12-12-2011 07:45 PM
Three days of struggling to clean an infected Thinkpad so I am ready for drastic action.
Wife's T60 2007-43U rendered useless by ramnit virus. Long story, but reformat seems like only solution.
Have T60 2008-SAA with as-built installation, and expect I can make Product Recovery discs for that machine.
Also have T60P 2007-8JU working fine, but with no recovery partition or great Thinkpad utilities,Sonic or WinDVD as reformat by previous owner deleted them. All three computers have XP Pro with SP-3.
1. Can self-made Product Recovery Disc from one Thinkpad be used to reinstall factory load on these others?
2. If so, should doing that completely clean the disk of existing virus and leave it in "new" condition?
3. Understand 6 CD's make up the factory set of Recovery Discs. The as built load is about 10GB! Is there a list somewhere of what all is included in the Recovery? Before I start making these discs, should I expect a total of 6, more, or fewer?
12-12-2011 08:42 PM
2) You should wipe the drive with DBAN or something along those lines first.
3) The set will have a total of 7 or 8 disks altogether...Rescue & Recovery + 6 CDs + possibly supplemental CD
12-12-2011 09:52 PM
As george say, you won't have a problem, the recovery discs probably have drivers for all T60 combinations. Even if one unit has a newer piece of hardware that the setup discs from another doesn't have, it's still highly probable that the system will boot with network support, so you can go online and download any drivers you need, or run system update and do it automaticly.
You can also install windows from a windows setup disc. WinXP will fit on a single 700mb cdrom disc, all the rest of that stuff on your recovery discs is bloat and redundant copies that make up your recovery partition. I prefer to do it differently though. When I rebuild a system, I make at three partitions, two of them will get windows installed, so I have dual boot and can start either. This way if your wife gets a virus or malware infection, you can simply start the other windows installation and continue until you come to her rescue. I have no need for the wasted space of a recovery partition, all I need is a windows disc and I'm set.
The third partition is to store my files, that way I can delete and reformat the others as much as I want and never have to worry about rescuing files off a partition/drive before reformatting.
Good luck, I'm sure you'll get her system fixed quickly.
12-14-2011 09:17 AM
Your recommendation about wiping first with dBan launched me into a lot of research on that and that raises a couple of questions about wiping a Thinkpad hard drive.
dBan evidently does not wipe the hidden restore partition.
(from dBanome vendors are using the (Host Protected Area )HPA instead of providing rescue media. Wiping the HPA would surprise and strand people that expect the HPA to have rescue materials, and it often results in OEM technical support marking and abandoning people that do it. The HPA is a low risk because it is not accessible during normal operations.)
Elsewhere on the anti-virus sites, we learn that some rootkits, backdoors, etc on these new virus infections can be left behind even in a low level format or a one-pass wipe. It is not clear to me if they can infect the restore partition , so does anyone know for sure if leaving the restore partition upwiped leaves the potential of still having the virus.?
Our infected Thinkpad does not have the restore partition so that is not an immediate problem this time. I will make the restore disks on my clean Thinkpad and attempt to wipe the full disc and reload my wife's Thinkpad.
Thanks for your help.
12-14-2011 09:50 AM
I like having the Thinkpad utilities for consistency in networking, troubleshooting, etc. I do have an XP disk with SP3 that I will use as a fall back if recovering with the discs from the other Thinkpad fails in some way. I have to research and ask questions as I go along, so thanks for your help.
12-14-2011 12:26 PM
01-11-2012 07:59 PM
Returning to give you feedback on the success of this recovery. The T60 went from being a doorstop to fully functional!
Thanks again to ajkula and TuuS for their suggestions. Helped me through a harrowing experience.
I made a full set of Product Recovery Discs, 6 cd's, but did not use them as it would have restored I assume to Windows XP or XP SP2 as originally shipped. The source computer had been upgraded to XP SP3 and was up to date on all Windows Patches. I decided to give it a try with Rescue and Recovery to take advantage of those upgrades. I made a full set of R & R discs and with nothing on the computer other than the original load and Firefox, it took 10 cd's.
On the target computer, the one with the virus damage, I set the bios to start from the CD drive, then, as ajkula suggested, and many other anti-virus sources endorsed, I wiped the disk, and I used dBan for that. Worked well in "short DoD mode" and took about 3 hours on a 60 gb drive. I had never tried that before.
I loaded the R & R start-up disc and from there on all I had to do was insert the next disc when instructed. This took several hours because I was not always paying attention when it called for the next disc. The only confusion was after the start-up disc ran and formated the drive, on the next disc, it warned that it was going to format the drive. I don't know if it did it twice or if the message is just poor communication. It went through to the end, and the result is the previously virus ridden computer is now 'identical" to the source. The hardware is similar but not totally identical . As TuuS suggested, the drivers must have been there as I did not have to add any drivers during this operation or since.
Regards to all,