removing viruses from an encrypted drive?

Question

Whoever can figure this out will impress me. I have a computer at my shop that is encrypted with bitlocker. It has a ton of viruses on it and wont allow me to get to the desktop. It is the ICE Virus. I removed the HDD from the laptop and it wont scan it because of the encryption. There is no option to boot from the CD either. I think they removed it (its a business computer and he doesnt want to get into trouble). Any ideas?

Ed G · Accepted Answer

I got it.You can't remove a virus from an encrypted drive.Since everything is encrypted you are not going to be able to do it.The only way would be get rid of the encryption first.Since you do not seem to have the key you are out of luck.I don't need to tell someone who works on a computer how encryption works and how hard it is to by pass it.

Wide Glide · Answer

Removing the viruses is easy, BUT getting the files de-crypted is virtually impossible If you don't have a Complete Back-up or an Image of the system
CryptoLocker Ransomware Information Guide and FAQ
http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
~~~~~
https://forums.malwarebytes.org/index.php?showtopic=134420

Both methods require booting from a CD. Change the boot order from HDD to CD-ROM(Force feed it)

Anonymous · Answer

I wonder if you couldn't boot into a recovery console (maybe boot by CD with the HD in another laptop) and run the command line tools (http://technet.microsoft.com/en-us/library/ee706522%28v=WS.10%29.aspx) manage-bde.exe to turn off the encryption, scan the drive and then turn it back on when you are done.

Trending News

removing viruses from an encrypted drive?

3 Answers