A Digital Age Deserves A Digital Leader

[Seriously need help] External HD causes HD & OS crashes

[Seriously need help] External HD causes HD & OS crashes

Postby masterton » Sat Jul 04, 2009 11:12 pm

The thread is rather long. Only read what you think important. Skip the rest!

We have a serious but mysterious problem. We have spent already one week but drawing a blank.
Two hard drives have been crashed and failed (unreadable). One computer has hung a few times unexpectedly and had one weird restart (no memory dump produced).
I suspect all the recent problems have to do with the new USB external hard disk (Buffalo MiniStation Lite: HD-PE250U2).

**********
Formatting USB external hard disk
**********
Originally I would like to use the program given by Buffalo to format the external drive once but we failed. We simply used Windows to reformat the drive into NTFS. I did not use the TurboSpeed advertised by Buffalo, or run its free program.

**********
Case A: Multi-transfer causes system crashes?
**********
The first time we met the problem.
We were trying to help a friend to backup data on an old drive, about a few years old. We plugged in the Buffalo USB portable hard drive and transferred a whole lot of files to the drive. Several cop/cut-and-paste operations were active at that time. The whole system completely froze up. It doesn't respond at all. Only a hard restart could help.
Restarted. Tranferred again. Several cop/cut-and-paste operations were active.
Hard drive crashed - the beginning of the nightmare!
Windows restarted. Chkdsk was running. Saw many lines of messages with:
"File segment record XXXXX is unreadable"
"File segment record XXXXX is unreadable"
......
"File segment record XXXXX is unreadable"

Chkdsk run very long time (perhaps a hour or so), complaining that some couldn't be fixed, some okay.
Initially I thought it was simply because it so happened that the hard drive failed in the middle of transfer. But the same nightmare occurred when we tried to plug it into another computer.

**********
Case B: Open folder causes system crashes?
**********
I plugged in the Buffalo USB external hard disk on a laptop computer.
I tried to check if transferred files were safe. I have no ideas how to check but it looked okay.
Some files were transferred to and from the external hard drive. I made sure only 1 copy-paste operation was active this time.
Then computer hung for a while and displayed Blue Screen of Death. (I recorded the message on a piece of paper but it was lost later).

Restarted. I believed chkdsk was automatically run and fixed some errors found (not too sure about this). I resumed the work. I made sure only 1 copy-paste operation was active this time.
The system hung this time when I double clicked on a folder (to see what contents inside). Another Blue Screen of Death popped up later:
KERNEL_STACK_INPAGE_ERROR
0x00000077 (0xC000000E, 0xC000000E, 0x0000000, 0x009C7000)
Info on this BSOF: http://support.microsoft.com/default.as ... us;Q315266

Computer restarted. Chkdsk was automatically run. Nightmare again!
"File segment record XXXXX is unreadable"
"File segment record XXXXX is unreadable"
......
"File segment record XXXXX is unreadable"

Chkdsk attempted to fix the problem but it complained "not sufficient space". Then I received STOP: C000021a Unknown Hard Error

Oh my gosh! What's up? I don't believe it so happened AGAIN the hard drive failed when some actions were performed between the hard drive and the USB external hard disk. I started to feel something went very wrong. Is it virus?


**********
Case C: Scanning for virus causes system crashes?
**********
Searching on the net didn't find any case which was similar to mine.
I tried again on a new computer. Fresh Windows copy. New hard drive (less than 1 year old). Only a handful of programs were installed.
I downloaded Avira and did on-demand scan for my internal hard drive first. No virus was found. Was I safe now?
I plugged in the USB external hard drive and scanned this drive for virus.
My new computer froze when the scanning was close to completion (I believed the progress was about 90%)

Computer restarted. No chkdsk was run automatically. I scanned again from scratch.
I paused it after a while. I had a weird thought that the USB external hard drive may crash our system when it's overloaded.

Then I was browsing on the Internet (perhaps a few hours or so). The scan was kept "paused". The USB hard disk was still plugged. My computer hung again when I tried to click to view a video on YouTube.

