ide drives reported as SCSI?

[darthishpierro]

Hello All, I'm in desperate need of help. I was caught out with the sasser worm lately, got rid of it but decided to go for a fresh install anyway. I installed win xp pro, sp1a, mcafee virus with latest dats, then logged on to the net to run windows update. Then netsky attacked, before the update was complete. I got rid of this with the stinger tool from mcafee but was still having problems with the pc running real slow. So, I got the latest dats for mcafee again, ran a cirus check, and got a message saying my hard drive was write protected. Checked the properties on the hard drive to find that win xp had it down as a SCSI drive, which it isnt. Same for my dvd drive. my sytem specs are as follows:-

athlon xp 3200+ barton
abit nf7 mobo
512 ddr400
hercules radeon 9800se AIW with omega softmod drivers
maxtor ata133 7200 80gb hdd
sony dvd-rom/cdrw combi drive
rockwell external v.90 modem

Has anybody even heard of anything like this before? I've been messing around with pc's for ten years, and consider myself reasonably well aquainted with the beige box, but I am tottlay stumped with this one.

any help would be hugely appreciated.

 

[oldman420]

welcome to the forums darth!
first off i have only one word "firewall" any reputable firewall even windows built in firewall would have stopped sasser it is critical to have a firewall up and running before you attach the box to the net.
second off you cant just "get " netsky it is an exacutable file that is email bound.
netsky does not degrade performance
givin this did you do a reformat reinstall or just a refresh reinstall. i see you had the right idea by taking all precautions before connecting but if you have remnants of infection in program folders my docs etc infection will resurface.
it sounds to me like an install of xp gone bad, if you lost connection or had other critical errors while doing windows update that could also kill xp.
extreme as it may sound i would put any user files on cd repartition reformat and reinstall xp as you did before with the exception of turning on xp firewall or even better free zone alarm also before connecting. then scan the files on cd before reinstalling them
good luck you will get it

 

[helpmeout]

You aren't using a controller card, are you? That's the only time I know of that windows will call a drive SCSI when it isn't.

 

[mechBgon]

First, the SCSI thing. If you install the nVidia SW IDE drivers during nForce2 driver installation, Windows will decide your ATA controllers are "SCSI." Nothing wrong with that in its own right.

Secondly, McAfee with the latest DATs should be stopping Netsky variants dead in their tracks. Did you have it fully configured (scan ALL files and filetypes, scan within compressed files etc, heuristics enabled, no exemptions, kill on sight without pandering to the user)? Also, did you update the engine itself? Use McAfee's SuperDAT to update both the engine and the DATs. The current engine is 4.3.20.

If you need a firewall software, ZoneAlarm's basic free one is good. Also, here's a Security Rollup package you could burn to CD for systems with a fresh WinXP SP1A installation: link

 

[darthishpierro]

Hi Guys, thanks for the tips,

 

[darthishpierro]

Hi Guys, thanks for the tips,
just to confirm, when I re-installed win xp, i did a full format / delete partitions / create partitions / install. As far as a firewall, yes i must admit i was lacking in that department when sasser struck. I now have firewall enabled in win xp, but I didn't turn it on until after the latest attack. I'm also pretty sure there were no attachments or anything opened, as this netsky attack was just after i had re-installed and seemed to happen while i was running windows update. The Nvidia drivers explanation explains the scsi problem, but it is still write protected according to mcafee (latest dats and engine both loaded). I'm thinking of trying to run panda active scan to see if anything is still lurking on my system, if I get no further with that, I'll be taking your sound advice(s) and starting over again. thanks,