Had a nasty virus, now trying to recover

[DyslexicHobo]

To preface this, my mom's computer has a RAID 1 setup, which one of the drives is dead. It hadn't been causing a problem so I never bothered to replace the damaged drive. Whenever I tried to boot up into safe mode when it got the virus, it BSOD'd after loading MUP.sys.

My mom's computer got a nasty virus - Internet Security 2010. I tried using all of the recommended removal methods such as running MBAM and doing it manually via regedit and deleting the core virus files. Neither worked. The virus kept coming back. Whenever I tried to boot into safe mode it BSOD'd. I decided I'd put it into my computer as a secondary drive and boot it into safe mode to run MBAM. I was able to run it fine. It found a bunch of threats which I deleted, then put it back into my mom's computer.

It gave me a RAID error saying that the drive was not a RAID drive (I'm guessing because I made changes to just the single drive). I pressed F1 to continue and it booted up into Windows. I try to log in, but as soon as my wallpaper appears it automatically logs me out. The BSOD recommended I run CHKDSK/F, so I tried to run CHKDSK from the recovery console via XP installation CD. It said "volume appears to contain one or more unrecoverable problems" whenever I tried to run chkdsk.

Right now, I'm just trying to figure out how to get my step-dad's important documents from his My Documents folder. Since his username is passworded, I cannot access the files by plugging the drive into my computer.

Yes I know we're dumb for not using any backup, but that's in the past now. Thanks for any help.

 

[Gustavus]

There is a very useful bit of freeware called OphCrack that can generally recover user passwords.

http://ophcrack.sourceforge.net/

Download it on your computer, unpack it to the bootable CD and then boot from that CD on your mothers machine with the drive installed. It will check for all of the users and then in a time that depends on how secure the user passwords were, show them for each user as it recovers them. A typical 7 or 8 character password takes at most a few minutes to recover. Hope this helps.

 

[DyslexicHobo]

Sorry, it's not that I don't know the password, it's that I can't access the "My Documents" folder when the drive is in another computer because the files are encrypted (it says "Access Denied" when I try to open it; I was under the assumption this was because his user name was password protected).

 

[RebateMonger]

If you can't access the files, then take ownership of the folder and give yourself any needed access permissions. Do a search of Microsoft's site for "take ownership" and follow the instructions CAREFULLY.

If you mean the files were EFS encrypted (or some other type of encryption) and if you don't already have the necessary recovery tools, then, yeah, you have a problem. But "Access Denied" does not equal encryption.