|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
 |
1. Beijing.A virus |
|
|
| Using eCS 1.25 and NVC 5.7 (registered). Computer is dual boot eCS/w98SE. During a Hard Disk scan the following message is displayed: Location: Master boot sector on drive D: Diagnostic: Virus: Beijing.A Clicking on Clean causes a "ringing" noise to occur however after the short burst of ringing the computer freezes. A re-boot and additional Hard Disk scans AND clicking on the Clean button does NOT clean or clear the virus. Any help is appreciated! |
| Date: 25 May, 2005 on 16:59 |
|
|
Premium member in user
     posts: 277 since: 10 Aug, 2004 |
|
| How about booting from your eCS CD and use LVM to replace / re-write the master boot record? |
| Date: 25 May, 2005 on 17:21 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
 |
3. Re:Beijing.A virus |
|
|
Fahrvenugen (25 May, 2005 17:21): How about booting from your eCS CD and use LVM to replace / re-write the master boot record?
Believe you hit the solution. Should work. I shall give it a try. Thank You! |
| Date: 25 May, 2005 on 17:41 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
|
| I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help. I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE. Thanks |
| Date: 25 May, 2005 on 21:02 |
|
|
Normal member in user
     posts: 43 since: 25 Feb, 2003 |
|
last updated at 27 May, 2005 01:35 (1 times)
Bobber (25 May, 2005 21:02): I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE. Thanks
You could ask your problem right at "support@norman.no" or since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that... Edit: I see that you found the forum allready...
With kind regards,Henk/2
|
| Date: 27 May, 2005 on 01:33 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
|
Henk (27 May, 2005 01:35):
Bobber (25 May, 2005 21:02): I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE. Thanks
You could ask your problem right at "support@norman.no" or since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that... Edit: I see that you found the forum allready... 
Yes, I'm "in line" on that list also. Thanks for the heads up! |
| Date: 27 May, 2005 on 02:04 |
|
|
Normal member in user
     posts: 15 since: 18 Oct, 2003 |
|
You should make two additional checks: 1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active). 2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.Hope this will help. |
| Date: 27 May, 2005 on 03:05 |
|
|
Normal member in user
     posts: 15 since: 18 Oct, 2003 |
|
| In the second check, don´t forget to write-protect the diskette. And will be better if you create the disk on another PC, free of virus. |
| Date: 27 May, 2005 on 03:07 |
|
|
Normal member in user
     posts: 14 since: 29 Mar, 2005 |
|
| Did you try to use DFSEE ? |
| Date: 27 May, 2005 on 15:58 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
|
| I just downloaded and registered DFSee. I am on the low end of the learning curve on it but plan to investigate what I can do with DFSee for this virus. Thanks for the headsup..appreciated. Norman (NVC) is doing some investigating also. |
| Date: 27 May, 2005 on 17:57 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
 |
11. Re:Beijing.A virus |
|
|
jorejarena (27 May, 2005 03:05): You should make two additional checks: 1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active). 2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.Hope this will help.
Virus Gone! It not only helped...it Worked!!! In case anyone experiences this Virus on their system, item 2 (above) worked. I did some research prior to performing this "operation" and found that: /MBR - recreates the boot sector of the first (bootable) hard drive in the system. This overwrites the original MBR with a new copy. The MBR is written without altering the partition table information. Many Thanks |
| Date: 29 May, 2005 on 07:06 |
|
|
Normal member in user
       posts: 21 since: 03 Jul, 2003 |
 |
12. Re:Beijing.A virus |
|
|
| Hi, I'd like to ask, where could one "obtain" such a virus (if not using win**). Thanks |
| Date: 30 May, 2005 on 15:31 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
|
boldos (30 May, 2005 15:31): Hi, I'd like to ask, where could one "obtain" such a virus (if not using win**). Thanks
And, where else to find real help to solve a win problem except in the OS/2 community. |
| Date: 30 May, 2005 on 16:59 |
|
|
Normal member in user
       posts: 21 since: 03 Jul, 2003 |
|
I know it looks a bit silly, but this is an OS/2 problem a bit. Why? Because I'm not a regular win user, I'm a ergular OS/2 user. I need to infect a computer with Win95, but because I'm an OS/2 user I don't have any experience with viruses. Thats why I'm just trying whereever I can . Does anyone here have any experience with infection a Wi PC? |
| Date: 30 May, 2005 on 21:47 |
|
|
Premium member in user
     posts: 350 since: 26 Nov, 2002
 |
|
boldos (30 May, 2005 21:47):Does anyone here have any experience with infection a Wi PC?
Yeah, I have... by serving various customers who have windoze machines. Basically, the newer the windoze is, the easier you'll get it infected. Example: On an XP machine make sure you don't have SP2 installed, hit any T-Online website in Internet Explorer (www.t-online.de) and wait for about 20 seconds. This will get you the Sasser virus in most cases (port 445 open, w/ windows messaging service active).
) If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one. Greetings Thomas |
| Date: 30 May, 2005 on 22:52 |
|
|
Normal member in user
       posts: 21 since: 03 Jul, 2003 |
|
warpcafe (30 May, 2005 22:52): If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one.
Well, I wold be really thankful for any viruses (or virii ), you send. I know that infection of WinXP is really easy: just connect to internet and wait , but this is the old Windows95. Anyway, I'll try the "t-online option"... Stefan |
| Date: 31 May, 2005 on 14:44 |
|
|
Premium member in user
     posts: 350 since: 26 Nov, 2002
 |
|
boldos (31 May, 2005 14:44): [snip]- but this is the old Windows95. Anyway, I'll try the "t-online option"... Stefan
Hi, that won't work, because the SASSER virus exploits a leak of the LSASS service of XP - and that service simply doesn't exist in windows versions prior to xp/2k. This is why I still prefer Win98 SE for security reasons compared to XP/2K... if no eCS or OS/2 is around of course.  I'll check what my customers have accumulated and quarantined in the meanwhile - maybe there's something I can send you although the AV programs usually tend to destroy the files right off... Greetings Thomas |
| Date: 31 May, 2005 on 17:34 |
|
|
Normal member in user
       posts: 18 since: 05 Jun, 2003 |
|
last updated at 06 Jun, 2005 08:29 (1 times) Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98... |
| Date: 06 Jun, 2005 on 08:26 |
|
|
Normal member in user
     posts: 46 since: 28 Sep, 2004 |
|
jabesse (06 Jun, 2005 08:29): Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98...
I am the individual who acquired the virus. I "assume" the virus came from the dual boot with w98 or possibly from an infected floppy. Might want to visit this site for some info on it: http://www.f-secure.com/v-descs/buptboot.shtml |
| Date: 06 Jun, 2005 on 09:09 |
|
|
|
|
| All times are CET+1. |
< Prev. | P. 1 | Next > |
|