«

Someone brought me a HP Notebook with important data on it that was dead. It was the power jeck that
had to be replaced. Once that was fixed, Windows would take aorund 10 minutes to boot in normal and
safe mode. When it finally did, the mouse would move in 10 second intervals. In other words, it
would take 5 minutes to drag the mouse from one point of the desktop to another because it would
intermittanly freeze. Eventually, it would just shut off.

I removed the hard drive and connected it to a desktop PC. I could see everything on it except the
HP_Laptop user's files. I did not have permission. I told the customer that that can occur when
there is a password on the user account. He assured me that there was no password. Then I thought
that the drive might be damaged. I told the customer that by fixing the power problem, it will not
guarantee that the data is still there. I put the drive back in the notebook and booted to an XP
image on cd and I saw all of the data there. At this point, I would do an XP repair installation, so
that the data will remain and the programs will still work. The odd thing was that when I pressed F8
for the license agreement, it didnt show me any previous installs of Windows to Repair. It looked
like a new hard drive. But that is wrong because there is a Windows directory and I can see it from
the boot disk. There is a boot.ini file and all of the usual files.

How does one do a repair installation if XP setup does not even see the current Windows that is
there. Does anyone know which file may be damaged that would cause this to happen?

Tony

On Fri, 09 Nov 2007 11:21:03 -0500, Tony < >
wrote:

>Someone brought me a HP Notebook with important data on it that was dead. It was the power jeck that
>had to be replaced. Once that was fixed, Windows would take aorund 10 minutes to boot in normal and
>safe mode. When it finally did, the mouse would move in 10 second intervals. In other words, it
>would take 5 minutes to drag the mouse from one point of the desktop to another because it would
>intermittanly freeze. Eventually, it would just shut off.

That could well be a sign of a virus (or other malware) presence.

>I removed the hard drive and connected it to a desktop PC. I could see everything on it except the
>HP_Laptop user's files. I did not have permission. I told the customer that that can occur when
>there is a password on the user account. He assured me that there was no password.

That could indicate some type of hostage virus. (A virus that
encrypts user data. And only tells the user that after almost all
of his data is encrypted.)

>How does one do a repair installation if XP setup does not even see the current Windows that is
>there. Does anyone know which file may be damaged that would cause this to happen?

Not.
Be very carefull. There are virus variants around that encrypt
part or whole of your harddisk while keeping the keys you need
for decoding in the MBR area. Wipe that (by doing a new install
or 'FDISK /MBR') and say good-bye to all your precious data

--
Kind regards,
Gerard Bok

I agree with Gerard. Sounds like a virus/spyware infection. What happens
when you scan for crapware?

smackedass

I wound up booting to an XP image cd, allowing me to access all of the user's data, transferring it
all to another shared drive on the network. Then I wiped it clean, re-installed everything and
restored all data after running virus\spyware\adware scans on the it. All turned out well but it as
one hell of a jump through hoops.

Tony


On Fri, 09 Nov 2007 18:16:33 GMT, (Gerard Bok) wrote:

>On Fri, 09 Nov 2007 11:21:03 -0500, Tony < >
>wrote:
>
>>Someone brought me a HP Notebook with important data on it that was dead. It was the power jeck that
>>had to be replaced. Once that was fixed, Windows would take aorund 10 minutes to boot in normal and
>>safe mode. When it finally did, the mouse would move in 10 second intervals. In other words, it
>>would take 5 minutes to drag the mouse from one point of the desktop to another because it would
>>intermittanly freeze. Eventually, it would just shut off.
>
>That could well be a sign of a virus (or other malware) presence.
>
>>I removed the hard drive and connected it to a desktop PC. I could see everything on it except the
>>HP_Laptop user's files. I did not have permission. I told the customer that that can occur when
>>there is a password on the user account. He assured me that there was no password.
>
>That could indicate some type of hostage virus. (A virus that
>encrypts user data. And only tells the user that after almost all
>of his data is encrypted.)
>
>>How does one do a repair installation if XP setup does not even see the current Windows that is
>>there. Does anyone know which file may be damaged that would cause this to happen?
>
>Not.
>Be very carefull. There are virus variants around that encrypt
>part or whole of your harddisk while keeping the keys you need
>for decoding in the MBR area. Wipe that (by doing a new install
>or 'FDISK /MBR') and say good-bye to all your precious data