VIRUS-L Digest             Thursday, 22 Dec 1988        Volume 1 : Issue 58

Today's Topics:
Brain surviving warm boot (PC)
RE: FORMAT command (PC)

---------------------------------------------------------------------------

Date:         Thu, 22 Dec 88 8:50 EST
From:         Don Kazem <[email protected]>
Subject:      Brain surviving warm boot (PC)

I first brought up this issue about the Brain Virus being able to
sustain itself even after a warm boot and it being able to write to a
write protected disk. These were my findings and I posted them to the
list. As far as I am concerned they were accurate.

To do away with all the flames, I have requsitioned another dual
floppy machine (the same as the one used in my first test). I will
repeat the tests that yielded such controversial results and will
post the results back to the list.  Until then please hold on to your
flames.

         Don Kazem
         National Academy of Sciences
         [email protected]

------------------------------

Date: Thu, 22 Dec 88 09:04 MST
From: GORDON_A%[email protected]
Subject: RE: FORMAT command (PC)

To Homer re FORMAT...regarding your hard disk low level format, what
kind of computer did you say you have?  Did you say your computer
supported a hard- disk?

The DOS FORMAT command does NOT destroy data on the disk.  It wipes
out the FAT, which is kind of like the card catalog and releases all
locations so that they can be written over.  If you use NORTON
utilities or something similar, you will see on a disk that had data
on it and was FORMATted, that the items in the root directory can be
listed, only with '?' in place of the first character.  These items
can then be restored, since the directory listing also gives the 1st
sector or cluster location.  If the files are contiguous they can be
saved.  All this means that a virus residing in the data area will not
be erased, but it isn't safe either, unless other factors are
implemented.  I think that during the FORMAT, DOS will skip over areas
deemed bad during the low level format.  Presumably a virus could lock
out these sectors so that they could be used for the virus's purposes.

Allen

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253