Spyware, Viruses, & Security forum

General discussion

Can any virus survive reformatting the hard drive?

by baggypants / December 7, 2004 4:44 PM PST

I have heard from a couple of sources that some viruses or perhaps worms or Trojans can remain intact on a hard drive even after it has been reformatted. I recently inherited a computer running Windows 2000 that was badly infected with over 1000 viruses. Norton AntiVirus was able to clean, repair or quarantine all of the viruses, software was reinstalled, the computer seems to be working normally, and no viruses are now found on a comprehensive full system scan.

I was warned by a local computer technician that even though the computer scans clean and is working well, that I shouldn't put it back on our local network because there is a small region on the hard drive that is not overwritten by normal formatting and some viruses are known to hide there. He suggested that it was still possible for this computer to infect other computers on our network.

That seems difficult for me to believe. All of our computers are running virus scanners. It would seem to me that, at least if it were a known virus, it would be recognized and stopped immediately if it reappeared and tried to spread to another computer.

Has such a threat ever been documented? Is there any reason to fear that this computer could be harboring a significant threat to other computers on the network? If there were a virus or other threat that is so invisible and difficult to remove, wouldn't it be just as reasonable to think that it could be present on any computer with similar protection?

Any insight offered is greatly appreciated.

Discussion is locked
You are posting a reply to: Can any virus survive reformatting the hard drive?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Can any virus survive reformatting the hard drive?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: Can any virus survive reformatting the hard drive?
by Donna Buenaventura / December 7, 2004 11:41 PM PST

Yes, it is possible but it depends on what infection you got before because some virus (rare but there is) can survive an FDISK & FORMAT. See a very interesting and useful discussion in http://www.dslreports.com/forum/remark,6347364~root=security,1~mode=flat

Collapse -
Re: Can any virus survive reformatting the hard drive?
by Bob__B / December 7, 2004 11:51 PM PST

First, a high level format does not over write much of anything, which is why you can do that and with the proper tools extract almost anything you want.

A better method is to use a hard drive eraser util, find one with google. 'Autoclave' maybe.

Perhaps your tech is referring to HPA, host protected area.

Find it with google, good bed time reading.

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by R. Proffitt Forum moderator / December 7, 2004 11:53 PM PST

The office had such survive. They forgot to scan diskettes and CDs and the pest was in a Word document.

"The cat came back the very next day."

Then we have the old "Boot Sector Virus". Formatting with say DOS FORMAT doesn't overwrite such.

And YES, all has been written about many many times.

The lesson was simple. All uptodate antivirus and to scan not only the PC, but all media in the building.

-> But today I find that formatting is rarely the right answer. The tools we have now save us from such work.


Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by oliverkazaam41 / December 9, 2004 1:23 PM PST

How will we be able to clean the workstations on a network if it has already spread?? Any suggestion on to do it without formatting? please I realy need an answer

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by bforst / December 9, 2004 7:10 PM PST

I wouldnt think that a virus could survive a low-level, or zero-fill, format of the hard drive.

Anyone know if this is tru?

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by icee1 / December 9, 2004 7:17 PM PST

if the entire space of the drive is zero filled, no, it cannot survive, but if there is a partition, then, it is possible.

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by cmarch / December 10, 2004 3:22 AM PST

No, virus can't, if you do this process...

Run your DOD wipe, then run

fdisk /mbr

That re-writes your master boot record.
(Thus overwriting any boot sector viruses)

then run fdisk to delete all partitions, then
recreate the partitions.

Then start reinstalling you software.

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by kjr59 / December 10, 2004 6:56 AM PST

fdisk /mbr worked for me. My son picked up a few problems downloading songs and infected the whole home network. After MANY attempts to reinstall the OS, a friend of mine told me to try this,,,,, never had the problem again. Get anti-virus software (I use Norton) and get daily updates from the web page. Also a firewall or in our case the router helps also!

Collapse -
erasing --everything--on laptop

ok so if you do decide to erase everthing on -in my case, laptop; there is a way to save some of the stuff right, however -for example- you put the info you want to keep on a disk, you would of coars put that back on so you may keep that info, BUT if the virus is on that 1:how do you know your scanner will or did get it? 2: what if it spreads, would the scan be able to find it, and hopefully get source?

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.

Try to find out first if it is really infected:

It is always recommended to disconnect any system from the network while in the process of disinfecting.

Do not modify, open or save anything if there is an infection.

Turn off the system instead of shutdown to prevent any malware in modifying or creating new processes or startup items (some malware renames itself or replicate each time Windows restarted or shutdown)

Boot the infected system using rescue disk instead of booting from hard-disk. Doing this will prevent the malware in running (hopefully)

Use an uninfected system to download the following:

TrendMicros' Sysclean Package - it will terminate all malware instances in memory, remove malware registry entries, remove malware entries from system files and scan for and delete all malware copies in all local hard drives. Read the readme_sysclean.txt on how to use it.


Use those tools to scan the system for malware or infection.

Do not turn off System Restore (if enabled and if you are using an OS that has this feature) until the system is cleaned.

Create a backup of important files and datas regularly.

Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by westerntony / December 11, 2004 7:23 AM PST


Collapse -
Re: Can any virus survive reformatting the hard drive? Yes.
by torex / December 10, 2004 9:02 AM PST

Trend Micro's PC-Cillin had a good review on CNet (or somewhere), the review said that Trend Micro's software is better than Symantec or McAfee.

But if you ever do a DOS format again, may I suggest the Format command with the /U switch. The U means Unconditional. A friend of my Son-In-Law told me that erases everything.

If you have a Western Digital Hard Drive, you can use the floppy diskette that comes in the retail box. There is a utility on that diskette that writes zeros to the entire drive. It takes a while, and I'm pretty sure it writes zeros the boot sectors also. You can contact Western Digital and ask the techs that question.

good luck.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by icee1 / December 9, 2004 7:11 PM PST

hard drives keep an area of the drive reserved for cashe usually 2-8 mb , i suppose it is possible a virus could survive there , when formatting the drive if you first delete the partition that should prevent the possibility

Collapse -
Surely it is dependant
by sheard / December 9, 2004 8:23 PM PST

If you remove Partitions
Then Format the recommended 3 seperate occasions
The chances are very remote
However there are now Prgs. which wipe your disc entirely to remove Data one of these would also serve your purpose.

Collapse -
What is a "low level" reformat?
by mdgoldbe / December 9, 2004 9:47 PM PST
In reply to: Surely it is dependant

What is a "low level" reformat?

Collapse -
Re: What is a "low level" reformat?
by masterdon / December 9, 2004 10:56 PM PST

The LLF was frequently done in the good old days with older hard drive. You can not do an LLF on new hard drives. Only the manufacturer is capable of doing so. However, LLF has been replace by zero-fill and is better than LLF. It writes zeros to every sector and will remove any nasty things. BUT you have to do so for every physical hard drive and every partition. Also as wisely mentioned by others, if you stick an old CD, DVD, of floppy you recorded and it was infected - back she comes! Safest thing is to run the DOS format command (C:>format "drive letter") then erase the MBR (Master Boot Record) by C:>format /mbr. Then run any of the many utilities that do a zero-fill from a boot floppy or CD. Be sure your BIOS is set to boot from hard drive first, then CD, then floppy or you will never see these devices after formatting. These utilities are numerous and can be found via a Google search.

Collapse -
Re: What is a "low level" reformat?
by what_now3 / December 10, 2004 12:27 AM PST

The "little" things are sometimes the most important.

" Be sure your BIOS is set to boot from hard drive first, then CD, then floppy or you will never see these devices after formatting. "

Those of us who need to ask the question, need the "one and one are two"

I am sure the answers were all brilliant but still left a lot of "huh??s"

I'll print them out and reread. By the way what's an "OCD" or something like that in a later ans. from gsteele I think? can't flip back while writing this so I get to sound even dumber than I am--be nice now.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by pablomdb / December 9, 2004 9:55 PM PST

First, the question is: what kind of formatting are we talking about? I can assure that NO VIRUS written for PC can survive a partition deletion, followed by a complete low-level format.- Even if you don't wipe remaining data, and even if the string of the virus may remain on any sector, (supposing you don't perform a zero-writing on the hole drive after formatting), it can't be a threat, even if a virus scanner detects it, it doesn't have chance to execute itself because it remains as that, as any string of data not wiped, waiting to be overwritten any time by disk usage.-

To conclude: if "surviving", applied to PC software viruses, means "existing in the disk", the answer to the question would be "yes, it can survive a format".- If surviving means "existing as a potential threat", the answer is NO.-

Collapse -
Re: Can any virus survive reformatting the hard drive?
by genos79 / December 9, 2004 10:01 PM PST

sorry to say but they can I had a 120gb hard drive gave to me and it had a virus in the boot sector we found out that it takes a special software to remove it we had to run this before we re formatted which we didnt and we wound up throwing it away cause we couldnt get rid of it after that

Collapse -
Re: Can any virus survive reformatting the hard drive?
by Gsteele / December 9, 2004 10:47 PM PST

Here's the deal: create a boot floppy with format, sys.com, and fdisk on it. Scan it with a virus checker to make sure it is clean and free of boot sector viruses. Take it out and set the write protect tab. Turn the computer OFF (clears RAM and clears on-drive disk cache). Boot the machine from the floppy (may require changing boot order in the BIOS screens). Run FDISK /MBR; this cleans and resets the boot sector of the hard drive. Note that boot loader and extended BIOS utilities will die, so you'll have to reinstall things like Toshiba's manager, WD, Maxtor, etc/ xbios utilities. If you do, make sure you virus scan the disks from which you will be running these utilities before you start this process. Turn the computer OFF. Run FDISK and create (a) new bootable partition(s) (primary, DOS)on the hard drive. Turn the computer OFF. Reboot from floppy and FORMAT /s the new partition. Change the boot order in the BIOS and boot from the hard drive, then install whatever OS from CD. The drive map structure so created cannot have any executable virus code unless your virus checker was not up to date and the boot floppy or disk utility disks had viruses that the checker did not find.

If you are concerned with bit patterns on the hard drive that reflect data that used to be on it, for business security reasons, that is a different issue. To eliminate such patterns, you do need to run a sector overwrite utility that alternates ones and zeroes on successive passes. DoD requires a very large number of passes, depending on the security level of the data. As a practical alternative, Steve Gibson's Spinrite left running overnight on highest level deep pattern testing will vaporize low-level magnetic remnant patterns if done after the ones and zeroes overwrite mentioned above. If you have OCD, throw the drive in a barrel with a hand grenade and buy a new one.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by tolley / December 10, 2004 2:00 AM PST

Worth noting, Norton Ghost (2003) has Gdisk, which can be set to wipe the disk with as many passes as you want, far beyond the 7 passes required by the Department of Defense. Easy to use, too.


Collapse -
Re: Can any virus survive reformatting the hard drive?
by Toscane / December 10, 2004 3:25 AM PST

The answer is : PERHAPS
But there is one thing NO viruses can survive : The removal of the primary DOS partition of a hard drive.
Using the FDISK command , remove any and ALL partitions of a hard drive including the primary partition. What is left is a dumb piece of metal that holds NO data nor viruses. Using the same FDISK utility, recreate your partitions and you can be certain that you have a clean hard disk.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by nkchebli / December 10, 2004 11:55 AM PST

A few suggestions to keep in mind:
1- Install either norton ghost 2003 or norton ghost 9, depending on your O/S and hardware and back-up your hard disk next you format, preferably on a dvd media if possible, otherwise on a different partition.
2- You could also install some sort of software such as "GoBack" or "RestoreIt".
3- Keep your antivirus up to date.
4- Always try to have a reliable firewall from a reputable company. Windows XP firewall is not good enough.
5- Enable automatic weekly virus scans of your entire computer.
6- Avoid executable downloads (programs, etc.) from any P2P or unknown sources.
7- Make sure not to share any of your drives on a network including a home network. Simply create ONE FOLDER through which you share whatever you want in order to keep a close watch on the data being accessed.

I personally use norton ghost 9 very extensively and a full back-up of the entire operating system exists on rewritable dvd's. For practical purposes, I have also installed "RestoreIt" to reset my C Drive if or when necessary. This combination is fool proof and works excessively well for me. I never needed to reformat my computer after afterwards.

Good Luck!

Collapse -
Re: Can any virus survive reformatting the hard drive?
by Mendieta / December 10, 2004 7:50 PM PST

Have you ever tried to delete a non-windows partition with fdisk?, Other operating systems create partitions that fdisk does not erases, modifies & in some cases doesn't even see them, as an example: Linux creates partitions like: Minix, ext2, ext3, swap, etc., Solaris (Sun Unix Operating system) creates Solaris Partitions & so on.

So, if anyone thinks that Fdisk will solve any virus problem he is completly wrong, because there can exist things that Fdisk does not manage.

Now, low level format is done only by the manufacturer of the disk, not by users, the best solution is to use a wipeing tool from the disk manufacturer, it wipes the hole HD (most of it) writing zero's no matter what OS the hard drive has on it or types of partitions, then you can Fdisk, MBR, format your HD, to install again Your OS & Software.

Another tip: Fdisk only writes the two first sectors of a hard drive, the first one holds the partition(s) data (Do not get confused with the partition itself) it just holds the way the hard drive is partitioned & the second one holds master boot sector (do not get confused with the OS boot sector) it just holds the code that looks on the drive for an Operating system to boot it, if any data is writen after that two sectors, fdisk does not overwrite them, fdisk /MBR does just the same, that's why you must Zero (wipe) your disk before using Fdisk & format.

