There could be some variations of the virus or it behaves differently
depending on a time of the day or random number generator or something
like that.
Yesterday I had an occasion of looking at some disks stricken by
the virus. We mounted these on Linux/Alpha machine so we were pretty
safe. :-) Partition tables actually still existed and even some top
directories looked mostly reasonable at the first glance (there were
multiple partitions on two disks). But FAT information was scrambled.
A text file would look sane for a moment but pretty soon would turn
into a binary chunk which obviously does not belong there. None of zip
archives I checked were usable. As the affected party had backups and
needed disks back right away we did not try to see if any attempts to
untangle the mess had any traces of a chance. Disks got reformatted.
This damage was definitely not confined only to "C:".
Owners were also complaining that on disks they try to reformat
and repartition themselves 'fdisk' from Windows got spooked and
refused to do anything. Only after writing a block of nulls over
an initial disk portion they were acceptable. Linux on a floppy
and dd to the rescue. :-)
Michal
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/