Messages in this thread | | | From | Michal Jaegermann <> | Subject | Re: WAY OT--Crisis...virus! Need help | Date | Wed, 28 Apr 1999 11:20:24 -0600 (MDT) |
| |
David Luyer wrote: > > > Going back to "Chernobyl virus" - I was told that it destroys > > FAT tables, backup FAT tables, partition tables and after that > > attempts to overwrite BIOS. > > I've heard it does all kinds of things. Actually fixing affected > machines for friends/family tells me it only overwrites about the > first 1Mb of the first drive in the system, leaving any extra > partitions on that drive and any additional drives fine.
There could be some variations of the virus or it behaves differently depending on a time of the day or random number generator or something like that.
Yesterday I had an occasion of looking at some disks stricken by the virus. We mounted these on Linux/Alpha machine so we were pretty safe. :-) Partition tables actually still existed and even some top directories looked mostly reasonable at the first glance (there were multiple partitions on two disks). But FAT information was scrambled. A text file would look sane for a moment but pretty soon would turn into a binary chunk which obviously does not belong there. None of zip archives I checked were usable. As the affected party had backups and needed disks back right away we did not try to see if any attempts to untangle the mess had any traces of a chance. Disks got reformatted. This damage was definitely not confined only to "C:".
Owners were also complaining that on disks they try to reformat and repartition themselves 'fdisk' from Windows got spooked and refused to do anything. Only after writing a block of nulls over an initial disk portion they were acceptable. Linux on a floppy and dd to the rescue. :-)
Michal
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |