Big Grub Issue

[Fintan]

Whenever I boot up in the morning I get a error message on my screen.
It varies but bacicly my Grub is gone.

So, I have to reinstall it using parted magigic live cd. (Thank god for that cd!!)

This is a major pain! I basicly have to have my laptop run all day long.

This has been happening since the latest update to KDE4.10.4.

Anyone with an idea?

Cheers
F

[SteveRiley]

Kinda difficult to tell without knowing the exact errors.

Eliminating GRUB from all my PCs sure has made life simpler. If your computer is UEFI-based, I highly recommend rEFInd. Install that, and then uninstall all of GRUB. You'll be happy.

Barring those options, have you tried reinstalling GRUB or checking out BootRepair?

[Fintan]

Hi Steve.
No my lappy is not UEFI based. I am using my parted magic live cd for now to reinstall grub, Bootrepair CD sounds good though..

By reinstalling do you mean from muon / sudo at-get reinstall?

[kc1di]

Hi Steve.
No my lappy is not UEFI based. I am using my parted magic live cd for now to reinstall grub, Bootrepair CD sounds good though..

By reinstalling do you mean from muon / sudo at-get reinstall?

get a copy of boot-repair and run it , follow the instructions on the page , if it does not work list the error file it generate here.
https://help.ubuntu.com/community/Boot-Repair
it should install grub into the MBR - if it get erased after that something on your system is erasing the MBR each time you shutdown, that is not good.
Is this a dual boot machine?

[SteveRiley]

By reinstalling do you mean from muon / sudo at-get reinstall?

No, I mean clicking the "reinstalling GRUB" link in my earlier post and following the procedure there. But BootRepair is easier, so try that first.

[Fintan]

@kc1di

if it get erased after that something on your system is erasing the MBR each time you shutdown, that is not good.
Is this a dual boot machine?

Thank you. Yes that seems to be the problem. But only if I shut down and boot agaion after a longer period of time, like over night. Booting after a few hours (1-4) doesn't seem to be a problem.

How do I find out what is doing the erasing?

I am using a dual boot system with win7 (preinstalled on my laptop) but haven't booted into that for months and never online for at least a year.

I do remember one thing though. I helped someone when I was on the road. He needed to copy a file to his garmin gps machine, so I hooked that up with the usb cable and copied the file to his garmin gps.
The issues started that same day.

Can I format the MBR from Parted Magic and then reinstall grub from Parted Magic or BootRepair?

I ran a clamtk session but it found nothing.

@ Steve: I downloaded the boot-repair-disk and burned a copy. That works fine, but it is still a pain to run that every morning.

Never had this with Grub.

Edit: Here is my partitions list:

   Gerät  boot.     Anfang        Ende     Blöcke   Id  System
/dev/sda1   *        2048      409599      203776    7  HPFS/NTFS/exFAT
/dev/sda2          409600   170278911    84934656    7  HPFS/NTFS/exFAT
/dev/sda3       624928768   625140399      105816    c  W95 FAT32 (LBA)
/dev/sda4       170280958   624928767   227323905    5  Erweiterte
/dev/sda5       170280960   540309503   185014272   83  Linux
/dev/sda6       540311552   548956159     4322304   82  Linux Swap / Solaris
/dev/sda7       548958208   585424895    18233344   83  Linux
/dev/sda8       585426944   624928767    19750912   83  Linux

[SteveRiley]

Thank you. Yes that seems to be the problem. But only if I shut down and boot agaion after a longer period of time, like over night. Booting after a few hours (1-4) doesn't seem to be a problem.

This appears to be some kind of clue. But of what, I'm not exactly sure. Two guesses come to mind:

* Problem with the hard drive. Restoring power after it's been off for several hours elicits some kind of malfunction that exibits itself as a broken MBR. Since the MBR lies in the first physical 512 bytes of a hard drive, there is a slight likelihood that mechanical malfucntion is wiping out that portion. But I'd imagine such a malfunction would exhibit itself earlier than after a +4 hour cool-down.

* Some kind of rootkit that wakes the computer up after an extended period of time off, perhaps in the middle of the night while you're asleep. ClamAV (the engine behind Clamtk) is not an effective rootkit detector.

I do remember one thing though. I helped someone when I was on the road. He needed to copy a file to his garmin gps machine, so I hooked that up with the usb cable and copied the file to his garmin gps. The issues started that same day.

