4

A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white screen covers everything. Sometimes there's random characters in the upper right cornor of the white screen.

Since we can't get into Windows and run a virus scan and the hard drive is encrypted so we can't boot from another disk and run the virus scan from there, I'm not sure what to do? The computer should have Symantec End Point Protection running on it (unless the virus knocked it out).

Improve this question
5

This question is a bit off-topic, but I'll post my personal experience with a similar issue.

  1. Create a VistaPE image.

  2. Integrate PGP into the image (Follow this guide and download the PGP tools from here)

  3. Burn the VistaPE image, then boot from it.

  4. Use the following command to decrypt the disk:

    pgpwde --decrypt --passphrase "YourPassword" --disk 0 --all-partitions

Note: I'm not entirely sure, but I probably had to use

pgpwde  --auth --passphrase "YourPassword"  --disk 0  --all-partitions

first to get to work. Just give it a spin.

Improve this answer
2
  • You could probably get a similar effect using an Ubuntu live-cd, seahorse-tool (to decrypt PGP), and ClamAV (for the virus scanning). – Travis Pessetto May 13 '13 at 18:16
  • 1
    @TravisPessetto Please teach me how. I've spent long nights trying to do that, I wasn't able to. Maybe there's some trick. No matter how hard I tried, I wasn't able to decrypt a PGP Whole Disk on Linux. – Adi May 13 '13 at 18:38
3

Another option is to put the drive in another computer that has PGP installed and decrypt and scan the drive from there. Make sure that the other computer is either a burner or has auto-play turned off to make sure the virus doesn't get an opportunity to spread from the infected encrypted drive though.

The key is to load the drive in a clean environment that can use PGP or compatible software to decrypt the drive and allow a virus scanner to access it. Any method that accomplishes that goal should work.

Improve this answer
2

According to Symantec, it's possible to:

6.Decrypt the disk using another system - Remove the hard disk and slave the disk to another system with PGP Desktop installed to decrypt the disk.

So you should be able to mount this HD in another computer, and extract all the relevant files to make a backup.

I wouldn't bothering removing the virus: if the user is worried enough about security, he/she should know that it's better to install everything from the beginning and, after having Windows + antivirus + firewall + etc again, he/she could restore the files from the backup you just made.

Improve this answer
1
  • 1
    +1 I think this should be the accepted answer. I wasn't aware that this was possible. I can't believe I didn't thoroughly check the docs. Thanks for the info – Adi May 13 '13 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.