Transferring files from virus-ridden HDD

[KubeDawg]

So I've never actually had a virus that completely prevented me from fixing, so I'm new to this.

I have 2 PCs. One is my work PC which has XP Media edition and the other is my Home PC which has Win7 Pro. Home PC uses a SATA drive and the work PC uses IDE.

First off, before I attempt anything, is it safe for me to hook up my Home HDD to my work PC and it not only boot the IDE drive, but prevent transfer of the virus to my work PC?

Also, if I am looking to transfer my stuff to my work PC, what if both drives have the same drive letter? (e.g. C:\)

I don't think SATA uses master/slave, but I'm not sure about the compatibility of the old IDE drive.

Finally, I have a separate external drive, one that has no OS installed used as a backup for my files, but since I cannot boot Windows on my Home PC, I don't know of any other way to get those files transferred to it.

Any advice?

[SomeOldGuy]

What virus? Have you tried all the normal cleaning agents (MalwareBytes, SuperAntiSpyware, etc)? Have you reinstalled Windows (that doesn't require wiping everything out, you can install Windows on top of itself and it won't reuse the current Windows settings)?

Drive letters won't have be the same on the same PC... that's a Windows assignment that occurs during the boot process

Why can't you boot windows on home pc?

Without knowing which virus or what's going on with your home PC,
I'd be cautious about attaching the HDD to another machine regardless of version of windows.

IDE and SATA drives can co-exist on same PC... just need the proper connections on mobo available

[FreaK367]

I can only offer some good virus removal programs really. My brother had a virus not too long ago that took control of his PC, I have a utility on my pen drive that comes with portable versions of software including web browsers and virus removal software, that worked for him because the virus couldn't touch the programs launched from a pen drive.

If that didn't work, I would have put a bootable version of Linux on an external hard drive, and booted up the PC choosing that option in the BIOS, then that would give you full access to all of your files, without the infected windows messing things up.

Other than going into lots of detail, get some virus removal programs and utilities, and boot in Safe mode if you can, and perform some scans, and use some built in windows programs to clean up your hard drive and fix errors etc.. (that's if you haven't already)

As SomeOldGuy said, get Malwarebytes: http://www.malwarebytes.org/

Also, Spybot search and destroy is free and good: http://www.safer-networking.org/index2.html

Avast! free along with many other generic free versions of antivirus programs, all do a great job, I use Avast!, http://www.avast.com/en-gb/index

To generally clean up your pc and make it more responsive and such, I would suggest WinUtilites to anyone. http://www.ylcomputing.com/content/view/327/135/

I hope you can supply more detail, like a virus name if possible, or symptoms.

[Innoc]

Originally Posted by SomeOldGuy

What virus? Have you tried all the normal cleaning agents (MalwareBytes, SuperAntiSpyware, etc)? Have you reinstalled Windows (that doesn't require wiping everything out, you can install Windows on top of itself and it won't reuse the current Windows settings)?

Drive letters won't have be the same on the same PC... that's a Windows assignment that occurs during the boot process

Why can't you boot windows on home pc?

Without knowing which virus or what's going on with your home PC,
I'd be cautious about attaching the HDD to another machine regardless of version of windows.

IDE and SATA drives can co-exist on same PC... just need the proper connections on mobo available

I'd add combofix and sdfix to that list along with USB enclosures/adapters to allow IDE/SATA drives to co-exist as well.

Frankly I don't spend a ton of time trying to clean any more. If the system I'm looking at is fairly well hosed I'll backup that which has been called out as critical, restore to factory original, update and harden the OS and Apps and then restore the critical stuff once I know that the OS and Apps are as current and as protected as I can make it...once all of that's done I'll capture a system image to allow a quick future restoration.

[KubeDawg]

Originally Posted by SomeOldGuy

What virus? Have you tried all the normal cleaning agents (MalwareBytes, SuperAntiSpyware, etc)? Have you reinstalled Windows (that doesn't require wiping everything out, you can install Windows on top of itself and it won't reuse the current Windows settings)?

Drive letters won't have be the same on the same PC... that's a Windows assignment that occurs during the boot process

Why can't you boot windows on home pc?

Without knowing which virus or what's going on with your home PC,
I'd be cautious about attaching the HDD to another machine regardless of version of windows.

IDE and SATA drives can co-exist on same PC... just need the proper connections on mobo available

I updated my Malwarebyte's, then scanned the file I had just downloaded and it immediately shut my PC off. After trying to boot, it went to the, "Windows is attempting to repair itself automatically," then fails and that's where I initially got stuck. After trying to repair with my Windows CD, it finally booted to my login screen. Shortly after entering the password, it blue screens and that's where I'm at now.

Innoc, that's what I plan to do in the future. I wasn't aware of the image functionality Windows 7 Pro had till I encountered this virus issue and none of my system restore points work at all.

[SomeOldGuy]

I have found Windows repair to be essentially useless when it comes to fixing virii problems.

