Linux Attacked by Windows Malware

Phew! Sounds like you got something that attacked your machine below the OS level, which is to say something that attacked either the BIOS or the drive firmware. And while I've never heard of this happening before, it doesn't strike me as impossible. It sounds to me like, if you cannot completely wipe your drives with something like a zero-fill program which completely fills the data-space with zeros, then you need to start with new drives, as there is something really nasty living on your old ones.

As for Linux, it generally is a much better OS than Windows. It is more stable and there are very few people out there writing viruses and the like to attack it. However, it does demand a much higher level of user expertise than Windows. Be prepared to spend a lot of time studying how to solve problems that simply do not exist in the Windows world. For example, just downloading and installing a program with Linux is a much more difficult proposition than with Windows. And where there are a hundred applications to do something in Windows, you might not find any for Linux. It's a lot like owning a Mac, but not as user-friendly. But, once you know your way around it, it really is the best OS out there.

And while I've never heard of this happening before, it doesn't strike me as impossible. It sounds to me like, if you cannot completely wipe your drives with something like a zero-fill program which completely fills the data-space with zeros, then you need to start with new drives, as there is something really nasty living on your old ones.

REPLY

Simply wiping the drive with a zero fill program is playing ostrich and sticking my head in the sand. I have never heard of this kind of behaviour either; hence my great surprise. I believe this malware originated as AntivirusXP2008/2009 but it apparently mutates itself with each boot up.

Locally this particular malware caused considerable economic damage. Some businesses infected with it lost their systems for days and a few cases for more than a week. Some individuals lost their computers completely. My doctor's office was forced to revert to paper and pencil record keeping for over a month. A couple of my sources reportedly traced the malware as being originated in south Eastern Europe. If this is in fact a back door attack on American business it was sucessful and bodes ill for the next wave of infestation. The next time it may well attack banks and major business computer systems relying on windows. My own credit union was pretty close mouthed about details but admitted to having difficulty with their system and we could not make any remote financial transactions for about 3 days. What about th enext time?

I agree that Linux is much better than windows and I am prepared to suffer the learning curve. That is not an issue. So far the UBUNTU variant of Linux has met my needs. No complaints there. I'm concerned about this virus and how to combat it. It is exhibiting behaviour that I have not seen mentioned before.

Linux is not a panacea against any malware progs and as any OS it could be breached. However probability to get a headache here (under Linux) significantly lesser.

I think you got a bad luck/coincidence of your hard drive damaging due to reasons which has not related directly to any malware activity. For instance hard drive controller had been broken (there might be a reason when PS had not enough power to run extra drive once it was attached).

What linux's distro had been applied. How your drive had been partitioned exactly? Do not rely on simplified drive partitioning. It;s urgently preferable that yours "/boot" "/" "swap" "/home" (plus maybe "/usr") directories were located on stand alone prime partitions. Ext3 or ReiserFS is good for that. Reiser is some slower but quite reliable and a durably good working file system.

I'm afraid your new computer's MB either drive inside was not quite good. Some MB's or drives' brand doesn't like "to cooperate" with each other. Have been jumpers installed properly?

Here's a hope all will be fixed out. Take a breath and try again. Maybe WinXP/2k as a test installation?

I realize Linux is not a panacea for everything. However, my concern is that here is possibly a malware variant that can cross platforms and spread it's destructive effects further than normal. Conventional wisdom has it that malware is focussed on one particular O/S. The Linux advantage is like the Mac in that it is not susceptible to the majority of Microsoft directed attacks. And as Dr moose says; there are few program writers out the who bother to spend time attacking Linux at this time. If this partucular variant spreads it will put a whole class of devices at risk that peviously was considered to be safe.

The specific Linux distro is UBUNTU Ver 8.04.1 the Drive was set up with only one partition so the Linux software occupied the entire drive. It was a clean install from the Distro ISO imaged CD. Nothing had been run on the drive except a test run to verify the install was clean and fully installed. The 10 GB drive was a spare on hand and had been installed in a stand alone computer for the specific purpose of recovering data files from the old infected drive. The motherboard had previously been running Win XP from that same infected drive for almost two years without fault . The motherboard is fairly recent. It has both IDE and SATA drive sockets. Noth the very latest technology but not so old either. The 300 watt power supply has supported dual CD drives and dual HD not to mention a host of USB devices. Camera, Head sets, external drives, etc. We are not talking about incompatible hard ware. It all worked fine prior to the appearance of the malware. The only addition was the Linux software and it has been running fine on a couple of my computers since October. My new computers are not involved. I made sure this computer under test was not connected to my network.

I had a similar but not exact problem. My computer contracted something that shut down the computer as soon as it finished booting up. I was able to access the drive by booting up with a floppy and accessing the Bios setup program and make the "D" drive (backup hard drive) as the boot up drive. After running a couple of stand alone virus programs and coming up empty I shut it down only to find later that the "D" drive was now infected with the virus. The solution came when I remembered that if you remove the battery for about 15 minutes the bios will reset itself. I have not had the problem since. It's worth a try! Best of luck and Happy new year !

Regards

Charles J. Hills

CJ , You are correct about the battery.On some boards, there is also a jumper that can be moved to totally erase the BIOS. There are some protected or reserved areas of BIOS that are not accessible without tech assistance form the manufacturer,hopefully, this area is not infected. HTRN

When I said for PS problem I meant as well voltage regulators on main board which could be responsible for disk controller damage as well.

If BIOS corrupted it would be impossible to observe zip data and got downloaded OS through CD.

I've heard a lot about malicious progs which could make HD broken on low level. At the past I used to apply old and good Norton utilities (under DOS) to wipe all possible problems out. Linux has such low level prog routines as default. Meanwhile, I bet if HD had been eventually damaged neither software will mend a problem.

One more suggestion is to attach problem HD to another PC, just for checking out, how things go.

One more suggestion is to attach problem HD to another PC, just for checking out, how things go. REPLY That is how I found out the drive was no longer recognized. The BIOS is not corrupted.

Happy New Year!

I just spent several days removing MS Antispyware 2009 and its nasties from my hard drive. I was able to do it without any replacements by using downloads and help from this link: http://www.bleepingcomputer.com/malware-removal/remove-antivirus-pro-2009.

I suggest that you download the recommended file(s) to your desktop and rename them with an alias to prevent the embedded rogue files from stopping installation. There is also a TDSS driver file that you will need to disable.

Good Luck! One of my sons dealt with the same virus and did replace his hard drive, I think because he fell prey to allowing the pervasive alert notice to prompt him to install it. Fortunately, I did not, but it still invades deeply into your system. I did not have any BIOS difficulties either.

Please re-read my original post. I no longer run MS Windows. I now run Linux. however I was trying to salvage the data files from the old infected drive using LINUX. To my surprise the malware was activated again and damaged my LINUX computer drive. I had been informed by a number of people who supposedly know about these things that it is NOT possible for malware to cross O/S platforms. Hence my concern. If malware program writers now have found a way to make their nastyware infect across platforms then we are in serious trouble. Most Apple, MAC and Linux users have the impression that their system is somewhat more resistant to virus and malware attack. In fact I have never seen protection software on the store shelves that offer protection to anything but MS windows operating systems.

elnav,

This is a LINUX based antiviral rescue system tool, very effective - free too. www.avira.com/en/support/antivir_removal_tool.html

It way well be linux based but it will only install on a Windows formatted computer. Also it requires the computer be connected to the internet. Neither applies to my situation. I am unable to open the downloaded package. How do I make this work on a stand alone Linux machine with no hard drive.

Hello elnav,

The following may be more than you asked for though you will find it very interesting. The method you did ask about you will find in the text and it may prove beneficial at this point to tear down to bare bones, seeing as you are so close and perform the described fix; enjoy.

How to Bench Test Your System

The purpose of this thread is to demonstrate an easy way to test your system prior to complete assembly. If you take the time to bench test your build prior to full assembly you will save yourself hordes of time in troubleshooting a faulty component.

The most efficient way to minimize lost time is assemble each part one piece at a time until operational stability is proven. The bench build is especially useful when troubleshooting a previously assembled system that has begun to show quirky instability problems, possibly caused by a case short or other similar problem which is hard to detect in an occupied case assembly.

Another major benefit to the bench build is the up-close inspection this method offers you, many times I have torn down a flaky system, bench assemble the parts and notice a burn spot, or debris in the video card slot, small plastic chip type debris has been found in the main motherboard connector which prevents full contact of all the pins in the main connector, another common discovery upon up-close visual inspection is burnt pins in the main connector or cpu power connector on the motherboard.

