If you had a virus, performed a FACTORY RESET without doing virus scan, do you still have the virus? (CD, hard drive)

[TAZORAC]

Ok, here's my interesting situation. Tried to download a game, then all sorts of spyware, adware, malware and probably viruses started downloading to my computer and taking over the memory. Eventually I started getting BSOD, and because the computer wouldn't stay on long enough to run my malware/virus scans, I was forced to do a FACTORY RESET. I went from WIN 10 to the original WIN 7 that the computer came with. Because I had to do a RESET all my stuff is out of date which is expected.

To make a long story short, what was a perfectly running computer before the attempted game download, now I have a computer that freezes, error codes when trying to install windows updates, and my internet crashes. So my question is, even after a Factory Reset, is the virus removed or do you still have to do a virus scan?

(My attempted AVAST virus scan won't even scan through..it gets stuck "compatibility check")


Also one more question...if your getting BSOD's...then how can you run win 10 in safe mode as the F8 button is disabled?

[NHDave]

There are rootkits and such that will survive a drive format, so it depends on the infection.

Safe mode: https://support.microsoft.com/en-us/...c-in-safe-mode

I suggest running Malwarebytes Chameleon https://www.malwarebytes.com/chameleon/

[stanley-88888888]

no. most factory resets use some form of dd so as long as long as the source image was clean then the virus wouldnt be replicated.

[rjm1cc]

My guess is that the reset brings the computer back t the state it was when you bought it new.

I think the update software for windows was changed by microsoft 6 months to a year ago. You will have to download the new windows update software. I think after that Microsoft also changed the way updates work so that could be a problem.
Might have to call Microsoft customer service for some help.

You can see if this helps. Windows 7 Won’t Update? Here’s What to Do | Plugable
Also search the Microsoft support. I think they have steps to update your system.
However I think this is a big problem due to changes Microsoft made so calling them might be the way to go.

[Labonte18]

It's possible you still have it, but unlikely.

There are viruses out there that infect system restore images and even the windows reinstall partition on the HDD. But, they're fairly rare.

I've rarely had a virus where I had to restore back to the image. Some that I just couldn't invest the time to clean them up properly.. Hard to tell a client "I billed you $1000 for my time cleaning this virus when I could have restored it to default and charged $100".. Unless it's on a critical machine or something.

Oh.. And the ransomware ones.. The ones that lock a machine and encrypt the files. There's usually no getting past that. You can remove the ransomware, but can't unencrypt the files. So.. No point in NOT re-imaging.

[ToucheGA]

Originally Posted by Labonte18

Oh.. And the ransomware ones.. The ones that lock a machine and encrypt the files. There's usually no getting past that. You can remove the ransomware, but can't unencrypt the files. So.. No point in NOT re-imaging.

That is true, at least for the most part. However, some options exist.

Anyone who has valuable data on their computer should backup regularly. If you have a relatively recent backup, you can simply reformat the hard drive, which will destroy the ransomware. Then it's just a matter of reinstalling the operating system, and the backup data. Be sure to use an external backup drive, and make sure that the external drive is physically disconnected from the computer after every backup. Otherwise, ransomware might encrypt the backup drive as well!

[Labonte18]

Originally Posted by ToucheGA

That is true, at least for the most part. However, some options exist.

Anyone who has valuable data on their computer should backup regularly. If you have a relatively recent backup, you can simply reformat the hard drive, which will destroy the ransomware. Then it's just a matter of reinstalling the operating system, and the backup data. Be sure to use an external backup drive, and make sure that the external drive is physically disconnected from the computer after every backup. Otherwise, ransomware might encrypt the backup drive as well!

I haven't tried one of the decrypters yet. Kinda wonder how long they take. What are they? Brute Force?

I know that some of them will get the recovery partition.. Which is why I always make a CD or USB backup of the recovery partition on any pre-built machine.

It isn't infecting something that's not plugged in.

[NHDave]

Originally Posted by Labonte18

I haven't tried one of the decrypters yet. Kinda wonder how long they take. What are they? Brute Force?

Decryptors only exist for ransomware that have had their keys released to the public. A decryptor app is then created to perform the decryption. Ransomware such as Locky and its variants have no decryptor and you won't be brute forcing it.

[TAZORAC]

I figured out why my computer was freezing, I thought the virus was somehow still lurking, but I had too many anti-virus/malware items downloaded. I had to delete Avast and Norton.

[skinsguy37]

Originally Posted by TAZORAC

I figured out why my computer was freezing, I thought the virus was somehow still lurking, but I had too many anti-virus/malware items downloaded. I had to delete Avast and Norton.

That will most definitely do it. Biggest rule of thumb, no more than one AV installed at a time. An accompaniment software like malewarebytes is OK, but definitely not two AVs at once.