Solved

Virus - No Disk

Posted on 2013-05-17
33
938 Views
Last Modified: 2013-12-06
Hi everyone,

recently I am having difficulties with this agent:

---------------------------
Any.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

Any suggestion?
Thanks
0
Comment
Question by:Samuel-AMC
  • 11
  • 6
  • 3
  • +5
33 Comments
 
LVL 3

Expert Comment

by:phoenix5ire
Comment Utility
Not exactly sure if this is a virus, sounds like a device error. When are you getting this message, is this a random message or it pops up when you attempt to access a hardware device (i.e., CD/DVD, USB, etc,..) ?  

Also, are there any entries in Event Viewer that is log when this message appears?

Thanks.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
I'm 100% sure this is a Virus, I was reading about it last night, but there was
not that much of info on the Virus, but it is a proccess that get hooked into
every single running .exe file, and it give the name of the file, for example:

---------------------------
notepad.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

---------------------------
Winpatrol.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

and so on, I have my ZoneAlarn firewall which I denied every attemp on this No Disk
Virus.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
This is the error in real time, and then I have to click like 7 times for the error
to go away, then 10 seconds later it shows again, is annoying, there are no USB
or anything pluged in the machine!
No Disk
0
 
LVL 18

Expert Comment

by:awawada
Comment Utility
Did you try this KB?

http://support.microsoft.com/kb/330137/en-us

Do you have Windows XP?
0
 

Author Comment

by:Samuel-AMC
Comment Utility
This problem is on Windows 7, and about that Microsoft page, yes, I saw that before
I asked this question here, once again, this is some kind of hooking Virus.
I will post some more info on this tomorrow, the virus take down any disk and make
or create two files on the disk, autorun.inf and a weird name file, now that I've been
checking on the virus and managed to get control on the virus, the virus changed the
way it drops the eggs, now the name of the .pif file is not .pif is .com and .exe
then after getting rid of both files and clean the virus, the virus still somewhere in
the pc as when everything seemed to be gone then I see an alert from the windows
firewall. but this only happend if I get to run a file, for example, notepad.exe or any
file, like ccleaner for exaample, then the windows firewall popsup and ask if I let
ccleaner run or what ever, then when I see that happend I know the virus born again.
I can get rid of it, but everything started with the NO Disk, which I know is a Virus.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
Plese take a good look at this example very well
These are the two droped infection by the Virus,
These files keep reapiring in my C:\ drive over and over again, no matter how
many times I get rid of them with all the tools I got, malwarebytes, combofix,
malwarebytes anti-rootkit, and so many other good anti-everything and still...
VirusThen this is the content of autorun.inf
[AutoRun]

;
;uLnt bUrWlqoiV
shell\ExpLOrE\COmmANd =fwvog.pif
;FrbBwQ 
sHElL\open\DeFault=1
opEn= fwvog.pif
;sdal 
sHeLl\oPen\COmmand =fwvog.pif

;vaeMBxaOusb MsiAVmcndKJ
shElL\aUToplAy\ComMAnD=fwvog.pif

Open in new window

My USB pen-drives are protected, thats why I got them clean still.
the droped infection sometimes is .pif some other time is .com
and some other times is executable file, i mean, .exe, etc.
0
 
LVL 3

Accepted Solution

by:
phoenix5ire earned 167 total points
Comment Utility
Thanks for the additional info, it helps give a better idea the overall picture of your problem.

Sounds like this problem, check to see if this helps:
No Disk virus

We recently ran into this issue with some of our file servers and our AV didn't catch it, see if this is your problem as well:
Hidden Files and Folders become .exe

Thanks.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
Thanks phoenix5ire, let me put these tips to the test and I will be back and let you know,
But just to give you an idea, in the past I used to face a virus that used to turn folders
into exe files and then make you click by mistake on them, but this time is not about
those folders, this time this virus hook into good exe files and actually the exe run ok,
but the virus run from there, thats the problem, and then when you try to look for a
possible process running there is none!
0
 
LVL 3

Expert Comment

by:phoenix5ire
Comment Utility
Can you also go into Safe Mode and see if you're seeing these No Disk errors. See if you can duplicate this problem while in Safe Mode. This would give a better idea if the virus is loading before or after OS starts.

