[SOLVED] Are survived files from ransomware attack dangerous?

[AlexsvonMüller]

My friend just told me that his laptop attacked by ransomware and he told me some of his files is somehow survived, so he moves it into a flash drive and bring it to me. My question, since the flash drive directly connected to his laptop when the ransomware has done his job, is it safe to connect the flash drive to my laptop? (btw, I have spare hdd but I'm too lazy to swap it)

 

[Ralston18]

No.

Not safe.

The files could have been infected and should be AV scanned for ransomware. I would use at least two AV apps to do so.

Actually that would be a pretty good trap....

Just appear to infect/encrypt some files and then allow the "surviving files" to be copied or moved to another drive. Which, in turn, goes to another computer and the infection/encryption spreads.

Even if you copy the USB files to HDD - the problem(s) go with the files. Not the host storage device.

 

[AlexsvonMüller]

No.

Not safe.

The files could have been infected and should be AV scanned for ransomware. I would use at least two AV apps to do so.

Actually that would be a pretty good trap....

Just appear to infect/encrypt some files and then allow the "surviving files" to be copied or moved to another drive. Which, in turn, goes to another computer and the infection/encryption spreads.

Even if you copy the USB files to HDD - the problem(s) go with the files. Not the host storage device.

So basically, the hdd will be infected when I plug that USB? If yes, then how to remove those files from that USB?

 

[Ralston18]

Potentially yes.

I am using "potentially" because something would need to happen in order to activate or transfer the virus, ransomware, or other malware. For example if you copy an infected file from the USB to the HDD then yes the infection (active or not) could spread.

That is why people should not just plug in a USB drive that they find somewhere....

The other scenario being that an infected application file is executed when the USB is connected to the drive. Or some misleading pop-up appears the user clicks something that actually launches the infection process.

Scan the USB drive to look for viruses, ransomware, etc.. Again scan with at least two AV applications.

But do so on a system that has already been exposed to the USB drive and its' contents. Or a system that is well defended against infections via portable drives. Scan the USB drive and host computer's drives.

For more information:

https://docs.microsoft.com/en-us/wi...vice-control/control-usb-devices-using-intune