LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Boot virus or Anti-Virus? AVG Free Anti-Virus Software problems (https://www.linuxquestions.org/questions/linux-security-4/boot-virus-or-anti-virus-avg-free-anti-virus-software-problems-212274/)

SparceMatrix 08-01-2004 06:08 PM

Boot virus or Anti-Virus? AVG Free Anti-Virus Software problems
 
I just installed AVG Anti-Virus Software Free Edition by www.grisoft.com from my Windows XP installation. I managed to reboot once, but when I actually ran the software to look for viruses and rebooted again the next morning, my BIOS could not find my hard drive. I get "Primary Master Drive Fails" error messages on booting. I'd ask Grisoft about what might be going on, but they will not even talk to you unless you purchase their full professional version. Yes, I am kicking myself.

But, a benefit of a doubt suggests maybe the software is not linux friendly and is interpreting my boot loader (Not LILO, the other one now installed automatically with RedHat 8.0). Any ideas about how to get my hard drive back? How can I clean things up without trashing my hard drive? Something is there, because when I ask the BIOS to "Match Partition Table", my boot loader comes up. When I select my DOS partition, I get loading errors and I have to reboot. When I try it again, the boot loader will not come up. The AVG software had me go through a rescue disk, but it kept asking for floppies and I figured something must be wrong. When I tried to load a rescue disk on a buned CD, it didn't work. So, no AVG rescue disk either.

Any and all suggestions would be appreciated.

k1mgy 08-01-2004 06:33 PM

I wonder if AVG mangled your partition table?

If there's any way you can boot up with a linux floppy or CD you can run:

/sbin/fdisk -l /dev/hd[a-z]

and check your partition table.

Others may have more elegant ideas/

I examined AVG and found it to be OK, but the support is poor and the updates are questionable. I've stayed with McAfee Virus Scan 7. Went to 8 but, in a work, it sucks.

There's also a bunch of windows-type partition table and recovery programs that I found in a listing. I can't vouch for any of these as I've never had to use them.


FFAT29
http://inet.uni2.dk/~svolaf/ffat29.zip

Acronis Recovery Expert
http://www.acronis.com/products/recoveryexpert/

Active@Partition Recovery
http://www.partition-recovery.com/

DiskPatch v1.0
http://www.diydatarecovery.nl/~tkuurstra/DiskPatch.htm

FixDiskTable - uses Linux OS, but recognizes all partition types
http://bmrc.berkeley.edu/people/chaffee/fat32.html

GNU Parted - uses Linux OS, but recognizes all partition types, but doesn't scan to find the lost partition table
http://www.gnu.org/software/parted/parted.html

gPart - uses Linux OS, but recognizes all partition types, scans and guess partition info and can restore it.
http://www.stud.uni-hannover.de/user/76201/gpart/

Test Disk v5.2 - for DOS, Windows and Linux - will need to be compiled with CygWin
http://www.cgsecurity.org//index.html?testdisk.html

Winternal's Disk Commander
http://www.winternals.com/products/r...dex.asp?pid=ap

FDISK. If you know what your partition table looks like, you *should* be able to go into fdisk and recreate the partitions. But you MUST do it exactly as it was before!!

SparceMatrix 08-01-2004 06:42 PM

Yes, of course. fdisk. Thank you very much. I'll be busy tomorrow with this good information.

Anybody else?

SparceMatrix 08-01-2004 06:45 PM

I should add for anyone with similar problems, the idea is to at least have a look with fdisk. You wouldn't want to go in and reformat or repartition, you would wipe everything out.

k1mgy 08-01-2004 06:48 PM

That's a very good caution. I've never done it, but understand that if you run fdisk it may write some stuff out anyway.

Here's a switch that just looks, for what it's worth:
fdisk /status

SparceMatrix 08-01-2004 09:35 PM

I tried fdisk and it cannot find the hard drive either. I should have known and should have said that I tried "linux rescue" from my RH 8.0 installation disk and it couldn't find the installation either.

k1mgy 08-01-2004 09:53 PM

Prehaps this will help... there are a number of partition table fixers out there.

http://www.majorgeeks.com/download4129.html

SparceMatrix 08-01-2004 10:12 PM

Quote:

Originally posted by k1mgy
I wonder if AVG mangled your partition table?

If there's any way you can boot up with a linux floppy or CD you can run:

/sbin/fdisk -l /dev/hd[a-z]

and check your partition table.

Others may have more elegant ideas/

I examined AVG and found it to be OK, but the support is poor and the updates are questionable. I've stayed with McAfee Virus Scan 7. Went to 8 but, in a work, it sucks.

There's also a bunch of windows-type partition table and recovery programs that I found in a listing. I can't vouch for any of these as I've never had to use them.


FFAT29
http://inet.uni2.dk/~svolaf/ffat29.zip

Acronis Recovery Expert
http://www.acronis.com/products/recoveryexpert/

Active@Partition Recovery
http://www.partition-recovery.com/

DiskPatch v1.0
http://www.diydatarecovery.nl/~tkuurstra/DiskPatch.htm

FixDiskTable - uses Linux OS, but recognizes all partition types
http://bmrc.berkeley.edu/people/chaffee/fat32.html

GNU Parted - uses Linux OS, but recognizes all partition types, but doesn't scan to find the lost partition table
http://www.gnu.org/software/parted/parted.html

gPart - uses Linux OS, but recognizes all partition types, scans and guess partition info and can restore it.
http://www.stud.uni-hannover.de/user/76201/gpart/

Test Disk v5.2 - for DOS, Windows and Linux - will need to be compiled with CygWin
http://www.cgsecurity.org//index.html?testdisk.html

Winternal's Disk Commander
http://www.winternals.com/products/r...dex.asp?pid=ap

FDISK. If you know what your partition table looks like, you *should* be able to go into fdisk and recreate the partitions. But you MUST do it exactly as it was before!!

I tried fdisk -l /dev/hda and got nothing back. Does that mean my partition table is gone? How do I explain the fact that I was able to get a glimps of GRUB, even if just once?

Some of the above links do not appear to be useful because they require some kind of backup to be made in advance. Some of the others like parted are simply too technical for me to understand how they might be useful. gPart looks like it has the most potential.

Here is another interesting aspect of the problem. My Automated System Recovery disk generated by MS's backup software does not work. I am prompted to remove all media and press any key to reboot and I'm met with the same missing system disk error.

SparceMatrix 08-02-2004 12:03 PM

I had backed up my Windows XP installation with the Automated Systems Recovery Wizard. I thought I had tried to use it and failed, but I had tried it incorrectly. First you must apply the installation CD and then go to ASR. What happened was that I was prompted for the floppy and it read it and kept asking for it. I figured nothing was going to happen, so I tried going to the rescue mode in the installation CD and found I could log in. So, somehow, my partition table had been restored and sure enough I rebooted and found GRUB fully intact and was able to log in normally where I promptly ripped out AVG.

So, PROBLEM SOLVED. Thanks to all who tuned in.

peter_robb 08-02-2004 02:35 PM

So a caution for the future..

There are several anti-virus programmes out there that offer to scan/rectify MBRs
It's pretty obvious they can't handle grub, although some can recognise LILO

Make sure that option is off if you have a non-M$ bootloader in the MBR
and make a boot disk for the distro.. ;)
(I must have a trawl and see if MBR viruses can move LILO or Grub out of the MBR...)


All times are GMT -5. The time now is 04:43 AM.