This is another clue, and it leads me away from thinking you have a hardware problem and closer to thinking you've got some kind of malware infection. Some Garmin products are based on Windows CE, others are based on Linux (!). Any model that can be mounted as external storage has the potential of delivering an infection to your machine.

How do I find out what is doing the erasing?

It might be worth the time to check your PC with Rootkit Hunter.

[Fintan]

I installed root kit hunter and ran with:

rkhunter -c -sk

This is the log output:

Not sure what it means

Edit: I also ran the harddisk controll at boot. It took a while but found nothing.

[SteveRiley]

I'm not all that surprised. Despite spending nearly 20 years in IT security, I've yet to see a rootkit in the wild. You shouldn't interpret that to mean they don't exist -- but I don't think they are as prevalent as some people imagine.

Running RKHunter on a booted system makes little sense anyway, becuase sophisticated rootkits can hide. If you really want to do a full malware check, you should search for instructions that walk you through a procedure for running RKHunter (and maybe some other tools) from a bootable CD. For forensic purposes, never boot a machine from read-write media like USB.

tl;dr -- something fscked your PC, and it's reasonable to assume it came from the Garmin. Were I in your situation, I wouldn't bother with hours of tedious investigations. I'd pave and reinstall, and then remind myself never to practice unsafe computing around other people's devices from now on. Here's a bit of advice to get started.

[Fintan]

Thanks for the cute advice

I agree it must be something garmin "schleppt" in.
But will a complete reinstall solve the problem?

I have been playing with getting rid on win 7 for a while. Why do I have a win7 geust ?

Maybe I could just format these partitions:

/dev/sda1 * 2048 409599 203776 7 HPFS/NTFS/exFAT /dev/sda2 409600 170278911 84934656 7 HPFS/NTFS/exFAT

Enlarge my sda5 partition (Data) and just keep my Linux partitions.

If this still persists I can still reinstall. What do you think?

Edit: I wouldn't think that apton cd would copy over the malware whatever it is. I usually use this when rinstalling.

[SteveRiley]

Don't attempt precision surgery here. Back up only your data, then nuke everything beginning with the partition table on your drive. Start from the proverbial clean slate.

[Fintan]

HI Steve, still have the issue. Here is what I did.
I backed up my Data and /home partitions by copying / pasting the partitions to my external HD then nuked the win7, Kubuntu, /Data and /home partitions. I left the HP recovery partition. Maybe I should have nuked that as well?

I reformated the HD to ext3 and made one partition: / and left the rest unalocated then copied / pasted the /Data and /home partitions from backup (external disk) to my HD as separat partitions. Tried installing Kubuntu from the usb. Installer crashed every time. Made a new kubuntu usb with the parted magic tool. That booted fine but the installation was not complete, even though it said it was. So I burned a DVD using that live usb. That install finally worked. All in all it took the most part of a day.

Booting in the morning still gives me the same error.

Now a few questions:
- I tried backintime-kde but that seemed really slow, so I just copied / pasted the backed up partitions by copying / pasting the partitions to external HD and back again to my HD. Mistake?
- Using dolphin to copy / paste my data dirs and files would have taken ages, dolphin is really slow with this.
- I looked for a command line method for copying my data dirs and files from HD to backup and back to HD but didn't find any thing useful (or I could understand ).
Which would be the best method?

Lost in space for now

[SteveRiley]

copying / pasting the partitions to my external HD

Can you elaborate on this, please? Entire partitions are not something you can normally just copy and paste.

[Fintan]

Hi Steve. Using parted magic I went into gparted and copied / pasted my /Data and /home partitions (separatly) to unalocated space on my external drive. When I was finished deleting, formating my HD and installing Kubuntu I did the opposite.

Edit saturday: I tried something else. I used the "Boot from HD" option on Parted magic CD and voila my grub is still there. I checked my HD for failures again, but found nothing. Very confused now
I'll just use the live CD as my boot manager for now. But that is no solution.

[SteveRiley]

Huh, I had no idea GParted could do that. Interesting. I've often accomplished the same thing using dd at the command line. In fact, I've done that even to transfer the operating systems between drives. An alternative would be to use the cp utility; check the man page for specifics.

There are widespread reports of problems with the installer in 13.04. Unfortunately, these seem to be sporadic and challenging to solve. I gave up on Ubiquity long ago and instead install via command-line using the Ubuntu Server ISO, followed by installing kubuntu-desktop. The Debian text-mode installer is much more robust.