Prev: how can I remove Trojan.Generic.IS.559211
Next: swp2009 demo hit my computer tonight
From: Andy Medina on 6 Nov 2009 12:12
Even deleting the partition(s) of the disk isn't enough if a MBR infector is
involved.

"OldandInTheWay" <OldandInTheWay.417p3b(a)DoNotSpam.com> wrote in message
news:OldandInTheWay.417p3b(a)DoNotSpam.com...
>
> @ The Central Scrutinizer: You are exactly right!
>
> In fact, even a "full-format" of the disk isn't enough.
>
> It's in the "System Volume Information" folder, too.
>
> You must "DELETE THE EXISTING PARTITION(S)"
> and then create a new partition(s) on the disk drive.
>
> Lastly do a "FULL FORMAT" to prepare the disk drive
> for use in the system, or to reinstall Windows XP Pro.

From: "FromTheRafters" erratic on 6 Nov 2009 13:24
Even replacing the entire disk storage hardware with new hardware with
known clean software is not enough if your firmware is malicious.

....next...

"Andy Medina" <gmedina(a)email.arizona.edu> wrote in message
news:u0BKhRwXKHA.844(a)TK2MSFTNGP05.phx.gbl...
> Even deleting the partition(s) of the disk isn't enough if a MBR
> infector is involved.
>
> "OldandInTheWay" <OldandInTheWay.417p3b(a)DoNotSpam.com> wrote in
> message news:OldandInTheWay.417p3b(a)DoNotSpam.com...
>>
>> @ The Central Scrutinizer: You are exactly right!
>>
>> In fact, even a "full-format" of the disk isn't enough.
>>
>> It's in the "System Volume Information" folder, too.
>>
>> You must "DELETE THE EXISTING PARTITION(S)"
>> and then create a new partition(s) on the disk drive.
>>
>> Lastly do a "FULL FORMAT" to prepare the disk drive
>> for use in the system, or to reinstall Windows XP Pro.
>


From: Andy Medina on 6 Nov 2009 16:47
True but highly unlikely... next

"FromTheRafters" <erratic @nomail.afraid.org> wrote in message
news:OQeff5wXKHA.3720(a)TK2MSFTNGP02.phx.gbl...
> Even replacing the entire disk storage hardware with new hardware with
> known clean software is not enough if your firmware is malicious.
>
> ...next...
>
> "Andy Medina" <gmedina(a)email.arizona.edu> wrote in message
> news:u0BKhRwXKHA.844(a)TK2MSFTNGP05.phx.gbl...
>> Even deleting the partition(s) of the disk isn't enough if a MBR infector
>> is involved.
>>
>> "OldandInTheWay" <OldandInTheWay.417p3b(a)DoNotSpam.com> wrote in message
>> news:OldandInTheWay.417p3b(a)DoNotSpam.com...
>>>
>>> @ The Central Scrutinizer: You are exactly right!
>>>
>>> In fact, even a "full-format" of the disk isn't enough.
>>>
>>> It's in the "System Volume Information" folder, too.
>>>
>>> You must "DELETE THE EXISTING PARTITION(S)"
>>> and then create a new partition(s) on the disk drive.
>>>
>>> Lastly do a "FULL FORMAT" to prepare the disk drive
>>> for use in the system, or to reinstall Windows XP Pro.
>>
>
>

From: OldandInTheWay on 7 Nov 2009 12:03

Thanks, but at my age nothing much gets me upset when it comes to
computers. I started programming an IBM 11/30 using FORTRAN in 1972. At
heart at I'm "child of DEC" (PDP-11, VAX, Alpha) with an M.S. in Applied
Mathematics. My real career was in electronic instrument design, where I
wrote lots of real-time assembler code for micro-controllers in addition
to designing the hardware itself. I taught C++ programming at the
University of Maryland for a few years as well in the past decade.
I'm just a "back in the day" type windbag now. ;-)

Thanks for the reminder about the MBR. I've had to save disks with
corrupted MBR's before and that's a "yawn job" for me to do. I guess I
was lucky and in this case the MBR was still pristine. I'd think that
repartitioning would have to caused the MBR to be rewritten for the
bootstrap loader to be able to find the new partition, but I may be
wrong.

At this point I have "rebulit" my secondary system disk (I spin 4
drives: two bootable systems and two for data storage in a RAID 1 array.
The primary system drive and the data can be physically disconnected to
prevent any contagion although I'm beginning to think I may have screwed
up enough stuff that even the malware can't run anymore! (The system is
booting and I'm stripping it down to see what happens)

If you guys care to gab, I'd love to know more about the side-effects
of locating pagefiles on another drive, and how do I fix "Add/Remove
Programs" which doesn't allow in the way of functionality anymore for
removing old software.

If I could extract my Microsoft Office 2000 CD-key I'd really be
thrilled. That seems to have been made wholly unavailable by the last
Security Update and every key finder I've tried can't cough up what I
need.

John


--
OldandInTheWay
------------------------------------------------------------------------
OldandInTheWay's Profile: http://forums.techarena.in/members/152152.htm
View this thread: http://forums.techarena.in/security-virus/1259354.htm

http://forums.techarena.in

From: Geoff on 7 Nov 2009 12:32
On Sat, 7 Nov 2009 22:33:46 +0530, OldandInTheWay
<OldandInTheWay.41ajvb(a)DoNotSpam.com> wrote:

>If I could extract my Microsoft Office 2000 CD-key I'd really be
>thrilled. That seems to have been made wholly unavailable by the last
>Security Update and every key finder I've tried can't cough up what I
>need.

One old fart to another, the Office key is called Product ID in the
About... box of any one of the Office applications.
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4 5
Prev: how can I remove Trojan.Generic.IS.559211
Next: swp2009 demo hit my computer tonight