Trying to set Zotob worm infected drive as a slave

As my subject indicates, I have a friend with a PC that was infected by that
new-making worm last week. As a result, his PC kept rebooting itself and I
can't get into it to perfrom any maint. (not even Safe Mode). The owner never
did any backups, so all the data is trapped on this drive that will not boot.
On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a
WD 20gb) in another PC. The infected PC was running XP and the testing PC
that I'm trying to install it into as a slave is running ME, but I wouldn't
think that would matter.

I've tried setting the jumper on the working drive to dual master and the
bad drive to dual slave. I've also tried using two separate IDE cables (one
primary and one secondary). In each instance, the drive is detected in the
PC's BIOS correctly, but when booting into ME, the drive just doesn't show.
When I tried using the same cable but setting the jumpers on both drive to
"cable select", then the PC gets caught in the reboot loop again as if trying
to boot off the bad drive.

Am I doing something wrong? Or is this drive just completely fried and I
should give it up for dead?

Thanks in advance.

If the infected PC was using the NTFS filing system then attempting to
access the disk as a slave from a Win 9x system such as Win Me is doomed
to failure as Win 9x systems cannot read or access disks using the NTFS
filing system.

As to trying to remove Zotob, have you tried booting the XP machine into
Safe Mode and removing the worm from there? For most variants the worm
isn't launched when in Safe Mode giving the user time to remove the launch
entries from the registry and to identify the variant and delete the worm
manually.
--
Mike Maltby



GTifeld wrote:

As my subject indicates, I have a friend with a PC that was infected
by that new-making worm last week. As a result, his PC kept rebooting
itself and I can't get into it to perfrom any maint. (not even Safe
Mode). The owner never did any backups, so all the data is trapped on
this drive that will not boot. On Gateway's advice (the maker of the
PC), I'm trying to set up the drive (a WD 20gb) in another PC. The
infected PC was running XP and the testing PC that I'm trying to
install it into as a slave is running ME, but I wouldn't think that
would matter.

I've tried setting the jumper on the working drive to dual master and
the bad drive to dual slave. I've also tried using two separate IDE
cables (one primary and one secondary). In each instance, the drive
is detected in the PC's BIOS correctly, but when booting into ME, the
drive just doesn't show. When I tried using the same cable but
setting the jumpers on both drive to "cable select", then the PC gets
caught in the reboot loop again as if trying to boot off the bad
drive.

Am I doing something wrong? Or is this drive just completely fried
and I should give it up for dead?

Thanks in advance.

Chances are that the infected PC was running XP in NTFS - which means that
Win ME cannot read the data without a third-party program to enable reading
of NTFS drives.

There are a number of such programs available - the free ones will only
allow reading of data, rather than writing, while the paid-for one mostly
also allow writing (but I'm not certain what that does for data integrity).
Google for
options...(http://www.google.co.uk/search?sourc...&q=ntfs+reader)

If the infected machine is set for encryption, however, then all bets are
off.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"GTifeld" wrote in message
...
As my subject indicates, I have a friend with a PC that was infected by
that
new-making worm last week. As a result, his PC kept rebooting itself and I
can't get into it to perfrom any maint. (not even Safe Mode). The owner
never
did any backups, so all the data is trapped on this drive that will not
boot.
On Gateway's advice (the maker of the PC), I'm trying to set up the drive
(a
WD 20gb) in another PC. The infected PC was running XP and the testing PC
that I'm trying to install it into as a slave is running ME, but I
wouldn't
think that would matter.

I've tried setting the jumper on the working drive to dual master and the
bad drive to dual slave. I've also tried using two separate IDE cables
(one
primary and one secondary). In each instance, the drive is detected in the
PC's BIOS correctly, but when booting into ME, the drive just doesn't
show.
When I tried using the same cable but setting the jumpers on both drive to
"cable select", then the PC gets caught in the reboot loop again as if
trying
to boot off the bad drive.

Am I doing something wrong? Or is this drive just completely fried and I
should give it up for dead?

Thanks in advance.

On Sun, 21 Aug 2005 21:45:01 -0700, GTifeld wrote:

As my subject indicates, I have a friend with a PC that was infected by that
new-making worm last week. As a result, his PC kept rebooting itself and I
can't get into it to perfrom any maint. (not even Safe Mode). The owner never
did any backups, so all the data is trapped on this drive that will not boot.
On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a
WD 20gb) in another PC. The infected PC was running XP and the testing PC
that I'm trying to install it into as a slave is running ME, but I wouldn't
think that would matter.

I've tried setting the jumper on the working drive to dual master and the
bad drive to dual slave. I've also tried using two separate IDE cables (one
primary and one secondary). In each instance, the drive is detected in the
PC's BIOS correctly, but when booting into ME, the drive just doesn't show.
When I tried using the same cable but setting the jumpers on both drive to
"cable select", then the PC gets caught in the reboot loop again as if trying
to boot off the bad drive.

Am I doing something wrong? Or is this drive just completely fried and I
should give it up for dead?

Thanks in advance.

It would matter if the Windows XP computer is using the NTFS file system;
Windows ME is not able to work with the NTFS file system, only with the
FAT, or FAT32 file systems. Your report that the drive "just doesn't show"
is suggestive of just that problem. You will need to slave that HDD on a
Windows XP computer.

I wouldn't do that on an important computer, or on a networked computer.
With a known infection on the HDD I would rather use an isolated computer
which would not cost me a lot of work in case things should go awry and the
infection get away.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Hi Mike,

Thanks for your response. I'll see if I can scare up another XP machine to
hook it up.

And, YES, I did try booting into safe mode, but to no avail. Every boot
option (safe, last known, etc.) resulted in automatic reboots across the
board.

"Mike M" wrote:

If the infected PC was using the NTFS filing system then attempting to
access the disk as a slave from a Win 9x system such as Win Me is doomed
to failure as Win 9x systems cannot read or access disks using the NTFS
filing system.

As to trying to remove Zotob, have you tried booting the XP machine into
Safe Mode and removing the worm from there? For most variants the worm
isn't launched when in Safe Mode giving the user time to remove the launch
entries from the registry and to identify the variant and delete the worm
manually.
--
Mike Maltby



GTifeld wrote:

As my subject indicates, I have a friend with a PC that was infected
by that new-making worm last week. As a result, his PC kept rebooting
itself and I can't get into it to perfrom any maint. (not even Safe
Mode). The owner never did any backups, so all the data is trapped on
this drive that will not boot. On Gateway's advice (the maker of the
PC), I'm trying to set up the drive (a WD 20gb) in another PC. The
infected PC was running XP and the testing PC that I'm trying to
install it into as a slave is running ME, but I wouldn't think that
would matter.

I've tried setting the jumper on the working drive to dual master and
the bad drive to dual slave. I've also tried using two separate IDE
cables (one primary and one secondary). In each instance, the drive
is detected in the PC's BIOS correctly, but when booting into ME, the
drive just doesn't show. When I tried using the same cable but
setting the jumpers on both drive to "cable select", then the PC gets
caught in the reboot loop again as if trying to boot off the bad
drive.

Am I doing something wrong? Or is this drive just completely fried
and I should give it up for dead?

Thanks in advance.

Thank you, Noel. I will give that a try.

"Noel Paton" wrote:

Chances are that the infected PC was running XP in NTFS - which means that
Win ME cannot read the data without a third-party program to enable reading
of NTFS drives.

There are a number of such programs available - the free ones will only
allow reading of data, rather than writing, while the paid-for one mostly
also allow writing (but I'm not certain what that does for data integrity).
Google for
options...(http://www.google.co.uk/search?sourc...&q=ntfs+reader)

If the infected machine is set for encryption, however, then all bets are
off.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"GTifeld" wrote in message
...
As my subject indicates, I have a friend with a PC that was infected by
that
new-making worm last week. As a result, his PC kept rebooting itself and I
can't get into it to perfrom any maint. (not even Safe Mode). The owner
never
did any backups, so all the data is trapped on this drive that will not
boot.
On Gateway's advice (the maker of the PC), I'm trying to set up the drive
(a
WD 20gb) in another PC. The infected PC was running XP and the testing PC
that I'm trying to install it into as a slave is running ME, but I
wouldn't
think that would matter.

I've tried setting the jumper on the working drive to dual master and the
bad drive to dual slave. I've also tried using two separate IDE cables
(one
primary and one secondary). In each instance, the drive is detected in the
PC's BIOS correctly, but when booting into ME, the drive just doesn't
show.
When I tried using the same cable but setting the jumpers on both drive to
"cable select", then the PC gets caught in the reboot loop again as if
trying
to boot off the bad drive.

Am I doing something wrong? Or is this drive just completely fried and I
should give it up for dead?

Thanks in advance.

Hi Norman,

Thank you for your response. I'm a little embarrassed that I didn't think of
the NTFS thing. What can I say but it's late and I'm beat. Need to sleep and
refresh myself. Will search for a spare XP machine to use as a guinea pig.
Thanks.

--- Gary

"N. Miller" wrote:

On Sun, 21 Aug 2005 21:45:01 -0700, GTifeld wrote:

As my subject indicates, I have a friend with a PC that was infected by that
new-making worm last week. As a result, his PC kept rebooting itself and I
can't get into it to perfrom any maint. (not even Safe Mode). The owner never
did any backups, so all the data is trapped on this drive that will not boot.
On Gateway's advice (the maker of the PC), I'm trying to set up the drive (a
WD 20gb) in another PC. The infected PC was running XP and the testing PC
that I'm trying to install it into as a slave is running ME, but I wouldn't
think that would matter.

I've tried setting the jumper on the working drive to dual master and the
bad drive to dual slave. I've also tried using two separate IDE cables (one
primary and one secondary). In each instance, the drive is detected in the
PC's BIOS correctly, but when booting into ME, the drive just doesn't show.
When I tried using the same cable but setting the jumpers on both drive to
"cable select", then the PC gets caught in the reboot loop again as if trying
to boot off the bad drive.

Am I doing something wrong? Or is this drive just completely fried and I
should give it up for dead?

Thanks in advance.

It would matter if the Windows XP computer is using the NTFS file system;
Windows ME is not able to work with the NTFS file system, only with the
FAT, or FAT32 file systems. Your report that the drive "just doesn't show"
is suggestive of just that problem. You will need to slave that HDD on a
Windows XP computer.

I wouldn't do that on an important computer, or on a networked computer.
With a known infection on the HDD I would rather use an isolated computer
which would not cost me a lot of work in case things should go awry and the
infection get away.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint