943,922 Members | Top Members by Rank

Ad:
Sep 27th, 2006
0

How does this happen??? NTFS mysteriously becomes RAW

Expand Post »
Hi You all.
So, strange but true, My Beloved's system (which I put together less than a year ago) was running an Ewido scan, minding it's own biz, when suddenly, the BSOD appeared. No problem I thought, at most we'll do a repair on XP and she'll be up and running again. No no, instead, we find that the 250 Maxtor has suddenly lost it's NTFS format, and is read as RAW (sounds painful). Being brilliant as well as beautiful, (big score on points there) she borrows a Linux disk and is able to retrieve most of her files in that manner. Now, HOW DID THIS HAPPEN? The only abnormality prior to the incident was AVG showed positive for 14 viruses which according to Housecall weren't there. On further investigation there aren't any virus' known by the names AVG gave us. Apparently AVG was testing positive for these mystery viruses for a week prior but never sounded the warning bells. The viruses were in files such as Nero.exe, or surething.exe, etc. Which are all legitimate files. So, before this qualifies for a novel, have we slept through a major attack warning or missed some new outbreak report? I'm out of adjectives and anything even remotely humorous to add. I would appreciate any candlepower directed on this situation. If we are to ensure it not occurring again, gotta know what "it" is.
Thanks you all.
Harvester3
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
harvester3 is offline Offline
12 posts
since Sep 2006
Oct 5th, 2006
0

Re: How does this happen??? NTFS mysteriously becomes RAW

Click to Expand / Collapse  Quote originally posted by harvester3 ...
Hi You all.
So, strange but true, My Beloved's system (which I put together less than a year ago) was running an Ewido scan, minding it's own biz, when suddenly, the BSOD appeared. No problem I thought, at most we'll do a repair on XP and she'll be up and running again. No no, instead, we find that the 250 Maxtor has suddenly lost it's NTFS format, and is read as RAW (sounds painful). Being brilliant as well as beautiful, (big score on points there) she borrows a Linux disk and is able to retrieve most of her files in that manner. Now, HOW DID THIS HAPPEN? The only abnormality prior to the incident was AVG showed positive for 14 viruses which according to Housecall weren't there. On further investigation there aren't any virus' known by the names AVG gave us. Apparently AVG was testing positive for these mystery viruses for a week prior but never sounded the warning bells. The viruses were in files such as Nero.exe, or surething.exe, etc. Which are all legitimate files. So, before this qualifies for a novel, have we slept through a major attack warning or missed some new outbreak report? I'm out of adjectives and anything even remotely humorous to add. I would appreciate any candlepower directed on this situation. If we are to ensure it not occurring again, gotta know what "it" is.
Thanks you all.
Harvester3
Hey folks, well it seems this post interested several of you all, but not enough to weigh in on the subject. I'll have to review the posting protocols, but probably should let this thread wind down as it's not going anywhere anyway. If there's something I'm doing wrong, or not doing right, please tell me. I want to be a contributor and a positive effect in this community, and welcome any advice to that end.
Thanks again,
BTW, still have no idea what happened to the hdd [:~)
harvester3
Reputation Points: 10
Solved Threads: 0
Newbie Poster
harvester3 is offline Offline
12 posts
since Sep 2006
Oct 5th, 2006
0

Re: How does this happen??? NTFS mysteriously becomes RAW

Our apologies- we're not ingoring you, we're just stretched a little thin helper-wise right now.

What exactly happened in your case I can't say, but having been through it a few times before, here's the general course of events as best I could determine once I'd resurrected the drives:

1. Something (could be anything) corrupts a piece of software, usually a driver. In my last two incidents the culprits appeared to be a) a power outage, and b) a driver update conflict. SOmetimes the STOP code in a Blue Screen error can help you more accurately determine the exact source of the corruption.

2. Driver goes BANG!, OS gets showered in shrapnel, and either the driver, the OS, or both do some serious fandango on disk and memory locations that they definitely shouldn't be writing to.

3. One of those areas turns out to be the Master Boot Record, the Master File Table, the Partition table, or some equally critical and low-level section of the drive.

Linux has some tools which will try to "guess" the partition type (FAT, NTFS, ext2, etc.) of a damaged disk and will therefore often be able to mount and access the disk (assuming the entire partition table isn't hosed) when Windows can't. Linux also obviously doesn't care about Windows boot-related files, so doing something like trashing the NTLDR file won't stop Linux from being able to recover the rest of the files on the drive.

As for the AVG "false positives", I've never heard of AVG exhibiting that behaviour before, and I use AVG on a lot of machines.
DMR
Team Colleague
Reputation Points: 221
Solved Threads: 369
Wombat At Large
DMR is offline Offline
6,439 posts
since Dec 2003
Oct 5th, 2006
0

Re: How does this happen??? NTFS mysteriously becomes RAW

Much thanks for the reply. We may never know exactly what happened, but I'm sure the scenario you proposed is a good hypothesis. I'm curious about the false AVG reports as well. AVG has always been rock solid yet unobtrusive... Good program in any case.
Thanks again for the time and helping hand. Hope I can recip some day.
Harvester3
Reputation Points: 10
Solved Threads: 0
Newbie Poster
harvester3 is offline Offline
12 posts
since Sep 2006

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: weird double click
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Help..pop up and audio weirdness





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC