Tell us, how does one even GET a boot sector virus on a
single-boot Windows
2000 or Windows XP using NTFS on a single boot system?
By starting up with an infected floppy in drive A. BSV hard
drive infection exploits the BIOS and has nothing to do with
the operating system or file system in use.
Bob
--
Robert Green
BootMaster Partition Recovery
http://bootmaster.filerecovery.biz
bob[dot]green[at]filerecovery[dot]biz
--
Phil Weldon, pweldonatmindjumpdotcom
For communication,
replace "at" with the 'at sign'
replace "mindjump" with "mindspring."
replace "dot" with "."
message
Zvi Netiv wrote:
Boot viruses is where AV software always did a
lousy job. Lots of
false alarms,
misidentification of the virus, and the worst -
high percentage of
unsuccessful
"disinfection" that ended in loss of access to
partition(s), or loss
of self
boot ability.
and yet the google archives of alt.comp.virus (and
to a lesser extent
alt.comp.anti-virus) are chock full of examples of
people
*successfully* removing boot infectors with
anti-virus products...
Wrong keywords for the search. ;-)
i wasn't doing a keyword search, i was working off my
memory from the 9
years i've spent in alt.comp.virus and 3 years in
alt.comp.anti-virus...
The victims of unsuccessful BSI disinfection aren't
limited to acv /
aca-v.
Obviously, your selective memory isn't the best source
for reference.
There are more hits for failed disinfection
by AV than successful ones,
on going back and actually trying to get the
statistics using google i
find something quite different, 'boot infector failed'
gives about an
order of magnitude fewer hits than 'boot infector
cleaned' for the
group alt.comp.virus...
maybe you've got some better keywords but quite
frankly using raw hits
as a measure is misleading as initial failures have
often been a case
user error (which, on consultation with the group,
gets corrected) or
an issue with an individual av product failing (a
phenomenon that is
not constrained to boot sector disinfection and that
subsequent use of
a different av fixes)...
especially if you limit the search to the last few
years.
are you suggesting that boot infector detection and
removal has gotten
worse during a period when practically no new boot
infectors have been
created?
Your simplistic and purely formalistic knowledge on the
issue really
amazes me.
The change in the last years had to do with the large
number of users that
shifted from early Windows, that was still based on DOS,
to NT based OS
(W2K and
XP). This shift had a pronounced effect on BSI and AV
related issues.
First, AV do false alarms much more on boot viruses
under the newer OS, to
the
point that it's safe to say that the majority of BSI
alerts under W2K and
XP are
false alarms. Next, attempting the disinfection of BSI
on such drives by
aid of
AV, ends more often in ruining self-boot ability or loss
of access to the
drive's partition(s).
Nobody would dare having a hernia operation if it
had similar
mortality
rates to AV disinfection of BSI!
i don't dispute that there have been cases where a
particular av
product has failed to do it's job properly with
respect to boot sector
viruses just as particular av's have failed on other
types of viruses -
that doesn't mean that av products in general are bad
at dealing with
boot infectors,
Wrong. AV products are unmistakably worse in cleaning
BSI than in dealing
with
other types of malware. There is no difference either
in failure/success
ratio
in that particular area between the various AV brands.
[snip]
If you suggested FDISK /STATUS before running FDISK
/MBR, instead of
sending the
poster on a wild goose chase, then the "rule" would
now be common
knowledge.
except it's not that simple... your 'rules' assume the
user knew what
partitions they were supposed to have and how big they
were supposed to
be (which has usually not been the case as most users
don't even know
what a partition is)...
You obviously haven't tried FDISK /STATUS, surely not on
a drive on which
you
shouldn't (or can't) run FDISK /MBR. Because if you
did, then you would
learn
that FDISK /STATUS returns no partitions at all (for
anything that isn't
FAT or
FAT-32), or senseless data. The return of FDISK /STATUS
leaves no doubt
whatsoever, no guess work is needed to interpret the
results, nor a
university
degree.
What should really amaze is why that simple and safe
solution (FDISK /MBR,
preceded by FDISK /STATUS for verification) didn't
surface earlier in the
virus/AV discussions. Could it be connected with the
preserving of some
ones'
profit?
of course some people can make good use of your rules,
but i tend to
think those would be in the minority...
... and a defeatist too, on top of the rest.
Regards, Zvi
--
NetZ Computing Ltd. ISRAEL
www.invircible.com
www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data
Recovery Utilities
