Nasty virus and files on USB drive

[velko-live]

Hello to all,

please help me with good guidance and sorry for the bad english(google translate). Let's start from the beginning. The other day I caught the "janma Coin Miner" virus. I first tried to fix it with Kaspersky Virus Removal Tool and Kaspersky TDSSKiller. Then I tried Windows Defender and Windows Defender Offline. I absolutely could not remove it. He detects it with the Defender, removes it and then returns again. Then I decided to reinstall Windows as the only way to get rid of the virus. Before that, I took and copied several files that had not yet been backed up, with a delay of about 10 days, and saved them on a formatted flash drive.
So the important question for me is how can I safely check if the files on the flash drive are infected so that I can save to the reinstalled Windows. Only to add if there is a way to do without installing programs with virtual Windows (at the moment I can not remember names).
Thanks in advance to anyone who can give me advice.

 

[X71200]

Grab Malwarebytes Premium Trial, and have it ran. It works both real time and do a check on the USB stick, they have a good database / hierarchy.

 

[TxGrin]

Defiantly use Malwarebytes it should clean it.

 

[64K]

Malwarebytes is a very good anti-malware program. If it won't get rid of the virus then I don't know what will.

 

[lexluthermiester]

Hello to all,

please help me with good guidance and sorry for the bad english(google translate). Let's start from the beginning. The other day I caught the "janma Coin Miner" virus. I first tried to fix it with Kaspersky Virus Removal Tool and Kaspersky TDSSKiller. Then I tried Windows Defender and Windows Defender Offline. I absolutely could not remove it. He detects it with the Defender, removes it and then returns again. Then I decided to reinstall Windows as the only way to get rid of the virus. Before that, I took and copied several files that had not yet been backed up, with a delay of about 10 days, and saved them on a formatted flash drive.
So the important question for me is how can I safely check if the files on the flash drive are infected so that I can save to the reinstalled Windows. Only to add if there is a way to do without installing programs with virtual Windows (at the moment I can not remember names).
Thanks in advance to anyone who can give me advice.

The data you copied is very likely unrecoverable and needs to be considered completely unsafe. Format the drive and be done with it to prevent further infection!! Next, stop visiting web sites that fall under the category of " I-Should-Not-Be-Here.com " (this includes, but is not limited to, pretty much all porn sites)! Next, practice safe computing methodologies: Take nothing for granted and consider every website you visit unsafe until proven otherwise. Use Firefox with the extensions "HTTPS Everywhere", "UBlock Origin", "Noscript" and "Cookie Autodelete". Learn how to use those extensions and they will make your browsing experience a MUCH safer one. Finally, use common sense. When in doubt, don't!

I'm sorry if this sounds a bit harsh, but your virus infection was completely preventable and with a bit of time spent learning how, you can protect yourself in future. It is no one's responsibility but your own to protect yourself. Learn how and you will avoid things like this.

 

[Hachi_Roku256563]

if those files are infected they are gone
malwerebytes wont be able to clense them
honestly Lexs post seems a bit over the top
just run sketchy files through virustotal and keep everything up to date

 

[lexluthermiester]

honestly Lexs post seems a bit over the top

I error on the side of caution and don't care if it seems "over the top". Better safe than sorry.

 

[Hachi_Roku256563]

I error on the side of caution and don't care if it seems "over the top". Better safe than sorry.

I mean sure and thats fine nothing wrong with that
but im no where near that careful and the only time i got malwere was when a website i used got comprimised
it was rather easy to remove also

 

[Toothless]

If Malwarebytes doesn't get it, just nuke the drive.

 

[lexluthermiester]

I mean sure and thats fine nothing wrong with that
but im no where near that careful and the only time i got malwere was when a website i used got comprimised
it was rather easy to remove also

I have more to protect than the average user, so I am much more cautious as a result.

 

[Hachi_Roku256563]

I have more to protect than the average user, so I am much more cautious as a result.

yeah the way i use my computer i could lose it all without majour issue
(we are getting of topic)
i think its say to say the file is gone
but use malwerebytes to remove any infection left

 

[velko-live]

To ask if I have infected files on the flash drive, can I infect my computer, just by inserting the flash drive, without opening or copying anything.
Thanks to all.

 

[jboydgolfer]

I error on the side of caution

err on the side of caution

MBAM & Defender are sufficient.
kaspersky seems like a virus to me, as is norton, & the two i mentioned are the only 2 i trust from experience.
a few times a year, MBAM goes on sale, and you can get a year of protection, for 3 3PC's/devices for like $20

 

[micropage7]

first is clean the pc/laptop since if you don't clean it, it will be back and infect your drive

 

[lexluthermiester]

To ask if I have infected files on the flash drive, can I infect my computer, just by inserting the flash drive, without opening or copying anything.
Thanks to all.

Not unless you have files that will auto-run on insert. However, if you access them you might trigger an execution, so it's best to delete them.

err on the side of caution

My usage was correct given the context of the statement. Remember, context is important.

 

[Bill_Bright]

He detects it with the Defender, removes it and then returns again.

I error on the side of caution and don't care if it seems "over the top". Better safe than sorry.

I'm with Lex on this one. But if me, I probably would not even bother with formatting the drive, I would have taken a hammer to that flash drive, buried it at the bottom of the trash bin, then stood outside to watch and make sure the trash collector dumped it into the truck and drove away.

