Fortunately for me, this is not a topic about me. This is about a friend of mine who somehow installed (to my understanding) a pretty powerful virus. It removed his administrative powers, is preventing Windows Defender from running any type of scan (including offline mode), is blocking all 'reset PC' options, and somehow wont let us boot into recovery mode.
We tried to wipe the infected (C:) drive (it's his only drive) with the Command Prompt, but since he doesn't have admin powers, we couldn't.

Does anyone have any ideas how to reset his PC? I've looked around the web, but couldn't find anything useful.

He has a Leveno laptop running Win 10. I don't know what he installed, but it's annoying.
Now would be a bad time to find out he doesn't have back ups. I'm sure there are more technical solutions but I'd just cut my loss and install a new HDD, or even upgrade to an SSD.
I would try wiping the hard drive through a bootable flash drive, such as Ubuntu:
http://www.techieinspire.com/completely-wipe-hard-drive-ubuntu-live-disk/

Just follow those instructions, although I would recommend putting it on a flash drive rather than a CD.
Thanks Alex and andressevilla, now one question I have is how will he reinstall Windows? The laptop came preinstalled with it, does he need some key or code to reactivate it?
You can download the ISO from the Microsoft website, I believe, just make sure you know his product key for the reinstallation.
I would also suggest a liveCD - even a winPE based one so that they can utilise some portableapps security software: https://portableapps.com/apps/security
TheLastMillennial wrote:
Thanks Alex and andressevilla, now one question I have is how will he reinstall Windows? The laptop came preinstalled with it, does he need some key or code to reactivate it?

If it was Windows 10, then as andressevilla pointed out, you can download the ISO from the Microsoft Website, and use the Media Creation Tool to create a bootable USB flash drive to reinstall Windows (it's more simple than it sounds, just go here and under "Create Windows 10 installation media", click the "Download tool now" button).

During the installation process, you can skip the activation key screen and when it finishes installing, it *should* recognise the mother board and activate itself. Worst case, you can call Microsoft and they can log on remotely to activate it.
Something I found out, if your login was linked to a microsoft account, then using that same account should re-establish his key. Dunno entirely how it works, though...
Sorry to burst his bubble, but knowing how to browse safely and not clicking on suspicious or "too good to be true" links is better than any antivirus. Here are my suggestions for your friend:


  • Don't download the wares with a z.
  • If you ever click on a result and it appears to be redirecting you to multiple domains in gradual sequence, it's probably malicious and you should go back or close the tab as soon as possible.
  • Search results such as "Free Download [your exact search term] Now" are never to be trusted.
  • Search results with all title case are never to be trusted.
  • PDF files with a shield icon are never to be trusted.
  • Many viruses cannot work without Internet, because that's where many of them take their payloads from. If you think you have a virus, unplug your Ethernet cable. If you see the hard drive light churn unusually frequently, force power off the computer as well.
  • Use common sense.
oldmud0 wrote:
Sorry to burst his bubble, but knowing how to browse safely and not clicking on suspicious or "too good to be true" links is better than any antivirus. Here are my suggestions for your friend:


  • Don't download the wares with a z.
  • If you ever click on a result and it appears to be redirecting you to multiple domains in gradual sequence, it's probably malicious and you should go back or close the tab as soon as possible.
  • Search results such as "Free Download [your exact search term] Now" are never to be trusted.
  • Search results with all title case are never to be trusted.
  • PDF files with a shield icon are never to be trusted.
  • Many viruses cannot work without Internet, because that's where many of them take their payloads from. If you think you have a virus, unplug your Ethernet cable. If you see the hard drive light churn unusually frequently, force power off the computer as well.
  • Use common sense.


I am too lazy to actually make my own post so instead I quote people and then don't say anything new

Be sure to pass this on to your friend TLM. Smile
I'll make sure to give him a lecture on this! Laughing
JamesV wrote:

If it was Windows 10, then as andressevilla pointed out, you can download the ISO from the Microsoft Website, and use the Media Creation Tool to create a bootable USB flash drive to reinstall Windows (it's more simple than it sounds, just go here and under "Create Windows 10 installation media", click the "Download tool now" button).

