Can a virus persist across Windows version upgrades?

Question

It is possible for a trojan which allows a remote user to secretly control a computer, to re-install itself after upgrading to a newer version of Windows?

Answer 1

Short answer: Yes.

Why?

1. If the malware/virus is delivered via an application/file and the app/file is opened after you re-installed Windows, then the virus/malware will be reactivated.

2. When you upgrade, you don't do a complete re-install of Windows, you just update it (for example from Vista to 7). If this happen it's very likely that the virus will run just as well on the new version (don't underestimate the compatibility of malware and viruses).

If you are completely removing everything that's on the hard drive there's a good chance that your PC will be clear of viruses. If you however, have your Windows on C: drive and the virus/malware on another drive, it's very possible that it will come back if you trigger some part of it.

There are a number of other options, but these are the more commons I can think of. It would also help if you could clarify explain what you understand by "upgrading to a newer Windows".

Answer 2

What prevents a trojan from infecting the BIOS? You can trick the user to reboot, run a nice animation of a chkdsk while you're flashing, then another reboot. Now you can even change the hard disk and you can't get rid of the trojan. Thinking more about it tells me that it has already been done.

Answer 3

Lots of things are possible. If you totally wipe your hard drive and then install a totally clean version, it's still possible the trojan will persist (see @ott--'s answer). But if you do a clean reinstall, it's not terribly likely, IMO.

Answer 4

The normal Windows update process only replaces the operating system itself and doesn't touch any 3rd party applications which are installed. It usually also takes care that any programs which are configured to run at startup still run at startup after the update.

So when a program you have installed is infected with a virus or you have a malware which is configured to run at startup, a normal windows update will not remove it.