Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: woody@chinacat.Unicom.COM (Woody Baker @ Eagle Signal) Newsgroups: comp.virus Subject: Re: infected? (PC) Message-ID: <0010.9008301334.AA25774@ubu.cert.sei.cmu.edu> Date: 26 Aug 90 04:56:31 GMT Sender: Virus Discussion List Lines: 38 Approved: krvw@sei.cmu.edu James Li posts a message about trashed disks. o.k., I would say that you have no infected disks, but what has happened is fairly nasty. I am assuming that you formatted the disks on the other machine. Now, there are various flavors of DOS around, and various flavors of format utilities. If you take a disk formatted and written on by dos 3.x and try reading it on a system running dos 2.1x you will have symptoms exactly as described. MS-DOS is only upwardly compatable between major releases, i.e. primary number changes. There is an additional problem. We released a new software package where I work. Some of our users reported that file directories were garbaged out and the programs would not work, others had no problem. I got a set of bad disks sent back. On my machine they were trashed, on a compaq they were trashed, on another machine, running another flavor of DOS, they were fine. A perusal with Norton, revealed the following: In the FAT table (the File Allocation Table) the first byte used to be used as a format identifier. If it was a F0 it marked a single sided 180k floppy. If it is F8 it is a double sided 360K floppy. The format program out on the factory floor was formatting double sided, but writing the id byte for a single sided disk. Some versions of dos make decisions based on the FAT table, others use other criteria to determine what kind of disk it is. Those that used other critera, such as placement of FAT tables worked, the ones that used the id byte didnot. MS documentation says that the id byte can no longer be relied on. The basic problem is that the first copy of the FAT always resides at the same spot both for 360k and 180k floppies, but in the case of a 360k floppy, the fat table is 2 'x as big. The second sector of the second fat table, occupies (on a 360K disk) occupies the exact same physical/logical sector as the directory sector on a 180K floppy. This results in total hash in the directory if the system thinks it's a 180K floppy. Hope this helps Cheers Woody