A local friend’s computer was giving him problems, so I stopped by to help. I found much more than I expected.
FIRST - everything was operating erratically. A variety of programs wouldn’t work, nothing seemed to make sense. A warning kept coming up saying that the machine was infected, but no details could be found nor could the source of the warning.
SECOND - the machine wouldn’t follow it’s boot sequence. It wouldn’t boot from the repair disk or any other disk, it always went to the hard disk even though we went in and adjusted the boot ROM to change the boot order
I tried different approaches to get in but nothing worked. I recommended that my friend wipe the disk and completely rebuild it, but he didn’t have a set of distribution disks and would have to buy some. The operating system was preloaded but he didn’t have any distribution disks to go with it. Beyond this, he wanted very badly to save a collection of pictures on the disk that hadn’t been written to CD yet.
I agreed to bring the computer back to my place and work on it, but I couldn’t promise much because of all the problems. Nothing seemed to work, so I decided it was time to shift directions and move to Linux.
Working on Linux gave me tremendous flexibility AND assured me that I’d be working with a system that shouldn’t be susceptible to the problems my friend was having. I also wanted to play with some other distributions to see how they all worked. I downloaded a Number of Linux distributions and burned them to CD :
Knoppix
Trinity Rescue Kit
System Rescue CD
Ubuntu 8
Fedora 9
I had plenty of experience with Red Hat, Fedora, Ubuntu, and Debian. Knoppix I’d worked with a little as a recovery CD and as a demo CD. I have a virtual Knoppix and a virtual Unbuntu on my laptop that I use when I need Linux. I hadn’t yet tried Fedora 9 or Ubuntu 8, so this was a good excuse to work with them and I’d never tried the specialized packages ‘Trinity Rescue Kit’ and ‘Security Rescue CD’, both of which interested me.
At this point, I’ve got some of what my friend wants, but there’s more that could be done, so while I’ve got the computer I’ll play a bit. Here’s what I’ve done so far:
1) After trying to boot Knoppix and other Linux repair disks and not being able to, I disconnected the hard disk and tried again.
Once I disconnected the hard disk, I found that the CD/RW disk didn’t recognize the disk inserted in it, but the CD-ROM drive did, so I changed boot configuration and started Knoppix.
2) With Knoppix able to load now, I first did hardware checks triggering MEMTEST on boot and running it through it’s paces, then running checks on everything else I could. Except for the RW CD disk, everything appeared to be working. I tried to write CDs with the CD/RW but it didn’t recognize that there was a disk inserted. I need to do some more tests on it. For now, I can use network disks to get done what I need to.
3) I reconnected the hard disk and again was puzzled when the computer wouldn’t boot according to the boot sequence. However, I noticed that it seemed to try everything in the proper sequence as I had it set up (CD-FLOPPY-HARD DISK). With a bit more experimentation, I found that if I closed the CD door just as the boot process started, it recognized the disk and booted properly. It was replicable, so I went with that for now. I still don’t understand the boot problem, but it’s of less importance than saving the files my friend doesn’t want to lose, so I’ll come back to it if I have time.
4) I booted Knoppix and checked to make sure I could mount the hard drive. Using CLAMAV, I ran basic checks on the drive, but it failed during the process. There was no explanation, so I decided to try another system.
5) This time, I booted the Trinity Rescue Kit (TRK - another Linux bootable CD), mounted the hard disk again, and using TRK’s Virusscan to select the Grisoft AVG scanner to rescan the disk. This time I picked up several worms on the hard disk and repaired them.
6) With the disk at least cleaner, I rebooted to Windows, but it’s still so messed up it’s just not useable. More work yet to do. So I booted back to Knoppix
7) With Knoppix running and the hard disk mounted, I searched for picture files and copied them off to my network drive. At this point, I’ve pulled about 4Gb of pictures
That’s as far as I’ve gotten so far. I’ve got the pictures saved that my friend wants. I don’t want to wipe the disk because he’s out of town and won’t be back for several weeks. I need him to confirm that I have everything copied off that he wants. Once I’m sure, then I’ll help him reformat and setup his system again. In the mean time, the system is mine to play with and I want to try other tools out to see what I can do.
One of the things I’ll be playing with is some of the raw access that I wrote about in my book DOS Programmer’s Reference. A lot has changed over the years, so I’ll update my programs to handle changes in the systems as I play.
While my book is now out of print (after 4 editions), many people still find it useful for what they learned from it and for working with older systems. Some copies are still available used through Amazon.com:
Oveall, my friends computer should give me a chance to play with some of the known problems, try out some of the known solutions, and see what else can be done.