🚀 go-pugleaf

Thus spake mybdav02@uctvax.uct.ac.za:
>There is an outbreak of EXEBUG virus on campus.
>It is easily removed by copying the original partition table from
>H0,T0,S17 to S17.

Yes-ish.

You must boot clean first, though. This is easier said than done with
EXEbug. The virus tells your PC (by altering the CMOS setup) that it
has no floppy drive A: installed. Some BIOSes, seeing this, figure
that trying to boot from an uninstalled drive is pointless, and thus
insist upon booting from hard disc. This gets the virus executed, and
installed in memory. The virus then attempts to boot from floppy -- if
there is a bootable floppy in the drive, you then seem to enjoy a
clean boot, though the virus is already active and working.

The virus' stealth mechanisms, once resident, deflect access from
0.0.1 to 0.0.17. So, when the virus is around, the partition record
looks normal -- and the partition table looks correct. DOS, when
working out which partitions belong to it, gets everything right.
When *not* resident, 0.0.1 is pure virus code, with complete nonsense
in the partition table zone. Boot without the virus, and DOS sees no
partitions belonging to it -- ergo, no C: drive!

So, if you try to boot clean to remove EXEbug, try logging to drive C:
after bootup. If you get "Invalid drive specification", then that's
*good* news. If you can reach drive C:, it means the virus is
resident.  Go into your CMOS setup, tell the system you *do* have a
floppy drive and then instantly reboot from floppy. Only when drive C:
is "absent" should you fire up NU, DE, DISCHAK or whatever to move
0.0.17 to 0.0.1.

>Another question: the virus formats an extra sector on floppies and
>     copies the original boot sector there - how does one read this
>     sector?  Does the virus have to be in memory? 

With the virus in memory, you'll see the "hidden" sector when you try
to read 0.0.1 from floppy, thanks to EXEbug's stealth. So you can use
the virus to access this extra sector...but then you can't write back
over the infected 0.0.1. Try Explorer or PEEKA.
- -- 
- --..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--
Paul Ducklin                                       duck@nuustak.csir.co.za

  CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa