From: sbonds@jarthur.Claremont.EDU (007)
Newsgroups: comp.virus
Subject: Methods of Virus Defense [Part 2-- Clean Boot Disks]
Date: 18 Jul 92 00:08:17 GMT

Why have a bootable floppy handy?  There are lots of reasons-- not all
of them virus related!

What do you do if something goes wrong with your hard disk?  This
could range from a disastrous hardware failure to an incorrect command
in the CONFIG.SYS file.  If the hard disk won't boot, you'll still
need to access it, either to recover whatever you can or to fix your
typos.

Ideally, Microsoft or IBM would ship clean, write-protected bootable
floppies with every system.  These would be produced from a computer
that had never seen any software, except software taken directly from
its programmers.  Unfortunately, we do not live in an ideal world, so
we have to make do with next-best.

Given these limitations, there are two real choices:
  + You boot from your original DOS disk, and hope that it wasn't infected
    at the factory.  Then make your "clean" floppy.
  + You hope that your computer isn't infected and go ahead and make a
    bootable floppy.  You can check your boot sector with DEBUG to see if
    a non-stealth boot infector is present.

As you can see, neither method completely assures that no viruses are
present.  The first method is about as close as you can get, tho.

If you KNOW that you are infected, and want to make a floppy that at
least has a chance of being clean, you might try a program like
Teledisk, which saves an image of a disk to a file, and vice versa.
You could ask someone with Teledisk to copy their clean floppy to a
file and send it to you.  I have not tested this under "battle"
conditions, but it is possible that a boot sector virus could copy
itself to the disk immediately after the file-->disk conversion.  DO
NOT change to the disk (i.e. type "A:") until you have write-
protected it!  This would almost certainly spread the infection to the
disk.

Another possibility is "patching" the boot sector with a clean boot
sector, using only BIOS calls.  Norton's DISKEDIT can do this.  (I
think).  Note that BIOS calls can possibly be intercepted, too.  A
good stealth virus may have you writing to somewhere else on the disk.
The same caution about changing to the disk applies.

These are both acts of desperation, and may not be effective.  A
better bet would be to create a boot floppy on a different computer,
preferably one that has a small chance of being infected.  (Any
computer without active virus protection is suspect.)

How to create a clean bootable floppy:
  + Cold boot from your DOS disk, if you have one.
  + Run your virus scanner with a memory check.  This should catch any
    known boot sector viruses.
  + If it finds nothing, format your floppy and SYS it.  Don't forget to
    copy COMMAND.COM.  (Preferably from your original DOS installation
    disks.)
  + Copy PKunzip (original compressed archive PKZ110.EXE) onto your floppy.
  + Copy F-prot (original .ZIP file) onto your floppy.
  + Cold boot from your new floppy.  (Don't write protect it yet.)
  + Uncompress PKunzip and F-prot.  Delete the compressed files.
  + Write protect your new floppy.

The reason you copy everything from the original archives is to
minimize the possibility of file infectors attaching to your antivirus
software.  If you're really concerned, use VALIDATE from McAffee or
another CRC checking program to be more certain.

Validate codes: (VALIDATE 0.3)
  + DOS 5.00 COMMAND.COM
    47,845 bytes 
    Method 1: 77B1 Method 2: 1196
  + PKZ110.EXE
    85,724 bytes
    Method 1: 962D Method 2: 0D8F
  + FP-204A.ZIP
    269,411 bytes
    Method 1: 0AF5 Method 2: 175A

Be careful when creating AUTOEXEC files that you do not execute ANY
programs from your hard disk.  This kinda defeats the purpose of the
clean floppy, since these programs could be infected.  Accessing data
files on the hard disk should be OK.  (For example, stacked drives.
Be sure to copy STACKER.COM onto the floppy, DO NOT use the copy on
the hard disk.)

I also find it useful to keep a clean boot floppy with nothing but
COMMAND.COM on it.  This is used not so much for anti-virus activities
as it is for checking for software incompatibilites.  Whenever
something bizarre happens, like a new program refuses to load, I start
from this disk to eliminate the possibility of TSRs interfering with
one another.  If the program starts after rebooting, it is probably a
software conflict.

Other programs that may be useful on your floppy:
  + A text editor for viewing F-prot's documentation.
  + Device drivers that you NEED to have.  (STACKER.COM if you want to scan
    your stacked drives, required video/hard disk drivers, etc.)
  + DEBUG and/or Norton's DISKEDIT.

Things you should NOT have on your floppy:
   + A PATH statement that includes ANY hard drive letters.  (DO NOT put
     PATH=C:\DOS in your AUTOEXEC!)
   + Batch files in your path that access the hard drive.  This includes
     DOSKEY aliases, etc.  I would advise anyone just to skip the path
     statement altogether on your floppy.

Wishing your computer the best of health,

  -- 007
- -- 
 000   000  7777 | sbonds@jarthur.claremont.edu
0   0 0   0   7  |----------------------------------------------------------- 
0   0 0   0  7   |        Childhood is short...
 000   000   7   |                    ...but immaturity is forever.