It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussion (archive)Hard Disk Failure - what to do?(114 posts)solved(114 posts)solved
(114 posts)solved
Pages:
1
2
3
4
5
6
7
8
This is my favourite topic
Posted May 25, 2012
avatar
HereForTheBeer: You may want to let the ESET online scanner have a go at it. Last time I fixed some malware / trojan / keylogger / backdoor crap for someone, that scanner turned up things that everything else missed, including our beloved Malwarebytes.

http://www.eset.com/us/online-scanner/
just as eset might things other scanners pick up. hence it's always a good reason to always use atleast 2 scanners.
Posted May 25, 2012
avatar
HereForTheBeer: You may want to let the ESET online scanner have a go at it. Last time I fixed some malware / trojan / keylogger / backdoor crap for someone, that scanner turned up things that everything else missed, including our beloved Malwarebytes.

http://www.eset.com/us/online-scanner/
avatar
lugum: just as eset might things other scanners pick up. hence it's always a good reason to always use atleast 2 scanners.
Agree. Shoot, I uploaded to www.virustotal.com an obvious trojan attachment from an email a couple weeks back, and got results all over the map. Most picked up nothing, and the rest were a mishmash of different names for this thing.
Posted May 25, 2012
avatar
Leroux: Thanks, I'll do that tomorrow.

I actually had this Unhide.exe from the rogue software thread running once and it restored a few desktop icons and the quick start icons in the task bar, but not the missing options in the start menu. Didn't think of checking the folders at that time yet. After a restart, of course, everything was gone again, including the Unhide,exe which was probably hidden by the malware on startup, too. But I guess it will come in handy to make my data visible again, once or if I managed to get rid of the malware first.

And yeah, it sounds like rogue software, the only difference is that I don't get any fake message to buy a tool to get rid of my problems, I just get the symptoms, no scam to accompany them. From what I've read I guess the malware must have been introduced via drive-by download, e.g. a fake popup ad that I thought I'd close but that actually started a secret download or something. I can't think of any other explanation and don't remember any significant actions on my part that could have caused it ...
It could be your current AV suite or the stuff you ran when you noticed the problem might have killed the "scam" part of the software before it run or you were able to notice it, or it just didn't become active for some reason while the rest did.

I would do as I said earlier: Boot into safe mode(You don't need to use linux even as safe mode usually stops most processes from running and is very safe to run AV/related software in.) and use the one reply's program that kills all processes to make sure nothing unwanted is running....then reinstall MWB and run it. Then copy over the results log here and we'll help you out some more.
Post edited May 25, 2012 by GameRager
Posted May 25, 2012
avatar
AlKim: Something very similar happened to my girlfriend's netbook, although the details are vague since I wasn't using the computer when it occurred. Anyway, it turned out that almost all folders and files were hidden, but they existed nonetheless, so we made everything visible again and backed up all important files. The netbook was useless to all intents and purposes, and I couldn't fix it with System Restore, MalwareBytes or MSE. I couldn't revert to factory settings either because apparently that part of Windows was missing for one reason or another. Two days later the computer refused to boot up (it would start, but it restarted before it got to Windows), and I couldn't fix it by reinstalling Windows from a USB stick because the damn thing didn't even know it had a hard drive installed. So I changed the hard drive to a fresh one, but got the exact same result. At that point I ran out of ideas.

Better make backups of your files in case it turns out you've got the same problem she had.
I've had malware cause havoc almost exactly like that to me.

Damn I wish I could spend five minutes in a room with the assholes that do this. They think they're so smart, but all they are is anti-social assholes. I would PAY for the privilege of spending five minutes in a room with the asshole that trashed my last laptop.
Posted May 25, 2012
I'll do all that tomorrow, thanks for your help, everyone. :)
Posted May 25, 2012
avatar
GameRager: If it's a copy of your data then how is it not a backup(technically speaking), or at the very least the makings of one if need be?
avatar
xyem: It's a backup in case of physical drive failure, it is not a backup for the many other things that cause data loss. Everything the originals are subject to, the "RAID copy" is subject to as well. Accidental deletions? Copied instantly. Malware introduced? Copied instantly. Malevolent intrusion? Copied instantly. Even the drive containing the originals failing can cause the drive failure of the copy, as the second disk can fail under the strain of rebuilding (which is one reason why you are not supposed to use similar disks).
Yes indeed, most data loss is not from hardware failure or miscopies, it's from plain old user error. Fatfinger the wrong files and you end up with nothing on either disk to save you.

Personally, I like to use ZFS or something similar as it actually monitors and repairs files warning you if it can't verify the file against the checksum. RAID arrays will happily allow bit rot to ensue without any warning at all.

avatar
GameRager: I use mine to store additional data, thus allowing me to have more on the same system. I only make backups of important data, not every single thing on the system.
avatar
xyem: RAID0 would also allow you to have more on the same system (and make read operations faster too) but the failure of either drive would render all data inaccessible. Fun fun!

I have RAID1 on my three main machines (2 desktops and server) only to stop a drive failure taking the machine offline. My backups are similar to yours as they are not full disk images, but do contain everything important.
Heh, there's a reason why they call that RAID "0" and this is it. Personally, I use Crashplan and generally have a back up on site and at least one offsite. Makes situations like this a lot less scary. The big issue though tends to be after the restore having to work to figure out what files I really need and which ones are duplicates. Fortunately, I'm usually only restoring a few files or a directory.

avatar
GameRager: Still, if it is malware related and the MWB has become infected this is the best course of action. Ultimately it's up to him to decide.
avatar
xyem: The problem being that he doesn't know if it is malware related and every write to the disk could be causing him to lose more and more data. When your data is at risk, you always go from the most conservative options first..
I'd do the disk imaging just because there's definitely a possibility that something has gone awry with the MFT in which case you could indeed very quickly lose all of the files instead of just a few.

If the OP uses file recovery software, it should work on images rather than on the Disk. First step though is going to be to buy a large disk and probably two large disks. One for the image and one for the recovered data.
Posted May 25, 2012
avatar
hedwards: First step though is going to be to buy a large disk and probably two large disks. One for the image and one for the recovered data.
My external drive is about five times the size of my actual hard disk. ;)
Posted May 25, 2012
avatar
hedwards: First step though is going to be to buy a large disk and probably two large disks. One for the image and one for the recovered data.
avatar
Leroux: My external drive is about five times the size of my actual hard disk. ;)
Heh, well clearly you don't need another disk then. That should be more than enough. That reminds me, I really should head into town next week. Around here you can get a terabyte HDD that's little bigger than a pack of cigarettes.
Posted May 25, 2012
avatar
Leroux: My external drive is about five times the size of my actual hard disk. ;)
avatar
hedwards: Heh, well clearly you don't need another disk then. That should be more than enough. That reminds me, I really should head into town next week. Around here you can get a terabyte HDD that's little bigger than a pack of cigarettes.
That's good if your tower support it, elsewise you need to buy bloody brackets and such to fit it into the larger form factor slots. :\

Also why 1TB? Heck, if and when prices finish normalizing i'd recommend a 2TB drive. More cost efficient than a 2.5/3TB model and imo better suited for those of us with more stuff to store.
Posted May 25, 2012
avatar
hedwards: Heh, well clearly you don't need another disk then. That should be more than enough. That reminds me, I really should head into town next week. Around here you can get a terabyte HDD that's little bigger than a pack of cigarettes.
avatar
GameRager: That's good if your tower support it, elsewise you need to buy bloody brackets and such to fit it into the larger form factor slots. :\

Also why 1TB? Heck, if and when prices finish normalizing i'd recommend a 2TB drive. More cost efficient than a 2.5/3TB model and imo better suited for those of us with more stuff to store.
I should have mentioned that it was an external drive and 1TB is nearly triple the size of the HDD in my laptop. Right now having something that's extremely portable is of much greater concern than having the hugest possible capacity.
Posted May 25, 2012
avatar
GameRager: That's good if your tower support it, elsewise you need to buy bloody brackets and such to fit it into the larger form factor slots. :\

Also why 1TB? Heck, if and when prices finish normalizing i'd recommend a 2TB drive. More cost efficient than a 2.5/3TB model and imo better suited for those of us with more stuff to store.
avatar
hedwards: I should have mentioned that it was an external drive and 1TB is nearly triple the size of the HDD in my laptop. Right now having something that's extremely portable is of much greater concern than having the hugest possible capacity.
Well for laptops that's a no-brainer. 2TB is more a suggestion for those using desktops/etc.
Posted May 27, 2012
Ok, here's what I did so far:

- booted with Linux-driven Avira Antivir and AVG disks, both only found "unknown virus" in specific old DOS programs that I'm quite certain are not a virus. I still allowed to put them in quarantine.
- booted with Ubuntu-CD and copied all the important stuff over to my external drive
- downloaded Unhide.exe and the most recent installer from Malwarebytes' Anti-Malware to my netbook, copied them over to my USB stick
- started the infected PC in safe mode, ran Unhide.exe from the USB stick, which completely restored all hidden data and the startmenu options (but I suspect booting in regular mode will hide them again)
- de- and re-installed Malwarebytes' Anti-Malware, now it's database is only 50 days old instead of 360
- unfortunately I wasn't able to connect to the Internet in safe mode, although I specified to load safe mode with network drivers. I have to create a new Internet connection, but Vista doesn't find the one
- ran a complete Malwarebytes' Anti-Malware check again, and this time it turned up absolutely nothing (because it already removed all possible threats it found last time I ran it, nothing new was found)

Not that many options left. Should I run the PC in regular (infected) mode, kill all processes, connect to the Internet, try to update Anti-Malware and run another check? Or run the online check from eset.com in regular (infected) mode?

Or format the hard disk and re-install the whole system? (The PC would probably benefit from it since I haven't ever done that since I got it in 2007 and I guess a lot of junk has accumulated over the years; then again, I've never set up Windows on my own before, not sure how hard and stressful it is, and I only got a so called recovery DVD that came with the PC, no manual that I know of.)
Posted May 27, 2012
avatar
Leroux: Not that many options left. Should I run the PC in regular (infected) mode, kill all processes, connect to the Internet, try to update Anti-Malware and run another check? Or run the online check from eset.com in regular (infected) mode?
You can either risk booting in normal mode, and see if the malware is still there, hiding your folders, or you can use "msconfig" to see what runs when windows loads, and start removing them.
Disclaimer: Msconfig can mess up your computer, so be aware of what changes you do, they should be reversible. Do not remove anything, untick it at first.
Press Start, type msconfig and it should find it. Go to the Startup tab and see all the junk that runs when you start windows. Some you will be able to identify at once and correctly (steam for example), other you may wonder what they might be, so check the "Command" part to see what it is they are running, and go see that file's properties, and a few you may be lucky enough to recognize as malware at once. Especially anything that runs from a temp folder or the user folder instead of a system one is suspicious, though be aware that the "StartUp" folder is in the user folder as well.
You can also just "Disable All", and boot into normal mode, but you may have some reduced functionality that way.
I sincerely hope that you won't have to shift through the "Services" tab as well, since UAC should have prevented it from going there.
Posted May 27, 2012
low rated
if you have recovered your data, can put it elsewhere and accumulated loads of junk in the last few years then i suggest just reinstalling windows all together.

it's not hard, even a monkey could do it.
Posted May 27, 2012
avatar
lugum: it's not hard, even a monkey could do it.
Well, I hope you're right, but I'm kind of afraid to find out my skills are inferior to those of a monkey. :D

The thought of erasing it all is scary as it probably involves lots of work trying to make everything working and comfortable again, re-installing tools etc., but I admit it's also quite tempting to restart with a clean slate and only restore what I really need.
Post edited May 27, 2012 by Leroux
Pages:
1
2
3
4
5
6
7
8
This is my favourite topic
Community
General discussion (archive)Hard Disk Failure - what to do?(114 posts)solved(114 posts)solved
(114 posts)solved