Re: Hit by virus !? Help, please...
On Tue, 27 Apr 1999, Oleg Krivosheev wrote:
> after my kid was playing games on win95 yesterday
> evening i was unable to boot into Linux - actually unable
> to boot into win95 also... Looks like some kind of
> virus destroyed boot sector with partition table.
You almost certainly got hit by the CIH ("Chernyobl") virus. Depending on
the version, it triggers on June 26th, April 26th, or every 26th. It kills
the first 14 (?) sectors of the drive (blasting the partition table) and
then tries to trash the CMOS and/or Flashable BIOS. It sounds like you're
lucky - it only got the disk, otherwise your computer wouldn't boot at
all. :-/
More information at:
http://www.symantec.com/avcenter/kill_cih.html
http://www.datafellows.com/v-descs/cih.html
or do a web search.
> i can remember approximate partition sizes and order.
> Is there any way to recover partition table and the system
> as well ?
Well, *maybe*. If it's only approximate, you could be in trouble. I'd
advise looking for a disk editor and start perusing disk blocks. Look for
filesystem boundaries around where you think they are. I *think* they have
signatures - FAT has aa55, and I forget what ext2's is. I'd see if you can
find something on the web about that.
Once you think you've got it, mount read-only at first to help prevent
further corruption.
In the future, I'd advise three things. :->
1. Spank your kid, or whoever got the computer infected.
2. If you're going to run Windows, get at least decent freeware
antivirus software.
3. Go buy some kind of backup system and use it.
I know, I know, easier said than done. :-/
Sincerely,
Ray Ingles (248) 377-7735 ray.ingles@fanucrobotics.com
"Improvements succeeded each other so rapidly, that machines which had
never been finished were abandoned in the hands of their makers,
because new improvements had superceded their utility."
Charles Babbage 'On the Economy of Manufactures' 1832
Reply to: