I got wacked real good x 3 (SOLVED)

For discussions about security.
Message
Author
User avatar
RetroTechGuy
Posts: 2947
Joined: Tue 15 Dec 2009, 17:20
Location: USA

#31 Post by RetroTechGuy »

snowshaker wrote:If you got pics and stuff on the old drives, get a $20 USB enclosure and mount the drive. Then read it with another machine and save off what you need. Caution. Don't use a windows PC. Boot up Puppy or Linux or use a MAC. If the drive has an autorun.inf virus, it will jump right onto your good windows PC. Maybe that's what happened to you already?
I have a couple of these, and am quote happy with them:

http://www.newegg.com/Product/Product.a ... 6812119152

(note that these devices generally want the drive jumpered as "slave")
As for viruses spreading via RAM sticks, that's just urban legend. RAM loses its data when powered down. Maybe your article was
Though by USB stick is a different matter...
speaking of the BIOS memory. If you could stick a virus in there, it stays with the chip. What could it do? Well, I have read where one guy claim his BIOS shows his picture when the PC boots, so that could be one way for a virus to keep you from booting into CD.

More likely though that you just have a bad CD drive, given that its tray was stuck.
And by pulling the HDD, you can eliminate faulty hardware as the access issue.

If you have Puppy running (e.g. a pupsave on a USB and a live boot CD), I put together this collection of links to make the latest ClamAV run on Puppy 4.3.1 (again...sorry...I haven't played with building .pets yet -- just run each of the Debian .deb files, and ClamAV will work -- I haven't tested this on older Puppy versions, but it's likely to work there as well)

http://murga-linux.com/puppy/viewtopic.php?t=53171

However, while you have the drive mounted (perhaps even before scanning for viruses), copy all the personal files off. There is always a chance that a scan will stress the hardware enough to kill the drive, if it's weak.

If you have XP on the drive, your files are _likely_ to all be buried under "Documents and settings'.

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

creating boot floppy automatically

#32 Post by prehistoric »

obxjerry wrote:...I have a laptop with a CD drive (not CD-R) and a floppy drive. It is running XP Pro. I paid $50 for it less than 2 weeks ago. It's fine couch surfing but pushed too hard the processor gets hot and it freezes. I have some Arctic Silver 5 and have improved it but I doubt I can boot Puppy yet...
Blast it, Jerry! If you have a machine with a floppy drive running XP Pro, you only need to download the exe file for a program which creates boot disks, run it, and follow instructions. You need not wrestle with rawwrite.

If I get a chance to test it, I'll put an floppy image file in a self-extracting archive program designed to write floppies (sfx144), and upload it. My problem at the moment is that I have a bunch of machines either without W*****s or without floppy drives.

If anyone else has a link to a neatly-packaged boot floppy image, they can post it here. It would also be nice to have a Puppy boot floppy in a self-extracting program which writes floppy images, then no nooby ever has to deal with rawrite directly to get Puppy running.

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#33 Post by Sylvander »

1. "Blast it, Jerry! If you have a machine with a floppy drive running XP Pro, you only need to download the exe file for a program which creates boot disks, run it, and follow instructions."
Yep, that's how I did it.
It was REALLY EASY to do.
Just downloaded sbm.exe whilst working within Windows [2000Pro]...
Then [once the download was complete] right-clicked on the file and chose "Open"...
Whilst there was a formatted floppy in the FDD...
And the EXE program created the bootable SBM floppy disk. :D

User avatar
obxjerry
Posts: 390
Joined: Fri 29 Jan 2010, 22:34
Location: Louisville, Kentucky

#34 Post by obxjerry »

:D :D :D :D :D Thanks folks. I have it and it boots. I had the exe file on my computer so I was half way done before I started. A few easy clicks and I was there. Best part, no RawWrite.

Sorry I didn't show all my cards sooner.

I'll keep you posted.

Thanks so much,
Jerry

User avatar
Aitch
Posts: 6518
Joined: Wed 04 Apr 2007, 15:57
Location: Chatham, Kent, UK

#35 Post by Aitch »

obxjerry
Sorry I didn't show all my cards sooner.
Some people like complicated

Others, like me, prefer easy

Glad you got there in the end :D

Aitch :)

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#36 Post by Sylvander »

"Others, like me, prefer easy"
That's my philosophy too. :D

I find easy usually works... :)

And complicated tends to go horribly wrong! :(

User avatar
obxjerry
Posts: 390
Joined: Fri 29 Jan 2010, 22:34
Location: Louisville, Kentucky

#37 Post by obxjerry »

No boot yet on CD or hard drive. It's the same as before I had the SBM floppy. Judging from the limited amount of use information on SBM I could find, I was hoping it would be intuitive. From what I saw it was highlight, enter,enter until the drive booted. I've spent a couple of hours with it and nothing. Highlight, enter, enter gets me disk error 0x03 on everything with 0xAA added for the CD-ROM. I have a D flag on everything except the hard drive where I have aA.

I am concerned about the strapping issue. As far as how things are plugged in it's the same as it's been for years. Is there a problem with the hard drive being IDE primary master and the CR-ROM being IDE secondary master? Both slaves are none.

I'm learning about BIOS settings online. Everything I see looks OK for what that's worth. CMOS settings are next.

I do have power lights on the CD and hard drive. I never get a steady blink. For some reason I'm thinking I should normally.

Is there a chance the SBM floppy is defective?

I could see a possibility the virus could have taken the hard drive out but, shouldn't it boot to CD with the hard drive disconnected? I have a couple of CD drives that were good when I took them out a few years ago. I could swap one of those in.

Floppy drive is listed twice on the SBM menu once as FDO and once as FDF. FDO is also in the bottom right corner with.........E

I am tempted to move on to the HP computer. That would be the one I'm not sure what it was doing before I shut it down. It is a dual boot with Puppy and a GRUB loader. I'm thinking that may make some difference.

Best guess, the day after my son brought his computer over and I worked on it, I was using the HP my wife was using a laptop both of us running Puppy. Both were slow and erratic surfing the net. They were replacing a utility pole close to our house and we thought the DSL service had gone flaky or maybe a virus.

The following day, when my wife started the HP, she thinks she chose Puppy at the boot menu. Windows started but wouldn't boot. I tried it again and it didn't boot. I didn't try booting Linux. By now I was suspecting my son's computer may have a virus so I shut the HP down and unplugged power and ethernet.

There seems to be a consensus opinion that this may be a virus that affects the BIOS, boot sector, MBR and not so much the data on the hard drive. I'm thinking if that is the case the damage is done and the worst is over quickly.

If anyone has any suggestions or knows of available information I could research I would appreciate hearing about it.

Take care

User avatar
Aitch
Posts: 6518
Joined: Wed 04 Apr 2007, 15:57
Location: Chatham, Kent, UK

#38 Post by Aitch »

You should see a menu like this if SBM is working

http://sourceforge.net/dbimage.php?id=127460

Select your CD, by highlighting & enter



As far as I can determine, it's probably a firmware problem of your CD player not liking the CD make or type you are using
- possibly you are using a CDRW or worse DVDR??

Try sourcing a different make of burnable CD and get CDR rather than CDRW
Verbatim are usually OK with older drives

see

http://ubuntuforums.org/archive/index.php/t-525241.html

Try different CDs in the drive, like for example another linux OSs or even a windoze one, to see if SBM will read them


I thought you might get confused by the 'strapping' error

No worries, as many seasoned users will have been, too - strapping is not usual computer terminology, but is a medical term, AFAIK

We normally refer to jumpering or setting the HDD or CD
Each IDE device can be set by jumper, a small 2 pin connector, as Master or Slave, at the rear of the CD/HDD when installing

As I already commented, you have said you have yours set as HDD primary master, and CD as Secondary Master, which means each device is on a separate cable and motherboard header or connector, so nothing to worry about

Read more here

http://www.cheap-computers-guide.com/in ... CDROM.html

You are gradually getting closer to a solution, and congratulations on giving the error codes! - It helps


Aitch :)
Last edited by Aitch on Sat 06 Mar 2010, 21:45, edited 2 times in total.

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

progress

#39 Post by prehistoric »

O.K. Jerry, that is actually progress. If your machine had a bootable partition on the hard drive that should show up with the boot manager. I'm guessing your MBR got hit. Does the boot manager show all the partitions you remember having before? The partition table is part of the MBR. If it is missing, this is strong evidence something zapped the MBR.

I'm less certain about what is going on with the CD. Did you have a bootable CD in the drive when you ran the boot manager? In addition to the device, you also need a filesystem of a particular type on that device to boot. I have some working CD drives which are hard to boot from using a floppy, probably because they are slow to respond to commands, so this may require more effort.

You are right that the strapping (jumpers) on the drives should not have changed. Leave that alone, since it was working just before you got hit.

If you, like many computer types, have an old hard drive which is known to work, you could pull the suspect drive from one machine, and eliminate one variable by putting the replacement in. This will also protect any data remaining on the suspect drive while you experiment. Most likely the hard drive is set as the master device on that channel. The strapping (jumpers) on the replacement should be set the same way as the one you pull out. Simply pulling the hard drive may not allow the CD to work, because many systems will not work if there is no master device on a channel, or if the master device is a CD.

If you are certain the floppy could not have been overwritten, use it to try booting that other machine. If you have any doubt, rewrite the floppy the same way you created it, then you will know it is not carrying a virus.

It will take me a few minutes to set up an old machine downstairs to try to parallel what you are doing. I'll get back when I have a better idea of exactly what you should be seeing.

I echo Aitch about the error codes and getting closer. Believe it or not, you are getting somewhere.

User avatar
Aitch
Posts: 6518
Joined: Wed 04 Apr 2007, 15:57
Location: Chatham, Kent, UK

#40 Post by Aitch »

Sorry prehistoric,

I was editing to improve my phraseology, and add a link at the beginning, for clarity

Aitch :)

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

trial results

#41 Post by prehistoric »

Back from the test machine. I was able to boot from the CD by simply highlighting it and choosing boot. The entry on the screen did not show a filesystem type for the CD until it tried to boot.

With one CD the machine failed to boot, possibly because of the kind of incompatibilities Aitch mentioned. I tried a different CD and succeeded. Even when it failed to complete booting, I got a message from ISOlinux, which came off the CD. If you get anything off the CD, it tells us something.

At this point you are simply trying to get it to boot anything that will run stand-alone. If you have a Puppy disk handy, that would be fine.

Added: If you still get no signs of life when you attempt to boot off CD, it might well be a good idea to swap out the one in there for an older one that worked in the past. At this point, we don't need much except the ability to read CDs written on another machine. Make sure the jumpers on the back match those on the one you take out.

No problem, Aitch. :wink:

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

a useful tool

#42 Post by prehistoric »

While I was waiting to hear the latest from Jerry, I decided to get ready for the next likely step. I tried to boot freedos from a CD I burned exclusively for this, but the CD was incompatible, as I mentioned. This caused me to go back to a general tool, the System Rescue CD x86 version 1.3.5. This booted and ran without problems.

While I was playing with the options on the help screen, I noticed that there was an image of freedos included on that disk. This came up and ran without problems when I entered "freedos" at the boot prompt. If it is necessary to reflash the BIOS, this system is what I often use to run a DOS program from the manufacturer.

This CD is so useful it is never surprising when I can't find my copy -- someone else has it. :roll:

I am now downloading version 1.4.0.

User avatar
obxjerry
Posts: 390
Joined: Fri 29 Jan 2010, 22:34
Location: Louisville, Kentucky

#43 Post by obxjerry »

I have 9 proven bootable CD-Rs. It will boot one of the DSL (darn small linux) and it plays around with a openSUSE enough that it may boot that if I hold my mouth just right. Out of 3 tries it came to 2 flavors of failure. The hard drive shows lots of activity, openSUSE really spins it.

I don't have a lot of experience with DSL. It has a "mount" clickable that turns up the floppy drive only. As it boots up it says something about HD and looking for ect/fstab. It spins the hard drive and says done. It does give some hardware info; processor, memory, ect., nothing I see about a hard drive.

I'm thinking I've been a bad boy. I've seen a couple of apologies which lead me to think only one person can be writing a reply at a time. I didn't realize that and I'm sure I've locked people out. I'm a very slow writer and typist even when that's all I'm doing. From now on I'll use AbiWord to compose my replies. I am truly sorry.

Of course I'll be spending some time checking out DSL and maybe trying some other bootables. I see several possibles here. I could swap out the CD drive. I could connect to the net with DSL if it's not spreading the virus. I have several ways I may be able to burn some CDs.

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#44 Post by Sylvander »

1. "I have 9 proven bootable CD-Rs. It will boot one of the DSL"
Is this you saying that the problem machine [one of the three] is succeeding in booting at least 1 bootable CD, provided you use the SBM to do it?

