Snip
i fail to see how you came to the conclusion that the virus caused the
corruption...your description doesn't even establish the presence of a
virus in your partition boot sector...
When a virus is "stealth" it hides. That's why. When i'm chatting normally
everything works. No errors should popup, and no files can be corrupted when
there is nothing that corrupts them, i suppose.
so far as i can see you had a corruption in the java runtime so you
installed it again but didn't uninstall the previous instance so you
encountered a conflict between them when you tried to disable one and
enable the other but after rebooting from a clean floppy it was fine -
no indication if it would have been fine after a normal reboot or if
the problem would have been there if you'd uninstalled the previous
instance of the java runtime first (like you're supposed to)...
Ofcourse i did. I deactivated the old runtime and activated the new one. I
uninstalled the old one, AFTER i detected the strange errors. What allso can
be possible is that someone (a hacker) messed my computer. Then the cause
wasn't a virus, but the result was.
Snip.
so you say - but so far i'm not inclined to trust your diagnostics...
I'm a trustfull person. I live in The Netherlands. My name is Wim Hamhuis. I
hate lies.
and sometimes it's just bit-rot...
That's true, but do you *really* think a brand new harddisk could suddenly
produce SO MUCH bad sectors ? After all when i removed the virus, the bad
sectors were gone when i removed them with disk doctor and i do not have
problems now. I saved several large files, verified them and do not have any
problems anymore, deleted them, emptied the waste-basket and did it again to
make sure the same space on the harddisk is used, and there are no present
problems (anymore).
which is an mbr infector...
When using the SYS command, the system is transferred. That's IO.SYS,
MSDOS.SYS and COMMAND.COM (on some old version) MBR replaces the partition
table, but SYS doesn't. OK you helped, the scanner did detect it again. With
fdisk/MBR it's gone definitely. Damn those virusses. Luckily fdisk /mbr
doesn't delete all your data.
please re-read - it's possible to have a boot sector in a dropper, but
not nearly as likely to have a dropper in a boot sector... especially
not on your hard disk (you would have had to put it there yourself)...
it's not what i ment. i ment a bootsector virus inside a dropper.
Programming a dropper inside a bootsector nah... don't even know the way to
do this ;-)) hahahaha
sure, but how did it get in your *boot sector*? it's not like you can
choose "save as" and select the boot sector as a location when your
downloading junk from the internet...
true, but i know some people could have the knowledge to pull a stunt like
this in machine language.
snip.
please re-read - if you boot from a floppy then you are booting from
the floppy, not from the hard disk... i didn't say attempting to boot
from the floppy... part of booting from the floppy involves verifying
that the floppy drive is the first drive in the boot sequence in your
bios...
Well it looks like it boots from floppy when the BIOS isn't setup right.
That's what i ment. Then ofcourse there is the auto boot feature...you know
when you put a cd inside a cdrom it starts up automatically if the settings
are right.... I perfectly understand you so we have a good and serious
conversation here. Don't let others harras you, and don't get angry.
fdisk /mbr replaces the master boot record...
so then you have 3 different viruses? you said lovesan at first, but it
wasn't that one -
Lovsan was detected, but automatically removed.
then you said brain except the cleaning method you
described wouldn't have cleaned the brain virus
It didn't , but with your info i cleaned the whole computer, thanks.
, and now you think
there was some 3rd virus that apparently your scanner didn't detect
True, because it hides with interupthelp. Nothing, even the modern
antivirusprograms can detect where the bootsector should be, but when this
is misled, the real bootsector could be somewhere else.
(hey, nobody is writing boot sector viruses anymore - if you had a
partition boot sector infector it would have to be pretty old and if
your scanner didn't detect it then your scanner is junk)...
Well, example if you ask me a pen but the pen is in the drawer, i had to
open the drawer first to get the pen. I couldn't give you the pen directly
if the drawer is closed. But i'm no viruswriter. Maybe this is how they
could catch misleading interupts ?
[snip]
Well , the big antivirusvendors sell loggy antivirusprograms who are in fact
very slow if they do not meet the system requirements. When you can program
your own systemrequirements you can cause the installer to install a program
which is special written for your processor. This should run a lot faster
and work a lot more accurate.
you still aren't getting it -
this was only a suggestion to make antivirusprograms automatically fit for
the computers the program is used for. It's no use running a
antivirusprogram on a pentium1 which was written for a pentium 4. The
program would probably choke on a pentium 1, because a pentium 4 knows more
instructions a pentium 1 can't cope with.
the only way to make the programs run
faster is to make them do less work... and when we're talking about
scanning engines that necessarily means that it will catch fewer
viruses...
No. The only difference would be the instructions are right in the program
offered to the computer. That speeds it up. The processor then do not have
to cope with instructions it can do nothing with instructions which are not
present in the processor. Worst case - you get errormessages then.
[snip]
AVG shows (see end of this mail). But they forget to mention an expiration
date, and the fact they are working all the time (when neccasary)
no, it's false advertising...
Then they have to mention an expiration date in their certificate. That
would be no lie-ing anymore for them. Now everybody -updated or not- shows
the same adding in a sig. That can't possibly be true; your right !
w.f.g.
Wim Hamhuis
to replace it. This solved