Home | Gallery | Forum | Services | Webmail | Archive | Links | Contact Us | About Us
OS2 World.Com Forum
OS2 World.Com Online Discussion Forum.
Index / OS/2 - General / Applications
author message
Beijing.A virus
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
1. Beijing.A virus
Reply to this topic with quote Modify your message
Using eCS 1.25 and NVC 5.7 (registered). Computer is dual boot eCS/w98SE. During a Hard Disk scan the following message is displayed:

Location: Master boot sector on drive D:
Diagnostic: Virus: Beijing.A

Clicking on Clean causes a "ringing" noise to occur however after the short burst of ringing the computer freezes. A re-boot and additional Hard Disk scans AND clicking on the Clean button does NOT clean or clear the virus.

Any help is appreciated!

Date: 25 May, 2005 on 16:59
Fahrvenugen
Premium member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 277
since: 10 Aug, 2004
2. Re:Beijing.A virus
Reply to this topic with quote Modify your message
How about booting from your eCS CD and use LVM to replace / re-write the master boot record?
Date: 25 May, 2005 on 17:21
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
3. Re:Beijing.A virus
Reply to this topic with quote Modify your message

Fahrvenugen (25 May, 2005 17:21):
How about booting from your eCS CD and use LVM to replace / re-write the master boot record?

Believe you hit the solution. Should work. I shall give it a try. Thank You!

Date: 25 May, 2005 on 17:41
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
4. Re:Beijing.A virus
Reply to this topic with quote Modify your message
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks

Date: 25 May, 2005 on 21:02
Henk
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 43
since: 25 Feb, 2003
5. Re:Beijing.A virus
Reply to this topic with quote Modify your message
last updated at 27 May, 2005 01:35 (1 times)

Bobber (25 May, 2005 21:02):
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks


You could ask your problem right at "support@norman.no" or
since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that...

Edit: I see that you found the forum allready...


With kind regards,

Henk/2

Date: 27 May, 2005 on 01:33
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
6. Re:Beijing.A virus
Reply to this topic with quote Modify your message

Henk (27 May, 2005 01:35):

Bobber (25 May, 2005 21:02):
I tried that idea with lvm but to no avail. Must be a stubborn virus. Still need help.

I could use "killmbr" but don't want to do a complete re-install of eCS/win98SE.

Thanks


You could ask your problem right at "support@norman.no" or
since a month orso there is a <forum.noman.no> with allso OS/2 /\ eCS... You could try that...

Edit: I see that you found the forum allready...


Yes, I'm "in line" on that list also. Thanks for the heads up!

Date: 27 May, 2005 on 02:04
jorejarena
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 15
since: 18 Oct, 2003
7. Re:Beijing.A virus
Reply to this topic with quote Modify your message
You should make two additional checks:
1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active).
2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.

Hope this will help.

Date: 27 May, 2005 on 03:05
jorejarena
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 15
since: 18 Oct, 2003
8. Re:Beijing.A virus
Reply to this topic with quote Modify your message
In the second check, don´t forget to write-protect the diskette. And will be better if you create the disk on another PC, free of virus.
Date: 27 May, 2005 on 03:07
eCSRD
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 14
since: 29 Mar, 2005
9. Re:Beijing.A virus
Reply to this topic with quote Modify your message
Did you try to use DFSEE ?
Date: 27 May, 2005 on 15:58
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
10. Re:Beijing.A virus
Reply to this topic with quote Modify your message
I just downloaded and registered DFSee. I am on the low end of the learning curve on it but plan to investigate what I can do with DFSee for this virus. Thanks for the headsup..appreciated.

Norman (NVC) is doing some investigating also.

Date: 27 May, 2005 on 17:57
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
11. Re:Beijing.A virus
Reply to this topic with quote Modify your message

jorejarena (27 May, 2005 03:05):
You should make two additional checks:
1- In the BIOS Setup utility of your Pc, check if any Virus Protection/Boot Sector Protection is active. You should deactivate it to allow your software to write/fix the MBR. (The viruses often finds the way to do this even if the protection is active).
2- Assuming you are using Boot Manager, turn off your PC, boot with a clean Win98 disk, then run "fdisk /mbr", then turn it off again, the turn it on and boot eCS - OS/2 and then run the antivirus again.

Hope this will help.


Virus Gone! It not only helped...it Worked!!!

In case anyone experiences this Virus on their system, item 2 (above) worked. I did some research prior to performing this "operation" and found that:

/MBR - recreates the boot sector of the first (bootable) hard drive in the system. This overwrites the original MBR with a new copy. The MBR is written without altering the partition table information.

