got a virus from somewhere.. can you help me?

xXToilet_DuckXx · #1 07-26-2003, 12:36 PM

hey, just a virus question i was wondering if anyone could help me out....

i was playing eq, and when i shut it down, programs started to not fuction, so i restarted my computer. (ATTN: i do not think the virus, if it is a virus, has anything to do with eqemu... these things are sometimes just a coninsidence)

when i restarted the computer, things were slow, and i noticed the computer was "thinking" all the time (u know, when the little light under the power button flashes like there was some background activity). Tried running a virus scanner (an updated McAffee virus scan and firewall professional version) and i kept on getting a blue screen saying there was a write error to drive C: and that data may be lost.

freaking out at this point i shut off the computer. Starting it up again i got the dreaded message: "opperating system not found"
ACK!!!!!!!! Running around the room screaming at this point, i created a boot floppy with my sister's computer and tried to access my two hard drives. I couldn't, so i tried to format, but it said "no fixed disks present" or something.

Went into the system's bios.... AND THE SETTINGS WERE CHANGED!?!?! i thought viruses couldn't change that.... (which leads me to beleive it's not a virus...) The bios was not detecting any hard drives (even with autodetect) and the floppy drive setting was changed to 720kB instead of 1.44Mb.

I am SO lost right now it's not even funny. My OS is winME (don't laugh, it worked fine before this...) and I have 2 hard drives. One (drive C

is 40Gb, and the other (drive D

is 60Gb... Please help...

***and do remember, i do not think it was eqemu that did this***

Hardy · #2 07-27-2003, 04:35 AM

I got almost the same thing about 2 weeks ago. But the virus deleted a partition (I also, am unsure if its a virus). See if maybe you still have the partitions.
Stick in your boot disk, and if its still the same as Win98, type: fdisk

Just a suggestion, I am probably way off. Just what I had happen to me.

Also, get Norton System Works

*edit*
Also, my disk space has changed. Went from 20gig to 4gig. Still using the 4gig, no clue how to change it back. Seeing as your floppy drive was changed.

xXToilet_DuckXx · #3 07-28-2003, 01:50 PM

well, i just turned on the computer a few days ago.... and *gasp* the computer magically saw my slave drive (which is supposed to be D: but marked it as C

. SO... it still can't find the REAL C: drive and there is still no OS cuz my slave drive just has anime on it. i tried fdisk, but it could only detect the slave drive and not the master.

you have no clue how glad i am that my anime is saved!!!! i had a lot of stuff saved on there.... phew! now i know i must BURN all my anime and not let it just sit there and get infected with a potential virus!

hardy, try using fdisk again and look at your primary dos partition. the virus *if it is a virus* may have created a partition only using 4 gigs of your hard drive and the other 16 gigs is just sitting there.

Darkforge · #4 07-28-2003, 02:02 PM

Uh.. Either you have a virus, or your hard-drive took a shit. I had a 60 gig maxtor for less than a month and it went bad. So, either buy a new hard-drive and test it out, or use your slave drive.

Hardy · #5 07-28-2003, 04:32 PM

Quote:

hardy, try using fdisk again and look at your primary dos partition. the virus *if it is a virus* may have created a partition only using 4 gigs of your hard drive and the other 16 gigs is just sitting there.

There was no partition at all, I had to create one, it just decided to make it 4gigs only.
Hmmmm, I just remembered, my last hard drive before i upgraded was 4gigs..............

Goauld · #6 07-28-2003, 09:46 PM

It sounds to me as if the MBR has been corrupted.

Boot to DOS prompt using your WinME/Win98 boot disk

Type:

FDISK /mbr

Then ENTER

This should clean up the MBR without damaging partition information. Then enter FDISK (enabling large disk support on the way in when prompted) and check your partition table info again.

Hope this helps

velns · #7 07-29-2003, 01:01 AM

For any of those running linux, I just read a good article on backing up / restoring the boot sector on a disk, in a TechRepublic linux tips email. I will paste the contents here =>

BACK UP YOUR BOOT SECTOR

While there are many ways to back up your file system, such as rsync for
remote backups and tar or dd for local backups, there aren't as many
options for backing up your boot sector. However, having a backup of your
boot sector is equally important in the event of a system crash. For this
procedure, the dd tool is your best bet.

