![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
artimusbill
Limp Gawd
- Joined
- Jul 29, 2003
- Messages
- 341
A co-worker of mine has requested my help recovering her laptop from a nasty virus infection. Here are the details, and what I have done so far:
* System would boot/access the net, but showed no program shortcuts on the desktop and start menu. It would throw up a million dialog boxes about missing files, and system alerts about malware. Task manager was not available/accessable from either CTRL+ALT+DEL and right-clicking the taskbar (normal and safemode).
* Most of the folders viewed from launching explorer.exe were empty except for a few game folders.
* I was unable to install Malwarebytes from a normal boot, and safemode. The install would proceed as normal until the end, and an access denied dialog box would pop up, and reverse the installation.
* Once during this, I was able to see/access the recovery partition from explorer. Only that one time though. Could this suggest a corrupt/infected restore partition?
* The documented method of accessing the restore function for this laptop (press zero while powering on) did nothing the twenty or more times that I tried it. Spamming F8 would bring up the normal windows options, and I was able to see the "Toshiba recovery" option. I was not able to get that option to do anything. I would get a ..... busy cursor(?) as it thought about my request for maybe 4-5 seconds. Then nothing. Tried this probably ten times.
* I used Microsoft's Standalone System Sweeper to scan the system from a usb stick. It found a few things, and removed them. Upon rebooting Windows, Microsoft Security Essentials repeatedly found an infection and suggested I download the sweeper program again.
* I looked up a method for using my Win7 Home Premium 64-bit upgrade DVD to reinstall the oem OS. I followed the instructions, and re installed using the OEM key extraced from the system before the reformat/re install. I did not delete the restore partition. This surprisingly (/s) installed the retail version of Windows. It is asking for me to activate within three days, and does not accept the entered key as valid.
Now, my question is, is it possible to access the restore partition any way other than F8 to potentially use it's intended function? There were no recovery DVDs made for this system when she got it. I can order recovery media for a reasonable price, assuming the extracted key works (I think it will, when I used the key, it generated the same ID number as the system had before the reformat).
Thanks in advance.
* System would boot/access the net, but showed no program shortcuts on the desktop and start menu. It would throw up a million dialog boxes about missing files, and system alerts about malware. Task manager was not available/accessable from either CTRL+ALT+DEL and right-clicking the taskbar (normal and safemode).
* Most of the folders viewed from launching explorer.exe were empty except for a few game folders.
* I was unable to install Malwarebytes from a normal boot, and safemode. The install would proceed as normal until the end, and an access denied dialog box would pop up, and reverse the installation.
* Once during this, I was able to see/access the recovery partition from explorer. Only that one time though. Could this suggest a corrupt/infected restore partition?
* The documented method of accessing the restore function for this laptop (press zero while powering on) did nothing the twenty or more times that I tried it. Spamming F8 would bring up the normal windows options, and I was able to see the "Toshiba recovery" option. I was not able to get that option to do anything. I would get a ..... busy cursor(?) as it thought about my request for maybe 4-5 seconds. Then nothing. Tried this probably ten times.
* I used Microsoft's Standalone System Sweeper to scan the system from a usb stick. It found a few things, and removed them. Upon rebooting Windows, Microsoft Security Essentials repeatedly found an infection and suggested I download the sweeper program again.
* I looked up a method for using my Win7 Home Premium 64-bit upgrade DVD to reinstall the oem OS. I followed the instructions, and re installed using the OEM key extraced from the system before the reformat/re install. I did not delete the restore partition. This surprisingly (/s) installed the retail version of Windows. It is asking for me to activate within three days, and does not accept the entered key as valid.
Now, my question is, is it possible to access the restore partition any way other than F8 to potentially use it's intended function? There were no recovery DVDs made for this system when she got it. I can order recovery media for a reasonable price, assuming the extracted key works (I think it will, when I used the key, it generated the same ID number as the system had before the reformat).
Thanks in advance.