I'm going to assume in the 'save what you got' mode you've tried running Malwarebytes and SuperAntiSypware in safe mode with no network, and you've also run combofix and sdfix from DOS.

FYI -- I've twice had to rename the Malwarebytes mbam.exe to something else and run that renamed .exe since the virus blocked it from running normally.

If that fails, what I've done in the past when in the unbootable toasted PC is to perform a "new" install on the same HDD, ignoring the repair option and not formatting the HDD. That seems generally to fix the problem (unless there was an HDD issue). The files are still there, but you have to reinstall programs because the Windows system files are rewritten. Then go thru and run Windows update immediately, intall/update drivers etc, and follow Innoc's todo list on new re-installs.

[KubeDawg]

Originally Posted by SomeOldGuy

I have found Windows repair to be essentially useless when it comes to fixing virii problems.

I'm going to assume in the 'save what you got' mode you've tried running Malwarebytes and SuperAntiSypware in safe mode with no network, and you've also run combofix and sdfix from DOS.

FYI -- I've twice had to rename the Malwarebytes mbam.exe to something else and run that renamed .exe since the virus blocked it from running normally.

If that fails, what I've done in the past when in the unbootable toasted PC is to perform a "new" install on the same HDD, ignoring the repair option and not formatting the HDD. That seems generally to fix the problem (unless there was an HDD issue). The files are still there, but you have to reinstall programs because the Windows system files are rewritten. Then go thru and run Windows update immediately, intall/update drivers etc, and follow Innoc's todo list on new re-installs.

It won't even boot to safe mode. I'll try a new install and see if that works.

[FreaK367]

It's a long shot, but I'd try removing your RAM and putting it back in, and generally dusting your PC, do the same with hard drives.

The blue screen is commonly associated with Hardware issues, most commonly the hard drive, HDD errors can cause it, some can be fixed, some cannot. If you do get on, try not to open too many programs, and run the command Chkdsk, or find the program in your start menu. That will check your entire hard drive for errors, and attempt to fix them, that could.. work.

Another problem could be that your PC is trying to use the same chunk of memory, that another part of your PC is trying to access. So it clashes, and thus, it blue screens. Hence why I am telling you to remove and replace the Memory, and not to run too many programs, it sometimes works.

My theory is, that it may be an HDD, RAM or Driver error causing it, your Event Viewer may tell you more...

[CatzEyes93]

I am coming to you guys from now on when I have issues

[Lost]

All of their answers will be "When will BMS out?"














But they are pretty helpful fuckers.

[Pixel]

You could boot into linux, copy everything and nuke it

[KubeDawg]

Originally Posted by SomeOldGuy

If that fails, what I've done in the past when in the unbootable toasted PC is to perform a "new" install on the same HDD, ignoring the repair option and not formatting the HDD. That seems generally to fix the problem (unless there was an HDD issue). The files are still there, but you have to reinstall programs because the Windows system files are rewritten. Then go thru and run Windows update immediately, intall/update drivers etc, and follow Innoc's todo list on new re-installs.

Thanks yo! This fixed it for me. All my files were redirected to a Windows.Old folder and I was able to move them over after getting rid of the virus files and it's as good as new.

[Innoc]

Originally Posted by KubeDawg

Thanks yo! This fixed it for me. All my files were redirected to a Windows.Old folder and I was able to move them over after getting rid of the virus files and it's as good as new.

Now Image it! And I'd suggest Clonezilla if you don't have access to the ghost32.exe (ver 11.5) executable on the Ghost Solutions Suite (ver 2.5)...I actually create custom Windows PE boot disks with Ghost and a number of other utilities (FreeCommander, Notepad++, etc). I use the Windows Automated Installation Kit 3.0 to create this....failing that...Clonezilla works well...

You can also try to use DISM to do your imaging but if you're not familiar with it...you're not going to like the results! Seriously...a complete disk image with Clonezilla is easy!

[KubeDawg]

Originally Posted by Innoc

Now Image it! And I'd suggest Clonezilla if you don't have access to the ghost32.exe (ver 11.5) executable on the Ghost Solutions Suite (ver 2.5)...I actually create custom Windows PE boot disks with Ghost and a number of other utilities (FreeCommander, Notepad++, etc). I use the Windows Automated Installation Kit 3.0 to create this....failing that...Clonezilla works well...

You can also try to use DISM to do your imaging but if you're not familiar with it...you're not going to like the results! Seriously...a complete disk image with Clonezilla is easy!

Yeah that's my plan once I've installed all my applications again. Windows 7 Pro has a built-in imaging program so no need to find 3rd party apps. Thx for the info tho.

[Innoc]

Originally Posted by KubeDawg

Yeah that's my plan once I've installed all my applications again. Windows 7 Pro has a built-in imaging program so no need to find 3rd party apps. Thx for the info tho.

That's what I'm talking about. If you're not familiar with and comfortable with the built in tools...I suspect you're going to be disappointed with the results and the really bad part of that is that you won't discover this until you go to use that "image".

[KubeDawg]

kk thanks