[Crag_Hack]

Hi mary58. I need to know what make/model of Dell computer you have. I have to look up some information about your computer. Please let me know then I will get back to you with further instructions.

[Advertisements]

Dell Dimension 8400

[mary58]

Dell Dimension 8400

[Crag_Hack]

Can you please also get me your service tag? It should be on a sticker on the computer case.

[mary58]

service tag 3WX3M71

[Crag_Hack]

Hello mary58. We will now create a copy of your MBR and boot.ini to analyze. Also we will create a table of your partitions. Please do the following:

• Download dumpit and save it to your flash drive.
• Insert the USB drive and CD in the Sick computer and boot the computer from the xpud CD again
• The computer must be set to boot from the CD
• Gently tap F12 and choose to boot from the CD
• Follow the prompts
• A Welcome to xPUD screen will appear
• Click the File tab
• Expand mnt by clicking the plus sign to it's left
• sda1,2...usually corresponds to your HDD
• sdb1 is likely your USB
• Double click dumpit.
• It will create some MBR copies on the USB drive.
• When it completes press Enter to exit the Terminal window.
• Press File
• Expand mnt
• Expand your USB (sdb1)
• Press Tool at the top
• Choose Open Terminal
• Type cp /mnt/sda2/boot.ini ./boot.txt and press enter
• Type cfdisk -P s /dev/sda >drives.txt and press enter
• Shut down the computer
• Remove the USB drive, then locate on it mbr.zip, boot.txt, and drives.txt, and upload these as attachments please.

Things to see in your next post:
mbr.zip
boot.txt
drives.txt

[mary58]

There is no boot.txt file, on the terminal it said, cannot stat no such file or directory, I tried that for sda 1 and sda 3 also, just in case and it came back the same thing.

I'm attaching the mbr.zip file and below is the drives.txt file

Partition Table for /dev/sda

First Last
# Type Sector Sector Offset Length Filesystem Type (ID) Flag
-- ------- ----------- ----------- ------ ----------- -------------------- ----
1 Primary 0 96389 63 96390 Dell Utility (DE) None
2 Primary 96390 302086259 0 301989870 HPFS/NTFS (07) Boot
3 Primary 302086260 312496379 0 10410120 CP/M / CTOS / . (DB) None

Attached Files

•  mbr.zip   2.26KB   263 downloads

[Crag_Hack]

Hiya mary58. Everything looks good. I am consulting a colleague about how to make OTLPE see your hard drive so we can run our main diagnostic utility. Sorry for the wait. I should have further instructions tomorrow.

[mary58]

thank you

[Crag_Hack]

Hi mary58. Your MBR dump looks clean as does your parititon table. I did some thinkin and came up with a possible solution to the problem of OTLPE not detecting your hard drive. If it works we can use our normal diagnostic utility which will give us the upper hand in fighting this infection. Please do the following:

Download  drivers.zip   160.54KB   272 downloads and extract its contents to a folder on your flash drive.

• Download Farbar Recovery Scan Tool and save it to a flash drive (unless you already have it)
• Download ListParts and save it to the same flash drive (unless you already have it)
• If you don't have the OTLPE cd anymore please recreate it:
  
  • Download OTLPENet.exe to your desktop on a working computer
  • Ensure that you have a blank CD in the drive
  • Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
• Reboot your infected system using the OTLPE CD
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
  
• Navigate to the folder containing the drivers.zip files on the flash drive
• Right-click on the iaahci.inf file and click install (it will take 20 seconds or so to detect your drive if it works)
  Icon will look like this:
• If you are prompted to reboot do not reboot
• Navigate to My Computer and see if your main drive is present (you can check by opening it and verifying the Windows and Program Files directories are present)
• If OTLPE picks up the drive we win and follow the rest of the instructions. If not let me know and I will get back to you.
  
• Run FRST by navigating to the flash drive then open FRST.exe
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply
  
• Run ListParts by navigating to the flash drive then open ListParts.exe
• Press the Scan button.
• When finished scanning it will make a log Result.txt on your flash drive.
• Please post me the contents of the log.

Things to see in your next post:
FRST.txt
Result.txt

[mary58]

When I right click on the iaahci.inf file nothing happens. I did check by navigaiting to My Computer, but my main drive isn't showing.

[Crag_Hack]

did you make sure to click install?

[mary58]

Yes, I tried it 3 or 4 times just to make sure.

[Crag_Hack]

Hiya Mary58. I found out how to load the necessary drivers for your hard drive. (I've never done this before that's why I had some trouble figuring it out) Anyways I will have more instructions for you soon and we can get started with the main diagnostic tool. Your infected computer will need a floppy drive for this to work so make sure it has one and let me know if it doesn't.

[mary58]

Sounds good.


I have a usb floppy drive. Now to dig out those old floppy's-- there's some blank ones around here somewhere.

Thanks again for your help.

[Crag_Hack]

I'm not sure if a usb floppy drive will be recognized on your infected computer by OTLPE. Does your infected computer have an internal floppy drive? If not we can try using the usb one.