VOGONS


Possible virus?

Topic actions

First post, by HighTreason

User metadata
Rank Oldbie
Rank
Oldbie

I have noticed this has happened to several Win9X machines I have, i cannot figure out what exactly the problem is.

List of issues;
> CD-ROM drive is not visible in My Computer (I think MKE drives attached to sound cards work, I'd have to check). Works in DOS or NT.
> Errors in device manager, regardless of chipset/driver.
> MBR Modified? It still works, one of these machines has GAG installed.
> PCI Ethernet cards do not work as they should, but the problems with those are a little random.

STR0.PNG
STR1.PNG

The only real link is that these systems have Win95/98. There is a possibility that all of them have booted from floppies made by my last surviving K7 (scheduled for dismantling) which was the first machine to do this. Thing is, the K7 is pretty closed off as it was only used for Cakewalk and WinImage, software from CDs I have been using for years, nothing out of the ordinary was run on it and hard drives are imaged with a different machine so it won't be from attaching drives with other people's files on... The problem started on that around one of the many BSODs caused by the SW1000XG, pieceashit, but the drivers came direct from Yamaha's site.

Any ideas? Is there any old anti-virus software worth trying? I am tired of having to load the CD-ROM under DOS as it seems to cripple Windows' performance.

My Youtube - My Let's Plays - SoundCloud - My FTP (Drivers and more)

Reply 1 of 9, by obobskivich

User metadata
Rank l33t
Rank
l33t

There are some copy-protection schemes from a few years ago (which some games use) that can cause this, if memory serves. IIRC it can eventually lead to actual hardware damage on some optical drives too. I can't recall ever having problems with direct downloads from Yamaha's website, but that's probably not saying much.

Reply 2 of 9, by HighTreason

User metadata
Rank Oldbie
Rank
Oldbie

Interesting... All but one of these systems ran the same game at one time (I won't say which, as I think my opinions on it are controversial) and ALL of them had failure of the primary partition (so not the optical drive, but the hard drive) which could be recovered by simply doing an "FDISK /MBR" on it, but the drives would fail shortly after, usually taking another component (RAM, CD-ROM) with them...

Problem there being, the game (A lesser known FPS from around 1997/8) doesn't have copy protection as far as I am aware and the game was played mostly from backup discs, only a Pentium which has never worked properly since this bug appeared, used the original CD.

The optical drives work fine if I place them in another machine and still work fine in other operating systems on the machine exhibiting the problem.

Edit: I wonder if all Win95 boot sectors look the same, perhaps I should image one of the drives and inspect it against one that works, it may give me some insight, I'm just weary of messing up the machine I use for imaging hard drives.

My Youtube - My Let's Plays - SoundCloud - My FTP (Drivers and more)

Reply 3 of 9, by calvin

User metadata
Rank Member
Rank
Member

AFAIK, some copies of Sin were infected with CIH. Have you also ran a logged boot (from F8) and see if anything appears out of the ordinary, like copy protection?

2xP2 450, 512 MB SDR, GeForce DDR, Asus P2B-D, Windows 2000
P3 866, 512 MB RDRAM, Radeon X1650, Dell Dimension XPS B866, Windows 7
M2 @ 250 MHz, 64 MB SDE, SiS5598, Compaq Presario 2286, Windows 98

Reply 4 of 9, by HighTreason

User metadata
Rank Oldbie
Rank
Oldbie

I don't have Sin, never played it past the time I loaned it in the 90s. But CIH huh? One of the machines did land up with a corrupted EEPROM. I don't think it is CIH as many of the machines think it is 1994/5/6 so the payload shouldn't go off, but there were others that had similar payloads which might not have the time bomb.

I have located my old Avast 4 installer, it should be good enough to find anything that has gotten onto one of the machines. I will try my K5 as the Seagate in that thing is getting flaky anyway and I have a CF ready for when it breaks, so if I lose everything on the hard drive it doesn't matter much. Amusing thought, I have a copy of a ransomware I wrote named "Tivoli" on there (though I nerfed the payload a little), I wonder if that will be picked up.

Before you say anything, Tivoli had a simple payload, which was to overwrite the partition table and surrounding area with the word "PHIL IS A POOPOO HEAD - DXZEFF" - which is not present on the affected machines, Phil was the name of a complete dickhead where I worked and is the person the software was "written for" back then, the copy on the K5 has been neutered however - it only drops a text file with a rude message. In short, I know it isn't the cause. The only two copies are the one on the K5 and another on a modern machine, it requires manual installation.

My money, then, is on something like CIH showing up.

My Youtube - My Let's Plays - SoundCloud - My FTP (Drivers and more)

Reply 5 of 9, by HighTreason

User metadata
Rank Oldbie
Rank
Oldbie

Progress report, Avast will not run on the affected machines. PC Cillin will not run. Norton will not run.

I think we are indeed dealing with a virus. Also, HDD throughput on the K5 measures EXACTLY 200KB/s, which is weird and, to be honest, shitty, explains why Doom was taking its time loading.

As NT machines are not affected by this, I suppose I could run a VM and mount one of the drives to a Win9X VM running the outdated Avast! - the problem with newer Avast, such as on my Win 7 system, is I know for a fact that it does not detect a lot of older malware.

My Youtube - My Let's Plays - SoundCloud - My FTP (Drivers and more)

Reply 6 of 9, by smeezekitty

User metadata
Rank Oldbie
Rank
Oldbie

It wouldn't hurt to try it though. You might also try MBAM while you are at it.
The problem with anti-malware is no program catches everything.

Reply 7 of 9, by HighTreason

User metadata
Rank Oldbie
Rank
Oldbie

Indeed, MBAM is on the list of things to try as I find it fairly effective.

I'm still stumped as to how it got in personally. I have also inspected the boot sector, it does indeed show small signs of modification though as to the function of these modifications I have no idea.

The corrupted BIOS also showed only minor differences, but those were enough to prevent the system reaching POST. It's settled then, I'll get an XP machine wired in and mount the hard drive as a slave drive on a copy of my Win98 VM... I knew I was right to keep the Core 2 box, it isn't doing anything useful and I don't care if I break it, so that looks to be the likely candidate right now, but I need to find my IDE card as the onboard one does not work and my SATA adaptors suck.

Edit: Better idea, I'll mount a CF card instead as two of the affected machines use those and they are easier to hook up.

My Youtube - My Let's Plays - SoundCloud - My FTP (Drivers and more)

Reply 8 of 9, by ZanQuance

User metadata
Rank Member
Rank
Member

This happens all the time on my Win98 box I use for playing around with Aureal.
The only drivers which work for the Nforce3 controller on my machine are the ones WinME loads. However when ME crashes then it does the same thing your screenshots show. I read somewhere that it's a triggered safe/compatibility fifo mode, but I could never get ME to switch back to DMA properly. So I just end up reinstalling the OS. This is with a box that never touches the internet at all, so it's virus free. The only thing that gets loaded are my games off CD.

Reply 9 of 9, by fyy

User metadata
Rank Member
Rank
Member

You should fdisk /mbr and use a live cd with dd to save the first 512 bytes of the disk. Then replicate this issue where it says the MBR has changed, and load up the live cd again and dd the first 512 bytes to another file and compare them to see what changed.