Virus infection on a T60 == how best to reinstall WindowsXP? Can Isafely still use the special Windows installation partition?

Hi


My T60 (WindowsXP Pro) has been infected with several viruses.

Is it safe to re-install from the WindowsXP partition?

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?


And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that there
will be problems with the Product Key and License number etc)

Any thoughts?

With thanks



Ship

P.S. For clarification my computer is a T60 laptop from Lenovo. (about
3 years old)

With thanks


Ship
Shiperton Henethe

From: "ship"

| Hi
| My T60 (WindowsXP Pro) has been infected with several viruses.
| Is it safe to re-install from the WindowsXP partition?
| Or should I kill absolutely everything on the disk (eg. by running
| KillDisk off a CD)?

| And if I do the latter, how on earth to I register it with Microsoft
| because the laptop did not come with any CDs.
| (I can borrow a Windows XP Pro CD from work - but I presume that there
| will be problems with the Product Key and License number etc)

| Any thoughts?
| With thanks
| Ship

What Cross-Post to all those groups and NOT; microsoft.public.security.virus ?

What "viruses" (assuming they were viruses and not plain old trojans) were they ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

ship wrote:
Hi


My T60 (WindowsXP Pro) has been infected with several viruses.

Is it safe to re-install from the Windows XP partition?

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?


And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that there
will be problems with the Product Key and License number etc)

Any thoughts?

With thanks



Ship

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:

http://www.techmixer.com/free-bootab...download-list/

Download the executable rather than the .iso image, if one is available,
(though no .exe is available for BitDefender).

After the scan is run, if you elect to quarantine files, they're
quarantined to RAM and lost after you reboot. You'll need to copy any
quarantined files to the hard drive, a thumb drive or elsewhere before
exiting.

Then run these:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/supe...freevspro.html

--
Joe =o)

HOW TO do a clean install of WinXP: See
http://michaelstevenstech.com/cleanxpinstall.html#steps and/or Method 1 in
http://support.microsoft.com/kb/978307

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a network and before using a flash drive or
SDCard that isn't brand-new or hasn't been freshly formatted:

4 steps to help protect your new computer before you go online
http://www.microsoft.com/security/pypc.aspx

Other helpful references include:

HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
(after a clean install)
http://groups.google.com/group/micro...5afa8ed33e121c

HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
clean install)
http://groups.google.com/group/micro...66ae41add7dd2b

Tip: After getting the computer fully-patched, download/install KB971029
manually: http://support.microsoft.com/kb/971029

NB: Any Norton or McAfee free-trial that came preinstalled on the computer
when you bought it will be reinstalled (but invalid) when Windows is
reinstalled. You MUST uninstall the free-trial and download/run the
appropriate removal tool before installing any updates, Windows Service
Packs or IE upgrades and before installing your new anti-virus application
(which will require WinXP SP3 to be installed).

Norton Removal Tool
ftp://ftp.symantec.com/public/englis...moval_Tool.exe

McAfee Consumer Products Removal Tool
http://download.mcafee.com/products/...tches/MCPR.exe

Also see:

Steps To Help Prevent Spyware
http://www.microsoft.com/security/spyware/prevent.aspx

Steps to Help Prevent Computer Worms
http://www.microsoft.com/security/worms/prevent.aspx

Avoid Rogue Security Software!
http://www.microsoft.com/security/antivirus/rogue.aspx
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002
www.banthecheck.com


ship wrote:
Hi


My T60 (WindowsXP Pro) has been infected with several viruses.

Is it safe to re-install from the WindowsXP partition?

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?


And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that there
will be problems with the Product Key and License number etc)

Any thoughts?

With thanks



Ship

On Jan 19, 6:16*pm, ship wrote:
Hi

My T60 (WindowsXP Pro) *has been infected with several viruses.

Is it safe to re-install from the WindowsXP partition?

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?

And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that there
will be problems with the Product Key and License number etc)

Any thoughts?

With thanks

Ship

If you think it is best to start from scorched earth, I would delete
everything - even the special Windows installation partition. You do
not know the status/health of it with 100% certainty. Even if you
could use it, if something goes wrong later, you will always wonder if
it was really part of the problem or not. Eliminate the possibility
of that question ever coming up - whack it.

You can certainly make a copy of a genuine bootable XP installation CD
to keep with your computer. Don't borrow it, make a copy for you. It
is not unethical to make a copy of a Windows CD. It is unethical to
apply the same license key to different computers. Be sure it is of
the same version you have now (Home, Pro, etc). If you don't need it
now, you will be glad you have it some other day.

Before you reinstall, you should determine the currently installed
licensing information on your current system (if it runs) and use that
when reinstalling. It may be on a sticker on your PC that is
unreadable, lost or missing. You need to figure out what Windows
thinks, not what some sticker says.

The information is already on your system of course, you just need to
find it and write it down for later.

