lkml.org 
[lkml]   [1999]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: WAY OT--Crisis...virus! Need help
Date
Visit www.datafellows.com, click on the "CIH" link on the first page. It
will tell you about the virus, and yes, it does trash the disk -then-
attempt to write to CMOS. If your board isn't an Intel 430TX or if the CMOS
flash jumper is not enabled, it will not mess with your CMOS. It does,
however, screw over your partition tables. I have two PCs right here that
are currently not functional because of this. Does anyone know if Norton
DiskDoctor might be able to fix the partition tables and at least recover
some data?

James Willard
james@whispering.org

>
> Well, I stand very much corrected. Dropped in to my friendly neighbourhood
> computer dealer this evening to find two (2) people standing there with
> their PCs. Both had the same symptom: totally black screens on power-up.
>
> Apparently the Chernobyl (aka CIH) virus _has_ struck.
>
> BUT the good news, at least for followers of this thread, is: if your PC can
> boot (or indeed display any message at all), you most likely don't have the
> CIH virus, because it trashes your CMOS. I suppose it might trash your disk
> instead if it has trouble writing to the CMOS, but I haven't seen that
> mentioned on any of the A-V sites I visited.
>
> ---------------------------------------------------------------
> |\ | o _ |/ Life's like a jigsaw
> | \| | |_ |\ You get the straight bits
> But there's something missing in the middle
>
> Nick Brown, Strasbourg, France (Nick(dot)Brown(at)coe(dot)fr)
> ---------------------------------------------------------------
>
>
> > -----Original Message-----
> > From: BROWN Nick [SMTP:Nick.BROWN@coe.fr]
> > Sent: 26 April 1999 15:29
> > To: 'Allan M. Wind'
> > Cc: linux-kernel@vger.rutgers.edu
> > Subject: RE: WAY OT--Crisis...virus! Need help
> >
> > >> There is a virus due to activate about now. We made today a
> > holiday in
> > >> South Australia - should have done the same at Penn, perhaps.
> > >That's the first positive impact, I've ever seen, a virus had.
> > Don't
> > >get any ideas now!
> >
> > My money is on it _not_ being a virus, given the number of partition table
> > sectors (and disks generally) world-wide which will go belly-up today like
> > any other day. Out of 2x10**8 PCs, I'd expect something like 1x10**5 to
> > have a serious disk problem on any given day, by the time you combine HD
> > MTBF and good old-fashioned bugs. And of course, people screwing up with
> > FDISK and blaming a virus when their boss asks why they haven't got any
> > work
> > done.
> >
> > One way to make a backup of your partition table sector (MBR) for next
> > time
> > :-) would appear to be:
> > dd if=/dev/hda of=/floppy/savembr bs=512 count=1
> >
> > [off-topic] I wrote a DOS version of this, too, as part of my free DOS
> > anti-virus stuff I did about 6 years ago (when DOS viruses such as Stoned,
> > Form, etc were the main problem). It saves the MBR and the active boot
> > sector in a magic file, so you can later restore them, or compare them
> > against the current live versions to detect viruses, etc. About twice a
> > year I would undo somebody's FDISKing, to their total amazement.
> >
> > |\ | o _ |/ Life's like a jigsaw
> > | \| | |_ |\ You get the straight bits
> > But there's something missing in the middle
> >
> >
> > -
> > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > the body of a message to majordomo@vger.rutgers.edu
> > Please read the FAQ at http://www.tux.org/lkml/
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>


--
James D. Willard | Linux/FreeBSD/OpenBSD/Novell/Win/DOS/Minix User
james@whispering.org | finger james@whispering.org for PGP Public Key
#!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)
.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,.,-=-,

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.028 / U:0.792 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site