Welcome, Guest. Please login or register.

Author Topic: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore  (Read 5395 times)

Description:

0 Members and 1 Guest are viewing this topic.

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #14 from previous page: December 24, 2011, 12:03:20 PM »
And it happened again today ... I was just swapping some PCMCIA device and that started saying my CF0: was "not dos" .. wich it obviously is and again df4: shows up.

When I boot from my OS3.9 emergency  disc, hdtoolbox says the drive isn't installed and also df4: shows up... something that otherwise doesn't happen.

Now I am sure the scsi.device from IDEFIX97 was activated and also pfs3 can't be the problem ..I think.

So I guess the RDB is gone again ... but can I restore that without loosing my partitions ? ANd what is causing this in the first place ?
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #15 on: December 24, 2011, 12:25:56 PM »
Do you have any means to transfer files from the internet to your Amiga? Another Amiga perhaps? Or can you connect the Amiga HDD to a PC running WinUAE (through USB adapter for example)?

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #16 on: December 24, 2011, 12:43:39 PM »
I can connect it with a USB adapter to both x86 with winuae or Powermac with MorphOS. The A1200 also can connect to the net with a 3com PCMCIA adapter and I think I have a bootdisc with Amitcp4 on it somewhere
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #17 on: December 24, 2011, 01:32:52 PM »
Ok, then download the attached file and run it against your HDD.

For WinUAE:

- right-click on winuae.exe and select "run as administrator".
- go to the Quickstart page and select "expanded WinUAE example configuration". Ignore any complaints about missing Roms.
- go to the Roms page and select either KS 3.1 ROM (if available) or AROS KS ROM (builtin).
- go to harddrives page,
click on "add Harddrive" and select your Amiga HDD. Activate the "Read/Write" check box.
click on "add directory or archive", "select archive or plain file", then select the ReRDB.zip file.
click on "add directory or archive", "select directory" and navigate to C:\Users\Public.
- click on Start. It should boot into a DOS window with a 1> prompt.
- enter
rerdb uaehf.device 0 dumpfile public:documents/dump.bin
- check what is written under "reconstructed RDB". If you like what you see enter
rerdb uaehf.device 0 write
- now the HDD should have some partitions again. Depending on how much data was overwritten, the first partition(s) may be missing.
- please attach the C:\Users\Public\Documents\dump.bin file here so that I can analyse it.

For real Amiga:

- unpack the attached ZIP file.
- transfer the resulting file ReRDB to the Amiga
- on the Amiga open a Shell window
- enter
df0:rerdb scsi.device 0 dumpfile df0:dump.bin
- check what is written under "reconstructed RDB". If you like what you see enter
df0:rerdb scsi.device 0 write
- now the HDD should have some partitions again. Depending on how much data was overwritten, the first partition(s) may be missing.
- please attach the dump.bin file here so that I can analyse it.

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #18 on: December 24, 2011, 02:57:14 PM »
Well I did this on the "real" amiga... All I retrieved is an unreadable DH1: partition. Dh0: didn't return so far.

Now I have to find a way to get that file on my emergency disc back to media that my windowsmachine can use.
 

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #19 on: December 24, 2011, 03:30:36 PM »
Now it's getting really strange ... I fired up another A1200 to transfer that dump.bin on to my cfcard that is FAT formatted and it also is suddenly unformatted .. and yes it was in the A1200 when it crashed. I really start thinking towards virus here.

Anyway the file is attached now
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #20 on: December 24, 2011, 04:00:57 PM »
This is a hex dump of the dump file:

