Clash between FDISK/MBR and scanners (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by A. Padgett Peterson Tue, 05 Jan 1993 20:31

#4762

Author: A. Padgett Peterson
Date: Tue, 05 Jan 1993 20:31

31 lines
1709 bytes

>From:    "Roger Riordan" <riordan@tmxmelb.mhs.oz.au>

>The command FDISK /MBR is often recommended for removing MBR 
>infectors (Stoned, etc) from hard disks.  However in some 
>circumstances this can cause problems with some scanners.  It 
>appears that some versions of FDISK/MBR rewrite the Master Boot 
>Record only as far as the end of the error messages, leaving the all 
>important partition information unchanged, but also leaving any 
>viral code between the messages and the partition information.

Cannot speak for all versions but the FDISK.EXE in MS-DOS 5.00
dated 3-22-91 is identical to that of 11-11-91 and both zero out all
the unused bytes between the end of the messages at absolute offset
0D9h and the beginning of the partition table at offset 1BEh. 

Of course FDISK/MBR will not have *any* effect with any DOS before 
5.00 so this may be the cause. 

It is possible that PC-DOS or some other proprietary version or even
that there may be an "export" MS-DOS that might have the effect Roger 
reports. (can only speak for what I have seen).

Please reply directly & I will summarize any verifiable exceptions.

					Warmly,

						Padgett
		<padgett@tccslr.dnet.mmc.com>

ps anyone know what the FORMAT switches /SELECT, /BACKUP, & /AUTOTEST
   do (MS-DOS 5.0) ?

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads