1

I have a windoz xp disk that got infected by a virus, a particularly nasty one that hides in a gazillion places and 'activates' on many actions including plugging in any usb device, file writes, etc.

I want to completely erase the files, not just mark the file deleted. So, using an ubuntu 12 live CD, I figured I could shred the C directory and eliminate the threat. So, to shred everything, I needed to follow each directory recursively.

I used the following command:

find * -exec shred -f -v -z -u {} \;

For 20 gb of data, the shredding lasted about 28 hrs.

After it was completed, I viewed the directory using: ls -l. I expected to see no files. What I saw instead was each filename with a green background. There were a few filename withouth the green background but the text was in green. So, what the heck does the green background mean, and more importantly, why are the files still there?

2

2 Answers 2

2

If you want to get rid of Windows, it would be far easier to just delete the Windows partition. This can be done with the GParted software program which is available from the software center. To delete the partition:

  • Open GParted and type in your password when prompted to grant it administrative privileges,
  • Locate your Windows partition and right click it to make sure it is not mounted ("Unmount" selection should be greyed out, click it if it isn't),
  • Select the Windows partition and click the Remove button, which is denoted with a red X,
  • As long as you are sure you don't want to risk keeping any important Windows files, click "Apply" and proceed.

To explain the problem you are having with shred: The -u option Deletes the files, but does not remove them. It is possible for the data of a file to be deleted, but the file's record will still remain in the filesystem.

What you are seeing with the ls command is basically the file system's record of the file, rather than file data. The reason shred was written that way is because the command is often used on a device file for a hard disk or something, such as dev/sda, and you don't want to delete those. To remove files after shredding them, use the --remove option.

5
  • ok, ty, I understand now...yes, the file contents are scrambled but the name is in the directory structure. As far as gparted goes,I considered using that, but, it was not clear to me that it would do a 'low level format' of the disk, e.g. a cylinder/sector/track erasing and then building the format structure. If it does, then that would have been the easiest way to go. I really wanted to eradicate this virus - I just hope it didnt attach itself to the boot block. Thanks Jul 30, 2013 at 3:26
  • "Select the Windows Partition and click the Remove button..." I don't see a Remove button. I see a red circle with a line through it and hovering mouse over it causes a tool tip to be displayed:"Delete the selected partition" Is this what you are saying? Jul 30, 2013 at 4:26
  • At this point, since you've shredded the files, they are not of concern anymore - so you might as well remove the partition. However, you are correct to use shred before doing this (if the virus is really as powerful as you assume), because when you do remove a partition, it simply removes the hard disk's record of the partition, not the partition data itself. It's a similar concept to removing/deleting in shred. You can use shred on partitions with shred -vf /dev/sdXY where XY is your partition's location.
    – Richard
    Jul 30, 2013 at 14:39
  • If you are concerned about the boot block, you can just use Boot-Repair to reinstall Grub and it will be overwritten. help.ubuntu.com/community/Boot-Repair
    – Richard
    Jul 30, 2013 at 14:40
  • I am concerned about the boot block. I'll probably just use my disk inspector and manually fix the block and zero the rest. And yes, deleting a partition only removes the structural information, not the actual data. BTW, I did use the 'remove' switch, -u - truncate and remove file after overwriting. That is why I was suprised to see directorys and file names around, eventhough the file size was 0. I expected to see then file names gone. thanks for the help! Jul 31, 2013 at 1:47
0

If you want the file names to be completely removed from the disk after shred just add -u as an option, as shown below

shred -vzu -n 5 filename.txt

The above command shred filename.txt

v - show progress

z - add a final overwrite with zeros

u - truncate and remove file after overwriting

-n 5 in 5 iterations

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .