Recovery Partition

[h4d3s]

Heloo, i have problem becouse of my virus, i use all the time mcaffee anti virus today after i plug my pendrive then try put some movie on it i get error after i plug it again i get 50 new fake file with fake date and fake size for ex i have 7 gb pendrive and files was there 32 gb ... and my question is if you make new system with recovery partition then i get clean system? becosue now my mcafee dont find any virus ;/ pls help me .

[WAWood]

@h4d3s 

Malware is totally unpredictable, so there is no way to know what got infected and what did not.

IF the Recovery partition was no touched, and it still works, then by pressing F11, you should be able to use HP Recovery to reset your PC.  Since that starts by reformatting your ENTIRE drive and erasing everything in the process, you will remove all traces of the malware in the process.

However, you will lose everything in the process, as well, and if you back up personal files and restore those, since those MIGHT be infected, you then risk re-infecting your PC after the reset,

So my suggestion would be, after you do the reset, if you've saved personal files and folders to a USB stick, insert that into your PC and run an AV scan to include the contents of that stick.

[h4d3s]

Thanks for fast answer, btw malware can be reason of slow working my laptop ? its really works slow, when i turn it on then it need some time to start for example with chrome, other example laptop is working but chrome get frozen, and it have - not responde status

[WAWood]

@h4d3s 

Generally no, the focus of malware is not to slow down your PC but either to trash it, or in the case of ransomware, to lock up your files and demand money from you.

If the PC is running really slow, that is more often an indication of a failing hard drive.

If your PC is new enough to support UEFI, you can use these steps to test the hard drive: http://support.hp.com/us-en/document/c00439024

If not, to check the drive you have to follow these steps:
1) Press Esc key repeatedly, several times a second, while rebooting the laptop. Do NOT hold the key down, just press it over and over.
2) Eventually, you will see an HP Startup Menu -- that will look similar to the image below ...

3) press the Function key for testing the hard drive (usually F2) and let it run.

Please report back the test results.

[h4d3s]

I just make that test and look at this:

2020-03-29 17:55:15  ================================================
2020-03-29 17:55:16  EFI System Diagnostic 7.3.0.0 Started
2020-03-29 17:55:16  Load Options Blank
2020-03-29 17:55:16  SysDiagsBiosData2011 Configuration Variable Acquired, SysDiagsBiosData2010.Version 1
2020-03-29 17:55:16  Found HP Thermal Diagnostic Protocol
2020-03-29 17:55:16  HP Thermal Diagnostic 2 Protocol Not Available
2020-03-29 17:55:16  [L]> System ID: 838F
2020-03-29 17:55:16  HP BIOS Image Interface Protocol Version 2.0
2020-03-29 17:55:16  [L]> Found 4 Processors 4 Enabled Processors
2020-03-29 17:55:16  [L]> MpService2 found Bsp at index 0
2020-03-29 17:55:16  [L]> Found 1 Absolute Pointer Protocol(s)
2020-03-29 17:55:16  [L]> 0 UART device path node found.
2020-03-29 17:55:17  System Family: = 2
2020-03-29 17:55:17  Filter Serial Port Test for SystemFamily 2 
2020-03-29 17:55:17  [L]> Locate IsaIoProtocol HandleCount = 0. (Not Found)
2020-03-29 17:55:17  [L]> Found 1 Thunderbolt Handles. 
2020-03-29 17:55:21  [L]> IsThunderboltAccessProtocolPresent(): SetPowerState(): Returned (Success). Successfully set DEFAULT_POWER_STATE
2020-03-29 17:55:21  Failed loading Hp Fingerprint Verify Protocol.(Not Found)
2020-03-29 17:55:21  [L]> Language Selected is currently (eng).
2020-03-29 17:55:23  Initializing Drive Library.
2020-03-29 17:55:23  TscPerSecond = 094C5BF00h 
2020-03-29 17:55:23  Installed DTD ATA Commands Protocol
2020-03-29 17:55:24  Found installed DTD ATA Commands Protocol supporting Packet Commands!
2020-03-29 17:55:24  Found 1 Hard Disk Drive.
2020-03-29 17:55:24  Drive 0 SMART Supported
2020-03-29 17:55:24  AtaCommandsBindBlockIoProtocol(): Linked Block I/O Protocol (0x67A07E18) to Drive 0
2020-03-29 17:55:24  1 Total ATA Drives Found
2020-03-29 17:55:24  No handle found supporting EFI_EXT_SCSI_PASS_THRU_PROTOCOL (143B7632-B81B-4CB7-ABD3-B625A5B9BFFE).
2020-03-29 17:55:24  No handle found supporting EFI_NVM_EXPRESS_PASS_THRU_PROTOCOL_GUID (52C78312-8EDC-4233-98F2-1A1AA5E388A5).
2020-03-29 17:55:24  No handle found supporting LEGACY_NVM_EXPRESS_PASS_THRU_PROTOCOL_GUID (EC51EF5C-2CF3-4A55-BF85-B63CA3B13F44).
2020-03-29 17:55:24  1 Total Hard Disc Drives Found
2020-03-29 17:55:24  0 Total Optical Disc Drives Found
2020-03-29 17:55:24  Found 1 Hard Disk Drives
2020-03-29 17:55:24  Found 0 Optical Disk Drives
2020-03-29 17:55:24  No handle found supporting EFI_DCPMM_CONFIG_PROTOCOL_GUID (CF2F5F1F-94B6-4C15-9CAE-AFB3BD9F2BA5).
2020-03-29 17:55:24  Failed to initialize NVDIMM modules.
2020-03-29 17:55:24  [L]> System ID: 838F
2020-03-29 17:55:24  [L]> SMBIOS Type: 17, ID: 0 not found. 
2020-03-29 17:55:24  [L]> SMBIOS Type: 17, ID: 0 not found. 
2020-03-29 17:55:24  [L]> SMBIOS Type: 17, ID: 0 not found. 
2020-03-29 17:55:24  System Model: = OMEN by HP Laptop 15-ce0xx
2020-03-29 17:55:25  System SKU: = 2BR99EA#AKD
2020-03-29 17:55:25  System ID: 838F
2020-03-29 17:55:25  [L]> SMBIOS Type: 3, ID: 0 not found. 
2020-03-29 17:55:25  "BATT_CARE" found in SMBIOS Type 11
2020-03-29 17:55:25  Type 11 OS Image: BUILDID#17WW2PMT603#SAKD#DAKD
2020-03-29 17:55:25  Warranty Start Date: 02/23/2018
2020-03-29 17:55:25  HDD 0 Type : ATA
2020-03-29 17:55:25  HDD 0 Model :   ST1000LM049-2GH172
2020-03-29 17:55:25  HDD 0 Firmware: RXM3
2020-03-29 17:55:25  HDD 0 Serial:   WGS0BTJ2
2020-03-29 17:55:25  DIMM 0 Serial Number: 33FD8F2B
2020-03-29 17:55:25  DIMM 0 Part Number  : M471A1K43CB1-CRC    
2020-03-29 17:55:25  BIOS Revision: F.19
2020-03-29 17:55:25  [L]> Platform Vendor ID : 0x8086
2020-03-29 17:55:25  [L]> Platform Device ID : 0x5910
2020-03-29 17:55:25  [L]> Only a single DIMM (Index 1) is populated on the system
2020-03-29 17:55:25  [L]> Found EFI_HP_DIMM_ID_PROTOCOL
2020-03-29 17:55:25  [L]> EFI_HP_BATTERY_CONTROL_PROTOCOL_2010 is present.
2020-03-29 17:55:25  Type 11 1 tables
2020-03-29 17:55:25  Type (000000000000000Bh), Len (0000000000000005h), Handle (000000000000000Fh), String count (000000000000000Dh)
2020-03-29 17:55:25  HPBATDET: Environment Variable not found.
2020-03-29 17:55:25  BATDET: Date 12//7//2017 
2020-03-29 17:55:26  BATDET: 0
2020-03-29 17:55:26  [L]> BATDET: HP
2020-03-29 17:55:26  SysDiagsGetBatterySafetyModeStatus(): Failed to get BatterySafeyMode/BatterySafeyModeStatus.
2020-03-29 17:55:26  BIOS Config Table Configure Legacy Support and Secure Boot section was not found. 
2020-03-29 17:55:26  Legacy Support:
2020-03-29 17:55:26  	*Disable
2020-03-29 17:55:26  	Enable
2020-03-29 17:55:26  GetBIOSBootModeFromBIOSConfig(): Legacy Support is Not Enabled. 
2020-03-29 17:55:26  Secure Boot:
2020-03-29 17:55:26  	Disable
2020-03-29 17:55:26  	*Enable
2020-03-29 17:55:26  GetBIOSBootModeFromBIOSConfig(): Secure Boot is Enabled. 
