| Subject | : | Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 25 May, 2005 on 16:59 |
| Using eCS 1.25 and NVC 5.7 (registered). Computer is dual boot eCS/w98SE. During a Hard Disk scan the following message is displayed: Location: Master boot sector on drive D: Clicking on Clean causes a "ringing" noise to occur however after the short burst of ringing the computer freezes. A re-boot and additional Hard Disk scans AND clicking on the Clean button does NOT clean or clear the virus. Any help is appreciated! |
| Subject | : | Re:Beijing.A virus |
| Author | : | Fahrvenugen |
| Date | : | 25 May, 2005 on 17:21 |
| How about booting from your eCS CD and use LVM to replace / re-write the master boot record? |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 25 May, 2005 on 17:41 |
Believe you hit the solution. Should work. I shall give it a try. Thank You! |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 25 May, 2005 on 21:02 |
| I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help. I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE. Thanks |
| Subject | : | Re:Beijing.A virus |
| Author | : | Henk |
| Date | : | 27 May, 2005 on 01:33 |
You could ask your problem right at "support@norman.no" or Edit: I see that you found the forum allready... With kind regards, Henk/2 |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 27 May, 2005 on 02:04 |
Yes, I'm "in line" on that list also. Thanks for the heads up! |
| Subject | : | Re:Beijing.A virus |
| Author | : | jorejarena icejoe@yahoo.com |
| Date | : | 27 May, 2005 on 03:05 |
| You should make two additional checks: 1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active). 2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again. Hope this will help. |
| Subject | : | Re:Beijing.A virus |
| Author | : | jorejarena icejoe@yahoo.com |
| Date | : | 27 May, 2005 on 03:07 |
| In the second check, don´t forget to write-protect the diskette. And will be better if you create the disk on another PC, free of virus. |
| Subject | : | Re:Beijing.A virus |
| Author | : | eCSRD |
| Date | : | 27 May, 2005 on 15:58 |
| Did you try to use DFSEE ? |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 27 May, 2005 on 17:57 |
| I just downloaded and registered DFSee. I am on the low end of the learning curve on it but plan to investigate what I can do with DFSee for this virus. Thanks for the headsup..appreciated. Norman (NVC) is doing some investigating also. |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 29 May, 2005 on 07:06 |
Virus Gone! It not only helped...it Worked!!! In case anyone experiences this Virus on their system, item 2 (above) worked. I did some research prior to performing this "operation" and found that: /MBR - recreates the boot sector of the first (bootable) hard drive in the system. This overwrites the original MBR with a new copy. The MBR is written without altering the partition table information. Many Thanks |
| Subject | : | Re:Beijing.A virus |
| Author | : | boldos boldos@os2.cz |
| Date | : | 30 May, 2005 on 15:31 |
| Hi, I'd like to ask, where could one "obtain" such a virus (if not using win**). Thanks |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 30 May, 2005 on 16:59 |
And, where else to find real help to solve a win problem except in the OS/2 community. |
| Subject | : | Re:Beijing.A virus |
| Author | : | boldos boldos@os2.cz |
| Date | : | 30 May, 2005 on 21:47 |
I know it looks a bit silly, but this is an OS/2 problem a bit. Why? Because I'm not a regular win user, I'm a ergular OS/2 user. I need to infect a computer with Win95, but because I'm an OS/2 user I don't have any experience with viruses. Thats why I'm just trying whereever I can . Does anyone here have any experience with infection a Wi PC? |
| Subject | : | Re:Beijing.A virus |
| Author | : | warpcafe warpcafe@yahoo.de |
| Date | : | 30 May, 2005 on 22:52 |
Yeah, I have... by serving various customers who have windoze machines. Basically, the newer the windoze is, the easier you'll get it infected. Example: On an XP machine make sure you don't have SP2 installed, hit any T-Online website in Internet Explorer (www.t-online.de) and wait for about 20 seconds. This will get you the Sasser virus in most cases (port 445 open, w/ windows messaging service active). Greetings |
| Subject | : | Re:Beijing.A virus |
| Author | : | boldos boldos@os2.cz |
| Date | : | 31 May, 2005 on 14:44 |
Well, I wold be really thankful for any viruses (or virii I know that infection of WinXP is really easy: just connect to internet and wait Stefan |
| Subject | : | Re:Beijing.A virus |
| Author | : | warpcafe warpcafe@yahoo.de |
| Date | : | 31 May, 2005 on 17:34 |
Hi, that won't work, because the SASSER virus exploits a leak of the LSASS service of XP - and that service simply doesn't exist in windows versions prior to xp/2k. I'll check what my customers have accumulated and quarantined in the meanwhile - maybe there's something I can send you although the AV programs usually tend to destroy the files right off... Greetings |
| Subject | : | Re:Beijing.A virus |
| Author | : | jabesse |
| Date | : | 06 Jun, 2005 on 08:26 |
| Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98... |
| Subject | : | Re:Beijing.A virus |
| Author | : | Bobber rbrown@wyobeam.com |
| Date | : | 06 Jun, 2005 on 09:09 |
I am the individual who acquired the virus. I "assume" the virus came from the dual boot with w98 or possibly from an infected floppy. Might want to visit this site for some info on it: http://www.f-secure.com/v-descs/buptboot.shtml |