Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!elroy.jpl.nasa.gov!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: paul%parsifal@econ.YALE.EDU (Paul McGuire)
Newsgroups: comp.virus
Subject: Re: Help to remove Joshi from partion table (PC)
Message-ID: <0007.9106121957.AA12675@ubu.cert.sei.cmu.edu>
Date: 11 Jun 91 19:49:42 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 25
Approved: krvw@sei.cmu.edu

CCA3607@SAKAAU03.BITNET writes:
>I try to use clean77 to remove , i get the virus removed i run the
>computer from new dos after i put the power off when i started ifined
>it again any help appreciation
>
> Terry  jawberh

You should examine the boot sector and see what else you can find.  My
symptoms were that I couldn't boot from the hard disk, and I found
that I had been hit with Joshi and Stoned at the same time, and
neither clean77 nor f-disinf (1.15) fixed it, though they both claimed
that they had.  (Immediately rerunning the respective program told me
I was cured again.)

I wound up doing a low level format, since I wasn't able to find a
clean copy of the boot sector stashed away by either of them, and
wasn't sure of what I was doing anyway.

General question: Is there some way of rewriting the boot record
without doing a low level format, or using a disk editor or debugger?
For that matter, what does one use to do a low level format?  Real
IBMs don't come with low level formatting software.

Paul McGuire
Yale Economic Growth Center