Crashing Hard Drive; Hidden Virus

L

Ladyhawk

Limp Gawd
Joined
Jun 5, 2005
Messages
244
For the past month I've been in computing hell. My hard drive has been erased three times, but I can't find the culprit.

TLDR: It's a long, complicated story, so I'll try to put the most important things in bold red, like this.

Symptoms: Each time the hard drive erased (well, at least two out of three), my first clue was Microsoft Word asking for a missing .dll. Each incident happened when I clicked on "New" to write an email with Outlook 2003. It uses Microsoft Word by default. (Yes, I know Outlook 2003 is ancient and probably virus-prone. My excuse? I'm getting old and I'm starting prefer what feels comfortable to anything new. It could very well happen to you.) In hindsight, this could mean the .pst files are infected. I scanned them with ZoneAlarm and MBAM, but they didn't find an infection.

Right after Microsoft Office goes belly up, ZoneAlarm and MBAM become inoperable. For some reason, it leaves my documents alone. The Windows operating system, my internet browsers and many other programs also continue to work, but it wipes out Steam and everything in my C:\games folder. I can't give you an exact rundown of what is left alone and what is erased because I restored from an Acronis backup and it hasn't happened again. At least not yet.

The first time it happened, I assumed the hard drive had crashed. I ran a complete diagnostic on the drive overnight and in the morning it said everything was fine. I didn't believe it, so I bought a new hard drive. On Monday, the exact same thing happened to the new drive. So, this has happened three times on two different hard drives. Each time I restored the hard drive with an Acronis image.

Even though I was fairly certain the hard drive was to blame, I ran memtest (two passes) to check for RAM errors. I also ran virus scans with Zone Alarm, MBAM, Trend Micro House Call and the online version of ESET. None of them found a virus, so I was sure the hard drive was at fault until it happened to the new one, too. After it happened to the new drive, I ran MBAM in safe mode and let ZA analyze every file on my C drive in normal mode. No viruses were found.

Despite several talks with ZA customer support, I cannot get ZA to run in safe mode on my computer. I'm not sure how important this is, so I'm not sure how much more time to invest. I've run MBAM in safe mode. Perhaps there is another antivirus I should try?

Thoughts:

1) Is there anything else that could be causing this? How likely is it that two hard drives could fail in exactly the same way? I think it's unlikely considering the fact the old hard drive passed a thorough diagnostic. I ran memtest (two passes). Even so, is there any way RAM failure or some other hardware failure could lead to such a catastrophic loss of information, creating the exact same symptoms each time? It seems unlikely, but I need to cover all bases.

2) At this point, I halfway suspect there could be a virus lurking in Outlook 2003 / Microsoft Word, but none of my virus scans have detected it.

3) I think all three crashes happened on a Monday (not entirely sure), but I can't think of anything special I have scheduled to happen on Mondays. Initially, I thought ZA was scanning on Mondays and that the virus delivered its payload upon discovery, but it turns out ZA scans were scheduled for a different day. Also, I ran a manual scan last night and everything was fine. I have external drives scheduled to sync on Tuesdays, so that doesn't seem to fit the pattern.

To sum up:

1) Should I try another antivirus besides the ones I've already tried (ZoneAlarm, MBAM, Trend Micro House Call, ESET). How about finding a way to get ZA to run in safe mode? Should I pursue that further? It keeps telling me "Antivirus not properly set." I've uninstalled, cleaned and reinstalled to no avail. Should I try another antivirus in safe mode? The folks at ZA said if ZA didn't find the virus in safe mode, it wasn't a virus, but I'm not buying that.

2) I'm pretty frazzled at this point. All the diagnostics and virus scans say my system is fine, but some trigger has caused the hard drive to erase certain programs three times on two different hard drives.

______________________________________

Here are my system specs:

Operating System
Windows 7 Home Premium 64-bit SP1
CPU
Intel Core i7 2600K @ 3.40GHz 54 °C (overclocked
Sandy Bridge 32nm Technology
RAM
8.00GB Single-Channel DDR3 @ 802MHz (11-11-11-28)
Motherboard
Gigabyte Technology Co., Ltd. Z68A-D3H-B3 (Socket 1155) 37 °C
Graphics
SyncMaster (1920x1200@60Hz)
Intel HD Graphics Family (Gigabyte)
2048MB ATI AMD Radeon HD 6900 Series (XFX Pine Group) 50 °C
Storage
931GB Western Digital WDC WD10EZRX-00A3KB0 ATA Device (SATA) 31 °C
931GB Western Digital WDC WD1001FALS-00J7B0 ATA Device (SATA) 36 °C
931GB Western Digital WDC WD1001FALS-00J7B0 ATA Device (SATA) 37 °C
1397GB SAMSUNG HD155UI USB Device (USB (SATA)) 33 °C
1397GB SAMSUNG HD155UI USB Device (USB (SATA)) 33 °C
Optical Drives
MagicISO Virtual DVD-ROM0000
HL-DT-ST BD-RE WH14NS40 ATA Device
Audio
Realtek High Definition Audio
 
Last edited:
This doesn't sound like malware to me. Then again, you can't prove that it isn't malware. Clean scans just mean that it didn't find anything. It doesn't prove anything isn't there. You can't, after all, prove a negative.

But this sounds more like failing RAM to me. I once had bad RAM that would pass memtest but would nevertheless cause games to crash. Especially as the computer got hot and the room temperature climbed.

Bad RAM can lead to data corruption. After all, any data that is written to the hard drive first passes through your system RAM. And a BSOD or crash at the wrong time can scramble the equivalent of the file allocation table (etc., essentially, the table of contents for a drive).

I'd look into RAM. This just doesn't sound like malware to me. And smells a bit of how everyone I know who has a computer issue tells me: "I think I have a virus. . . my mouse stopped working." =)

Of course, that tends to be a better guess than it used to be nowadays. But in this case, I don't think it's malware.

--H
 
If it is nuking specific folders on your drive, that is not random data corruption.

I'll bet if you did not restore, but started clean it wouldn't happen again.........

Consider using your image to make a VM that is sandboxed, and then see if the VM erases folders
 
Hurin said:
This doesn't sound like malware to me. Then again, you can't prove that it isn't malware. Clean scans just mean that it didn't find anything. It doesn't prove anything isn't there. You can't, after all, prove a negative.

But this sounds more like failing RAM to me. I once had bad RAM that would pass memtest but would nevertheless cause games to crash. Especially as the computer got hot and the room temperature climbed.

Bad RAM can lead to data corruption. After all, any data that is written to the hard drive first passes through your system RAM. And a BSOD or crash at the wrong time can scramble the equivalent of the file allocation table (etc., essentially, the table of contents for a drive).

I'd look into RAM. This just doesn't sound like malware to me. And smells a bit of how everyone I know who has a computer issue tells me: "I think I have a virus. . . my mouse stopped working." =)

Of course, that tends to be a better guess than it used to be nowadays. But in this case, I don't think it's malware.

--H
Click to expand...

Actually, I suspected hard drive failure or RAM failure before I suspected a virus and ran diagnostics on the hard drive and the RAM. When the tests came back clean, I then scanned for viruses. None of the tests exposed the true issue.

Each time I lost information on the hard drive, it was the exact same information as far as I can tell. If my problem is due to faulty RAM, I believe the data loss would be more random than that. Windows continues to run just fine after the data loss. You'd think RAM issues would corrupt the operating system first because Windows is constantly accessing RAM. Also, the content of folders that never use RAM (unless I open them manually) are vanishing without a trace.

Also, the computer does not crash. It continues to run while data disappears. The day this first happened, my computer did crash, but I didn't notice loss of data until much later. The last two times, data disappeared without a crash, so it's possible the crash and loss of data were completely unrelated. My computer has not crashed since then. It continues to operate, even while files disappear before my very eyes. Windows seems fine. My documents are unaffected. Only certain files and programs are affected. This doesn't fit the profile of faulty RAM.

That is why I now suspect a virus. But because I don't know for sure, I won't rule out bad RAM. :)
 
Last edited:
thebufenator said:
If it is nuking specific folders on your drive, that is not random data corruption.

I'll bet if you did not restore, but started clean it wouldn't happen again.........

Consider using your image to make a VM that is sandboxed, and then see if the VM erases folders
Click to expand...

I'd go with the VM suggestion.
 
Sadly, unknown malware won't be detected by a scan. Yup put may be unable to use that data
 
thebufenator said:
Sadly, unknown malware won't be detected by a scan. Yup put may be unable to use that data
Click to expand...

Yeah, that's my fear. I could do a clean installation of everything and still end up with the virus if it hitches a ride on a file. *shrug*
 
Interesting idea. I've never used a VM before, but I understand what you're saying. I can probably figure it out.
 
The "random" deletion or corruption of data that is often-used is not random. So those saying that bad RAM wouldn't cause the corruption of the same files aren't necessarily considering that RAM will only corrupt files that are read and written through the RAM. And if the person makes constant use of Outlook, it'll more than likely manifest itself in a tangible way by mangling the PST (etc.).

Just as my bad RAM most often manifested itself while playing Company of Heroes and almost never at any other time.

Please do keep an open mind about it being your RAM. As you said you are.

This still smells more like a bug, bizarre interaction between software, or failing hardware than it does malware. But obviously, we fear the malware hypothetical the most.

On the malware front, I realize Microsoft's detection rates are pretty maligned now, but here's an offline scanner that boots into a Windows PE environment and scans your whole system (so any rootkits won't be able to mask themselves).

http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline
 
Personally, I would do a wipe of the drive and start over from scratch.

However, my go to stuff for getting rid of malware/viruses for computers that I am working on is as follows:

Dr. Web CureIT:
https://www.freedrweb.com/download+cureit+free/?lng=en

MBAM - you already mentioned.

SuperAntiSpyware
http://www.superantispyware.com/

Spybot S&D - mainly use for the immunization feature, but the malware scan is good as well. When I use this, I generally run a scan, then immunization, and then uninstall.
https://www.safer-networking.org/

And my current anti-virus of choice.. which I have a subscription to is BitDefender. They have a free version as well. And if you want a subscription to it, do a search on google and you should be able to find a really good price on it.
 
Please do let us know when you get things sorted out. Actually curious.
 
did you ever try to do a clean install on your new harddrives ? Or did you always clone your data to the new drives ?
 
I bet it's the image too.

The only thing the OP is doing consistently is re-imaging with Acronis. And the issue keeps happening.

Always start out fresh.
 
You must log in or register to reply here.
Back
Top