This message generated a parse failure. Raw output follows here. Please use 'back' to navigate. From devnull@lkml.org Fri Apr 26 22:25:55 2024 Received: from entropy.muc.muohio.edu (IDENT:root@entropy.muc.muohio.edu [134.53.213.10]) by herbie.ucs.indiana.edu (8.9.3/8.9.3) with ESMTP id QAA09585 for ; Wed, 28 Apr 1999 16:26:53 -0500 (EST) Received: from vger.rutgers.edu (vger.rutgers.edu [128.6.190.2]) by entropy.muc.muohio.edu (8.8.7/8.8.7) with ESMTP id RAA02408; Wed, 28 Apr 1999 17:24:54 -0400 Received: by vger.rutgers.edu via listexpand id <155511-14821>; Wed, 28 Apr 1999 14:22:46 -0400 Received: by vger.rutgers.edu id <155117-14821>; Wed, 28 Apr 1999 14:22:19 -0400 Received: from chaos.analogic.com ([204.178.40.224]:1434 "EHLO chaos.analogic.com" ident: "SOCKWRITE-65") by vger.rutgers.edu with ESMTP id <155102-14821>; Wed, 28 Apr 1999 14:21:35 -0400 Received: (from root@localhost) by chaos.analogic.com (8.9.3/8.7.3) id OAA01933; Wed, 28 Apr 1999 14:54:39 -0400 Date: Wed, 28 Apr 1999 14:54:39 -0400 (EDT) From: "Richard B. Johnson" Reply-To: root@chaos.analogic.com To: Michal Jaegermann Cc: David Luyer , dwguest@win.tue.nl, linux-kernel@vger.rutgers.edu Subject: Re: WAY OT--Crisis...virus! Need help In-Reply-To: <199904281720.LAA21510@ellpspace.math.ualberta.ca> Message-Id: Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-linux-kernel@vger.rutgers.edu Precedence: bulk X-Loop: majordomo@vger.rutgers.edu X-Orcpt: rfc822;linux-kernel-outgoing-dig On Wed, 28 Apr 1999, Michal Jaegermann wrote: [SNIPPED...] > > Yesterday I had an occasion of looking at some disks stricken by > the virus. We mounted these on Linux/Alpha machine so we were pretty > safe. :-) Partition tables actually still existed and even some top > directories looked mostly reasonable at the first glance (there were > multiple partitions on two disks). But FAT information was scrambled. > A text file would look sane for a moment but pretty soon would turn > into a binary chunk which obviously does not belong there. None of zip > archives I checked were usable. As the affected party had backups and > needed disks back right away we did not try to see if any attempts to > untangle the mess had any traces of a chance. Disks got reformatted. > This damage was definitely not confined only to "C:". > > Owners were also complaining that on disks they try to reformat > and repartition themselves 'fdisk' from Windows got spooked and > refused to do anything. Only after writing a block of nulls over > an initial disk portion they were acceptable. Linux on a floppy > and dd to the rescue. :-) > > Michal Here is a way to help prevent problems in the future. Just `cp` the raw device to a raw floppy until it's full. Save the floppy somewhere. If you need to fix the disk, mount a rescue disk somewhere and `cp` from the raw floppy back to the raw device. Here's a test I made on a spare partition. Script started on Wed Apr 28 14:34:30 1999 # umount /dev/sdb1 # cp /dev/sdb /fd0 # rm /fd0 # cp /dev/sdb /dev/fd0 cp: /dev/fd0: No space left on device # Here I delete the parition. # fdisk /dev/sdb Command (m for help): p Disk /dev/sdb: 255 heads, 63 sectors, 274 cylinders Units = cylinders of 16065 * 512 bytes Device Boot Start End Blocks Id System /dev/sdb1 1 260 2088418+ 83 Linux native /dev/sdb2 261 274 112455 83 Linux native Command (m for help): d Partition number (1-4): 1 Command (m for help): d Partition number (1-4): 2 Command (m for help): p Disk /dev/sdb: 255 heads, 63 sectors, 274 cylinders Units = cylinders of 16065 * 512 bytes Device Boot Start End Blocks Id System Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. WARNING: If you have created or modified any DOS 6.x partitions, please see the fdisk manual page for additional information. # Here I put the partition information back. # cp /dev/fd0 /dev/sdb # fdisk /dev/sdb Command (m for help): p Disk /dev/sdb: 255 heads, 63 sectors, 274 cylinders Units = cylinders of 16065 * 512 bytes Device Boot Start End Blocks Id System /dev/sdb1 1 260 2088418+ 83 Linux native /dev/sdb2 261 274 112455 83 Linux native Command (m for help): q # mount /dev/sdb1 /mnt mount: /dev/sdb1 is not a valid block device # Need to have the kernel re-read the partition table. # fdisk /dev/sdb Command (m for help): p Disk /dev/sdb: 255 heads, 63 sectors, 274 cylinders Units = cylinders of 16065 * 512 bytes Device Boot Start End Blocks Id System /dev/sdb1 1 260 2088418+ 83 Linux native /dev/sdb2 261 274 112455 83 Linux native Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. WARNING: If you have created or modified any DOS 6.x partitions, please see the fdisk manual page for additional information. You have new mail in /var/spool/mail/root # mount /dev/sdb1 /mnt # # It works. Let's check it. # ls /mnt PS_SYSTEM_MAP bin dev export home lost+found pi.c sbin var System.map boot dos exports hostsys mnt proc tmp vmlinux XF86Config cdrom etc guru lib net root usr vmlinuz # umount /mnt # fsck -f /dev/sdb1 Parallelizing fsck version 1.13 (15-Dec-98) e2fsck 1.13, 15-Dec-98 for EXT2 FS 0.5b, 95/08/09 Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information /dev/sdb1: 113887/522240 files (0.5% non-contiguous), 1730001/2088418 blocks # fsck -f /dev/sdb1 2 Parallelizing fsck version 1.13 (15-Dec-98) e2fsck 1.13, 15-Dec-98 for EXT2 FS 0.5b, 95/08/09 Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information /dev/sdb2: 11/28224 files (0.0% non-contiguous), 3598/112455 blocks # exit exit Script done on Wed Apr 28 14:44:48 1999 Cheers, Dick Johnson ***** FILE SYSTEM WAS MODIFIED ***** Penguin : Linux version 2.2.6 on an i686 machine (400.59 BogoMips). Warning : It's hard to remain at the trailing edge of technology. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/