up vote 1 down vote favorite
share [g+] share [fb]

How can I read a WinXP partioned disk that is infected and shows up on a USB connection to Win Vista computer as a single partition that Vista cannot see the contents? The XP computer HDD is partioned into 4 partitions. It became infected, and all attempts to clean it have failed. Applications begin to launch, but are then shut down by the infecting agent. Using a major Anti-virus Co. boot disk (which was unable to connect to the Web, probably because the infecting agent stopped it) with virus definitions dated after the disk became infected, the resultant scan showed no infection. I bought a USB cable to connect the IDE drive to my Vista computer, but when I open Win Explorer, it sees the disk, but does not show any contents. It indicates it is a single partition that is valid. However in all the ways I have tried it does not show drive contents. Any suggestions on what to do next?

link|improve this question
Have you tried connecting the drive directly to the IDE interface instead of via a USB conversion (obviously ensure you don't boot to this drive)? Also, may I recommend you don't clean the drive - but instead recover your data, completely wipe the drive and rebuild. Only way to be safe, particularly if the malware is a vicious as it seems. – DMA57361♦ Aug 24 '10 at 14:57
feedback

2 Answers

up vote 0 down vote

What I would do, put the infected hard drive back in the PC, then create a bootable AV CD, boot from it and scan the drive to remove infections, when done restart the PC, see if you can get to the desktop, if you do, immediately do a Reset of Internet Explorer.

After this is done and you have closed IE and re-opened IE, download MBAM, install it and then use the Update tab of the program to update it, then do a quick scan to clean up any remnants of the infections.

Bootable AV http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

MBAM http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

link|improve this answer
Retured57 already specified that bootable AV CDs have not produced satisfactory results. – TuxRug Aug 24 '10 at 4:59
Maybe they need to try another one, these AV boot cds need to be made fresh, if it is an old one (1 week is old) it will have old virus definitions, also trying different vendors can help find newer viruses. – Moab Aug 24 '10 at 16:56
feedback
up vote 0 down vote

My guess would be that you have somehow ended up with a sort of "wrapper" partition around all of your interesting partitions.

This could have occurred legitimately if you installed a "dynamic disk overlay" like Maxtor's "EZ-bios", which existed primarily to allow hard drives in excess of the barrier-of-the-week to be used with older BIOSes. (I'm not actually sure there are any DDOs that work with XP, though.)

It could also be a sign of a (very stupid) boot virus. (I say very stupid because it seems pretty dumb for a virus to announce its presence by doing this.)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.