Re: Virus 'protection' departitionment

Ian Whalley (ian@virusbtn.com)
Wed, 7 Aug 1996 17:04:17 +0100 (BST)


> I just ran f-prot virus protection(in dos) and it said it found and
>cleaned the ripper virus on my second drive, the one with a dos, linux swap,
>and ext-2 partition. It decided I really had one huge dos partition and
>wrote that on my MBR. Does anyone know any way to rewrite the MBR with the
>correct information witout losing all the data on my drive?

Curious...

> BTW, I know the data is still there because my kernel is on that
>drive and lilo can still run it, but of course it can't mount root, cause
>the file system info is wrong in the MBR.

Um. Well, it ought to be possible -- provided you haven't done anything
silly like write to the huge DOS partition it's created for you --
to write back in correct values for the location of each partition into
the MBR. After all, whilst the contents of the partition tables is
screwed up, that should be all.

The only way I can figure for you to do this will be to boot DOS and
use Norton [or similar] to look across the surface of the disk for
the start of each partition. The problem is that unless someone here
can provide you with some hex patten which can be located near the beginning
of an ext2fs file system, it's going to be almost impossible. I don't even
know if the swap partition will have such an identifier -- anyone?

However, if you are able to work out correct values, you can use Norton
to drop them back into the MBR (make sure you compute the size field
correctly!), everything should work again. The partition type code
for a linux swap partition is 82h, and that for an ext2fs one is 83h.

Best,

I.

------------------------------------------------------------------------------
|---Ian Whalley, Editor, Virus Bulletin Magazine---|-Author of Project VGrep-|
|-Direct/Office/Fax: +44-1235-544039/555139/531889-|-virus name xref system--|
|-Key CRC: 2A02 96E5 5D77 4C8D EB22 146F E03B A0D3-|-Get it from the web at:-|
|-Unix/NT/W95/Win32/C/x86/Sed/Awk/Perl/Sh/Html/VBA-|http://www.virusbtn.com/ |
------------------------------------------------------------------------------