How To Remove Polezei Virus on an Encrypted Drive

[allanc]

This is going to sound completely crazy

If you turn on the clients computer let it go into 7 and let it sit there, then leave the power cable from the clients computer in but swap the sata cable from the clients computer and then slave the drive onto your computer (still leave their power cable in) and see if you do safe mode or live cd or flash drive removal.

Of course the above assumes that the hard drive will not go back into a 'locked' state.

Now I know I may get some people moaning or having a go because it dangerous or totally stupid and in one way it is and there are no guarantees. and I wont blame you for having a go at me.

I did this a few times before with IDE drives although with that we used the 'pause/break button at POST and had another working pc and was able to access locked drives this way, long shot and risky but you'll never know maybe just worth a try.

Well... I won't have a go at you.
I would never attempt something that I consider risky like this without a full image backup which did not run successfully (see earlier in the thread).

 

[hmig89]

what what? is that perhaps something that works on hard drives with built in hardware encryption?

Possibly, it was a lot of years ago, and it worked on IDE drives. I suppose It wont work on SSD's as they differ.

Assuming a simple theory of when ProtectDrive comes into action? Is it on boot up? I know McAffee endpoint asks for a password before the windows password which then takes the drive off the encrypted state. IF the drive can be slaved keeping it powered to new PC it could be possibly, although suspect the encryption software maybe to smart not to come into play and detect the change.

 

[allanc]

Possibly, it was a lot of years ago, and it worked on IDE drives. I suppose It wont work on SSD's as they differ.

Assuming a simple theory of when ProtectDrive comes into action? Is it on boot up? I know McAffee endpoint asks for a password before the windows password which then takes the drive off the encrypted state. IF the drive can be slaved keeping it powered to new PC it could be possibly, although suspect the encryption software maybe to smart not to come into play and detect the change.

Yes, the user enters a username and password before the Windows splash screen.

 

[hmig89]

http://c3.safenet-inc.com/downloads...rotect Drive - Frequently Asked Questions.doc

See the word doc above tells you PD allows and doesn't allow might put you on the right track.

 

[allanc]

http://c3.safenet-inc.com/downloads...rotect Drive - Frequently Asked Questions.doc

See the word doc above tells you PD allows and doesn't allow might put you on the right track.

For the future.
The client picked up his notebook this morning.