LILO, or any other boot loader, is generally installed on the boot
sector of the boot drive. After you've installed or modified your boot
sector and verified that it works, back it up by writing it to a file on
your hard drive or a floppy disk. For example:

# dd if=/dev/hda of=bootsector.img bs=512 count=1

or:

# dd if=/dev/hda of=/dev/fd0 bs=512 count=1

The first command writes the boot sector of your boot drive (in this
case, /dev/hda) to a file called bootsector.img in the current directory.
Replace /dev/hda with your boot drive, such as /dev/sda if you have a SCSI
drive, or /dev/hde if you boot off the first device on the third
controller, such as an ATA100 controller in a system with onboard ATA66
controllers.

If you ever need to restore from these images, reverse the "infile" (if)
and "outfile" (of) destinations. For example:

# dd if=bootsector.img of=/dev/hda

If it's stored on a floppy, use this:

# dd if=/dev/fd0 of=/dev/hda

Make sure that you use the right source and destination. If you
mistakenly write the floppy to the hard drive when you make a backup, you'll
damage your boot sector and won't be able to boot.

velns · #8 07-29-2003, 01:04 AM

For you Windoze folks, it might also work to install Cygwin, and do the steps above, but I am not sure. If it does it is a great way to protect yourself from boot sector corruption.

xXToilet_DuckXx · #9 07-29-2003, 10:11 AM

so goauld, does that mean if i enter that FDISK /mbr none of my files will be deleted? (if the files are still hiding somewhere on there... i'm hoping :evil: )

**EDIT: Actually, i read up on it, and the command seems a little too dangerous. I hear that it's very risky because there are too many variables that could go wrong.

Goauld · #10 07-30-2003, 06:43 AM

I know that FDISK /mbr retains partition info.

A search on Microsoft bought up this :

"Do not use this command if any of the following conditions exists:
The disk was partitioned using the Storage Dimensions SpeedStor utility with its /bootall option.
More than four partitions exist.
Certain dual-boot programs are in use."

&

"Fdisk has an undocumented parameter called /mbr that causes it to write the master boot record to the hard disk without altering the partition table information."

I think that means your files stay intact

Goauld · #11 07-30-2003, 06:45 AM

I know that FDISK /mbr retains partition info.

A search on Microsoft bought up this :

"Do not use this command if any of the following conditions exists:
The disk was partitioned using the Storage Dimensions SpeedStor utility with its /bootall option.
More than four partitions exist.
Certain dual-boot programs are in use"

&

"Fdisk has an undocumented parameter called /mbr that causes it to write the master boot record to the hard disk without altering the partition table information"

I think that means your files stay intact

Goauld · #12 07-30-2003, 06:46 AM

I know that FDISK /mbr retains partition info.

A search on Microsoft bought up this :

"Do not use this command if any of the following conditions exists:
The disk was partitioned using the Storage Dimensions SpeedStor utility with its /bootall option.
More than four partitions exist.
Certain dual-boot programs are in use"

&

"Fdisk has an undocumented parameter called /mbr that causes it to write the master boot record to the hard disk without altering the partition table information"

I think that means your files stay intact

xXToilet_DuckXx · #13 08-01-2003, 11:03 AM

hum.... this leads me to beleive it is a virus.... but is it possible? can this be a virus? and where could i have gotten it? is it possible to get viruses from servers you connect to?

4john · #14 08-26-2003, 04:50 AM

Every now and then my computer just restarts,ill be in the middle of something,screen goes blank,and it re-boots !!!???

This is a junky computer anyway (An AIM,the worst around) Doesnt multi task well,etc......

Anyone 1 no what might be causing my computer to re-boot and to re-size desktip ot 840X640 when i have it @ 800X600 (uugghh)

Thanx

John

Trumpcard · #15 08-26-2003, 05:44 AM

I'd guess it's either a heat issue or memory..

Most likely heat though.