Trojan.ByteVerify related disaster. Please Help.

[Mr Pants]

Okay. I'll try to keep it brief.

I'm running Win XP Pro and NAV 2003. The machine had become really
slow over the last couple of weeks so I double checked all my
definitions were up to date and ran a full virus scan (it was under a
month since the last one and I update every week).

The scan too almost 48 hours which was slightly unexpected but at the
end of it I had a load Trojan.ByteVerify related files (Beyond.class,
BlackBox.class, Dummy.class and VerifyBug.class). NAV quarantined
them and I assumed it would be okay to delete them as NAV gave me the
option. I deleted them.

I thought I'd reboot and run the virus checker again. I hit reboot
and left the room. When I cam back a pale Windows boot-up blue screen
(Safe mode? I've never seen safe mode on XP) was chugging through
disk sectors, claiming most of them to be corrupt and deleting them.
It must have been going for about 10 minutes and it was on;y on 18%.

It seemed to be wiping the whole disk. I panicked end pulled the plug
on it. It now won't boot at all. Manage to get to a command prompt
by booting from the NAV CD but it doesn't recognise any other drives
(including the hard drive).

I now realise I shouldn't have deleted the Trojan files until I'd
disabled System Restore, and I'm also pretty sure that pulling the
plug on it wasn't a great idea but I'm still quite surprised by the
apparent level of damage that's been occured.

Does anybody have any idea what happened or where I might start in at
least getting access to some non-backed up files before I have to
resort to a re-format/re-install.

Any suggestions or info appreciated, even stuff that starts with "Well
your first misake was...". I realise that I failed to keep it brief!
;-)

Cheers
Al

 

[Robin]

Just a suggestion. I assume you've tried booting from the XP CD? If
that failed there are a number of recovery packages around. When I
lost the partition with all my (unbacked-up) mail on it I used Acronis
Recovery Expert. The free demo will tell you whether it can rescue
your lost partition. If it can then you buy the full package (about 30
dollars). You can make a bootable set of floppies to run it off.


Robin

 

[Mr Pants]

I can boot from the Windows (Mesh Recovery) CD and get to a 3 choice
menu. I don't relly want to re-install at this stage because I'd like
to try and get some of my files back first, however I did run the 2nd
option which was to "repair a current installation" or something like
that.

This left me with a command prompt and I haven't yet had time to try
CHKDSK etc but at least that's a start.

I found the demo of Recovery Export but I'm not sure I can run it
without having previously installed it. Is this true? Should I be
able to see what's there from a bootable floppy with the demo on it?

Thanks
Al