[comp.virus] Help to remove Joshi from partion table

CCA3607@SAKAAU03.BITNET (06/11/91)

I try to use clean77 to remove , i get the virus removed i run the
computer from new dos after i put the power off when i started ifined
it again any help appreciation

 Terry  jawberh
cca3605@sakaau03.bitnet

paul%parsifal@econ.YALE.EDU (Paul McGuire) (06/12/91)

CCA3607@SAKAAU03.BITNET writes:
>I try to use clean77 to remove , i get the virus removed i run the
>computer from new dos after i put the power off when i started ifined
>it again any help appreciation
>
> Terry  jawberh

You should examine the boot sector and see what else you can find.  My
symptoms were that I couldn't boot from the hard disk, and I found
that I had been hit with Joshi and Stoned at the same time, and
neither clean77 nor f-disinf (1.15) fixed it, though they both claimed
that they had.  (Immediately rerunning the respective program told me
I was cured again.)

I wound up doing a low level format, since I wasn't able to find a
clean copy of the boot sector stashed away by either of them, and
wasn't sure of what I was doing anyway.

General question: Is there some way of rewriting the boot record
without doing a low level format, or using a disk editor or debugger?
For that matter, what does one use to do a low level format?  Real
IBMs don't come with low level formatting software.

Paul McGuire
Yale Economic Growth Center

p1@arkham.wimsey.bc.ca (Rob Slade) (06/12/91)

CCA3607@SAKAAU03.BITNET writes:

> I try to use clean77 to remove , i get the virus removed i run the
> computer from new dos after i put the power off when i started ifined
> it again any help appreciation
>
>  Terry  jawberh
> cca3605@sakaau03.bitnett

I would suggest a slight reordering of your disinfection procedure.

     1) Boot from a known, clean, write protected system floppy disk.
     2) Then run CLEAN/FPROT/whatever to remove the infection.
     3) Test your system again, and redo if necessary.
     4)  Reboot.


=============
Vancouver          p1@arkham.wimsey.bc.ca   | "If you do buy a
Institute for      Robert_Slade@mtsg.sfu.ca |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security