Thanks.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
phoenix5ire, I tried the steps from the first link you posted
Yeah, the: No Disk virus but those instructions are either old
or for a diferent virus type, cuz none of that info is related to the virus I have.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
I can't request more help on this question because I already did, and nobody here
seemed to know what my question is all about, searching on google found many
forums with this same issue, but mine is a bit diferent, I wonder is there is more
help to ask here in EE, otherwise there is no good for me to keep asking here.
Sorry phoenix5ire. and thanks for trying to help.
0
 
LVL 47

Assisted Solution

by:dlethe
dlethe earned 167 total points
Comment Utility
A virus didn't kill the disk drive.  Prove it yourself by booting the system to a copy of linux you load on a USB stick.  (Go to ubuntu.com to see how to do this).

Once you can verify that the hardware is either bad, or perfectly fine, you can either go shopping, or start looking at device driver issues.
0
 
LVL 23

Expert Comment

by:ComputerTechie
Comment Utility
I recommend this. Go to a clean compute and get a USB stick with nothing on it. Next download from hitman pro website. Their 30 day trial. Next when installing it created the boot able version using usb . Next boot the computer up with the USB stick and it will ask you if you want to bypass MBR say yes. This should allow you to do a complete scan and find the virus. If USB will not work I recommend something like virperescue and create a boot able media.

CT
0
 

Author Comment

by:Samuel-AMC
Comment Utility
modus_operandi: I changed the zones for this question from:

"Anti-Virus, Anti-Spyware, HijackThis Software
to
Anti-Virus, Anti-Spyware, HijackThis Software, Microsoft Windows Operating Systems".

Huh? ...woow what a big change! ...all you did is add OS which have nothing to do with
my question, and I added three zones to my question which it was good enough for any
expert to provide an answer, but the true is that there are no experts here thats all.

Now as for dlethe and ComputerTechie
I am more than disappointed with the information given here...
If this was a negligence I'll sue EE for wasting people's time and provide information
that is not. sorry but you guys need to learn more about infection.

I already collected a lot of information about this issue, it is a Virus, is hard to get rid
of it, but so far I'm taking care of it myself with out wasting my time here.
this place is nothing but a waste of peoples time.
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Problem resolution 101 .... Determine what is known good & known bad.  You can't trust any software-based diagnostic tools to determine health of the hardware if you are booted to an infected O/S.  

You also can not eliminate the possibility of multiple problems.  If this was an easy thing to fix, then it would have been resolved by now.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
dlethe:
"If this was an easy thing to fix, then it would have been resolved by now."

Thats the reason why I posted my question here, to see if some one knew the asnwer.
on the other hand, every day I solve big problems and issues myself, and I don't ask for
any help here, but sometimes I do cuz I'm very busy, but thats the point, if you can ask
for a solution that somebody already had, thats a time safer. but in this case what makes
me feel so desapointed is that I already provided a very small portion of the issue, and
nobody have come across of what the issue is, and there are hundreds of places that
came out fast with that the issue is.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Based on the information you posted, you can not eliminate an intermittent HDD problem, which may exist independently of a virus.  A 5 minute operation of booting an immune O/S not only eliminates a great deal of possibilities, but also provides a mechanism to see any and all hidden files in a read-only mode.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
Did you read all my posts?
Did I ask about bad hard disk drive?
I did posted some images with some errors making any one believe the problems
come from the hard drive, but actually thats the trick of the virus.
This issue is not about a bad hdd or any other hardware problems.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Yes, I read your post, especially the parts about suing EE and how there are no experts.

In light of that, considering your question was "Any suggestion", then I advice you reformat your disks, flash factory firmware on all hardware components and reload the O/S from factory-sealed media.  (Do not use the internet, and do not plug in any USB sticks that have not been bit-level erased).

This will absolutely destroy any virus, assuming your hardware is fully operational.  Good luck to you.
0
 
LVL 78

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 166 total points
Comment Utility
The biggest item is prevention of getting the problem in the first place by using best practices i.e. UAC on, Standard User Accounts, Firewalls, Updates, Antivirus and antimalware on and updated  and user education.

Some tools you may have missed, i.e. autoruns by sysinternals, and its companion autorunsc (for services), also look through your task scheduler.  and also rootkit revealer also by sysinternals (microsoft).. how about SFC ??

Some malware is highly resistant to removal i.e. it disables any known anti-virus and anti-malware tools.

Also ensure that your pdf readers and oracle java are always up to date (and with java ensure that it is NOT installed unless you absolutely need it.. keep your exposure area as small as possible.

Each time you've tried to eliminate the virus it keeps reappearing which is either a NEW infection or the same one has compromised your system to where it isn't an economic use of time to fix it.. You're already at the point that you can't trust this pc.. so its time to bite the bullet and reinstall the operating system.
0
 

Author Comment

by:Samuel-AMC
Comment Utility
dlethe, ve3ofa, I am very disappointed with your responses...
You can tell that this place does not have people who know about virus infections!
do not feel offended but is the true.

I managed with the elimination of this virus, without formating the hdd, without
so much bla-bla-bla, I was gonna post the solution here, but why waste my time
teaching others when is them who should be giving me the solution I came here for.
so thank you for nothing.

I will open a blog soon to talk about the bad things going on with this website.
Bad customer support, email or even over the phone.
these people (EE) do not deserve a single visit.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
That is your right, Samuel-AMC.  

I am sure the thousands of people who do get their questions answered every day feel otherwise, and are aware that experts aren't paid staffers so sometimes pick and choose who they want to help in their spare time.

You are within your rights to have a question deleted and not get charged for points? I suggest you do so and this question will be deleted from the database.  

Or you can award the points to yourself if you post the solution so others can benefit from what you learned rather than blogging about why unpaid volunteers had better things to do than help strangers who insult and threaten them with a lawsuit.
0
 
LVL 15

Expert Comment

by:ericpete
Comment Utility
Samuel-AMC,

First thing you need to do is dial it back on the caffeine. modus_operandi's actions were the direct result of YOUR request to get more Experts involved. He knows what he's doing, and based on the fact that both dlethe and ve3ofa have significant experience solving problems like this one, his actions were successful. You owe both of them an apology.

Second, you do NOT have a virus -- at least as far as the issue you have raised here is concerned. WinPatrol.exe is a legitimate program installed by some manufacturers with some versions of the Windows operating system. See http://www.shouldiblockit.com/winpatrol.exe-22733.aspx for more information. The likelihood is that when you installed one program or another, you installed the winpatrol.exe as part of the process.

The good news is that you can turn it off. See http://www.bleepingcomputer.com/startups/WinPatrol.exe-6730.html for instructions on how to do this.

Finally, insulting the people who are trying to help you, threatening lawsuits, and generally stomping your feet is not very productive in terms of solving your problem. You might want to take that into consideration when faced with a problem you need help with.

Regards,

ep
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
LVL 15

Expert Comment

by:ericpete
Comment Utility
As long as the Asker receives no refund, I'm fine with deleting.
0
 
LVL 47

Expert Comment

by:dlethe
Comment Utility
Charge points & distribute equally to all the experts. The original question WAS asked & answered.

"Any suggestion?"

The author refused to do basic diagnostics by booting to linux in order to eliminate hardware as being a possibility, or diagnose multiple problems.  There is not even proof that there is a virus in the first place, only symptoms compatible with multiple possibilities.
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
For the Moderator who reviews this: I have no objection to the suggestion from 'dlethe'.
Beyond the technical competence, I admire the demonstration of restraint by the Experts involved.
0
 
LVL 15

Expert Comment

by:ericpete
Comment Utility
For my part, the points should be split between dlethe and ve3ofa. My contributions were only tangentially related and not really a solution.
0
 
LVL 23

Expert Comment

by:ComputerTechie
Comment Utility
I agree; I think we all had good ideal that would have work for this issue

CT
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now