Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!swrinde!elroy.jpl.nasa.gov!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: LYNNE@vax.oxford.ac.uk
Newsgroups: comp.virus
Subject: Boot sector viruses on IDE hard disks (PC)
Message-ID: <0005.9104101917.AA00785@ubu.cert.sei.cmu.edu>
Date: 10 Apr 91 14:39:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 35
Approved: krvw@sei.cmu.edu

Can anyone offer me preventative and curative measures for the new IDE
hard disks if they become infected with a boot sector virus. If the
virus is one that cannot be successfully removed by any of the current
anti-viral software, I believe we will be reduced to doing a low-level
format on the disk in order to rewrite the boot sector. This will, as
far as I know, erase the information that on older drive types was
stored in the CMOS, thereby making the disk unusable. As the
manufacturers seem very reluctant to supply us with the information
needed to correctly rewrite the boot sector we are looking at other
means to avoid this eventuality.

In the way of preventative measures we think that a solution would be
to advise our users who are purchasing IDE drives to take several
backup copies of the boot sector which they can then copy back to the
disk if it becomes infected. We believe we can use Norton Utilities to
rewrite the boot sector but are unsure about the procedure for writing
the correct boot sector contents. Has anyone got information that
would help us with this?

Does anyone know of a simple (and optimally free) utility that
provides a fool-proof mechanism for copying and writing the boot sector?

As far as curative measures are concerned (where a copy has not
been taken of the BS) we are stymied! Has anyone any suggestions?

Again on the subject of boot sector viruses does anyone know of some
anti-viral software that will remove the Spanish Telecom or Telefonica
virus?

Please mail me directly at LYNNE@UK.AC.VAX.OXFORD.

Thanks in advance.

Lynne Munro
Oxford University Computing Service