# Virus killed my drive (Moved from Hard Drive Support)



## dcyuri7 (Jul 19, 2005)

First and foremost, READ FINAL STATEMENT in post before downloading the attachment. Thanks 

Just to start off right, I'm not a nooby with computers, can program in a few language and yea... im just not nooby, aside from actions i take in pure laziness. 

Basically, I downloaded a program that I knew wasn't safe, but might not be totally bad, and after running it, it extracted 4 files(executables) all roughly 8kb in size, and a "run.bat"(dont worry i didnt actually run the run.bat. lmao) and it auto-executed the run.bat when it was done extracting. This opened all 4 executables, and my computer instantly shutoff.

Now being who I am, the second I saw that Dos prompt popup from that batch file, I jumped out of my chair and unplugged my external backup hard drive, so I can easily restore to where i was... or can i? 

Basically the computer is no longer able to read my hard drive.(On a side note, i rebooted to see the damages, and apparently the virus lays dormant for the next two reboots, and then kills your hdd)
I turn on comp, and it says (*note: i ran a chkdsk with windows xp disc-which failed at 25% completion - and the message is now different from the original... forgot what it said) "NTLDR missing". However, all my Dos boot disk utilities show that the drive is working fine, it just wont boot. So the virus attacked the MBR im assuming, which is a quick fix if I were to restore a boot image or had proper dos software. But I had some files on the comp that I want before i resort to this, and roughly 40 dollars in music(its important to me anyway lol)

My question is, does anyone know what kind of virus this is, and in what ways it works, and in what ways can it be fixed/prevented, aside from not opening conspicuous files?

"Final Statement": I attached the exact file that did this to my comp. DO NOT!! DO NOT OPEN IT. Download and scan sure, BUT DO NOT RUN THE EXECUTABLE. Don't say I didn't warn you! It's attached for research purposes only(unless ur just naughty like that and want to use it on a co-workers computer or something. hah. trust me, this virus works very well). I renamed it's file extension as a prevention method to keep it from being able to accidently open, but i totally understand if you dont want to downoad it atall. I'll settle for anything, even google search terms so i can look it up myself.

I'm on a public computer right now at my university, so I cant exactly fix this problem without proper help first. Any help is greatly appreciated on this matter.

*Edit, max file size on forum is 2mbs, virus is 3mb. so I put it on my rapidshare, it can be attained from this link:
(its inside the zip file, and extension is a non-associated one so it cant be accidently opened)


----------



## JohnthePilot (Mar 30, 2006)

*Re: Virus killed my drive*

I think this is a problem for our analysts to look at in the first instance so I'll move your thread there. It can always be moved back if and when they give it the all-clear.


----------



## dcyuri7 (Jul 19, 2005)

Ok I appreciate it 

Yea i had a feeling it mght be "not so good" to post a file such as the one ive posted. Thought it might be pertinent to my situation, but am fully willing to delete the link if need be.

Oh, and I tried a few things out that might shed light on the situation.
1.) Chkdsk stops @ 25% everytime(from XP Cd)
2.) Dos Bootdisk either:
- - - a.) cannot physically see the drive('C:')
- - - b.) or can see it, and cannot use it(even the RAM drive support bootdisks i have are unable to write to it)
3.) ERD Commander trial can access and write information on C:, however it does not recognize windows installation and C: appears to be 0bytes in size.
4.) PowerMax Boot disk successfully completes ALL tests, proving the drive does work in some respect atleast.(Sector tested, Burn-In Tested, Installation Check completed succesfully as well)
5.) also tried Avira NTFS for Dos, it is able to view the size of the disk successfully, replies that is not a valid drive, and does not allow me to use chkdsk on the floppy/ram-drive for the C: drive, since no drive letter was inherently assigned.

Ironically my buddies partition magic boot rescue doesnt work, one of the floppies is corrupt(and i dont have access to another floppy, aside from ERD:C and since C is 0bytes in size, I cannot install Partition magic to make a boot diskette. :upset... and im pretty sure that prog would fix this, as it can assign Active partitions, and diagnose/fix MBR problems...

Yet again, any help is appreciated.

*edit
nvm lol, you got rid of link for me already, hadn't noticed. :tongue:


----------



## dcyuri7 (Jul 19, 2005)

It would seem that I'm too impacient. I went ahead and used my external HDD's backup to restore the MBR, and apparently the virus affected the location of Windows files as well, so I had to restore the entire HDD partition(the windows O/S + drivers and updates).

So yea, the virus is absolutely EVIL. Not a good prank to pull on friends, its un-recoverable(im sure theres a way, i just dont have the software... or patience it would seem). Thanks anyway, I lost $40 in music and some projects for my ANSI-C programming class in college, but I'll manage. I can't wait even a day, it would seem, to have a working computer.

Later guys,
Yuri


*note:
I solved my problem by:
1.) Drinking alot of alcohol(im buzzin, dont know how im typing so well... ...... yea)
2.) Did a "quick" format to remove the bad Master boot Record.
3.) Installed windows, then restored a backup from a external HDD(restoring to a virus infected HDD does not work whatsoever)


----------



## dcyuri7 (Jul 19, 2005)

blast! welp im back again i guess.
After installing windows, Stellar Phoenix(data recovery prog) scanned the drive and was unsuccessful in finding the data that was originally there. This strikes me as odd, as I formatted using 'Quick' options specifically and solely for the reason that it wouldnt delete the files i was trying to retrieve, would only delete the pointers to them(MBR). But... ***? :4-dontkno

my hard drive then showed up as if its 36gigs in size(its a 60gig i purchased about 4 months ago), and this morning it no longer spins. So apparently the virus messes up MBR, but the HDD was going out regardless. What an awkward coincedance.... it happens to die just as i install a virus? hmmm, welp guess ill take it to geek squad and see if they can tinker and salvage anything.


----------



## JohnthePilot (Mar 30, 2006)

That's Murphy's Law for you. Good luck with recovering your data.


----------



## ladyme123 (Sep 1, 2009)

where are the attachments?


----------



## koala (Mar 27, 2005)

They were deleted, probably because they contained an infected file not suitable for posting on a public forum. This thread is from 2007, so it's unlikely they are still available.

If you want to see the attachments because you have a similar problem, please start a new thread describing your symptoms.


----------