2. "I do have power lights on the CD and hard drive. I never get a steady blink"
What I see [right now when tested] with my own optical drive [DVD-RW], with SBM booted and its menu displayed:
(a) If I put a readable disk in the optical drive...
With the drawer open the LED doesn't glow or blink..
(b) When I hit the button on the optical drive to close the drawer...
The LED glows unblinkingly.
(c) When the BIOS succeeds in reading the disk [during that it goes clunk, clunk, whoooosh][with my previous drive the LED blinked, then], the LED stops glowing [goes dark].
(d) The SBM display shows each flag for all detected drives [FD0, HD0, CD0] are D.
(e) I highlight the CD-ROM drive,a and hit <Enter>, and a dialog displays reading "Save the changes (Y/N)?".
I hit N, and the optical disk is booted.
(d) Strangely...
When I choose the HDD [HD0], I get a red warning that no bootable HDD was found. :?
And yet my HDD is bootable and functioning.

3. "Is there a chance the SBM floppy is defective?"
Sounds like your SBM is working as it aught.

4. "Floppy drive is listed twice on the SBM menu once as FDO and once as FDF"
Might your BIOS be mis-identifying the optical drive as a FDD=FDF?
I wonder what would happen if you choose FDF as the device to boot, with a bootable optical disk in place?
-------------------------------------------------------------------------------------

5. Another trick to try:
To by-pass [or side-step] any problems with the HDD MBR...
(a) Make this Windows NT 4.0, 2000, XP or Server 2003 boot floppy disk.

(b) I know an alternative way of making this bootable floppy, but you'd need a working PC.
It involves making the 1st [FREE] version of the EBCD ["Emergency Boot CD"], and using one of its included programs that's designed to make such a floppy.

(c) The above Windows Universal Boot Floppy substitutes for the "System Partition" on the HDD.
When booted, it presents you with a choice of 2 physical HDD's [choose the 1st], each holding 4 partitions [choose the 1st if you think that's the one holding the "Windows" folder][the floppy is set up to work with a Windows folder named "Windows"].

(d) So long as the chosen partition holds a working Windows folder [named "Windows"], then Windows should load.
If the Windows folder has a different name, it's possible to edit the boot.ini file on the floppy so the name matches.

(e) If the above (d) works, then you know all's well there, and can work on a way to restore a working MBR.
Which version of Windows is on the HDD?

User avatar
obxjerry
Posts: 390
Joined: Fri 29 Jan 2010, 22:34
Location: Louisville, Kentucky

#45 Post by obxjerry »

Sylvander,

Yes I have 2 versions of DSL. 1 of those boots consistently. openSUSE says it can't find a kernal. It will do memtest (100% pass) and a CD mediacheck which also passes.

This computer (the only sick one I have run or worked on) is my son's. It has W.....s XP on a 10 gig hard drive. I bet there is only one partition. Sorry I blew over this info before. I was asked.

I have W.....s XP Pro running on a laptop that can burn a floppy. The 3 files for the boot floppy are just copied to the disk? or do I right click the boot.ini and it creats the boot floppy?

I have the CDs that came with our Dell computer in XP flavor. The XP Pro laptop has a DVD and a floppy drive. Any help there to get to a EBCD? I can research that online.

Lots of yard work today, may be turning in for the night soon.

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#46 Post by Sylvander »

1. "The 3 files for the boot floppy are just copied to the disk?"
(a) Yes, just follow the instructions given in the webpage.
i.e.
"Format a floppy disk using a Windows NT 4.0, 2000, XP or Server 2003 machine (not windows 9x!)
format a: /u
"
So you are using a formatted floppy.
Then...
"Copy NTDETECT.COM and NTLDR onto the floppy disk"
So you now have 2 of the 3 needed files on the floppy.
Then...
"Download this BOOT.INI file and put it onto the floppy disk"
This boot.ini file is a special customized copy that offers 8 choices of partition to attempt to boot.
Now you have a formatted floppy with the 3 necessary files on it.
SO...

(b) Boot the floppy.

2. "do I right click the boot.ini and it creates the boot floppy?"
No...
Just copy the 3 files to the floppy as above.

3. "Any help there to get to a EBCD?"
I'd need to host somewhere my copy of the [FREE] 1st version of the EBCD.
[If anyone wants it]
The present EBCD version is version 2 I believe = no longer free, and not so comprehensive [lots of things it doesn't do anymore].

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

progress

#47 Post by prehistoric »

This is indeed progress. At this point, I'm guessing your MBR was clobbered. Malware doing this is not hard to create. It can even get clobbered by accident. Zapping the BIOS is harder.