2020-03-29 17:55:26  Battery Care Function from BCU:
2020-03-29 17:55:26  	*100%
2020-03-29 17:55:26  	80%
2020-03-29 17:55:26  	50%
2020-03-29 17:55:26  GetBatteryCareFunctionFromBIOSConfig(): Battery Care Function Value::100 
2020-03-29 17:55:26  BIOS Config Table Adaptive Battery Extender section was not found. 
2020-03-29 17:55:26  SaveBIOSConfigInfo: Error assigning Battery Adaptive Extender data from BIOS configuration. Status = Not Found
2020-03-29 17:55:26  BIOS Config Table Adaptive Battery Optimizer section was not found. 
2020-03-29 17:55:26  BIOS Config Table DMAr Protection section was not found. 
2020-03-29 17:55:27  Starting Graphical System Diagnostic Menu
2020-03-29 17:57:07  No USB optical drive detected.
2020-03-29 17:57:30  Hard Drive SMART Check Selected
2020-03-29 17:57:30  No USB Hard drive detected.
2020-03-29 17:57:31  Estimated Total Time Required = 2s
2020-03-29 17:57:31  SMART Check Started
2020-03-29 17:57:31  SMART Check Completed - Result 1
2020-03-29 17:57:32  SysDiagCalculatePassID(): Test PassID 29808-34212-50654.
2020-03-29 17:58:03  Hard Drive SMART Check Completed
2020-03-29 17:58:08  Device path: PciRoot(0x0)/Pci(0x17,0x0)/Sata(0x2,0xFFFF,0x0)
2020-03-29 17:58:09    0  0  23  0
2020-03-29 17:58:09  Matched FailingBus = 0, FailingDev = 23, FailingFunc = 0
2020-03-29 17:58:17  No USB optical drive detected.
2020-03-29 17:59:03  Hard Drive Optimized DST Check Selected
2020-03-29 17:59:03  No USB Hard drive detected.
2020-03-29 17:59:03  Drive Partition 2 (NOTOUCH)
2020-03-29 17:59:04  Drive Partition 5 (NOTOUCH)
2020-03-29 17:59:04  Found 6 Partitions on Drive 
2020-03-29 17:59:04  SectorPerCluster 0x8
2020-03-29 17:59:04  Cluster Size 0x1000
2020-03-29 17:59:04  Partition has 0x10000 Clusters
2020-03-29 17:59:04  Volume is FAT32
2020-03-29 17:59:04  Drive 0, Partition 0 - Decoding FAT data
2020-03-29 17:59:04  Partition Starting LBA 0x800
2020-03-29 17:59:04  Partition Size in LBA 0x82000
2020-03-29 17:59:04  Partition (FAT32) Clusters: Read=0x5AF4 Skipped=0xA50C Total=0x10000
2020-03-29 17:59:06  NTFS Blocks Used 5252341, Free 2368499
2020-03-29 17:59:06  EXT3 Blocks Used 0, Free 0
2020-03-29 17:59:06  FAT32 Clusters Used 23284, Free 42252
2020-03-29 17:59:07  Estimated Total Time Required = 600s
2020-03-29 17:59:07  EfiDriveLibPollDSTStatus(): Drive 0 temperature before Self-DST Test = 40 degrees Celsius 
2020-03-29 17:59:07  Optimized DST Started
2020-03-29 17:59:20  Partition (FAT32) Clusters: Read=5AF5 Skipped=A50B Total=10000
2020-03-29 17:59:20  EfiDriveLibExecuteOptimizedDiskTest(): Unknown FS(0x0) on Drive(0) Partition(1).
2020-03-29 18:05:58  ReadBlocksAccordingToClusterBitmap(): ReadBlocks() failed. (Device Error)
2020-03-29 18:05:59  Failed LBA 0x87FC300, Size 0x20000
2020-03-29 18:05:59  ExecuteNTFSOptimizedDST(): ReadBlocksAccordingToClusterBitmap() failed. (Device Error)
2020-03-29 18:05:59  EfiDriveLibExecuteOptimizedDiskTest(): FAILED(3) on Drive(0) Partition(2).
2020-03-29 18:05:59  EfiDriveLibExecuteOptimizedDiskTest(): FS(7).
2020-03-29 18:05:59  (NTFS) Blocks (256 Sectors per block): Read=511853 Skipped=42131 Total=553984
2020-03-29 18:05:59  (EXT3) Blocks (256 Sectors per block): Read=0 Skipped=0 Total=0
2020-03-29 18:05:59  (FAT32) Clusters: Read=23285 Skipped=42251 Total=65536
2020-03-29 18:05:59  Optimized DST Completed - Result 7
2020-03-29 18:05:59  EfiDriveLibPollDSTStatus(): Drive 0 temperature after Self-DST Test = 49 degrees Celsius 
2020-03-29 18:06:00  SysDiagCalculatePassID(): Test PassID 29808-34214-50654.
2020-03-29 18:06:19  Hard Drive Optimized DST Check Completed
2020-03-29 18:06:22  Device path: PciRoot(0x0)/Pci(0x17,0x0)/Sata(0x2,0xFFFF,0x0)
2020-03-29 18:06:22    0  0  23  0
2020-03-29 18:06:22  Matched FailingBus = 0, FailingDev = 23, FailingFunc = 0
2020-03-29 18:06:44  Device path: PciRoot(0x0)/Pci(0x17,0x0)/Sata(0x2,0xFFFF,0x0)
2020-03-29 18:06:45    0  0  23  0
2020-03-29 18:06:45  Matched FailingBus = 0, FailingDev = 23, FailingFunc = 0
2020-03-29 18:06:54  Device path: PciRoot(0x0)/Pci(0x17,0x0)/Sata(0x2,0xFFFF,0x0)
2020-03-29 18:06:54    0  0  23  0
2020-03-29 18:06:54  Matched FailingBus = 0, FailingDev = 23, FailingFunc = 0

[WAWood]

@h4d3s 

You started the threads with talk of infection; now you're talking about drive read failures.  These are very different things.

If you look through that log, you will see near the end that it has encountered failures on the drive, Drive (0) both partitions 1 and 2.  That implies that the drive is failing.

That will seriously slow down a PC because the disk controller will read failing sectors over and over and over until it gives up.  That can slow your PC to a crawl.

You need to consider replacing the drive.