Virus Compromising Recovery Partition?

[colonydata]

i am working on a client's dell laptop, using the avg av live cd i found several instances of trojan/java.downloader on the C: drive.

i removed the viruses, and now i am just checking over the system, and performing some basic service items. this laptop has the hidden recovery partition, and i just noticed that the recovery partition is visible under my computer. i do not remember it ever showing up like that on this computer before. i scanned every partition on that computer just to be on the safe side and there were no infections in the recovery partition.

what i am wondering now is has the virus or something i did compromised the recovery partition?

 

[PcTek9]

tweakui ui ui ui...

You can use tweakui a free microsoft tool, just click on drives & unselect the ones you want to hide.

You can also edit the registry keys so that the drive (or any drive) will be hidden or shown.

You can also make a windows machine w/o admin priv. show you every drive on the network by editing registry key, and gain access to those network drives.

ELOS!

 

[colonydata]

im not as concerned about hiding it again as if that partition has been compromised in some way?

 

[PcTek9]

Do you see the giant list of antivirus programs at the top of this forum? In it you will find every antivirus program currently made around the world. You will also find every antirootkit, every antispyware program there as well. Pick some. Scan. See if you find anything.

More than likely you made the partition visible accidentally, I don't think a virus would do that, but... it could happen, b/c they CAN do that. So, as I have told many many people before you.

There are people who can write viruses, and you will never know their virus exists, until an a/v company figures out something is wrong, and 'they' find the virus. So if you have something to modern for detection, or that simply has eluded virus researchers for a long time, then anything is possible.

Good Luck.