NOTE: THERE IS TEXT BELOW THIS IMAGE
Large composite image of 112 newly infected files and virii I've never heard of
Herein lies the story of how my laptop went in for warranty repair with a blown mobo and a clean filesystem and returned with a clean mobo and a blown filesystem (and a metric ton of virii)...
I don't even know what to say, honestly. I'd like to say there's a great article explaining what happened on the site I've linked you, http://www.fruzzetti.org/toshiba but I'm still at such a loss for words that I can't think straight. Here's the story in as few words as possible.
I have a Toshiba Portege R500-S5003 which was a fabulous machine until 5-Sep-2008 when it decided to suddenly shut down, giving me an error code consisting of orange blinks of its DC-in LED. Please note at the time I bought it this was a massively expensive computer but it was so light and powerful that it thrilled me nonetheless.
Photos from before I shipped it to Notebook Depot (Toshiba's official repair center)
I called and got a service number, and they said they'd ship me a box and a UPS shipping label. Not three days later, there it was at work. Their instructions were: take all accessories off the machine (no battery, no add-ons, no PC cards, etc etc) and bring just the computer and the box to the UPS store, where UPS store employees will pack it and ship it overnight to Notebook Depot on the included 2nd day air tag.
So I followed their directions. Almost entirely. I did not fill out a couple things on their contract form because I didn't like the idea of leaving the keys in the car (they ask for all relevant passwords to ride in the box with the computer all the way there.... how secure). Otherwise I did what they said.
I neglected to mention the return shipping label that came in the box was connected along a perforated edge to the shipping label used to send the laptop to me (neither had been removed and actually affixed to the box). And, of course, the UPS store packed the machine as Toshiba Support said they would, and shipped it out... Back to me... Two miles away at my office and at a cost of two wasted days.
Photos taken while at the UPS store
OK, whatever. This is a simple case of human error; they happen and they're forgivable. So I returned to the same UPS store, and thankfully they still had the correct label; problem solved.
Then I get a phone call three days later (it went out over a weekend) from a Toshiba technician. She asked me to elaborate on the problem further, which I did. She requested the password for the machine, which I produced.
I must make this clear: during the phone conversation, I explained how I was not able to back up the filesystem due to the blown motherboard and that its SSD did not use a standard connector (in fact, it doesn't even have a cover on it; it's a PCB with some chips exposed connected to a tiny metal-lined ribbon cable). I specifically asked the technician to avoid doing anything to the filesystem. She said, "Ok. I understand," in response to this. I further explained how there was an abundance of sensitive data on the disk I could not successfully back up for safety, and I told her she must not replace the disk and must not mess with the filesystem (I had to say that at least five separate times, all in different ways [Note: I'm a teacher]).
Toshiba has a nifty online repair tracking system through which you can see the rigors your machine has been put through and each time stamp for those things. Mine were: SvcOrd# T1-GHSQP6 and Ser# 87022351H (I'm ok with the world seeing this info).
Now I received the machine back today. I had been expecting it (thanks to the aforementioned system) so I brought both batteries, the AC adapter, and my 3g card with me to work.
Then I fired it up. It finished booting and I was thrilled. I swiped my finger across the print reader and suddenly I was logged in. And before it finished starting everything up I started seeing bad signs...
So I decided it was time to run a boot-time scan. Only there was a dilemma: the anti-virus software was last updated on 5-Sep-2008, which was the last day the machine was in my hands. It was now 19-Sep-2008 and I really needed to update the software before I ran the boot scan. Ridiculous. Why should a laptop go out for service flawless and virus-free and then return absolutely virus-laden? One such virus-installing file that came home with my computer is available here (please do not rename it back to .exe to run it; you will not be happy and I do -not- take any responsibility for you choosing to be retarded).
But the wireless connection wouldn't work. So I checked into it. As it turns out, somebody fiddled with the driver and software combination, installing a combination of software and driver that caused the software to complain about not being compatible with that version of the driver. Ridiculous. So I went to a lot of trouble to remove the software entirely (which I already remembered doing in the past...). Once I got online, I updated the software (and I'm sure I also involuntarily sent my passwords and bank information in UDP packets to at least ten singaporeans) then scheduled the boot-time scan and rebooted. The scan log is available here.
Assortment of documentation, photographs and screenshots created immediately upon receipt of the laptop
Also, please note my wife and I are expecting our first child exactly one week from today; we have been taking many photographs and videos around the process and ancillary experiences -- around ten gigabytes of which were on my laptop hard disk unable to be backed up. After I received the machine back, the number of files on disk had increased by 63 000 (to 589 846) but the free space on disk had also nearly doubled to 31GB.
So my laptop came home FROM THE MANUFACTURER'S CERTIFIED REPAIR CENTER lighter on personal data and heavier on virii. I'm not angry; I think I'm too surprised to be angry. My wife broke down in tears today when I told her that some of the footage (baby showers, vacation in Lake Tahoe, etc.) had been lost. It was painful in a way that I had never experienced before.
Of about 13 gigabytes of family media destroyed by I-don't-know-what, I managed to recover a whopping ninety-six photos (at around 5 megabytes each), leaving a 12.832 gigabyte deficit. I haven't looked at my work data yet and I'm actually afraid to enable any of its network devices.
If I could take it all back and instead go to an authorized service center to get this fixed, I would. I'm never, ever leaving my laptop in the hands of someone else when I'm not right there standing over them preventing them from ruining it. And I'm going to stay much better on top of copying data to my file server as soon as those data are born.
Never, ever allow "Noteobok Depot" to touch anything you care about.