Virus attack ruins gard drive?

[The Fish]

Evening all.

Mates' HP laptop, dual core Turion and 4gb running Vista SP1 64 bit. Gives it to me boot up and immediate nasty red writing on desktop warning the world is going to blow up, and then a fake A/V programme GUI. Um, 'Pro Tools' was the name I think.

Wouldn't let me load AVG/delete anything/ do anything. Wouldn't run 'regedit' in the command line box.

Umm I thought, hard core. Then the thing does a fake BSOD. Then shuts down.

Ok, couldn't do anything, so try sys restore. Nada! Ok, try Acronis and recover the OOB install. Get 'install can't complete error 0x0000000'.

Ok, next was install XP to reformat disk. Nada too. Screen said, hard disk check for viruses etc. Ran Spinrite prog for 25 hours. No dodgy errors or u/r sectors.

So can some viruses get into the boot sector on a disk [ its an unpartitioned disk..I know..] and destroy them? Not even being able to reformat it is me thinking new drive for my mate. Anyone got any other ideas? Something I have missed?

Thanks good peoples.

[Splash]

Don't think I've seen a bootsector virus in a *long* time. You could always run bootrec /fixmbr when booting into a Windows Repair. which will rewrite your MBR.

If that fails, then I'd be looking to run the disk through the vendor support tools to check for errors (I've never trusted anything associated with Steve Gibson I'm afraid) - if all is looking good there then remove all partitions, recreate and reinstall Windows. Viruses are very rarely destructive these days, the writers being far more motivated by financial gains and a machine that won't boot just doesn't make them money.

Rereading your post though reminds me of a few machines I've cleaned since last weekend though - Google "LSE ad virus" or something similar. MalwareBytes can easily clear the infection, which writes to users\all users\appdata. If UAC has been disabled then it might be a little more entrenched, but the moral of the story here is that UAC is one of the best additions to Windows in recent years and anyon who disables it is far from the know-all that they may claim to be.

[The Fish]

Thanks Splash.

Running rescue disk as we speak. Won't repair - 10 errors there. Trying to get it to restore to OOB. Not looking good.

I haven't tried bootrec/fixmbr. New to that so I'll read up, have tried HP's support tools. No joy there. Mem test and hard disk test came back ok. SPINRITE suggested no drama's, ran full level 4 for 25 hours.
So I am thinking the disk seems to be ok. But the failure of installs from rescue suggest mbr issues?

I was not happy that a copy of XP wouldn't even get to the reformat part when being run, which was what I wanted, a new format and wipe the nasties away.

From the rescue disk it's currently installing Vista. but my guess is it will abort. Of to find out about fixmbr! Is is a command line thing?

[Splash]

When you say "installs from rescue" what exactly do you mean? I'm guessing it's a hard disk hidden partition, and if there are disk issues then... it's not going to happen.

If you boot from your Vista disk you should come to the install screen, when you get there you should see an option to repair instead, which will give you an option to repair. Select that and you should be able to get a command prompt.

I may be clutching at straws, but there's always the chance that your XP media is damaged? As you're looking to flatten (from what I can see) the machine is it maybe worth trying to install a Linux distro, even if only temporarily? Should give you some confirmation if it's a hardware issue or now.

[The Fish]

Indeed Splash you are right, the recovery is no good. He has no disk, so I have been trying to recover from the makers small partition. Nada...

But obviously having an XP disk I thought I could install that. Having that tell me no, check for viruses was the game stopper.

[The Fish]

Good point on media, have tried with two verified burns from an ISO. Now digging out original XP disc and trying that.

The Acronis disk loads its GUI, but with no back up image not really helpful. I have made the point that if he gave it to me before he messed up....

[Splash]

Can he get hold of the OEM media from HP? Chances are it'll cost, but in the meantime you could always grab a Win7 trial from http://technet.microsoft.com/en-us/evalcenter/cc442495 - that'll give you 90 days to either get hold of the Vista OEM media from HP or convince him to splash on a Win7 license. Either/or it should be able to prove if you have hardware issues.

