What Malware Requires Formatting Your Hard Drive

For my computer security website, I want to include a section that tells what infections you should format your hard drive for if your computer is infected by them.

Right now I know Virut, Vitro, Sality, and Ramnit are some. Are there any others?

 

I've removed Virut without a reformat. Pretty much no malware requires a reformat - very very little will ever require it. Some might necessitate a bootCD but usually if you can boot up you can remove it.

The only ones that force a reformat are the ones that install, screw up (not on purpose), and do serious damage.

 

Really? I heard you should format because:

1. Infected files, even if cleaned are usually damaged from poor coding of the virus.

2. A backdoor is opened on your computer so you can never really trust your PC again.

 

there is certainly malware that merits reformat as cure
computerworld.com/s/article/9217953/Rootkit_infection_requires_Windows_reinstall_says_Microsoft

 

Microsoft never actually said to reformat, the article got it wrong iirc. You just need to do a fixmbr or have an AV remove it.

I got Virut and Vundo mixed up.

Anyways, anything a Virus can do can almost always be undone. Opens a backdoor? It can be closed. Patches files? You can clean them.

I've never seen a virus that couldn't be removed given the right amount of time/ motivation. Maybe an AV won't be able to do it (no definitions for it yet) but I've removed plenty of malware manually.

 

Couldn't it just be fixed with fixmbr? Like TDSS?

 

if i find ANY malware i all-ways reformat or reimage
no trying to fix it
error on the safe side

 

Yes, so as far as OP's question regarding "a section that tells what infections you should format your hard drive for if your computer is infected by them," I think there is no hard and fast answer. "Should" is the operative word here.

Whether the response to a given infection should include reformatting your hard drive is more of a value judgment than anything. Maybe an infection can or can't be repaired to your satisfaction with currently available tools but the value of trying to do so rather than reformat, or not, can only be judged by the affected user/owner of the system.

 

Very sensible approach!

Google doodle takes you to scareware sites
12 May 2011, 17:08
http://www.h-online.com/security/news/item/Google-doodle-takes-you-to-scareware-sites-1242208.html

----
rich

 

@Rmus I agree with that article and that is only one infection and it changed so many things and the only way is to reinstall Windows! And most Malware Hunters (Cleaners) will recommend that it is free of malware but to fully trust the system reinstall Windows is the only way unless you have a Clean Image!

TH

 

Just keep a "clean" Image in a safe place and you do not need to be concerned with formatting.

 

+1

 

Reimage or reinstall. Safety and stability first.

 

Win7 Antispyware 2012 that does the same, to anyone interested here's some removal instructions.

hxxp://www.bleepingcomputer.com/virus-removal/remove-win-7-antispyware-2012

I used sequentially Rkill, Malwarebytes, Combofix and finally the repairs from Windows Repair (All In One), from tweaking.com, and everything seemed to be repaired.

 

That.


The advice you want to give will totally depend on your audience. If you're talking to security professionals & nerds that can't leave their computers alone, then yes, you can compile a list of known crud that you should reformat after catching.

However, if your audience is the unsophisticated user, then if it were my blog I would recommend that they seek out a professional's help or reformat themselves. An unsophisticated user could see a list of viruses, they'll compare it to the list that norton spits out. If there isn't anything that matches then they could think they were safe.

 

Oh no. I have a step-by-step guide for removing basic infections, then an advanced guide that involves creating a Dr.Web Live CD, then I recommend they sign up and ask for help on this forum if they don't succeed, then at the bottom I list what infections warrant a format and reinstall. If you want to see the guide, check the link in my signature.