tsty
|
|
hard drive with a TIME BOMB ????? <help>
| 
Feb 4 08:21 UTC 1997 |
i may have just received the first malicious piece of hardware sold
on the internet. oh, yes.
bought a couple hard drives, small, scsi (slow&narrow).
<<btw, i stopped payment on the check, sender's cod didn't require
cash, although he said it would. tuff.>>
anyway, one drive i have been able to revive with norton utilities, a
250 meg formerly-internal mac drive.
the 2nd drive, however .....
quantum 330 meg scsi in external case. hooked it up to a mac plus
and booted from floppy, sys 6.0.8. mac booted, no hd. ran a couple
of scsi mounters and such, no dice. drive sounds ok, does touchy-feely
internal stuff ... no mount. not even avaiablle/locatable/identifiable
at any scsi location. used a couple different scsi tools - nothing.
hmmm, ok, i know where there is another, nifter mac running 7.5.2 nad
some more tools.... let's go see....
hook up, power up, turn on mac 660av w/500 meg hd inside. weird, thing
starts ok, no external hd. try some scsi mount tools, nothing.
kinda ticked, doa.
went to shutdown.... screen flashes/blinks ... says something
like... delaying shutdown to rewrite name of system folder to (dot)..
W H A T !!!
just a rapid flash on the screen.. if i had not been looking, i never
woulda seen it.
shutdown completes.
turn everything off... disconnect external hd, turn mac back on.
floppy with a heart-attack-frown.
(seeth)...in extremis
brought over known good hds with some utilities and kicked up the 660av
with the both the cd-rom os and also my sys 7.1 and 7.5.2 emergency
floppies.
internal hd unable to mount, not found.
scsi bus utilities identify hd totally, but no mount.
run norton disk doctor, it finds something although i don't have a
recent enough ndd to do everything.
what it finds is an invalid node structure, the b-tree header is ?too large?
and the bit-tree map is snarfed. (excuse me, b-tree *depth* has exceeded
it's maximum ... same as 'too large', kinda)
since there *was* the notice of writing to the internal hd, and the mac
*did* put a message on the screen of this unnatural activity, i have this
Nasty&Sneaking suspicion that this external hd was loaded with
a TIME BOMB! and, btw, the 660av *always* had sam intercept running.
anyone know anything about the site saturn.wpi.org ?
anyone have any stronger scsi hd tools i could borrow (or you
could show off?).
anyone ever seen/heard of this set of symptoms?
i'm not enchanted with the idea of rebuilding a hd that has the
slightest chance of being recovered.
help!
|
tsty
|
|
response 3 of 10:
|
Feb 5 13:03 UTC 1997 |
do NOT want to format the hd .. want to recover...the 660av hd.
the external, however is a different matter, n8nxf, would be grateful for
teh assistance. when you have all inverter stuff together, i'd be happy
to use the other tools.
|
ajax
|
|
response 8 of 10:
|
Feb 10 04:46 UTC 1997 |
If you couldn't get the second drive to mount, I think it's
pretty unlikely that it launched a time bomb that messed up
the primary hard drive. To do that, I think the Mac would
have to auto-execute something on the secondary drive while
it boots/mounts it. To my knowledge, it only does that with
the boot drive. If I'm wrong, however, that would be a great
trick for a virus to exploit. Have you run a current virus
scanner on your remaining working drives?
If the seller was really trying to rip you off, they should
have sent you some rocks or something, instead of a partially
working and non-working hard drive. In serious scams, you
usually don't even get broken stuff. So I'd think that the
person thought the stuff was working. Could be wrong, though.
|
tsty
|
|
response 10 of 10:
|
Feb 25 19:13 UTC 1997 |
thankxx -- yes, i stopped paymetn on the check. for the cost of
teh stop-payment, i have a a good external scsi powersupply and case,
adn after a few initializatins/partitions/formats one of the drives
passes teh media tests from norton (anyone know of another surface
tester for scsi drives?) ...
the 330 megger is possibly irretrievable make that 'probably'. for
the moment it's on the far back burner.
the other machine is now back to normal - and it took several
passes of the new norton 3.x to do it.
yes, i popped open the case in a jiffy!. inside inspection revealed
that i sure was not the first pern to open it. a bit of a mess
but nothing i couldn't correc, and did.
stuck in the other drive, power supply works ok, that drive had
bunches of bad blocks...like i should be surprised, right?
blasted the thing with hard disk tools and did some norton stuff
adn it *seems* to be an acceptable/useable (temporarily) storage device.
|