[The Fish]

Well, I have run Acronis, Paragon and the MS rescue disk. All work fine, so I am thinking its software.

The Paragon disk includes some disk utilities and I have formatted the damn thing. Now I hope I can get XP on. Although I have yet to see. But you have a good point with the WIN 7 trial- looks a better option. Thanks for your help Splash.

[Splash]

No sweat, but I'd suggest that the Acronis, Paragon and MS Rescue disks likely aren't stressing the hardware at all so I wouldn't rely on them to rule out any form of hardware failure. That said: I fully agree that it's unlikely that it's a hardware issue. If nothing else when you get it all up and running again it might be worth explaining UAC and/or setting up a restricted user account for everyday use: it's only good practise at the end of the day.

[Behemoth]

Might be worth getting a copy of Vista 32 bit oem and loading that on and then use the licence key off the bottom of the laptop.

[The Fish]

Amazed. Deleted in Paragon's utility both partitions, reformatted.

XP still won't load. 'Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check your hard drive to make sure it is properley configured and terminated. Run CHKDSK/F to check for hard drive corruption, and then restart your computer.'

And then some 0x00000007B etc errors.

Right when formatting, I am thinking active partitions etc. All done auto right/ So when it's formatted it should be ready to install on yeah?

EDIT: No it wasn't aoutomatically done. The two partitions I had created [O/S and Data] were both not active. So I made the O?s active. Lets hope that's it.

EDIT: No it wasn't same old message!

Really run out of ideas now.

[watercooled]

Deleting partitions does NOT clear the MBR. You will need to zero it manually, use something like DBAN or dd on a Linux LiveCD (the first few MB would be plenty to destroy the MBR). I must admit I've never come across something like this though, but I always zero HDDs when I reformat anyway, just to be thorough. As above, the recovery partition probably won't work, they are a complete waste of HDD space IMO and a lame excuse for MFRs to not include a DVD which would cost them practically nothing.

@Splash: I couldn't agree with you more, there are few things that anger me more than hearing some computer expert friend has disabled UAC, or Windows Update. But I won't hijack the thread with a rant, I'm sure you feel the same way.

Edit: Oh and some BIOSes have an option to write-protect the MBR, have a look for it.

[Behemoth]

You might find that XP won't run correctly anyway even if you do get it to install. I tried it on my HP laptop a while ago, and I got everything to work driver wise apart from the soundcard. Something to watch out for.

[The Fish]

Ahhh, watercooled. Lovin' your wiseness, thanks. I thought that would clear the MBR. I think I am probably right in thinking that's the issue. Rant accepted; we all do feel the same way I'm sure about turning off updates.

@Behemoth. I am d/l the win 7 trial at the moment, but that's a plan as well, the 64 bit surely? Once I get this sorted.

@Splash. Good points on not really stressing the hardware and also UAC etc.

Thanks for all your help so far fellers, really appreciated.

I think I know so much and then realise its a case of 'in the land of the blind, the one eyed man is King' lol....thankfully Hexus is a main learning centre for me. I'm doing CompTia A+ at the moment, and I learn more here really!

Edit: @Splash. Meant to ask, you made a comment about Gibson's SPINRITE. Care to elaborate? I am always after using progs folk have tested before me. Talikng of which, would anyone else have used anything different?

[The Fish]

Update.

Cleaned MBR, with Paragon,not DBAN as this didn't run in the laptop. Did in my machine. So I began to suspect iffy DVD drive on the laptop as well. But when I tried to install Win 7 demo, it said the NTFS filing was an unsupported version. Formatted in Win 7 and its currently installing.

I hope it will. Learnt Paragon has a useful rescue disk, with a MBR utility and disk ones. But may not format in a Win supported way. Got DBAN, liked the look of that. Found handy 90 trial of Win 7, but make sure you say you are an IT person or they sweep you off to another page.

And finally, educate your mates to mirror images before they mess up. Lets hope I'm not back tomorrow lol.

[wazi]

thought it was just me had this problem last week , essentials didnt stop anything , so format and re-install ( tried spybot etc... nothing worked )