Virus Crippled HDD

yashasinitski

Honorable
Jul 10, 2013
4
0
10,510
Hey folks,
I'm kinda new to this community. Long time reader, new poster. Anyways, I have a Mac Air and a custom PC, and due to school travel the desktop PC is off a lot of the time. Recently I checked my bank account, and noticed around $800 missing. After doing some digging, I narrowed it down to my computers. I THINK someone had access to one of them. No way to be certain, as neither system showed any abnormalities nor did the scans find anything. The account is online only - the computers are the only way they could have been accessed. To be safe, I decided to wipe both and reinstall the OSs. Mac if fine - PC is not. Upon formating the PC drives from Win7 CD menu (120GB SSD and 2TB HDD), and installing Win7 on SSD again, I thought everything was dandy. Went into My Computer and Device Manager - no HDD.

Rather, it's there, but instead of 2TB, it's showing 100MB. SSD is perfect, CD drive is accounted for, but HDD is messed.

Specs for system are as follows:
Asus Z77 Sabertooth Motherboard
i5-3570K
16GB RAM
GTX 670
120GB SSD + 2TB HDD


Any help would be appreciated.
Yasha
 
Solution
First before you proceed, is all your important data that was on the 2tb drive already backed up and you dont need to access the drives data?

If you have everything you need backed up already then
run diskmgmt.msc
The 100mb system partition is likely to be on the 2tb. {For it to have been on the SSD you should have installed win7 with the HDD unplugged.}
If the rest of the space on the 2tb is reading unallocated rt click on it and then select 'New Simple Volume' then follow the prompts to select the size and assign a drive letter.

If that part of the drive is listed as something else, possibly because a viruse encoded the partition, then rt click and delete it and the use the above to create a new simple volume again.

USAFRet

Titan
Moderator
That 100MB is the System Reserved partition, that holds the boot information. Usually, when you install Windows on a system with 2 or more drives, Windows put the boot info on the second drive.

The rest should be seen as unallocated space.

This is why it is generally advisable to only have the desired boot drive connected when installing Windows. Weird, I know.
 

yashasinitski

Honorable
Jul 10, 2013
4
0
10,510
So at the moment, I have my main drive, with Win7 on it (120GB SSD), and some "system reserved partition".

Thanks for clarifying that. But how do I get my 2TB back? THAT'S my main concern, aha.
 

popatim

Titan
Moderator
First before you proceed, is all your important data that was on the 2tb drive already backed up and you dont need to access the drives data?

If you have everything you need backed up already then
run diskmgmt.msc
The 100mb system partition is likely to be on the 2tb. {For it to have been on the SSD you should have installed win7 with the HDD unplugged.}
If the rest of the space on the 2tb is reading unallocated rt click on it and then select 'New Simple Volume' then follow the prompts to select the size and assign a drive letter.

If that part of the drive is listed as something else, possibly because a viruse encoded the partition, then rt click and delete it and the use the above to create a new simple volume again.
 
Solution

yashasinitski

Honorable
Jul 10, 2013
4
0
10,510


Thanks for the info. I got the HDD working again. I have 3 drives now under My Computer now - SSD, system partition (100MB), and 2TB HDD.

Is the system partition there to stay? It doesn't bother me at all, just curious if I can get it somewhere else somehow.
 

popatim

Titan
Moderator
Run diskmgmt again and rt click on the system partition and select 'Change Drive Letter'
once you are in that windows, check off Remove. and ok.

This will stop you from seeing it listed as a drive in explorer.

You can remove the system partition but its a royal pain and sometimes leaves you with needing to run startup repair 3 times and if that doesnt work then you have to reinstall windows. Its 100mb... nothing to worry about compared to 2tb (2 million mb - LoL)
 

popatim

Titan
Moderator
BTW - I recently got my grandson an iPod for his birthday and I set it up with a nice strong password.. his iTunes account was hacked into a week later. I did some research and found its fairly common and they usually drain funds by making iTunes purchases. Luckily I did not link any of my CC's to his account so they got nothing! LoL

So if you haven't found how $800 was drained from your account. Check your iTunes purchases.

I beleive they actually hacked in thru iCloud and not iTunes but they use the same logon.
 

yashasinitski

Honorable
Jul 10, 2013
4
0
10,510
Got the solution, thank you so much.

As for the $800 - $600 of it was actually a Dyson vacuum cleaner. Crazy expensive. I found out when it quite literally arrived at my door step, with no signature required after work. Upon inspecting the receipt, I noticed that the billing information was cobbled together. It was an older account, my new address, and my cell phone number (with a mistake in the number, a digit off). The rest of it, $200, were actually itunes purchases that happened over 2 days.

I guess you're right about the CC details for Apple, never doing that again. Sticking to prepaid gift cards from now on. Thanks!

Thought I would say quickly, the bank was notified and I got my money back from everywhere it was spent. Account gone though :(