Re: Does anyone recognize this?
From: nemo_outis (abc_at_xyz.com)
Date: 26 May 2005 16:06:59 GMT
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
> From: "nemo_outis" <email@example.com>
>| To minimize the amount of work I suggest the following.
>| 1. Reformat the entire drive. But that's not enough. I suggest
>| you also repartition it and restore the MBR (e.g., with fdisk).
>| Alternatively - and better - do a "manufacturer's level reformat"
>| (using software available from Western Dignital, Maxtor, Hitahi,
>| seagate, etc. as the case may be.)
>| 2. Reformat the disk (and repartiton it, etc.)
>| 3. Install just the OS from known-good sources (e.g., original
>| Windows CDs)
>| 4. Install Ghost (or Acronis, etc.) from known-good sources (or
>| even use a diskette or CD-based version that doesn't require
>| installation). Backup the HD as an image.
>| 5. Install your most trustworthy programs from known-good sources
>| (e.g., MS Office from CDs)
>| 6. Backup entire HD with Ghost, Acronis, etc. (incremental backup
>| shpould suffice).
>| 7. Install second-tier (less trustworthy) software. Backup with
>| Ghost as per step 6.
>| 8. Repeat steps 7 & 6 in stages adding a few more programs,
>| confirming the system is clean, and backup. Repeat until all is well
>| and system is fully up. If you encounter problems at any point, roll
>| back to a previous working disk image.
>| I know this seems tedious (and it is) but the idea of regular
>| incremental image backups is something you should be doing anyway and
>| this ill be a baptim of fire in that discipline :-)
> There is really no "low level format" of ATAPI/EIDE hard disks. The
> term "zero fill" the drive (writing "zero" to all areas of the hard
> disk). However, there is no indication of a Boot Sector Infector,
> just adware/spyware and a "fdisk /mbr" and "zero fill" of the hard
> disk is unwarranted. Just deleting the partition and recreating the
> partition then a high level format of the drive is needed.
I outlined two courses of action: the conventional reformat, and the
"manufacturer's reformat." I did this purposefully and fully aware of
the possibilities and limitations of each. And, yes, as a review of my
previous posts will show, I'm well aware that a "manufacturer's level
reformat" using its publicly available software isn't equivalent to a
factory reformat (e.g., laying down servo tracks, etc.) but it does
zeroize all data on the drive.
No evidence of a boot sector infector? Maybe not, but that hardly seems
conclusive. The fellow with the problem seems unable to identify the
source of his problem or even to eliminate specific categories.
Accordingly, it would be just plain prudent and sensible, if one goes to
the trouble of reformatting a drive, to do it thoroughly. And that is
why I would strongly recommend using the manufacturer's program (e.g.,
Powerblast for Maxtor, Drive Fitness Test for Hitachi/IBM, etc.).
Moreover, I mentioned these programs because many are not aware that such
manufacturer's software is available.