+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Check-Up] HDD Deleted Itself, Found Extra Files After Recovery (/showthread.php?tid=5683640)
HDD Deleted Itself, Found Extra Files After Recovery - 2Chode2Furious - Jul 31, 2017
So this afternoon I was looking to get a file from my secondary HDD, my OS is on a separate SSD, and the whole drive was gone. Furthermore, The HDD was what I used to backup every file I need to keep and file I cannot get anymore.
First thought was it broke but I looked into it and it was just erased. I think I may have a FUD virus or actually a rootkit because I installed a torrented Windows 7. Probably not a good idea.
Anyway, I ran some data forensics tools to recover the lost data and selected what I needed, had some older stuff that was not relevant, and came across some files that I did not select. I will provide pictures as well.
.rnd - 1kb
BROM_DLL.txt - 45kb
ComboFix.txt - 21kb
Feb 1 2016 scan.xml - 13kb
g2ldr - 177kb
g2ldr.mbr - 8kb
TDSSKiller.3.0.0.44_04.03.2015_18.54.43_log.txt - 207kb
The TDSSKiller is what concerns me the most because it is a rootkit detection/removal tool by Kaspersky. I googled it once I saw the word "killer".
TDSSKiller Log
The log files seemed to be encrypted. When I opened it the file consisted of Chinese characters and ASCII characters as well.
The same thing appeared in BROM_DLL.txt.
BROM_DLL.txt
It also appeared in ComboFix.txt as well.
ComboFix.txt
I'm not quite sure what to think here and thought I might as well ask you guys because I was just browsing a minute ago because I haven't been on here in a good while.
Thank you.
Recovered Files
UPDATE:
The recover finally completed and a new file, swapfile.sys, appeared. It is safe but I feel like I should've updated that it appeared considering I posted the picture and it was not on the list.
All my .exe's are gone and the folder that contained all my programs that I have gathered from this site also do not have the .exe's and even more files.
* - Agent Shark - Aug 1, 2017
Tacticus,
I just want to explain some of the files you were concerned about. ComboFix and TDSSKiller are both tools used to remove malware off machines. Those logs are simply reports that could have been used in a previous time where you had a malware related issue.
Is there something specific you are trying to figure out other than this? Are you experiencing any issues with your machine that lead to malware or slowness on the machine at this current time?
* - 2Chode2Furious - Aug 1, 2017
My main concern is why the HDD fully erased itself. I checked the health of the drive and it was completely healthy.
* - Agent Shark - Aug 1, 2017
(Aug 1, 2017 02:29 PM)Tacticus Wrote: My main concern is why the HDD fully erased itself. I checked the health of the drive and it was completely healthy.
Just to clarify, your current status is the computer is fully factory reset as if it was brand new correct?
There are a variety of things that could cause a wipe of an HDD ranging from malicious to software malfunction to a short circuit.
It's hard to determine. Are you experiencing any virus related symptoms currently?