Thread View: comp.virus
1 messages
1 total messages
Started by A. Padgett Peterson
Tue, 10 Nov 1992 22:31
Is this a Virus (PC)
Author: A. Padgett Peterson
Date: Tue, 10 Nov 1992 22:31
Date: Tue, 10 Nov 1992 22:31
33 lines
1625 bytes
1625 bytes
To: UVS1::"rknazik@x102a.harris-atd.com" (personal mail to this address bounced) (user reported 654360 bytes by DOS 5.0 MEM and CHKDSK) a) See the FAQ 8*) it has an entry for this point. b) The following process is what I use for "something" that cannot be identified: Well, first I assume you meant 654336 not 654360 "total bytes memory" or I'd be looking for a bad chip. Next, I would cold boot from a clean write protected floppy with MEM or CHKDSK on it and see if you get the same thing. If not I would be concerned. Then I would use DEBUG to look at the missing memory "D 9fc0:0 L 400" should dump the whole k. (D 9fc0:0 with 7 sucessive "D"s will do the same thing slower) If almost all zeros, it is probably a buffer. If 1/4 or more full of code, then I would be concerned, paticularly if there were "interesting" ASCII strings. If all FFs then the chip is not responding to that address range (really odd). If really suspicious I would boot from floppy, capture the MBR, then run FDISK /MBR and see if that took care of it. If not, try capturing the DBR and run SYS. If this fixes the problem, send the captured file to a researcher. Write if this doesn't take care of it. warmly, Padgett
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads