I hope someone can help me...

[khaos56k]

Before anyone gets the wrong idea... I've been searching, reading, experimenting and consulting with Toshiba already for the past three days. EVERYTHING has come up bust and the recovery partition is inaccessible. This forum may be my last hope and I'm seriously looking for that helping hand... or the final nail-in-the-coffin.

I've recently taken on the challenge to rid an abused laptop (2004 Toshiba Satellite M45-S265) of numerous NASTY viruses and malware while keeping the owners files intact. I've done extremely well, if I may say so, and WAS on the road to be complete sometime today...

For no apparent reason the laptop is giving me a BSOD saying the video driver failed to load (0x0000005E) when trying to boot normally. This always happened if trying to boot into Safe Mode and felt is was a software issue to be dealt with later. I found out there's a virus that alters the beep.sys file and read the solution was to delete to infected file and replace. So... I installed a second installation of WinXP Home which, so far, works perfect. This obvious signifies the video hardware is not bad. I copied the beep.sys from the new installation to the old but no successful boot into the original WinXP. I am unfortunately unable to recover any of the owners data since her account was made "private" at creation.

Right now I'm using the OS selections menu at boot and the "old" WinXP Home is still installed. I've yet to find anyway to get around the video error so I can at least recover the data (pictures, music... etc...) or decrypt the account Doc and Settings folders.

Is there any hope to retrieve the encrypted data or workaround the video error? Or should she just learn from this and accept a reformat/reinstall of WinXP?

Thanks in adnace...

[tehboris]

Boot a Ubuntu live disk, copy files to external media. Scan them with a number of scanners.

Now reinstall Windows. If the laptop refuses to use the recovery partition get Toshiba to send you a recovery disk. If Toshiba can't/won't do this explain to the person you are doing this for that the viruses have corrupted the recovery partition, so they need to get a copy of Windows XP.

You need to reinstall Windows, there is no choice in this matter tbh. You could offer to install Ubuntu if you are up for it.

[tokenuser]

If the video drivers have been corrupted, they might not be the low level drivers, but the higher level ones that give more control.

Try booting in via safe mode (F8 on bootup). That might be enough to load the generic VGA drivers. If it doesn't safe mode can create a boot log that shows each driver as it is being loaded - that might be enough to indicate the file that was corrupted so that you can copy from the good partition.

Eitherway, I see a fresh install in the laptops future. I also see virus protection and malware scanner being installed before you do anything else (get them downloaded and on a thumb drive before you go any further).

[khaos56k]

Thanks for the replies. ALL excellent info and worth their weight in gold.

It's unfortunate that those I know, and preach to, don't understand the significance and importance of viral, spyware, malware and adware protection as we do. I'll fix it as usual and expect it back in six months just as bad...

I agree a total wipe and install is absolutely the next step... and it shall be accompanied by my usual protection "package". I'll definintely attempt each of your suggestions as my biggest concern is trying to get the personal data transfered.

tokenuser: Regardless if I choose Safe Mode or Normal Start-up... as soon as the screen changes from the Microsoft logo I get the BSOD I briefly described earlier. Hopefully you're right and the boot log will lead me in the right direction.

tehBoris: I've never used Ubuntu but I've heard of it. Will get a copy and try as you explained... And scanning is a definite necessity. Don't know if Toshiba is going to be much more help than they already were. The laptop is five years old and they're "Vista" now-a-days... I'll torment them though!