Solved HP notebook came as a gift, but besieged with malware.

[pscowboy]

A young lady received a notebook, HP Pavilion dv4, as a "gift" from her uncle. Unfortunately, it was terribly infected with Internet Security 2011 plus 7 other trojans (identified after I got the unit). Hell of a nice uncle. I got a boot first try to ascertain the issues. Could do nothing else inside Windows. Then it couldn't boot after I worked on it. The malware took out the keyboard drivers, can't sign in.

In my efforts to clean this pc, I invoked M/S SSS, Bit Defender, & Kaspersky offline cd's (in that order). They all found infections and cleaned them (deletions).

I was hoping to get the machine operating well enough to run Belarc to get the license key and do a clean install of Ultimate (the existing OS).

I need ideas to try to get the keyboard back; or to run Belarc offline, outside of Windows; or some way to divine the key offline.

I am assured by the girl that the OS is legal. Her uncle is just a computer fool. He gave up on the pc when he could'nt run anything & passed it off to her. "If you can get it fixed, you can have it", were his parting shots. Of course, he doesn't know where the documentation is for W7. He got it upgraded somwhere from Vista. There is a COA key underneath.

 

[gregrocker]

You cannot audit the Product Key offline as it's heavily encrypted. You'll have to follow your plan to get it running well enough to audit the Product Key to see if it will work or if some kind of bootleg is on it. In fact before reinstalling I'd uninstall the key and reinstall it using the Change Key link to see if it activates - if not it's likely cracked and needs the HD wiped and native Vista reinstalled unless she wants to buy a legal copy.

To know you've tried everything to get it started, follow these steps for when Windows 7 fails to boot .

If it won't start post back results to see if there are other ideas. If not he'll need to come up with the Product Key or buy a new copy, lest you'll need to install the licensed copy of Vista to get her up and running. It's really not that bad, especially if it's a gift.

 

[pscowboy]

I believe I've got it clean enough to boot; IF I can get past the crippled keyboard at the login screen.
Any way around the login?

The keyboard works fine offline, by the way.

 

[gregrocker]

What do you mean the keyboard works OK offline - the Log in screen is offline.

I'd try a PS2 if a USB keyboard won't work in any port.

What did SFC find from the Command Line? You may need to clean System Files first.

 

[pscowboy]

The laptop's keyboard functions fine when using bootable cd's.
At the login screen, Windows has loaded a raft of drivers already; but the keyboard drivers have been compromised. Cannot type in the password.

I'm giving this gal the benefit of the doubt. I believe there is a legal key in there.

 

[gregrocker]

Can you get into Safe Mode? What happens?

Run a few passes with Startup Repair from the DVD or Repair CD, SFC from Command Line and report back the results.

 

[pscowboy]

No. Have to login to get into Safe Mode.

Will Startup Repair replace keyboard drivers? I thought that it was just for fixing boot problems.

 

[gregrocker]

It's unlikely you lost keyboard drivers since the keyboard works. More likely you've got System file damage which needs repair after infection. You could even still have infection.

 

[pscowboy]

I took my DART 7.0 bootable utility and ran an offline System Restore back to July, 2011.
I took the oldest one available.

It took about 80 minutes to complete. Much to my surprise, when I tried a boot, I was able to type the password (keyboard was now functioning) and get to the desktop. Ran the Belarc Advisor for the product key.
System was infected even back then (from SAS scan), but not bad enough to stop me from running Belarc.

Son of a gun. This was only the second time an SR worked for me (at least good enough for this case) out of 20 or so tries. Hardly have had any luck with these.

Now that I have the key, I'll do a clean install of Ultimate for her and find out if it's a legit W7, or cracked. I'm going to bed; do it later today. I will post back about that.

Greg, thanks so much for your quick responses to help me out.

 

[gregrocker]

Does the Product ID string - which should be there next to the Product Key - have the letters OEM in it? If so then it's possible it is bootleg unless the uncle bought a builder's OEM copy of Win7 to upgrade from Vista - hardly likely since the cost is similar.

As I suggested earlier you can also input the key at Control Panel>System "Change Key" link to see if it activates or is rejected. This way you'll know without having to reinstall and can either buy a key or reinstall native Vista.

If there is no Change Key link there, open an Elevated Command Prompt
and type slmgr -upk, then slmgr -ipk followed by a space and the Product Key, then slmgr -ato to uninstall key, insert key, activate.
SLMgr Commands and Options with Windows Vista Product Key Activation » My Digital Life

 

[pscowboy]

Yes it does.

Which, if your gut feeling is right, it's a "fugazi".

Too bad for the girl. She's a nice kid.

Have postponed this project for a day (paying work came in). I will post back on the validity of this.

 

[gregrocker]

Not a gut feeling. If "OEM" is in the Product ID string then it is either factory or builder's OEM activated, or an illegal cracktivation.

It can't be Factory OEM if it isn't the licensed OS on the COA sticker.

It could be Builder's OEM if the uncle bought that instead of Upgrade version. I would ask him. Don't tell him why you're asking. He should at least remember whether he bought Upgrade or OEM version. If he insists its Upgrade then it likely means he or whoever installed cracked it.

A cracktivation is likely done at the BIOS level using a factory OEM key to emulate SLP factory activation like it comes from factory. I would wipe the HD first with Clean Command before any install: How to Clean or Clean All a Disk with the Diskpart Command

 

[pscowboy]

I performed the slmgr routine, and the key was rejected. AGAIN, nice uncle.
Good call on your part. And, I've been made aware about keys & Product ID's not jiving.
It is never too late to learn.

Called the gal up; explained everything; she agreed to buy a Home Premium key.
Will set it all up tomorrow.
Case closed.

 

[gregrocker]

All's well that ends well!

Same basic steps to get a perfect clean reinstall after wiping the HD with Diskpart Clean Command:

Clean Reinstall Windows 7 Factory OEM