HPA possibly left by a virus/malware

Hello everyone,

I've gone through quite a lengthy process of removing some malware - seen here http://www.bleepingcomputer.com/forums/topic446369.html - from a machine I've been tasked with working on for someone and It's come to my attention that there is a sneaky little partition floating on this machine.

I've come to find out there is a 'Host Protected Area' aka 'Hidden Partition Area' - HPA - which wasn't hidden when Windows was installed and I doubt the end user knows anything about it other than they may have noticed the hard drive shrink 4.74GB/4.41GiB, but they probably didn't. Anyway, the person on the virus forum told me this isn't a virus infection but I'm afraid it is, since it very well could be quite a complex and sneaky root kit hiding on this HPA.

If I reformat this machine and re-install Windows, this HPA is going to remain untouched and if it still has an infection of some sort, everything done in the other forum was for naught.

I tried using HDAT2 to remove this HPA but I wasn't successful. Upon reboot it is back. I am going to read up on hdparm, once I get my LILO booting using UUIDs so that I can plug this IDE based drive into my computer running an OS from a SATA drive which is on channel 2 and the ATA is seen as channel 0. Not sure where channel 1 went, possibly off to a singles bar? ....wow I should be a comedian.

I digress.

I'm not sure why HDAT2 didn't work. It seemed to me it was the defacto tool for this job. Here is exactly what I did.

IMG293
You can see the drive capacity as 35.28 GB. There is an exclamation point next to it, down the bottom you can also see that HPA_IS_ACTIVE flag is set - I believe this is an HDAT2 term and refers to the Host Protected Area being set with a MAX ADDRESS set to a size smaller than the native drive size MAX ADDRESS. Press 'Enter' to get the 'Main Menu'

IMG294
HDAT2's 'Main Menu' with 'HPA Menu' highlighted

IMG295
HDAT2's 'HPA Menu' with 'SET MAX ADDRESS AT command menu' selected. Again this shows that the drive has HPA enabled, which isn't done by a flag but instead from the user address space not matching the native address space.

IMG297
Here is the meat of the 'SET MAX ADDRESS command menu'. You can see that there is a 4.74GB or 4.41GiB(as reported by Windows) difference. To fix this you use the SET MAX ADDRESS AT command through this utility, or something similar.

IMG298
I hit the S key at the previous window and I was prompted to make sure. Hit 'Y' key to run AT command SET MAX ADDRESS.

IMG299
I am informed that I need a power-on or HW reset to issue the command a second time for success. I pulled the power plug from the drive and plugged it back in and went back to the main screen in IMG293.

IMG300
I repeated the steps in IMG293-IMG298 and I was told the command was completed successfully.

IMG301
I am back at the 'Main Screen' and it shows that the drive is now 40.02GB or 37.27GiB as Windows would report, which happens to be the size of the Windows partition, as reported by Windows and ListParts.exe.

IMG302
Just verifying in the 'HPA Menu' that HPA is disabled.

IMG303
Here in the 'SET MAX ADDRESS AT command menu' you can see that the drive is no longer seeing a difference. However, upon reset I find that there is still an issue since if I go into HDAT2 again I have to do it all over again. If I boot into Windows I am able to see that the drive is still only detected as 33 GiB using ListParts.exe or Windows Explorer.

This system is running Windows XP

Hi

Could it be unallocated space on the drive?

To check, you can look at it in the Disk Manager.
In XP right-click on My Computer and choose Manage
In the tree in the left window under Storage choose Disk Management
In the lower right window you should see a graphical representation of your hard drive showing how much the C: partition occupies. What does it say about the extra space? Does it say something like '3.5GB Unallocated'?

James

EDIT: I couldn't find any clues to this in your other thread but is it possible that this drive originally was in an old Dell PC?

No, it's HPA. I will post logs that show the Windows partition being 37GiB and the drive capacity being 35GB/33GiB. I will take a screenshot as well. The drive is being seen by BIOS as only 33GiB. Should be 37.25GiB. In no application can I see that this is a 40GB/37.25GiB drive, not partition, drive.

Once I find the usb flash drive the logs are on, I will post them.

I'm actually working on getting my Linux system booting from UUIDs so that I can do some better diagnostics on this device. I will report back tomorrow.

I am highlighting information in red and putting my comments in grey.

