"Rebuildfstab" on a windows 10 ssd? Can't fully format (I believe)

[Misalf]

Because actions like these can be very dangerous for your system (i.e. choosing the wrong drive by accident) you need to run them as root / super-user (administrator). To do so, precede the command you want to run with the  sudo  command.

Code: [Select]

sudo dd ...


[coreplayer2]

Some manufacturer's utilities are designed to perform only on their drives.  For example Samsung utilities will likely work only on Samsung branded and possibly selected drives.

Use the utility provided by your drive's manufacturer for your SSD model, or use the Secure Erase extension provided in the tinycore repo which is unaware of manufacturer.

These are your only two choices to correctly secure erase the drive and restore like new performance.  There are so many other tools to wipe a drive but they were written for Hard Disk Drives, not SSD's which are a different animal.  Any other method, for example DD, etc. etc. as said earlier will hurt your SSD.

After a secure Erase, you can then use FDISK to partition as intended.

[patrikg]

What i can see in samsung webpage the firmware for evo 840 is very popular.


http://www.samsung.com/semiconductor/minisite/ssd/download/overview.html
http://www.samsung.com/semiconductor/minisite/ssd/downloads/software/Samsung_SSD_840_EVO_EXT0DB6Q.iso

[genju]

Ok, the virus is in the ram. Booted from usb with no ssd whatsoever and the partition that contains the viruses and all that crap was still there.
I cant even flash bios anymore. I tried to go back to an old version and every single one is the same. I remember the old versions and didnt have some features that now I can see.

I cant use my computer since two months now. Lost tons of stuff, cant even work at thome because I had that hdd unplugged.. They have access to everything.

So, how can I remove this stuff from the ram? It sounds unbelievable but its true.

[Juanito]

Are you sure that the virus isn't on the usb stick? If the ssd is not connected, then how can you see a partition with a virus on it unless it is on the usb stick?

If you can boot from cd/dvd, it would be better to burn a tinycore iso to cd/dvd on a clean machine and boot your infected machine with that to clean it.

[genju]

Because I can still browse the infected partition (X:) with no ssds, usbs nothing.
It is there.

Same thing happens when I try to install windows from an usb. I tested, unplugged everything and still cna browse the X: partition. I need to get rid of it, its literally making me lose a lot of time and money.

[Juanito]

What is the partition x on? It must be on some kind of non-volatile device?

Did you try to boot from a tinycore cd/dvd?

[genju]

Tried both, CD and USB.
On BIOS I see a lot of dram related stuff with very weird values. I was suspecting the it was located in the ram but this confirms it. Forgot to mention, I got this virus when I tried to install an app called manageiq. One of the strps was to install a virtual machine, and another step was wrong on purpose. It instructed the user to pate someone elses json on a cloud instead of instructing the usrr to create  his own private key. It was late and I honestly I didnt known how dangerous that was but after that, they have control over my computer/network.

Here, to prove my point, this right now is being broadcasted and here are some threads of people mocking me for being a linux noob.

http://forum.tinycorelinux.net/index.php/topic,20755.0.html
http://forum.tinycorelinux.net/index.php/topic,20762.0.html
http://forum.tinycorelinux.net/index.php/topic,20765.0.html --> notice the screencap w cellphone just like I did earlier today. The did this before aswel. They follow me to every forum I ask help on and start making fun of me (linustechtips network section last month for example) for... getting hacked in a very tricky way.
http://forum.tinycorelinux.net/index.php/topic,20771.0.html
http://forum.tinycorelinux.net/index.php/topic,20736.0.html
http://forum.tinycorelinux.net/index.php/topic,20793.0.html
http://forum.tinycorelinux.net/index.php/topic,20798.0.html

They also interacted with me through my webcam.

Sorry for not knowing how to remove a virus that was installed by people that I really trusted (it was a targeted attack, not random.. One of them said I was "selected" just because I have a nice pc). And I dont know what did I do to get all this undeserved humilliation. Tried to talk nicely with these guys but they dont reply/act like they dont know anything when I know that they stream my ipad/pc screens and subtweet about it.

