computer - major crash

DorsetDude

DorsetDude

Spud
Messages
7,018
Name
Keith
Edit My Images
Yes
Hi

bought a Medion PC from Aldi, 6 months or so ago. Runs Windows 7. For the last few days/week, when starting up firefox it's told me there was a problem with one of my tabs, did I want to restore or start a fresh session. I always said restore.
Yesterday while in firefox it would suddenly just close. Id reopen it, then it'd close again.
Then... suddenly I had loads of error dialogs come up, something about windows delayed write had failed, abort retry cancel. Then a dialog came up saying I had hard disk problems and needed to reboot. Did that. Same error dialogs appeared. I managed to launch a diagnostic thing windows offered and that ran for a bit and reported boot sector problems, disk not readable problems, disk not fast enough, memory problems and all sorts.
Whether its relevant or not I dont know but I had the latest cover DVD from a camera mag in the cd tray and was watching some videos on there too.

At this point I should add that I have not had an anti virus program running for a few months... (But I never login as administrator when internetting)

I am doubtful that the disk has gone wrong although its possible I guess.

Any advice on how to go forward form this crash most appreciated. First thing I'll try is try and run in safe mode and see if anything still works.

Thanks
 
Safe mode/boot from a Windows DVD and ask it to check the disk. If you can get it into windows, open up a Windows Explorer, right click the drive, Properties->Tools->Error Checking and get it to fix everything. It will take many hours and may or may not help you.

I'm with Neil - probably disk failure of some sort.

It's at this point some bright spark says... you did have a backup didn't you?
 
DorsetDude said:
At this point I should add that I have not had an anti virus program running for a few months... (But I never login as administrator when internetting)
Click to expand...

Seriously?

It matters not one bit by the way that you were not in an administrators account whilst using the internet, you can still get infected.
 
Overheating of the CPU might be another possibility. things tend to go haywire when it gets too hot. Worth a look inside to see if the fan on the cooler is working.
 
Straight back to Aldi, who will probably say Medion, would be my advice.

It is warrantied for 3 years after all, so no point in voiding that.
 
I recall the error diagnostic that came up said the CPU was running hot (along with the disk and memory errors)

tried to boot into safe mode last night. Just got black dos like screen and a message NTLDR not found.

I want to try a bootable windows CD on it before I ring aldi i think. If I can get my data off onto external hard drive worth a shot.

Cheers
 
DorsetDude said:
Just got black dos like screen and a message NTLDR not found.
Click to expand...

that and the delayed write message would indicate an issue with getting data on/off the hard drive.

be it a hard drive issue, a cable issue or motherboard sata controller issue.

i can recommend the BART-PE boot CD if you want to get your data off onto a USB drive.
 
At this point I should add that I have not had an anti virus program running for a few months... (But I never login as administrator when internetting)
Click to expand...

Once it's fixed, install AV. Not being logged in as an administrator makes little difference.

As others have suggested, take it back to the shop - or rather look up in your documentation the technical support number to phone. Providing no damage was caused by you (ie spilling something onto it), they will have to repair it.
 
Quick update - I found the recovery CD disk that came with the PC. Booted up from it. Tests didnt find anything which was odd. Did a system restore to 3 or 4 weeks back. PC now boots into Win 7. Ran a McAfee stinger cd, found 4 virusses in a java related directory and cleaned those. Installed AVG and ran that. That found 4 files and removed them. All files in Mydocuments appear to have vanished.
I also had all my photos in a C:\Data directory. That is showing as empty. What files/photos I did have backed up were on an external hard drive. That is also showing as completely empty. ???
Fired up elements organiser, fully expecting it to not to be able to find any pictures. It shows my entire collection ok. ??!? Properties for the pictures are showing C:\Data\EOS\x\y\z.cr2 as expected.

Most confused.:thinking:
 
DorsetDude said:
Fired up elements organiser, fully expecting it to not to be able to find any pictures. It shows my entire collection ok. ??!? Properties for the pictures are showing C:\Data\EOS\x\y\z.cr2 as expected.

Most confused.:thinking:
Click to expand...
Lightroom (and I suspect Elements) use a database system where they store the thumbnail and display that as the image you see without referring back to the original image. Do the thumbnails have any question marks/exclamation marks on them that would indicate the program can't find them in the path? Not saying it is this but it would give the symptoms you are seeing.

Without the computer in front of me, it's difficult to diagnose...
 
hi

No I dont recall a question mark. I could double click on an image and it would expand to full screen ok. Think I need to physically try and edit one or something to see what happens.

I find it odd that a virus would only delete data from a couple of directories and leave others alone.
 
you can still see the enlarged preview without the source directory present, it loads it from the preview catalogue.

i dont think the "virus" is relevent here, i still think its a hardware fault.

disconnect the external drive and plug it into another computer and check for the files.

also have you run the diagnostics on the harddrive yet?
 
Hi neil

<frantically scrolls back up thread>

No not run any diagnostics other than what the recovery disk checks did. I think it ran chkdsk as part of it and reported no errors.

Will try plugging the external drive into my other 8 year old pc and see whats on it there.

thanks
 
Try running unhide.exe
http://download.bleepingcomputer.com/grinler/unhide.exe

Malware has a habit of hiding files.

Then a dialog came up saying I had hard disk problems and needed to reboot. Did that. Same error dialogs appeared. I managed to launch a diagnostic thing windows offered and that ran for a bit and reported boot sector problems, disk not readable problems, disk not fast enough, memory problems and all sorts.
Click to expand...

This is behaviour associated with specific types of malware that will also hide your documents. Windows does not report "disk not fast enough" errors etc.

Be careful what you run, DO NOT run any file cleaners. If unhide.exe restores your files, I would request that you post here first before taking further action. I would offer you proper malware removal support, but there is a limited amount I'm willing/able to do in an open forum.

I apologise, I didn't read the thread fully before my original reply - I assumed it was a genuine hard drive failure - however based on the issues you are experiencing it looks more likely to be malware. Be careful with what you do, malware related boot issues are usually symptomatic of rootkits - and I can't advise on the best removal method for a rootkit without seeing a full set of logs.
 
Last edited by a moderator:
It won't have any effect on the hidden files, might target any rootkits installed, they have to be restored in a specific way - but it's a risky fix without knowing what's on the system. Probably also won't target the HDD malware as that is unlikely to cause boot issues.

I wouldn't use it - you don't know what it's going to remove, you have no control over it - if the removal gets borked as it often does with rootkits, then you're screwed.
 
Hi guys

Latest update. The external hard drive which was showing as having no image files (or anything) on it after my virus attack, I removed and plugged into an older PC. All the files then appear on the external drive. For some reason the thumbnails are sort of greyed out but when I double click one they open in windows Picture viewer ok.

I am hopeful therefore that the C:\data directory on the newer PC, although appearing empty still has my latest files still present. Can anyone reccomend anything to try that doesnt involve opening the case on the new computer and thus possibly voiding any warrranty?

I'll probably back up all the files to DVD on the older pc from the external drive for safety before reconnecting it back to the new PC. Once I do reconnect it I will need to somehow unhide the files on that also.

Will any of the utilities mentioned above help?

Thanks all
 
unhide.exe should help. It's specifically designed to deal with the hidden files caused by the type of virus I believe you have.

Once your files are restored, back them up onto a separate computer before continuing. There is no need to run System Sweeper at this stage, or likely at all.
 
Last edited by a moderator:
I wonder if it's a combination of malware and hardware issue? Ive never seen any malware cause a delay error.

The hidden files in the my docs and external drive does remind me of a USB stick malware I sorted for someone many moons ago where it hid the legit files and folders and replaced them with shortcuts to the malware executable.
 
The error message is fake. This type of malware displays fake HDD Diagnostics telling you there are issues with your hard drive - it then sets all file attributes to Hidden to further convince you the hard drive is broken. The aim is to "register" the program to fix the errors.

The NTLDR issue was probably an unintentional side of effect of a corrupt malware install/different malware in the bundle interfering with each other. Malware doesn't tend to be the most stable bits of coding. The boot issue could have been caused by so many different things it would be impossible to guess without analysing every aspect of the computer and the malware that was installed.

Considering the HDD errors, and the Hidden file attributes - I would be highly surprised at this stage if malware was not the cause. Doesn't mean there are not extra problems with the computer - I had a fix the other day where the moment the malware was fully cleaned, the users hard drive failed.
 
someguy201 said:
The error message is fake. This type of malware displays fake HDD Diagnostics telling you there are issues with your hard drive - it then sets all file attributes to Hidden to further convince you the hard drive is broken. The aim is to "register" the program to fix the errors.

The NTLDR issue was probably an unintentional side of effect of a corrupt malware install/different malware in the bundle interfering with each other. Malware doesn't tend to be the most stable bits of coding. The boot issue could have been caused by so many different things it would be impossible to guess without analysing every aspect of the computer and the malware that was installed.

Considering the HDD errors, and the Hidden file attributes - I would be highly surprised at this stage if malware was not the cause. Doesn't mean there are not extra problems with the computer - I had a fix the other day where the moment the malware was fully cleaned, the users hard drive failed.
Click to expand...

Beg pardon I read it as the delay error was pre windows the same as the ntldr
 
Hi guys

I ran unhide and excellently, all my files have now reappeared! As far as I can tell anyway.

Thanks for the help.

Is there anything more I need to do to make sure my external drive or whatever is not still carrying malware or a virus? Once Ive done that Im going to back up everything to DVD as well as the external.

Thanks
 
Yes, there is lots you should do. You may still be infected, Stinger would not have removed it and AVG would not have removed any rootkit onboard. You may be clean, you might not - hard to say without seeing logs.

The best course of action I would suggest would be to post up at one of the following forums:
Bleeping Computer
TechSupportForum

Both these forums offer free professional malware removal support. If you wish to post up, go to the Virus/Trojan section in either and follow the instructions given on what tools and logs to post. Make a note of what your symptoms were, and what tools you've already run (include unhide.exe).

If you do not wish to post on either forum, then your best option would be to install and run Malwarebytes' Anti-Malware.

Personally I wouldn't use AVG, I would suggest choosing one of these excellent AV programs:

Avira AntiVir Personal
Microsoft Security Essentials
Avast! Free Antivirus

These steps may or may not fully remove the infection. Posting up at one of the forums suggested is in my opinion a preferable option, it's generally best to see logs before running tools as some malware is risky to remove - the NTLDR issue is what I'm most wary of.

Do not run any infection specific tools. Do not run any anti-rootkit tools unless instructed by an expert.

Due to the nature of this open forum setting, I'm unable to offer you proper malware support outside of the steps instructed. I can only personally offer you support if you post up a thread at TSF - if you do, let me know once you've posted and I'll take a look as soon as I can.
 
Last edited by a moderator:
Hi Will.

Ok Ive registered with TSF, same username

Will post up the logs and bits required next chance I get and let you know. It may be a day or 2

Thanks
 
Okay, let me know once you've posted a thread and I'll take a look. I suspect there won't be a huge amount to do, but due to the boot issues I feel it would be best to check for rootkits.

Make a backup of your important files/photos now just in case - it's always better to have one than not.
 
I spoke to a friend who's pretty computer literate and he says it may not be a good idea to back up files until I know Im not copying trojans/virus/whatever over at the same time.

I'll try and get something up on TSF soon.
 
It's best to have a destructable backup - e.g. copying everything onto DVDs or similar which you can then destroy after the computer is cleaned. It's correct that malware might also be copied, but from our perspective if something goes wrong it's better to be able to restore to an infected machine with all it's files, than lose everything. The backups should be deleted afterwards, and new backups made of the clean machine.
 
Sounds reasonable. Thanks Will

I'll have to download synctoy and have a go I think. Hopefully that'll backup to DVD
 
Quick footnote to this thread - I visited the TSF site and Will has sorted me out on there and Im now malware free. Didn't lose any data in the end. Time to sort out a backup routine...

Thanks Will! :thumbs:
 
You must log in or register to reply here.
Back
Top