Hope this can help you or anyone else.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by Mendieta / December 10, 2004 8:02 PM PST

I said "Master boot sector" & "OS Master boot sector", I must say: "MASTER BOOT RECORD" & "OPERATING SYSTEM BOOT RECORD", sorry ... =0)


Collapse -
Re: Can any virus survive reformatting the hard drive?
by bob t / December 11, 2004 8:18 AM PST

I have a Dell Dimension 8100 which is now 4 1/2yrs old.
This computer does a system crash every 3-4wks. So in the time I have owned it you can compute how many re-installs I have done.
I sanitize my HD before doing a 'clean re-install'. I do it as follows:
1. go into the BIOS and move CD drive to the first
position. Then I disable HD and FDD.
2. to sanitize I use "Wipe Drive" from Access Data
(accessdata.com) this is one of many DOD type of
disk cleaning programs. I set the program to do
seven overwrite passes, then I go to sleep as it
takes all night, about 20hrs, okay sometimes I
cant wait so I only set the program for three
passes which takes about four hrs, I think.
3. when this is done I go back into the BIOS and
enable the HD and FDD.
4. next I re-install my OS which reformats the hard
drive before re-installing the OS(Windows 2000
Just a side note, my Apple IMac G4 17" flat panel has
not crashed in the three years I have owned it and it
was $2300.00 versus my Dell which was $2600.00, my Apple has a bigger HD, firewire, usb ports, flat panel
screen and super combo drive which burns CDs and DVDs. The Apple costs less, does more and seems to be totally stable.
So much for Dell, Intel and M$.
Good luck, bob t

Collapse -
Re: Can any virus survive reformatting the hard drive?
by baggypants / December 12, 2004 12:55 AM PST

Wow!! As this was my first post to this forum asking for help, I'm blown away. Thank you all for sharing your knowledge and experience, tips and tricks. This been a real education for me. I did take the time to read through the excellent but lengthy discussions that Donna pointed me to in the first reply. It was too much to fully absorb in one read but it was clear that this is a complicated and contentious subject. The good news is that there are clear effective fixes for the problem if it exists in a now have tools and procedures to restore a hard drive to as delivered by the manufacturer.

The one thing that wasn't spelled out anywhere was how the virus or Trojan or worm was detected after each attempt at reformatting or at anytime other then by running an up-to-date VirusScan. Can Norton AntiVirus 2005 with the latest virus definitions see these polymorphic worms and viruses in the master boot record or sector zero or if they were written on the cylinder? Each of these things were reported but without explanation of how they were detected. If the virus scanner can see these things but doesn't find them, do I need to worry about them?

The situation is further complicated by the introduction of malware, spy ware and other new inventions that a simple virus scanner does not look for. For these, I use Adaware and Spybot but from the threads even these programs are not sufficient. It appears that the only way to be certain that the system is clean is to periodically do mid-level reformatting and carefully overwrite everything on the hard drive. Thankfully, from a practical perspective, it is probably only necessary to go to these lengths when you have an observable problem.

Again, I greatly appreciate all of your wisdom, help and input on the subject.

Thanks and God bless you, Baggy.

Collapse -
Re: Can any virus survive reformatting the hard drive?
by Dobby / December 13, 2004 4:40 PM PST

If you delete the partion(s), and recreate same before formatting drive(s), you will have no problems!

Just formatting the drive(s) is not enough...you must start with a clean boot, when you reinstall any OS!

Collapse -
Re: Can any virus survive reformatting the hard drive?
by nyabdns / December 14, 2004 6:44 AM PST

Back in the day there were several viruses that could withstand deleting partitions and formatting and still survive and spread. I believe one of them was the Monkey B virus. The only way to get rid of them is to start at sector 0 of the hard drive and write over everything. We used an applet that used to come with Norton Utilities.

Collapse -
by mas76y / August 19, 2006 9:04 PM PDT

can viruses still remain after formatting a hard drive

Popular Forums
Computer Help 51,912 discussions
Computer Newbies 10,498 discussions
Laptops 20,411 discussions
Security 30,882 discussions
TVs & Home Theaters 21,253 discussions
Windows 10 1,672 discussions
Phones 16,494 discussions
Windows 7 7,855 discussions
Networking & Wireless 15,504 discussions


iPhone 8: Everything we know so far

This is all the iPhone 8 reports and rumors in one place. From a 5.8-inch OLED display, reports of wireless charging and even a 3D scanner for facial recognition, it's all here.