Virus Damage to Hard Drives

We had a combination of viruses render our mirrored hard drives inopperable, causing us to lose our information. We were able to restore the information from the tape back-up but one of the Hard Drives does not work properly, despite repeated attempts to format the disk. IS IT POSSIBLE THAT A VIRUS COULD CAUSE PHYSICAL AND PERMANENT DAMAGE TO A HARD DRIVE? My research indicates that either the IDE or ATA controllers could have been affected and are causing the malfunctions. Is there ANY information on this?

I did some searching and I didn't find anything that talked about a virus doing permanent damage to a hardrive to the point that it was useless You may have a boot virus on the drives and sometimes a regular format won't erase the the virus What I would do is go to the manufacturer of the drive and download their software tools that will do a low level format on the drive.

As to date, the are no existing viruses which would cause physical damage to a hard drive. Perhaps running a magnet HDD eraser over the hard drive, and reformating it afterwards using fdisk would fix the issue.

DVM,
I personally have never had of a virus do physiacl dmage to a harddrive (and just thinking about it don't know how it could *** I am not a genoius, there might be I jst don't know how***) but if it modifies the firmware I don't see why it wouldn't act like a damaged drive. I have however had similar problems when HDs crashed and the crash took out other drives.

What viruses did you find?

Bio

A virus itself can not infect hardware and damage it through infection means. However, a virus's activity can damage certain forms of hardware depending on virus type. Examples.

1.If the Virus is meant to write, erase, write, erase, write, erase to the same segment of a drive over and over again. If does it fast enough and long enough, it places wear and tear on that segment of the drive, eventually ruining anything being written and read from that area in the future.

2. If the Virus is meant to do low level formats on the harddrive multiple times (by low level I mean writing 0's to the entire disk.. very low level) over and over again. Like scenario one, the harddrive eventuall get's so hot and overused that it begins to cause damage to the drive itself from the heat+overuse.


Those two scenarios are only a few things I've seen in my time. So in essence, a virus can damage hardware (in this example harddrives), but not through "infecting means", just "hardware overuse". Also note that IDE and ATA cables are obviously exempt from this, as the amount and continual use of electrical pulses makes no difference to them, just the harddrives that get overworked.

pooh is defenitely onto something there. I forgot about that aspect. I was actually thinking of experimenting on a virus which could Send an electrical impulse to the HDD and possibly kill it. Another way could also be a Trojan programmed to download an infitite amount of data from the nternet or copying itself endlessly until the entire HDD is filled, and then reformating and going over the same process over and over and over.

I do agree with DeadAddict.

If you're using a hardware RAID solution you might want to recheck the settings of the controller. I've had issues with controllers marking disks as unused after a serious crash. After reconfiguring the RAID controller everything worked fine again.

This 'problem' you have is a nice example of why you still need good backups. Even if you use RAID1 or RAID5 your data can get corrupted. RAID is only usefull preventing outage should 1 of your drives suddenly die.

You say you have tried to re-format the disk.

Have you also tried to re partition it ?

The virus may have overwritten the master boot record and this may prevent a re-format.

Steve

have you tryed booting up the system with the damaged disk attached only? if so was it recognised in the bios! if so then maybe you have an electrical problem with the circuitry on the hard drive.if however it was recognised and didn't start possibly due to a virus, have you tryed booting up the bootdisk and from prompt writing or copying a new partition table to the hardisk with FDISK /MBR , did that not work?

if it did but you can't see the files that where originally on the harddisk try a file scavenger program, something similar to that of lost and found.

thats all as i ever do,

1) Isn't recognised in the Bios (damaged circuit board) change it for an identical
working one and recover your files then loose the disk.

2) if its a bootsector virus, (copy a new bootsector from a floppy) FDISK /mbr

3) if it the data that can't be found then run a file scavenger program can be a
time consuming job, but you'll get there eventually.

Works everytime for me :) well unless its down to the disk being off its bearings then it's off to the lab.

It seems appropriate, like Sir Dice mentioned, to determine WHAT controlls the disk and then WHAT controls the mirror. For example, if the RAID or Mirror is controlled via a hardware controller then, does the controller recognize the disk? If so you will need to rebuild the RAID or Mirror and proceed. To eliminate any off the above, could another PC be used to format the disk. That will eliminate RAID controller isses for now and provide a base to t-shoot the controller issues and rebuild the strip or mirror.

Theoretically, would it be possible to overwrite the bios, and alter the power levels that go to a reader/writer head? In the case of a CD drive, this could melt the CD (you can alter the beam intensity for different densities or something, I heard), although I'm not sure if the BIOS has that level of control over the hardware...

Anout one month ago i had posted a question on this (name of the topic was 'can you harm hardware remotely?') and i had got many answers...if you search the forum area you will find it. There, they were mentionned some viruses that can affect hard drives..i dont know how to make links that's why i dont give you the link...take the time to read it i think it can help you...

Thanks for the outstanding feedback. For now, we scrapped the second drive as we feel it is permanentlty damaged and it is not worth getting it to "work" only to have something go wrong. A new drive was installed, the Raid controller has the mirror working perfectly and order is restored. I am going to check some of the links that were suggested to get more info on physical damage to hard drives as a direct result of a virus attack. Feel free to continue to provide input when available to this thread. Thanks again for the help.

Yes. I got one a while back on an older machine. The virus write to CMOS and has your [4500RPM] HDD try to run at maybe [7200RPM], or faster, thus rendering your harddrive useless. I haven't found much info on this online, just a few things on how to use assembly to write to CMOS.

Hi All,

I just finished fixing a ladys laptopwith the same problem, with one exception.. she had aquired the PTsnoop , then someone dropped in BAT/MUNGA and let it go.. she only rebooted, but it got about 70% of her drive before she shut down.. luckily, I was able to recover all of her clusters through fdisk/s but it took all of 6 hours to do it.. afterwards I reinstalled Everthing, and to my suprise everything worked well I then did the whole PT Snoop Colon Trick, and everything is working well.

Cheers

What makes you think there was a virus? Hard drives die all the time... from "natural" causes.

Hey Roadclosed, as a matter of fact , that is what has happened to the system I was talking about...

The customer had failed to mention she had reciently dropped her laptop...Imagine that.... :rolleyes:

Cheers

Quote:

---

Hard drives die all the time... from "natural" causes.

---

does smashing the damned thing with a 10lb sledge hammer because the comp is pissing you off count as natural causes?

Seriously though, if the old HDD has been removed and replaced what did you do with the old one? I would ask the powers that be if i could examin it further if i were in your shoes. If its been replaced then taking a look at it to see if it can be fixed wouldnt hurt. Like a few others have said try low level formating it. That resets all the information on the entire drive to 0.

The only reason I can think that a virii writer would want to damage an HDD was coperate espionage, or they own a HDD manufacturing plant and they want money :D. I have huge doubts about a virus damaging and HDD, although dropping or the sledgehammer (zombie!) might... you never know though.

-Cheers-