disinfectors that leave ghosts of viruses (PC)

Article View: comp.virus

Article #4335

#4335

From: A.APPLEYARD
Date: Wed, 16 Dec 1992 09:03

14 lines
1208 bytes

  OVERBERGER@GW.WMICH.EDU wrote: "... new variety of STONED ... infect the
partition table of infected DOS machines ... F-Prot 2.06a [and CLEAN]
identified it as a STONED virus but refused to remove it...
  FRISK@COMPLEX.IS replied: ... old problem ... disks ... infected with
stoned, and improperly disinfected by a program that just overwites a part
of the boot sector with valid code, leaving a part of the virus, so
[FRISK's] program gets a partial match...

  These 'ghosts' of killed viruses are perennial problem. It would be
useful if a FAQ entry could be made listing: (1) what variants of what
virus-removers leave ghosts and don't properly ghostbust after themselves;
(2) how a user can ghostbust after using such an untidy virus-remover, so
that he doesn't keep getting these false alarms.

Technical Details

Message-ID: <0011.9212171857.AA14855@barnabas.cert.org>

Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: A.APPLEYARD@fs1.mt.umist.ac.uk
Newsgroups: comp.virus
Subject: disinfectors that leave ghosts of viruses (PC)
Message-ID: <0011.9212171857.AA14855@barnabas.cert.org>
Date: 16 Dec 92 09:03:30 GMT
Sender: virus-l@lehigh.edu
Lines: 14
Approved: news@netnews.cc.lehigh.edu