Virus Killed My Harddrive-reformatted 3x+still Bad.

Quote from loufah:

DEC standard 144, which put the table (and the bad sectors) in the first few tracks of the last cylinder of the drive.
Sorry, this should be "and the replacement sectors for the bad sectors".
 
Quote from loufah:

No. dd'ing an entire disk (or at least the beginning, if you don't want to wait for a long time) with zeroes is exactly what you want to do if you have an infected MBR. And we do this when we need to redeploy a disk to hold a different OS or to be in a different RAID box.
Thanks for posting that correction loufah. I was actually considering testing the theory out on an old drive because I didn't believe it to be true but I didn't get around to it.
 
Quote from loufah:

No. dd'ing an entire disk (or at least the beginning, if you don't want to wait for a long time) with zeroes is exactly what you want to do if you have an infected MBR. And we do this when we need to redeploy a disk to hold a different OS or to be in a different RAID box.

You are still living in the days of SMD drives. SCSI and ATA drives keep their bad sector list in an area that can only be accessed by special commands, not ordinary read and write commands.

The c/h/s numbers are mostly fiction, because since the 1990's disks have had a variable number of sectors per track, more on the outer tracks than the inner tracks, and are linearly addressed. c/h/s is just for the benefit of the BIOS and OS, and can be anything you want, although s is generally limited to 63 and of course the product should be as close as possible to the number of sectors on the disk so as not to waste space. In any case, fdisk can set up a new MBR with the appropriate c/h/s values.

The OS keeps a bad sector list, but this is specific to the OS and the filesystem type and is not kept in sector 0 of the drive. Even back in SMD days, if bad sectors could not be "slipped", the mapping used by most OS's used DEC standard 144, which put the table (and the bad sectors) in the first few tracks of the last cylinder of the drive.

I don't know about your experiences, but I have ACTUALLY DONE this! Your simple "nuke'ing" of the first few sectors on a disk may blow out the MBR...I agree - true...continue with a bit more dd'ing and nighty night to the disk - RAID disks included - I HAVE DONE THIS! dd'ing to a floppy is different and the way to "format" a floppy in linux is driving zeroes to the end of the disk with dd.

You may note that I put "track 0" in quotes...I did this for a reason - I don't think elitetrader is the place to discuss disk intracies. If somebody wants to learn about disk details, they might try Steve Gibson's book on disk drives. I don't need a lesson from you on "sector translation." I am well aware of sector translation.

GTS, please do give your test a whirl on that old disk. I may be right or I may be wrong. My experience has been that you can smoke the disk. I can tell you this: I had a Sun 9 GB disk and an 18 GB Fujitsu (both SCSI disks). I ran a command like:
dd if=/dev/sda of=/dev/sdb - where sda was the Sun disk and sdb was the Fujitsu.
When the command was complete - the Fujitsu "thought" it was a 9 GB Sun drive! This sort of "destruction" would mean that the disk would have to be sent back to the manufacturer (Fujitsu) to have "track 0" rewritten - so that the disk would "understand" that it was a Fujitsu drive again. Like I said before - this may not be physical damage to the platters, but it is equivalent (in my understanding), because the disk would need to be sent back to the manufacturer for repair.

-gastropod
 
the original poster may have a bad ram chip, or a bad motherboard, or a bad cpu, not a virus. fix this by getting a new computer, installing several fans to cool the motherboard, ram chips and cpu and don't put the computer in a cabinet (oven) because the fan noise is bothersome

for $170 I could have bought a whole new 64 bit dual core computer

how to get your hard drive back from a virus or to clean install windows to a blank hard drive

download damn small linux , suse linux live, fedora linux live or any linux that runs off the cd and ram chips,burn the iso image to a cd, put it in that machine, use sudo su or su to root # cfdisk /dev/hda or /dev/hdb or /dev/hdc or /dev/hdd to find the hard drive

find the instructions for "shred" program for linux on the internet

# shred -v -n 1 /dev/hda

shred is a file destruction program that will over write giberish to the hard drive 35 times by default setting -v = verbose, it tells you what is happening, -n 1 = number of times to overwrite " -n 1 " is overwrite one time you dont have time to overwrite 35 times it takes days

I have used this program hundreds of times and it will not harm the hard drive, it will wipe everything off the drive, windows (a virus), viruses for windows, the mbr, and all files.

get "antivir" free antivirus, use the windows firewall, reformat and start over when you get a virus

I have built 150 computers. time stealing evil machines.
 