We are still dealing with suspect machines. If you succeed in booting, via the route Sylvander has suggested, you will still be running a suspect Windows installation, and should exercise caution. Sylvander is probably more experienced than I am with Windows, and operates in your time zone. Listen to him.

If I were there myself, I would start with freedos, because that is the weakest system that would allow me to check the BIOS, and gives any possible malware as little to work with as possible. You could hide an elephant in a typical Windows installation.

All good utilities to flash a BIOS have an option to save the current BIOS before flashing. This can be used for another purpose. If you make a backup file of the current BIOS, and compare it bit-for-bit to the BIOS image file downloaded from the OEM site, you can tell if the BIOS is okay without risking a flash operation. (The BIOS ID you get during POST should allow you to download exactly the right file.)

Once you are sure you have a good BIOS, the next order of business involves recovering data and eliminating infections. When you recover data, I recommend using a non-Windows OS like Puppy first, because the malware was tailored for Windows.

p.s. You haven't stopped anyone from posting. The forum software allows overlapping posts. The apologies are about possible confusion.

User avatar
obxjerry
Posts: 390
Joined: Fri 29 Jan 2010, 22:34
Location: Louisville, Kentucky

#48 Post by obxjerry »

I did make a boot floppy. It didn't boot the hard drive, there was no CD in the tray. I'll type in the text it produced later.

Prehistoric, thanks for the clarification on posting. You folks have been so kind I hated to think I had caused problems.

The same place the computer tells me I can press del to go to bios it gives me a way to awdflash if that helps.

There is rain forecasted for here late today. Today is break the garden day+Jerry likes to eat=little computer time today. Sorry to put this on hold.

Take care

Sylvander
Posts: 4416
Joined: Mon 15 Dec 2008, 11:06
Location: West Lothian, Scotland, UK

#49 Post by Sylvander »

1. " It didn't boot the hard drive"
(a) Try each of the 8 partitions in turn.
If it fails to boot Windows on each of the 8...
Then, either...
(b) The Windows folder isn't functional.
[Doesn't exist or is corrupted]...
And/or...
(c) The BIOS cannot see the HDD.
[BIOS or its config settings are messed up, or the controller isn't doing its job (configured off?), or some hardware problem]
Make sure the CMOS jumper isn't in the "clear" position.
And/or...
(d) The partition File tables have been messed up [deleted?]
I think perhaps TestDisk.exe run from a bootable floppy may be able to make a non-bootable HDD bootable once again.
I've used it to do just that, and it was amazing.
I think it restored [a good/backup copy of] an improperly deleted, or corrupted, partition or partition file table.
But then [prior to that], I was able to boot Windows using the Windows Universal Boot Floppy to boot Windows...
But it only succeeded in booting Windows after I'd edited the boot.ini file to change the name of the Windows folder [from WINNT] to "WINDOWS".

(e) A BootIT NG bootable floppy is a great tool [I have it but don't use it lots].
I believe it automatically fixes certain basic problems, so that people are astonished that just running it fixed their problem.
All hopes of a fix by such as these depend on the BIOS being able to see the drive.
This may confirm whether the drive [and its parts] can be seen.

User avatar
prehistoric
Posts: 1744
Joined: Tue 23 Oct 2007, 17:34

award flash utility

#50 Post by prehistoric »

The normal award flash utility does have options to save the current BIOS without programming the BIOS with any new binary data. On the command line, this uses the /Pn and /Sy options. If you have the checksum, from the manufacturer's site, you can check for BIOS corruption without either flashing or saving the existing BIOS code, using /CKSxxxx, where xxxx is the hexadecimal value of the checksum. How this works with awardflash in the BIOS depends on the manufacturer. You will need to download the manual.

This may be wasted effort, but I'm being extremely cautious.

If, as we suspect, the MBR has been clobbered without any other damage to the Windows installation, the NT bootloader will still be installed on the partition with the OS. (You can also install GRUB to the partition holding Puppy, in addition to installing it to the MBR, so it can be used if the MBR gets zapped.) The problem is that the partition table was likely clobbered along with the MBR. In that case, you need the recovery tool suggested above. Hopefully, you won't need more advanced methods, though you should know these exist, if needed.

That still leaves the problems of recovering your important personal files, and removing any possible malware which caused the problem, but things are now moving in the right direction.

Post Reply