Member Avatar for Member #956681

I'm just curios.

Lets a say a person downloaded a trojan by mistake and the trojan gives a attacker commands and control to control the PC. If that happens a user can unplug the PC and pull out the hard drive to connect it to another desktop and format the hard drive so the attacker won't have access to the old OS they had access to.

User can put the hard drive back and then format the computer from beginning, but I think the attacker might have already know the users IP and other information.

What is your opinion?

  • 6 Contributors
  • 5 Replies
  • 304 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Tcll

Dani AI

Generated

Powering a machine down or unplugging the drive will immediately stop an attacker’s live session, but it is not a full fix. As stressed, the system should be isolated from networks first; as noted, killing a RAT process can sever an active connection but does not remove backdoors or stolen data; and, as warned, advanced threats can persist outside the running OS (hidden recovery areas, bootkits or firmware). Stopping a session only contains the incident — remediation and verification are separate tasks.

Recommended immediate containment steps:

  • Power off the affected PC and any co-located devices; cut all network access (unplug Ethernet, disable Wi‑Fi at the router).
  • Preserve the original drive if evidence or forensics may be needed. If analysis is required, image the disk using a hardware write-blocker or boot a trusted forensic/live USB and mount read-only.
  • Avoid attaching the suspect disk to a regular Windows desktop without write protection.
  • Use a separate, known-clean device to reset credentials and enable multi-factor authentication on email, cloud, and financial accounts. Assume credentials used on the infected host may be compromised.

Remediation and recovery guidance:

  • Prefer full secure-erase or replacement of the drive over a quick format. For HDDs, ATA Secure Erase or vendor utilities are appropriate; for SSDs, use the drive vendor’s secure-erase tool (tools like DBAN are not reliable for SSDs).
  • Reinstall the OS from verified vendor or official media. Apply firmware/UEFI updates from the hardware vendor and follow official guidance to reflash if firmware compromise is suspected.
  • Factory-reset and update router firmware; check for unexpected port forwards or remote-management entries.
  • Restore user files only from backups that have been verified on a clean system and scanned with up-to-date malware tools.

Prevention and follow-up: run with least privilege, keep systems and firmware patched, maintain offline (cold) backups, and enable MFA everywhere. For systems containing sensitive data or where persistence is suspected, engage professional incident response to ensure the compromise is fully removed and to preserve evidence.

Recommended Answers

All 5 Replies

Member Avatar for rubberman
  1. Plugging the drive into another computer may infect that one also, especially if it is also running a Windows OS.
  2. Yes, they may have your IP address, but if you are using DHCP, that will change when you reinstall the operating system.
  3. Once infected, change all user IDs and passwords when you restore your system.

  4. A lot of modern malware will also infect your recovery partition and/or boot sector, and/or your BIOS. So, do this as well:

    a. wipe your drive with a Linux system - you can boot a Linux Live CD/DVD to do that. Wipe the ENTIRE disc, including boot sector.
    b. reflash your BIOS.
    c. install Linux - it is much more secure from malware than Windows and Apple systems.

One other thing is to make sure you have disabled remote management of your router/firewall, and change its password as well (after disabling remote management), and CLOSE all forwarded ports you may have opened on your router in order to run games and such.

Member Avatar for jwenting

and oh, make sure to do all that while you're not connected to any network, including the internet.
Physically unplug network cables and turn off WiFi hotspots.

Member Avatar for vectramind

Thank you rubberman for your valuable advice

Member Avatar for Member #46692

oh and use linux ;)

Member Avatar for Tcll

^switching from Win to Lin is a hastle in itself...
you're better off sticking to win and upgrading your security.
I use Comodo Firewall and Dragon with Avast.

Avast - everyone knows what that does :P
Firewall - notifies you about a process or possibly harmful action and haults it as it starts.
Dragon - Chrome with Actual Security and Malware protection which runs on Comodo's DNS.

their DNS blocks harmful content before it even reaches the browser. ;)

anyways, back on topic...

I've let my friend infect me with a RAT before which gives him full control over my compy...
(about as choppy as plugging in a 2nd keyboard/mouse)

all you have to do there is terminate the process the RAT is running on.
(it'll short-circuit his end with an "error 404")
^he can't connect unless the host process is running.

Edited by Tcll
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.