Quote from angel_king:

the original poster may have a bad ram chip, or a bad motherboard, or a bad cpu, not a virus. fix this by getting a new computer, installing several fans to cool the motherboard, ram chips and cpu and don't put the computer in a cabinet (oven) because the fan noise is bothersome

for $170 I could have bought a whole new 64 bit dual core computer

how to get your hard drive back from a virus or to clean install windows to a blank hard drive

download damn small linux , suse linux live, fedora linux live or any linux that runs off the cd and ram chips,burn the iso image to a cd, put it in that machine, use sudo su or su to root # cfdisk /dev/hda or /dev/hdb or /dev/hdc or /dev/hdd to find the hard drive

find the instructions for "shred" program for linux on the internet

# shred -v -n 1 /dev/hda

shred is a file destruction program that will over write giberish to the hard drive 35 times by default setting -v = verbose, it tells you what is happening, -n 1 = number of times to overwrite " -n 1 " is overwrite one time you dont have time to overwrite 35 times it takes days

I have used this program hundreds of times and it will not harm the hard drive, it will wipe everything off the drive, windows (a virus), viruses for windows, the mbr, and all files.

get "antivir" free antivirus, use the windows firewall, reformat and start over when you get a virus

I have built 150 computers. time stealing evil machines.

Damned You Angel_king!!! LOL!!! Solve the OP's problem, while loufah and I could have had a war on what dd can and cannot do - why don't you!!! LOL!!! Ok, damned it, solve the damned problem - LOL :D I must admit that "shred" rocks...yet, I feel the need to create another "OS war" - what the hell is the equivalent MicroSucks command as shred - oh, wait, you probably have to BUY such a critter - LOL!
Thanks - gastropod!
 
Quote from gastropod:
When the command was complete - the Fujitsu "thought" it was a 9 GB Sun drive!
Sure, if the MBR were overwritten, the OS at some level will think it's a different disk. I've actually done this intentionally when I have a 300GB disk I need to clone and all I have is a 301GB disk. The OS doesn't really care if the geometry is different from what the target disk originally was, since it's all a linear address space as far as it's concerned. (The only thing you ought not to do is give the OS the impression that the disk has more sectors than it actually has.) The 301GB disk does not think it's suddenly a different type, though. The Linux sdX device presents an address space that doesn't include anything really critical. If you still have that disk, plug it in, go to the BIOS setup routine provided by Adaptec or whoever, and see what the disk type, model, and geometry really are.

Since you mentioned Sun disk: Solaris does the same thing, although the SPARC platform doesn't use an MBR but something morally equivalent called a disk label. But look at /usr/sbin/installboot on a Solaris system sometime. It is a shell script that writes over the first few sectors of the raw disk device. Doing so does not alter the disk's geometry.
 
I guess where Gastropod and I agree is that it's OK to overwrite the first few tracks of your disk with zeroes or garbage, and that should be enough to get rid of any boot sector virus that is there. So just do that.
 
Quote from loufah:

I guess where Gastropod and I agree is that it's OK to overwrite the first few tracks of your disk with zeroes or garbage, and that should be enough to get rid of any boot sector virus that is there. So just do that.

Hello Loufah, I don't have those disks anymore...happily I think ;-) Kind of small nowadays :-)

EEECCCCKKKKK, you mentioned Solaris - haven't had to play with that in a while. I used to want to keep Solaris and dump Linux. Now that I have worked with Linux for a few years, I like Linux better than (Open)Solaris (whatever the heck that means :D ) (Personal thought - Sun is toast - the Sparc chips just aren't keeping up with the Intel/AMD/(IBM Power) chips. With so little software on Solaris/OpenSolaris...why move to it? I hear the people with the, "but, it will run Linux programs too", but, if I want to run Linux programs...why not run Linux?) What a convoluted system that was too..."how many slices are you putting on that partition...oh and don't forget that slice 2 represents the whole disk.....but, why have slices AND partitions.?!?!?...I digress :D

bottom line...shred rocks!

-gastropod
 
Back
Top