Salvaging Data off an Infected Hard Drive

[Randy Tyndall 1087023]

My granddaughter dowloaded a virus that either wiped out my son's C:\ Drive or has it hidden so it cannot be accessed. She was playing WoW and watching YouTube videos at the same time. She said a "PopUp" came on that she thinks said "Puter Killer - You have been Infected with a Virus". (She's only 10 years old so her recollection is a little "dim".)

 

She did not click anything on the popup, but went straight to the "Start" button and shut the computer off. Too late or wrong choice, because now when we start up his system we get a BIOS message the says "NVidia Agent Boot Failed. Check Cable." BIOS is accessible, but having the computer boot from the hard drive is no longer listed. Now it's just CD-ROM, NVidia Agent Disk, and USB options. We have tried starting in Safe Mode, but still no joy. No matter what choice we select, i.e., Safe Mode, Last Good Config, Last restore Point, etc. they all end up going to the same BIOS Error message about NVidia.

 

He is running an Alienware Titanium with Vista 64, dual core, SATA HD, NVidia (obviously). The system came without the Vista OS Install Disk with Vista already installed. The certificate number is pasted inside the DVD Drive door. It came with four disks, none of which were required to start using the computer right out of the box, a System Recovery Disk, a Support Disk (Drivers), a NERO 7 Essentials Disk, And a Sanyo Disk for the monitor. We tried all four as a startup disk...no joy. It's like the C:/ Drive doesn't exist anymore. All of them want to know what Operating System to restore to, but the field of choices is blank. When you browse to go looking for a place to restore the only file type it will let you look for is "Setup Information" I've never heard of that as a file type.

 

I have a Malware Removal program on a USB Flash Drive, and it is readable, sort of, but it is now the C:/ drive whenever I insert it. Since the browser shows only "Setup Information" files, the executable is not visible to click.

 

I have tried holding all of the "F" keys down during the Boot process, but the only one that results in anything is the F8 key which gets me into the handcuffed Safe Mode. I can get to the command prompt. I tried switching to different directories using CHDIR but the answer is always XXXXXXX not an executable program, where XXXXX is whatever I am trying to do. I tried several times to run my Malware program by typing RUN C:\MBAM.EXE but no such luck.

 

Any ideas... I tried installing the infected hard drive into another computer as a Slaved HD but the drive was never detected when I booted up the computer after installing the drive. I even tried activating it from BIOS but all I got was "No Device found at SATA5"

[Ernesto Alvarez 818262]

yeah i got hit by that youtube virus a few months ago on my laptop. unfortunately, the only way to fix it was to reformat it.

 

if theres important files you really need to salvage, i'd take out the hard drive and take it to best buy or a PC shop and see if they can restore the files on a CD or somethin. make sure to let them know its infected tho

[Miguel Frias]

Hi Randy,

 

Sorry to hear about this. What I could suggest is that you boot using a Linux distribution (example: CentOS, OpenSUSE) and see if that can detect the disk and mount the filesystem.

 

This is actually how I do my backups. I use "OpenSUSE" since it detects pretty much everything. Here are a few links to distribution ISOs:

 

OpenSUSE: http://software.opensuse.org/113/en

CentOS 32 bits: http://isoredirect.centos.org/centos/5/isos/i386/

CentOS 64 bits: http://isoredirect.centos.org/centos/5/isos/x86_64/

 

However, this implies that you have minimal Unix/Linux knowledge. The distributions are downloadable as a .ISO file and can be burned onto a DVD. Then, boot via CD/DVD, and choose something like "Rescue Linux", not the standard installation.

 

This will boot a temporary Linux kernel (user "root", no p[Mod - Happy Thoughts]word), that will allow accessing disks on your system. You should be able to mount the disk like this:

 

# mkdir /a

# mount /dev/sda0 /a

 

The above command creates directory "/a" and then attempt to mount disk "a" (first) partition 0 (first) which means the C:/ drive normally.

If the command works, you can then:

 

# cd /a

# ls -al

 

To change directory to "/a" and then list all files in the dir (notice options are small A, small L).

 

Now this is just a last resort for you to be able to get any important files from your disk, eventually onto a pen drive or another disk.

 

Good luck!

Miguel

[Randy Tyndall 1087023]

Thanks Ernesto,

 

That's where I fear this is headed for my son as well. The only thing he really wants to get off the drive are pictures. I saw somthing at NewEgg that looks promising and may try that first. It's a device that lets any normally internal HD, either IDE or SATA, connect to it externally and then has a USB connector to plug directly into any USB port. Basically, the internal HD then becomes an external storage device. It's only $16.99 and free shipping, so what the heck. If it works I will have saved the $150.00 the local computer guru (I live in a small town) charges to salvage data from infected drives. I'll let you know if it works here in this topic.

 

And a Second Thanks to you Miguel,

 

I have absolutely no experience with LINUX whatsoever. I understand a little about .iso files and what they are. I downloaded bitTorrent to convert a Torrent version of the Vista 64 Recovery Disk to images on a CD so if we ever get control of the HD we can reinstall Vista without buying the entire OS again ($99.00 is the cheapest one I've found). I went to the sites you imbedded in your reply. I kinda understood what I was reading at the openSUSE site, but the other two had so little information I would be leary of using them. Not sure I want to buy something I don't really know how to use...openSUSE. I would probably end up doing more damage than good. I try to stay within my limitations, learning bits and pieces as I go.

 

Thanks to both of you for responding. I'll let you know how I do here at this topic site.

 

Randy

[Darrol Larrok 1140797]

Randy, if your not comfortable with command lines, I suggest downloading a Ubuntu Live Disk and booting from that. You can probably mount and access the drive that way from a very nice GUI.

[Ernesto Alvarez 818262]

yeah that one may work Randy. ive been after that USB cable for awhile so i can restore my old laptop HD.

 

youll be able to use it just like an external hard drive.

 

which you just reminded me of, i ordered some stuff from newegg a few weeks ago and completely forgot to check for the cable