Printable View
Hi ppl.
I've got a friend that wants to format his PC. He's got multiple virusses and he already formatted it but most of the virusses haven't been deleted. Now I've heard of a program that formats the harddisk multiple times in one go to make sure that the files on the disk are deleted instead of just "marked writable".
So, I wanted to ask you guys, do you know any of those programs and where you can download them? I would really appreciate any help you can give.
Thanx ppl.
SD Formating doesnt remove data or files It simply moves them elsewhere. The solution is to use fdisk delete the current partition. Then boot to a boot floppy and make another or let the windows install do it for you.
SickDwarf make sure you format from a clean boot medium, otherwise you will still be stuck with the memory resident viruses.
You can use norton systemworks for your "special" format. It has Norton Wipe Info.
Wipe Info erases either a file, directory, disk or unused / free space to erase all tracks of earlier progs.
redgore is correct. You have to FDISK and delete the partition and delete the DOS partition. You then recreate the partition and DOS partition. Then load your OS. This will clean everything out on the HD
w98 Bootdisk[write protect] + w98 cd reset than fdisk /mbr[1 partition]and reset than setup w98.no more boot-virus.
format c: or format c:/q won t do the job!
Good-luck
just to throw it out there if it is a western digital [other probably have the option but i am sure WD harddrives have it] you can use the system tools disk or whatever the hell they call it and write all 0's to the drive
Euclid -
Are you maybe thinking of WD's Data Lifeguard? The writing "0's" to the hard drive is included in the "DLG" package. Maxtor and Seagate also have hard drive formatting tools. I'm not sure if they have anything similar to Western Digital's but I expect they do as well.
SickDwarf -
Does your friend know what virii were picked up? It may be that they have infected the CMOS, BIOS or MBR files. From what I've read, some MBR virii can easily avoid the repartitioning/reformatting process even if you have a write-protected floppy.
If you need programs for a specific hard drive or virus type - let us know and I'm sure we can help you out. I have a growing list of links for all sorts of things as I'm sure others who frequent this forum do. Good Luck!
V.
Get the low-format utility from your HD manufacture. These so call "low-format" utilities just writes zeros all over your HD. It is quick and the result is a clean hard disk without hidden viruses!
Sorry, here's a newbie question...just browsing though this post...You can't reformat and try to rid the viruses? You'd be better to just wipe the HD clean? I know when I was infected with Klez, I had to use my complete restore disk, which wiped out everything on my comp and reinstalled back to how I got my computer when I bought it, I couldn't do much of anything that would rid the klez completely. I even tried downloading the remover from my friend's comp and running the disk on my box to no avail.
And even when I was infected with Klez, I couldn't use any of my backup disks. I don't know...I've just gotten myself confused, can someone clarify this for me...
Just trying to follow along and learn...
EDIT: I got really confused with the whole writing the zeros to your harddrive, would this take up unnecessary space? Or would it just overwrite the virii, to be later overwritten by data? (Sorry, never heard of doing that before)
I think what people were pointing out is that format c: on its own is not enough to remove a lot of virii, as there will still be traces of it left on your HDD, or even worse in your BIOS.
By using the fdisk /mbr command first you should be able to reset/clean the MBR record on your HDD. This is important, as if you a virus that has infected your MBR, it will reinfect your machine when you reboot (even if you have done a format c:).
However if the BIOS is infected, even this may not work, and the only option is to re-flash the BIOS, which is fairly drastic, as if it goes wrong you end up with a non working PC.
The good news on this front is that some more modern motherboards have two copies of the BIOS, so if a virus has affected your primary BIOS, you can tell the PC to boot from the secondary copy - and if everything works OK you can then copy the secondary copy back to the primary one.
I'm surprised you couldn't use any backup disks, but there is a good chance they wouldn't do you any good anyway! If your BIOS and/or MBR was infected then doing a restore from a recovery disk would restore the main contents of the HDD back to what it was when you purchased it, but not the MBR or the BIOS. Then as soon as you re boot the virus reinfects your machine !!
Doing a low level format (i.e. writing 0's over the entire HDD) effectively achieves the same result (although it won't solve a BIOS problem) as it wipes all data from your HDD. It doesn't take up unnecessary space. This is often used if you are intending to sell/give your PC/HDD to someone else, as you probably don't want them looking at any personal data you may have left behind.
To try and summarise, normal formatting will remove the virii from the main part of your HDD. But if the MBR and/or the BIOS is infected, then when you re boot your machine the virii will spring back into action, and reinfect the rest of your HDD.
I am wondering about writing 0's all over your hard drive, do you mean that the actual binary code is written to all 0's, or am I missing something here?
It's binary zeros everywhere.
btw if you really want to permanently erase the data, then you would use one of the wipe programs out there that writes different data to each sector a number of times.
Depends on how paranoid you are as to the number of writes you go for :D
Okay, another question....Even if you were to rewrite over and over again, can it still not be traced, just with more effort as to how many times you've rewritten it? I'm just curious.
Use FDisk. Delete all partitions. Use bootable DOS disk and re-partition and format drive.
GG: Yes some people can read data off your hard drive even after multiple re-writes. I believe the NSA said they can get data even after 10-15, someone feel free to correct me if I'm wrong here, just trying to recall from an old thread. Anyway, the point is, if you're done with the HD melt it :D let them try to get data off it then... There are other ways though, I think such as a strong enough EMP should wipe the data right off, not sure if you will be able to use the HD again after that though.
GEL
First thing I'd do is a debug script there are threads here already that cover debug script so a search here fot it. After you run debug keep a boot disk in place , run fdisk again shut off the system 3 to 5 minutes to clear any cache ot TSR. Debug is a good tool to take the HD back to MFG level.