You can use one of several free tools, or use them all and see which
one you like best:

Magic Jelly Bean:
http://magicaljellybean.com/keyfinder/

SIW:
http://www.gtopala.com/

Belarc:
http://belarc.com/free_download.html

It would be more fun to just fix your current unspecified problem and
not reinstall, but you can/should certainly find out the licensing
information and get a copy of a genuine bootable XP installation CD of
your own and keep it in a safe place for the future - or the present...

On Wed, 20 Jan 2010 04:12:47 -0800 (PST)
Jose articulated:

On Jan 19, 6:16Â*pm, ship wrote:
Hi

My T60 (WindowsXP Pro) Â*has been infected with several viruses.

Is it safe to re-install from the WindowsXP partition?

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?

And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that
there will be problems with the Product Key and License number etc)

Any thoughts?

With thanks

Ship

If you think it is best to start from scorched earth, I would delete
everything - even the special Windows installation partition. You do
not know the status/health of it with 100% certainty. Even if you
could use it, if something goes wrong later, you will always wonder if
it was really part of the problem or not. Eliminate the possibility
of that question ever coming up - whack it.

You can certainly make a copy of a genuine bootable XP installation CD
to keep with your computer. Don't borrow it, make a copy for you. It
is not unethical to make a copy of a Windows CD. It is unethical to
apply the same license key to different computers. Be sure it is of
the same version you have now (Home, Pro, etc). If you don't need it
now, you will be glad you have it some other day.

Before you reinstall, you should determine the currently installed
licensing information on your current system (if it runs) and use that
when reinstalling. It may be on a sticker on your PC that is
unreadable, lost or missing. You need to figure out what Windows
thinks, not what some sticker says.

The information is already on your system of course, you just need to
find it and write it down for later.

You can use one of several free tools, or use them all and see which
one you like best:

Magic Jelly Bean:
http://magicaljellybean.com/keyfinder/

SIW:
http://www.gtopala.com/

Belarc:
http://belarc.com/free_download.html

It would be more fun to just fix your current unspecified problem and
not reinstall, but you can/should certainly find out the licensing
information and get a copy of a genuine bootable XP installation CD of
your own and keep it in a safe place for the future - or the
present...

A fresh Format/Installation would certainly eliminate a lot of
potential problems that might exist on your system. Before nuking the
drive, do insure that you have the "key" for reinstalling Windows.
Next, visit this site:

http://tech.icrontic.com/articles/wi...ver_collection

It has some information that might prove useful to you. You might be
interested in: DriverMax http://www.innovative-sol.com/drivermax/
also. It could save you a lot of time. Prior to running it, do insure
that you have the latest drivers installed.

Finally, download a copy of FreeDOS http://www.freedos.org/. Create a
bootable CD, and use it to start your system. Read the documentation
first. If used correctly, it will remove all existing data and
partition info from your drive. You can then use the same disk to
reformat the drive prior to installing Windows. No entirely necessary;
however, it does help to erase all existing data on the drive.

Ciao

--
Carmel |::::=======
|::::=======
|===========
|===========
|

ship wrote:
Hi


My T60 (WindowsXP Pro) has been infected with several viruses.

Is it safe to re-install from the WindowsXP partition?

I have *never* seen or read about an instance where malware actually
alters the hidden recovery partition. I would say the answer is yes, it
is safe.

Or should I kill absolutely everything on the disk (eg. by running
KillDisk off a CD)?

No, the recovery partition is something you always want to keep (IMO).
An exception *might* be made if you have a full-fledged XP installation
CD and it _must_ match the license you have, too. Even so, if it were
me, I would still keep that hidden recovery partition intact.

And if I do the latter, how on earth to I register it with Microsoft
because the laptop did not come with any CDs.
(I can borrow a Windows XP Pro CD from work - but I presume that there
will be problems with the Product Key and License number etc)

Registration is optional. I assume you are referring to activation. The
CD you borrow (and I would recommend making a copy of it for your use)
*must* match in all respects. So the Windows XP Pro CD *must* be a
generic OEM version in order for the Product Key on your Certificate of
Authenticity (COA) sticker for activation to work. Then again, if you
simply use the hidden recovery partition, the process is much simpler
and faster. :-)

Any thoughts?

Make sure you copy all your data. Be sure to include e-mails, your
address book, Internet Explorer favorites, etc. Then follow the
instructions Lenovo provided for the recovery. You'll be fine. (Then, of
course, reinstall your programs and copy the data back.)

That being said, depending on the malware, there might be a better
solution: remove the malware. :-) If the amount of damage is minimal,
that's what I would try first. Feel free to post back with specifics,
and many here will be happy to guide you.

Might I suggest before you completely obliterate your drive to try
Avast! Anti-Virus? It comes with a boot-time scan to get rid of any
viruses before the OS boots so they can't replicate themselves.