Rescue yourself if your computer is already compromised—here's how

October 31, 5:58 PMSF Computer Virus ExaminerLenny Bailes

Previous

Comment Print Email RSS Subscribe

Subscribe

Get alerts when there is a new article from the SF Computer Virus Examiner. Read Examiner.com's terms of use.

Email Address   Include other special offers from Examiner.com Terms of Use

Some of the viruses discussed in previous posts may damage the boot process on your computer to the point where  you can no longer start up. You can't get to an OS interface that will let you disinfect the computer with a good A-V tool (such as Avira Antivir or  Malwarebytes Anti-Malware). 

What can you do if a virus or spyware attack has rendered your computer unbootable? You have several alternatives.  The most expensive one, taking the computer into a commercial repair shop, is often the least effective solution. You need to be careful when choosing a virus removal service. Check word-of-mouth reviews and Internet buzz before proceeding. Most computer repair services are honest, but the techs responsible for removing a new virus or spyware threat may not know any more than you do about whether their existing tools can get the job done. If you decide to use a commercial repair service, be sure to ask for a preliminary report and work estimate. If possible, find out whether they've identified the specific problem on the PC and whether they've dealt with it before. Giving the clean-up chore to someone else may spare you from having to think any more  about the internal mysteries of how computers work. But  maybe it won't. 

Learning a bit more about how your computer works may ultimately be a better investment of your time. Once you've located a reliable set of antivirus and antispyware tools, it's not all that difficult to use them, even if you have an infected computer that won't boot into the operating system. There are two basic ways to rescue an unbootable computer: 

1. If you have more than one PC, take the infected hard disk out of the first computer and install it in a second (protected) PC. This isn't as difficult as it might sound, particularly if you're willing to invest in a cheap USB drive-mounting gizmo such as the Apricorn DriveWire. (See the image at the upper-right .)
    
2. If you have only one PC, download an antivirus rescue kit NOW, while the computer is still bootable. If you're reading this blog entry on a friend's computer, ask if it's OK to download the rescue kit there. If the computer has a CD-R/DVD-R drive that permits CD-burning, you can go to your local drug store, buy one or two blank CDs, launch the rescue kit program and burn a bootable antivirus rescue CD. The good ones have the ability to establish an Internet connection right from the CD and download the latest virus detection patterns.

In modern PCs, temporarily removing the hard disk is generally a simple and painless procedure— particularly with laptop models. Check the installation manual that comes with the computer to find out how.  (On laptops, you'll probably need to remove a few screws on the bottom side of the chassis and slide the 2.5-inch drive out of its slot. Modern desktop PCs are only slightly more complicated.  You'll need  to slide off one side of the case, disconnect a few cables and pull the drive out of its slot.)  Once you have the infected drive in hand, you can plug it into the second computer (which you'll remember should already be protected by antivirus and/or anti-spyware utilities with real-time scanning ability). The Apricorn Drive-Wire, referred to above, will allow you to connect a bare hard drive of almost any type to a USB-conversion mechanism (3.5" and 2.5" IDE PATA and SATA form factors are supported).  You don't need an external case or power supply. You just need to exercise reasonable care and gentleness in handling the bare hard drive until it can be disinfected and returned to the original computer.

After the infected drive is temporarily plugged into a USB port on the second computer. it will be recognized and assigned a new drive letter. Run the malware removal program on the infected drive, then put it back in the original computer. Chances are good that the drive will now boot into the operating system, allowing you to download and install a good Antivirus/Antimalware application to prevent the problem from recurring.

PS: The Apricorn DriveWire, priced at $31.99, is an excellent deal. In addition to allowing a bare hard drive to easily be mounted on a second PC, it includes a good set of software utilities that can back up individual disk partitions or automatically transfer the complete partition structure from one drive to another. (This is the actual intended use. You can start with an old drive that has two or more partitions and automatically transfer  the partitions to a new disk. If the new disk is larger, you can automatically or manually expand the partition sizes on the new disk.)