Unfortunately the tool stops working around 30% of verifying the download. Is there a similar tool I could try to use instead?
You can use Rufus as well, to put the ISO at a USB drive.
There are two ways I usually fix Windows computers if they get killed by viruses. Either way, you want to have a Linux LiveCD or LiveUSB to boot into Linux, I'd recommend making an Ubuntu one. This can be used for easy recovery.

1. Remove the Virus Manually (difficult)

Boot from the Linux LiveCD. Windows isn't exactly a secure operating system, so you can easily use Linux to modify user accounts and usernames and passwords. Do this to make you a fresh account with administrator privileges.

If you can boot into this account, then use the Task Manager to try and locate the virus, you can right-click it when you think you found it and it will have an option to "Open File Location" which you can use to remove it from your computer.

Also check your Startup directory. Also make sure to check programs that are in your StartUp directory and check your registry for start up entries.

2. Bruteforce Factory Reset (easy)

This way you can just do an easy factory reset on your PC and have it do all the work for you. It's kind of a bruteforce tactic, but it works. Again, pop-in that Linux CD and back-up any data you want from your hard drive to a flash drive, because this will wipe all your data.

Install then run Boot-Repair. This will put GRUB on your system. Reboot the computer and you should be greeted by the GRUB which lists a bunch of locations you can boot from. Look for something along the lines of "bootmgfw.efi". This will boot directly into the recovery menu. From here, you can select "Troubleshoot" then "Reset your PC".

Afterwards, it should let you select a "Target Operating System". I've recovered two PCs this way and neither required me to use a Windows installation CD after the factory reset, it's usually capable of resetting the PC without one if you can select a target operating system to my knowledge.

Run this, and it should make your PC like new.
So I (finally) got into the recovery section. I hate Lenovo so much right now! They freaking di- but that's a rant for another time. Anyways either the virus finally broke his computer... or I did. (I forced it to shut down while it was booting up). So now his computer wont boot into Windows 10 and instead goes to system recovery. I was able to get to the 'Reset this PC' but when I tried to reset everything (yes everything, he wants the disk all cleared) it said 'there was a problem resetting this PC'.

So I put the Ubuntu iso on a flash drive and was able to boot it from the flash drive! The battery died before I could do anything though. :\

My question is: where do I go from here to reset everything? Would it be possible to get Windows 10 back on his laptop? I have his product key but nothing else.
Ok, I'm happy to announce that I successfully got a healthy Windows 10 on his laptop! It wasn't easiest thing I've ever done, but it was a good learning experience.

If, by any chance, someone wants to know my steps, here's a rudimentary step by step process:
  • Obtain infected computer,
  • Obtain that computers Product Key (not Product ID) that should have come with the laptop (if you don't know yours, you can still reinstall Windows, however you should contact the manufacturer about the key)or as Luxen stated, you can use your Microsoft login if it was tied to that computer
  • Obtain a flash drive that has at least 4Gb (It cant have any information you care about keeping since all the data on that drive will be destroyed)

  • Find out how to get into the BIOS for that laptop model
  • Go to a healthy computer that is running Windows and create a Media Creation Tool.
  • I personally made an .iso file and saved it to my local drive, then I used Rufus 2.18 (I got that download link from here) to burn it to the flash drive. This makes the flash drive bootable. (Don't worry, your drive can still be used normally later)
  • Boot the infected computer into the BIOS and make sure that it is set to boot into the flash drive. (This is different on some systems, for this Lenovo computer, I had to change the boot from UEFI to Legacy.)
  • reboot your computer, when the flash drive gets booted into, you can now follow the instructions on how to either try and repair your PC, or completely reinstall Windows.

If I missed a step, or put wrong information, please tell me!
  
Register to Join the Conversation
Have your own thoughts to add to this or any other topic? Want to ask a question, offer a suggestion, share your own programs and projects, upload a file to the file archives, get help with calculator and computer programming, or simply chat with like-minded coders and tech and calculator enthusiasts via the site-wide AJAX SAX widget? Registration for a free Cemetech account only takes a minute.

» Go to Registration page
Page 1 of 1
» All times are UTC - 5 Hours
 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

 

Advertisement