Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing OS after attempted removal of ransomware using Kaspersky Rescue Disk


  • This topic is locked This topic is locked
6 replies to this topic

#1 HalifaxPhil

HalifaxPhil

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:33 PM

Posted 26 January 2014 - 05:00 PM

Dear forum pros,

 

My Dell laptop running Windows XP was recently hit with a ransomware virus - the kind that locks the whole machine and won't allow you to boot to safe mode.  My internet research led me to try to repair my machine by running Kaspersky Rescue Disk from a USB.  I did this (apparently) successfully by letting the Kaspersky scan everything that was an option (including ticking the check box next to the C: drive) and then after the scan was complete and files had been moved to quaranteen I restarted my computer.

 

This is where I ran into problems.  Booting without the USB now yields a black screen that says "Missing operating system".  If I reboot to the Kaspersky USB again I have the same choices to scan and repair but notice that this time the C: drive does not appear in the list of items that can be scanned.

 

If you can provide any ideas as to how I can recover from this I would appreciate it.  Unfortunately I don't have the original Windows disks because the laptop was a work-provided machine that I purchased when I left my last job.

 

With thanks in advance,

 

Phil



BC AdBot (Login to Remove)

 


#2 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:33 PM

Posted 29 January 2014 - 01:39 PM

Hi Phil,

 

do you have a log file from your run with the Kaspersky Rescue Disk that shows what was found and deleted? If yes, please post it up.

Did you change back the boot order in BIOS so that the hard drive has first priority? Are all USB sticks and other flash drives disconnected from your computer when you try to boot into Windows?



#3 HalifaxPhil

HalifaxPhil
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:33 PM

Posted 01 February 2014 - 02:38 PM

Hi there,

 

I just checked today and unfortuantely there does not appear to be any log file from the initial process.  Not sure if there is a way to back in time or if the log files are stored somewhere else?

 

I did change back the boot order in BIOS so that Internal HDD (IRRT) is first.  When I try to boot there aer no USB or CD/DVD disks connected to the computer.

 

A few other observations:

- When I started the Rescue Disk program today the program began by "Mounting Disks".  At about 90% complete dialogue box popped up that said "There is not enough disk space to copy the required files - 495Mb of free space is needed.  The files will be stored in memory."  I believe this also happened the second and subsequent times that I booted from USB (Rescue Disk) when I was trying to figure out why the OS could not be found.

- One other item to note: within the Rescue Disk platform I am not able to open any of the other progams which appear (internet browser, file manager, etc.) Double clicking on these objects does nothing, nor does right clicking and selecting open.

 

Phil



#4 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:33 PM

Posted 05 February 2014 - 03:48 AM

Hi,

 

sorry for the delay.

Is your hard drive recognized and listed in BIOS? It sounds like this might not be the case..



#5 HalifaxPhil

HalifaxPhil
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:33 PM

Posted 06 February 2014 - 06:07 AM

No trouble.  When I boot and hit F12, I get the following boot options:

- CD/DVD/CD-RW Drive

- Internal HDD (IRRT)

- Onboard NIC

 

Following that a list of other options including opening BIOS. When I do enter the BIOS screen all the computer information appears.  For example , under System Information, I can see the value for Primary Hard Drive is set to 160 GB HDD.

 

Note sure if that is helpful?



#6 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:33 PM

Posted 25 February 2014 - 05:50 AM

I'm very sorry I missed your reply.
Do you still need help?

#7 aharonov

aharonov

  • Malware Response Team
  • 2,441 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:33 PM

Posted 12 March 2014 - 12:03 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users