From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: HELP with partition infector!! (PC)
Date: 3 Sep 92 02:48:19 GMT

Tim Simmonds reports:
> I have scanned a PC for virus's using SCANv8.7B95 and it reported
> that the Partition table was infected with the Cansu[Can] virus.
>         And the CLEAN-UP program reported that the virus could not be
>         removed safely....Is there anything else that can be donee
>         and how can you get a copy of the Partition Boot Record.
>
>         The PC is a IBMPC 386 running DOS 5.

The solution you require is:
1.  Assuming you have a write protected boot diskette, use this to start your
    system.  If you don't then with this virus you should be safe in booting
    from the hard drive.
2.  Run FDISK /MBR which will replace the partition boot record, (alias
    partition sector or MBR - Master Boot Record), with the standard program
    & retain the correct partition info.

Getting a copy of the partition sector is usually done with a disk
editor, such as that in the Norton Utilities or Central Point PC
Tools.  For Norton 4.5 Advanced Edition you should start the program
in 'maintenance mode' with "NU /M".  Look at Absolute sector 0 on your
hard drive, and you can save this (in FILE mode).

pragma sermon (on)

** Everyone should have a boot diskette **

Not so long ago everybody had a [PC/MS/DR]-DOS diskette with their
system, which could be used to boot it.  However many cheap PCs now
seem to ship with only a partial version on the hard drive, and the
standard MS-DOS 5 upgrade will not boot.  Also systems change over the
years an your boot diskette may not be appropriate anymore.

So you should think about preparing a suitable boot diskette, "just in
case".  Use "FORMAT A: /S", or if the disk is already formatted "SYS
A:", to make a basic boot disk.

If you use a command shell, such as 4DOS, you will need to ensure that
the relevant files are copied to the diskette, and a minimum
"CONFIG.SYS" is prepared to start it correctly.

Copy some basic utilities onto the diskette, such as "DEBUG" (SID in
DR-DOS), "CHKDSK", "FDISK", ...  This is your 'bare bones' boot disk,
test it by booting from it, write-protect it, make an extra copy (with
DISKCOPY) and keep them safe.

If use special software, such as DISK MANAGER or STACKER, to access
your hard drive(s) then you need a second version of the diskette.
This needs to include the software & appropriate "CONFIG.SYS" and/or
"AUTOEXEC.BAT" to start these programs.  Again test the disk,
write-protect, copy & store safely.

DO NOT put WINDOWS, DESQVIEW, QEMM, 386MAX, ...  onto these diskettes
as they are likely to obstruct investigation of your system for faults
or viruses.

Your favourite anti-virus s/w, system checking software (such as
Quarterdeck MANIFEST), should be kept on seperate write protected
diskettes, (so that you don't have to remove the protect on your boot
disks).  Use these after booting from your diskettes, as the copies on
the hard drive may be corrupt or infected.

pragma sermon (off)

Take care & compute safely,

Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk