jboy:Great! I've been to sites you referred me to & downloaded f-prot & latest virus def.--But I can't figure it all out yet--have you used it? Is f-prot meant for use when you can only boot to DOS & not Windows? Can f-prot be used in DOS mode somehow in conjunction with an Emergency Recovery Floppy? ...Stinger's files are read from the same Emergency Recovery Floppy Disk or separate one?

0

No, sorry, not recently - my systems stay remarkably virus free, but F-Prot has enjoyed a good reputation for many years (certainly before I'd ever owned a PC). From that alt.comp page, it would appear that you boot the machine from the 1st floppy and execute the f-prot like so: F-PROT /LOADDEF (more instructions on that site) Of course, you can have the files on the hard drive and run from there - the purpose of running from floppies is to ensure that the program itself hasn't been corrupted due to virus attack or HDD damage. Newer bits of malware will actually target & disable AV and Anti Spyware products. Running from floppies will be fairly slow. While I'm sure it would be fine to be run from a DOS boot, can't swear it would be ok from a DOS prompt run from within Windows (probably be ok). If you're able to run Windows, may as well run a Windows AV scanner. Stinger is supposed to be good as well - it never hurts to run different AV programs consecutively just to cover your bases, it may not be a good idea to have more than one active at the same time. Probably the folks over in Security & Virus could field some of these questions better than I can. Use

0

More Thanks!-- I'm learning a lot--didn't know about alt.comp page & "folks over in Security & Virus"---at computing.net? Don't know how you can the take time to "do my thinking for me" -but 's appreciated. ------------- For benefit of others w same problem,here are 2 replies I rec'd from JT at allexperts.com: JT #1: You have the classic case of "What does a computer do". Computers multiply errors so fast that the human eye cannot see them or the brain comprehend them. I hate to give you really bad news but here it is, Your data is probably all trash at this point and very little of can be recovered without hours of sifting though raw sectors on the disk. The partition table on the disk appears intact at this point but there is not even a guarantee on that. What has happened is that your FAT table got corrupted and then scan disk scrambled what was left by attempting to use the alternate table that is store by MS for situations like this....Doesn't work well unless the original FAT table is completely unreadable and then the alternate table can be used. I would recommend FDISKing the drive and starting over. Since that is not what you want to hear, I will answer your questions and allow you to try and see if any data is recoverable. 1) There is a danger of infecting a good system if you connect an infected drive to the system. It depends on the virus that is present on the drive and how much the bios attempts to read from the drive while booting. When your system is booting your virus scan is not resident and running until it is launched by the OS. Prior to that point the Bios routines could launch a virus while checking for a boot partition or some low level drive diagnostics. Granted there are only a few viruses like this that have made it into the wild, but they do exist...Be careful but you can try attaching. (Ensure you have a good backup of the system, and do not launch even explorer on the drive before scanning till it hurts) 2) There are several stand-alone virus scanners. most of them will only look for specific viruses but Mcafee has what they call the "Stinger Tool". It looks for the "HOT List" of viruses that are active at the time you download it. The current version scans for 40 viruses and is good if the virus you have is on the list. Download and instructions are at http://vil.nai.com/vil/stinger/ 3) If you re-install on the drive you will probably overwrite any data that is still on the drive (see comment above about sifting through raw sectors for data). I would try this as a last resort before FDISKing the drive. If this does work and some data is recovered you will still want to FDISK the drive and reload OS after your recovery attempts. You cannot trust the structure on the drive any further than you can throw it at this point. I feel bad having to give you all this bad news, but I'm sure others have said the same thing. There is no magic bullet available other than a good backup. Not a warm fuzzy backup, but a good bit by bit, verified, validated, error checked backup. I do not believe that this started with a virus, I would say that it probably originated more with a disk error or power glitch that caused a soft error on the disk and then the utilities took over and completely scrambled things. It's hard not to say FIX when a utility asks you, but you have to show restraint and not auto fix until all other options have been exhausted including a good backup at the point of the error before trying the auto fix options. _______________________________________________________________ JT #2 : First “my bad” on the Stinger tool, Stinger only works under windows. You can load windows 98 from three floppies, but not worth the trouble at this point. Again I don't think you have a virus that caused this problem. If you would like to check out a lot of DOS utilities for virus scanning see http://ciac.llnl.gov/ciac/ToolsDOSVirus.html . Unless a virus scan finds a boot sector virus do not allow the program to make any changes to the disk. Very important point: Do not make any changes to the disk. Do not rename, delete, create or change the contents of the disk in anyway at this time. Doing so could prevent you from recovering anything else from the drive. You say you HAVE recovered 50 files using floppies... Granted most of the files on your drive you don't need to recover, you only need to recover "data" type files. I'm assuming that you are trying to recover word docs, photos, email and such. If you are trying to recover programs or use the disk without formatting and reloading...forget it. You need at this point to make a plan listing what you hope to recover, everything that you can remember that you had on the drive that you can not replace from another source. Try to keep the list as small as possible because each file you list translates to some time spent finding it. Some of the files will still have the same name, some will be in .chk files and some will probably be in strange looking file names. At this point unless you are only looking for a very small number of files you need to get that drive attached to a system where you can use some tools on it. DOS copy c:\xxxx\xxxx\xxxx a:\ gets very old quick and type c:\xxxx\xxxx\xxxx | more will only work if you are looking for doc or txt type files. Trying to view the contents of some files would also be impossible to tell if they are intact or not. I would attach the drive as a slave to another computer that I'm sure I have a good backup of. Immediately run a virus scan on it when the system boots and then copy all of the files on it to the primary disk. You will probably get some errors during the copy process. Some files are probably in the directory structure but not on the drive. Sift through the files looking first for the obvious files that you are looking for. Then sort though the files that you've copied over looking for anything that looks close to items you want. Then try a search / recover tool like IOLO's search and recover available as a try and buy for 30 days at http://www.iolo.com/sr/download.cfm . Most of the tools you'll find are for deleted files, but they work because they scan the drive looking for pieces of the files not just looking in the FAT for deleted items. JT

0

Hi Roark Some good information there from JT - he's far more eloquent than I, but we're more or less in agreement. Scandisk made mush of your directory structure, and recovery of all files will likely not be possible. One tool that may help is the venerable List from Vernon D. Buerg - it's a general purpose file viewer that lets you examine a file's contents. If the files your attempting to restore are executables you may not have much success - but ZIPs, text and picture files can frequently be recovered in good condition. I didn't believe there was much chance of infection from a slave drive, but apparently it's not inconceivable. Use

0