OS2 World.Com Forum

Subject  :  Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  25 May, 2005 on 16:59
Using eCS 1.25 and NVC 5.7 (registered). Computer is dual boot eCS/w98SE. During a Hard Disk scan the following message is displayed:

Location: Master boot sector on drive D:
Diagnostic: Virus: Beijing.A

Clicking on Clean causes a "ringing" noise to occur however after the short burst of ringing the computer freezes. A re-boot and additional Hard Disk scans AND clicking on the Clean button does NOT clean or clear the virus.

Any help is appreciated!


Subject  :  Re:Beijing.A virus
Author  :  Fahrvenugen
Date  :  25 May, 2005 on 17:21
How about booting from your eCS CD and use LVM to replace / re-write the master boot record?

Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  25 May, 2005 on 17:41

Fahrvenugen (25 May, 2005 17:21):
How about booting from your eCS CD and use LVM to replace / re-write the master boot record?

Believe you hit the solution. Should work. I shall give it a try. Thank You!


Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  25 May, 2005 on 21:02
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks


Subject  :  Re:Beijing.A virus
Author  :  Henk
Date  :  27 May, 2005 on 01:33

Bobber (25 May, 2005 21:02):
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks


You could ask your problem right at "support@norman.no" or
since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that...

Edit: I see that you found the forum allready...


With kind regards,

Henk/2


Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  27 May, 2005 on 02:04

Henk (27 May, 2005 01:35):

Bobber (25 May, 2005 21:02):
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks


You could ask your problem right at "support@norman.no" or
since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that...

Edit: I see that you found the forum allready...


Yes, I'm "in line" on that list also. Thanks for the heads up!


Subject  :  Re:Beijing.A virus
Author  :  jorejarena icejoe@yahoo.com
Date  :  27 May, 2005 on 03:05
You should make two additional checks:
1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active).
2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.

Hope this will help.


Subject  :  Re:Beijing.A virus
Author  :  jorejarena icejoe@yahoo.com
Date  :  27 May, 2005 on 03:07
In the second check, don´t forget to write-protect the diskette. And will be better if you create the disk on another PC, free of virus.

Subject  :  Re:Beijing.A virus
Author  :  eCSRD
Date  :  27 May, 2005 on 15:58
Did you try to use DFSEE ?

Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  27 May, 2005 on 17:57
I just downloaded and registered DFSee. I am on the low end of the learning curve on it but plan to investigate what I can do with DFSee for this virus. Thanks for the headsup..appreciated.

Norman (NVC) is doing some investigating also.


Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  29 May, 2005 on 07:06

jorejarena (27 May, 2005 03:05):
You should make two additional checks:
1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active).
2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.

Hope this will help.


Virus Gone! It not only helped...it Worked!!!

In case anyone experiences this Virus on their system, item 2 (above) worked. I did some research prior to performing this "operation" and found that:

/MBR - recreates the boot sector of the first (bootable) hard drive in the system. This overwrites the original MBR with a new copy. The MBR is written without altering the partition table information.

Many Thanks


Subject  :  Re:Beijing.A virus
Author  :  boldos boldos@os2.cz
Date  :  30 May, 2005 on 15:31
Hi,

I'd like to ask, where could one "obtain" such a virus (if not using win**).

Thanks


Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  30 May, 2005 on 16:59

boldos (30 May, 2005 15:31):
Hi,

I'd like to ask, where could one "obtain" such a virus (if not using win**).

Thanks


And, where else to find real help to solve a win problem except in the OS/2 community.


Subject  :  Re:Beijing.A virus
Author  :  boldos boldos@os2.cz
Date  :  30 May, 2005 on 21:47
I know it looks a bit silly, but this is an OS/2 problem a bit. Why? Because I'm not a regular win user, I'm a ergular OS/2 user. I need to infect a computer with Win95, but because I'm an OS/2 user I don't have any experience with viruses. Thats why I'm just trying whereever I can . Does anyone here have any experience with infection a Wi PC?

Subject  :  Re:Beijing.A virus
Author  :  warpcafe warpcafe@yahoo.de
Date  :  30 May, 2005 on 22:52

boldos (30 May, 2005 21:47):Does anyone here have any experience with infection a Wi PC?

Yeah, I have... by serving various customers who have windoze machines. Basically, the newer the windoze is, the easier you'll get it infected.

Example: On an XP machine make sure you don't have SP2 installed, hit any T-Online website in Internet Explorer (www.t-online.de) and wait for about 20 seconds. This will get you the Sasser virus in most cases (port 445 open, w/ windows messaging service active).
)
If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one.

Greetings
Thomas


Subject  :  Re:Beijing.A virus
Author  :  boldos boldos@os2.cz
Date  :  31 May, 2005 on 14:44

warpcafe (30 May, 2005 22:52):
If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one.

Well, I wold be really thankful for any viruses (or virii ), you send.

I know that infection of WinXP is really easy: just connect to internet and wait , but this is the old Windows95. Anyway, I'll try the "t-online option"...

Stefan


Subject  :  Re:Beijing.A virus
Author  :  warpcafe warpcafe@yahoo.de
Date  :  31 May, 2005 on 17:34

boldos (31 May, 2005 14:44):
[snip]- but this is the old Windows95. Anyway, I'll try the "t-online option"...
Stefan

Hi,

that won't work, because the SASSER virus exploits a leak of the LSASS service of XP - and that service simply doesn't exist in windows versions prior to xp/2k.
This is why I still prefer Win98 SE for security reasons compared to XP/2K... if no eCS or OS/2 is around of course.

I'll check what my customers have accumulated and quarantined in the meanwhile - maybe there's something I can send you although the AV programs usually tend to destroy the files right off...

Greetings
Thomas


Subject  :  Re:Beijing.A virus
Author  :  jabesse
Date  :  06 Jun, 2005 on 08:26
Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98...

Subject  :  Re:Beijing.A virus
Author  :  Bobber rbrown@wyobeam.com
Date  :  06 Jun, 2005 on 09:09

jabesse (06 Jun, 2005 08:29):
Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98...

I am the individual who acquired the virus. I "assume" the virus came from the dual boot with w98 or possibly from an infected floppy. Might want to visit this site for some info on it: http://www.f-secure.com/v-descs/buptboot.shtml


Powered by UltraBoard 2000 <www.ub2k.com>