Article View: comp.virus
Article #4762Clash between FDISK/MBR and scanners (PC)
From: A. Padgett Peterson
Date: Tue, 05 Jan 1993 20:31
Date: Tue, 05 Jan 1993 20:31
31 lines
1709 bytes
1709 bytes
>From: "Roger Riordan" <riordan@tmxmelb.mhs.oz.au> >The command FDISK /MBR is often recommended for removing MBR >infectors (Stoned, etc) from hard disks. However in some >circumstances this can cause problems with some scanners. It >appears that some versions of FDISK/MBR rewrite the Master Boot >Record only as far as the end of the error messages, leaving the all >important partition information unchanged, but also leaving any >viral code between the messages and the partition information. Cannot speak for all versions but the FDISK.EXE in MS-DOS 5.00 dated 3-22-91 is identical to that of 11-11-91 and both zero out all the unused bytes between the end of the messages at absolute offset 0D9h and the beginning of the partition table at offset 1BEh. Of course FDISK/MBR will not have *any* effect with any DOS before 5.00 so this may be the cause. It is possible that PC-DOS or some other proprietary version or even that there may be an "export" MS-DOS that might have the effect Roger reports. (can only speak for what I have seen). Please reply directly & I will summarize any verifiable exceptions. Warmly, Padgett <padgett@tccslr.dnet.mmc.com> ps anyone know what the FORMAT switches /SELECT, /BACKUP, & /AUTOTEST do (MS-DOS 5.0) ?
Technical Details
Message-ID:
<0013.9301062041.AA14693@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!dtix!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!dtix!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) Newsgroups: comp.virus Subject: Clash between FDISK/MBR and scanners (PC) Message-ID: <0013.9301062041.AA14693@barnabas.cert.org> Date: 5 Jan 93 20:31:08 GMT Sender: virus-l@lehigh.edu Lines: 31 Approved: news@netnews.cc.lehigh.edu