Results 1 to 5 of 5

Thread: Disk failure or Virus?

  1. #1
    Bronze Member
    Join Date
    Dec 2002
    Location
    Derbyshire, England
    Posts
    105

    Disk failure or Virus?

    Can anyone put forward any ideas about a recent problem I had with one of my client's machines?

    The machine is running Win 2000 pro and has a 60Gb disk drive formatted as a single FAT32 partition. As it turns out, no antivirus software was working on the machine, nor was a firewall in operation. The machine connects to the internet via another machine which provieds the internet connection sharing and is firewalled.

    From what was reported, the machine had been working OK and left for a while and when they came back to it to shut it down, it was showing a blank blue screen. The following day it started OK but later 'froze up' and then wouldn't reboot. So much is what I was told.

    When I investigated I discovered that the boot sector had been corrupted - but in a very organised way. Only every 8th byte was affected, starting with the 6th byte and only the 6th bit of that byte was affected (except for one byte).

    of the 42 bytes affected (of the possible 64 8th bytes), 40 had bit 6 switched on (OR 0x40), 1 had that bit switched off. The other byte was the exception mentioned above but it is possible that its differing value was legitimate - I don't know quite enough about FAT32 boot sectors to say! The way I ascertained the 'correct' values was by comparing with the spare boot sector copy stored at sector +6.

    The only sector I could find with any error was this boot sector.

    I restored the duff sector to its copy and the machine rebooted reasonably adequately (there was actually an inaccuratly recorded free space message) but I was able to reboot the system and get at the data. Since then it has been working fine.

    My immediate thought was that it looked like the result of a virus, however a full scan of the disk showed nothing and searching on the net revealed no messages about a virus which showed this behaviour (though I could well have missed it).

    I thoroughly checked out various bits of hardware - the disk, the cable (which I replaced anyway), the memory. I wasn't in position to be able to do very much with the disk controller.

    So what are your theories as to what happened?

    What I'd like most is for someone to say that this was exactly what virus XXXX does - or failing that suggest what component could have misbehaved in such an organised way.

    I can't see why anything *should* have been writing to the boot sector for it to get it wrong! Needless to say the machine now has adequate protection.

  2. #2
    Super Moderator Super Moderator Big Booger's Avatar
    Join Date
    Apr 2002
    Location
    JAPAN
    Posts
    10,941
    FAT32 is notorious for corruptions of this type. I used to get them quite frequently with windows 98, and back then I didn't have the benefit of a disk image or the knowledge to do a repair.. so I would have to reinstall..

    COuld have been a rogue program or it could be a hard disk going bad. I'd keep an eye on it if I were. Highly unlikely it was a virus if you scanned it with a recent virus definition and it came back clean..

    Is there any particular reason that win2k machine needs to use the FAT32 file system? Why not back up the data, format and bring it to the NTFS system for security and stability? Plus as it writes data in smaller cluster sizes, you use the disk space more efficiently and will have extra space to store files AFAIK.

  3. #3
    Bronze Member
    Join Date
    Dec 2002
    Location
    Derbyshire, England
    Posts
    105
    Conversion to NTFS is on the list of things to do. FAT32 was originally needed since it was a dual boot machine for a while but now they're happy with W2K it'll get converted when there's time.

  4. #4
    Super Moderator Super Moderator Big Booger's Avatar
    Join Date
    Apr 2002
    Location
    JAPAN
    Posts
    10,941
    Just remember regular disk management, chkdsk, scandisk, defrag, etc...

    NTFS will do them well. I'd only use FAT32 if I were to run a dual boot like they were.

  5. #5
    Silver Member joshsiao's Avatar
    Join Date
    Jun 2003
    Location
    Singapore
    Posts
    357
    Yup, I guess thats the problem. A long time ago way back when I was using Win 95, there would be frequent losses of sectors, I thought that it was due to the instablity of 95 so I switched to 98, new OS at that time. The Seagate drive was reformatted and 98 installed on it. This time the problems got worse. Not only were there losses in sectors but in the boot sectors as well. I had to have the drive reformatted 10 times before ME came out. I got a new computer to replace the old ageing one. ME was unstable, crashes often happened but the drive was fine. Finally, XP came and I upgraded the OS. The computer was already into its 2nd year. During the 3rd year, which is the 2nd year of using XP, the OS started to reboot occasionally all of a sudden. It had to keep on going for a consistency check. The Hard Drive was failing again? No, its was due to Fat32 and the mostly framented drive. The drive was not old, it was stressed and FAT32 made it worse. Finally this year I bought another computer which I am using now. Its 80GB so the file system would be NTFS. Its stable and fast. and defragmentation is fast. I used to wait for hours for the defragmentation to complete but now its done in 15 minutes!
    "Never seem more learnt then the people you are with. Wear your learning like a watch and keep it hidden. Do not pull it out to count the hours, but give the time when you are asked."
    ~Chesterfield

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •