Active@ Killdisk Issue

Topic

New Reply

About four days ago I began to see this message on my boot-screen, running Windows 10 build 1511.29. This was the day after my PC was updated to that build.

42927-433212527

Please note the date of the message – July 85th 2015. I have NEVER installed Killdisk, NEVER seen the ascii menu appear ever, and have NEVER used the program. Or to my knowledge, NEVER booted from a hdd/cdrom/usb that had this software installed. On July 28th 2015 … NOTHING HAPPENED!

The message appears after the BIOS verifies its data and the “Boot From CDROM:” message appears onscreen, but before the PC shows any “boot” activity – that is, before the blue windows flag appears on the screen.

PC details below.

REPETITION FOR EMPHASIS: Killdisk has never been installed on any of my hdds, nor on any USB stick I use; in fact I didn’t know it existed until that day. I have not had any other USB stick inserted into this machine except my own which have known software installed.

I have taken the following steps to diagnose the problem.

1. Reset Bios to Defaults and rebooted – no change.
2. Reset Bios to Optimised Defaults and rebooted, no change.
3. Shorted BIOS according to m/b instructions – turned pc off, disconnected PSU cable, pushed power on button 4 times. No change.
4. Used Autoruns from SysInternals – no software suggesting Killdisk activity or presence.
5. Used Process Explorer – nothing suggestive.
6. Used MSINFO – nothing suggestive.
7. Tried to find the object ID of the unit reported in the message – 9QFBF565 – not on my PC.
8. Full scan using Alvira Free – one never knows.
9. Full scan using Windows Defender – Yes, its “academic-virus-test” test results are poor, but its “real-world” detection rates are very good. Please don’t go off-topic about Defender.
10. Scanned using AntiMalwareBytes Premium Trial. Nothing found.
11. Manually searched registry for “Active@ Killbits” and “LSoft Technologies” and variants – just in case. Nothing found.
12. Manually searched every folder under “Program Files” – just to be sure. Nothing found.
13. Asked the question on a local technical forum – and got the suggestions I’ve already mentioned.
14. Manually searched User profiles Roaming and Local App Data folders – nothing.
15. Emptied Recycle Bin.
16. Scanned using CCleaner and Glary Utilities – no change.

Note: I didn’t expect to find anything using steps 5, 6, 8, 11 12, 15 and 16, but they’re part of the problem solving procedure.

So I’m almost stuck … :confused:

My PC Specifications:

MB: Gigabyte G31M-ES2L (Socket 775) Rev 2
CPU: Intel Pentium E5300 @ 2.60GHz Core2Due (57 °C) Wolfdale 45nm
RAM: 4.00GB Dual-Channel DDR2 (5-5-5-15)
Graphics: 1023MB NVIDIA GeForce GT 610 (EVGA)
Monitors: SyncMaster (1280×1024@60Hz), SyncMaster (1280×1024@60Hz)
Optical: PHILIPS SPD2412T ATA Device
BIOS: Award FC July 2009 – no further updates available from Gigabyte site
Network: Qualcomm Atheros AR8131 PCI-E Gigabit Ethernet Controller (NDIS 6.30)
Storage: ST3160815A ATA Device
ST3320820SCE ATA Device
ST380013AS ATA Device
ST3320310CS ATA Device
WDC WD2500JS-22NCB1 ATA Device
Audio: NVIDIA High Definition Audio
AnvSoft Virtual Sound Device
DrmRAudio
High Definition Audio Device

Any help would be gratefully appreciated.

Reply | Quote

Replies

Active@ Killdisk is a disk eraser program that will wipe your hard drive with no possibility of recovery.

You should be able to uninstall it by going to Control Panel > Programs and Features.

If that doesn’t work, you can try using the free version of GeekUninstaller…

http://www.geekuninstaller.com/download/?version=1.3.4.52

Thanks for your reply, but it’s never been installed, so not in the list of installed programs.

Reply | Quote

Thanks for your reply, but it’s never been installed, so not in the list of installed programs.

Have you checked there isn’t a disk in the CD/DVD drive or a bootable USB drive connected?

Reply | Quote

Have you checked there isn’t a disk in the CD/DVD drive or a bootable USB drive connected?

Yes, nothing lurking there.

Reply | Quote

It looks like the fingerprint, only available with the Pro version of Killdisk, page# 46 of the manual:

Write Fingerprint
If fingerprint has been written to the disk’s first sector, next time you boot
from this disk, you can see disk erase status,…

Do you know the complete history of all the drives?

Reply | Quote

It looks like the fingerprint, only available with the Pro version of Killdisk, page# 46 of the manual:

Do you know the complete history of all the drives?

Yes, I’ve had two since new, the other three were purchased used May 2015, but were formatted using Windows Disk Management console before use.

