[comp.virus] Norton sd says *NonMovable Blk*

rzi@philpav.tds.philips.se (Roman Zielinski) (11/04/90)

Some days ago someone complains that *curse.exe* (i.e. the tool replacing
the mouse-arrow by a tiger-cartoon-figure in win 3.0) creates non-movable
blocks.

I looked a little in my 386-system and noticed that Nortons *sd* reported
a number of areas marked by X, *NonMovableBlks*!

2 areas was occupied by the boot staff
1 was msdos.exe (i localized it to \windows directory (its the *old*
  win 2.x-like executive)
1 was a lost cluster that could be corrected/removed by chkdsk /f

The only strange thing is why msdos.exe is nonmovable?
- - if I rename it to msdos1.exe the X-marking disappears!
- - I fetched a new copy from MSDOS distrib diskettes (You have to use
  "expand.exe" to uncompress!), and the same occurs - the file is nonmovable
  only when it has the funny msdos.exe-name...

Can someone explain that?????

Roman

+-------------------------------------------+           _--~--_
| Roman M. Zielinski                        |   ----   /       \   ----
| Philips Tele & Data System AB             |  ----   (  |^^^|  )   ----
| S-115 84 Stockholm, Sweden                |   ----   \  \ /  /   ---
| tel +46 8 782 1373                        |           |=====|
+-------------------------------------------+           |=====|
| NET ADDR:  rzi@pav.tds.philips.se         |           |=====|
+-------------------------------------------+            ~~U~~

terry@spcvxb.spc.edu (Terry Kennedy, Operations Mgr) (11/07/90)

rzi@philpav.tds.philips.se (Roman Zielinski) writes:
> The only strange thing is why msdos.exe is nonmovable?
> Can someone explain that?????

  Sure. Norton thinks that anything "strange" is non-movable because
it might be copy-protected. MSDOS.EXE is (last I looked) a 1-byte
file. Now it is not possible to have a 1-byte EXE. MS-DOS sees an
invalid header and loads it as a .COM, but Norton doesn't know about
that.

  If you call Norton, you might ask them about a program called
"SDPROBE" which will tell you lots of useful things about why files
are not movable, as well as debugging information about SD itself.

        Terry Kennedy           Operations Manager, Academic Computing
        terry@spcvxa.bitnet     St. Peter's College, US
        terry@spcvxa.spc.edu    (201) 915-9381

decomyn@penguin.uss.tek.com (11/08/90)

rzi@philpav.tds.philips.se (Roman Zielinski) writes:
>Some days ago someone complains that *curse.exe* (i.e. the tool replacing
>the mouse-arrow by a tiger-cartoon-figure in win 3.0) creates non-movable
>blocks.
>
>I looked a little in my 386-system and noticed that Nortons *sd* reported
>a number of areas marked by X, *NonMovableBlks*!
>
>2 areas was occupied by the boot staff
>1 was msdos.exe (i localized it to \windows directory (its the *old*
>  win 2.x-like executive)
>1 was a lost cluster that could be corrected/removed by chkdsk /f
>
>The only strange thing is why msdos.exe is nonmovable?
>- - if I rename it to msdos1.exe the X-marking disappears!
>- - I fetched a new copy from MSDOS distrib diskettes (You have to use
>  "expand.exe" to uncompress!), and the same occurs - the file is nonmovable
>  only when it has the funny msdos.exe-name...
>
>Can someone explain that?????

Most likely, Norton's sd is looking for a combination of System
attribute bit and one of the names that the DOS programs can have
(IBMBIO, IBMDOS, MSDOS and IO) without checking the file extension (as
far as I know, all of these have a .SYS extension).

Of course, if the MSDOS.EXE file doesn't have the System bit set, then
it might be looking for the name on any executable file.  An easy test
would be to copy some text file to MSDOS.COM and see if Norton's flags
it as unmovable.

In any case, it's probably just a bug in the program.

-
 -------------------------------------------------------------------------------
Brendt Hess a.k.a.             | Disclaimer: Opinions?  I don't even work here!
Vergil William de Comyn a.k.a. |-----------------------------------------------
Payne Hirds                    |       Life is not a zero-sum game:
decomyn@penguin.uss.tek.com    |          don't treat it as such.

korpela@stew.ssl.berkeley.edu (Eric J. Korpela) (11/08/90)

rzi@philpav.tds.philips.se (Roman Zielinski) writes:
>I looked a little in my 386-system and noticed that Nortons *sd* reported
>a number of areas marked by X, *NonMovableBlks*!
> ...
>1 was msdos.exe (i localized it to \windows directory (its the *old*
>  win 2.x-like executive)
> ...
>The only strange thing is why msdos.exe is nonmovable?

The reason that MSDOS.EXE was listed as unmovable is because of a
"feature" of Norton's SD that lets you specify files which will not be
moved.  MSDOS.EXE is, by default, specified to be unmovable.
Apparently Norton wanted to be sure that no one has renamed their
MSDOS.COM system file to MSDOS.EXE.  (Or perhaps he was afraid that
future versions of MSDOS would use system files in EXE format).

To allow MSDOS.EXE to be moved you must do (from SD)
1) Set Options
2) Unmovable files
3) Remove the stupid filenames

It's as easy as that.  Removing a file name from the list of unmovable
files will not change the file attributes nor will it make system
files movable.

    /\                      korpela@sunspot.ssl.berkeley.edu      Internet
   /__\  rioch              BKYAST::KORPELA    42215::KORPELA     DecNet
  /    \   of Chaos         korpela%bkyast@ucbjade                Bitnet
 (_____________________     <aka Eric Korpela>