I dont wish this to anyone, not even my worst enemy.

[Juanito]

Even if the virus was in ram, if you turn the machine off, disconnect any storage devices (hd, ssd, usb stick, etc) diable wired and wireless networking and then turn it back on again with only a cd/dvd drive connected I don't see how it can be re-infected unless you have some non-volatile ram.

Have you booted from a tinycore cd/dvd after doing the above?

[genju]

I tried everything. cd, usb, I evne tried with a different stick of ram (which tbf it was installed when I got infected so theres that). Ram is ddr4 mushkin and as I said before, Ive never seen so many virtualization-related items on my bios ever.
Tbh im surprised that you are asking that to me. I dont want to sound like an assole but google partition x vm or virtual mchine or ramdisk. I say I dont want to sound like an asshole because they are filtering my google results right now so I cant post any links (yes, it is THIS bad).

[polikuo]

What Juanito is trying to say is that, it is impossible for anything to stay in RAM when it is uncharged.
(i.e. shutdown your pc and unplug the power cable)
Remove the ethernet cable, boot the computer with tiny core CD and your SSD.

However, the hackers probably have attacked your network service provider as well, since they can filter your google results.

[genju]

I dont think so. It all started when I tried to install the program I mentioned before.
They can inject javascript stuff into my ipad, thats how can they filter google results etc.
So, no possible way to remove this X: partition using tinycore despite the fact that is mentioned everywhere when it comes to VMs, right?

edit forgot to mention I even changed the modem two momths ago and still got the damn x partition. It survives all kind of formats... You guys created a monster without even knowing it,

[polikuo]

X: partition

Sounds like you're booting with a MS-DOS bootale media or something related to M$.
linux doesn't assign a partition the way M$ does, are you exploring the disk with M$ ?
If the mysterious X partition can not be seen with gdisk, it could be a virtual disk.
If so, unmounting it might help.

Oh, BTW,

Ran tinycorelinux, fdisk and got this
http://i.imgur.com/SteUZDX.jpg
What does this mean?

Disk /dev/sda is your samsung SSD with GPT partition table.
fdisk can't read it.
Dowload gdisk to see what's inside.

Disk /dev/sdb (I guess) is your tiny core boot media.
8G USB stick I think.

Disk /dev/sdb1 is something I'm unfamiliar with.
A partition inside a partition

forgot to mention I even changed the modem two momths ago

I mean the network service provider upstream to your modem.

[coreplayer2]

Here are some important things to consider..

1.  Logically and most importantly, a Virtual Machine has to be loaded into memory from non volatile storage, otherwise the software does not exist after a shutdown and reboot. 
if you disconnect every Hard Disk Drive, SSD and mSATA device then there is nowhere a VM can be loaded from.  ASUS motherboards come with all kinds of mSATA and variant types of additional storage devices.
To learn more about mini SSD's look here https://rog.asus.com/articles/hands-on/easy-guide-to-ssds-sata-msata-m-2-and-u-2/

 Have you really disconnected all these devices and tried to boot only the tinycore cd??  I believe you've missed something, a device still connected..

2.  Only thing I noticed is the partition within a partition, how you managed that I don't know..  sdb1p1 is a mistake which needs fixing.   
Is sdb1p1 a USB thumb drive? or a motherboard mSATA storage device like M.2 ?  secure-erase.tcz extension will definitely erase the Samsung  SSD, however it may not have access to the mSATA or variant device to command a secure erase.
gparted.tcz extension will also remove any partition tables form any device it recognizes.

Note: when using the command line it's easy to make a mistake.  if using fdisk to create a partitions use

Code: [Select]

fdisk /dev/sdbnot fdisk /dev/sdb1

gparted has a graphical user interface which makes things easier


and remember: when working with SSD's, mSATA devices, USB thumb drives, etc etc.  stay away from any utility option that writes Zero's to the drive.  zero's are for the dinosaur hard disk drives.