(Probably) a simple Macrium image question?

slipd · 19 Nov 2014 at 10:56

Hi guys,

I've got a Macrium image that I need to restore which I know has malware on it. I'd like to rid the image of malware remotely from a clean system so I open the image but then I find this window:

a little bit contradictory... I want to be able to write to the drive don't I? But then I don't want the changes I make to be temporary and then discarded :confused:

I'm confuesed, which options should/shouldn't I be checking?

darael · 19 Nov 2014 at 11:21

It sounds like you're trying to remove the malware directly from the image. I don't think that this is possible.

slipd · 19 Nov 2014 at 11:23

darael said:
It sounds like you're trying to remove the malware directly from the image. I don't think that this is possible.

That's exactly what I'm trying to do

KIA · 19 Nov 2014 at 11:31

Do a clean install of the OS and restore personal data from the image.

slipd · 19 Nov 2014 at 11:36

Hmm, I'll be honest, its not my image and I want to spend as little time as possible on it, but you're right, a clean install would probably be quickest...

Before I do though, there's definitely no other way as is?

skyripper · 19 Nov 2014 at 11:39

Theory;
Mount the existing image as a drive
Make it Writeable
Clean it with antimalware programs
Use Macrium to create a new image from the mounted drive?

If not
Dump the image onto a spare drive
Clean it
Reimage it

?

bledd · 19 Nov 2014 at 11:40

I wouldn't waste time trying, but you could restore this to a virtualbox machine, clean it, make a new image.

Might be a bit funny with the 'changed hardware'

darael · 19 Nov 2014 at 11:45

If you know the image has malware, then you could restore the image then load Windows into safe mode and run anti-malware programs, such as Malwarebytes and Adwcleaner.