poorly laptop

[pawz7]

Hi all. I was given a laptop to fix today which the owner knows is infected with malware. It came to me because it is looping on boot. You see a blue STOP screen for an instant and then the machine reboots. The Advanced boot menu does not have the option to disable automatic restart so I cannot get to see what the message says.

Normally I would get to Recovery Console and either do a fixboot, or more likely fixmbr after a chkdsk, but when I tried to access RC using a disk, the machine told me that it could not find a hard drive. It said the same thing when I opted to repair Windows - so that avenue was out.

We took the hard drive out and attached it to my machine and so I can see the files on there, but of course that is not going to help me fix the mbr. Has anyone got any good wheezes or ideas or tools? I don't even know if you can fix an MBR remotely.

I have Recovery Console installed on my machine so thought I could access the drive that way to fix the MBR, but when I get into RC it wants an administrative password for that drive, and none of the usual ones work. It is a Polish machine so probably the password is Polish too... I suppose I could hack it with NT Password but thought I would see if anyone here has ideas as to what to do before I dig that out.

I recovered the Windows PID and Office PID from the registry via a remote password recovery util - no PID on the case, so at least I could put the system on again ( does ASUS Notebook F7L have a secret partition do you know?), but she has no disks at home which means she would lose her Office as I do not have that version here, and her folders all have Polish titles and she seems to have used 'Default User' to park stuff - and though there is nearly 250 GB of data, with only about 20 gigs left for the swap file, I can't see any itunes or piles of pics or docs anywhere, so wonder what has filled the drive.

Any thoughts please?

[Alan2273]

From what I remember, if the poorly laptop goes have a recovery partition, press F9 on start up to access it.

[pawz7]

thank you Alan, I will give that a try just to see, though I did not see any sign of another partition in disk management console :)

[Belatucadrus]

Depends how the recovery system is managed, my Dell has a hidden partition and is really easy to reset to virgin factory condition. Does wipe out all your data though so as always regular backups are needed.

Have you tried any of the live CD toolkits like Dr Web

[pawz7]

no Belatucadrus, haven't tried Dr Web. Will look into it. Thank you.

At present the drive is attached to my machine and being scanned for malware before I attempt to copy over the lady's files to my external to keep them safe should I need to reinstall Windows. Then I am going to dig out, or make another NT Password disk and see if that will change that drives admin password to a blank, then, if successful, I will try to do a fixmbr on her drive from recovery console while it is attached to my computer, and then.... we will see :)

[pawz7]

umph, couldn't change the admin password via NTPassword as it didn't see the drive, and have not found any way to access the user profile folder to get the music, docs and pics off - which I know are there because Malwarebytes Antimalware displays them on its check screen, so now I am running GetdataBack to see if I can recover them that way. Trouble is I can't do a partial search because I do not know what sector range to put in, so got to do the whole disk, which will take nearly four hours just for the first stage. Once I have got all her personal stuff off, we will put the drive back in the laptop and see what else we can do besides reformat, which would mean she lost all her apps including Office. Enter Dr Web perhaps, but am not hopeful - what I REALLY want is a way to get into recovery console or to repair from a the Windows disk.

[Scythe]

I've used for asus laptops in my days (and are on an asus g50 now,) I've done a massive amount of messing around with it (linux, osx, vista, windows slash screen, aero tweaks, etc) and had it fatalcrash once, however I was somehow able to restore everything then, possibly a built-in fixboot or something.

I can however, assure you that asus does NOT install hidden partitions with a backup windows or anything. Basically, she's boned if you can't extract the data and can't boot it. If the drive has free space I'd suggest booting a live CD of your favorite distro, and using its partition manager to mount the windows partition and transfer data to device xyz.

[pawz7]

what is so frustrating is that IF I could get into RC I could have probably fixed the boot problem immediately, and then been able to work from within Windows to clean out the malware, or alternatively, repair the Windows from a system cd. Neither of those options presented though, just a message when in the cd to say no hard drive was found (which is rubbish). Instead I have had to attach the drive via usb and attempt to clean off detected malware that way - which took hours, then had to copy over her files on C: to an external, about 20 Gb there, morfe hours, then use GetDataBack to recover the locked files in her music, docs and pic folder - yet more hours - which I have just finished doing - and then,tomorrow, will have to put the drive back in the Asus and try PEBuilder or Dr Web ( which I have never used before) to see if what good they might do - maybe get to My Computer Properties to untick the box that sets the machine to restart when the system crashes, if that is possible in a virtual desktop, so I can hopefully then see the the BSOD... ggrrr, all this fiddling about when it should be straight-forward. I WILL get there in the end, but she may lose her apps, which is sad as she is a student and in lodgings, so probably not able to afford to buy much software. Anyway, thank you for your input Scythe.

[Scythe]

Ehh, that sucks. If you're getting a no-harddrive error I'd suspect that some serious malware is on there, and I'd recommend scanning everything with at least malwarebyes and spybot before letting it anywhere near your own files. That, or the NTFS config is broken, in which case the disk will need reformatting. :\

[pawz7]

I am in through the front door now - thanks to an old copy of Ultimate Boot Disk which has a Nortons Utility that can fix the mbr, which it did (hooray) - but if I thought that was the end of it I was wrong. Having got in, all the menues and dialogues are in slovenian so I have to find things and click things by icon and or memory, and there is still a fair bit to do to get things right. Happily Eset and Malwarebytes did a good job on most of the detectable malware while the hard drive was attached to my computer - but once in the machine proper I found the browsers were redirecting, so getting to bleeping computers or Microsoft's Fixit download for returning to the default Host file wasn't going to happen - but guess who had a Fixit tucked away on a thumb drive, so THAT was sorted. Cloud Panda reckoned it found three unknown rootkits and got rid of them - but actually I think they were elements to do with Asus Security management (oops). Although the machine is up to SP3, it is still running IE6, and the Security Centre is not displaying properly either, even though I have been into services and reset all the vital ones - everything but the essential remote service was set to disabled. I tried downloading IE8 as I wasn't getting any movement on Windows Update page. I did get IE8 down and installed, but it wasn't happy and only gave me bare-bones functionality because it detected malware, and then I lost the web connection completely, so had to revert to IE6, which isn't working very well. Soooo, way to go, but if the young lady can come round and interpret the dialogues and menu items, maybe we can sort out the bits that are still not as they should be. Hope so, tired out I are.