Ugly, ugly virus

[Phoenix64d]

So...my friend has a copy of vista that she's been running with an expired Norton for some 9 months now. She calls me today and explains that her system won't boot.

I walked her through some basic things, but it seems that there is suddenly no OS on the drive. It's like the entire HD has vanished, even though BIOS says its there. Lights are on; nobody's home. She's bringing it to me, but I suspect the boot sector is fubar'd. She CANNOT afford to lose her data -- it contains stuff for her job, for which reason she cannot afford to have this sitting in a computer repair shop for a week!

I know the recovery console has a command to fix the MBR, but I read that it can cause the BR to become totally unrecoverable. I need to be delicate, but I've never dealt with one of these before and I know I need to be VERY careful! Please help if you have advice! :(

P.S. Please tell me if this thing can infect the BIOS, and if it will infect whatever flash drive I stick into it!

[jdrom17]

How do you know it's a virus? Norton doesn't do shyt anyways so I doubt it would matter if it was up to date or not...

To me it sounds like her drive just went corrupt. All I can suggest is plugging the hard drive into another computer and seeing if you can access any data on it. That way you won't be messing with the drive. You could also try running recovery software too this way.

And honestly, if her data was THAT important, why wasn't she backing it up somewhere else? Stupid move right there.

[Zefram]

If the data is mission-critical, i won't recommend you toying with the MBR. It would made the whole hdd inaccessible :p

You could try plugging the HDD into another system, and see whether the system could see the HDD......... and try to pull the data out through that system. It may well be that the O/S is corrupt and the hdd data are intact.

But if all else fails, and she really need the data on that hdd, ask her to send the hdd to a data-recovery firm. It maybe costly, but that's the price to pay for not having a backup (like jdrom says, lol)

[Comixion]

Excessive Pr0n maybe?

[Phoenix64d]

No Pr0n, promise.

So, it's a laptop with a SATA HD. It has vista installed on it. I have the computer now, but I think I may have made the problem worse.

1. The initial error was PXE-e61 check media cable from Intel Boot Agent. Certain the problem is the HD. A bios check returns errors.

2. Stuck HD in freezer. No dice.

3. Disconnected laptop HD, and connected to my desktop. Tried to boot from the drive. My BIOS told me to put in some sort of bootable media.

4. Next tried to run XP recovery console with broken HD connected as the only HD. In retrospect, I realize this may have written Windows XP boot files to the drive... :( Tell me I'm wrong. I couldn't see the drive in recovery console.

5. Booted Windows with my main XP HD and the broken HD as a secondary (which didn't work initially, but magically the broken HD decided to start working as a secondary)

6. Disk Management sees the disk. Device Manager sees the disk. They both think the drive is blank too. Yet, the disk does not appear in my computer. I INITIALIZED the disk in disk management. I did not convert, partition, or format it.

7. I rebooted. Still could not see the disk in My Computer.

8. I gave up, put the broken HD back in the laptop. Now I get a new message in addition to Check Media Cable: "Invalid partition table"

9. My stomach turned. What do you think happened? If I did write WIndows XP boot files, I am hoping I can just overwrite any XP boot files with Vista boot files once I get my hands on a copy of Vista come Monday. Or, would you guys recommend that I just leave the damned thing alone, and ship it off to recovery firm. I think the data may be worth that much to her. If it isn't, then I'll try fixmbr when I get the Vista disc.

P.S. She has Vista Home Premium installed. Will it cause any trouble if I try to repair this with Vista Ultimate?

[jdrom17]

P.S. She has Vista Home Premium installed. Will it cause any trouble if I try to repair this with Vista Ultimate?
I don't think so. All Vista versions are identical, just that the key enables/disables certain functions. The MBR would be the same regardless.

And to me it sounds like the hard drive is just dead so I'm not sure how much luck your going to have getting anything off it. Probably the only way to get the data off is to remove the platters and mount them into an identical drive which is extremely costly.

Oh and you will NOT see the drive in My Computer if it's blank. It must be formatted and mounted with a drive letter. Seeing as Windows finds it as a blank disk, it will not mount a drive letter to it.

However since the drive is visible in Disk Management, you could try some data recovery programs out there. I've had luck with this software when my RAID0 array crapped out (GetDataBack NTFS + RAID Reconstructor): http://www.runtime.org/

Again, who runs a laptop with critical data without backups? Laptop hard drives are much more prone to failure IMO since they get bashed around so much.

You should really enforce the fact that she should be making weekly (maybe even daily) backups of all this critical data onto some form of removable media (preferably CD/DVD since it has a lower chance of randomly failing).

[Phoenix64d]

Thanks guys. JD, I'll try the recovery software you recommended. Although I would ordinarily chastise her, I don't think I have to at this point. She was crying last night for an hour straight and got physically sick -- to give you an idea of how important this data was. This may have been a painful lesson, but I'm just really clinging to some hope that I can recover this disk. :(

[jdrom17]

Thanks guys. JD, I'll try the recovery software you recommended. Although I would ordinarily chastise her, I don't think I have to at this point. She was crying last night for an hour straight and got physically sick -- to give you an idea of how important this data was. This may have been a painful lesson, but I'm just really clinging to some hope that I can recover this disk. :(
Well best of luck to ya then. Sounds like she's learned her lesson the hard way though.

[FrozenMercury]

I'd be curious as to what Partition Magic would show for her drive. Might be able to recover the partition and use the drive as a slave if the data is accesable.

I've had some success with the software jd suggested. It just takes time to sift through everything.


EDIT: Hiren's boot cd has many usefull tools. You can probably find a torrent of it pretty easily. But here's the homepage if you want to check it out. http://www.hiren.info/

[jdrom17]

EDIT: Hiren's boot cd has many usefull tools. You can probably find a torrent of it pretty easily. But here's the homepage if you want to check it out. http://www.hiren.info/
Ah yes, SpinRight would be another good program to run which is included on Hiren's Boot CD (it's an illegal copy though and thus why the boot CD is only available on torrents). You could buy SpinRight though if you prefer the legit way.

[Dizzious]

No Pr0n, promise.

So, it's a laptop with a SATA HD. It has vista installed on it. I have the computer now, but I think I may have made the problem worse.

1. The initial error was PXE-e61 check media cable from Intel Boot Agent. Certain the problem is the HD. A bios check returns errors.


Just to add a tidbit here; the PXE thing is the computer trying to boot off of a network device. That just means that it couldn't find a boot device, so it tried to boot from the network, and it couldn't do that either apparently (which is perfectly normal, you probably don't have the thing booting off the network...).

I would like to vouch for the software that JDrom recommended, I've used it plenty of times (a couple on my own stuff, mostly on customers data/drives at work) and in my experience, it's the best recovery software out there. It can often take a long time to do it's job though, as in "let it run overnight".

If it's REALLY important data, you could try sending it out to a data recovery outfit. I've done business with a place called Drivesavers (http://www.drivesavers.com/) - they're pricey (think $2,000)... but you do get what you pay for. If it was data that was THAT important, and you NEED it back, you might give them a call if other methods fail.


I notice you said that you can see the drive in Disk Management & that you initialized it. That being the case, Getdataback will probably recover the data just fine. However, if software methods of data recovery fail and you don't think it's worth spending a couple grand on (or can't afford to), you could try a last-ditch swap of components on the disk.
To do that, you need to order a functioning drive which is identical to the one you've got - same model & all that. Test the drive first to make sure it's working. The first piece of hardware to swap would be the PCB on the back of the drive - take the board off the new drive, put it on the old drive, then see if you can recover anything. If not...
...then you need to build yourself a glove box. You can build a decent one for about 20 bucks out of an air filter with a fan, some dish gloves, and a clear plastic tote from wal-mart. A google search yields me this tutorial on the subject. (http://www.bom.ca/building_glovebox.htm) Basically, a glove box is a miniature clean-room, which you need to have if you're going to expose the drive platters to open air....
...once you've got the glove box, put both drives & all required tools inside it, close it up, and let the fan/air filter run for a few minutes to clean the air inside of it. Next, go to work taking apart the drives (having a bunch of different small-sized torx drivers and a pair of pliers as tools is a good idea). The idea here is to take the platters (flat shiny things that look like donuts) out of the old drive, stick them in the new drive, then reassemble the new drive so that it will work with the old platters. If you can pull it off, you stand a good chance at recovering whatever was on that drive.

That was quite a mouthful... I think I'm gonna stop shooting off at the mouth & say good luck with the data recovery.:)

[VanillaTbone]

If she would have sent it to me, the first thing I woulda done is stick the HDD in my desktop and boot up Ubuntu Linux...

