2

I've got a computer with WinLocker blocker virus in it. This virus blocks user from using their computer by showing a banner with some text in it. I've got a manual on how to get rid of this virus, which involves booting from a live cd, mounting your windows partition and removing/renaming some files/registry keys.

The thing is that no live cd (be it ubuntu or windows PE) doesn't see Windows partition, although I can boot from it - which means it is obviously not corrupted in any way. The computer is also a corporate laptop that means that it a) has a very limited user account and no access to admin account, b) cannot boot into safe mode because of a), and c) can be somehow protected from mounting windows partition from somewhere else in not-so-rare cases of lost corporate laptops with crucial info inside.

Linux live cd gives me an error about incorrect NTFS signature when mounting it, although I can see it with fdisk -l. Windows PE CD just shows a unformatted partition (I'm not sure what tool I used to get this info).

Can you give me some directions on what could be done to bypass this protection (?), get access to partition and manually remove virus files to boot normally? Most obvious solution - send it to support - is not the best one since it will take too much time.

0

Is the hard drive itself password-protected? What about the drive's encryption? Has it been encrypted with something like BitLocker or TrueCrypt?

1
  • Thanks, turns out drive itself was encrypted, so nothing could be done apart from sending it to IT. – Andrey Stolbovsky Jan 4 '17 at 21:52
4

For Ubuntu Try mounting the drive with the force option eg.

sudo mount -t ntfs /dev/sda1 /sum/mount/point -o force
2

Option 2: Pull the hard drive out of the computer and attach with a USB enclosure to another computer running your version of Windows or higher

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.