If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Trying to set Zotob worm infected drive as a slave
As my subject indicates, I have a friend with a PC that was infected by that
new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. |
#3
|
|||
|
|||
Chances are that the infected PC was running XP in NTFS - which means that
Win ME cannot read the data without a third-party program to enable reading of NTFS drives. There are a number of such programs available - the free ones will only allow reading of data, rather than writing, while the paid-for one mostly also allow writing (but I'm not certain what that does for data integrity). Google for options...(http://www.google.co.uk/search?sourc...&q=ntfs+reader) If the infected machine is set for encryption, however, then all bets are off. -- Noel Paton (MS-MVP 2002-2005, Windows) Nil Carborundum Illegitemi http://www.btinternet.com/~winnoel/millsrpch.htm http://tinyurl.com/6oztj Please read http://dts-l.org/goodpost.htm on how to post messages to NG's "GTifeld" wrote in message ... As my subject indicates, I have a friend with a PC that was infected by that new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. |
#4
|
|||
|
|||
On Sun, 21 Aug 2005 21:45:01 -0700, GTifeld wrote:
As my subject indicates, I have a friend with a PC that was infected by that new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. It would matter if the Windows XP computer is using the NTFS file system; Windows ME is not able to work with the NTFS file system, only with the FAT, or FAT32 file systems. Your report that the drive "just doesn't show" is suggestive of just that problem. You will need to slave that HDD on a Windows XP computer. I wouldn't do that on an important computer, or on a networked computer. With a known infection on the HDD I would rather use an isolated computer which would not cost me a lot of work in case things should go awry and the infection get away. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint |
#5
|
|||
|
|||
Hi Mike,
Thanks for your response. I'll see if I can scare up another XP machine to hook it up. And, YES, I did try booting into safe mode, but to no avail. Every boot option (safe, last known, etc.) resulted in automatic reboots across the board. "Mike M" wrote: If the infected PC was using the NTFS filing system then attempting to access the disk as a slave from a Win 9x system such as Win Me is doomed to failure as Win 9x systems cannot read or access disks using the NTFS filing system. As to trying to remove Zotob, have you tried booting the XP machine into Safe Mode and removing the worm from there? For most variants the worm isn't launched when in Safe Mode giving the user time to remove the launch entries from the registry and to identify the variant and delete the worm manually. -- Mike Maltby GTifeld wrote: As my subject indicates, I have a friend with a PC that was infected by that new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. |
#6
|
|||
|
|||
Thank you, Noel. I will give that a try.
"Noel Paton" wrote: Chances are that the infected PC was running XP in NTFS - which means that Win ME cannot read the data without a third-party program to enable reading of NTFS drives. There are a number of such programs available - the free ones will only allow reading of data, rather than writing, while the paid-for one mostly also allow writing (but I'm not certain what that does for data integrity). Google for options...(http://www.google.co.uk/search?sourc...&q=ntfs+reader) If the infected machine is set for encryption, however, then all bets are off. -- Noel Paton (MS-MVP 2002-2005, Windows) Nil Carborundum Illegitemi http://www.btinternet.com/~winnoel/millsrpch.htm http://tinyurl.com/6oztj Please read http://dts-l.org/goodpost.htm on how to post messages to NG's "GTifeld" wrote in message ... As my subject indicates, I have a friend with a PC that was infected by that new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. |
#7
|
|||
|
|||
Hi Norman,
Thank you for your response. I'm a little embarrassed that I didn't think of the NTFS thing. What can I say but it's late and I'm beat. Need to sleep and refresh myself. Will search for a spare XP machine to use as a guinea pig. Thanks. --- Gary "N. Miller" wrote: On Sun, 21 Aug 2005 21:45:01 -0700, GTifeld wrote: As my subject indicates, I have a friend with a PC that was infected by that new-making worm last week. As a result, his PC kept rebooting itself and I can't get into it to perfrom any maint. (not even Safe Mode). The owner never did any backups, so all the data is trapped on this drive that will not boot. On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a WD 20gb) in another PC. The infected PC was running XP and the testing PC that I'm trying to install it into as a slave is running ME, but I wouldn't think that would matter. I've tried setting the jumper on the working drive to dual master and the bad drive to dual slave. I've also tried using two separate IDE cables (one primary and one secondary). In each instance, the drive is detected in the PC's BIOS correctly, but when booting into ME, the drive just doesn't show. When I tried using the same cable but setting the jumpers on both drive to "cable select", then the PC gets caught in the reboot loop again as if trying to boot off the bad drive. Am I doing something wrong? Or is this drive just completely fried and I should give it up for dead? Thanks in advance. It would matter if the Windows XP computer is using the NTFS file system; Windows ME is not able to work with the NTFS file system, only with the FAT, or FAT32 file systems. Your report that the drive "just doesn't show" is suggestive of just that problem. You will need to slave that HDD on a Windows XP computer. I wouldn't do that on an important computer, or on a networked computer. With a known infection on the HDD I would rather use an isolated computer which would not cost me a lot of work in case things should go awry and the infection get away. -- Norman ~Win dain a lotica, En vai tu ri, Si lo ta ~Fin dein a loluca, En dragu a sei lain ~Vi fa-ru les shutai am, En riga-lint |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
WIN98SE BOOT PROBLEM | R.L. Barnhart | Disk Drives | 2 | May 12th 05 10:25 PM |
Cannot format a network drive | iwrpwrri | General | 21 | March 31st 05 02:41 PM |
installing new hard driive, copying from old to new | Larry | General | 12 | February 17th 05 08:20 PM |
cd rom drive disappears when I install a new hard drive ??? | Edward Letendre | Disk Drives | 5 | February 16th 05 12:55 AM |
BAD BAT | Pebble | General | 41 | December 2nd 04 09:51 PM |