ListParts by Farbar Version: 12-03-2012 03
Ran by Staff (administrator) on 23-04-2012 at 13:56:36
Windows XP (X86)
Running From: C:\Documents and Settings\Staff\Desktop
Language: 0409
************************************************************

========================= Memory info ======================

Percentage of memory in use: 22%
Total physical RAM: 1023.49 MB
Available physical RAM: 788.93 MB
Total Pagefile: 2462.36 MB
Available Pagefile: 2309.05 MB
Total Virtual: 2047.88 MB
Available Virtual: 2009.71 MB

======================= Partitions =========================

2 Drive c: () (Fixed) (Total:37.26 GB) Here they say drive C: but it actually means partition C:. I'm sure you know that, but for other readers this would be some educational information. A hard drive/disk has become an inter-changeable term that seems to have gotten gummed up in Microsoft's OSs over the years. A drive is where the media goes and the disk/disc is the media. C for optical k for magnetic. In a CD ROM the device with the tray is the 'drive' while the CD itself is the disc. Same goes for floppy except it's a disk. In a hard drive the disks are the platters. (Free:17.25 GB) NTFS ==>[Drive with boot components (Windows XP)]

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 33 GBHere the Disk/Drive is being displayed as having a total capacity of 33GiB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 37 GB 32 KB
======================================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C NTFS Partition 37 GBAgain the partition is shown as larger than drive capacity, which is obvious in the screen shots I posted earlier. Healthy System (partition with boot components)
======================================================================================================

****** End Of Log ******

Have you checked the BIOS for a setting that disables it?
The setting has different names depending on the computer. What is the manufacturer/model of the computer? If you are not sure, do you know what the manufacturer/model of the motherboard is?

James

Here is an example of what you would see in Disk Management if it was an old Dell drive like I asked in the first post...



Your image will not have the Dell Utility or Dell Restore partitions but you should see the HPA part shaded out.
Do you see something like that?

James

To answer your questions, there isn't any BIOS options. It's a local shop build and it's a Gigabyte GA-8IPE1000 motherboard.

I don't mean for you to take any offence by this at all, I am just proving a point that Microsoft tools - as well as many other tools - are NOT to be relied upon.

Windows Disk Manager is irrelevant, I have pictures to prove it. I'm sure if the HPA was created before installation and/or didn't overlap a partition Disk Manager would detect it properly.

Here is what I did, using a new disk someone wanted me to buy then stuck me with...

* I installed Windows XP on a 500GB 2.5" sata drive using the same system.
* I completed installation and then rebooted into HDAT2 ( Hiren's Boot Disc )
* Using HDAT2 I careted a 250GB HPA
* I rebooted, and it was persistent.
* I unplugged the HD power and plugged it back in. HPA was persistent.
* I rebooted into Windows and looked at Disk Manager
* It still showed a 500GB partition and 500GB disk. Where BIOS, and every other tool at my disposal showed only a 250GB disk with a 500GB Windows partition, if partition * information was available by that tool.
* I rebooted with the Windows install disc.
* I deleted the 500GB partition.
* Windows Setup is now showing that only 250GB is unallocated.

I have taken pictures for every step as proof. There is no point of me looking at Windows Disk Manager because just like the rest of Microsoft Windows, it just falls short of a set of REAL tools. Do you have another diagnostic process to figure out why HDAT2 won't remove this HPA?

The issue I'm trying to resolve is I think there is a virus on this HPA which I spent quite a while removing from the system on these forums in the thread linked to above. I need to get rid of this HPA otherwise I suspect the virus is going to come back.

Could that board have had Gigabyte's Xpress Recovery installed on it? That creates an HPA.
http://www.manualowl.com/m/Gigabyte/GA-8IPE1000-Pro-G/Manual/239664?page=99

I was just going through the process of determining whether it was an HPA created by the MBR like an old Dell drive does or if it was an HPA controlled by the BIOS like an old Thinkpad does. I haven't dealt with these in several years because both companies began to realize the problems created when users tried to clone and install larger drives.

If you don't want to go through that process then you can do a scorched earth approach and use hdderase
http://www.ocztechnologyforum.com/forum/showthread.php?74093-How-to-use-HDDErase
Which is what Uncle Sam says to use for removing HPA and DCO nasties

James

EDIT: Did a quick search and found this post about a BIOS upgrade required to fix a different Gigabyte board with a similar problem. Do you think this might be what is happening?
http://blog.gleonard.com/2011/07/gigabyte-xpress-recovery-and-host-protected-area/

Also, if it is Xpress Recovery then in the BIOS you may be able to run it (or by pressing F9 at startup) and select REMOVE which will remove the HPA and the space will be unallocated.

I've never used express recovery. I think that was 99% of my problem but now there is 3MB I can't get rid of. Hopefully the drive will be set to a usable state using HDD Erase, it's running now. I've spent way too much time on this system...I hate quitting!