Flash drives are today's floppy disks. The only time any one of my systems ever got infected was when a co-worker brought an infected floppy in from his home, stuck it in my work computer without telling me, then forgot about it. The next morning, not realizing there was a floppy disk in the drive, I booted my computer and BAM! Never again have I allowed any portable storage device get attached to any computer (business or personal) I've been responsible for unless it was my portable storage device that was never out of my own possession or control.

That method of malware distribution is where infection by "sneakernet" came from by the way - though we had combat boots on.

So the important question for me is how can I safely check if the files on the flash drive are infected

Funny how a missing "not" can change the entire meaning of a sentence.

Anyway, IMO, the only way to safely check to see if the files are "NOT" infected is to attach the flash drive to a stand-alone, "sacrificial" computer. That is, a computer that is not connected to any network and that does not contain any personal data, or is needed for any important task. Then scan the heck out of it with everything you got. And FTR, I agree with using Malwarebytes and Windows Defender.

I also agree with Lex when it comes to avoiding infestation. While I blame the bad guys for being evil ba$tard scumbags and for creating and distributing the malware, the blame for becoming infected falls on the user as the user is ALWAYS the weakest link in security.

The fact of the matter is, it really is simple to keep our systems clean - especially with W10. Just keep the OS current, use a decent anti-malware solution and keep it current. And avoid being "click-happy" on unsolicited links, downloads, attachments and popups. Of course many of those bad guys are pretty clever con artists, often tricking even the most security aware users into clicking on something we shouldn't - "IF" we let our guard down. So never do.

If you are not the sole user of a computer, and you are the one responsible for that computer, educate those other users, ensure they have their own limited user accounts, and restrict their access.

kaspersky seems like a virus to me, as is norton, & the two i mentioned are the only 2 i trust from experience.

LOL I have to laugh because I have pretty much felt the same way for years - especially with the Russian "state sponsored" Kaspersky! Of course Putin denies it so it must be true! But that's for a different discussion.

 

[MentalAcetylide]

The data you copied is very likely unrecoverable and needs to be considered completely unsafe. Format the drive and be done with it to prevent further infection!! Next, stop visiting web sites that fall under the category of " I-Should-Not-Be-Here.com " (this includes, but is not limited to, pretty much all porn sites)! Next, practice safe computing methodologies: Take nothing for granted and consider every website you visit unsafe until proven otherwise. Use Firefox with the extensions "HTTPS Everywhere", "UBlock Origin", "Noscript" and "Cookie Autodelete". Learn how to use those extensions and they will make your browsing experience a MUCH safer one. Finally, use common sense. When in doubt, don't!

I'm sorry if this sounds a bit harsh, but your virus infection was completely preventable and with a bit of time spent learning how, you can protect yourself in future. It is no one's responsibility but your own to protect yourself. Learn how and you will avoid things like this.

The real issue isn't with any one particular industry(i.e. porn). The problems start when individuals go to some random website and try to get something for free(pirated videos, images, software, etc.) that they would otherwise have to pay for. I could be wrong, but given the amount of money that particular industry rakes in, most of the well-established "pornduction" companies have much better security on their websites than what most would think.

Backups & Deep Freeze by Faronics works for me.

 

[lexluthermiester]

The real issue isn't with any one particular industry(i.e. porn). The problems start when individuals go to some random website and try to get something for free(pirated videos, images, software, etc.) that they would otherwise have to pay for. I could be wrong, but given the amount of money that particular industry rakes in, most of the well-established "pornduction" companies have much better security on their websites than what most would think.

I was just making an example.

 

[MentalAcetylide]

LOL I have to laugh because I have pretty much felt the same way for years - especially with the Russian "state sponsored" Kaspersky! Of course Putin denies it so it must be true! But that's for a different discussion.

heh, I wouldn't trust anything security-related coming out of Russia. The whole thing with Yeltsin was just a change in the overdress appearance of its government so that they wouldn't be kept isolated from the west and further drive its economy into the ground. As we can see, they got more $$$ and allies now, so things continue in the same general direction as they did during the cold war.

 

[xrobwx71]

(this includes, but is not limited to, pretty much all porn sites)!

cough cough, except for Pornhub.

The fact of the matter is, it really is simple to keep our systems clean - especially with W10. Just keep the OS current, use a decent anti-malware solution and keep it current. And avoid being "click-happy" on unsolicited links, downloads, attachments and popups. Of course many of those bad guys are pretty clever con artists, often tricking even the most security aware users into clicking on something we shouldn't - "IF" we let our guard down. So never do.

This...
I manage multiple systems at work and home and somehow, keep them virus-free. On the Win 10 systems, I only use Windows Security/Defender. The last time I can remember an infection was Windows XP.

I do, however, sometimes purposely infect a VM to see how it works.

 

[Mussels]

if those files are infected they are gone
malwerebytes wont be able to clense them
honestly Lexs post seems a bit over the top
just run sketchy files through virustotal and keep everything up to date

thats not a bad idea, virustotal is probably a wise move for anything critical.... but he's also gotta be prepared to wipe everything yet again if the drive is contagious

 

[Caring1]

Defiantly use Malwarebytes it should clean it.

And definitely.

 

[Mussels]

Wait i'm an idiot!

Use a bootable USB with Linux on it to recover the files, windows viruses cant hurt linux!

Mint or Ubuntu should work just fine

 

[Hachi_Roku256563]

Use a bootable USB with Linux on it to recover the files, windows viruses cant hurt linux!

i mean cleaning thouse files is still not easy
also just do puppy linux

 

[Mussels]

i mean cleaning thouse files is still not easy
also just do puppy linux

point is, connecting the USB drive wont pose any risk doing it that way