HDD eating virus? / Computer Science / Forums

Forums

4hv.org :: Forums :: Computer Science

« Previous topic | Next topic »

HDD eating virus?

Move Thread

LAN_403

Part Scavenger

Sun Mar 09 2008, 02:06AM

Registered Member #79 Joined: Thu Feb 09 2006, 11:35AM
Location: Arkansas
Posts: 673

Ok, guys, haven't been around in a while, but I need some help!

My parent's computer's newest failure was the HDD, which was really hard to find because it was *working* but it was dragging down the PSU voltage just low enough to make the system unstable. Eventually it got worse and died and so
was able to figure it out.

I was able to get the HDD to work in a USB sled to copy the important files to my laptop. The HDD kept overloading the PSU in the sled and resetting it, but I finally got all the files off. As soon as I finished, my LAPTOP starts acting sick...long story short, I can barely get into Windows before I lock up and my hard drive starts *clicking* You know, when the HDD starts banging it's head against the case? I've got my parent's computer back from the dead, but my laptop is in pretty bad shape. Fedora does not even try to boot, but I can access the system in "Rescue Mode." XP required severe resuscitation. Furthermore, right off the BIOS, no matter what I'm booting from I get the error:

SMART Failure Predicted on Hard Disk 2: WDC (serial number)

WARNING: Immediately back up your data and replace your hard disk drive. A failure may be imminent

Sources tell me this message is "notoriously unreliable." Other sources say it can result from damaged BIOS. But, the HDD's clicking and various test programs are telling me bad things. I have no other computer to test the HDD in.

My laptop was a Gateway MT68xx series, Vista downgrade to XP, dual 2.0Ghz Intel Centrino processor, 1.5 gig RAM, running Fedora and XP dual boot, I have never had hardware trouble EVER, and I have had it about 9 months. Fedora is on sda1 and XP is on sda3 (sda2 is SWAP IIRC).

So the question is:
1. Can anyone tell me what the heck is going on?
2. What is this 'Hard disk 2'? I only have one HDD, and nothing plugged in USB or otherwise. I was wondering if it could mean a partition, but at this level of code it's not supposed to.
3. Could it be really caused by a virus? or is it a big coincidence?
4. Should I try something else before I buy a new HDD? It looks like I'm only going to get one shot at getting my data off my laptop's HDD, any suggestions? I was going to get it really cold and try to be quick, but I don't know past that.

Thanks so much,
-GB

Dr. Dark Current

Sun Mar 09 2008, 07:15AM

Registered Member #152 Joined: Sun Feb 12 2006, 03:36PM
Location: Czech Rep.
Posts: 3384

Two days ago I got an e-mail message from my father from work. It said to not to open e-mails with "INVITATION" in the subject - they contain a virus that will "burn" your hard-disc. It is advised to immediately turn off your computer if you get it. The virus is classified by Microsoft as the most destructive virus ever, and so far they haven't found a fix for it.

101111

Sun Mar 09 2008, 10:24AM

Registered Member #575 Joined: Sun Mar 11 2007, 04:00AM
Location: Norway
Posts: 263

Ok if this is a virus, how dose it "burn" the HDD?

A few theories:
1: It might start to copy many files and deleting, making the disc to spin up and read fast. But with all my experience HDDs are made for this kind of job.

2: Change the HDDs firmware to make it work as it is not supposed too, so it will draw allot of power and eventually fail.

Maybe we all should change to SSD?

Dave Marshall

Sun Mar 09 2008, 02:11PM

Registered Member #16 Joined: Thu Feb 02 2006, 02:22PM
Location: New Wilmington, PA
Posts: 554

These emails are widely known as hoaxes. Snopes is loaded with info on the bogus ones. A virus which simply destroys your hard drive would be pretty pointless, as it wouldn't have any rewards for the author. Don't believe everything that lands in your inbox (but please friend, send me $400 so I can process this $5 million your third cousin's great uncle twice removed left to you when he died in Antarctica).

The SMART capability on modern hard drives is designed to detect mechanical or electrical instability. It also monitors wear and tear on the hard drive. Stuff such as the number of starts and stops, spin-up time, how many hours of operation it has accumulated, etc. The problem is that SMART is notoriously vague, not necessarily inaccurate. It doesn't necessarily mean that drive failure is imminent, it could just be that a predetermined amount of wear and tear has been sustained, generating the error. A scan with some more detailed and capable disk analysis tools would be more telling to the actual state of your HDD. I'd still recommend an expeditious backup.

Dave

Part Scavenger

Mon Mar 10 2008, 03:05AM

Registered Member #79 Joined: Thu Feb 09 2006, 11:35AM
Location: Arkansas
Posts: 673

I thought it was really weird too, and I knew that although it was possible, it was unrewarding and difficult to make an HDD virus. It was just such a big coincidence between two unexpected failures, I was wondering if anybody'd had the same trouble.

The prognosis is better. I put my laptop in the fridge for a couple hours while I thought about the most important stuff on there, then I yanked it out and started working quickly. Windows still had the lockup problems, so I booted a Ubuntu disk to get the files off Windows. I could see my Fedora files in Ubuntu, but didn't have rights to do anything with it.

So, I went into Fedora rescue mode and reconfigured the GRUB loader and was able to log into Fedora again minus the Avahi and Haldaemon. Not sure what that means, but nothing was mounted, USB didn't work and neither did CD or network. But I'm just amazed at the stability of the system, after a bit of reading and hacking I was able to get those services back, mount my USB sled, and copied ALL MY FILES OFF!!!!

Typical. Linux rocks and Windows pees all over itself and doesn't have drivers.

So, now that I've got the data off, I'm going to re-format and run HDD tools to see what the damage is. I doubt the SMART error will go away, but we'll see.

Thank you very much for your help guys.
-GB

Backyard Skunkworks

Mon Mar 10 2008, 06:18AM

Registered Member #1262 Joined: Fri Jan 25 2008, 05:22AM
Location: Maryland, USA
Posts: 451

I just went through natural failure on a five year old hard drive a few months ago, with very similar symptoms. While failure rates for a 9 month old HDD should be pretty low I still wouldnt rule out that you have a bum drive from manufacturing defects etc. 9 months is still kind of close to "infant mortality" on the "bathtub curve" of product life cycle.

I've never heard of a hard drive eating virus but I did hear of one pretty unsucessful virus a few years ago that maxed out your fan speed and managed to burn out a few fan motors. Given how easy it is to write a more "fun" virus like a boot looper or some other type of system-crippling malware I'd take any reports of HDD killing Virii with a grain of Sodium Chloride.

Conundrum

Fri Mar 14 2008, 09:26PM

Registered Member #96 Joined: Thu Feb 09 2006, 05:37PM
Location: CI, Earth
Posts: 4061

could be the psu on the laptop is badly designed. i had an external drive start clicking even though brand new due to low usb voltage.

if the 5v rail dropped too low then it might have caused the head to crash< causing SMART errors.

however:-
2: Change the HDDs firmware to make it work as it is not supposed too, so it will draw allot of power and eventually fail.

I did recall reading about a virus that infected some routers by updating part of the firmware so it became a "poisoned" DNS.. Nasty.

Also to update a HDD firmware is nearly impossible as even the manufacturers often write it during manufacture to an area of the platters which is not accessible in "normal" use. this often results in the COD as the drive seeks to this boot block and fails due to track or head damage.

-A

Carbon_Rod

Sun Mar 16 2008, 03:44AM

Registered Member #65 Joined: Thu Feb 09 2006, 06:43AM
Location:
Posts: 1155

1.
Routers on large scale autonomous systems run on a trusted architecture that are not susceptible to ass-hat virus. However, personnel can physically damage the $200000 blades during maintenance cycles, and have it fail over to one of several other modules. =P

Solid state drives wear out faster if used for normal PC functions. In routers it is normally Read-Only with a copy of the OS standing by.

2.
If your system came pre-installed with LoJack it will affect every system the hard drive comes into contact with. HP/Sony/Acer/Toshiba are all compatible with this technology. Swapping such hard drives may activate the security module in the hardware (not in the hard drive.)

3.
Linux does not often use BIOS routines and should work fine (assuming Grub was not damaged by LoJack changing the MBR once a day to inject its bootup payload.) When flagged as stolen it will happen every 15 minutes. However, if you recovered the drive from Linux it should not run the activation routine available in almost all laptops.

4.
S.M.A.R.T. monitors the frequency of sector replacement technologies (drive appears to remain undamaged.) It can be disabled in the BIOS, but you should run BootAndNuke to wipe the drive clean and get a warranty replacement unit.

Cheers,

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob