"Rebuildfstab" on a windows 10 ssd? Can't fully format (I believe)

[genju]

Hi. First of all Im not a Linux user, hope you dont hate me or tell me to delete system32 because of it :p (Joke)

So, I got a samsung evo 840 ssd 120gb which I think it got infected by a virus because I started seeing a lot of unknown processes going on so now Im trying to fully format it and tried with different tools already.
But I get the message "rebuild fstab --- killed by signal 9".
After googling a little it Ive found out that this is related to Tiny Core Linux, is that correct?
The thing is: I never installed Linux and thats why I think theres something wrong going on here. Besides the weird processes showing up on Linux, I also noticed that windows shows up as Activated/Genuine copy even tho I didnt activate it yet. All those things combined make me think that this partition is malicious and is set as Read-only so it can come back everytime, so I need to know how to completely remove this or these partitions.

If anyone can help me out, I will really appreciate it.
 
Thanks.
 edit: sorry If I posted it in the wrong section.

[Misalf]

But I get the message "rebuild fstab --- killed by signal 9"

In Tiny Core there exists a file called  rebuildfstab , this might have lead your search engine here.

But while you're at it, you might want to try the  dd  command to destroy everything on your disk (doesn't need mounting the drive).
Something like this (just to give you a clue) would fill the entire drive  sdb  (output file) with zeros (input file).

Code: [Select]

dd if=/dev/zero of=/dev/sdb
Don't just run this command! Further googling would be needed.
IIRC, I have heard that SSD drives don't like to be written with zeros, so different command options may apply.

You can do this with Tiny Core, or, if it gives you a hard time, any Linux will do.

[Juanito]

..or you can use the secure-erase extension, which is probably the quickest for an ssd.

..or you can use shred from the coreutils extension (be very careful about using this command):

Code: [Select]

$ sudo shred -vfz -n 10 /dev/sdxy

[genju]

Thanks guys for being so polite and cool helping me .
Now, I got some questions:
@Misalsf: isn't that exactly what Asus secure erase does tho? If so, I can do that from my BIOS.

But: the program that gave me the error was KillDisk and it was the free version and said one pass all zeros (cant select another format method because free edition). So I guess both Asus secure erase snd killdisk do the same? But asus secure erase didnt show any errors. Do I have to assume that my SSD is good now? The problem is that I already did an Asus secure erase 2 weeks ago (im fighting against this virus/whatever it is that is infecting my entire network for 2 months now) and then when I used killdisk today (bootable dvd linux version) it showed that error anyways.

@juanito: could you link me to that extension or some instructions maybe maybe? For a windows noob like myself.

Thanks.

edit Or maybe the Linux version of KillDisk uses tiny core and shows that as an error but not an actual partition?

edit2 It cant be that tho because according ot killdisk i have 6 partitions whereas windows only shows 4. Damn this is looking complicated.

[Misalf]

These extensions Juanito is mentioning are software packages / applications that you can install on (Tiny) Core Linux from the repository via the Apps browser.

I don't know what KillDisk does.
If you still see the partitioning after you've "KillDisk'ed" your drive, I think KillDisk might have not done enough (i.e. just wiping the data). Malware can hide in MBR/PBR as well.

[genju]

Ok, where can I start downloading all this? What commands will I need? Can I use an USB?
Sorry for the cringeworthy noob questions.

[polikuo]

A few questions.
Which version of windows are you using ?
Does it boot by legacy BIOS or UEFI ? (it helps determining whether it is MBR or GPT)
Is the partition table MBR or GPT ? (if it's MBR, run dd if=/dev/zero of=/dev/sdx bs=440 count=1)
Does any other computer under the same domain having the similar issue ? (could be a virus infecting the entire network, consider that you've been fighting for 2 month)
Do you have a spare computer that has a running OS ? (preferably windows since your unfamiliar with linux)
If you end up trying tiny core, gparted is a helpful GUI tool for beginner.