**********
Case D: System crashes without USB hard disk
**********
OK! I switched the computer off completely and unplugged that "devil".
Using the computer for about one day, computer hung again at night.
Hmm... This computer is new. What's really wrong if it isn't related to the USB hard disk?

**********
Case E: Transfer a large file causes system crashes
**********
This test attempts to transfer a single large file (4.33GB) from USB external hard disk to my computer
First attempt: System restarted mysteriously in the middle of transfer. I set it to display BSOD when crashes. The computer shouldn't restart. I didn't see any memory dump either.
Second attempt: System hung after the transfer.



I'm desperate! It's just so strange! I have absolutely no ideas why something like this would happen. :-? :-? :-?

My questions:
  1. Really what's going wrong? I don't think USB external hard disk is such a so unreliable product. There must be something I'm missing...
  2. What checking tools (free or paid) do you recommend to verify whether the transfer is faultless, files being safely moved/copied?
  3. What file recovery tools (free or shareware) could I use to recover (at least most of) lost data in the hard drives? The tools have to be well (professionally) written. I tried a few but all failed to recover all except a small portion of data. Professional recover services are out of consideration because I know it's very expensive and the data isn't utmost important.
  4. How could I save/recover data from the laptop computer? I tried to go to safe mode but failed. I received STOP: C000021a Unknown Hard Error. Chkdsk once complained "insufficient disk space" when attempting to fix "file segment unreadable" error. Is it the cause? I also inserted SeaTools CD to do a scan. It said it's loading something to the RAM drive (I had only 1 internal hard disk on the laptop computer). It's loading but never finish. I couldn't even enter into the main screen of SeaTools. I could only see a black screen.

Tell me anything else you want to know.
Ask me any piece of information which helps to troubleshoot the very root of this series of problems.
PRO Level 2
Posts: 11
Joined: Sat Jul 04, 2009 7:54 pm

Re: [Seriously need help] External HD causes HD & OS crashes

Postby JabbaPapa » Sun Jul 05, 2009 6:52 am

It does sound like the external drive is seriously dysfunctional, which can potentially be caused by physical or logical damage ; although these symptoms also sound a lot like a serious virus infection.

masterton wrote:The system hung this time when I double clicked on a folder (to see what contents inside). Another Blue Screen of Death popped up later:
KERNEL_STACK_INPAGE_ERROR
0x00000077 (0xC000000E, 0xC000000E, 0x0000000, 0x009C7000)
Info on this BSOF: http://support.microsoft.com/default.as ... us;Q315266


This is a VERY serious error code, indicating that your BIOS/CMOS has been altered. This most likely occurs after a virus attack, although some unusual hardware-based I/O or electrical errors could conceivably produce the same result.

Nevertheless, you would be well advised to clear CMOS on all computers that the external drive has been plugged into, although this would not be sufficient to fix any actually infected computer, as the virus might just alter BIOS/CMOS again upon Windows reboot.

The most likely source of the malware infection, if there were one, would be your friend's old drive in Case A ; but that's just forensics, given that the problem has spread.

Personally, I would take the cleanest computer that you have, ie the one with the smallest amount of data content and/or one for which you already have an extensive external data backup, then :

0) Perform any necessary backups -- don't worry about the virus for this operation, except move the data to another computer that is already involved in this business, instead of to yet another one ;) OR make the backup to a separate data partition if no other solution is available

1) plug in the external drive, and then not just format but delete the partition on that drive (in Start > Computer > right-click > Manage > Disk Management) -- and then unplug it WITHOUT making a new partition

2) Clear CMOS/reset BIOS on the computer, and then BEFORE rebooting insert a Windows installation CD/DVD

3) Boot to Windows installation, and reinstall making sure that you format the installation drive during setup and YES this will delete all data on that drive, see step 0) above

4) Install the NOD32 antivirus ( http://www.eset.com ), and ensure it's up to date

5) Create a new partition on the external hard drive (in Start > Computer > right-click > Manage > Disk Management)

This should ensure that you have at least one completely clean system to base any further repair work on.

After this, you should be able to use a combination of the external drive and NOD32 to perform the basic backup/cleanup tasks for the other infected machines -- but you should bear in mind that you should clear CMOS/BIOS on all of them, Format the system drives on all of them, and clean install Windows on all of them. And YES these low level virus attacks ARE nasty :(

Unfortunately, it does sound like some very low-level damage/attack, so that some quite radical clean up methods are recommendable :(
Image
PRO VETERAN
User avatar
Posts: 9538
Joined: Sun Feb 22, 2004 5:17 pm
Location: Monte-Carlo
Real Name: Julian Lord

Re: [Seriously need help] External HD causes HD & OS crashes

Postby masterton » Sun Jul 05, 2009 9:19 am

Thanks for the reply. I'm going to follow what you suggest soon and will report back later.
I'm really worried if the true culprit is not external HD but some very hideous virus. But I'm really puzzled why all three got infected. Ask any questions you want so we can locate the true cause of this disaster.

The new computer started to act weirdly after multiple system crashes. Take a look at the quirks:
1. Grey missing bottom bar
2. Image

Pressing Windows logo + D could restore the bottom bar for a while only.
Some icons couldn't display in the desktop.
I have to restart computer now to remove all those quirks away.
But it would re-occur after some period of usage when the computer is on. The exact time of occurrence doesn't seem to be constant. It's rather random (no pattern observed!)

I have some quick questions. My new computer has Avira installed. It has the highest detection rates according to AV-comparatives but no AV could detect all malware. :dontgetit
Did I get some rootkits? Hmm..... :(
And, assume my new computer is infected. Would my system re-infect if I reformat the system partitions only (leaving the data partitions intact)?

I need some REALLY good recovery software to recover lost data after crashes, save my laptop (can't reboot now), and backup data storing in the "unstable" external HDD before reformat. Any help is greatly appreciated.
Last edited by masterton on Sun Jul 05, 2009 1:23 pm, edited 2 times in total.
PRO Level 2
Posts: 11
Joined: Sat Jul 04, 2009 7:54 pm

Re: [Seriously need help] External HD causes HD & OS crashes

Postby masterton » Sun Jul 05, 2009 9:21 am

Last edited by masterton on Mon Jul 06, 2009 5:54 am, edited 1 time in total.
PRO Level 2
Posts: 11
Joined: Sat Jul 04, 2009 7:54 pm

Re: [Seriously need help] External HD causes HD & OS crashes

Postby JabbaPapa » Sun Jul 05, 2009 4:41 pm

I have responded to your PM by sending you one, and I'll just add that the antivirus software typically recommended by members of PROnetworks is NOD32 and NOT Avira ;)

I'll also add that a computer of mine was infected by a similar virus day before yesterday, and that a quite difficult forced BIOS/CMOS reset, combined with a format of the infected system drive and Windows reinstallation, successfully cleansed my system.
Image
PRO VETERAN
User avatar
Posts: 9538
Joined: Sun Feb 22, 2004 5:17 pm
Location: Monte-Carlo
Real Name: Julian Lord

Re: [Seriously need help] External HD causes HD & OS crashes

Postby masterton » Mon Jul 06, 2009 5:43 am

Thanks a lot for your reply. I haven't reformatted yet but I'm preparing to do.
I just ran SeaTools and my HDD in the new computer passed the test. But it doesn't seem to be a really comprehensive test. I wonder if there are some more sophisticated tests we can perform to make very sure all the HDDs are still healthy.

Based on what you comment, so you think the whole disaster is more likely to do with a very hideous malware rather than the (faulty?) USB drive. My new computer is suffering from display quirks [1] [2] after the crashes now. What do you think? Would that be a good indicator to confirm that the true culprit is the malware from Case A?

Why NOD32 when Avira seems to have the highest detection rates to the existing and new malware?

You did mention "if you don't actually manipulate the file, say by copying it for example...". It's surprising to me because I don't think moving/copying files will "activate" the malware. I always think I must execute it to get infected. It seems I'm completely wrong.

I would like to know whether I would get infected on the following situations too. Just say yes or no:
1. simply plug in the infected USB drive / discs / USB stick and do absolutely nothing!
2. extracting files from an infected archive
3. simply double click to open an infected archive without extracting anything
4. all computers would get infected automatically if one computer in the same local network is infected. It doesn't require any interaction.

That really sucks. I didn't realise malware can be so powerful and horrible.

Thank you so much for your help. Very much appreciated! :notworthy
PRO Level 2
Posts: 11
Joined: Sat Jul 04, 2009 7:54 pm

Re: [Seriously need help] External HD causes HD & OS crashes

Postby JabbaPapa » Mon Jul 06, 2009 6:48 am

masterton wrote:My new computer is suffering from display quirks [1] [2] after the crashes now. What do you think? Would that be a good indicator to confirm that the true culprit is the malware from Case A?


You are unlikely to get system defects such as these from plugging in a faulty USB device.

masterton wrote:Why NOD32 when Avira seems to have the highest detection rates to the existing and new malware?


The claims made about Avira are basically just hype, whereas NOD32 is a tried and tested AV, that most techies would trust.

masterton wrote:You did mention "if you don't actually manipulate the file, say by copying it for example...". It's surprising to me because I don't think moving/copying files will "activate" the malware. I always think I must execute it to get infected. It seems I'm completely wrong.


Each virus strain has its own quirks, but it can only do something if you access it, either manually or by a background task of your operating system -- copying and moving constitute access, and are therefore dangerous tasks where infected data is concerned.

masterton wrote:I would like to know whether I would get infected on the following situations too. Just say yes or no:
1. simply plug in the infected USB drive / discs / USB stick and do absolutely nothing!


Yes.

masterton wrote:2. extracting files from an infected archive


Yes.

masterton wrote:3. simply double click to open an infected archive without extracting anything


YES !!

masterton wrote:4. all computers would get infected automatically if one computer in the same local network is infected. It doesn't require any interaction.


Absolutely.

masterton wrote:That really sucks. I didn't realise malware can be so powerful and horrible.


Live and learn :(
Image
PRO VETERAN
User avatar
Posts: 9538
Joined: Sun Feb 22, 2004 5:17 pm
Location: Monte-Carlo
Real Name: Julian Lord

Re: [Seriously need help] External HD causes HD & OS crashes

Postby NT50 » Mon Jul 06, 2009 4:06 pm

From reading all the post, I agree with JP on this one; you have one real bad virus that is probably laying dormant in your CMOS by now and can be replicated jsut by runn Windows again.
I have run a computer business for several years now and have used ALL the AV programs out there. The only one that my business sells and represents is the NOD32. If a customer ask for a different one, I tell them to install it themselves. I will not stand behind it.
Dogs Have Owners; Cats Have Staff
PROfessional Member
User avatar
Posts: 8220
Joined: Sat Jun 19, 2004 4:46 pm
Location: Jackson, TN USA
Real Name: Jeff Replogle

Re: [Seriously need help] External HD causes HD & OS crashes

Postby masterton » Wed Jul 08, 2009 6:20 pm

NT50 wrote:I have run a computer business for several years now and have used ALL the AV programs out there. The only one that my business sells and represents is the NOD32. If a customer ask for a different one, I tell them to install it themselves. I will not stand behind it.


I'm curious to hear the reasons why only NOD32 is highly recommended. What it does which is far superior than other AVs.
According to reputable test sites like AV-Comparatives and AV-Test, Avira is the one which is almost getting the highest detection rates.
PRO Level 2
Posts: 11
Joined: Sat Jul 04, 2009 7:54 pm

Re: [Seriously need help] External HD causes HD & OS crashes

Postby NT50 » Wed Jul 08, 2009 7:12 pm

If you will look at the pdf charts closely Eset got Advance+ while Avira only got Advanced.

Eset has a smaller footprint in memory than the others also. Plus I have used Eset for many years now and NEVER had a problem. Also consider my surfing habits are few and I dont go to sites that "some" people goto.
Dogs Have Owners; Cats Have Staff
PROfessional Member
User avatar
Posts: 8220
Joined: Sat Jun 19, 2004 4:46 pm
Location: Jackson, TN USA
Real Name: Jeff Replogle

Next

Return to General Windows Support

Who is online

Users browsing this forum: No registered users and 1 guest

cron
cron