Immunizing portable HDD

gabe22 · 30 May 2015

Hi

I just plugged in my porable HDD to another system today and after I connected it back to my system avast detected 50 viruses ".ink" type, as avast already caught the viruses so I'm not that worried but I would like to avoid similar situations in future as one may not be so lucky everytime.

Ofcourse I know I should be careful but sometimes you have to connect your devices to a system because you really need to/have to ....

Anyway I would like to know whats the best possible option to "Immunize my portable HDD" ... please advise.

Thanks in advance!

MoxieMomma · 30 May 2015

Hi:

Perhaps Panda USB Vaccine

Cheers,

gabe22 · 30 May 2015

I seems to be rather promising but what are the other options?

Also I was wondering if there is an way to make a certain portable storage device such as pen-drive or maybe a portable HDD with "Read-Only" mode .. for example if I'm transferring data on another system and I won't want to risk getting anything from that system, having a "Read-Only" mode and disabling write access alltogether somehow for that system or perhaps disabling write access for any system other than mine would probably help, thoughts?
Is it possible?

Callender · 30 May 2015

.lnk files are generally shortcut files. My guess is that Avast read the zone identifier and quarantined them based on tat information which tells it that the files originated on another machine outside the "trusted security zone"

See: Question about Restore points and Open File Securiy Warning

And also:

Open File Security Warning - Enable or Disable

See image in Option One here for example of blocked .lnk (shortcut) file:

Open File - Security Warning : Unblock File

There are lots of tools to monitor and block files tat attempt to run when plugging in a usb drive:

10 Tools To Protect Computer From Infected USB Flash Drives - Hongkiat

Personally I don't use any of them as my security software takes care of it.

Immunizing portable HDD-voodooshield-settings.jpg

gabe22 · 30 May 2015

@Callender

I think I understand what you said but maybe in this case thats not it(not sure .. i don't know much about security stuff lol) .. I'm just assuming based on the [trj] which is probably trojan .. detection in avast .. please see attached screenshot.

BTW Im thinking to get a new system with windows 8 probably and I'll be transferring number of files including .exe (applications), media files, web files (.php and other scripts etc) .. to the new system
And I had a possible rootkit infection on my system which used to create this/that files in public directory but avast seemed to detect them .. not the root of the issue(the file thats running the command to create this child-infected files within public directory) and I created the following post here: Possible rootkit infection? ... and ran number of scan/tests etc .. and somehow the issue stopped but none of the scans or anything really detected as in found the cause of the issue.
So basically I'm still a bit skeptical about transferring file from this system the new one and I have been wondering for a while if there is a way to make sure that once I have all the necessary data on my portable HDD, nothing fishy or malicious/infected is in there .. including rootkits etc(if any).

Callender · 30 May 2015

Your screenshot just appears to show a shortcut to a video file. Not the video itself but a shortcut to it. I'd say it's nothing to worry about and that it's a bug in Avast.

As for checking your files before transfer to another system - well get a properly configured AV with on access file scanning instlled on the new machine before moving files and aslo consider scanning your current machine with a rescue disk. Check out the entire video here for ideas and comparison of a few popular free tools.

Best Antivirus System Rescue Disk -

Other than that - please note that you'd probably get better help from one of the malware removal experts on this forum if you want to ensure that your machine is entirely clean.

Most experienced users here don't actually recommend Avast. I used it myself for a couple of years and had problems with missed detections and a high number of fasle positive detections. My rule of thumb is to only quarantine known malicious files that are detected and prompt the user for a decision on anyting else.

Callender · 30 May 2015

Re: External drive scan. It should be possible to scan it with any security software you've got onboard. You can use free tools like Emsisoft Emergency Kit or MalwareBytes to scan external drives:

Immunizing portable HDD-emsisoft-emergency-kit.jpg

Callender · 30 May 2015

Okay - looks like I'm wring about shortcuts. Check the Avast forum here and read a few posts down the page:

https://forum.avast.com/index.php?topic=52252.570

If you can upload any of those files to an online virus scanning service - see if you get the same detection.

gabe22 · 30 May 2015

Thank you for your suggestions, I'm reviewing the best antivurs url .. will post back if I have any questions ...

About .ink issue, I wish I could but I don't know how to, I mean avast already detected them as possible trojan(I think) and quarantined them ... so how do I get access to the file without compromising system security and upload them to online scanning services such as virustotal?

And also I'm wondering .. assuming what you said is correct, so that avast detection is a link to the video file and perhaps we can assume its harmless but it wasn't there before I connected the portable HDD to the other system .. so it has to be something malicious(which creates shortcuts to files for no reason or whatsoever) right?

Also I ran avast quick scan/ malewarebytes scan with rootkit detection enabled on the portable HDD already and so far no detection(excluding the first 50 detection by avast on device connection), should I be concered about the HDD? I mean is is secured or perpahs you can suggest a few more scans using some other tools, just to be safe maybe .. please advise.

gabe22 · 30 May 2015

Oh and I acutally created a post on avast forums after the rootkits auto genereated file detection continued randomly even after taking various secuirty measures ... https://forum.avast.com/index.php?topic=168033.0 , i followed almost all steps(except the "Dr.CureIt" as I could make up enough free time to run a scan that could take 12hour+ or more) they suggested and nothing fixed the issue, finally they suggesed that maybe something from online .. as in a website .. maybe a scirpt is creating those files in public direcroty .. I'm no security expert but I think that can't be the case(normally) .. probably because when malicious scripts from websites try to work it way on your system and if you have a decent AV .. it should detect and block the script right way .. and if worst case scenario .. a certain script is written in a way to bypass AV detection algorithm ... well then we're screwed really.
But I'm just assuming ...