can a hdd be cleaned without running Windows?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by @hometechy, Mar 28, 2011.

  1. @hometechy

    @hometechy Private E-2

    Hi there,

    I'm trying to help a friend with her computer. She brought it to me hoping I could help her recover some files because it would no longer boot Windows.

    I tried to boot Windows. It showed me an error message saying missing file "msvcrt.dll". Then when I tried to boot in safe mode it said there were multiple missing files.

    Then, using advice received in a different forum on majorgeeks, thank you :), I used a newegg adapter to disassemble the hdd from the computer, then attach it to my laptop using the adapter, so I could view the files and help her find the specific ones she needed right away. That whole process worked well, I didn't need the mini-tool data recovery software to read the drive, just the adapter. What I discovered when I read it is that the hdd has no available space left on it. Less than 50 bytes if I'm remembering correctly. I scanned the drive with Comodo Security before transferring files, and it did find 10 trojans and 1 malware. Comodo cleaned them.

    Now, she has purchased an external hdd and wants to transfer the contents of her entire computer to the external hdd. I'm concerned about possible viruses being transferred along with the information and wanted to know if there's a way to use the Read & Run Me First information and tools on an external hdd connected through my laptop via the adapter? That way I can clean it before I move the information over.

    Any advice would be greatly appreciated, thank you. And if I'm in the wrong forum could you tell me which one to post in please? I didn't know if this should go in malware, hardware, or software. Thanks again,
     
  2. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    The tools will detect and scan any connected external storage devices.

    dr.m
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually SUPERAntiSpyware and Malwarebytes can scan the files system of other drives. But they would not see anything related to the registry of the external drive since it is not actually running. Thus any infections within the registry would remain undetected. To perform proper complete scanning it would still be necessary to boot the drive and OS that is infected.

    ComboFix and MGtools are more designed to be run from and to scan mostly the drive that boots Windows. Thus they will not really do scans on the "external drive". In fact MGtools will not scan it at all and ComboFix may all do a very very small amount on it.

    Thus, it you wish to have more detail scanning of the "external drive" just run full scans on it with an antivirus program and even follow up with an online scanner too.
     
  4. @hometechy

    @hometechy Private E-2

    Thank you for the advice. I will scan it entirely with Comodo Internet Security free version. I'm unclear regarding what type of scan would constitute an "online scanner". Could you recommend one please?

    Also, once I'm done transferring the files to the external hdd she bought, would it be ok to reinstall her hard drive in her cpu, reinstall Windows XP and start fresh again with her computer and have the files on the external hdd? I guess what I'm asking is if I have to first reformat her hard drive before installing Windows again, and if that will erase the BIOS settings? And can I transfer programs back onto her cpu once it's reloaded with Windows? How do you know if you're getting all the "pieces" you need when you transfer a program? Do I need to move these questions to the software or hardware forum?

    Thanks again for the advice regarding cleaning the external hdd while it's connected to my laptop. I look forward to learning what is meant by an "online scanner".
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    See the ones mentioned in this link: Alternative Scans

    Without knowing what infections you may or may not be dealing with, this cannot be answered properly. The safest thing to do is delete partitions, recreate partitions, format, and then reinstall. There are some infections that can survive a format which is why removing partitions is necessary.

    No you cannot just copy installed programs back. You must reinstall them.

    Yes you need to ask questions like this in the Software or Hardware Forum based on the topic of your question. ;) Even the how to do repartitioning/formatting/reinstalling are questions suited for the Software Forum.
     
  6. @hometechy

    @hometechy Private E-2

    Thank you for the advice. I removed the hdd from the cpu and then attached it to my laptop via the sata/ide to usb 2 adapter. I scanned it with Comodo Internet Security and Malwarebytes. I then backed up all the files I could onto an external hdd, not all files would transfer over, I assume they were the system files and the program files. I reinstalled the hdd into the cpu and started it up. Eureka! It started Windows. Now I wanted to run the READ & RUN ME FIRST steps on it, however, when I go to control panel, it won't open the System folder, it says: "C:\Windows\sysstem32\rundll32.exe Application not found". It only offers Ok as an option. Same message when I try to open add or remove programs.

    This computer is not connected to the internet, I was going to download all scans off my laptop and transfer them over via usb. The other thing I was going to note about this computer is that it has a 38.2 GB hdd, with only 542 MB of free space. I was hoping to free up some space by deleting programs and antivirus programs that she doesn't need, however without being able to get into the control panel or the add or remove programs spot, I'm unsure how to proceed.

    Should I shut it down and restart it using the Avira method mentioned before? Should I use uninstall programs for various antivirus programs through usb and hope it uninstalls any it finds? I also have the original disk she used to run Windows, a shared copy from her brother, I try not to judge. Should I reboot with that in place instead? Will that delete everything from her system or only replace the missing files?

    Any advice would be greatly appreciated. Thanks for all the advice so far, I wouldn't have gotten this far without the team at Majorgeeks!
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Does this file actually exist? Look for it to see and check the file size and date. Also check Properties/Version info to see if it is signed by Microsoft.

    You cannot run scans let alone Windows itself with so little free space left. This is not a malware forum topic. You need to address this elsewhere.

    Remove all temp files, pictures, videos, downloads,...etc. Assuming you already backed them up, you don't need to keep them as they are not necessary to run Windows.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds