Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Del Boy]

My laptop is coming up with this? What does it mean, and I haven't set no passwords? How do I get it off? Laptop is a Dell Inspiron 1525.



Also when I put in the windows factory boot disc it, it loads, but when I get to the where to load the windows to, I select the hard drive and it says: Windows is unable to find a system volume that meets the criteria for installation? I haven't a clue what any of this means?

[Del Boy]

It says this:



Then when you click next, it says this:

[Entwood]

Sounds to me like your motherboard has lost communication with the hard drive. If you enter the BIOS is the hard drive listed ??

My approach would be to take the HD out and try connecting it directly to another machine as a slave, just to see what it says... and maybe do a "deep format" .. if you have the software to do such a thing.

If that fails it looks like a new HD needed at a guess .. but difficult to diagnose at a distance ...

[Del Boy]

Sounds to me like your motherboard has lost communication with the hard drive. If you enter the BIOS is the hard drive listed ??

My approach would be to take the HD out and try connecting it directly to another machine as a slave, just to see what it says... and maybe do a "deep format" .. if you have the software to do such a thing.

If that fails it looks like a new HD needed at a guess .. but difficult to diagnose at a distance ...

I'll check the BIOS thingy, and report back  .

[Del Boy]

I can't see any hard drive bit listed anywhere? If I get a new HDD, can I just put my computer discs in and it'll work on the new one?

[Gaffers]

The disk is being seen by the computer as per the screenshot but it looks like the partition table has been dropped which is a sign it is on the way out or of something more malicious (ie hacker's root kit install gone wrong).  There are some HDD test software packages you can get for free.  Create an image, burn them to a CD or USB and boot it.

Did you get a BSOD before this?  Is there any reason you suspect the system to be compromised with a virus?

[Del Boy]

The disk is being seen by the computer as per the screenshot but it looks like the partition table has been dropped which is a sign it is on the way out or of something more malicious (ie hacker's root kit install gone wrong).  There are some HDD test software packages you can get for free.  Create an image, burn them to a CD or USB and boot it.

Did you get a BSOD before this?  Is there any reason you suspect the system to be compromised with a virus?

It had a virus (I think), basically it I went on google, clicked a website, then it came up your computer is locked pay is $100 and we'll unlock it, to some Ukrainian rubbish. Turned it off then all this came up? Have they ruined it?

[aaronjb]

That's where your password has come from, then They (the virus) has set the HDD password - that $100 would have got you the password (maybe, or more likely just got your accounts drained!)

The only thing I can't remember is if the HDD password (which is also why the installer can't see the drive IIRC) will stay there when you swap drives.. I don't think it will, so swap the drive, install Windows and no more clicking on dodgy links!

[PhilRich]

The disk is being seen by the computer as per the screenshot but it looks like the partition table has been dropped which is a sign it is on the way out or of something more malicious (ie hacker's root kit install gone wrong).  There are some HDD test software packages you can get for free.  Create an image, burn them to a CD or USB and boot it.

Did you get a BSOD before this?  Is there any reason you suspect the system to be compromised with a virus?

It had a virus (I think), basically it I went on google, clicked a website, then it came up your computer is locked pay is $100 and we'll unlock it, to some Ukrainian rubbish. Turned it off then all this came up? Have they ruined it?





You're much better trying for a Thai Bride Del, less chance of being scammed  as the Thai's are after ALL your money not just some of it!

[Gaffers]

There was definitely a virus of some sort.  I hope you didn't do anything important such as online banking with it.  They could have rooted it which is a pig to remove, even if you know what you are doing.  The root virus sits in the boot partition of the disk and logically before any operating system.

Without physically having the disk there is little I can do from here.  They could have infected the BIOS as well which means that even a new HDD will not cure the problem.  Again without physically intervening there is not much I can do.

[Del Boy]

So it could end up costing me a new computer? .

[Entwood]

So it could end up costing me a new computer? .

Possible but highly unlikely ... a "deep format" (properly called a "Low Level" format) would probably sort it .. but BIOS systems rarely have that utility built in anymore.

It is quite easy to take the HDD out, connect it to a PC and "low level format" though, takes a while but the software is readily available

http://www.softpedia.com/progDownload/HDD-Low-Level-Format-Tool-Download-37794.html

is just one example

[Gaffers]

It needs someone who knows what they are oing to look over it.  I old not just take it to any computer shop (they are often staffed by cretins who don't know what they are talking about.

The latest AVG Free can check for Root kits, although I haven't tested how good it is at doing that.  Sophos and Kapersky do anti root kits as well.

If I were you I would do the following:

- (if using the same disk) wipe the disk with partition software and create a new partition.  Format all partitions.
- (if using new disk) just go ahead as normal to next step.
- Install operating system.
- Install AVG Free and do a full scan incluing searching for Root virus.
- Install other anti root kits such as those mentionned above (not all anti root kits have 100% sucess rate, the more you do the better the chances of being sure it is clear)

If at any time you get any error messages relating to the BIOS, especially if they try and direct you to another site, it would suggest a BIOS virus.  They can be removed by flashing the BIOS but it may require specialist software.

If you get any hits from the root kit software then you will need to try to remove it or get somone else to.

If you get any more messages about paying a release fee or other suspicious activity then consider the system unsafe and go though with full checks.

Good luck

[Kevin Wood]

Yes, they've either activated the BIOS' own HDD encryption feature or installed some malware in the boot loader that mimics it, IMHO.

Windows can no longer recognise the MBR so it's not letting you play with that drive.

There might be some value in writing a new MBR onto the drive in a second machine (carefully, to avoid that getting owned too), then you'll be able to re-install windows. You might even be able to salvage some files from the old partition, but I'd give up any hope of making it boot again, as it's probably compromised anyway.

There are normally some tools to repair the MBR and partition table available by booting a Windows CD in recovery mode, but they're not straightforward to use.

[Entwood]

It is also possible it's a far simplier problem ...

Password scanning software exists that might just be able to "tell" you the password that has been installed, and thus allow you to remove it

The version I have is a linux bootable CD which then scans the whole hard drive for passwords, including MBR, and allows their removal (or replacement which can be fun)

Depending how the one you have has been configured this may or may not work, as it requires access to the drive in order to scan .. if that makes sense ...