ukash malware, no safe boot mode

[caintry_boy]

Try this one for the Puppy Linux ISO > http://distro.ibiblio.org/pub/linux/distributions/puppylinux/puppy-5.2.8/lupu-528.005.iso

And this one for BurnCDCC > http://www.snapfiles.com/php/sfdwnld.php?id=108048&a=7122834&loc=2

 

 

 

 

[Tomk_]

I'm not sure. I've never burned a dvd. Seems like it should work. CD's are much cheaper.

 

Based upon a little research it would appear that dvd's should boot just like cd's

[ekih]

it's a booting, I may not be able to finnish this till tomorrow aft. work.

[ekih]

• Click on the folder that represents your USB drive (sdb1 ?) after mounting the window that is open is /mnt/sdc1
• Confirm that you see the query.sh file in the main window all it shows is the file query.exe not query.sh forgot to run file
• Click Tool at the top tool at top of what?
• Select Open Terminal
• Type bash query.sh in the Terminal window then press Enter
• After it has finished a report will be located on your USB drive named RegReport.txt
• Remove the USB drive and insert it back in your working computer and navigate to RegReport.txt

Copy and paste the RegReport.txt in a reply here for my review.

Edited March 19, 2013 by ekih

[caintry_boy]

Sounds like you need to do it again and make sure you get it all this go-round...

 

 

 

• Install your Flash Drive that contains Query.exe that we downloaded for xpud earlier
• Set your language, time. etc preferences and continue
• Click the Mount Icon located at the top left of your desktop (should be 3rd from the left top row)
• A Window will open, click mount for each drive listed
• if you have a USB Flash Drive connected it's usually automatically mounted upon boot, but click the "usbdrv" tab and make sure it is mounted.
• Click on the folder that represents your USB drive (sdb1 ?)
• Confirm that you see the query.sh file in the main window
• Click Tool at the top
• Select Open Terminal
• Type bash query.sh in the Terminal window then press Enter
• After it has finished a report will be located on your USB drive named RegReport.txt
• Remove the USB drive and insert it back in your working computer and navigate to RegReport.txt

Copy and paste the RegReport.txt in a reply here for my review.

 

 

Good luck!

 

 

edit: sorry Tom, you're the one helping hm...

 

 

 

[ekih]

<p>Click <em>Tool</em> at the top</p>

<p> </p>

<p> </p>

<p> </p>

<ul>

<li>Click on the folder that represents your USB drive (sdb1 ?) when I click on the folder it opens with folder chntpw and files oldregreport.txt, query.exe, query.sh, and regreport.txt.</li>

<li>Confirm that you see the <strong>query.sh</strong> file in the main window yes I do</li>

<li>Click <em>Tool</em> at the top<br />

<p>I don't see where you want me to click, to get to Select <em>Open Terminal</em></p>

<p><em>is it something I'm not seeing</em>, at the top it has an up arrow, house, right arrow, refresh, zoom, show extra details, change sort criteria, show/hide hidden files, select all, show rox-filer help</p>

</li>

</ul>

<p> </p>

<ul>

<li>

<p><em>Also the only drives I see are the DVD and USB stick.</em></p>

</li>

</ul>

Edited March 19, 2013 by ekih

[Tomk_]

I am sorry ekih. I gave you confusing directions.

 

I've burned a copy of the same version of Puppy so here are correct instructions for what you are seeing.

 

Once you have got puppy running and have selected the usb drive so you can see queary.sh:

 

Right click on query.sh and select Window in the window that pops up. Then select Terminal here. A terminal window will open where you will enter bash query.sh. The script will run and create a file on your usb drive called RegReport.txt. Put the usb drive back in your good computer, access RegReport.txt and paste the contents here.

[Tomk_]

 

 

edit: sorry Tom, you're the one helping hm...

 

 

 

No problem c_b. I am not a linux guru and obviously I need all the help I can get as I gave instructions that were old/confusing.

[ekih]

When I open RegReport.txtg all there is "Remote Registry Report"

nothing else.

 

When in puppy I can't see the hard drive, I may know why.

It is a work computer and I was told the hard drive is probably encrypted.

Would this change things?

[Tomk_]

Sure could. It is my understanding that you can only access encrypted drives through the encryption program. (Kind of the whole point of encrypting the drive in the first place.) Some programs, such as TrueCrypt have you make a rescue disk so that you can un-encrypt the drive. I'm guessing you don't have such a critter?

 

 

It is a work computer and I was told the hard drive is probably encrypted.

Sounds like you should be talking to your IT department instead of me.

[ekih]

Tom

 

I wish to thank you immensely.

When sending to our IT dept. that can take a long time.

So I usually try to sort it out myself first.

I sent it off today, it took me 2hr just to get the right paper work done.

 

Thaks again

James

[Tomk_]

Sorry I couldn't help you resolve this but I believe you made the only reasonable decision.

 

Good luck!