Odd Read-Only Issue in Windows Rescue Operation
 

Hi!

I'm trying to help a friend with a Windows problem. In addition to her system crash, I'm finding some weird (to me) read-only problems as I try to fix it. I'll give as much background information as I can leading up.

What I Was Told
My friend says she has an older PC that has passed through at least two other owners before coming to her. She stated that a few days ago she downloaded a zip file containing mp3 files from a Dropbox account. Soon after extracting the files, she found that her iTunes player would no longer play mp3 files. When she tried other media players those also failed. Within a day her machine would no longer boot at all. She stated that a hastily installed malware detector "picked up something" before the crash, but she could not remember what.

What I Know
Obviously my first guess was "virus." When I examined her machine I found that it would not boot into normal mode. Attempting to boot led to a very brief Blue Screen of Death (too quick to make out the error message), followed by endless attempts to reboot until the machine was shut down manually.

Booting into Safe Mode, booting to the last good configuration, and even booting off a Windows CD all have the same effect.

I booted off a Slax Live CD, and was able to bring the machine up. I was able to mount and read her HDD, but the files on it were all Read Only. I attached an external HDD (Western Digital 3409M 120GB), intending to back up her essential files, and discovered that the external drive was also mounting as Read Only.

I attempted to use chmod to change the access privileges, but the system informed me that the external drive was read-only and that I could not write to it. umount and mount had no effect. (That is, the remounted drive was still Read Only.)

I took the external HDD back to my own system. There, Ubuntu Lucid, Knoppix, Fedore, and even the original Slax CD all mounted the external drive normally (with R-W privileges)

So, any ideas what's going on here? Why can Linux make the external drive writeable on my system, while the same distro gets only Read-Only access on the defective system? And how can I fix it?

What filesystems are on the drives ? Use ntfs-3g for read and write support.

This, however, does not explain why the external drive became writable on your system.

I would check the BIOS options of the computer and make sure there's nothing strange in there.

I would also use something like:
http://www.sysresccd.org/Main_Page

for recovery. I've found slax to be rather minimal, and not quite adequate for recovery.

If nothing else work, get the internal drive and put it in your system.

Hi, Tex! My bad, I see there were a couple of things I forgot.

The internal drive is NTFS, as far as I know. I actually didn't check, but it's a Windows system. The external drive is FAT32. But yes, the internal drive was writeable a few days ago, and the external is writeable now, just not on that computer.

I should also mention that even though it wasn't writeable, I was able to mount the internal drive and verify that the data is still there. So there wasn't any wholesale restructuring of that file system.

Well, in fact there is something strange there. I found it when I was poking around in the system, but I can't tell if it's part of the problem or not.

When I checked the BIOS I found everything set about as I would expect. However there's a password on the BIOS. You can read it, but you can't change it. I've never in my life seen this before. My friend had never had occasion to check the BIOS (she didn't even know what it was), so she didn't know what the password was or how it got there. So I can't say if it was there before all this started or not.

That was lack of preparation on my part, I'm afraid. I went in there planning to use Knoppix. But it turned out that my only live Knoppix media was a DVD, and her computer could only read CDs. The only live CD I had with me was Slax.

So what you're saying is that you can read the bios settings, but not change them ? That may be a problem. Maybe the BIOS will not let a live CD have write access. It's just theoretical, but I've seen some strange behavior caused by BIOS settings. Either way if the BIOS has a password, you may need to reset it if nothing else work:
http://www.wikihow.com/Reset-Your-BIOS
It lists some default passwords.

All I can say is to try a different live CD and hope it works, or take the internal drive and mount it separately, or reset the BIOS settings.

I was also wondering if the BIOS was affected by the virus (if there was one). You never know.

If you can't boot to the windows cd without a blue screen you then need to fix hardware. Start with memtest.

Memtest is a good idea, and since can also be disk related I would also test the disk with the utility from the manufacturer.
T reset the BIOS and get rid of the password you can also clear from the hardware side. Almost all mainboards have a jumper to do that, mostly labeled CLEARRTC or CLRCMOS or something similar. If you can't find it, search for the battery, take it out and wait for an hour. Then put it in again and try if the password was deleted and the settings were set to their defaults.

Yes, the fact that I couldn't boot off a WinXP disk caused me concern. A couple of points on that though...

1) I can boot off a Linux live CD. What sort of hardware problem would affect a Win CD but not Linux?
2) Her "Windows CD" had the label written in Sharpie marker. So I won't be surprised if it's not up to spec. I plan to try my own Win 7 system disk next time, if it's not a DVD.
3) I haven't used memtest. What should I look for?

Just FYI, this is a desktop rather than a laptop. I don't think it has a battery.

Will resetting from the motherboard return it to factory defaults, or purge the BIOS completely?

BTW, apologies for the double post. I tried to delete this one, planning to paste the text into my previous message, but I don't see an option to do that in this edit screen.

These two threads are based on the same question.

http://www.linuxquestions.org/questi...11#post4232211

http://www.linuxquestions.org/questi...12#post4232212

All mainboards have a battery, mostly it is a CR2032 coin cell. They need it to save the data in the CMOS-chip when you pull out the power cable.
Resetting the BIOS will set it to factory defaults, not purge it.

@ stress_junkie
Those links point to this thread ...

memtest runs read/write tests to RAM to see if RAM is ok. It will keep checking it indefinitely, until you stop it. Just make sure it has done one full set of tests without errors, and then you can stop it.

Have you tried to boot safemode to administrator?
Select safemode or safemode with networking at selection window then login administrator.
Try hiren's bootcd it has mini windowsxp you can access recovery console.

Well, I did try booting to safe mode. It never made it to a login screen, though. It crashed first.

I looked all over his site, and while I found the list of files he puts on his CDs, I couldn't find an ISO image or ordering information anywhere. How can I get this?

This 1 comes in zip file.
save it somewhere open and burn
http://www.hirensbootcd.org/download/

Well, I have to list this one as "Solved," but I don't know how.

I brought the machine up with Hiren's Boot CD, and both the internal and external HDD were mounted and writable. I later booted with Puppy Linux, and they were there too. The machine itself is still down (I'm working on finding that virus), but I was able to transfer the data to external backup.

Sometimes I think sacrificing a chicken is the best solution to hardware problems.