virus stopping an AV scan?

[stuck]

I've recovered data files, for a colleague, from a HHD that holds a Win98SE system that won't boot. I did it by taking it out of it's own case, setting the jumpers to 'slave' and connecting it to my ancient Win98FE box and booting up. As expected the dud HDD appeared as a new drive in Explorer and it was straightforward to search for and copy off data.

I then wondered about trying to revive the dud disk (I know, I know, why?). As a first step I'm trying to scan it with ClanWin to see what might be lurking on it.

ClamWin happily scans the main C: drive and gives a short report about how many files it's scanned and if any were infected (no, all clear). It also gives a sensible report about E: (a data partition on the same physical HDD as C:).

But... when I choose to scan D: (the dud drive) although it seems to scan the drive it produces an empty report, no info about anything. I know some viruses are very clever and can try to hide by turning off AV apps.

Anyone care to offer any thoughts on what might be going on here?

Ken

edited to add...
Just tried the AV scan again. This time I've got a notification balloon that says there were problems with the scan. Think I'd better do a Scandisk.

[HansV]

Viruses can only turn off security software if they're running. If you attach a hard disk as a non-system drive, there's no way for a virus on that disk to run, unless you deliberately started it.
So it seems more likely that the same damage to the disk that prevent it from being bootable is preventing the AV program from correctly reading its contents. Since you already got the data off the disk, it's probably best to format it, then see if it can be used again.

[stuck]

Viruses can only turn off security software if they're running. If you attach a hard disk as a non-system drive, there's no way for a virus on that disk to run, unless you deliberately started it.

Duh, of course, I knew that!

So it seems more likely that the same damage to the disk that prevent it from being bootable is preventing the AV program from correctly reading its contents. Since you already got the data off the disk, it's probably best to format it, then see if it can be used again.

Yup, Scandisk is finding errors in the \windows folder, it's unlikely this will installation fly again. did someone mention volcanic ash?

Ken

[HansV]

NOBODY mentions volcanic ash!

[stuck]

NOBODY mentions volcanic ash!

I was supposed to have a hair cut on Wed morning but it was cancelled because the hairdresser is stuck in Spain because of

Ken

[Doc Watson]

NOBODY mentions volcanic ash!

I was supposed to have a hair cut on Wed morning but it was cancelled because the hairdresser is stuck in Spain because of

Ken

Soooo... your now a hairdresser living in Spain ???

[stuck]

Soooo... your now a hairdresser living in Spain ???

it might pay more

[ChrisGreaves]

I was supposed to have a hair cut on Wed morning ... Ken

Soooo... your still have hair ???

It may be a bit too late, but wasn't Win98 still DOS-based?
What about that old DOS trick of SYS or something, whereby we copied two vitally essential files (Sys.com???) to the boot sector.
Worth a try?

[stuck]

It may be a bit too late, but wasn't Win98 still DOS-based?
What about that old DOS trick of SYS or something, whereby we copied two vitally essential files (Sys.com???) to the boot sector.
Worth a try?

Yes, it is DOS based but the corrupt files are supporting dlls , vxds and the like, quite a few were cross linked. It's not worth the effort of trying to put it back together. Also, the owner is only really interested in the data and I've got that for them already.

Ken