🚀 go-pugleaf

Thus spake mybdav02@uctvax.uct.ac.za:
>Recently, I have had a run-in with the so-called ExeBug virus

I see you're posting from Cape Town -- not surprising that you've had
EXEbug, because it's rapidly becoming the most common virus in South
Africa. We've had reports of people buying new PC gear that came with
the virus already present, which would help to explain its prevalence
and rapid spread. If my memory serves me right, the virus appeared in
about April 1992, near Pretoria.

>I used CLEAN 97 A: [Swb] /nomem to remove the virus, and CLEAN 
>reported that it had removed the virus.  However, on
>rebooting (before any other programs were run), the partition table of
>the HDD was infected!

I assume the /nomem switch "turns off" the virus-in-memory check.  If
so, this is extremely silly. EXEbug's stealth is such that all writes
to the partition record while the virus is resident get deflected to
its hidden copy of the "real" partition record.  You can't remove
EXEbug with conventional techniques whilst it's resident. BOOT CLEAN
BEFORE GOING VIRUS HUNTING...

>In the article by BIT magazine, it was stated that the virus formatted
>an extra sector for itself, and copied the original boot sector there.
>I couldn't find this extra sector with Norton 6.01's DISKEDIT, so
>copied clean boot sectors from other disks to the infected disks.

Try Quaid's excellent Explorer, or Alan Solomon's PEEKA, if you wish
to look at weird sectors. On high-capacity discs, EXEbug formats an
extra track -- track 80 -- for its own use. Look for 80.0.1. On
low-cap discs, it's at 40.0.1. One serious flaw in the virus is that
it assumes that 720KB stiffies have 40 tracks (0..39), rather than 80,
and formats its "extra" track at 40.0, obliterating anything that was
there before!

DISKEDIT is a "clever" program, which knows the geometry of specific
mdeia. When you ask it to read a particular physical sector, it pops
up an input form asking you to enter the track, head and sector you
wish to look at -- and helpfully performs validation on your input.
So, you can't ask to look at track 40 of a 360KB disc-- DISKEDIT is
"intelligent" enough to know that your "40" is erroneous!
- -- 
- --..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--
Paul Ducklin                                       duck@nuustak.csir.co.za

  CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa