lkml.org 
[lkml]   [1999]   [Apr]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: WAY OT--Crisis...virus! Need help
Date
David Luyer wrote:
>
> > Going back to "Chernobyl virus" - I was told that it destroys
> > FAT tables, backup FAT tables, partition tables and after that
> > attempts to overwrite BIOS.
>
> I've heard it does all kinds of things. Actually fixing affected
> machines for friends/family tells me it only overwrites about the
> first 1Mb of the first drive in the system, leaving any extra
> partitions on that drive and any additional drives fine.

There could be some variations of the virus or it behaves differently
depending on a time of the day or random number generator or something
like that.

Yesterday I had an occasion of looking at some disks stricken by
the virus. We mounted these on Linux/Alpha machine so we were pretty
safe. :-) Partition tables actually still existed and even some top
directories looked mostly reasonable at the first glance (there were
multiple partitions on two disks). But FAT information was scrambled.
A text file would look sane for a moment but pretty soon would turn
into a binary chunk which obviously does not belong there. None of zip
archives I checked were usable. As the affected party had backups and
needed disks back right away we did not try to see if any attempts to
untangle the mess had any traces of a chance. Disks got reformatted.
This damage was definitely not confined only to "C:".

Owners were also complaining that on disks they try to reformat
and repartition themselves 'fdisk' from Windows got spooked and
refused to do anything. Only after writing a block of nulls over
an initial disk portion they were acceptable. Linux on a floppy
and dd to the rescue. :-)

Michal

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:51    [W:1.996 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site