Virus Corrupted Disk Erase

[psifi]

I had a virus take over my laptop that simply won't go. I want to use Diskpatch to secure erase the drive to get rid of it. However, I ran into the following problems:

1. The regular Diskpatch would not load via floppy. It only got so far and hung.
2. I downloaded the Win98dos version and made a boot CD. That brought up the drive.
3. When I tried a read only surface scan, it stated the partition information was wrong and would not run.
4. I couldn't save an analysis file so I made a boot floppy and have attached the file.

Anyway, my question is, how do I need to set the secure erase to be sure to totally wipe out the disk so I can start it over again? The surface scan parameters don't seem to work so based on the drive configuration, what start and end do I need to put in for the secure erase?

Thanks.

[Tom]

If all you have to do is erase the disk then first erase the MBR (look in the "MBR related tasks" menu). This will kill all partitions, and then start the full disk erase.

Are you sure the disk is correctly recognized by the PC? It seems that there might be a problem with the disk's size, meaning the disk may be larger than is showing now. What is the disk's real size? Find more info here: www.48bitlba.com

[psifi]

The actual disk size is 160GB but the bios is older and doesn't recognize the full size of the disk. In bios, it shows as 127MB.

Diskpatch with Linux doesn't boot but it does with dos. However, it says there is a disk overlay problem. It won't do the wipe because it shows two different partitions when there is only suppose to be one.

I figure the virus is preventing the laptop from booting into linux but doesn't mind dos because it has it compromised. An attempt to reformat appeared successful but then, all sorts of errors trying to reinstall windows. Errors trying to install the service packs, etc.

I am going to get an adapter and hook the drive into a desktop and try the wipe again. I figure I need to do a complete wipe to get rid of the problem. I will wipe out the MBR before I try the wipe and see if that works.

With the drive removed from the laptop, it booted into Ubuntu just fine. With the drive installed, Ubuntu showed errors and then never made it to the desktop. The same with the standard diskpatch boot disk. It would start and then hang up.

Thanks for the help. Much appreciated.

[Tom]

Are you sure the disk is healthy? Sounds like it could also be a disk health problem, maybe it's worth checking this; run a disk health check.
http://www.diydatarecovery.nl/dp_manual/guide_smartcheck.htm

[psifi]

Smartcheck shows the disk as 100% healthy; I am attaching the report.

Since I haven't got an adapter right now, I put it back in the notebook and started Diskpatch. Diskpatch initializes ok now. However, when I go to do the wipe, it is showing me the starting point as 63 and ending 312576642. when I select this, I get the message The values for the start location ... are invalid.

Diskpatch is seeing the entire formatted disk showing it to be 149GB. However, it isn't wiping it because of where it starts.

I haven't wiped the MBR yet as I wanted to see if I could get diskpatch to initialize correctly which it apparently did. It only did this after I reinstalled windows after an attempted reformat. However, something is still not right since it won't let me wipe and says it starts at 63.

I don't know if putting it in a newer machine will change this. Any ideas? I need to clean this drive off and get it working again, virus free.

Thanks

[Joep]

Diskpatch initializes ok now. However, when I go to do the wipe, it is showing me the starting point as 63 and ending 312576642.

Did you try the bottom option: "Select region manually/Entire disk", and then accept suggested values?

[psifi]

I am trying it now. It suggested starting at 0 so I accepted it. Hopefully, it will totally wipe it out.

The suggested start was 0 rather than 63 so I assume it is wiping out the boot area with the virus.

Is the standard diskpatch wipe sufficient?

Thanks for the help.

[Tom]

That's why I suggested the MBR wipe in the beginning...

Anyway, to kill a virus, if that is indeed the problem, a standard wipe is sufficient.