WGAs Revenge.
Dear Friends,
Yesterday when i tried to boot up my computer a badge like thing appeared,
Something like your software may not be genuine etc .
But I am having a legit CD of WinXP SP1 & they also have supplied earlier a free CD of SP2 to me ,I never use any pirated Cd's whatsoever.
The major fact is my Project Drive where I keep all my Files (VB) & develop softwares or programmes, was completely formatted.
this happend like this.
While the Badge like thing appeared it stayed there for a while then my Computer rebooted.It went on rebooting until I switched it off then I installed my hard disk in a second computer where i saw the Drive (H:\) is totally formatted.The Windowsfolder was also deleted!
only few little titbit files were left there which are eventually of no use to me.
What Can I do for this?
Can anyone help me out in this aspect?
Rahul
[930 byte] By [
dsrahul] at [2007-11-19 22:40:26]
# 1 Re: WGAs Revenge.
Sounds to me like malware. However, if there where some files left, then the drive was not formatted, thus there may be a chance of data recovery. Even data on a formatted drive can be recovered using "Unformat", or some such thing, though I've never tried to use it. Apparently it's part of the FAT32 stuff, and I would be surprized if something similar wasn't available for NTFS as well. I haven't looked into that.
There are undelete programs you can try, but if it was malware, that may still be on the drive too, especially once you manage to recover lost data. So I'd not try booting with it afterward. The most important thing here is DO NOT WRITE TO THE DRIVE BEFORE ATTEMPTING RECOVERY!!! At least that is in the case of FAT. Unless the actual data has been overwritten, then it's still there. Heck, even win3.11 had an "Undelete" option on the menu, though I think that requires manually entering a first letter for every file you want to recover. Not certain as I never had win3.11.
Here's something that may help:
http://service1.symantec.com/SUPPORT/nsw.nsf/0/2c9af48d5ee1530185256c370048ada7?OpenDocument
# 2 Re: WGAs Revenge.
You need SpinRite ( http://www.grc.com/intro.htm). It is the only program that can recover anything that is possibly recoverable. It is written by Steve Gibson in assembly.
# 3 Re: WGAs Revenge.
Nice link peejavery! :thumb:
# 4 Re: WGAs Revenge.
Nice link peejavery! :thumb:
Thank you. I have been listening to a Podcast with Leo Laporte and Steve Gibson. Steve Gibson is probably the world's smartest man about security.
Check out Security Now! ( http://www.grc.com/securitynow.htm) It has kept me tied down for days.
# 5 Re: WGAs Revenge.
To all of my beloved friends,
Wiz suggested something(as he always does,quite helpful guy),which is applicable for DOS times.Unformat /Undelete does not recover anything from WInXP or Me drives.
NDD says unknown disk format.
Pctools says disc not found.
Norton Disc editor =unable to find disk.
Undelete results in "No wild strings" "??.?" or **.*** found.
cannot proceed further.
Peeja said use spinrite but spinrite is expensive & they dont provide trial version.
I feel like deserted & alone now,I have 2 projects to be submitted by next monday.
I think I'll commit something bad.
Rahul
# 6 Re: WGAs Revenge.
I have a few questions for you:
Is it NTFS?
Is it partitioned?
If NTSF, have you checked the recovery console for any tools that may help?
In the case of FAT32, FDISK has a command line switch to rewrite the Master Boot Record: /MBR. If the boot sector is corrupted, the data may not be found even if it's intact AFAIK. I have not checked for what the recovery console might have for this type of thing. Formatting the boot sector in this way wipes out boot sector resident boot managers/viruses, but leaves all data unchanged. Also try to verify that the drive is being detected with the exact same numbers for heads, cylinders, etc as it was before. If your mobo has boot sector write protection, and it's enabled, then chances for it to have been overwritten without prompting you are slim if at all.
If I think of anything else to add I'll post it.
# 7 Re: WGAs Revenge.
Peeja said use spinrite but spinrite is expensive & they dont provide trial version.
Alas, you are correct. It is expensive but it is the only one of its kind.
# 8 Re: WGAs Revenge.
Its simple FAT32
& I feel scared to use the command Fdisk/mbr
The disk is displaying (Actually the size is 8 GB) "4095mb free space."
I feel the data is there but it got hidden somehow.
I found one of my 256mb DDR is defective.
But even after replacing it nothing improved.
Rahul
# 9 Re: WGAs Revenge.
Its simple FAT32
& I feel scared to use the command Fdisk/mbr
The disk is displaying (Actually the size is 8 GB) "4095mb free space."
I feel the data is there but it got hidden somehow.
I found one of my 256mb DDR is defective.
But even after replacing it nothing improved.
Rahul
That seems to suggest the disc is half full, or the disc is being detected incorrectly. What I mean about detecting is in the BIOS, not what windows sees. Anyway, I can understand your hesitation to try fdisk. If you have a spare drive, try it there first and see what I mean. It works in the blink of an eye. It doesn't write all over the drive.
That's another reason I think the data is there, because to delete so much would probably have taken a lot of time, even though deleting a file doesn't overwrite the sectors with zeros. I'm not certain how long it might take to just delete directories. You say there are some files left - are these all in the root of the drive, or in a folder, and are they in the place they are supposed to be?
I wonder if scandisk would find anything, but I would NOT do anything to change the data of the drive until I was certain of what was wrong.
As for the cost of SpinRite, only you can compare it to the cost of losing your data.
# 10 Re: WGAs Revenge.
I hope i'm not late in replying to this thread...
But there are 2 options i usually use if i encounter something similar as yours.
1.) i would buy Administrator's Pak (http://www.winternals.com/Products/AdministratorsPak/EvaluationRequest.aspx) from Wininternals...but it's too expensive if you're not working. Actually much more expensive than SpinRite but it's really useful.
2.) 2nd option would be using those LiveCD and try to copy the files out with it. At least you had a backup copy. But the process is tedious.
I hope my 2cents really helps you. :p
e_har at 2007-11-10 3:49:18 >
# 11 Re: WGAs Revenge.
Dear All of you lovely friends,
By your love blessings & guidance I got it back ! Yes all of them by using "Disk Guard"
by peter norton created in the yester years.
I never expected that this software would be working like this.It just said"Fixing Disk Problems" withing 2 secionds the Disk is back to Square 1 Again.
Thank you pals Thank you friends for all your efforts & encouragements.
# 12 Re: WGAs Revenge.
I'm glad you got it fixed!
It makes sense that it fixed it quickly, since it was messed up quickly. Is there a site for the software you used? I looked but didn't find any reference to it.
# 13 Re: WGAs Revenge.
I'm glad you got it fixed!
It makes sense that it fixed it quickly, since it was messed up quickly. Is there a site for the software you used? I looked but didn't find any reference to it.
Yes wiz,
I had that in a floppy from my DOS times.
I never expected it to work for me now in windows ME Edition.
Anyway it worked if you feel, I can send you the Program.
Rahul
# 14 Re: WGAs Revenge.
Yes wiz,
I had that in a floppy from my DOS times.
I never expected it to work for me now in windows ME Edition.
Anyway it worked if you feel, I can send you the Program.
Rahul
Well, the OS isn't what matters here, but the disc format itself (in this case FAT32).
If the program is freeware/shareware, then yes I'd like a copy :)
# 15 Re: WGAs Revenge.
Hey, if it is freeware, I will take a copy too. I use Mac but at work I have to program on a PC.
