Mystery 3MB Partition still showing after full disk wipe

[Tyler335]

Hi all,

I used Killdisk from LSoft to erase my harddrive and everything seemed to work fine. Then I opened Active@ Partition Manager and it's showing a 3MB partition labelled X:BOOT. This partition doesn't show in Killdisk, just in Partition Manager, and Partition Manager can't delete it without giving an error. Does anyone know what this might be?

Googling hasn't turned up much, but could it be related to the virus problem these people were having:

http://www.sevenforums.com/system-security/247502-partition-virus-non-system-drive-virus.html
Kaspersky Lab Forum > Alureon.E

The partition doesn't show up in Parted Magic either. I'll attach a screenshot from Active@ Partition Manager.

Please help

 

[Lady Fitzgerald]

I ran into that bugaboo on a HDD I salvaged from my old XP machine that had the OS installed on it. I tried everything I could think of and actually managed to reduce it 9MB but it wouldn't completely go away until I tried formatting it, then deleting it or merging it with the rest of the HDD (I don't remember which now).

 

[Tyler335]

Hi Lady Fitz, thanks for the reply. This partition has resisted all attempts to delete it, or modify it in any way. I was running Windows 7 on the drive before I wiped it.

 

[jumanji]

Download Windows Executable ver 4.30 (works without installation) from http://hddguru.com/software/HDD-LLF-Low-Level-Format-Tool/

Try to low level format the full disk with it. ( Be careful to select the correct drive.)

Once low level format is completed - which you can monitor in the progress bar - format it with Windows 7.

Let us see whether it helps to get rid of the 3MB partition.

(If you have a Seagate or Western Digital HDD, zeroing it with the manufacturer's diagnostic/repair tool/utility will be a better option.)

 

[rvcjew]

does it show up in diskpart in windows?
EDIT: im surprised it does not appear in gparted in parted magic.

 

[TVeblen]

Keep in mind: Windows, and some other OS, use and need a small unallocated portion of a hard drive before and sometimes after the main volume. These are usually 2 to 6 MB in size.
However these small sections are supposed to be invisible and definitely should not have a drive letter assigned, so I would remain suspicious that it could be something else.

If you use DISKPART with the "Clean All" command it will (should) wipe the drive of everything. Then if you initialize it using Windows then those "working" sectors will be created as Windows likes it.

 

[Tyler335]

I downloaded the HDD Low Level Format tool, but it gave a system error when I tried to run it: "Can't start because SHFolder.dll is missing". So I booted DBAN from USB and ran an "autonuke" that took 10+ hours to fully wipe the drive. The partition seems to have survived even that.

The partition doesn't show in diskpart.

I was able to open the partition using the Boot Disk Explorer from LSoft, and I'll attach a screenshot of what I found:

 

[crankypenguin]

If a hard drive survives a dban nuke that lasts 10 hours, I am thinking bad sectors or rootkit.

 

[jumanji]

Hi Tyler,
1. The problem of missing shfolder.dll has to be tackled as an entirely different problem.

2. What is the history of the HDD that has this 3 MB partition?

3.That even DBAN wouldn't touch it gives a clue that that partition remains in the HPA/DCO area.( You now know how important is the history.)

4. The easiest way to kill that partition and restore the full capacity of your hard drive is to use Atola's HDD capacity Restore Tool Restoring Factory Hard Drive Capacity » Official Atola Technology Blog This works only on 32bit system and so you have to hook up your HDD as a second internal drive on a desktop running 32 bit Windows 7 and do the procedure.

5. Otherwise you have to use HDAT2 HDAT2 Download. There is a cookbook on using it. Find it and download it.

( I am allowed to sit stand and move about only for two or three hours a day. So I am not able to elaborate. My quota for the day is over. )

 

[Tyler335]

Alright, I've downloaded Hdat2 and the cookbook. Under the "Hidden Areas>>Overview of Hidden Areas" menu, there is nothing listed next to HPA or DCO. I wasn't able to take a screenshot, but the program is definitely saying there are no hidden areas on the disk.

The partition still shows in Active@ Partition Manager, though. Could another wiping program other than DBAN nuke the drive more thoroughly? Or are there any settings in DBAN Interactive mode that would force the program to wipe absolutely every single sector on the disk? I'll admit I'm getting a little frustrated...this partition seems to be immortal.

 

[TVeblen]

Have you tried DISKPART "Clean All" yet?

 

[Tyler335]

Hi TVeblen, I'm sorry I didn't respond to your original post. I've run Clean All in Diskpart a few times now, but it didn't have any effect on the partition, I'm afraid.

The more trouble I have removing this partition, the more convinced I become it's part of a rootkit.

 

[jumanji]

I am surprised to learn that HDAT2 did not find anything.

The only thing left for you to try is to use Atola's HDD Capacity Restore Tool - my post #9 - hooking up the HDD onto a 32bit system.

(If you have no means to do it, you may seek help from a neighbourhood computer shop to do it for you.)

 

[TVeblen]

I looked back at your first post and noticed that this mystery drive is Virtual Hard Disk.

Does this 3MB partition show up in any other program or utility? If not, it may be a virtual drive created for the use of Active Partition Manager.

Just a guess. But seeing it is a virtual drive just makes me think it does not really exist at all on the physical hard drive.

 

[Fordprefect]

I've got current and ample knowledge on what you are trying to get rid of. It's the almost impossible to actually impossible to get rid of bootkit originally made by the NSA that's written outside of the writable area of the disk that's why you can't delete it. I'm a little rusty but if memory serves correctly its built by the hard drive firmware rootkit that is the real "kit" involved here. Basically you erase it when you format that drive but as soon as the write heads are done cleaning or binary writing the disks depending on which format version you go with, the firmware malware hijacks the drive and rebuilds it. That folder called unattend is the innocent name for the house that holds the malicious base level payload. Once an os is booted that partition hooks the os in one of a few ways depending on windows version in your case it's for sure from xp and eventually gets itself kernal level access at least and has instructions to get the rest of whichever exploit was intended from a remote server.. meet EQUATIONDRUG and GRAYFISH... they can be modified but on a base level drug writes into the firmware of the drive and grayfish is the 3mb little bastard it creates with those steel hooks it likes to stab into your digital realm maintaining persistence on it's own i.e. unattended by any human presence.

 

[Fordprefect]

Actually I think depending on the drive brand and setup in some cases it's actually written on the disk outside of the user level write head operating distance. Most would call it the service area or manufacturer only area and essentially the write heads are overextended to write the payload using parameters normally only accessible by the factory. My guess is the jumper setting labeled factory use is what enables that function and true low level formatting and that jumper can be selected via electricity no physical object needed.. when . P.s. doesn't mean the nsa put it on your drive. Hackers got their hands on the code when kaspersky went public with it and there is an associated worm that lives to find other systems to infect autonomously