Formatting a virus affected harddisk

Caution: Do not forget to back-up your important files.

You might not necessarily have to reformat your hard disk if your computer has anti-virus software that's being updated regularly. Scanning your system for the infection might work, or if not, then try to go online and find the solution on how to remove such kind of infection. It may be easier than a reformat for you will need to re-install everything that were installed on your machine.

Is this a desktop or a notebook computer? If it is for a desktop and familiar with computer hardware, and have access with another desktop that has a regularly updated anti-virus software, another option might be to pull out your hard disk and plug-in to that computer. In doing so, you need to assign you infected hard disk as a slave hard drive. For a notebook you will need an USB hard drive adapter that will be plug into a USB port of a desktop or another notebook. Now you can scan and hope fix the problem.

If unsuccessful with the above steps and have the disc (usually misplaced or lost) for the OS re-installation, then reboot your computer, and while on that process you can see a display on how to run setup, depending on the brand name and model of your computer. This will access the BIOS setting of your machine. Change the way how your computer will boot-up using access to the CD/DVD as first on the list. Save settings, then exit. Again re-boot your computer with the OS installer disc on the CD/DVD drive whatever the disc drive maybe. Follow the display for instructions on how to re-install the OS. Make sure that you reformat the hard disk for a fresh re-install of your OS.

Hope this helps.

Okay, you have an infected hard drive and you have determined that your best course of action is to reformat, to simply wipe the drive and start fresh. However, consider this fact.

When you format a drive, all that happens is that the file allocation table is re-written. So, from the point of view of the computer, the entire dataspace is now available. This is similar to what happens when you delete a file. The OS removes the file reference from the file allocation table, and then the computer is free to write new data to that particular physical location.

However, all of the code which was on the drive before you formatted is still there. It occurs to me that a really clever hacker could write a very nasty virus to take advantage of that fact. I don't know that anyone has actually written such a monster, but the prospect frightens me. For that reason, I always prefer to use a zero-fill utility, which will write zeros to your entire dataspace.

So, first question, what kind of hard drive do you have? If you have a Western Digital, Seagate, Maxtor or Quantum, you can go to the manufacturer's website, www.westerndigital.com or www.seagate.com for Seagate, Maxtor and Quantum, and download the instalation utilities, which include formatting tools, partition copying tools, and a zero-fill device. If the infected hard drive is not one of the afore mentioned brands, but is in a machine that has one of the mentioned drives, the installation tools will almost always allow you to use them to re-work the affected disk.

So, you have downloaded and installed the installation utilities onto a clean computer. Run the utility and, following it's instructions, create a bootable floppy disc, CD or flash drive, and use this to boot the infected machine. The computer will then boot directly into the installation utilities program, bypassing the hard drive entirely.

Once into the installation utilities program, flip through your options until you come to something that says "Zero Fill a Drive". It is usually found in something that looks like "Maintenance Utilities". Once there, run the zero fill device and and select the "Full" option. Execute the command, and then go get a cup of coffee, as it will take some while. But rest assured that once complete, your hard drive will be clean and virus free. Then simply reformat the drive using the installation utilities, re-install your OS or whatever you need on the drive, and you're back in business.

If, however, the infected drive is not a Western Digital, Seagate, Maxtor or Quantum and you do not have one such in your computer, it is best to seek the assistance of an advanced nerd, as it does get rather involved, and things like Fdisk are not for the uninitiated.

Be sure that you have your OS and other programs and drivers on cd or floppy disc so that you can reinstall them. If you have a Hp or Compaque computer, they come with a system restore disc. These do not have the OS and other bundled programs on them. All they do is run a program that restores the installed software to factory original settup, they do not reinstall the software. So when you format your hard drive on these machines you are stuck with a paper weight instead of a computer. Also these companies do not have support for formating and reinstalling software.

If you do have your operating system on install-CD and you have saved your important files you will need a physical level formatting, like the good old "Prefor" program wich does surface analysis. Than will really erase everything from the HDD (it can take several hours). The other way is to "Ghost" an other HDD to the infected one. Tha also will erase the original content without checking it.

Thanks for the message and the replies, it seems general, i do have backed up the data which was imp , i do have the operating system, i have not followed the system of formatting as explained by you'll . I have previously tried, but i feel there may be virus infection in HDD as there is some non consistancy of the performace of some programs , that why i suspect some virus infection in the disk, as usuall i am not as expert as you'll , hence asking for the required perfect method to reformat and also i do not have one antivirus installed , op sys is win98.and follow the screen message while scandisk and fdisk but may be some thing worng?, what other dos commands work to write in mbr area and to wirite "0" sor "1" s on the disk as everybody says to wipe out the any virus while formatting ?, Can you'll help on this problem in detailed commands of the dos and the steps while formatting the disk . Thanks for the reply and i am trying to analyse the methods also suggested.

If you want to make sure the virus is off of your hard drive, there is only one sure way of doing it. Write zero's to it. We use a program called GW Scan although there are others available. GW Scan is a product of Gateway Computer and is available from their web site. They use some programing from Western Digital along with some of their own to make GW Scan and it works good. It is free (or it was when I sold my computer business a year ago) and would work on any hard drive.

It completely writes zeros (o) to the drive thus eliminating anything and everything on the drive. Once done, you have to reformat the drive before you can reinstall the operating system again.

Download GW Scan and copy it to a floppy disk, CD, or memory stick if your computer will boot from a memory stick. Go into your bios and change the bios so it will boot from the floppy, CD, or memory stick as the first boot device. When the machine boots it will come up with a blue screen saying GW Scan on the top. Use the down arrow key and go down to the line that says "write zeros to drive" select that and let it write the zero's. It will take a while so make sure you let it finish. After it has finished do a complete test of the drive by choosing one of the other line items on the menu. This test will let you know if there are other problems with your drive.

Some others have mentioned backing up files and doing other things to save your data. Just make sure your data you save has been checked for viruses after you save it so you don't reinfect your machine. Also, be aware while not real common, viruses can infect your bios and memory (RAM). there are free programs for checking those also.

Good luck.

Randy

There is software around on a bootable CD or DVD that will "clean off" the virus and leave your system working as before......this is the way to go if you have valuable data or photos.

In the future make sure that you have at least 2 physical hard disks, one for the system and all installed software, the other for your data. If you have money for a third, make backups of your data and images of your system disk.

I cannot recommend Win98 anymore either, unsupported.

WinXP Pro is what I use on 3 Laptops, one portable and a normal PC......its not perfect, but it is a lot better than everything else in the Windows forum.

Make sure you have SP 2 and all fixes installed, keep your anti virus software up to date and make sure that you have a software and a hardware firewall.....install ad-aware, spybot and spyware terminator, all free. Run them all at least once a week, seperately of course! Install a rootkit sniffer, run it once a week too.....

I have found that low level formating is the best way to repair drives that have been infected. resetting the partitions and then reformating them makes all the data that was on them unusable and overwrites the data with nulls. Additionally several companies make programs that will wipe drives clean of all recordings and return them to the conditon your drive was in following manufacture. Same process used by the government to remove sensitive data from drives being disposed of or surplused.

I backup my notebook and desktop once a week on Saturday with Norton Ghost. I backup to a external USB drive and have a boot disk to restore the disk image from the external drive. I work from a thumb drive during the rest of the week and keep a log of anything I add or install during the week. Keeping the install programs on the thumb drive or a CD.

If I get a virus that I can't remove (even from a quarantine folder) I simply reformat the drive with a permanent eraser and use my Ghost Boot Disk to reload the week old image from the external drive. Then I add the weeks worth of work or installs from the thumb drive and CD. Walla I'm back without reloading everything.

Another way is to keep a duplicate hard drive imaged one week behind. Switch drives for a quick fix and then reformat the virus infected drive. Then do a disk to disk image copy every week until the next switch and then repeat the above steps. You still need to keep the weeks worth of work on a thumb drive and keep a log of additions or installs. Having a duplicate drive is expensive but a VERY quick solution! I would only use this method on my desktop!

Formatting is good enough to make all data/program inaccessible to any OS.

Get a clean boot disk/CD and format from there. To be safe, use fdisk to remove partitions first and recreate them before formating.

Pineapple