F-Prot won't clean... (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by A. Padgett Peterson Thu, 10 Dec 1992 15:31

#4274

Author: A. Padgett Peterson
Date: Thu, 10 Dec 1992 15:31

16 lines
1139 bytes

I *suspect* that what you have is a simple STONED hack that just has
changed the real MBR resting place to something other than 0,0,7
(essentially a two byte change). I do not know if F-Prot uses a global
search for a valid partition table like my stuff (no names) but this
would tend to indicate that it does not.

The AZUSA virus does not bother to save the original MBR so when you
use CLEAN [AZUSA], I would expect this to be the same as CLEAN [GEN-P]
which is also essentially the same as FDISK /MBR since the only
assumption made is that the valid partition table is in sector 1 and
the MBR code is replaced by a canned program.

I am curious to know where or whether it did store the original MBR.

					Warmly,
						Padgett

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads