Classic Shell: Forum

I can say that it was most certainly the hack. If you recall when you installed it previously, there would have been a UAC prompt warning of an unverified publisher. This is not the case with the legit classic shell, which is digitally signed

Check your Classic Shell installer's Properties (right click on it) to see if it has a "Digital signatures" tab.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

Thanks, I have just checked the actual installer that was used on both computers. It was:
ClassicShellSetup_4_2_5c.exe

Showing as 6,810 KB

Downloaded at 07.35 GMT from a location picked from the CS website, but not sure exactly where from.

The properties of this file show digital signature:

Ivaylo Beltchev sha1 21 May 2016 4:17.07 ....

This installer is genuine. Only version 4.3.0 was ever compromised.
I don't know why it would break your computer. Nobody has reported similar problems in the past (aside from the hack).
Classic Shell has no capabilities to alter the booting of your computer. However some unknown incompatibility may exist in your case. It may be an interaction with another software you installed. I would advise you don't install Classic Shell the third time, as the problem may happen again.

Thanks.
I hadn't installed any other software on either of the two Asus T100's. Both were "out the box".
Though that doesn't mean Asus did not have something on at that point!
As exactly the same happened twice, I won't risk the third one.

Whilst this issue is marked as resolved, I would still like to get CS on the Asus T100HA, but won't try as is.
It is now clear the hack was not responsible. A bit more info on what happened:
Normal CS installation up to (during) the loading files bit. Black Dos type command box appeared in top right corner for a fraction of a second. Computer rebooted itself, direct to BIOS screen with internal storage missing.
Exactly the same on both.
If it makes any difference, both machines were from ARGOS EBAY, factory refurbished.
Has anybody got CS on one of these machines successfully?

The black command window opening for a fraction and the PC not booting properly is a direct indication that the installer was not genuine!! It was malware and if your PCs are broken still, fear not it is possible to fix them. Your data is not lost. Follow the instructions here: viewtopic.php?f=12&t=6440

The genuine installer is digitally signed by Ivaylo Beltchev. Without running this file, right click the file you downloaded and click Properties.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

Thanks Gaurav for your response again.

Through post's 3 - 5, Ivo stated the installer was genuine. But I won't use that one again!

Checked new CS download version 4.3 as you suggest and everything looks OK in the signature as per your example.

I stated in my 1st post, the viewtopic.php?f=12&t=6440 fix was not successful on either computer.
The only item showing in the boot menu at that time was the prepared Windows copy on the USB.

On the now third machine, I have completed all the Windows updates and made a windows recovery USB.

I am now more confident of giving this a go on CS installation.

Anybody any thoughts or suggest the risk is too high?

Thanks for the help from all again.

Martin F. - Grimsby UK.

If you still have the infected/malware installer of Classic Shell, please upload it somewhere and send me or Ivo the link privately via "Private Message" (PM) feature of this forum.

Make sure the new installer you have downloaded is signed and then it's safe completely.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

Also, it may still be possible to recover your other 2 PCs. Don't give up because the standard MBR recovery procedure failed. The data on the drives is not destroyed and if it is important you can recover it.

You could try downloading and running TestDisk from a Live CD: http://www.bootmed.com/ One of our forum members reported that using Testdisk they could fix the partition table on one compromised drive and restore the partition table completely with no issues. Do a quick scan using Testdisk and then add back the partition it finds and write it to disk.

Once you download the ISO of the Live CD, you can create a bootable flash drive and try to fix your PC using it. The bootable flash drive can either be MBR partitioned or GPT depending on what your PC supports. For MBR, choose NTFS file system for the bootable drive. For UEFI/GPT choose FAT32. To write the ISO file to a bootable flash drive, use Rufus: https://rufus.akeo.ie/

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

Think? I've done that PM and link.

The file you sent me is the genuine Classic Shell 4.2.5c, it is not infected/malware. Now a newer version 4.3.0 is released, so you can get that too. I don't know how you got the infected one but somehow you did and it bricked 2 of your PCs. During the short period when the download service at FossHub was hacked, you must have downloaded the infected EXE which did not have Classic Shell at all and simply opens a command window and overwrites the MBR. But you can recover your PCs which don't boot as per the instructions I gave above.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

Thanks Gaurav.
I have downloaded the Bootmed, just in case!

However, you verify the 4.2.5c in the link was genuine, this was the file used on both machines and we know what happened.

I am setting up a new W10 installation on a spare HDD, albeit not on the Asus T100HA.
Will try the CS 4.3 that I have verified as ok as detailed above on that before trying on the Asus.
Also going to try clone the T100HA non removable 64GB SSD first if I can.

If this was the file used on the machines that got infected, then something else infected your PC and it is not Classic Shell. I ran the installer and it is not the malware-infected one.

_________________
Links to some general topics:

● Compare Start Menus

● Read the Search box usage guide.

I am a Windows enthusiast and helped a little with Classic Shell's testing and usability/UX feedback.

That was my thinking, but the same thing happened twice. The second failure occurred when the machine was "so out the box" an internet connection had not been made/installed, neither had anything else.

As these were both were "factory refurbished" I wondered if this process did something different to a brand new one?

It looked like the HDD/SSD controller had failed or lost software function or the MBR/FAT was lost or damaged. But being unable to boot past BIOS, I was unable to look in Device Manager! The T100HA has a full system recovery partition hidden and I tried the routine to use this. That failed, presumably as the SSD appeared not to be present.

The viewtopic.php?f=12&t=6440 routine (booted through the USB) looked fine until it appeared to not have a drive to write/access.

These reasons generated my original question, " anybody else had similar with a Asus T100 type?

At this point I'm pretty sure there is no malware at play here. It might be some incompatibility.

Thanks Ivo, beginning to trend towards not trying CS for that reason (possibility).
Just looked into the BIOS as it is, and the only option shown under Boot is "Boot Option #1 [Windows Boot Manager]".
I note this does not specify a specific location as to where this is located, for example the 64GB permanent SSD drive.

If a formatted USB memory is present, also shown is Boot Option #2 [UEFI: Lexar USB Flash Drive 1100, Partition 1]".
These can be swapped over.

During the failed viewtopic.php?f=12&t=6440 routine the only option in the Boot menu was the flash drive. You need to change the BIOS Security setting under Secure Boot Menu from Disable to Enable.
I did not try the Bootmed option suggested as I did not have either of the machine's when informed about that.

For information in normal start up Windows Explorer shows just: "OS (C:)".

The purpose of this entire exercise is make Windows 10 look and operate more like 7. I am preparing the machine for a 76 year old friend, who is familiar with 7, not much chance with 10! He can't work a smart phone, hasn't got one and does not want one.

Another option could be a complete clean install of 7, deleting 10, but drivers may be an issue.

Presumably I could recover/reload 10 as is, through BIOS and the 10 Recovery USB I have already prepared (took about 5 hours!).

Anybody any thoughts?