Remove drive and scan on another PC

[David Petsuch]

If I remove a drive from a PC and use a USB converter to attach it to another PC, is Malwarebytes able to scan ALL files in all profiles?

I know that in Windows file explorer you can get privilege errors if you try to view certain profiles.

[AdvancedSetup]

It can scan all of them already without removing the drive. However it is better to have MBAM installed and running in the real environment to do detection and removal.

[David Petsuch]

It can scan all of them already without removing the drive. However it is better to have MBAM installed and running in the real environment to do detection and removal.

Yes I do know that but I mean a system that's infected to the point you have to remove the drive to scan it on another PC. Does it scall ALL files?

[RubbeR DuckY]

In theory as long as the user profiles do not have a password it SHOULD work. I don't think we have simulated this in the lab so please do keep us up to date if you end up trying it.

[Firefox]

In theory as long as the user profiles do not have a password it SHOULD work. I don't think we have simulated this in the lab so please do keep us up to date if you end up trying it.

RubberDucky just so you know, I have performed what this user is asking, and I have been able to do a scan the whole drive, but it the profile was set to private, then you can not access the files, but if it had a password on it, you can still see the files. If they are private you would have to take control of the folder. Of course by doing that, if the user had encryption enabled on those folders, they could loose all files that had the encryption.

If you are interested in the exact steps I take, then send me a PM and I will explain in further detail, as doing it here would or could cause problems if someone decided to follow those steps. (I am in the business and know what I am doing so I would know how to recover if something happened).