Then Disable the PXE(Intel LAN Boot Agent).... All my Dell PowerEdge servers have it and I hate it. My Dell PowerVault(100% Headless Server) relies 100% on PXE Boot to get anything done...



Seriously, the most simple solution(or at least most simple first thing to try) is usually the last thing we think of in an emergency...

But then again as the others have hinted at... Data Lost = Serious lesson learned and next time someone will think very hard about a Data Backup Plan...


I do Massive data backups and off-site recovery for a living... With any PC, no matter if its a 3TB SAN or a PDA... BACKUP YOUR GD DATA!!!!! :fighty:

[Comixion]

No Pr0n, promise.



Positive?....

[JoshKorn12]

Sounds like you probably just have a corrupt file system. However, this also could be a hint that the drive is failing.

I would highly recommend using a program like Acronis ot Norton Ghost to make a sector by sector image of the HDD as soon as possible. If it is a bad hdd, every time you boot it up, your chances of retrieving data get slimmer. Running any type of software that may stress the drive in any way will also lower your chances.

There is a chance that a chkdsk /r(you can run this from the XP recovery console) will make the data visible again. I've seen it work in the past. However, all the data might not be recoverable.

If she REALLY needs the data, bring the drive into Best Buy and have them send it away for their DRD services. They working hand-in-hand with Ontrack(THE leaders in data recovery). It'll probably come up as a lvl 3 recovery, which most of the time is roughly $1,800.

[Phoenix64d]

Positive?....

Lol. I'm +positive+ :)

Well, it seems we're getting somewhere! Seems the program sees most of the data, but there is some kind of major error on the drive. If this works, I may have to ship JDROM a beer... :D

[jdrom17]

Lol. I'm +positive+ :)

Well, it seems we're getting somewhere! Seems the program sees most of the data, but there is some kind of major error on the drive. If this works, I may have to ship JDROM a beer... :D
Hehehe, I can't drink yet :p

You can ship me some hardware though ;)

[Dizzious]

I do Massive data backups and off-site recovery for a living... With any PC, no matter if its a 3TB SAN or a PDA... BACKUP YOUR GD DATA!!!!! :fighty:

Seems like a pretty good business to be in, Tbone. You ever tried swapping platters on a drive?

[Phoenix64d]

Wininternals disk commander to the rescue. A friend happened to have a copy "handy" (hey do you guys like torrents? I like torrents. Torrents are wonderful...) Partition table was ruined. How? Dunno. Don't care. I have the data. The drive can spin itself to pieces now as far as I'm concerned. Now Ill install some working antivirus and run some checks to try to prevent this problem from repeating itself. Thank you to all who helped

[Comixion]

Hehehe, I can't drink yet :p




Anybody can drink. You just mean legally eh? You do have a house don;t ya?

[FrozenMercury]

Wininternals disk commander to the rescue. A friend happened to have a copy "handy" (hey do you guys like torrents? I like torrents. Torrents are wonderful...) Partition table was ruined. How? Dunno. Don't care. I have the data. The drive can spin itself to pieces now as far as I'm concerned. Now Ill install some working antivirus and run some checks to try to prevent this problem from repeating itself. Thank you to all who helped

I'm glad to hear that all the precious data is safe. Nothing more stressfull than being in that situation. And nothing more relieving than recovering all that data. Torrents are always good... Torrents will help your friend avoid such a disaster again. We're talking about legal torrents right? :p

[FrozenMercury]

Anybody can drink. You just mean legally eh? You do have a house don;t ya?

Think he ment he couldn't drink in celebration quite yet. I'll drink to ya! Cheers mate!

[jdrom17]

Anybody can drink. You just mean legally eh? You do have a house don;t ya?
House? What's that? :p

Actually I don't really feel the need to drink for whatever reason or smoke for that matter. I guess I'm different from the normal...

And yeah, I meant legally. I know I can illegally if I really wanted to.

[Phoenix64d]

As Homer Simpson said: "Here's to alcohol - the cause of and solution to all of life's problems ;)

House? What's that? :p

Actually I don't really feel the need to drink for whatever reason or smoke for that matter. I guess I'm different from the normal...

And yeah, I meant legally. I know I can illegally if I really wanted to.