🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4558

Re: DOS 5 Fdisk, etc (PC)

#4558
From: Mark Aitchison, U of Canty; Phys...
Date: Tue, 18 Jun 1991 01:27
23 lines
1804 bytes
BARNOLD@YKTVMH.BITNET writes:
> Readers might want to play with an undocumented /MBR switch in DOS 5
> FDISK.  It appears to force FDISK to overwrite the code in a PC/PS2
> master boot record, without touching the partition table, and in
> limited testing on a half dozen machines it succeeded in cleaning up
> machines infected with the Stoned, the Stoned 2, and the Joshi
> viruses.  This was with the DOS 5 shipped by IBM, not Microsoft's DOS
> 5; can somebody please test MS-DOS 5?

On a related subject:
You may use the DRDOS 5 sys command to rewrite the boot sector (not
the MBR, I think), but watch out when you have a diskette infected in
such a way that the Bios Parameter Block (that says the disk size,
etc) has been junked (e.g. by stoned).  The SYS command rewrites a
good boot sector around it (fair enough), but acts on the size
information in the BPB, and you end up with a disk that needs to be
fixed with a disk editor. Remember that DOS normally ignores a lot of
the BPB and goes by the ID byte at the start of the FAT; this is
because early (version 1) DOS might write anything there. DRDOS reacts
sensibly if it contains junk *except* when it comes to the SYS
command, so beware.

Mark Aitchison, Physics, University of Canterbury, New Zealand.
Technical Details
Message-ID: <0012.9106181359.AA17901@ubu.cert.sei.cmu.edu>
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!asuvax!noao!ncar!elroy.jpl.nasa.gov!swrinde!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!asuvax!noao!ncar!elroy.jpl.nasa.gov!swrinde!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: DOS 5 Fdisk, etc (PC)
Message-ID: <0012.9106181359.AA17901@ubu.cert.sei.cmu.edu>
Date: 18 Jun 91 01:27:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 23
Approved: krvw@sei.cmu.edu