Article View: comp.virus
Article #4780Re: Clash between FDISK/MBR and scanners (PC)
From: Kevin Marcus
Date: Wed, 06 Jan 1993 09:05
Date: Wed, 06 Jan 1993 09:05
23 lines
1814 bytes
1814 bytes
riordan@tmxmelb.mhs.oz.au (Roger Riordan) writes: >The command FDISK /MBR is often recommended for removing MBR >infectors (Stoned, etc) from hard disks. However in some >circumstances this can cause problems with some scanners. It >appears that some versions of FDISK/MBR rewrite the Master Boot >Record only as far as the end of the error messages, leaving the all >important partition information unchanged, but also leaving any >viral code between the messages and the partition information. I recently installed Linux, a version of unix for the PC, in addition to my regular dos partition. This comes with a small program called "wini" which is a program, which occupies the MBR to allow me to choose which OS I would like to boot into. It's my understanding OS/half does somethign like this, also, or can do something like this. If FDISK/MBR REWRITES the MBR with the basic, boring code that normally is there with DOS, then if I use this method, I will destroy the wini program, and restrict myself from booting into my Linux partition. This is another drawback to fdisk/mbr. - -- || Kevin Marcus, Computer Virologist. (619)/457-1836; RE-xxx, TSCAN || || INET: tck@bend.ucsd.edu []-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[] || tck@fold.ucsd.edu || All I wanted was a Pepsi... || || datadec@watserv.ucr.edu || And she wouldn't give it to me...||
Technical Details
Message-ID:
<0007.9301071651.AA16031@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!think.com!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!think.com!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: tck@bend.ucsd.edu (Kevin Marcus) Newsgroups: comp.virus Subject: Re: Clash between FDISK/MBR and scanners (PC) Message-ID: <0007.9301071651.AA16031@barnabas.cert.org> Date: 6 Jan 93 09:05:10 GMT Sender: virus-l@lehigh.edu Lines: 23 Approved: news@netnews.cc.lehigh.edu