Code: [Select]
0000: 444F5300 5CEB2D01 00000370 60000006    DOS.\ë-....p`...    
0010: 60000060 2C790000 000448E7 FFFE41FA    `..`,y....Hç.þAú    
0020: FFE06100 002A303C 010022D8 51C8FFFC    .àa..*0<..&quot;ØQÈ.ü    
0030: 0C390044 000FE000 6700000E 4EF90007    .9.D..à.g...Nù..    
0040: F4104EF9 00C7E1B0 4EF9000F E01033FC    ô.Nù.Çá°Nù..à.3ü    
0050: 4E70000F E0000C79 4E70000F E0006600    Np..à..yNp..à.f.    
0060: 000A43F9 000FE000 4E7543F9 0007F400    ..Cù..à.NuCù..ô.    
0070: 4E752C79 00000004 61000040 4CDF7FFF    Nu,y....a..@Lß..    
0080: 60000020 646F732E 6C696272 61727900    `.. dos.library.    
0090: 464D464F 4A20584A 53565420 56322E32    FMFOJ XJSVT V2.2    
00A0: 00AE43FA FFE02C79 00000004 4EAEFFA0    .®Cú.à,y....N®.*    
00B0: 20402068 00167000 4E756100 00226100     @ h..p.Nua..&quot;a.    
00C0: 003E41FA 003A2D48 002E41EE 00224240    .>Aú.:-H..Aî.&quot;B@    
00D0: 7217D058 51C9FFFC 46403080 4E752C79    r.ÐXQÉ.üF@0.Nu,y    
00E0: 00000004 33FC4EF9 00000110 23EEFD9E    ....3üNù....#îý.    
00F0: 00000112 41FA0070 2D48FD9E 4E7513FC    ....Aú.p-Hý.Nu.ü    
0100: 00997628 51402C79 00000004 6100FFD0    ..v(Q@,y....a..Ð    
0110: 41FA0020 B1EEFE3A 67000016 33FC4EF9    Aú. ±îþ:g...3üNù    
0120: 00000100 23EEFE3A 00000102 2D48FE3A    ....#îþ:....-Hþ:    
0130: 4E752C79 00000004 0C690002 001C6700    Nu,y.....i....g.    
0140: 00380C69 0003001C 6700011C 0CA90006    .8.i....g....©..    
0150: E000002C 6600000A 13FC0000 76285140    à..,f....ü..v(Q@    
0160: 4EF90000 010048E7 FFFE6100 FF724CDF    Nù....Hç.þa..rLß    
0170: 7FFF4EF9 00000110 4AA9002C 6600FFE2    ..Nù....J©.,f..â    
0180: 48E7FFFE 33E9001C 0007F900 23E90024    Hç.þ3é....ù.#é.$    
0190: 0007F904 23E90028 0007F908 23E9002C    ..ù.#é.(..ù.#é.,    
01A0: 0007F90C 337C000E 001C2C79 00000004    ..ù.3|....,y....    
01B0: 6100FFAE 4AA90020 66000060 337C000F    a..®J©. f..`3|..    
01C0: 001C2C79 00000004 6100FF96 4AA90020    ..,y....a...J©.      
01D0: 66000048 337C0003 001C6100 00066000    f..H3|....a...`.    
01E0: 003A6100 005E41FA FE182348 0028237C    .:a..^Aúþ.#H.(#|    
01F0: 00000400 0024237C 00000000 002C2C79    .....$#|.....,,y    
0200: 00000004 6100FF5A 337C0004 001C2C79    ....a..Z3|....,y    
0210: 00000004 6100FF4A 4E754CDF 7FFF3379    ....a..JNuLß..3y    
0220: 0007F900 001C2379 0007F904 00242379    ..ù...#y..ù..$#y    
0230: 0007F908 00282379 0007F90C 002C6000    ..ù..(#y..ù..,`.    
0240: FF2041F9 76284E38 203CFFFF FFFF223C    . Aùv(N8 <....&quot;<    
0250: 000000FF 42829098 918251C9 FFFA23C0    ....B.....QÉ.ú#À    
0260: 76284E3C 4E750C79 111100F8 00006700    v(N<Nu.y...ø..g.    
0270: FEF00C39 00997628 51406600 FEE448E7    þð.9..v(Q@f.þäHç    
0280: FFFE2C79 00000004 43FAFDFA 4EAEFE68    .þ,y....CúýúN®þh    
0290: 23C07628 514E2C40 41FA006F 2208243C    #Àv(QN,@Aú.o&quot;.$<    
02A0: 000003EE 4EAEFFE2 23C07628 515241FA    ...îN®.â#Àv(QRAú    
02B0: 006E2408 263C0000 00D02239 76285152    .n$.&<...Ð&quot;9v(QR    
02C0: 4EAEFFD0 41FA004C 2208243C 000003EE    N®.ÐAú.L&quot;.$<...î    
02D0: 4EAEFFE2 23C07628 515241FA FD242408    N®.â#Àv(QRAúý$$.    
02E0: 263C0000 04002239 76285152 4EAEFFD0    &<....&quot;9v(QRN®.Ð    
02F0: 22397628 51522C79 7628514E 4EAEFFDC    &quot;9v(QR,yv(QNN®.Ü    
0300: 4CDF7FFF 6000FE5A 01432F4D 6F756E74    Lß..`.þZ.C/Mount    
0310: 0000432F 44000000 00000000 00000000    ..C/D...........    
0320: 03F30000 00000000 00010000 00000000    .ó..............    
0330: 00000000 00200000 03E90000 002048E7    ..... ...é... Hç    
0340: FFFE2C79 00000004 43F90000 00644EAE    .þ,y....Cù...dN®    
0350: FE6823C0 00000078 2C40223C 00000070    þh#À...x,@&quot;<...p    
0360: 243C0000 03ED4EAE FFE223C0 0000007C    $<...íN®.â#À...|    
0370: 243C0007 F000263C 00000400 22390000    $<..ð.&<....&quot;9..    
0380: 007C4EAE FFD62239 0000007C 2C790000    .|N®.Ö&quot;9...|,y..    
0390: 00784EAE FFDC4CDF 7FFF4EF9 0007F00C    .xN®.ÜLß..Nù..ð.    
03A0: 4E75646F 732E6C69 62726172 79005359    Nudos.library.SY    
03B0: 533A432F 44000000 00000000 00000000    S:C/D...........    
03C0: 03EC0000 00070000 00000000 000C0000    .ì..............    
03D0: 00160000 001E0000 002E0000 00400000    .............@..    
03E0: 004A0000 00500000 00000000 03F20000    .J...P.......ò..    
03F0: 762894E8 00000128 76289490 760F6744    v(.è...(v(..v.gD    