[genju]

A few questions.
Which version of windows are you using ?
Does it boot by legacy BIOS or UEFI ? (it helps determining whether it is MBR or GPT)
Is the partition table MBR or GPT ? (if it's MBR, run dd if=/dev/zero of=/dev/sdx bs=440 count=1)
Does any other computer under the same domain having the similar issue ? (could be a virus infecting the entire network, consider that you've been fighting for 2 month)
Do you have a spare computer that has a running OS ? (preferably windows since your unfamiliar with linux)
If you end up trying tiny core, gparted is a helpful GUI tool for beginner.

Im running w10 uefi.
Yes, its a virus affecting my whole network, more info here https://forum.xda-developers.com/g4/help/rootkit-lg-g4-takes-network-remove-t3563103/post71184870#post71184870

People interacted with me on twitch chat because they could see me through my webcam (im not joking). Lot of people subtweeted about it. I could show you via pm in case you think im trolling. This is a nightmare.

[patrikg]

Also a good start with tiny core linux is to read the good book.
That can be downloaded with this url:

http://tinycorelinux.net/corebook.pdf

[Rich]

Hi genju

edit Or maybe the Linux version of KillDisk uses tiny core and shows that as an error but not an actual partition?

According to the KillDisk website their  Linux console  version uses Tinycore.

edit2 It cant be that tho because according ot killdisk i have 6 partitions whereas windows only shows 4. Damn this is looking complicated.

Computers come with a recovery partition and sometimes a utilities partition. It's possible Windows does not see them
where Linux does. It's also possible you have a couple of hidden partitions where your virus keeps its payload.

[Juanito]

Ok, where can I start downloading all this? What commands will I need? Can I use an USB?

Perhaps the easiest is to burn tinycore to cd/dvd and boot from that - you can then use dd/fdisk/shred/secure-erase as you please.

http://www.tinycorelinux.net/7.x/x86/release/TinyCore-7.2.iso

[NewUser]

Is your disk a solid state disk?  If so, I would choose secure-erase. It will wipe the disk in seconds, other methods will take hours.

[coreplayer2]

Regarding an SSD, writing "Zero's" (programmed) will harm your SSD.  Maybe Harm is too strong a word, but with Zero's an SSD will have reduced write cycles remaining and the drive's controller will be tasked with a huge maintenance cleaning job before those blocks can be written to again, causing a severe performance hit at best.  Writing Zero's to an HDD leaves the drive in an empty clean state.  However the opposite occurs to an SSD which will be left with all blocks full.   These blocks have to be erased before they can be used again, writing 1's (erased) to an SSD is equivalent to writing 0's to a HDD.

Regardless of a modern HDD or SSD, the actions of a secure erase is programmed into he drive's controller, so the correct action will be taken when 'Secure erase" is commanded.   Remember not to confuse "Erase" options of partitioning and format utilities with "Secure Erase" which is totally different.

Look after your SSD's using Secure Erase ONLY.  To restore like new(if possible)  performance to an SSD use ONLY Secure Erase,.    Unlike Secure Erase for a HDD which can take hours,  the actual secure Erase of an SSD completes instantaneously since the task is purely electrical.   I think it's safe to say all SSD manufactures provide a Secure Erase utility,  however a Secure Erase extension is available in the repo for this.

With all MLC devices, SSD's, SD card's, USB Thumb drives etc. etc.   use secure erase to restore like new condition and performance.

Format with 1MB offset for best write performance.   Align by 1MB covers a multitude of scenarios, after all 1MB of space is a small price to pay for performance.  Whatever, do not align by Cylinder mode on a SSD (or any MLC device),  even HDD's perform better aligned to 512KB or 1MB rather than cylinders.   

 

[NewUser]

If you have a Windows PC that works, go here:  https://www.samsung.com/semiconductor/minisite/ssd/download/tools.html, download and install the Samsung Magician Software for Consumer SSD(3), which, according to the instructions, includes Secure Erase.  You'll have to move the disk, of course.

[genju]

@newuser, yes, tried with samsung magic and it says "device not supported".
Tried with asus secure erase from the bios but the virus keeps coming back.
Ran tinycorelinux, fdisk and got this

http://i.imgur.com/SteUZDX.jpg

What does this mean? Did it find a hidden ntfs partition on it or thats the memory?
Tried to run the dd command but nothing happened.

All this was using terminal.
Any help is appreciated.