Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: rzi@philpav.tds.philips.se (Roman Zielinski) Newsgroups: comp.virus Subject: Norton sd says *NonMovable Blk* (was Curse.exe virus) (PC) Message-ID: <0004.9011061327.AA14231@ubu.cert.sei.cmu.edu> Date: 4 Nov 90 10:35:30 GMT Sender: Virus Discussion List Lines: 30 Approved: krvw@sei.cmu.edu Some days ago someone complains that *curse.exe* (i.e. the tool replacing the mouse-arrow by a tiger-cartoon-figure in win 3.0) creates non-movable blocks. I looked a little in my 386-system and noticed that Nortons *sd* reported a number of areas marked by X, *NonMovableBlks*! 2 areas was occupied by the boot staff 1 was msdos.exe (i localized it to \windows directory (its the *old* win 2.x-like executive) 1 was a lost cluster that could be corrected/removed by chkdsk /f The only strange thing is why msdos.exe is nonmovable? - - if I rename it to msdos1.exe the X-marking disappears! - - I fetched a new copy from MSDOS distrib diskettes (You have to use "expand.exe" to uncompress!), and the same occurs - the file is nonmovable only when it has the funny msdos.exe-name... Can someone explain that????? Roman +-------------------------------------------+ _--~--_ | Roman M. Zielinski | ---- / \ ---- | Philips Tele & Data System AB | ---- ( |^^^| ) ---- | S-115 84 Stockholm, Sweden | ---- \ \ / / --- | tel +46 8 782 1373 | |=====| +-------------------------------------------+ |=====| | NET ADDR: rzi@pav.tds.philips.se | |=====| +-------------------------------------------+ ~~U~~