Many Thanks

Date: 29 May, 2005 on 07:06
boldos
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.volny.cz/boldos
posts: 21
since: 03 Jul, 2003
12. Re:Beijing.A virus
Reply to this topic with quote Modify your message
Hi,

I'd like to ask, where could one "obtain" such a virus (if not using win**).

Thanks

Date: 30 May, 2005 on 15:31
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
13. Re:Beijing.A virus
Reply to this topic with quote Modify your message

boldos (30 May, 2005 15:31):
Hi,

I'd like to ask, where could one "obtain" such a virus (if not using win**).

Thanks


And, where else to find real help to solve a win problem except in the OS/2 community.

Date: 30 May, 2005 on 16:59
boldos
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.volny.cz/boldos
posts: 21
since: 03 Jul, 2003
14. Re:Beijing.A virus
Reply to this topic with quote Modify your message
I know it looks a bit silly, but this is an OS/2 problem a bit. Why? Because I'm not a regular win user, I'm a ergular OS/2 user. I need to infect a computer with Win95, but because I'm an OS/2 user I don't have any experience with viruses. Thats why I'm just trying whereever I can . Does anyone here have any experience with infection a Wi PC?
Date: 30 May, 2005 on 21:47
warpcafe
Premium member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 350
since: 26 Nov, 2002
15. Re:Beijing.A virus
Reply to this topic with quote Modify your message

boldos (30 May, 2005 21:47):Does anyone here have any experience with infection a Wi PC?

Yeah, I have... by serving various customers who have windoze machines. Basically, the newer the windoze is, the easier you'll get it infected.

Example: On an XP machine make sure you don't have SP2 installed, hit any T-Online website in Internet Explorer (www.t-online.de) and wait for about 20 seconds. This will get you the Sasser virus in most cases (port 445 open, w/ windows messaging service active).
)
If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one.

Greetings
Thomas

Date: 30 May, 2005 on 22:52
boldos
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.volny.cz/boldos
posts: 21
since: 03 Jul, 2003
16. Re:Beijing.A virus
Reply to this topic with quote Modify your message

warpcafe (30 May, 2005 22:52):
If you're interested in testing AV programs, I can send you some viruses (or is it "virii" ?) once one of my customers has got a new one.

Well, I wold be really thankful for any viruses (or virii ), you send.

I know that infection of WinXP is really easy: just connect to internet and wait , but this is the old Windows95. Anyway, I'll try the "t-online option"...

Stefan

Date: 31 May, 2005 on 14:44
warpcafe
Premium member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 350
since: 26 Nov, 2002
17. Re:Beijing.A virus
Reply to this topic with quote Modify your message

boldos (31 May, 2005 14:44):
[snip]- but this is the old Windows95. Anyway, I'll try the "t-online option"...
Stefan

Hi,

that won't work, because the SASSER virus exploits a leak of the LSASS service of XP - and that service simply doesn't exist in windows versions prior to xp/2k.
This is why I still prefer Win98 SE for security reasons compared to XP/2K... if no eCS or OS/2 is around of course.

I'll check what my customers have accumulated and quarantined in the meanwhile - maybe there's something I can send you although the AV programs usually tend to destroy the files right off...

Greetings
Thomas

Date: 31 May, 2005 on 17:34
jabesse
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this memberhttp://rblcheck.besse.nl/
posts: 18
since: 05 Jun, 2003
18. Re:Beijing.A virus
Reply to this topic with quote Modify your message
last updated at 06 Jun, 2005 08:29 (1 times)
Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98...
Date: 06 Jun, 2005 on 08:26
Bobber
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 46
since: 28 Sep, 2004
19. Re:Beijing.A virus
Reply to this topic with quote Modify your message

jabesse (06 Jun, 2005 08:29):
Someone mentioned in the news groups that there now might be an eCS virus. However, as I read the message, I guess it just came there through Win98...

I am the individual who acquired the virus. I "assume" the virus came from the dual boot with w98 or possibly from an infected floppy. Might want to visit this site for some info on it: http://www.f-secure.com/v-descs/buptboot.shtml

Date: 06 Jun, 2005 on 09:09
Beijing.A virus
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
All times are CET+1. < Prev. | P. 1 | Next >
Go to:
 

Powered by UltraBoard 2000 Standard Edition,
Copyright © UltraScripts.com, Inc. 1999-2000.
Home | Gallery | Forums | Services | Webmail | Archive | Links | Contact Us | About Us
OS2 World.Com 2000-2004