hans@let.vu.nl (Hans Varkevisser) (07/21/89)
We have a virus on our PC, it is not a new one I think, but what to do?
The virus infects all disks,5 1/4 and 3 1/2 and the harddisk.
We can find the infected disks by using chkdsk. chkdsk gives 1024 bytes
bad sectors on a infected disk. When we use that disk in another
computer then we also have 1024 bytes badsectors on that harddisk.
When we use format on an infected computer, there seems to be nothing
wrong, formatting goes well, but when we use chkdsk it gives 1024 bytes
bad sectors.
So far I know that format, copy, diskcopy can't be used anymore and
xcopy doesn't work anymore.
I now low level format the harddisk and put the original files on it
and we format all the floppydisks with badsectors.
But when someone uses a disk with bad-sectors we have the virus back again.
We also can see the virus when we using backup or pcbackup etc. then
there is a little ball bounching over the screen. I also happens
sometimes ! when we using copy, diskcopy or an other copy command.
I don't know the program that infected our system, but we have a
lot of work to deal with it.
Is there a easier way to deal with the virus, except low-level format.
Hans
- --
Organisation: Free University, Faculty of Literature
Amsterdam, the Netherlands
Name: Hans Varkevisser (system administrator)
hans@let.vu.nl or let.vu.nl!hans UUCPCCEYEOYT@NUSVM.BITNET (07/22/89)
If I am not wrong, it is the Ping-pong virus ( also known as the Bouncing ball virus). I remove the virus by first copy the original boot record ( it is stored in one of the bad sectors marked by the virus) back to the boot sector and then erase the content in the two bad sectors. Yeo Y.T. Plus: I always boot-up the system with a 'clean' DOS before I make any changes. Otherwise the virus will remain active in the RAM if you boot-up with an infected disks. You will not be able to remove the virus even though you format your disk.