Virus with PGP Encryption Preventing Virus Scan

Question

A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white screen covers everything. Sometimes there's random characters in the upper right cornor of the white screen.

Since we can't get into Windows and run a virus scan and the hard drive is encrypted so we can't boot from another disk and run the virus scan from there, I'm not sure what to do? The computer should have Symantec End Point Protection running on it (unless the virus knocked it out).

Answer 1

This question is a bit off-topic, but I'll post my personal experience with a similar issue.

1. Create a VistaPE image.

2. Integrate PGP into the image (Follow this guide and download the PGP tools from here)

3. Burn the VistaPE image, then boot from it.

4. Use the following command to decrypt the disk:

   pgpwde --decrypt --passphrase "YourPassword" --disk 0 --all-partitions

Note: I'm not entirely sure, but I probably had to use

pgpwde  --auth --passphrase "YourPassword"  --disk 0  --all-partitions

first to get to work. Just give it a spin.

Answer 2

Another option is to put the drive in another computer that has PGP installed and decrypt and scan the drive from there. Make sure that the other computer is either a burner or has auto-play turned off to make sure the virus doesn't get an opportunity to spread from the infected encrypted drive though.

The key is to load the drive in a clean environment that can use PGP or compatible software to decrypt the drive and allow a virus scanner to access it. Any method that accomplishes that goal should work.

Answer 3

According to Symantec, it's possible to:

6.Decrypt the disk using another system - Remove the hard disk and slave the disk to another system with PGP Desktop installed to decrypt the disk.

So you should be able to mount this HD in another computer, and extract all the relevant files to make a backup.

I wouldn't bothering removing the virus: if the user is worried enough about security, he/she should know that it's better to install everything from the beginning and, after having Windows + antivirus + firewall + etc again, he/she could restore the files from the backup you just made.