Encryption + Virus is making it impossible to get back into HDD

[diffiehellman]

Hi everyone. Haven't created an account here yet, but will do that soon. I've used these forums a lot in the past, but never made a post till now. I wish my first post here was more helpful.

So here's the situation I have gotten myself into. My HDD is fully encrypted with TrueCrypt, v7.1a with Windows 8 installed as the OS. Recently I got a virus, and have tried using MSE, Malwarebytes, and Trend Micro Housecall. This all happened over a few days, but I knew I had a virus as everytime I started up the computer, a process called mdm.exe would start up and take up about half of my CPU. MSE and Trend Micro Housecall also picked up a couple of viruses

So I decided to boot into safe mode to get rid of it. Ever since then, my computer has booted into TrueCrypt asking for my password like normal, then me getting a Windows logo after typing it in. After the Windows logo, nothing. Windows doesn't load and my screen just turns black. The num lock key on my keyboard stays lit and flickers about every 5 seconds.

My next idea was to put the infected, encrypted HDD into a new computer with a working OS to see if I couldn't at least decrypt it in order to get some files. This didn't work, however, as for some reason TrueCrypt doesn't recognize the HDD as being encrypted or it just doesn't accept the password I have been using for a while now.

Is there a solution to the Windows 8 booting to a black screen issue? I tried browsing several forums and none of those worked for me.

Also, why doesn't TrueCrypt recognize my HDD, and decrypt it? I thought it should be able to do this, and then I would be able to grab my files.

Is my HDD dead? Hopefully not, but I'll find out if it gets wiped. I didn't think it'd show the Windows logo if it did die.

What I am going to do, is probably wipe the HDD. Unless the people here can help me out...I'm really bummed out because there were a few files on there that weren't backed up. A lot of my stuff was, but some no..

Thanks to anyone in advance who has read through this and tries to help out. It'd really be fantastic if this could get resolved, however I've pretty much accepted that wiping may be my only solution.

 

[SuperSoph_WD]

Welcome to Tom's Hardware, diffiehellman!

I'm sorry to hear about your issues, it seems like quite a mess. If the HDD boots, then it is surely not dead yet but it might as well be corrupted/damaged. You can determine that by testing it using a diagnostics utility. Since booting into the OS is not an option, there are DOS versions of some HDD testing utilities that will let you know what is the drive's health and SMART status without booting into Windows. You should search your HDD manufacturer's website for such a utility. If you cannot find one, you might as well use this one: http/products.wdc.com/support/kb.ashx?id=jbpgVx

Another thing you can try is Ubuntu Live CD to recover and back up your files: http/www.howtogeek.com/howto/windows-vista/use-ubuntu-live-cd-to-backup-files-from-your-dead-windows-computer/
Afterwards, I strongly recommend writing zeros to the drive (fully erasing it). This way you will be sure that all the malware and viruses are gone.

Hope I helped. Keep me posted though!
SuperSoph_WD

 

[hang-the-9]

I would guess that the virus cleaner removed a file that was used by Windows and likely TrueCrypt. I've seen that happen, while they remove the virus, the files that it had to remove are sometimes regular Windows files.

If you have a rescue disk for TrueCrypt you can try that to unlock the drive.