1

Assuming I have a USB with virus/malware installed on it. I want to to the following:

  1. Boot my laptop via a live USB
  2. Unmount the hard disk on which my normal OS is installed on (the only hard disk on my laptop)
  3. mount the "infectious" USB
  4. Check what is on the USB stick / format the USB stick

*I don't mind formatting my live USB afterwards just in case.

Can this somehow damage my main hard disk?

Improve this question
1
  • It is probably not a problem, but ransomware writers are getting ever more inventive, so make sure you have top notch antivirus installed.
    – anon
    Commented Oct 7, 2020 at 15:18

2 Answers 2

Reset to default
2

When you just mount the possibly malicious USB stick and dont execute anything nothing should happen anyway. So you can safely mount it.

But if some malware gets executed this malware could (with root privileges) remount the drive and modify it (just like you could). But it is unlikely that it is intelligent enough to do so. It also coud modify BIOS and persist reboot that way.

So theoretically it might be possible that malware executes through a explloit in some program that accesses the USB drive. There is no additional security by using a usb live os, except from the (likely missing) intelligence to mount the drive.

You can't never be a 100% safe if you don't use a air gapped system and never attach anything to it (waht makes it useless for most cases)

If the malware does not uses an exploit in a program that is accessing the USB stick, you are fine without an additional live os. (Very likely)

If it does execute (very unlikely) and it is not programmed to mount the drives (likely) this live os helps, otherwise you have to hard unplug it.

If the malware gets executed and modifyes the BIOS, even that would not help.

Improve this answer
1
  • 4
    The OP should at least be made aware that BIOS and hardware firmware are places where malware can persist between reboots even in the absence of a disk or other storage media
    – Yorik
    Commented Oct 7, 2020 at 20:59
2

The USB could be registered as a keyboard and will execute the payload without the user running anything. While it could be that the virus was not designed for your Live OS, but assuming it was then as soon as you remount it it'll execute whatever is on it. The again as @jjj said it is highly unlikely that the virus was programmed to mount any drives.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .