[jjmn]

I'm sure I'll need to do a separate entry for my overall problem (virus disinfection gone awry and now BSOD) but for now, as I try to repair this myself, I'm finding that when I run the XP disk to get to the recovery console, it only offers one option as far as which win I want to repair. The one on C drive is not even listed.

I know Windows is still there because when when I try to boot up, I get the Windows splash screen first and then then BSOD.

Does anyone have any advice on how I can get through the recovery process with C showing? Am I missing a boot up file that can be replaced by running something else in my optical drive first and then do the Windows recovery? I've heard of the Ultimate Boot CD but I don't know much about it or what is on it. Is there a utility on it that can help with this situation?

BTW, when Kaspersky detected a virus it was some sort of backdoor named virus and the only thing I remember about where it was something like /0harddisk or something like that.

Edited to add: BSOD I'm getting is unmountable boot volume

Any help would be GREATLY appreciated!!

[Rockn]

There may than one partition on your computer and that is where the recovery console is showing it's location. Browse the file system on E to see if that is indeed the location Windows is installed.

[Mark1956]

Trying to clean out a backdoor infection without good Malware knowledge has most probably left further infections on your system. A backdoor infection allows a hacker to gain access to your personal information, bank account details, passwords, etc. Once a system has been compromised by this kind of infection the safest thing to do is a full format of the hard drive and then a clean install.

The virus has damaged your file system, hence the error message, you may be able to repair this by using the command chkdsk /f from the command prompt, you can get to the command prompt from the recovery console. If this does not work then try using the command fixboot.

My advice would be to seek help in the Malware forum to make sure your system is clean (although with a backdoor it can never be guaranteed) or to re-install the OS (recommended). You will loose all data on the drive so I hope you have some back ups of anything important.

This guide Ubuntu Live CD to back up files from your dead Windows will show you how to save any important data from the drive before you re-install, but be sure you scan everything with something like Eset on-line scanner here before you put any files back onto the hard drive.

[jjmn]

I'm following the instructions for booting from a CD using Ubuntu and I'm happy that it booted from the cd, but I'm not able to access the files on my computer. The directions in that tutorial don't seem to address my specific situation, so I'll just post it here if someone can help. I'm not familiar with how to this from within Ubuntu without specific instructions.

When I tried to access the files on my computer within the Ubuntu interface, I received this error message:

Error Mounting: mount exited with exit code 12: Failed to read last sector (307178864): Invalid argument

HINTS: Either the volume is a RAID/LDM but it wasn't setup yet or it was not setup correctly (e.g. by not using mdadm-build...), or a wrong device is tried to be mounted, or the partition table is corrupt (NTFS size is not valid).

Failed to mount '/dev/sda2': Invalid argument The device '/dev/sda2' does not seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disc instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?


Any ideas? Does this error message via Ubuntu give anyone clues on what I could do from within Windows? Or Ubuntu? Any help would be greatly appreciated. My main concern is getting my files off the computer and if I must reformat, I can do that.

Thanks!!

[Mark1956]

Not sure about those errors but I'd guess it is badly corrupted and/or the partitions have been corrupted which might be repairable.

Has your hard drive got a Recovery Partition or was Windows installed straight from a Microsoft XP disc? And do you have the disk?

[jjmn]

I reformatted about a year and a half ago and did it right from the XP disk. Yes, I still have the disk.

[Mark1956]

Ok, we will try a repair first using the XP disc.

Boot the PC with the XP disc in the CD drive.

Press any key when asked to boot from the CD.

The disc will run through a lot of files and then you will come to a screen "Welcome to Setup"

Press the "R" key. you will be asked which Operating System you wish to perform repairs on and to enter your password. If you do not use a password, after selecting the system to repair, hit the Enter key again.

This will now display the Command Prompt on the next line.

Type in this command chkdsk /f and hit the Enter key. (Make sure you leave a space befor the /)

Any problem or error message let me know what happens.

If the command runs, it could take an hour or more to complete and may appear to freeze which is normal, leave it to complete and take note of what is displayed on screen. When it finishes it should boot into Windows take note of any error message if it fails.

Whatever happens, do not try anything else, report back in your next post.

[jjmn]

Actually I tried that and the listing for Windows on C doesn't show at all, only for E which is my optical drive (see first message for more details).

This all happened while disinfecting a virus using Kaspersky as though it never completed the operation and left it in an unbootable state. I just wonder if there's a way to get the files off via Ubuntu in the meantime but I don't know Linux and can't translate what was in that link above about using Ubuntu for my specific error situation. I'm happy to reformat the hard drive after that and probably, in light of all of this, switch to Ubuntu as a result.

[Mark1956]

Any usefull repair to the Windows installation is going to need access to the Recovery Console, but as it is not recognising that there is a partition active with Windows on it we have hit a wall with the procedure.

Every Anti Virus programs has its strengths and weaknesses, this problem has been caused by a failure in Kaspersky to cleanly remove the infection, it has nothing to do with Windows.

Obviously the drive is still infected and as Ubuntu won't recognise the OS partition I doubt anything else will. The next thing to try is to remove the hard drive and hook it up to another PC.

If your PC is a desktop you can hook the drive up to another desktop using the internal wiring. If it is a laptop you will have to use a USB Hard Drive Adapter (about €10 on Ebay), this will allow you to connect any type of drive to a laptop or desktop PC. Doing this, you should be able to see the contents of the drive and extract all your data. Be sure to scan all data that you transfer off the drive before putting it back on the drive after re-installing Windows.

[Mark1956]

Yes, it should work and if it doesn't then there will be little else you can do. The disk does not have to boot to view it's contents when it is hooked up to another PC. When the drive is connected internally, or on a USB adapter, you boot the PC in the normal way from its own hard drive and then try to access the bad drive using Windows Explorer to read and save the data from it.

[Triple6]

Originally Posted by Mark1956

Yes, it should work and if it doesn't then there will be little else you can do. The disk does not have to boot to view it's contents when it is hooked up to another PC. When the drive is connected internally, or on a USB adapter, you boot the PC in the normal way from its own hard drive and then try to access the bad drive using Windows Explorer to read and save the data from it.

I have no idea what you mean by this "gettimg msg saing xotjl compressed"

This poster was not the original thread started of this thread, they correctly started their own thread and I have deleted their post here.

[Mark1956]

Ok, thanks Triple6, I wish people would not do that

[jjmn]

I went to the Kaspersky site and made a cd of the "Rescue Disk" and booted from it. I'm in that utility now and it has an option of using a file manager to explore the contents of the drive. It appears that within this disk it was able to mount the C drive as I can explore its contents in read only mode. But now I'd like to get the files off the drive without taking the laptop apart. I'm not well-versed in that and worry I'll do more damage than has already been done.

Does this information, that the Kaspersky rescue disc was able to mount the drive and give me read-only access give any more clues as to a possible, less-invasive remedy? Is there another utility that I could use that would give me similar access to the contents of the drive but enough so that I could actually pull the files off? Or, a utility that will repair the boot up issue itself?

This assumes that I don't go the route of buying an adapter, that is, to connect it to another computer. I'm open to that option still of course.

[Mark1956]

As the OS is not showing up when you use the XP disc to try and run repairs removing the drive is probably the only option available to get your data. You will appreciate from this experience the importance of making regular back ups to an external source.

You do not have to take you laptop apart to remove the hard drive. There will be three or four screws under the drive which you will be able to see from the underside of the laptop. Undo all the screws and the hard drive will just slide out. Some laptops will just have a cover over the hard drive, once removed the hard drive can be pulled out.

The other thing you could try is a Repair Install. This will preserve all your software and documents, but needless to say if it goes wrong for any reason that may make it more difficult to retrieve your data. Again this may not be possible as it does not recognise the installed OS.

I would personally go for the safer option of removing the drive and hooking it up to another PC.

Have you tried a scan with the Kaspersky disc?

[Elvandil]

If you can access the files from the Kaspersky disk, then that is the time you should make the backups. You don't need anything else.

You said you got a prompt at E:\Windows. That is your installation if it has a Windows folder. Partitions do not have intrinsic letters assigned to them. They are assigned at boot time by whatever is booting and change all the time.