Here we will get started with the steps of bench building & testing. only the bare essentials here, no cd-rom drives, hard drives, floppy drives etc



A) Place the motherboard on top of a non-conductive surface. I personally favor the motherboard box itself as it allows the video card riser to ride past the bottom surface of the motherboard, this is an important consideration (see black arrow)


B) Install the CPU into the motherboard, here is an often made mistake, many fellas want to assemble the cooler heat/sink mounting frame to the motherboard prior to inserting the CPU, however after market coolers such as the Zalman 9500 frame stop the CPU lever from swinging open enough to open the socket lever to insert the CPU.
Therefore install the CPU into the motherboard CPU socket before mounting the heat sink frame. Make sure you align the golden arrow on the cpu die perimeter with the orientation mark on the motherboard socket (see manual)

C) Install the CPU heat sink / Fan combo and connect the fan wire to the CPU fan header on the motherboard, this is a very important step, many motherboards will not fire if the cpu fan is not activated, at the very least the cpu temps will rise immediately and cause a thermal auto shutdown.

D) Insert one stick of memory; see motherboard manual for specific slot to be occupied for single stick operation, some motherboards will not fire up unless these rules are followed. Please adhere to the single stick memory install until we have achieved the "first" successful bios screen post.
Often times memory incompatibilities will cause a system not to post, these problems can be quickly identified if you install only one stick for our first post screen goal! (seldom does proven incompatible memory fail to start a system when single stick occupied)
Later in our bench testing we will go after the second post screen, then we can install the second stick, if you have a memory incompatibility it will then show the dilemma without further loss of time!

E) Place the PSU on the bench and connect the motherboard main connector (20 pins or 24 pin) If your PSU uses a 20 + 4 connector (most units use this now) you will either leave the detachable four pin in place for a 24 pin main connector motherboard or you will detach the snap lock four pin from the 24pin connector to reduce the main connector to a 20 pin configuration.
Next step is attach the 4 pin square looking cpu power plug (some boards have an eight pin cpu power plug) make sure when inserting the four pin cpu power plug you "hear" the snap of the positive lock of the clip.
Many fellas make the common error of trying to use the detachable four pin connector from the 20+4 motherboard connector to power the CPU this does NOT work you must use the CPU power plug

F) Install the video card and the video card dedicated power plug if the card needs such a power plug. Make sure the video card riser extends past the bottom of the motherboard surface (see pic w/black arrow above)

G) Connect a keyboard and mouse to the motherboard. Connect a monitor to the video card, verify the monitor has power active. Connect the PSU power plug into the wall socket.

H) You have two options to start the system, you can assemble the test platform next to the case and just simply bring the case switch wires over to the motherboard and use the button on the case for system activation.




Or you can use a small flat bladed screwdriver to just touch the two pins on the motherboard header, these are the same two pins that normally get occupied by the PWR Switch on the motherboard connector header. Simply touch those two pins together for about two seconds and then pull the screw driver away, it should fire up. If not check the switch on the back of the PSU to make sure the PSU switch is on?

at this point in the test you should see the post screen ????? if not; power off the system, inspect everything step by step for accuracy and try again, if still no joy.

Just kidding; swap memory sticks and try again ?

Things to check when the power is activated:

1) Does the CPU fan spin at start-up ?

2) are there any LED lights that are lit on the motherboard when the PSU is connected with the power active in the PSU ?

3) does the video card fan spin ?

4) when the power is active to the system on the bench does the monitor show a yellow or green stand-by light (next to the monitor power button)

Once you get to a post screen I advise you hang there for about half an hour in the bios screen and monitor CPU temps and get your bios settings configured while you are waiting out your temperature monitoring. Set the data & time if this is a new build, boot priority, etc




Now that you have the core components of the Motherboard, CPU, Video Card, two sticks of memory, Power Supply, Keyboard, Mouse & Monitor working; next we proceed to adding Cd-rom drive, Hard Drives, Floppy Drives and the Operating System. All components are added one at a time and verified working. If you build three systems you will receive one new dead part, guaranteed! That's why installing one variable at a time will save you a lot of grief in identifying that culprit when the reaper comes knocking.



in photo above the hard drive is active, floppy drive & cd-rom drive (don't forget jumper pin settings on your drives) and if the bios doesn't detect your drives, then you cant go any further with this process, you must correct that immediately, the bios must recognise your devices before you can use them at all! No drivers whatsoever have to be dealt with at this stage!
If you look closely at the monitor the hard drive is being formatted during the OS install.


Now that all components have been verified and the OS is installed, we can stuff all the "guts" into the case knowing that everything is operational, so if there are any problems we know we made the problems while installing into the case. One word of cautious advice; make sure when you install the motherboard stand offs in the case you only use the motherboard mounting holes which have a silver ring around the hole on the motherboard itself, you DONT use the holes in the motherboard which don't have the silver ring around the perimeter of the hole!
You should have 9 (usually brass) case stand-offs under the motherboard for a full sized ATX board, make sure there is a mounting screw in each stand-off. If you make the mistake of installing a stand-off where its not suppose to be, the bottom of your board will be shorted!

Its very important that none of the metal surfaces on the bottom of the motherboard touch the case surface or you will create a nasty motherboard short!

If you do not pay heed to this warning, you will suffer the symptoms of a motherboard short, these can drive you insane!

Thanks bwise! I need to create a work space where I can spread out the parts as described. I will also transfer the post to someplace where I can print it as a hard copy. For the test I need to use the same monitor hardware as I am using to read this msg as Webmail. There is no provision to print with this webmail since the server is 250 kilometers away. Nor do I have a printer at home that connects to this Linux machine. I will have to go to a place 30 Kilometer away where I an download the email and print it there. I will get back to you.

You could view on your phone save to memory card and load it in a printer

Huh? view on phone? Ya gotta be kidding! My smoke generator don't have no view screen. Its visual alright but only to the observer on a distant hill reading the smoke signals. I'll have you know my "memory card" can't scribble with a goose quill fast enough to keep up with the smoke signals. The wind usually blows away the smoke too fast for her to scribble. Seriously, we is so far off the map even cell phones don't work on cornfusers out here. Some lower mainlander jest bought a ranch out here and called me up cuz the preacher told him I was da confuser expert out here. ( an I don't know nuttin) After a hour of trying, I realized it warn't da puter dat wuz screwed but da system. Two hours later on the land line phone the service provider people admitted they lied when they told the customer that he had country wide coverage. Turns out the closest point of internet/cell phone coverage was five hundred kilometers away. I only had to hint about lawsuits and government penalties about lying in advertising nd false representation afore they profusely apologized and agreed to refund his whole contract payment. and not levy penalties. The only reason I got a wi-fi link to the internet is becuz I am tapped into the main fiber optic trunk along the highway for the province wide ambulance and fire station network. I'm exactly 1560 feet away from the fire station antenna. In the whole village of 300 houses we got maybe 12 - 16 homes connected. The rest is out of radio range of the fire tower. I wanted to get away from civilization and here we is ( big grin) Ah'll git er printed up when we go into town for supplies next trip.

Puff-puff to the cornfuser,

System upgrade available, maybe a Co-op opportunity.

I've experienced the far yonder respite where one may hear a flatulent flea from fiffty paces.

Sounds like you are in the ideal location. Ah, yes. Peace and quiet. Why exactly do you want a computer.

To earn a living so I can afford to live here. I teleconsult.

Not everyone is a fat cat living on a retirement income.

You seem to forget that the virus was probably written using no system call, therefore all it needs is a cpu with power on, it has little use for an OS!

Also, in a PC, the various attachments of the hardware have to be made in the same manner......or at least a similar manner (I am not a PC programmer!), so it made little difference as to the OS.

Thats my 2 pennoth!

In such cases of virus attacks, the first job is to fully clean the HD with a proprietry anti virus software......on a PC that is COMPLETELY safe and protected against attacks.....

I also tend to feel that you may have some hardware problem with the mainboard.... maybe not a virus?

The Virus you mentioned is often a free download on offer on the internet. NEVER TAKE UP ON THESE OFFERS, THERE IS ALWAYS A CATCH......

I cab recommend Kaspersky as being a good software, I am using it since 2006 with no problem whatsoever.....

Best of luck with getting out of this mess. Good backups are a great idea, but too late for you at this time....

Andy, there is no way I would have simultaneous identical problems with four different computers and six different hard drives. And yes I did remove the memory battery from MB on several occasions. All of the proprietary anti virus software packages must be loaded on a Windows O/S. I no longer use Windows. I am now running Linux - specifically the UBUNTU distro. I think it was you that suggested using Knoppix back in September to salvage my data files from the infected drive. I was trying to follow that advice. After I got new replacement computers ( with Linux installed) I decided to load Linux on my old computers as well. The Linux O/S was running on a drive that had never been infected. It was a spare drive I salvaged from another computer. I over wrote the Windows that had been installed on it and replaced it with UBUNTU. It ran fine and worked for several hours of testing. Now I know how both my back up copies got wiped. Evidently this malware goes active during the POST boot up and scrambles either the MBR or registry or both. It is able to go active from a slave drive even before the O/S gets loaded.

Perhaps another point of view will help. Lets look at what the REAL PROBLEM MIGHT BE. MY thinking is that the original infection nailed the boot partition on the c drive. since your linux install apparently did not recreate/ restore the boot partition, you're still nailed. It ain't linux, its your drive partitioning.

I'm not a linux guy, but using fedora, you could repartition your hard drive including the boot partition and then reboot into linux.

Just because the hardware is still malfunctioning does not make a credible case that linux was attacked. What it does is confirm that the machine has not been cleared of the orignal attack/damage.

1+ 1 does not equal 5, even though that may/ would be a preferable explanation / conclusionto you.

Your machine was attacked, and your c drive misconfigured. That isn;t the fault of linux.

repartition your drive and properly set up the boot partition and all will be well.all will be well. all will be well. all will be well.

otherwise happy new year.

milo

Milo. I said it damaged a drive that was formatted and already running only Linux. I was under the impression that Linux was totally different from Windows and this is what makes Linux much more resistant to attack from windows focussed malware. So called computer experts have told me that a drive that is set to be a SLAVE only; is safe to read because none of its programs and executable files are activated. I already figured out that the original infection must somehow have migrated from the slave drive over to the new C:/ drive and infected it. HOWEVER, the two affected hard disks are new to me and were never infected. I acquired them later during the process of rebuilding some computers to run Linux. A new hard drive which had never been infected was tested with a motherboard and found to be running just fine using UBUNTU (Linux). At that point I installed the infected drive as a SLAVE. Result: the BIOS reported no boot up file found. Yet five minutes previously the same C drive booted up perfectly. I double checked and discovered the new C:/ drive now has 0 )zero) bytes of capacity according to the BIOS auto detect routine. Whereas five minutes previously it had full capacity. I repeated the process with a second drive which had also never been infected. It was only when I installed the infected drive as a SLAVE that the master drive got wiped. This wiping has to have occurred during boot up. The computer was never connected to the internet. It was never connected to any of my other computers. Therefore the problem could only have originated from the drive that was infected last summer. What surprises me is that it is so easily able to attack a Linux computer. I am also surprised that this infection is instantly activated as soon as power is applied to the infected drive even before the POST is completed and the O/S is loaded into memory. I do not have a self bootable floppy with FEDORA or Fdisk The Windows CD I have in my possession are all upgrades. Not Original CD's . I have gone through half a dozen O/S and computers in as many years. In each case I either upgraded the previous version or the computer came preloaded with only a rescue CD. The only bootable floppy I might still have in my possession is DOS 5 on a 3.5" floppy and I haven't run it for more than 10 years. I doubt the magnetic media on the disk is stil readable. First I would have to find it to check. I am not yet familiar enough with Linux to be able to create a self bootable disk with that system. You said: since your linux install apparently did not recreate/ restore the boot partition, you're still nailed. It ain't linux, its your drive partitioning. MY ISO image UBUNTU CD warns the user that it will reformat and wipe any previous data on the HD if you install it instead of running from the CD. I took that to means it formats and then creates a new partition. Am I mistaken in that respect? You also said: Just because the hardware is still malfunctioning does not make a credible case that linux was attacked. What it does is confirm that the machine has not been cleared of the orignal attack/damage. REPLY: My question then becomes; why can a CD that wipes and reformats; then partitions a drive not be able to perform this function on the affected drive. What was present before that is now removed? I was under the impression that a self bootable CD that can format and partition a new blank HD does not need something else already installed to the HD. I contend that whatever is present on the infected drive somehow attacks any hard drive at a very basic level and this makes it just as dangerous to a MAC or a LINUX as it already is to a Windows machine. The question is what? I am trying to learn something here. Sorry I admit to being sloppy with my terminology. The original malware was specifically directed towards Windows machines. It was named AntivirusXP 2008 but it has apparently mutated. That particular drive has not been active or connected to any computer since Sept 14 2008.

Far be it from me to claim expert status on this currently evolving area. But from a problem solving point of view, I am trying to put the pieces of this puzzle in to the proper compartments.

