How to transfer safely files from old laptop to new laptop when old had trojan horse on it?

Hello,

The situation is a bit tricky. But there are multiple ways to sort it out.

Anyway, firstly, there is not enough information to give completely accurate advice, and it is not entirely clear how and under what conditions you performed the actions (in particular with the USB flash drive; and what is state of your old laptop).

Then, it depends on how much time, opportunities and technical desires you have. Like something straightforward, but riskier; or risk-free, but maybe more challenging.

For example, I would probably try booting the old laptop using a "live CD" system or tool (if laptop has a CD drive) or a "live USB" system or tool. Then, by using it - I would transfer the files I need from old laptop's filesystem to a "safe" and "clean" external drive (HDD, SSD, USB, SD), which I would then use on the new laptop. With old laptop - I would do the routine offline (if technically possible), without an internet connection.

// "live CD/USB" can be there as a some generic operating system (Linux) or some kind of dedicated Rescue disk; which possible to use as bootable media.

As a long-term solution, I would probably prefer to try to cure and fix this old laptop. Again, options are: boot the system using RescueCD/Tool or any dedicated LiveOS OR scan old laptop live with more tools or scanners.

Previously, many AV / cyber security companies offered something like rescue disks, live disks or other solutions that could be used here. I do not know who still does this. More accurately, I know, but only one was able to help me recently (when I wanted to test some things). I am sure there are much more options. You just need to decide what to use, get it from an official source (after reading the instructions), and proceed carefully. There are also more specialized solutions, or the option of using a live operating system in the same way and manually trying things out.

Depending on how old your old laptop is, what operating system it is running (or how old) and whether you are still using it online, you might want just to try installing additional security solutions and scanning the system. Look at the results. Or you could use online scanners like F-Secure Online Scanner as an initial check. Then, backup required data and maybe to reinstall operating system there.

But back to your certain situation: since detection occurred only after a manual scan, then it is possible the "dangerous" files were only static; so, USB flash drive did not get any 'spreadable' malicious items from the old laptop during transfer / connection. But it is better not to run anything indeed.

u536604.vbs and u454686.dat looks suspicious.

but without any context (like path) - it is almost impossible to say either it is a false positive detection or something dangerous.

as such - surely - .vbs file can be dangerous.

"Opera GX scheduled assistant Autoupdate 1787902790" is even more obscure without context.

When you wrote that "old laptop had trojan horse on it" ("old laptop is infected with Trojan horse virus") - did you mean these three detections as a source of this statement? Or there was a story with old laptop and its compromised state is based on that?

My question is how to proceed and how to be sure the transfer is safe?

Without repeating all the points above:

• if 'required files' are already on your USB flash drive.
• if it is unknown either USB flash drive is now 'dangerous' or only static suspicious files there (which are undetectable).
• if 'required files' are something like text files or sort of data and documents.

just connect USB flash drive to your new laptop (maybe without network connection), scan USB drive by F-Secure, transfer only required and likely 'safe' files to your laptop. Unplug USB flash drive. Scan files once more (placed in your laptop). Connect to Internet. Scan it again.

if files are 'publicly' available - you can try check it with some websites like VirusTotal. And / or by verifying their hash (SHA512 or something like this).

if 'required files' are some executables (.exe, .msi) or some potentially dangerous files (like modifications to other applications or sort of) - then - there are ways to 'safely' transfer them. But I am not sure that it is really possible to check if files are surely safe.

if important documents were received from third-parties - then maybe some tricky payload in them. Such as .pdf or Office files can be exploitable against some vulnerabilities in viewers/editors. Or just be with a payload.

Since you tried to contact the official support team, I think it is better to keep in touch with them. Maybe they do able to assist you remotely. Otherwise, a bit more information is required to a precise advice.

Thanks!

Hello,

@RGFF

So it is just documents, photos and power point presentations along with some videos from my university. So nothing really dangerous about them I suppose.

In this case, if the files you need are already on the USB flash drive (from which F-Secure on your new laptop has already moved some items into quarantine), I suggest plugging in that drive, manually locating required files (documents, photos, PowerPoint presentations, videos), and copying them onto your new laptop's file system.

Just in case - scan them manually using F-Secure (and 'verify' that they are not replaced; such as - there are indeed documents, photos.. and not executables with look-a-like filenames/logos).

