Author Topic: Trojan removal - Is it over?  (Read 3666 times)

0 Members and 1 Guest are viewing this topic.

Offline Foxpup

  • Hero Member
  • Species: Cyborg Fox
  • *****
  • Male
  • Posts: 1191
Re: Trojan removal - Is it over?
« Reply #25 on: December 06, 2010, 11:52:09 pm »
You could just slave the hard drive to another computer and run your antimalware software from there.

Two words of caution about doing this if you are using two Windows machines:

1. Windows XP, Vista, 7, etc. adds unique identifiers to the internal hard drives that you use in your system.  If you remove your internal hard drive from one Windows system and place it into another one it will change the identifier on the disk, the disk will become marked as "unallocated," and you will likely lose much of the data on your drive.  I found this out the hard way once when I moved a NTFS-formatted hard drive from the motherboard's IDE controller to a Promise Technology IDE controller card in the same machine.  Just changing what controller the drive was plugged into made Windows Server 2K3 think that it was a different drive entirely, and it automatically marked the entire drive as being "unallocated."  After trying several ways to recover the drive's file system I finally had to resort to using low-level hard drive recovery program to restore the file system of the drive, and even after all of that effort many of the files ended up already being corrupted.  Back in the FAT32 days you could swap your internal hard disks between computers at will, but thanks to someone's bright idea at Microsoft that is just not the case anymore.  Move your NTFS-formatted internal hard disks to and from Windows machines at your own risk!
Yeah, Windows XP and later have severe issues dealing with FAT12 and NTFS partitions (and the fact that they need to be installed to an NTFS partition certainly doesn't help). Sometimes, it'll just randomly corrupt the partition and ask you to reformat it (I don't think this is related to plugging the drive into another computer - I've had this happen to the boot partition on my secondary master drive, without even changing anything). DON'T reformat the drive, instead use a Linux boot CD to clone the filesystem, fsck it, then if all else fails, reformat, then dd the cloned filesystem back onto the reformated partition; or you can just copy the files off it and reinstall Windows. Whatever's easier.

2. Some malware (such as a Smitfraud infection that I once battled) will add autorun.inf files to the root directories of your hard drives, which will cause them to run the malware code on a computer as soon as the drive is accessed.  This is done with the specific purpose of infecting your second Windows computer if you place the infected drive in it as a slave or hook it up to your computer through an external hard drive enclosure.  So watch out, the malware writers could be one step ahead of you and may have thought of that already!
And that's why you disable AutoPlay.

Bottom line: Windows sucks and will make your life miserable.