HELP!

Discussion in 'malware problems & news' started by Rico, Nov 20, 2016.

  1. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Someone brought me HP AMD A10 computer claiming it was frustratingly slow.

    I ran HMP which found 7 malwares, & 710 other threats, HMP deleted the malware & said it needed to reboot, to complete. Bios screen, then the screen goes black. Now I see, the hdd light blinking. More than one hour of black screen & sporadic hdd activity, still won't go to OS win8.1.

    At first just thought I was being impatient, due to hdd light activity, & needed to wait longer. 2hrs. now

    HP BIOS screen has zero on it other than HP logo, nothing about F2 or F12 etc. Tried all those keys, plus Esc. can't see BIOS etc
     
    Last edited: Nov 20, 2016
  2. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    I though I was out of the woods when, onto the black field came the bluish circle. LONG TIME!

    Then after longer time, got to enter users password, that screen said at the bottom, said important windows updates go to settings to install

    Now black screen, but mouse pointer is working, still flickering hdd
    ______

    It reminds me of the slowness of a machine IDE/ATAPI controller not using DMA? What did thay call the non DMA, something like 'pio' or something with a 'p', that kind of slow!

    All the infections & whatever it still has was downright speedy, as compared to saying ok to HMP's reboot.

    Still black screen, moveable mouse pointer
     
  3. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,812
    Location:
    .
    You want to know something?
    For starters it could be a defective HDD. I would recommend to boot a Hirens boot CD and run a diagnostic with the HDD's Brand utility looking for bad sectors. Malware can ruin or kind of ruin a hard drive.
     
  4. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Well, Black screen with moveable mouse, then hdd off for minutes not even a flicker, still black & moveable mouse

    Found the BIOS, & found 'legacy boot' disabled left the UEFI alone, rebooted & still, black screen in approx 1 hour, I expect the bluish circle to return.

    25 minutes NO bluish circle yet!

    In win 8.1 can hdd revert back to pio from DMA, can this still be an issue?
     
  5. Palancar

    Palancar Registered Member

    Joined:
    Oct 26, 2011
    Posts:
    2,402
    Did you consider using Mister X's approach, or something close to it? Before I got to his post in this thread I was thinking you should use a LiveCD (14.04.5 example) and verify your machine is working well running in RAM. Bios, motherboard, etc... can all be verified to work, which if so, can narrow your issues down to the hard drive and then you can continue.

    Win 8.1 has been a problem anyway. Its no secret that I would scrub the drive and run Linux. On most HP products it works very well. However; if Windows is going to be the choice at least go to Win 10. For now, you can run a product key finder and make sure you have the Windows 8.1 KEY. Wipe the disk and reload the OS while adding the KEY as requested. Win 8.1 disks are everywhere.

    If using Linux even in a LiveCd version seems too tough you can try something else. Download a free software like Partition Wizard and then mount it on a DVR in RAM and run functions that examine the disk surface of your hard drive. No harm because you are changing nothing on the platter surface.

    Is this computer now YOURS giving you freedom of choice, or are you a "repairman" for a friend? If its the latter I feel your pain. I am known in my family as the computer geek and all the crap hits my desk. LOL!
     
  6. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    I don't believe, or I was not successful at making a Hirens boot disc from Win10. On that line of thinking 'Spinrite, may help ck the drive

    Can hdd revert to PIO from DMA in 8.1? If so would system restore, revert back to dma. Or I found a script see http://winhlp.com/node/10#qs #1

    I was thinking: enable "legacy boot" safe mode, run the script from flash drive. Long ago you could tell from dev. mgr > ide/atapi what mode, I don't see that in Win10 & not sure if it's relevant in 8.1
     
  7. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    I ran HP's diagnostics which gave:

    Short DST Check: FAILED

    FAILURE ID: 9GDX8C-0008A5-WPXEXG-60XH03

    I'm not sure what DST fail is, but HP forums (HP guy) talks need for new drive.
    ____

    Also on boot: escape > F9 boot options > choosing UEFI > gave a screen scrolled to "LEGACY" press enter. NOTHING HAPPENED & no legacy boot.
    ____

    DST Short Test Failed
    If a DST Short Test fails on your computer, and you receive an error message or log entry that reflects the failure, this is likely caused by a failing hard drive. However, certain software will also cause the DST Short Test to fail. McAfee and other anti-virus programs may cause the DST Short Test Failure error to generate. Other corrupted applications may also throw the error. Re-install the anti-virus program, or return your computer to an earlier point in time with System Restore.

    HDD WD10EZEX-60ZF5AO
    ___

    F10 to BIOS > secure boot config > disabled secure boot > enable Legacy > save changes > enter code to accept (7740 + enter). could not find 'boot options' I was going to try Spinrite from CD boots FreeDOS.

    Tried safe mode same problem with entering windows, was going to try rstrui.exe.
    Tried windows startup repair fail
    Tried escape on boot > F9 start up options > can high-lite, all but pressing enter does not complete the process
    Tried F10 to BIOS > Security > secure boot config > disable secure boot > enable Legacy F12 boot to Spinrite, I see a DOS screen about FreeDOS, but stops at Initdisc_ then solid hdd
     
  8. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,812
    Location:
    .
    The acronym “DST” stands for Drive Self-Test.

    Most likely problem is bad sectors on the surface.
    IMO you really should change that HDD for a SSD. This will give new life and a much better overall performance. You need to reinstall everything from scratch, from Windows to the last app.
     
  9. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Then Spinrite or even chkdsk /r, should repair. The machine belongs to someone else. I'll try again to boot from FreeDOS which is the OS for Spinrites disc. From legacy F12 & cross my fingers. I'll post back in awhile

    Thanks
     
  10. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Followed this http://support.hp.com/us-en/document/c03659945/ tried the bootable Spinrite. Spinrite does not start. Quite some time at initdisc then Invalid Opcode at

    From escape > F9 boot options, does not list USB, was going to try bootable Spinrite from USB

    Tested a WINPE on cd, was able to boot from CD

    Anything with winpe, that can fix hdd?
     
    Last edited: Nov 20, 2016
  11. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    24,107
    Location:
    UK
  12. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Bart's Preinstalled Environment (BartPE) bootable live windows CD/DVD


    Bart's PE Builder is no longer available. We have to move on! Thanks everyone for all your support throughout the years!!!




    Wouldn't I have to make the 'bootable BartPE, then somehow add 'chkdsk-GUI' to it?

    ________

    I've tried the existing OS's "Start Up Repair" FAIL.

    Would booting from (MY 8.1 disc) on (Friends machine), then entering repair > troubleshoot allow chkdsk /r or repair the disc, more than the original 'start up repair from existing OS

    NEVERMIND Boot from 8.1 install disc > repair > FAIL

    _______

    I have a 'UBCD' for windows, seems to be loading, will this run chkdsk /r. If so a little help pointing the utility at c: THANKS!

    Nevermind UBCD trys to load, ending in the old B.S.O.D
     
    Last edited: Nov 21, 2016
  13. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,812
    Location:
    .
    Yes. But it's my way I've used for the last 4 years. Don't know if someone else do it my way but I assume a big YES, of course.
    HD Sentinel Pro PORTABLE (PAID) - Reinitialize HDD surface function (warning: all data will be irremediably lost and erased forever). This function should reallocate bad sectors and refresh HDD firmware info for the drive to work again.

    You can run a WinPE Live CD and run HD Sentinel Pro (Portable) from a USB stick.

    Honestly I don't think you have an issue with the filesytem so a chkdsk run will not fix your problems, again it's a bad sectors thing, I said this from many cases attended in my computer technician life. I could be wrong though.

    Even a surface re-initialization should fix bad sectors found, prolly bad sectors could appear again days weeks or months later. That's why I recommended a HDD/SSD swap.

    Moreover, these new HDD I been servicing on recent laptop models are VERY slow. Windows most of the time crawls, all processes are very SLOW.
     
    Last edited: Nov 21, 2016
  14. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Hi,

    Okay! I believe Spinrite to be the ultimate hdd tool. & hopefully repair the disc, problem is booting with spinrite on it, FreeDOS does not seem compatible, with the native Win8.1.

    I thought that chkdsk /r would mark, sectors as bad, thus avoiding the problem. I say this as it's my belief & wanting to understand.

    Hdd sectors issues may/may not have been present, when I ran HitManPro, I've never seen HMP do anything like this before (used it hundreds of times), reboot to finish removal, causing problems. Loss of data & or new hdd, is not what the client/friend want's to hear. I always get 'Rico', can you take a look at my machine, me, do you have a backup, NO, how about rescue disc NO. So it's 4th & long, one last play Hail Mary, & see If spinrite, can guide me to boot & repair

    Thanks
    Rico
     
  15. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    There are no disk repairs tools that work reliably long-term. You might get lucky, but that's that.
    Best is to have spares, clones, and up-to-date images, so you can quickly recover.
    Mrk
     
  16. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Hi Mrk!

    For my computers, I have up-to-date images, taught classes on how to make a proper backup, where I would make a backup, make a rescue disk, & restore from the just made image. These classes offered many times, just were not as glamorous as, photo classes etc, & thus had low enrollment compared, to others.

    I took on this project as the lady is a friend, who like many, showed ZERO interest in spares,clones, & Images. Now I'm the bearer of bad news, a not pleasant task. So the long shot Spinrite, which would be non-destructive, & if successful, I could, continue removing junk & malware. The husband, I cleaned up his rat's nest of infections. I installed ccleaner, to remove temp files it found 56 GB, or garbage.
    _____________

    I tried this on the lady's machine, removed the hdd, hooked it up to run as a USB drive, I could feel/hear the disc spinning, & the win10 machine I plugged the USB cord into chimed noise, like recognizing something, but windows assigned no drive letter & remove item icon (sys tray) showed no drive letter, exit ATA/ATAPI bridge, tried two sets of cables, same result, also checked a working backup hdd, in the same USB port, windows 10 assigned a drive letter.

    What is ATA/ATAPI Bridge? Is this further proof the drive is toast?

    Note my spinrite boot disc, failed & GRC support instructed me to make a boot disc from an iso of WIN98, as opposed to the FreeDOS, wow WIN98
     
  17. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    You are trying to analyze the behavior of a dying disk.
    It could mean a lot of things. Just let it be. Let it go.
    Fly birdie fly!
    Mrk
     
  18. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    You can always try "the freeze trick." Throw the drive in the freezer for an hour or so. Take it out and let it come up to room temp. This sometimes will allow you to boot into the OS long enough to do a quite download of all your important files.
     
  19. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    24,107
    Location:
    UK
    Don't forget to wrap the drive up first so no moisture enters. And yes, this does sometimes work, I've done it myself.

    However I don't allow it to get to room temp after taking it out, but work with speed to access any info before it heats up, cuts off and then I pop it back in the freezer again.
     
  20. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    what I wonder about is why the drive was working fine before the cleaning and reboot? we have not seen any mention of what the infections were. if the hard drive is bad, you shouldn't be able to see any after booting with a bootable cd-dvd. I have kubuntu on my sisters computer. when booting I used a usb stick since that could be set to first boot device on her computer. from there you get two choices. boot to usb or dvd if that is what you used or install to hard drive. hey if she can use a Linux distro anyone can. if you can not set the bios to boot from a usb , then just use a dvd.

    her is a link to the usb installer I use. https://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/

    and also grab a copy of kubuntu. http://www.kubuntu.org/getkubuntu/
     
    Last edited: Nov 23, 2016
  21. Rico

    Rico Registered Member

    Joined:
    Aug 19, 2004
    Posts:
    2,287
    Location:
    Canada
    Hi Guys! Many Thanks,

    HMP found I believe it was 8 threats, search protect, can't remember the other 7, but found 700 lesser threats or traces. I'm not sure the drive was working fine, hdd light was lite up almost all the time, the sluggishness could have been from the infections or the drive itself. I received no warnings, so Ransomware, was not on my mind. Zero visible signs or warnings, start HMP, it took a long time, to complete, several hours, then prompted for the reboot, where all the troubles started.

    The owner came by, & claimed he had a hdd with win 7 plugged it in, via machines sata cable, & tried to boot, NO OS. So I do not believe, that test drive actually had an OS on it. At that point I hooked, up the removed drive, as USB connected, (sata connector to usb, deal) win 10, did not assign a drive letter, but recognized a ata/atapi bridge. Felt fairly confident the drive was bad. And thought this thread was done, with Mrks comment

    "Just let it be. Let it go.
    Fly birdie fly!"


    I gave the cord to make the hdd usb to friend, to try on another OS. And I'm done, I have NO HDD for him, nor an OS. He now has a new hdd & OS, it working. He reported the the old hdd, was accessed, (by whoever put in the new hdd) & was told one user account was empty.

    On that machine, enable legacy boot in the BIOS, then escape key > then F9 for boot options, FreeDOS which had Spinrite on it, failed to boot, giving a long Opcode. Tested on the sick machine a WinPE boot disc, used for password recovery, it worked fine. Waited for reply from GRC support, who had me dl Win98 iso & place Spinrite on it. I mentioned this several times to the owner, but he took his machine elsewhere.

    I took a picture of the screen showing short DST Failed & printed out HP's reply to SHort DST fail, & gave, it to him.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.