Risks are:

• in old terms, malicious things could inject a dangerous payload into all other items and files within a compromised system (such as "old laptop"). Modify them or do something else. In this way, "safe" things would also come to pose a threat per execution or accessing them.
• while browsing content of a USB flash drive - there are maybe still present some 'malicious' or 'dangerous' stuff from an old laptop, that were not (have not been) detected by F-Secure. Usually, just presence of such files does not necessarily mean that a problem will arise (for that to happen, they would need to be, for example, an exploit targeting a system vulnerability or some other weakness somewhere).
• if USB flash drive itself is now compromised in general. Utilizing, again 'in old terms', something like "autorun" or related mechanisms, where there would be no "safe" way to begin viewing the contents of a flash drive.

In my view, all three of the points mentioned above are unlikely in your situation. Or (with the second point) can be mitigated by proceeding with caution. Like perform only necessary job (manually transferring only the required files without any 'extra' actions around and avoiding access to potentially dangerous 'areas' of USB flash drive).

But I am not sure about possible additional information around and why F-Secure Support Agents definitely suggested to unplug and do not touch it at all.

Microsoft Defender is constantly giving alerts for virus threats for these two files ( in the photo above ). On display both of the antivirus software says it is Trojan Horse.

I think, I can't see that photo now. But if you were referring to the one from earlier (screenshot showing .vbs and .dat items in Quarantine), then sometimes it is a generic term and can be a false positive detection. But .vbs and .dat pair is a rather suspicious combo. And it likely points to something more within the system or surrounding it.

It's important to figure out where the file/item is located, or what is causing the notification about it to keep appearing. Why don't these solutions perform a cleanup or something like quarantining?

I tried removing the virus with Safe mode and with the antivirus applications but it was not successful.

Such as - did they fail to make it (like saying 'impossible to do', 'cannot' or sort of)? Or just did 'malicious item(s)' reappear then again and so notifications about them after supposedly removal process?

I contacted the team but seems they did not understand what I wrote because their reply was for me to check for fake threats or something similar..

well, maybe because this is a fairly popular one with FakeAVs and fake / deceptive notifications claiming that trouble(s) have been detected on your system. Typically, such notifications originate from the browser or some browser's addons. Can be from installed software as well.

But, yes, in your case that's not so (looks like?!).

// as a speculation: is it possible that all detected items in your old laptop are placed / detected in some sort of email software like Outlook or its archive? This could explain why notifications about them keep appearing and why there are difficulties with clearing them out. For example, these are 'stored' emails containing malicious attachments. If they are related to .dat or .vbs files, which F-Secure was able to move to quarantine from USB flash drive, then the situation is a bit unclear (because - probably it should not be so then). Still, that's a possibility. If so - the threat is rather static. And this is not the same thing as a complete compromise of the system on your old laptop.

In general, most of stuff like current TR-type malware and script-based one (.vbs) are likely require an active network connection to be real dangerous. Kind of 'first' step to your system. To get either command or further item; or transfer something from your system. OR just be manually executed/launched.

Otherwise, it would be something like ransomware (to encrypt your system) or completely old-fashioned ones (to wipe your system). So, more visible impact right away. Without any long-term 'threat'.

Without precise information on how all this started, what exactly is being detected, and so on, I would minimize the use of that old laptop while it has an active internet connection; in other words, I would isolate it. Because it is unknown what risks and consequences might arise. Especially if, for instance, it's somehow related to infostealers or any fileless stuff.

As for clean-up or fixing situation..

For example, Microsoft Defender likely includes an "Offline Scan" feature / option. You can try using this as an alternative to mentioned rescue disks / LiveCD/USBs.

It should be visible somewhere in Virus & Threat Protection - Scan Options within Microsoft Defender (Windows Security) UI.

I think tools like 'Kaspersky Rescue Disk' or 'Avira Rescue System' support installation onto a USB drive. And can be used as a bootable media with built-in scanners. But I don't know whether such actions are actually required in your case.

Maybe, enough to scan your system with some third-party tools / scanners as a second opinion. Such as: Emsisoft Emergency Kit; Kaspersky Virus Removal Tool or HitmanPro (I am not sure if it is still free to use; but looks like Sophos offer would allow to use it as a free trial). Or a bit more lightweight tools like: ESET Online Scanner; Trend Micro HouseCall; Or as I already suggested, even more light, F-Secure Online Scanner. Malwarebytes is also frequently recommended (though I would only try it if other tools haven't helped; or to check, in case you don't want to make any manual adjustments yourself). And I do not think I've ever tried current McAfee Malware Cleaner - I am not sure what it is capable of. But mentioned things are likely will cover all possible 'engines' and 'opinions' on your system safety.

And yet.. if the main concern is to get the files off the USB flash drive, then, well, just go ahead and do it. In general, F-Secure should even provide an option to scan a storage device when it is inserted into a laptop, before it is used. And if something (potentially dangerous) launches automatically when a USB flash drive is inserted, that has already happened the last time.

PART ONE.

Sorry for the delay with my reply.

I have tried removing the virus via safe mode, since it showed me it was in temporary files. It was good for few days and then appeared again.

It could be due to visiting a (compromised) website, the presence of a tricky scheduled task in the system. Or something else entirely (like if certain software trying to update itself, but it is a hacked/compromised version).

OR some other trouble within system (the presence of additional malicious or unwanted items cannot be ruled out either; and being undetected / unknown for scanners / security solutions). Which will create them in temp locations.

Therefore, it is useful to determine (or try to understand) whether something common or something 'specific' occurred at the moment it reappeared.

Based on provided photo - well - there is definitely something suspicious with your old laptop. And situation is already unclear (how old laptop's system 'got' it; via installing something from the web; or just inserted tricky media like flash drive with a malicious paylod). But I will touch this at the end.

As for when I plugged in the USB flash drive… I plugged it in then auto play button appeared on the right but i clicked on the " x " so I guess it did not run? Then immediately went on to scan the USB drive.

It's generally unknown. What's more important, really, is whether there was any malicious item on the USB flash drive that might have automatically attempted to become active upon plugging-in (in any way).

But that is not particularly likely in your situation (I think). Because, in that case, this specific vector should have become the target. And if you simply copied files over from an old laptop, any "harmful" stuff are most likely stored in a 'static' state; they pose little danger unless you manually execute or access them.

I mean, more likely, situation is about something generic and 'light' rather than something highly specialized or multi-vectored.

But if to suspect that your USB flash drive has become a source of a malicious payload after being connected to an old laptop (for example, if the USB drive's icon in the system has been replaced by a shortcut pointing to a malicious script or executable file; because this is how usb's viruses/shortcut-type works), then just try to double check that your new laptop without tricky named folders in System32 (as per further discussion). Probably your actions were a mitigation against impact. But better do not repeat inserting USB into your old laptop for now.

Last 2 days F secure has not detected anything suspicious on the new laptop either, so I believe all is good?

It's always a bit "risky". But I think so, yes. Because if the only sign of a threat on a new laptop was the detection of two (or three) items during a manual scan, then no significant compromise of the system had actually taken place. These were some "dangerous" files (in terms of running or opening them) that had been copied from one file system to another.

However, in general terms, if two laptops are connected to the same network and one of them is infected with a particularly dangerous type of malicious stuff, it could pose a threat to all other devices on that network. And this depends on the specific configuration of both the individual device (the laptop) and the network as a whole.

But based on the description, it seems that only the old laptop has some sort of trouble for now, the extent of which is unknown, and these are likely limited to that specific device only.

and also something strange with the device protection settings regarding the core isolation. It constantly turns off on its own when I turn it on. ( I turn it on today and next time I use the old laptop it is off without me doing anything ).

For a device running Windows 11, this is indeed strange.

However, the "Core Isolation" (Memory Integrity) feature - I think - relies quite heavily on compatibility with other components and may sometimes require specific configuration adjustments.

For example, older devices may be incompatible due to specific graphics card drivers. Or, it is sometimes necessary to enable a particular thing within the device configuration.

Windows might automatically disable this feature (after an attempt to enable it) to avoid conflicts. However, I think that if this is due to an incompatibility, the UI should inform you and specify exactly what is incompatible.

Perhaps there is some information about the causes in the Windows "Event Viewer". I am not sure. Third-party drivers could very well be the reason for this (I am not sure if Windows 11 silently disables Memory Integrity or provides list of them).

I am also not sure of the best way to investigate why this is happening or how to fix it. I would suggest making sure that Windows 11 has all the latest updates installed, and also checking whether hardware virtualization is enabled (which is required for Memory Integrity) and stuff like TPM 2.0 in use (which is likely should be with Windows 11).

There is a random Microsoft Learn / Q&A topic with some general advices about checking thing around; And this is an official 'documentation' article about: https://support.microsoft.com/en-us/windows/security/windows-security/device-security-in-the-windows-security-app#bkmk_coreisolation with some explanations of its design.

// I will split my reply to avoid limitations.

end of part one.