Got a Toshiba C660-U25 laptop from a customer infected with the KLPD / Police / Ukash virus. Easy to fix ... right? No
Troubleshoot: Trial & Error
Customer attempted to restore a previous version of Windows himself, and than after 90 minutes of waiting (which is indeed too long) aborted the process. Result: totally messed up Windows (both F8 and F5 not working) and Windows constantly booting into DART mode.
Toshiba Harddisk Recovery
Not accessible from F8, and strange errors from at the command line while trying to run Toshiba HDD Recovery from within custom DART mode (by Toshiba). Toshiba Recovery failed too.
And no Toshiba Recovery disks So ... onto ...
Windows Manual Reinstall
Works of course, but Win7 64-bit OA Windows serial key is not working with my Win7 OEM installation disc ... that's a problem. Also while reinstalling ... it messed up the system partition of Toshiba, and without that particular partition the "Toshiba Recovery Media Creator" will not work either ... *sigh* wonderful. And recovery disks cost 36EUR.
D: drive contains images ...
of about 900MB each. Smells like a spanned recovery image. But swm files? Never heard of them!
What are SWM files?
. swm-files are splited wim-files, the Microsoft format for image files.
Can be unpacked with 7zip. However ... that won't install them. Different procedure for that!
Creating a WIM file
I followed the 2-stage process. There's also a solution to do everything in 1 command line, but I felt more comfortable using this particular solution (after backing up the files to an USB harddrive).
I was already in Windows trial modus, so I first decided to create the WIM file. To get started you need the tool 'imagex' which was hidden in ODDfiles/Tools. And then open up a command console (run as administrator) and execute "imagex /ref 10739XSP*.swm /export 10739XSP.swm 2 boot.wim"
That created a 11.5GB wim file.
Booting into Windows Recovery console
executed "imagex /apply boot.wim 1 d:"
d: in this case being the windows drive. Rebooted the system. Took too long. Booted into recovery console again, and ran "bootrec.exe /fixmbr" and now again seeing "setup is starting services". Hmz ... might need a clean install.
Sources used to compile this article