Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!elroy.jpl.nasa.gov!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: Re: Removing Azusa (was: Hong Kong on...) (PC)
Message-ID: <0004.9106131515.AA13504@ubu.cert.sei.cmu.edu>
Date: 12 Jun 91 15:12:51 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 12
Approved: krvw@sei.cmu.edu

>From:    dwe29248@uxa.cso.uiuc.edu (Derek William Ebdon)
>The only way to
>disinfect a hard drive is to redo the low level format because the
>virus infects the boot sector and the dos partition.

A low-level format is certainly not the *only* way to fix an
Azusa-infected hard disk.  Any program that can write a valid boot
record to the partition-table area (preserving the partition
information and just fixing the code) will remove the virus from the
execution stream, and (since the Azusa uses only the partition table
area on a hard disk, and no sectors in the DOS partition or anywhere
else) that will disinfect the disk very nicely...  DC