🚀 go-pugleaf

I *suspect* that what you have is a simple STONED hack that just has
changed the real MBR resting place to something other than 0,0,7
(essentially a two byte change). I do not know if F-Prot uses a global
search for a valid partition table like my stuff (no names) but this
would tend to indicate that it does not.

The AZUSA virus does not bother to save the original MBR so when you
use CLEAN [AZUSA], I would expect this to be the same as CLEAN [GEN-P]
which is also essentially the same as FDISK /MBR since the only
assumption made is that the valid partition table is in sector 1 and
the MBR code is replaced by a canned program.

I am curious to know where or whether it did store the original MBR.

					Warmly,
						Padgett