Yes. But if you have malware, you have bigger problems.
This is a question I’m resurfacing from nearly 20 years ago.
I have two reasons:
- The answer remains important to understand.
- The answer hasn’t changed. If anything, things have gotten worse.
It's not your PC anymore
If malware gets on your computer, you can’t trust it. Anything connected to it, including your external drive, could be at risk. The safest thing to do is assume the worst. Clean it up, restore from a backup, and start backing up every day.
Once you have malware…
There’s a very important and scary rule of thumb that’s worth remembering:
Once your computer is infected with malware, it’s not your computer any more.
You may think it’s yours. It may even behave as if it’s yours.
But it’s not. Or, perhaps more realistically, you can’t assume it is.
Why?
Malware can do anything.
That’s a difficult concept for many to comprehend. Let’s dive in a little deeper.
Help keep it going by becoming a Patron.
Related
What Security Software Do You Recommend? (2026 Q3 update)
My updated guide cuts through the hype with four no-nonsense steps to keep your PC safe. Learn what works, what to avoid, and how to stay secure without overspending or overcomplicating.#3517
What malware does
Most malware is written with a task to perform. Perhaps it’s designed to capture keystrokes. Maybe it’s designed to encrypt your data and hold it for ransom. Perhaps it’s designed to copy all your files to the hacker’s computer somewhere. Maybe it’s designed just to wreak havoc by deleting whatever it feels like.
Or maybe it’s designed to do everything, everywhere, all at once.
We can’t really know.
Thus, we must assume the worst: malware can do anything.
This seems particularly difficult for folks concerned about keylogging to grasp. Just because you’ve somehow blocked the logging of keystrokes doesn’t mean the keylogger — which is just malware — can’t capture your data entry some other way. Malware can do anything.
And, yes, that includes accessing whatever’s on your external drives. It’s one reason not everyone agrees with my position on leaving your backup drives connected all the time.
Unauthorized access to your data
The original question was prescient in at least one interesting way: it predates the concept of ransomware (or at least the major spread of it).
Twenty years ago, the questioner was concerned that the data on his external hard drive might be stolen or used in some unauthorized way. Now there are many more ways to get at your data that don’t involve your external drive. Online data breaches like account hacks are much more likely to expose your data. Even then, hackers aren’t really interested in your files (unless you’re a government or corporate employee with access to sensitive or secret things). They’re just interested in abusing your account for other purposes, typically spam-related.
These days, if malware accesses your external drives, it’s more likely to encrypt the data and hold it for ransom. Not all ransomware does this; in fact, only a small percentage of ransomware attacks involve encrypting external drives. Usually, it’s easier, quicker, and just as effective to encrypt the data on your system drive.
There’s no way to know
Here’s the frustrating thing about malware: once detected, there’s no way to know with certainty what was and what was not compromised. The only truly safe approach at that point is to assume everything has been compromised.
In other words, it’s not your computer anymore.
That’s a harsh and serious assumption to make. What we often do is play the odds. In a case like this, maybe we:
- Scan the external hard drive with an anti-malware tool or two. If it comes up clean, we keep using it, keeping an eye open for suspicious activity.
The catch is that you just don’t know that they’ve actually found and removed the malware you have — it could persist. So other people:
- Restore the system drive from a backup image taken before the malware infection. This is a great way to know it’s gone.
- If you don’t have a backup image, then reinstall Windows and your applications from scratch, and restore your data from a backup copy.
Many people balk at reinstalling Windows, and I get it. It’s a big deal.
Do this
This is the part where I reiterate that prevention is much less costly and less frustrating than the (incomplete) cure.
- Back up regularly; daily, if you can.
- Do all the things you know to do — or more correctly, not do — to keep yourself safe from malware. Avoid links you’re not 100% certain of, don’t open attachments you’re not 100% certain of, and stay alert for phishing emails or other types of scams.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Mine happened soon after the 2nd AT&T breach. I ran a Malwarebytes deep scan and it found 4 trojans. I quarantined and deleted them, but I suspect our network was compromised. My external hard drive with my last image backup has been turned off and I haven’t opened and connected it since the last back up before the hack. If i open it now to do a restore, will it automatically become compromised as well?
