USB OS Installation. Am I at risk of installing a virus as well?

[Ursidae]

Hypothetically speaking, say you have an unused 8GB USB 3.0, a physical copy of Windows 8.1, a virus infected laptop with an optical drive, and a new computer with no operating system. What would happen if I the USB and disk and into the infected laptop and create an image file of the CD and then burn it to the USB? Will my USB be infected? And if I try to put the infected USB into the new computer will the new computer be infected? I know there are many other routes to installing an operating system but in this specific situation is it likely that the USB will be infected and transfer to the new computer?

[dragoon20005]

yes the USB drive will be infected by the virus

 

so it is not advise to use the infected computer to burn any disc or create a bootable USB drive

[lekro]

I'm thinking that it's possible and probable. But I wouldn't want to deal with virus-infected computers anyway. I'd perform a clean wipe of that computer before attempting this.

 

More possibilities:

- Virus won't infect anything else.

- Virus will infect USB stick but won't get into Windows installation

- Virus will infect USB stick and will get into Windows installation, thereby corrupting it

- Virus will infect USB stick and will get into Windows installation, but won't corrupt it, leading to a second infected computer.

[Syntaxvgm]

yes the USB drive will be infected by the virus

 

so it is not advise to use the infected computer to burn any disc or create a bootable USB drive

oh lord

 

I'm thinking that it's possible and probable. But I wouldn't want to deal with virus-infected computers anyway. I'd perform a clean wipe of that computer before attempting this.

 

More possibilities:

- Virus won't infect anything else.

- Virus will infect USB stick but won't get into Windows installation

- Virus will infect USB stick and will get into Windows installation, thereby corrupting it

- Virus will infect USB stick and will get into Windows installation, but won't corrupt it, leading to a second infected computer.

yes. 

[dragoon20005]

oh lord

 

yes. 

am i wrong?

[colonel_mortis]

It's highly unlikely that a virus would be able to infect a windows image, because that would have to be very specialised malware. However, the USB drive itself could in theory get infected, which then makes it possible for your new computer to become infected straight away. The best way to write to the USB stick would be to download a linux distro onto your infected computer and boot into that, then copy the disk onto the USB drive in linux, where 99.99999% of malware will be dormant. That is also the perfect opportunity to run a virus scan.

[Syntaxvgm]

am i wrong?

You are not wrong, but that's highly, highly unlikely. 

[dragoon20005]

You are not wrong, but that's highly, highly unlikely. 

ok but we dont know what virus he got on his PC

 

so I assume the virus will cling onto any removable media

[SlayerOfHellWyrm]

It's highly unlikely that a virus would be able to infect a windows image, because that would have to be very specialised malware. However, the USB drive itself could in theory get infected, which then makes it possible for your new computer to become infected straight away. The best way to write to the USB stick would be to download a linux distro onto your infected computer and boot into that, then copy the disk onto the USB drive in linux, where 99.99999% of malware will be dormant. That is also the perfect opportunity to run a virus scan.

Not to make people paranoid... but considering there's been proven examples of working BIOS, and USB firmware malware, it's entirely possible, albeit incredibly unlikely something like that is in the wild, and you'd stumble across it. That stuff tends to be done in labs as a proof of concept, and then used to try and patch security holes.

[Syntaxvgm]

ok but we dont know what virus he got on his PC

 

so I assume the virus will cling onto any removable media

Right, but even if it did, installing fresh off of it won't affect anything unless it's specifically designed to affect Windows installations. There are very complicated ones out there, but so rare. I mean that's why you are not wrong, what you are suggesting is basically just somewhat unnecessary safeness, nothing wrong with that. 

[dragoon20005]

Right, but even if it did, installing fresh off of it won't affect anything unless it's specifically designed to affect Windows installations. There are very complicated ones out there, but so rare. 

actually when i think of it

 

thats how cracked Win ISO works

 

it has a toolkit in it to run a script during installs

[colonel_mortis]

Not to make people paranoid... but considering there's been proven examples of working BIOS, and USB firmware malware, it's entirely possible, albeit incredibly unlikely something like that is in the wild, and you'd stumble across it. That stuff tends to be done in labs as a proof of concept, and then used to try and patch security holes.

Exactly, hence my use of "highly unlikely" rather than "impossible".

[Syntaxvgm]

actually when i think of it

 

thats how cracked Win ISO works

 

it has a toolkit in it to run a script during installs

but that's  a tailor made one. Again, you are not wrong, it's basically like wearing two condoms if that was safe or effective. No reason to, but wouldn't hurt. That's a bad analogy. Don't wear two condoms, it'll break. 

[dragoon20005]

but that's  a tailor made one. Again, you are not wrong, it's basically like wearing two condoms if that was safe or effective. No reason to, but wouldn't hurt. That's a bad analogy. Don't wear two condoms, it'll break. 

understand mate

[SlayerOfHellWyrm]

Exactly, hence my use of "highly unlikely" rather than "impossible".

This is true. I've seen some incredibly scary malware in the controlled, and completely disconnected lab at my old university, and I've read about so many worse ones in security blogs, and IT security websites. Some of the stuff they've made is like a freakin' phoenix. You kill it, but it has the ability to re-write itself (almost).

[KemoKa]

use a linux distro to burn the image. Part of the reason why Linux is so secure is that a) no self-respecting virus programmer would write viruses for Linux, meaning they total about 43, b ) a virus written for windows is not going to have a single clue what to do if it met a Linux iso ("what's a kernel?") and would be useless even if it could jump on board, c) Any virus written for Linux can't do any major damage because it doesn't have root access or the root password which is kept under constant guard by both layer upon layer of security protocols and the IQ of the user's brain, and d) most people who use Linux these days are rather educated, smart and tech-savvy people who know not to give an unnamed program the root password.