I've recovered data files, for a colleague, from a HHD that holds a Win98SE system that won't boot. I did it by taking it out of it's own case, setting the jumpers to 'slave' and connecting it to my ancient Win98FE box and booting up. As expected the dud HDD appeared as a new drive in Explorer and it was straightforward to search for and copy off data.
I then wondered about trying to revive the dud disk (I know, I know, why?). As a first step I'm trying to scan it with ClanWin to see what might be lurking on it.
ClamWin happily scans the main C: drive and gives a short report about how many files it's scanned and if any were infected (no, all clear). It also gives a sensible report about E: (a data partition on the same physical HDD as C:).
But... when I choose to scan D: (the dud drive) although it seems to scan the drive it produces an empty report, no info about anything. I know some viruses are very clever and can try to hide by turning off AV apps.
Anyone care to offer any thoughts on what might be going on here?
Ken
edited to add...
Just tried the AV scan again. This time I've got a notification balloon that says there were problems with the scan. Think I'd better do a Scandisk.
virus stopping an AV scan?
-
- Panoramic Lounger
- Posts: 8197
- Joined: 25 Jan 2010, 09:09
- Location: retirement
-
- Administrator
- Posts: 78671
- Joined: 16 Jan 2010, 00:14
- Status: Microsoft MVP
- Location: Wageningen, The Netherlands
Re: virus stopping an AV scan?
Viruses can only turn off security software if they're running. If you attach a hard disk as a non-system drive, there's no way for a virus on that disk to run, unless you deliberately started it.
So it seems more likely that the same damage to the disk that prevent it from being bootable is preventing the AV program from correctly reading its contents. Since you already got the data off the disk, it's probably best to format it, then see if it can be used again.
So it seems more likely that the same damage to the disk that prevent it from being bootable is preventing the AV program from correctly reading its contents. Since you already got the data off the disk, it's probably best to format it, then see if it can be used again.
Best wishes,
Hans
Hans
-
- Panoramic Lounger
- Posts: 8197
- Joined: 25 Jan 2010, 09:09
- Location: retirement
Re: virus stopping an AV scan?
Duh, of course, I knew that!HansV wrote:Viruses can only turn off security software if they're running. If you attach a hard disk as a non-system drive, there's no way for a virus on that disk to run, unless you deliberately started it.
Yup, Scandisk is finding errors in the \windows folder, it's unlikely this will installation fly again. did someone mention volcanic ash?HansV wrote:So it seems more likely that the same damage to the disk that prevent it from being bootable is preventing the AV program from correctly reading its contents. Since you already got the data off the disk, it's probably best to format it, then see if it can be used again.
Ken
-
- Administrator
- Posts: 78671
- Joined: 16 Jan 2010, 00:14
- Status: Microsoft MVP
- Location: Wageningen, The Netherlands
-
- Panoramic Lounger
- Posts: 8197
- Joined: 25 Jan 2010, 09:09
- Location: retirement
Re: virus stopping an AV scan?
I was supposed to have a hair cut on Wed morning but it was cancelled because the hairdresser is stuck in Spain because ofHansV wrote:NOBODY mentions volcanic ash!
Ken
-
- 4StarLounger
- Posts: 412
- Joined: 25 Jan 2010, 06:46
- Location: New Jersey
Re: virus stopping an AV scan?
Soooo... your now a hairdresser living in Spain ???stuck wrote:I was supposed to have a hair cut on Wed morning but it was cancelled because the hairdresser is stuck in Spain because ofHansV wrote:NOBODY mentions volcanic ash!
Ken
If life gives you melons,
You may be dyslexic.
You may be dyslexic.
-
- Panoramic Lounger
- Posts: 8197
- Joined: 25 Jan 2010, 09:09
- Location: retirement
Re: virus stopping an AV scan?
it might pay moreDoc Watson wrote:Soooo... your now a hairdresser living in Spain ???
-
- PlutoniumLounger
- Posts: 15664
- Joined: 24 Jan 2010, 23:23
- Location: brings.slot.perky
Re: virus stopping an AV scan?
Soooo... your still have hair ???stuck wrote:I was supposed to have a hair cut on Wed morning ... Ken
It may be a bit too late, but wasn't Win98 still DOS-based?
What about that old DOS trick of SYS or something, whereby we copied two vitally essential files (Sys.com???) to the boot sector.
Worth a try?
He who plants a seed, plants life.
-
- Panoramic Lounger
- Posts: 8197
- Joined: 25 Jan 2010, 09:09
- Location: retirement
Re: virus stopping an AV scan?
Yes, it is DOS based but the corrupt files are supporting dlls , vxds and the like, quite a few were cross linked. It's not worth the effort of trying to put it back together. Also, the owner is only really interested in the data and I've got that for them already.ChrisGreaves wrote:It may be a bit too late, but wasn't Win98 still DOS-based?
What about that old DOS trick of SYS or something, whereby we copied two vitally essential files (Sys.com???) to the boot sector.
Worth a try?
Ken