From: 72571.3352@compuserve.com (Wolfgang Stiller)
Newsgroups: comp.virus
Subject: Re: os/2 changes to boot sector (OS/2)
Date: 22 Aug 92 20:57:35 GMT

In Virus #141,  ygoland@edison.SEAS.UCLA.EDU Yaron (The Jester) Goland
writes:

 > I currently run a program called 'Integrity Master' by Wolfgang
 > Stiller. Among other things, this program checks the boot sector of
 > each partition against a copy it made of the partition,
 > to detect any changes. My harddrive is a 210 western digital
 > pyranna(sp) which is currently set up with three partitions:
 >         OS/2 Boot Manager Partition-A 1 meg partition
 >         Dos Partition-A 1 meg partition
 >         FAT/HPFS-I have one last partition which is 200 or so megs
 >                  and is then subdivided into two logical partition,
 >                  the first is fat and the second is hpfs.
 >
 > My Problem is as follows:When I run IM (Integrity Master) under os/2
 > to initialize the boot sector, I don't have any problems. However if
 > I then change to dos, dos will say that the D drive boot sector
 > has changed!

That's because it _HAS_ changed.  When you boot back to DOS you are
using a different boot sector. I don't use boot manager myself but I
use dual boot and experience exactly what you're talking about.  The
simple solution would be to check your boot sectors under either DOS
or OS/2 (but not both) and stick to that or else use separate .SID and
.SRL (sector ID and Sector reload) files for each system.  You could
use a batch file to switch the files when you boot the other operating
system.

Also, as I understand it, Boot Manager may switch the active
partition.  This change alters the master boot record (AKA partition
sector).  If this is the sector IM is reporting as changed, (it calls
the MBR the "partition sector" as opposed to the "DOS Boot sector" to
avoid confusion.

 > In addition it will say that there is a self executing
 > program in my D drive dos boot sector!

What do you mean by "self executing" program?

All boot sectors may contain a program.  Integrity Master does not
talk about "self executing" programs so I'm baffled as to what you are
asking about here.

 > In addition if I then do NOT
 > re-initalize my data (i.e. its still comparing my current boot
 > sector to the picture it has in it's memory) and return to os/2,
 > IM will still say that there is a problem!

Please be more specific.  What problem does it say there is.  I have
gone out of my way to make sure that Integrity Master is very clear
and very specific.  It uses simple language to explain exactly what it
finds wrong.  It won't just say "there is a problem", it will say
exactly what is wrong and also suggest what might have caused the
problem and then suggest specific steps to correct the problem.

 > Matters are further
 > complicated by the fact that I just had a cmos failure. The specific
 > failure was that my harddrive and both my disk drives settings were
 > set to 'disabled'. This could very well be a battery failure

You're correct; battery failure is the most likely explanation for
these symptoms.

 > My Question is as follows:Does os/2 change the boot sector of
 > drives under it's control?

Yes, please see my prior comments.

 > In addition, I understand why my first 1
 > meg, boot manager, partition would have a self booting program in it
 > but why should my D drive have one? Os/2 does NOT boot from D drive
 > and dos boots from C drive!

See my prior comments.  All of your boot sectors contain executable
code or do you mean something else by "self booting"?

 > So should there be a self running
 > program on my D drive? I'm very concerned as this sort of activity
 > is standard viral activity.

This sounds normal, you need not be concerned by this.

 > And finally, is there any known virus
 > which targets cmos and clears out sections of it?

A virus or trojan certainly could modify your CMOS but this is much
more likely to happen due to hardware or software glitch or even an
unknowledgeable user executing the setup program on your PC.

 Regards, Wolfgang                                Wolfgang Stiller
                                                  Stiller Research
 Author of Integrity Master(tm)                   2625 Ridgeway St.
                                                  Tallahassee, FL 32310
                                                  U.S.A.