Messages in this thread |  | | Subject | Re: Virus 'protection' departitionment | Date | Wed, 7 Aug 1996 17:04:17 +0100 (BST) | From | "Ian Whalley" <> |
| |
> I just ran f-prot virus protection(in dos) and it said it found and >cleaned the ripper virus on my second drive, the one with a dos, linux swap, >and ext-2 partition. It decided I really had one huge dos partition and >wrote that on my MBR. Does anyone know any way to rewrite the MBR with the >correct information witout losing all the data on my drive?
Curious...
> BTW, I know the data is still there because my kernel is on that >drive and lilo can still run it, but of course it can't mount root, cause >the file system info is wrong in the MBR.
Um. Well, it ought to be possible -- provided you haven't done anything silly like write to the huge DOS partition it's created for you -- to write back in correct values for the location of each partition into the MBR. After all, whilst the contents of the partition tables is screwed up, that should be all.
The only way I can figure for you to do this will be to boot DOS and use Norton [or similar] to look across the surface of the disk for the start of each partition. The problem is that unless someone here can provide you with some hex patten which can be located near the beginning of an ext2fs file system, it's going to be almost impossible. I don't even know if the swap partition will have such an identifier -- anyone?
However, if you are able to work out correct values, you can use Norton to drop them back into the MBR (make sure you compute the size field correctly!), everything should work again. The partition type code for a linux swap partition is 82h, and that for an ext2fs one is 83h.
Best,
I.
------------------------------------------------------------------------------ |---Ian Whalley, Editor, Virus Bulletin Magazine---|-Author of Project VGrep-| |-Direct/Office/Fax: +44-1235-544039/555139/531889-|-virus name xref system--| |-Key CRC: 2A02 96E5 5D77 4C8D EB22 146F E03B A0D3-|-Get it from the web at:-| |-Unix/NT/W95/Win32/C/x86/Sed/Awk/Perl/Sh/Html/VBA-|http://www.virusbtn.com/ | ------------------------------------------------------------------------------
|  |