Member Avatar for knoxlawyers

This is an older computer: a P4 1.7 with 512 MB RAM. two physical HDs [C and D]. Running XP Pro SP2. Comcast's online McAfee AV allegedly running.

OK, here's what happened:

I downloaded an mp3 via uTorrent. Immediately got a system32.dll error and the computer shut down on me. The computer would not boot in safe mode, safe mode with networking or safe with command prompt. Booting to normal Windows XP Pro, I would get an immedate same error and the computer would shut down and reboot. I never had a chance to get to a stable Windows environment to run any anti-malware application -- it just errors and reboots.

After several attempts just to get into Windows to run anti-malware software, the computer freezes at the initial startup screen [E-Machines -- it's an old computer]. I hear PC speaker beeps every 20 seconds or so. Rebooting and going to CMOS setup, I see that Bios sees NO primary master HD, and the secondary master is just gobbledygook characters. I tried an auto-detect on the primary master and no HD was seen. I turned it off and am crying for help.

Anybody got any suggestions? I could just reformat and start over, but there is a lot of data on these HDs that I would like to recover.

  • 3 Contributors
  • 9 Replies
  • 162 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Immediate priority is preserving the data. Do not keep trying repeated normal boots of the suspect OS — each attempt can make a failing drive worse or change on-disk metadata. Treat the disks as evidence to be imaged first, then repaired or scanned from the image.

Practical, low-risk workflow:

  1. Power down and remove the suspect drive(s). If possible, attach them to a known-good machine as secondary drives using a SATA/USB adapter or a write-blocker.
  2. Create a full, read-only image of the drive to a larger target disk (or to a file) before attempting repairs. Tools built for resilient cloning under read errors include GNU ddrescue (see GNU ddrescue) and Clonezilla (Clonezilla). Work from the image for everything that follows.
  3. Check drive health (SMART) with a clean utility such as smartmontools (smartmontools). If the drive exhibits mechanical noise or many read errors, stop and consult professional recovery services — further DIY can make things worse.
  4. Run partition repair and file-recovery tools against the image, not the original disk. TestDisk and PhotoRec are well-regarded for partition fixes and file carving (TestDisk/PhotoRec). If you have no spare system, boot a clean environment from a live USB (for example, an official Ubuntu Live image) to attach and image drives (Ubuntu Desktop).

On malware versus hardware: firmware-level infections exist but are uncommon. Do not assume firmware compromise unless there is independent evidence; focus first on safe imaging and recovery. Once data is secured, wipe or replace drives and do a clean OS install from trusted media. If unsure about any step, prioritize professional data recovery — that is often safer for important files than repeated guesswork on a failing disk.

As pointed out, hardware problems can mimic infections, and correctly emphasized recovery-first.

Recommended Answers

All 9 Replies

Member Avatar for jholland1964

Hard to say here, since you say it is an old computer could just be a coincidence and a failure would have happened regardless of what you were doing. Since you were downloading via uTorrent then infection also has to be figured in there too.
If nothing is recognized though, sounds like maybe you have had just a total failure. Possible you won't be able to get anything back. You say you hear beeps, how many?
Do you have the XP Disk? You might try and see if you can do a repair install but it really sounds like a full failure to me, the computer needs to "see" the hard drives and sounds like it doesn't at all.

Member Avatar for knoxlawyers

Thx for the reply. On other XP machines, I will get an HD failure message on boot. This not only refuses to boot, but the BIOS failure to see either physical HD is something I haven't seen before. Have you ever heard of an infection of any sort that could create such havoc? Also, assuming I can eventually boot to a command prompt, is there anything I can run on the floppy drive [there's one in this machine] or in the CD drive that might help?

Member Avatar for knoxlawyers

Nice BIOS summary. I'll have to see if the beeping corresponds to any of the error beeps referred to in the article. I guess at this point, the first thing is to get it to recognize the HDs. Without that, I can never get to step 2, which is troubleshooting Windows problems.

Member Avatar for knoxlawyers

What I'm really wondering from the various computer folks out there is whether this behavior corresponds to any known malware. If so, what do I do about it?

Member Avatar for jholland1964

I personally have not encountered an infection that wipes out BIOS settings, but maybe others have. Really wouldn't matter though, if you cannot get the hard drives recognized then there is no way to do any cleaning. That IS the #1 requirement to clean infection from a hard drive...there has to BE a hard drive seen.

Member Avatar for knoxlawyers

Interestingly, BIOS now sees the 2 HDs. I'm not complaining.

I was able to get into Windows long enough to go to msconfig and de-select from the Startup tab all the unnecessary [and suspicious looking] startup programs. On reboot, the error message I get remains as follows: "generic host process for win32 services encountered a problem and needed to close". As long as I don't click OK on that dialogue box, I can, to a limited extent, run programs. I started an old [1 year old definitions] Ad-Aware SE full scan -- old because it errored on me when I tried to update the definitions [maybe because it's an old version]. It's still running but had already picked up 6 critical problems. If I can get functional enough to do a hijackthis scan, I'll follow up with it tonight.

Member Avatar for senthuram

I personally have not encountered an infection that wipes out BIOS settings, but maybe others have. Really wouldn't matter though, if you cannot get the hard drives recognized then there is no way to do any cleaning. That IS the #1 requirement to clean infection from a hard drive...there has to BE a hard drive seen.

I think ur OS will be failed.U dont bother about that
Using Recovery Software,you can easily recover your HD's .It will recover your Hard disk files .After that reinstall ur OS

Member Avatar for jholland1964

Forget that AdAware program. It isn't what it used to be anyway. IF you can get to HiJackThis I would need a full scan. Also if possible I would like to know what all you turned off using msconfig. As long as the hard drives are now seen let's see if we can get this thing running again. I am willing to stick with it as long as you are.
Judy

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.