Forum Home
Press F1
Thread ID: 84723	2007-11-16 03:53:00	Virus removal killed Windows XP!	scratta (7982)	Press F1

Post ID	Timestamp	Content	User
611924	2007-11-16 03:53:00	Im basically fixing a computer on behalf of a family friend's friend (!) . They complained they couldnt get into windows at all and could I have a look at it for them. After 10 mins i managed to get into windows fine (mcafee was the cause of the problem, so booted to safe mode and deleted mcafee as the definitions were out of date by 3 years). Once I was into windows proper I used trend housecall and found 10+ different types of malware (viruses/trojans) and 4000+ files infected. As trend didnt work properly (no clean/delete option was presented, it just hung after 2 hours) i proceeded to install kaspersky home trial and told it to delete the infected files, on the next startup. HOWEVER, it seems in my stupidity I allowed it to delete infected core system files as well, which basically screwed windows up ( just returns to the account login screen). After trying to reinstall windows (repair) over the top, i get access denied errors after a while when trying to copy the latter half of the windows files, even thought the files are present on the windows xp cd in e:\i386, it wont let me use them for setup. After spending hours trying different techniques to get it repaired, it seems the best option is to back up system32/config (registry files) and the my documents and settings folders and then reinstall them over the top of a fresh install? Is this the right idea? If it is the best idea it is very difficult because the recovery console only allows the copying of 1 file at a time, and you cant copy directories, or even rename them. Any help/guidance would be appreciated. Thanks! Athlon 1500+ 512mb ram 70gb hdd fx 5200 Windows XP sp2 (windows xp cd is sp1)	scratta (7982)
611925	2007-11-16 03:59:00	If they've got the CD do a clean install. Dont try and install over whats already there. You'll have to reinstall everything anyway. Or connect it to a working PC, as slave and do a scan with something better like Nod32 or Avast Home / Pro	Speedy Gonzales (78)
611926	2007-11-16 04:06:00	+2 not worth mucking around trying to repair it. connect to a spare pc and copy any docs etc over. then format and reinstall.	tweak'e (69)
611927	2007-11-16 04:28:00	If they've got the CD do a clean install . Dont try and install over whats already there . You'll have to reinstall everything anyway . Or connect it to a working PC, as slave and do a scan with something better like Nod32 or Avast Home / Pro Ah ok, they wanted everything left how it was if possible, lots of installed programs etc . If they'd taken it to a professional what would they have done differently, instead of getting the anti-virus software to delete the infected system files? And lastly, I didnt think the recovery console allowed networking for scanning the comp, like how the net command is disabled in it . Sorry for the questions, but thanks for the replies!	scratta (7982)
611928	2007-11-16 04:36:00	Take the hdd out of the case, and connect it to a working system (open the case). And connect it as slave. Thats how you connect it to another system. Just remember to scan it with another AV program (like the above), before you copy whatever documents. You'll have to reinstall the programs (You cant copy programs that have been installed already and copy them back later). They wont work. And if the programs that are installed were infected as well. Copying them to another hdd may have infected it again. A shop may have done the same thing. Either scanned it if it booted or connected it to a working system scanned it, copied whatever then formatted it. And charged a lot for it. Then put whatever back on once Windows was reinstalled.	Speedy Gonzales (78)
611929	2007-11-16 04:39:00	sure you could repair it but it will take time (ie $$$$) and it leaves it open for problems later on. in my humble experince when a system is that badly damaged a repair is never perfect. they always tend to crap out later. its cheaper, easier and more reliable to format/install.	tweak'e (69)
1