Please bear with me.

The initial infection was on hard drive "zero" on a windows machine. Windows succumbed to the malware and infected this drive. The malware was "payload" on some anti -windows code. Once on the hard drive, it worked on machine language levels below / independent of windows

You bought new computer installed linux, and thought that since its linux it will not be vulnerable to windows viruses. This seems true, until it had the machine language code injected from drive to drive.

I do not see this as a linux vulnerability, I see this as a sneakernet attack, ie akin to telling someone to insert an infected disk into their own mqchine. I believe that the malicious bit of disk killing machine language would not be successful from outside on a linux machine. But once the poison drive (I call it zero As in zero case) was connected, its malware runs on all drives available,

i guess i am thinking more about catching/preventing the infection thanabout containment; once you let it loose in your new system by deliberately hookingup known infected drive for "data recovery." operator error, not linux vulnerability is the root cause for the death of the new harddrive.

I remain unconvinced that it is a Linux problem; or a linux susceptibility. I believe that hooking up known infected components regardless of operating systems is equivalent to sharing needles in a health care analogy.

Sorry I can't be of more help; but I would write off the Zero drive and its data rather than lose yet another system trying. my point is that the windows system vulnberability allowed this bad code in , once in, it is running at component levels under the operating systems.

I do hope you get this straightened out. but i would take the zero drive out and shoot it if you cant get the folks at mcafee or someplace to do a forensic on it. (Also the other infected drives).

I'll get out of the way now.

milo

<VBG> Okay it looks like a terminology issue. You are correct! It isn't a linux issue as such but rather a machine code issue at a much lower level. I should point out that the machine in question was knowingly put at risk because I knew there was a high probability that it would suffer an attack. My work related computers are safe and this computer will never be connected to their network. What surprised me was the suddenness and ferocity of the malware attack. I have had to fight virus attacks before and have been successful in the past. My last big infection that could not be defeated was back in 2004 and then I was able to recover all my data files using a Knoppix CD. I thought I would be able to repeat that this time. Yes I can just shrug my shoulders and walk away from it, but the implications of such malicious capacity by any virus is alarming. Especially if it does in fact demonstrate a capacity for total destruction of not only Windows but MAC and Linux based computers. In addition there is a host of Linux based applets running in other equipment like cell phones, PDA and so on. Given this particular variant's capacity for survival and method of spreading, it poses a serious threat to the electronic data user community. In medical terms this could become a global pandemic. I had hoped ( apparently in vain) that a software forum might get me in touch with someone having greater expertise in combating this variant. I had read either here or on CNET that this malware mutated. I may in fact have a mutation that is further advanced than what most people encountered. I tried for three weeks to fight it and subjected it to a hundred or so reboots. According to one report I saw, the mutation is done each time you reboot. Thanks for the discussion. Although we did not find a solution, it has garnered some additional ideas.

Your entry has a point. Linux is downloadable from any bootable device(CD, floppy, usb, ethernet whatever), but unfortunately not for Elnav's case, as he hadn't made separate partitioning for crucial linux derictories. I am afraid hd's partitioning (node's db) is a mess now.

I'm supposing fedora and others won't help as hd is not recognised on BIOS level as I could understand.

If hd's hardware is ok it would be useful and hopeful to find out some special engineering measures (software include).

I think the only hope if this hd might be "resurrected" attached to another MB.

Happy New Year to all cr4's!

Caramba let me understand this. Are you saying that it doesn't matter how the HD is low level formatted? Linus will recognize it anyways. Formatting is NOT Linux unique? If that is the case what do I need to use? I once had an old Maxtor disk Manager floppy but it wil not recognize a drive bigger than 850 MB. Any drive bigger than that gets truncated with reduced capacity. Can I use that to begin the resurrection process? I think that Floppy is still stored somewhere. I have somewhere around 800 floppies and CD. I never toss anything out if it was still working - even when it was obsolete. I also have half a dozen computer cases, power supplies and mother boards etc. I should be able to cobble something together. What do I need for the next step to reformat the drive to make full use of its complete capacity. I have a bunch of HD ranging from a 1.08 GB to 80GB. At what point would the UBUNTU ISO CD be able to recognize the drive and complete the job? The only thing I cannot do is find a Windows XP CD that is self booting. All mine are system restore CD and will not boot to a blank drive that lacks formatting.

