🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #3143

Virus-like behavior of DOS 5.0 chkdsk (PC)

#3143
From: vpk2!john
Date: Wed, 11 Nov 1992 14:09
48 lines
2350 bytes
This is an excerpt of a message I posted to comp.os.msdos.misc,
that I thought might be of interest.

(This is NOT an official report from Microsoft or AT&T. It's just
 my own friendly posting to try to help)


Program: chkdsk
O/S    : MS-DOS 5.0

Symptoms: Users running chkdsk with the /f option have 256 copies
          of the FAT written onto their hard disk starting at the
          first copy of the FAT. The result being that all directory
          information and a significant amount of the data in the data 
          area are irrecoverably destroyed.

Affected users: Any users using 256 sector FAT's. 

How to tell if you're at risk: 

          Run chkdsk WITHOUT the '/f' option and check the 
          "Total allocation units on disk". If this number is
          more than 65280, you're at risk. DO NOT USE CHKDSK TO
          CORRECT ANY DISK PROBLEMS if this is the case. You'll
          trash your disk.

Solution: Call Microsoft and request the 5.00A upgrade. They know
          about the problem and they've fixed it. They've also done
	  some diddling with the following programs: (though I don't
          know what they did to them.)

	deloldos.exe	diskcomp.com	diskcopy.com
	doshelp.exe	dosshell.exe	dosswap.exe
	emm386.exe	expand.exe	format.com
	himem.sys	mirror.com	qbasic.exe
	recover.exe	setver.exe	undelete.exe
	xcopy.exe

______Opinions stated are my own. Transcripts available by request______
      ===
    =--====  AT&T Canada Inc.          John Benfield
   =----==== 3650 Victoria Park Ave.   Network Support Analyst (MIS)
   =----==== Suite 700		  
   ==--===== Willowdale, Ontario       attmail   : ~jbenfield
    =======  M2H-3P7                   email     : uunet.ca!attcan!john
      ===    (416) 756-5221            Compu$erve: 72137,722

____Eagles may soar, but weasels don't get sucked into jet engines._____
Technical Details
Message-ID: <0006.9211121950.AA09997@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: vpk2!john@attcan.uucp
Newsgroups: comp.virus
Subject: Virus-like behavior of DOS 5.0 chkdsk (PC)
Message-ID: <0006.9211121950.AA09997@barnabas.cert.org>
Date: 11 Nov 92 14:09:43 GMT
Sender: virus-l@lehigh.edu
Lines: 48
Approved: news@netnews.cc.lehigh.edu