Ransomware prevented rescue cd-rom to boot

Discussion in 'ESET Smart Security' started by Niels, Jan 29, 2013.

Thread Status:
Not open for further replies.
  1. Niels

    Niels Registered Member

    Joined:
    Jul 29, 2005
    Posts:
    466
    Location:
    Belgium
    Dear,

    When I was trying to disinfect an infected laptop with ransomware, which prevented to boot into safe mode, I was unable to start the rescue cd-rom. It always blue screened, just before you get into the scan environment. Only a rescue cd-rom that is based on a Linux distro was able to start and perform a scan. Can this issue being investigated? Because normally the rescue cd-rom always booted successfully. Is it possible to offer also a linux distro based rescue cd-rom?

    Regards,
    Niels
     
  2. TheKid7

    TheKid7 Registered Member

    Joined:
    Jul 22, 2006
    Posts:
    3,469
    You might try booting a Linux Distro which has GParted and check to see if you have an extra small partition that is set Active (Active is called something different in GParted). I recently saw a YouTube Video made by Britec09 showing how to use GParted to:

    1. Delete this small partition which was created by Ransomeware and made the Active Boot Partition.
    2. Make the correct Partition bootable with GParted.
    3. Make the correct Partition Active (Active is called something different in GParted.)
    4. Use the Windows Installation CD/DVD to repair the MBR.
     
  3. Niels

    Niels Registered Member

    Joined:
    Jul 29, 2005
    Posts:
    466
    Location:
    Belgium
    Hello TheKid7,

    Thanks, for the suggestions. I was able to clean the laptop. Only after that the rescue that were linux based remove some parts of the infections, only at that moment the Eset rescue cd-rom was able to boot.

    Regards,
    Niels
     
Thread Status:
Not open for further replies.