Avast WEBforum
Other => Viruses and worms => Topic started by: arjay on February 08, 2012, 02:02:28 PM
-
Hi
A friend asked me to clean an infected notebook running win vista. I installed Avast and ran a boot scan first. There were about a dozen infected files. I moved them to chest. After the reboot, the keyboard was unresponsive and I could not log in. Same goes for safe mode.
I use linux myself and can mount the win vista HD using a linux Live CD. However, the chest folder just numbers the files 00000001, 00000002 etc. I want to be able to id the files and restore likely keyboard files if possible. Is there a way to see which file is which? If so, can I rename it and drag it back to its original location? I appreciate that might reinfect the PC but if I can't get into it at all I am stuffed anyway.
Thanks for any help people can give
-
arjay,
You don't say what type keyboard, i.e., USB or PS2, or onboard.
Does keyboard work in linux?
Keyboard should work in BIOS, but not in windows. Switching keyboards may work for you, then maybe can login into vista.
Be sure to turn off computer before switching to a PS2 keyboard, turn on, and start as normal.
You may have some sort of rootkit, and one of those files prevents windows from booting when quarantined.
Worst case, use linux to copy and paste files important to you.
EDIT:
-
Thanks so much for replying. Just as you say, the keyboard works OK in BIOS but not when I want to log into Win Vista. The K/B is the one on the actual notebook. I didn't think of trying an external one - I'll try tomorrow afternoon and report back. I am pretty sure that one of the quarantined files is required for the K/B but it isn't obvious which one - all the usual ones like keyboard.sys etc are still there. Problem is i can't log into windows to fire up Avast and have a look at the Chest. Ah well ....
-
It may be keyboard system file that was infected - plug in a usb keyboard and you should have access
-
You should be able to get into device manager using only you mouse unless you use a logon password. Check for a yellow explanation point under keyboard and just reinstall it's driver.
-
Glad to hear K/B works in BIOS.
Did you try an USB K/B?
Another workaround is to use F8 to access safe mode when you get a K/B that works, and choose Administrator. Most of the time, Admin does not have a password, just hit enter, and you are in.
Follow DonZ63's advice and repair using driver reinstall via device manager.
Failing that, go here for a copy of the keyboard driver you need and paste into the system folder using linux: WINDOWS\Service Pack Files\i386
There are three files on my XP system:
- Keyboard.sys
- Keyboard.inf
- Keyboard.drv
Only two of the files actually go into the WINDOWS\System32 folder:
I do not know what files there should be on Vista, however. An .inf file is actually an installation file for the driver, so... (Using this .inf file may take care of having to register these files as merely copying and pasting the needed files may not work. Double-clicking the .inf file should get it to run.)
I have not done this before, so am not sure if this is a needed step.
I do not recommend searching on the internet for a copy of the file(s) you may need, as some are not clean, depending on the reputation and integrity of the site you are visiting.