Article View: comp.virus
Article #4267Re: Is this a DOS virus? (PC)
From: Joel A. Frahm
Date: Thu, 10 Dec 1992 00:44
Date: Thu, 10 Dec 1992 00:44
24 lines
1611 bytes
1611 bytes
echrstmn@lab4.smcm.edu (Evan Christman) writes: >From: echrstmn@lab4.smcm.edu (Evan Christman) >Subject: Is this a DOS virus? (PC) >Date: 2 Dec 92 02:03:47 GMT > > On one of our PC's we are observing some odd behaviour of our >DOS files. The symptoms are: certain DOS files, share, dosshell and a >few others report that their size has been altered when I run a >CHKDSK. Also we have been getting non-fatal errors during Windows >sessions. In addition, one file reports that it has been "reallocated >to block 505." I have ran F-prot 206, and pro-scan on it. When they >read the files they report that the above files are "unreadable." > I was wondering if anyone else is experiencing the same >behaviour, or if anybody has some ideas of what to look at. You may also check this out: If you have an IDE or SCSI or some drive type like that, make sure the controller ROM memory location is protected. In system.ini, the command is EMMEXCLUDE (address-address). This will insure that Windows won't try to write to that memory area, and thus send weird commands to the hard disk. I've had this happen before, and the effects ar similar to what you're discribing. Joel. (frahm@ucsu.colorado.edu)
Technical Details
Message-ID:
<0004.9212141513.AA07337@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: FRAHM@UCSU.COLORADO.EDU (Joel A. Frahm) Newsgroups: comp.virus Subject: Re: Is this a DOS virus? (PC) Message-ID: <0004.9212141513.AA07337@barnabas.cert.org> Date: 10 Dec 92 00:44:25 GMT Sender: virus-l@lehigh.edu Lines: 24 Approved: news@netnews.cc.lehigh.edu