File Recovery Virus Problem

[brmeau]

Under My Computer it has a section for Hard Disk Drives.  The first listed says "RAMDisk(B:) Local Disk.  The second listed says "TOSHIBASYSTE... Local Disk.  I will assume that this second one should be drive C: although it does not state it specifically.  When I choose this Toshiba one it only shows the folders/files as before.  No data, music, or pictures that I had saved appear anywhere.

[essexboy]

OK from the command prompt type the following and we will see if windows can copy the registry  files across

sfc /scannow /offbootdir=C:\ /offwindir=C:\windows

[brmeau]

I typed what I thought the script was.  Are there any spaces?  I inputed it with no spaces...if that is the case then I got the following:

'sfc' is not recognized as an internal or external command, operable program or batch file.

[essexboy]

sfc   /scannow   /offbootdir=C:\ /offwindir=C:\windows

I have exaggerated the spaces. each gap is one space

[brmeau]

I received the exact same error message with the spaces now.

Just to be sure, in the command mode, I am at X:\Programs\MBRFix>

This is where it defaulted to when I selected it.

[essexboy]

At X type CD..  to tak you to the root and try from there ....  I am beavering away on other sites at the moment looking for a resolution

[brmeau]

I went down to root X:\> and received the exact same error message that 'sfc' is not recognized.........

[essexboy]

From the Reatogo desktop could you run OTLPE

• Double-click on the OTLPE icon.
  
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
  
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start.
• Press Run Scan to start the scan.
  
• When finished, the file will be saved  in drive C:\OTL.txt
  
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.   
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.
  

[brmeau]

Hello..

Only got to step 2...select the windows folder of the infected drive...

I chose/clicked the one labeled "Toshiba System Volume (C:) and hit enter...a RunScanner Error message appeared saying "Target is not windows 2000 or later.  I press ok and it takes me back to Reatogo desktop.

[essexboy]

That would suggest the MFT is corrupted

It looks like we may need to do a parallel install of windows ..  Do you have the CD.. 

At the moment I am just checking out an ISO download of windows to confirm it is legitimate

[brmeau]

I have 2 cd's that came with the system.  One is titled Toshiba Recovery and Applications/Drivers Windows Vista Home Premium 32-bit.  The other cd is titled Windows Anytime Upgrade.

I am coming to the conclusion that all of my data is gone forever, is that true?

Again, thank you for your help.

[essexboy]

Unfortunately that appears to be the case

I am not sure if the Toshiba disc will allow you to install windows without disturbing the documents and settings.  As there are some that will just reinstall the windows compnents 

[voodoo322]

here is what I did.  Just needed to out smart the idiots who write these things...

The virus disables alot of functions in your profile, so I logged on as a "Guest".  The virus did not affect the Guest profile, just like it does not affect the safe mode profile.  As a guest i did a system restore to a point where i know i did not have the virus.  Took about 30 minutes to restore.  rebooted and entered my normal profile.  Virus gone. 

I'm still going to research to see if i still have it in my computer, but for now, the virus is not active.

Hope this works for you, it did for me.

Armando