Unable to get back to Factory Image....

Message

stephenaron · #1 Post by **stephenaron** » Fri Oct 20, 2006 5:54 pm

I updated the bios, and then decided to use the hidden image to wipe the drive and return it to the factory state. I have been unable to do so. I also tried to do it using the CD's IBM sent me, but cant finish with those either. I get most of the way sometimes and then get some error message with MAILMAN.EXE in it. I read up and it seems that would suggest a TROJAN. Why wont using the CD's format the drive (and the trojan) and then put a fresh image on the drive? Help? IBM sending me a box to send it back, but i would prefer to fix it "in house".

#2 Post by **Kyocera** » Fri Oct 20, 2006 7:28 pm

That is kind of bizarre, a couple of the tv ad's were geared directly toward virus recovery on the spot with the hpa.

stephenaron · #3 Post by **stephenaron** » Sat Oct 21, 2006 8:07 am

Can you expand on that?

Xavier · #4 Post by **Xavier** » Sat Oct 21, 2006 9:54 am

It sounds very weird.

When you boot from the Recovery CD, nothing that is on your hard drive is loaded: I don't see how a trojan could possibly mess with it.

Can you describe more precisely the error messages you get ?

The standard procedure for returning the hard drive in factory state from the CDs is the following:

Turn you TP on, then go to the BIOS and change the boot sequence so that your optical driver be the first device in the list. Then, put the CD (first CD, probably labelled "Recovery CD 1/1"), restart the TP, and let it boot on the CD. It will reinstall the pre-desktop area, and then let you restore your preload from the other CDs you've got.
It is very important not to boot on the first CD using F11, this can really mess things up!

#5 Post by **Kyocera** » Sat Oct 21, 2006 11:34 am

Xavier pretty much said it all, wiping out all the data on the hard drive completely (with the CD's) should get rid of any and all data on the drive, which of course would mean the virus also. I don't think trojans get into the bios. I'd give it another shot, if tech suport wants your machine they obviously have no clue what is going on either.

Unfortunately.

christopher_wolf · #6 Post by **christopher_wolf** » Sat Oct 21, 2006 2:39 pm

There are boot-sector based viruses, but there is not one virus that I have heard of that can embd itself into the BIOS. Not only would that be highly evident, it would also limit the virus's range of operations because different systems may have different BIOS chips and the virus has no way of re-adapting to the new BIOS.

It could be that it resided in a sector of the drive that was untouched by the re-image. Although I still don't think that is likely. It could be that the trojan infected the files that were burned to the disks during the initial RnR operation while you were in windows.

Are you sure this is a trojan? As all I can find on that particular trojean doesn't suggest a capacity for installing itself into special sectors at all.

stephenaron · #7 Post by **stephenaron** » Sat Oct 21, 2006 6:01 pm

i thank everyone for their feedback. I have used IBM (real ones) Recovery CD's...and yet everytime it fails and some message that stays on teh screen only for a moment, displays "Mailman.exe....."
The CD's appear to be Resuce and Recovery 3, or at least that is whats on the screen during the beginning of the restore process. I too thought taht a virus would be wiped out with teh process, so if its not a virus, then what? Is there a way to reflash the bios with an OS installed?