[comp.virus] DOS 5 Fdisk, etc

PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics) (06/18/91)

BARNOLD@YKTVMH.BITNET writes:
> Readers might want to play with an undocumented /MBR switch in DOS 5
> FDISK.  It appears to force FDISK to overwrite the code in a PC/PS2
> master boot record, without touching the partition table, and in
> limited testing on a half dozen machines it succeeded in cleaning up
> machines infected with the Stoned, the Stoned 2, and the Joshi
> viruses.  This was with the DOS 5 shipped by IBM, not Microsoft's DOS
> 5; can somebody please test MS-DOS 5?

On a related subject:
You may use the DRDOS 5 sys command to rewrite the boot sector (not
the MBR, I think), but watch out when you have a diskette infected in
such a way that the Bios Parameter Block (that says the disk size,
etc) has been junked (e.g. by stoned).  The SYS command rewrites a
good boot sector around it (fair enough), but acts on the size
information in the BPB, and you end up with a disk that needs to be
fixed with a disk editor. Remember that DOS normally ignores a lot of
the BPB and goes by the ID byte at the start of the FAT; this is
because early (version 1) DOS might write anything there. DRDOS reacts
sensibly if it contains junk *except* when it comes to the SYS
command, so beware.

Mark Aitchison, Physics, University of Canterbury, New Zealand.