Solved

Virus - No Disk

Posted on 2013-05-17
33
988 Views
Last Modified: 2013-12-06
Hi everyone,

recently I am having difficulties with this agent:

---------------------------
Any.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

Any suggestion?
Thanks
0
Comment
Question by:Samuel-AMC
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 6
  • 3
  • +5
33 Comments
 
LVL 3

Expert Comment

by:phoenix5ire
ID: 39176630
Not exactly sure if this is a virus, sounds like a device error. When are you getting this message, is this a random message or it pops up when you attempt to access a hardware device (i.e., CD/DVD, USB, etc,..) ?  

Also, are there any entries in Event Viewer that is log when this message appears?

Thanks.
0
 

Author Comment

by:Samuel-AMC
ID: 39176634
I'm 100% sure this is a Virus, I was reading about it last night, but there was
not that much of info on the Virus, but it is a proccess that get hooked into
every single running .exe file, and it give the name of the file, for example:

---------------------------
notepad.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

---------------------------
Winpatrol.exe - No Disk
---------------------------
There is no disk in the drive. Please insert a disk into drive \Device\Harddisk3\DR3.
---------------------------
Cancel   Try Again   Continue  
---------------------------

and so on, I have my ZoneAlarn firewall which I denied every attemp on this No Disk
Virus.
0
 

Author Comment

by:Samuel-AMC
ID: 39176645
This is the error in real time, and then I have to click like 7 times for the error
to go away, then 10 seconds later it shows again, is annoying, there are no USB
or anything pluged in the machine!
No Disk
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 18

Expert Comment

by:awawada
ID: 39176717
Did you try this KB?

http://support.microsoft.com/kb/330137/en-us

Do you have Windows XP?
0
 

Author Comment

by:Samuel-AMC
ID: 39176823
This problem is on Windows 7, and about that Microsoft page, yes, I saw that before
I asked this question here, once again, this is some kind of hooking Virus.
I will post some more info on this tomorrow, the virus take down any disk and make
or create two files on the disk, autorun.inf and a weird name file, now that I've been
checking on the virus and managed to get control on the virus, the virus changed the
way it drops the eggs, now the name of the .pif file is not .pif is .com and .exe
then after getting rid of both files and clean the virus, the virus still somewhere in
the pc as when everything seemed to be gone then I see an alert from the windows
firewall. but this only happend if I get to run a file, for example, notepad.exe or any
file, like ccleaner for exaample, then the windows firewall popsup and ask if I let
ccleaner run or what ever, then when I see that happend I know the virus born again.
I can get rid of it, but everything started with the NO Disk, which I know is a Virus.
0
 

Author Comment

by:Samuel-AMC
ID: 39176829
Plese take a good look at this example very well
These are the two droped infection by the Virus,
These files keep reapiring in my C:\ drive over and over again, no matter how
many times I get rid of them with all the tools I got, malwarebytes, combofix,
malwarebytes anti-rootkit, and so many other good anti-everything and still...
VirusThen this is the content of autorun.inf
[AutoRun]

;
;uLnt bUrWlqoiV
shell\ExpLOrE\COmmANd =fwvog.pif
;FrbBwQ 
sHElL\open\DeFault=1
opEn= fwvog.pif
;sdal 
sHeLl\oPen\COmmand =fwvog.pif

;vaeMBxaOusb MsiAVmcndKJ
shElL\aUToplAy\ComMAnD=fwvog.pif

Open in new window

My USB pen-drives are protected, thats why I got them clean still.
the droped infection sometimes is .pif some other time is .com
and some other times is executable file, i mean, .exe, etc.
0
 
LVL 3

Accepted Solution

by:
phoenix5ire earned 167 total points
ID: 39177435
Thanks for the additional info, it helps give a better idea the overall picture of your problem.

Sounds like this problem, check to see if this helps:
No Disk virus

We recently ran into this issue with some of our file servers and our AV didn't catch it, see if this is your problem as well:
Hidden Files and Folders become .exe

Thanks.
0
 

Author Comment

by:Samuel-AMC
ID: 39177497
Thanks phoenix5ire, let me put these tips to the test and I will be back and let you know,
But just to give you an idea, in the past I used to face a virus that used to turn folders
into exe files and then make you click by mistake on them, but this time is not about
those folders, this time this virus hook into good exe files and actually the exe run ok,
but the virus run from there, thats the problem, and then when you try to look for a
possible process running there is none!
0
 
LVL 3

Expert Comment

by:phoenix5ire
ID: 39177615
Can you also go into Safe Mode and see if you're seeing these No Disk errors. See if you can duplicate this problem while in Safe Mode. This would give a better idea if the virus is loading before or after OS starts.

Thanks.
0
 

Author Comment

by:Samuel-AMC
ID: 39177627
phoenix5ire, I tried the steps from the first link you posted
Yeah, the: No Disk virus but those instructions are either old
or for a diferent virus type, cuz none of that info is related to the virus I have.
0
 

Author Comment

by:Samuel-AMC
ID: 39178201
I can't request more help on this question because I already did, and nobody here
seemed to know what my question is all about, searching on google found many
forums with this same issue, but mine is a bit diferent, I wonder is there is more
help to ask here in EE, otherwise there is no good for me to keep asking here.
Sorry phoenix5ire. and thanks for trying to help.
0
 
LVL 47

Assisted Solution

by:dlethe
dlethe earned 167 total points
ID: 39181864
A virus didn't kill the disk drive.  Prove it yourself by booting the system to a copy of linux you load on a USB stick.  (Go to ubuntu.com to see how to do this).

Once you can verify that the hardware is either bad, or perfectly fine, you can either go shopping, or start looking at device driver issues.
0
 
LVL 23

Expert Comment

by:ComputerTechie
ID: 39181891
I recommend this. Go to a clean compute and get a USB stick with nothing on it. Next download from hitman pro website. Their 30 day trial. Next when installing it created the boot able version using usb . Next boot the computer up with the USB stick and it will ask you if you want to bypass MBR say yes. This should allow you to do a complete scan and find the virus. If USB will not work I recommend something like virperescue and create a boot able media.

CT
0
 

Author Comment

by:Samuel-AMC
ID: 39181995
modus_operandi: I changed the zones for this question from:

"Anti-Virus, Anti-Spyware, HijackThis Software
to
Anti-Virus, Anti-Spyware, HijackThis Software, Microsoft Windows Operating Systems".

Huh? ...woow what a big change! ...all you did is add OS which have nothing to do with
my question, and I added three zones to my question which it was good enough for any
expert to provide an answer, but the true is that there are no experts here thats all.

Now as for dlethe and ComputerTechie
I am more than disappointed with the information given here...
If this was a negligence I'll sue EE for wasting people's time and provide information
that is not. sorry but you guys need to learn more about infection.

I already collected a lot of information about this issue, it is a Virus, is hard to get rid
of it, but so far I'm taking care of it myself with out wasting my time here.
this place is nothing but a waste of peoples time.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39182031
Problem resolution 101 .... Determine what is known good & known bad.  You can't trust any software-based diagnostic tools to determine health of the hardware if you are booted to an infected O/S.  

You also can not eliminate the possibility of multiple problems.  If this was an easy thing to fix, then it would have been resolved by now.
0
 

Author Comment

by:Samuel-AMC
ID: 39182053
dlethe:
"If this was an easy thing to fix, then it would have been resolved by now."

Thats the reason why I posted my question here, to see if some one knew the asnwer.
on the other hand, every day I solve big problems and issues myself, and I don't ask for
any help here, but sometimes I do cuz I'm very busy, but thats the point, if you can ask
for a solution that somebody already had, thats a time safer. but in this case what makes
me feel so desapointed is that I already provided a very small portion of the issue, and
nobody have come across of what the issue is, and there are hundreds of places that
came out fast with that the issue is.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39182083
Based on the information you posted, you can not eliminate an intermittent HDD problem, which may exist independently of a virus.  A 5 minute operation of booting an immune O/S not only eliminates a great deal of possibilities, but also provides a mechanism to see any and all hidden files in a read-only mode.
0
 

Author Comment

by:Samuel-AMC
ID: 39182110
Did you read all my posts?
Did I ask about bad hard disk drive?
I did posted some images with some errors making any one believe the problems
come from the hard drive, but actually thats the trick of the virus.
This issue is not about a bad hdd or any other hardware problems.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39182170
Yes, I read your post, especially the parts about suing EE and how there are no experts.

In light of that, considering your question was "Any suggestion", then I advice you reformat your disks, flash factory firmware on all hardware components and reload the O/S from factory-sealed media.  (Do not use the internet, and do not plug in any USB sticks that have not been bit-level erased).

This will absolutely destroy any virus, assuming your hardware is fully operational.  Good luck to you.
0
 
LVL 81

Assisted Solution

by:David Johnson, CD, MVP
David Johnson, CD, MVP earned 166 total points
ID: 39182329
The biggest item is prevention of getting the problem in the first place by using best practices i.e. UAC on, Standard User Accounts, Firewalls, Updates, Antivirus and antimalware on and updated  and user education.

Some tools you may have missed, i.e. autoruns by sysinternals, and its companion autorunsc (for services), also look through your task scheduler.  and also rootkit revealer also by sysinternals (microsoft).. how about SFC ??

Some malware is highly resistant to removal i.e. it disables any known anti-virus and anti-malware tools.

Also ensure that your pdf readers and oracle java are always up to date (and with java ensure that it is NOT installed unless you absolutely need it.. keep your exposure area as small as possible.

Each time you've tried to eliminate the virus it keeps reappearing which is either a NEW infection or the same one has compromised your system to where it isn't an economic use of time to fix it.. You're already at the point that you can't trust this pc.. so its time to bite the bullet and reinstall the operating system.
0
 

Author Comment

by:Samuel-AMC
ID: 39202561
dlethe, ve3ofa, I am very disappointed with your responses...
You can tell that this place does not have people who know about virus infections!
do not feel offended but is the true.

I managed with the elimination of this virus, without formating the hdd, without
so much bla-bla-bla, I was gonna post the solution here, but why waste my time
teaching others when is them who should be giving me the solution I came here for.
so thank you for nothing.

I will open a blog soon to talk about the bad things going on with this website.
Bad customer support, email or even over the phone.
these people (EE) do not deserve a single visit.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39202723
That is your right, Samuel-AMC.  

I am sure the thousands of people who do get their questions answered every day feel otherwise, and are aware that experts aren't paid staffers so sometimes pick and choose who they want to help in their spare time.

You are within your rights to have a question deleted and not get charged for points? I suggest you do so and this question will be deleted from the database.  

Or you can award the points to yourself if you post the solution so others can benefit from what you learned rather than blogging about why unpaid volunteers had better things to do than help strangers who insult and threaten them with a lawsuit.
0
 
LVL 15

Expert Comment

by:ericpete
ID: 39202842
Samuel-AMC,

First thing you need to do is dial it back on the caffeine. modus_operandi's actions were the direct result of YOUR request to get more Experts involved. He knows what he's doing, and based on the fact that both dlethe and ve3ofa have significant experience solving problems like this one, his actions were successful. You owe both of them an apology.

Second, you do NOT have a virus -- at least as far as the issue you have raised here is concerned. WinPatrol.exe is a legitimate program installed by some manufacturers with some versions of the Windows operating system. See http://www.shouldiblockit.com/winpatrol.exe-22733.aspx for more information. The likelihood is that when you installed one program or another, you installed the winpatrol.exe as part of the process.

The good news is that you can turn it off. See http://www.bleepingcomputer.com/startups/WinPatrol.exe-6730.html for instructions on how to do this.

Finally, insulting the people who are trying to help you, threatening lawsuits, and generally stomping your feet is not very productive in terms of solving your problem. You might want to take that into consideration when faced with a problem you need help with.

Regards,

ep
0
 
LVL 38

Expert Comment

by:younghv
ID: 39331809
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
LVL 15

Expert Comment

by:ericpete
ID: 39331788
As long as the Asker receives no refund, I'm fine with deleting.
0
 
LVL 47

Expert Comment

by:dlethe
ID: 39331810
Charge points & distribute equally to all the experts. The original question WAS asked & answered.

"Any suggestion?"

The author refused to do basic diagnostics by booting to linux in order to eliminate hardware as being a possibility, or diagnose multiple problems.  There is not even proof that there is a virus in the first place, only symptoms compatible with multiple possibilities.
0
 
LVL 38

Expert Comment

by:younghv
ID: 39331847
For the Moderator who reviews this: I have no objection to the suggestion from 'dlethe'.
Beyond the technical competence, I admire the demonstration of restraint by the Experts involved.
0
 
LVL 15

Expert Comment

by:ericpete
ID: 39331882
For my part, the points should be split between dlethe and ve3ofa. My contributions were only tangentially related and not really a solution.
0
 
LVL 23

Expert Comment

by:ComputerTechie
ID: 39332831
I agree; I think we all had good ideal that would have work for this issue

CT
0

Featured Post

How Do You Stack Up Against Your Peers?

With today’s modern enterprise so dependent on digital infrastructures, the impact of major incidents has increased dramatically. Grab the report now to gain insight into how your organization ranks against your peers and learn best-in-class strategies to resolve incidents.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question