Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!wuarchive!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: JLI@VAX.OXFORD.AC.UK (James Li, Oxford)
Newsgroups: comp.virus
Subject: infected? (PC)
Message-ID: <0004.9008221137.AA19228@ubu.cert.sei.cmu.edu>
Date: 18 Aug 90 11:05:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 86
Approved: krvw@sei.cmu.edu

Dear netter,
     I have lost the contents of two floppies after copying some files
into them on a ibm compatible in the computing service in Oxford.
After copying I got information about one of the floppies as follows:

from dos command "dir":

 Volume in drive A is |s$;n
 Directory of  A:\

kPC To ols 12255232   9-00-80  12:00a
|3@zPc $X871598879  25-05-80  12:04p
`	
hl >l <DIR>     12-07-81   8:30p
Ahv
ZYFl2767453438  30-05-75  12:02a
        6 File(s)     12288 bytes free

from dos command chkdsk:

Volume |s$;n created 26 Wri 2069 9:30p

Errors found, F parameter not specified.
Corrections will not be written to disk.

A:\kPC To.ols
   Allocation error, size adjusted.
A:\|3@zPc.$X
   First cluster number is invalid,
    entry truncated.
A:\|s$;n
   First cluster number is invalid,
    entry truncated.
Cannot CHDIR to A:\>_W=
   tree past this point not processed.
A:\`	
   First cluster number is invalid,
    entry truncated.
A:\Ms2dM.Mur
   First cluster number is invalid,
    entry truncated.
A:\tC i
   First cluster number is invalid,
    entry truncated.
A:\:6j
   First cluster number is invalid,
    entry truncated.
A:\hl.>l
   First cluster number is invalid,
    entry truncated.
A:\Ahv
   First cluster number is invalid,
    entry truncated.
A:\&?J
   First cluster number is invalid,
    entry truncated.
A:\i
   First cluster number is invalid,
    entry truncated.
A:\ZYFl
   First cluster number is invalid,
    entry truncated.
A:\^Aho^;
   First cluster number is invalid,    entry truncated.

132 lost clusters found in 10 chains.
Convert lost chains to files  (Y/N)? n
   135168 bytes disk space
          would be freed.

   362496 bytes total disk space        0 bytes in 6 hidden files
     4096 bytes in 4 directories
   210944 bytes in 5 user files
    12288 bytes available on disk

   654336 bytes total memory
   543600 bytes free


However, when using scanv64 on these floppies, I got the report as "no
virus found". I was puzzled about this situation. Could anyone can
tell me what may have happened to the floppies? Are these floppies
infected or not? Is there any chance to recover the contents on the
floppies? I will appreciate any help on this problem.

James Li