Reply | Quote

A different subject, but prior to reinstalling the image mentioned above, my Win10 1511.29 asked to be rebooted after installing updates. I complied, and now my version is 1511.11.

However, since the message still appears, perhaps the fingerprint was saved to the hidden windows partition?

I can almost rule out this KillDisk message being present when the image was compiled, as I hadn’t seen it before this week. Interesting.

Reply | Quote

I made a disk image using Macrium Reflect Pro on Nov 11th 2015, which I have just restored to the same hdd.

Sadly there’s no difference to boot. Message still appears.

Reply | Quote

Perhaps one of the used drives had killdisk run on it from a machine that had incorrect time/date set.

Reply | Quote

Perhaps one of the used drives had killdisk run on it from a machine that had incorrect time/date set.

I know it’s possible, but both were purchased from a reputable shop with a statement about being formatted and zeroed prior to sale. I can’t imagine how the ID in the message came about, because I can’t find it anywhere, and presumably KillDisk uses the disk’s ID as opposed to one that it makes up on use.

What surprises me is the message hasn’t appeared until this week, and yet apparently is a notification of activity in July. And I haven’t “played” with my hdds since they were installed. Just partitioned, formatted them, then used them.

I know it’s like a duck – looks like, smells like, walks like, flys like, eats like …. so I guess it’s a duck. But I haven’t installed it, haven’t had any strange messages like the program’s ascii menu – it’s really obvious – and I haven’t used any other usb drives except my own. And those don’t get loaned out.

However, this is the duck bit; software doesn’t run by itself, so even knowing my own usage and being convinced I haven’t introduced it; I’m at a loss to explain how it got there.

I’ve has some “malware” warnings from Defender, which have been quarantined, but since I didn’t investigate the type I can’t suggest that’s how this message got onto my hard disk. Think I’ll pass that one.

So now the problem becomes, how to get rid of the thing?

Reply | Quote

Perhaps you weren’t seeing it, a matter of timing – it looks like it displays sometime after the disk detection routine – something, perhaps the disk order, is different now, the Killdisk disk is booting earlier?

Reply | Quote

I’ve only got one disk that has an active boot sector, and that’s C: I’ve tested booting to other drives, but get the error message No OS Installed.

Reply | Quote

The active bootsector/bootable drive issue is irrelevant here. Killdisk will plant this fingerprint on any drive that it’s been set to. The Killdisk software isn’t installed or running, the fingerprint displays only after the disk has been detected by the BIOS routine – note how it replaces the BIOS data.

Contact the vendor of the drives, it’s almost certainly something they’ve done, probably from a machine built from recovered parts that they use for basic testing that they hadn’t set the date/time correctly on.

It’s probably triggered by something in the MBR, or in the next sector that the MBR points to.

Try using TestDisk (download link ~5 lines down) to view the MBR, compare it with the non-bootable new drive.

Reply | Quote

Remove all but the boot drive. Still there?

If no, add one drive back at a time until you identify which drive it is on.

Kill ALL partitions and then repartition and quick reformat the drive. I’m assuming these are used drives cleaned up since new ones don’t come partitioned and “formatted.” The vendor probably used killdisk to clean up the drive and didn’t realize a piece of the app remained.

Reply | Quote

Remove all but the boot drive. Still there?

If no, add one drive back at a time until you identify which drive it is on.

Kill ALL partitions and then repartition and quick reformat the drive. I’m assuming these are used drives cleaned up since new ones don’t come partitioned and “formatted.” The vendor probably used killdisk to clean up the drive and didn’t realize a piece of the app remained.

I found the effected drive – not the boot drive – and used testdisk to rewrite its mbr. Then rebooted. However got the 1234F error on boot, so disconnected all but the boot drive to see if that made any difference. No.

Eventually had to do a full, clean reinstall of Win10 from my usb stick.

But there’s no access to any of the other hdds, so I gave up and repartitioned all of them. So now I start from clean disks.

Many thanks for all your and others help.

Reply | Quote

I found the effected drive – not the boot drive – and used testdisk to rewrite its mbr. Then rebooted. However got the 1234F error on boot, so disconnected all but the boot drive to see if that made any difference. No.

Sounds like you no longer have the problem, but just out of curiosity, could I ask a few postmortem, followup questions?

Which disk was causing the problem? Was it one of the HDDs you bought used? That would support FascistNation’s suggestion it may have been an artifact left from whomever wiped/reformatted it–possibly leaving a “fingerprint” in that disk’s boot track, as satrow mentioned.

My immediate impression in post #1 was “9QFBF565” seemed a lot like a Seagate serial number. Your post mentioned one Western Digital and four Seagate hard drives … might that be the serial number on the label of one of the hard drives? Perhaps even the culprit hard drive?

With a 2009 BIOS, my assumption is you’re using MBR booting, but since you mention Win10, would you mind affirming you’re using MBR vs. UEFI/GPT partitioning?

When you used testdisk to rewrite the MBR, was the boot drive disconnected? If not, it may have also altered the MBR on the boot drive. That could explain the “1234F” prompt.

As an aside, I don’t think “1234F” is an error, per se, it’s a prompt from a special MBR. Instead of designating a specific active partition, the MBR is displaying a kind of shorthand boot menu–in effect, asking the user, “Which partition do you want to boot from? partition 1? 2? 3? 4? or boot from floppy?” It’s waiting for you to press a key.

Reply | Quote

Which disk was causing the problem? Was it one of the HDDs you bought used? That would support FascistNation’s suggestion it may have been an artifact left from whomever wiped/reformatted it–possibly leaving a “fingerprint” in that disk’s boot track, as satrow mentioned.
My immediate impression in post #1 was “9QFBF565” seemed a lot like a Seagate serial number. Your post mentioned one Western Digital and four Seagate hard drives … might that be the serial number on the label of one of the hard drives? Perhaps even the culprit hard drive?

It was one of the Seagate drives.

With a 2009 BIOS, my assumption is you’re using MBR booting, but since you mention Win10, would you mind affirming you’re using MBR vs. UEFI/GPT partitioning?

Yes using MBR booting.

When you used testdisk to rewrite the MBR, was the boot drive disconnected? If not, it may have also altered the MBR on the boot drive. That could explain the “1234F” prompt.

Boot drive connected, but had selected other drives except the boot drive when running TD. Boot drive not targeted with testdisk, but rather from the cmd window of a Win10 boot usb flash drive, where I used “bootrec /fixmbr”.

As an aside, I don’t think “1234F” is an error, per se, it’s a prompt from a special MBR. Instead of designating a specific active partition, the MBR is displaying a kind of shorthand boot menu–in effect, asking the user, “Which partition do you want to boot from? partition 1? 2? 3? 4? or boot from floppy?” It’s waiting for you to press a key.

Yes, but none of those keys elicited a suitable response, except for the same message appearing on another line. Sorry for the “error” part – I did look it up and shouldn’t have used the misleading term “error”. Your answer though, is a great explanation of the same term “aside” – in HTML5. Well done.

Update:

Have rebuilt my boot drive and made an updated image. Just as its predecessor came in handy on this occasion, so might this one; but I hope never to use it for that purpose.

Also, I’ve not had the opportunity to recover from a total all-disk mess before, and having two separate backups was a wonderful feeling. I’d previously copied individual folders from my BU-HDD, but never had to rely on it. I DO feel good about that.

Thanks for your comments …

Reply | Quote

I don’t think there’s a pressing need to do anything, it’s not active except that it now shows up after disk detection, it’s not related to partitions or the file system (the BIOS doesn’t detect partitions/filesystems). A good disk editor could remove it, once the location was found.

Reply | Quote

I don’t think there’s a pressing need to do anything, it’s not active except that it now shows up after disk detection, it’s not related to partitions or the file system (the BIOS doesn’t detect partitions/filesystems). A good disk editor could remove it, once the location was found.

After I’d read the date and noticed it was the same over successive days/boots, it lost some of the “worry” factor, but then it became annoying as it didn’t need to be there. Hence the subsequent activity that lead to a clean install of Windows 10 and re-partitioning and formatting all my other hard disks.

In this case, tidiness came with a cost. :blush: :coffeetime:

Many thanks for your help with this.

Reply | Quote

Okay, from the information you’ve supplied, it seems likely that the errant disk had been wiped with TD and the TD fingerprint was left in the “unused” sectors (LBA 2-63) of the boot track of that disk. That was event #1, and occurred before you got the disk.

Event #2 was the MBR boot code of your boot disk apparently was altered such that the fingerprint starting being displayed. That would have occurred at some unrelated time, though there is insufficient information to make a guess how that may have happened. A normal Microsoft MBR doesn’t look for TD fingerprints, but a TD MBR probably does, and my guess is it might display that information onscreen before chaining the boot process on to the regular Windows boot loader. Windows still boots like normal, so nobody is the wiser that the MBR is different except for the telltale fingerprint display at boot time.

Using the “bootrec /fixmbr” command returns the MBR boot code to Microsoft’s standard code, so once again nothing is looking for fingerprints at boot time. (FWIW, I suspect the fingerprint is still there on that Seagate disk, but it’s effectively orphaned and there’s no harm leaving it alone.)

It’s water under the bridge now, but if my guess is right then the easiest way to fix things would have been to simply run that “bootrec /fixmbr” operation and you wouldn’t have had to reinstall from scratch.

Reply | Quote