Information in searches I’ve done seems to indicate that if my network is compromised, everything connected to it is as well. We have 2 mobile phones and 2 Windows 10 PC a printer and a Ting electrical monitor currently connected–mobile to wi-fi and PCs via Ethernet. I also use the Dashlane password manager that I’m concerned about as well.
Restoring the backup will completely overwrite the drive and shouldn’t be affected by the malware as long a the backup was made before the malware got on your system. If your network is compromised, the malware can return.
First: NO in general everything is NOT compromised automatically. However there is risk that things MAY be compromised. There’s no guarantee either way since it depends entirely on how the specific malware works.
I was one of the people who had that Nikke goddess of victory “Rat” , my laptop seemingly was normal all that time but the thing was apparently stealing stuff etc but i neer saw any effects.
I have reset the laptop but i had 3 external drives plugged in…if i scan tjose later while having the laptop offline, is it possible the drives could be ok? I have no back ups…like 8tb of files.
It can go either way. I’d run a couple of malware scans on the drives. Generally, it’s easier to find malware on an external drive because there are fewer places for it to hide.
I’d be cautiously optimistic: most infostealers focus on stealing data from the PC and don’t necessarily infect every attached drive. If the scans come back clean, there’s a reasonable, but not 100% chance your external drives are fine.
Malware stored on an external drive is generally harmless until a program, script, macro, exploit, or other active content is executed. Simply having malicious files on the drive does not infect the computer. Infection normally requires opening, running, installing, loading, or otherwise processing those files.
Don’t run any programs directly from the external drives until they’ve been scanned. Data files (documents, photos, music, videos, etc.) are generally less of a concern than executable files that could reinfect the system.
I’d get a second or third USB hard drive and copy only data files to it, excluding executable files, scripts, installers, and macro-enabled documents.
Common executable or script file extensions to avoid include:
.exe, .com, .scr, .msi, .msp, .bat, .cmd, .ps1, .vbs, .js, .jse, .wsf, .wsh, .hta, .cpl, .dll, .pif, .jar, and .reg.
I’d also avoid macro-enabled Office documents such as .docm, .xlsm, and .pptm unless you or a trusted source created them. Additionally, MS Office disables macros by default until you enable them. It’s safer viewing suspicious PDFs in an up-to-date Edge browser before I’d open them in something like Adobe Acrobat, Foxit PDF Editor, or another full-featured PDF application. The attack surface is smaller.
Simply storing a malicious file on a drive does not infect a computer. Malware generally has to be run, opened by vulnerable software, or otherwise executed before it can do harm. By copying only non-executable, non-macro-capable data files (photos, music, videos, plain documents, etc.), you greatly reduce the risk of transferring an infection.
Files capable of containing macros are safe, as long as you created them yourself or got them from a trusted source.
Thanks for the detailed reply.
Since I have so many files and can’t get large enough drive right now could scanning the drives and deleting .exe files etc. be enough if the scans find nothing?
Thanks again and sorry to bombard with more questions.
I have similar situation to JT: Friend had NIKKE on their pc and they ended up having the malware rat on their pc.
Few days before They shared through Google Drive 2x .exe game files with other. dll stuff etc. indie games to me… And now I am worried since I ran those games on my pc before we knew of the infection am I also at risk now?
Friend was also using my home wifi could the rat move that way too to other devices? Phones, other Pcs laptops smart TV etc?
Plus forgot to ask: if friend who gave me those files had the Nikke RAT on their pc, and their mobile phone was connected to external usb hub/drive that is connected to laptops usb port is there a chance it could have infected the mobile phone too? They have scanned files on their phone with malwarebytes no threaths so far but they have all their MFA on that phone so they are quite worried.