Author Topic: no access to my external Hard Drive, after putting some files in the Chest  (Read 7090 times)

0 Members and 1 Guest are viewing this topic.

Mijni

  • Guest
Hi all,

I am a new user of Avast, so I hope you will have some patience with me  :D
After an infection with a backdoor Win32 Trojan Horse, from which I was not protected by F-secure (the anti-virus provided by my Internet provider), I installed Avast... and Avast found quite some rubbish on my PC!
I decided to do a full system recovery, then I ran Avast, also over my external Hard Drive and as a result some files were put into the Chest.
But it wasn't until now that I discovered I could no longer reach the external HD. Even Avast no longer finds it!

The external HD is partitioned in F: G: H: I:
Now when I check "My Computer" only F: is visible. But F: "is not formatted, do you want to format now?" NO!!! This HD contains all my scanned slides, thousands of them!!! And all my backups!

This is the full content of the Chest:

A0000218.Inf in F:\System Volume Information\_restore{9B2640BF-AB83-4FD2-8EDA-B0FCC526FCC8}\RP5 containing VBS:Malware-gen
A0000476.Inf in G:\System Volume Information\_restore{9B2640BF-AB83-4FD2-8EDA-B0FCC526FCC8}\RP9 containing VBS:Malware-gen
A0000477.Inf in H:\System Volume Information\_restore{9B2640BF-AB83-4FD2-8EDA-B0FCC526FCC8}\RP9 containing VBS:Malware-gen
AutoRun.Inf in F: containing VBS:Malware-gen
AutoRun.Inf in G: containing VBS:Malware-gen
AutoRun.Inf in H: containing VBS:Malware-gen
AutoRun.Inf in I: containing VBS:Malware-gen
cryptnet21.dll in C:\WINDOWS\SYSTEM32 containing Win32:Trojan-gen {other}
IPv6.dll in C:\WINDOWS\SYSTEM32 containing Win32:agent-ACRH[trj]
NvCpl64.dll in C:\WINDOWS\SYSTEM32 containing Win32:agent-ACRH[trj]
ReSSDT.sys in C:\WINDOWS\SYSTEM32 containing Win32:agent-ACRH[trj]
Thumbs.0nk in G: containing Win32:agent-ACRH[trj]
Thumbs.0nk in H: containing Win32:agent-ACRH[trj]
Thumbs.0nk in I: containning Win32:agent-ACRH[trj]
Uninstall.bin in C:\WINDOWS\SoftwareDistribution containing Win32:agent-ACRH[trj]
WinXP.bmp in C:\WINDOWS\SYSTEM32 containing  Win32:agent-ACRH[trj]

I tried restoring the Chest files of F: G: H: and I: (not the C: ones), but they cannot be properly restored: they were restored with faults, as Avast reported. And still no access to the external HD.
Now what can I do?
Please, please, can someone help me? I feel quite desperate!  ??? :'(

Avast 4.8 home edition
Windows XP Home SP 3

Thanks in advance,

Mijni

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Can you download and install Easeus (http://www.partition-tool.com/) and check if the partitions are still there?
If not, you can consider Partition Doctor (http://www.ptdd.com/ptdmoreinfo.htm). But it's not free.
The best things in life are free.

Mijni

  • Guest
Thanks for your quick reply!
Yes, the partitions are still there.... H: and I: were empty, but F: and G: are located, with their original name. So they must be there... I just can't start them..
Easeus does not seem to have other options than to format the partitions.
I also download the Data Recovery Wizard.... it's searching now...
Apparently the data are still on it... I will have to read a lot first, before taking any action!

Regards

Mijni

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Do you have another computer to test the external drive?
The best things in life are free.

Mijni

  • Guest
Unfortunately not... but Easeus has reported that the two partitions with data are "unformatted", the other, still empty, partitions are still formatted. So an other computer wouldn't access the HD either.
Easeus Data Recovery is scanning now, but that will take several hours!

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Unfortunately not... but Easeus has reported that the two partitions with data are "unformatted", the other, still empty, partitions are still formatted. So an other computer wouldn't access the HD either.
Easeus Data Recovery is scanning now, but that will take several hours!
Seems the partition was affected... It won't be easy to recover...
The best things in life are free.

Mijni

  • Guest
Tomorrow a friend will come with some software to recover picture files from blocked media , and put it on an other external HD...  With some luck I can re-format my external HD and put the pictures back on. Wish me luck!

Regards
Mijni

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Wish me luck!
Sure I wish.
Please, post back the results.
The best things in life are free.

Mijni

  • Guest
Well, he tried PC Inspector Smart Recovery and Photo Rescue PC, but to no avail.
I was just about to find a company to recover lost data, when I found another strange thing. A 2.0 USB hub, connected to a recently installed USB 2.0 PCI card, did not work properly. The hub had a long extension USD cord... and this hub with cord was connected right next to the external HD on the same PCI card. I reconnected the hub without the extenson cord and then I suddenly had access to the external HD again, probably the USB extension cord to the HUB was too long, which caused trouble with the HUB. So when I took the extension cord out, I could suddenly access the external HD! It wasn't stabile though... cause after restarting the HD was gone again. Next I connected the HD to a slow USB port, and everything suddenly was accessable again, and working properly....
So I suppose the problem lies in the 2.0 USB card...
When closing down there was a pop-up telling me there was something that H:\$ secure was damaged and that I had to do a chkdsk, which I did with EASEUS.
I'm still trying out other things.... like de- and installing the drivers for the USB card. Didn't make a difference, I'm afraid.
Thank you for listening and thinking with me!

Offline scythe944

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2913
    • My Tech Blog
I don't know how long exactly the, "long USB extension cord" was, but USB does have a few limits:
Quote
Q2: Why can't I use a cable longer than 3 or 5m?
A2: USB's electrical design doesn't allow it. When USB was designed, a decision was made to handle the propagation of electromagnetic fields on USB data lines in a way that limited the maximum length of a USB cable to something in the range of 4m. This method has a number of advantages and, since USB is intended for a desktop environment, the range limitations were deemed acceptable. If you're familiar with transmission line theory and want more detail on this topic, take a look at the USB signals section of the developers FAQ.

Read here for more info:

http://www.usb.org/about/faq/ans5/

Of course, some USB devices may be more sensitive than others.  Usually, you'd want to have a USB external Hard Drive plugged directly into the computer's USB receptacle instead of a hub to make the connection faster.  Leave mice and webcam's etc, connected to the hub.

Hope you got it fixed though.  ;)
For generic computer (not avast) problems, you can also visit my forum for help: http://www.jacobytech.net/forum

Mijni

  • Guest
Yeah, NOW I know about the maximum length of the extension cord!  :-[ It was 5 m long, the only one available in the shop where I went to buy one. Plus the 1 m that was already on the hub... makes it 6.
But still, the HD was not connected to the hub. In fact nothing was connected to the hub, it was there to be used incidentally.
The HD and the hub were both plugged in the PC's new 2.0 USB card (receptacle)!
I still don't understand how the one affects the other! But I'm glad I found out.... And that the data are still on the HD.
Now when the HD's are getting cheaper all the time, I am planning on buying another one, transfer the data, reformat the 1st HD, and keep them both as backups.