Elnav, my cr4mate, please do forget about which OSs were installed on your HDs and what could cause your nightmare. Either OS along with HD's firmware uses the same set of codes on its low level. As I said as a dry result you got malfunctioned HD or HD which is not recognised by yours partuclar MB as operable, no matter a reason (virus or anything else). Old HDs which I repaired a lot at past time had been reachable for low level formatting and I used to wipe out all data from MBR and other disk spaces using Norton Utilities.

More than 6 month ago I got a sad plight with my home desktop. There was broken HD controller on MB (damn South Bridge gone to knockout). There were installed my lovely SuSE and Mandriva which I desperately miss now. I've been facing the same symphtoms you're described. But when I connected removed HD(initially properly partitioned) to PC of my temporary employer I succeeded to buckup all crucial data I would be sorry to lose. Now I am compelled to work on laptop (winXP) which my employer's lent me till I charged to make ordered project.

If you would reachable I'd help you for free. Now I so hope someone could help you who is not so far from your location.

I wish all your problems will be sorted out and forgotten in 2009. There is a good chance at least as this is not a leap one.

Sincerely,

caramba.

Elnav, listen to me. I have been building, programing and repairing computers for almost 24 years now, in both Windows and Linux, so please believe that I know what I am talking about.

Formatting is OS specific, period. The Linux file system is totally different from the Windows file systems, and is in fact one of the things that makes Linux so very stable. Indeed, when Microsoft introduced their NTFS file system, it was something of an effort to try to duplicate the Linux file system.

No, in discussing this with my wife, who is probably the best hacker I have ever met, we are convinced that this is either something that has attacked your drive's firmware and is operating at the BIOS level, thus avoiding the OS and file system entirely, or you have a hardware issue that is causing a cascade failure in any drive that gets connected to the original. We honestly believe that you are not going to be able to restore this drive, and that it will continue to destroy any computer you connect it to. Your only safe solution is to write this drive, and any other drives that it has already destroyed, off, and to send the drive to Symantec (Norton) for a thorough forensic.

As to cobbling together another machine, I would highly encourage this. It is always a good idea to have more than one machine. I have always tried to keep at least three on hand. One as my primary machine, one as a backup, and one as a "mule" for testing hardware, such as these pesky drives of yours. And, Ubuntu will recognize just anything that Windows XP will. But, try to keep to a 1GHz or faster CPU, 512meg or more of RAM, and 40gig or larger hard drive (unless you go with multiple drives). Linux will run on a lesser system, but it just won't be all that useful.

Regarding software tools, I highly recommend Hiren's BootCD 9.7, which you can download from numerous BitTorrent sites and then burn to disc. This an invaluable toolkit, in that it contains almost every imaginable utility, and all on a single, bootable CD, including just about every hard drive recovery tool there is.

Now just a point regarding "Master" and "Slave" drives. The old IDE interface, also known as parallel ATA, used a 40 or 80 conductor ribbon cable to connect one or two drives to the motherboard, or in some cases to a drive controller board. The terms "Master" and "Slave" simply designated which drives were which. For example, the primary master (there are usually two IDE slots) is almost always the "C" drive, the primary slave, if there is one, will be the "D" drive. If there is no primary slave, then the secondary master will be the "D" drive, and so forth. And almost universally, the primary master will be the system drive where the OS resides.

In the event that you are using 40 conductor ribbon cables, the drives have to be jumpered to designate which one will be the master and which will be the slave. IF you have a board that can use the 80 conductor cable however, then the master will be the drive at the end of the cable and the slave will be the one in the middle of it.

The advent of the serial ATA interface, or SATA, has greatly simplified this, since each socket will accept only one drive.

Hello Elnav,

I'm afraid it is not a virus attack from your old HD. How could you identify it? For sure you got a broken "new" HD (either hd's controller or its own flash or something else).

Do you have a gut to conduct one more experiment to attach your old problem HD to another PC as a slave. Something says me that all will be well. I can't insist but the only way to sort this mess out to continue the like experiments, of course being cautious.

Sincerely, every good luck to you.

caramba.

It isn't a case of having the "guts" to try another experiment. Its a case of needing time to build up another computer, testing it first, then repeating the experiment. I am totally reliant on the internet and computers for my income. I cannot afford for them to be infected again. I nearly went bankrupt during the last encounter. I live 70 kilometers from the nearest town and I cannot afford to pay hundred of dollars for some expert down on the coast 600 kilometers away to fix things for me. So I proceed carefully one step at a time. right now I am the only computer expert around for 70 kilometers. If I am stuck I have no one nearby to help me.