It's obviously some kind of floppy boot block. And it contains the text "FMFOJ XJSVT V2.2" which matches this: http://www.vht-dk.dk/amiga/desc/txt/eleni22.htm

Offline bloodline

  • Master Sock Abuser
  • Hero Member
  • *****
  • Join Date: Mar 2002
  • Posts: 12113
    • Show only replies by bloodline
    • http://www.troubled-mind.com
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #21 on: December 24, 2011, 04:29:15 PM »
Ooh!! A Wirus!!! ;)

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #22 on: December 24, 2011, 06:18:52 PM »
amazing sentence , that last one ... I used a floppydisk with XCOPY 8.5 two minutes before the crash ...

Merry Xmas ... a-holes whoever wrote it back then.
 

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #23 on: December 24, 2011, 08:07:34 PM »
Ok I learned it the hard way I shouldn't test/check floppydisks I get from strangers who's Amiga I bought for a humble 10 euro ... that's where the xcopy disc came from.

That said can't I backup my RDB some way to put it back afterwards when things like this happen ?
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #24 on: December 24, 2011, 10:17:28 PM »
To get DH1 back you just need to run IDEfix (or LoadIDE). Without it the area outside the first 4GB cannot be accessed and because of this DH1 appears to be unreadable. But the data is not lost, it's just not accessible.

To get DH0 back you need to run HDToolbox and create a new partition in the empty space before DH1. If you enter exactly the same values as your DH0 had before, you'll get all your files back.

But the most important issue is to get rid of the virus. This should be the first thing you do.

- switch off the Amiga.
- find a bootable floppy disk which you didn't use since you were infected.
- make sure that it has the write protect swich on
- boot from it and then check all other floppy disks one after the other. If you find a file called D in the C directory, delete it, delete the Mount command and overwrite the boot block by install df0:. Note that a Workbench disk will not boot without the Mount command, so if you have a proper Mount command on your uninfected disk, copy it to the formerly infected disk.
- Do this for every disk which might be infected. Be careful not to boot from an infected disk and not to run a program from an infected disk. Once you run an infected program you can (and must) start all over from the beginning again (switch off the Amiga, ...)

Every disk without the write protect switch on which you inserted into the drive while the Amiga was infected is probably infected now, too.

Be sure to keep the write protect switch on on all floppy disks. Only switch it off for a short period if you really want to save data to the disk and immediately enable it again afterwards.


Regarding backup of the RDB, there are some programs on Aminet which can do it.

TSGUI can do it, too: http://thomas-rapp.homepage.t-online.de/downloads/tsgui.lha
Just select a partiton on the harddrive, then choose "save RDB to file" from the menu.

Offline SimonVTopic starter

  • Jr. Member
  • **
  • Join Date: Jun 2006
  • Posts: 75
    • Show only replies by SimonV
    • http://www.amigaclub.be
Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #25 on: December 25, 2011, 12:15:02 PM »
Amazing, I got my partitions back without losing anything. You deserve a medal.

About infection. Isn't the virus still on my HD ? Luckily most of my floppys are write protected so not much work there.
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #26 on: December 25, 2011, 12:59:53 PM »
Quote
Isn't the virus still on my HD ?


Same procedure here: switch off the computer, then boot from an uninfected floppy disk, delete c/D and c/Mount from the boot partition and copy back a clean Mount from the WB floppy or OS 3.9 CD.