Three questions before I post a response.

Which (if any?) anti-virus program were you running prior to this happening to the old HD?

Did you install a reliable anti-virus program on the new HD before trying to recover the files?

Did you try to run the infected HD through an anti-viral program before attempting to recover files with the new HD?

Sincerely,

Lady Guru in Ontario

Three questions before I post a response. Which (if any?) anti-virus program were you running prior to this happening to the old HD? REPLY I was running Norton Internet Security on my old windows XP Pro system. Plus whatever Microsoft used. MS Defender or something like that. Also AVG but it didn't find anything. Question Did you install a reliable anti-virus program on the new HD before trying to recover the files? REPLY I have never seen a Virus protection package for Linux. So how can I run it? In order to load an anti virus program onto a HD you must first boot up with an O/S. The failure happened during boot up and the O/S never got installed. The UBUNTU ISO distro comes with some protection against adware, phishing attempts and so forth. I get daily security updates. However LINUX is totally different from the Microsoft world. Once bitten twice shy. No way will I go back to relying on or using any MS software. Question Did you try to run the infected HD through an anti-viral program before attempting to recover files with the new HD? REPLY I'm not sure how you expect me to do that. Any of the commercially available anti virus programs are intended for Windows O/S and cannot be installed or recognized on a LINUX machine. Even if there was a Linux anti virus program you would have to run the O/S before being able to load the virus protection from the equivalent to "start menu". If there are specific after market Linux virus software programs I would love to hear about them. The distro CD came with included protection software. I am not privy to the details. I simply accept the daily updates. The computer store people tells me Linus doesn't need virus protection the way Windows does. One of the main selling features of Linux.

All OSs based on Intel(AMD) are the same way arranged after all(MSWin, Linux, Unix, Novel, MacOS etc). Here's a lot of Anti-virus software for linux distros (so often the same brands as for MS). SuSE's Yast firewall is a paranoic one, though even one might be hacked. But here's a scornful small probability that properly installed and tuned linux machine could be destroyed phisycally by means of external sofware intrusion.

You've been told:

" Linus doesn't need virus protection the way Windows does." This gentleman has forgotten to provide you by some details:

(1)Do not work under root(SU) account;

(2) make your /, /boot,/usr,/home partitions separate in sense that mounting points should be related to stand alone primary logic disk partitions. For /home partitions I used to apply separate physical drive.

(3) type-in command "sync" under shell(command line) time to time to secure all your data will be always properly stored.

There are a lot of other recommendations to continue.

I think most of malware is directed for stealing crucial information not for barbarian like hardware destroying. Virus writers are very pargamatic people. Linux is the same way vulnerable for such attacks. None the less, yes, most of viruses are aimed OSs of big M.

Hi Elnav,

Before we get started, I hope your holidays were wonderful and Happy New Year. So hard to believe we are already into 2009.

I'm a firm believer in starting from the absolute bottom in determining what caused the breakdown. Obviously the first thing to rule out is whether the problem originated from virus or malware OR if it was a hard or software conflict. The bugger of it is that there are too many variables to easily pinpoint. So, first things first, always look at the nastiest proposition, VIRUS.

Now as for virus scanning and protection fo Linux based OS:

http://free.avg.com/download?prd=afl

(first one on the list is for Ubuntu) I trust no other than AVG. Any pc's I ever set up, I install the security suite from 'heaven' including my favorite: AVG by Grisoft. I've had and dealt with far too many failed security systems that were suppose to be 'attack-proof'. No such beast.

Thanks! I have been using AVG since about 2003 on my windows machines but did not realize they also made a version for Linux. Copy downloaded. now I just have to figure out how to install. I'm still so new to Linux that I sometimes have trouble installing things that I want to download. I still cannot get Skype to run on my Linux machine nor can I get GoogleEarth to work. Both worked perfectly on my windows machines. I'm a hardware guy, not a bit diddler. Back in the mid seventies when Motorola first came out with evaluator boards I decided that cramming bits into bytes and uploading them one byte at a time to assemble code was for the birds. Ironically when I did get a new Windows machine for my AutoCAD; my first action was to download and install AVG. Then I ran into a connect problem with my ISP. Their tech support insisted I remove AVG because in their opinion it might be causing difficulties in connecting. to their server. Go figure!