Computing.Net > Forums > Windows Me > Virus sitting on HDD after formatting

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Virus sitting on HDD after formatting

Reply to Message Icon

Name: Hunter
Date: March 15, 2002 at 16:19:07 Pacific
Comment:

Hi all...
Can a virus sit on a hard driver after partitioning and formatting?



Sponsored Link
Ads by Google

Response Number 1
Name: wawadave
Date: March 15, 2002 at 18:52:04 Pacific
Reply:

hello
not too likely but the chv can sit in your bios and chip sets and reinfect things once theres a system back there may be others that do this sort of behaver too.
i see i cant spell to save my self.
have a nice day


0

Response Number 2
Name: Col
Date: March 15, 2002 at 19:14:26 Pacific
Reply:

Hi,
I sure hope it isnt in your BIOS..
You have BIOS protected dont you. ??
Did you Format fully ??
Or just "Quick format" ? Tell us more..
Col


0

Response Number 3
Name: Hunter
Date: March 15, 2002 at 19:41:53 Pacific
Reply:

I have formatted fully.
format C:\ then yes to conferm it.


0

Response Number 4
Name: Ellis
Date: March 15, 2002 at 20:01:38 Pacific
Reply:

I've never seen a virus "live" in your BIOS. They can attempt to corrupt it, but live there?

More likely, it's infected your MBR.

Post a reference for me wawadave - I'd be interested in perusing it.


0

Response Number 5
Name: Isato Kaizer
Date: March 16, 2002 at 01:02:46 Pacific
Reply:

Virus canot survive in ure BIOS ... Once u close ure comp, the virus in the BOIS is history ... If u format a HDD, the data doesn`t go to the recycle bin ... So, all data including virusess are permenantly eliminated ..


0

Related Posts

See More



Response Number 6
Name: Brant
Date: March 16, 2002 at 01:27:47 Pacific
Reply:

Isato is for the most part correct. Generally if you get a CIH virus which infects your BIOS, the PC will not reboot.
Formatting writes 0s to the entire drive, so I cannot see a virus hiding while you do that. REMEMBER a "Virus" is nothing but an executable program which has been written to cause damage when run. PCs can't sneeze and pass the virus on to other puters in the room LOL.
Most Viruses are quite simple, in that they are written to "replicate" themselves, eating up your HDD and finally crashing it. More complicated viruses have been written which actually cause physical damage to peripheral equipment,rendoring them useless,or so it seems. A virus can do NO more than what can be written for a program to do. If you read these posts you get a pretty good idea of the damage we can do by accident, just think of the things we could do if we set our mind to it: The epitomy of a virus


0

Response Number 7
Name: Balakong
Date: March 16, 2002 at 06:31:06 Pacific
Reply:

Viruz dosent live in the BIOS. If I`m not mistaken, I only heard that viruz can wipe out ure BIOS. CIH doesn`t infect BIOS. Its a memory resident viruz. See http://securityresponse.symantec.com/avcenter/venc/data/kill_cih.html

Aditional Note :
The W95.CIH virus cannot infect computers running Windows NT or Windows 2000

If ure operating system is Win95 and is infected wit CIH, ure entire OS is history, every exe file wil be infected.


0

Response Number 8
Name: arai san
Date: March 16, 2002 at 06:40:24 Pacific
Reply:

No such thing as CIH infecting the BIOS.

History of CIH
http://securityresponse.symantec.com/avcenter/venc/data/cih.html


0

Response Number 9
Name: arai san
Date: March 16, 2002 at 06:45:55 Pacific
Reply:

I only heard BIOS.Password.Trojan.
http://securityresponse.symantec.com/avcenter/venc/dyn/7620.html
But this doens`t infect ure BIOS at all ..


0

Response Number 10
Name: Isato Kaizer
Date: March 16, 2002 at 06:56:29 Pacific
Reply:

Giv me just one viruz thats infects ure BIOS, Brant ... ???


0

Response Number 11
Name: Brant
Date: March 16, 2002 at 15:58:54 Pacific
Reply:

Well I tell ya, if it looks like a virus and smells like a virus, it is probably a virus. I appreciate the opportunity to respond to the challenge Isato, and I hope you find this satisfactory.

Source: IT White Papers

Summary:
Name: Magistr

Aliases: Disemboweler, W32/Magistr@mm, Troj_Magistr, I-Worm.Magistr

Type: Portable executable virus and mass-mailing email worm

Systems Affected: Windows systems.
Payload: Overwrites all disk files with text "on all local and network drives (delayed). Erases content of system BIOS (CMOS) and destroys hard drive sectors on Windows 9x computers.


Access: Direct access
Format: HTML
Source: F-Secure
Date: March, 2001
Summary:
NAME: Magistr

ALIAS: IWorm_Magistr, I-Worm.Magistr, W32/Magistr@mm

Magistr is a very dangerous memory resident Win32 worm combined with virus infection routines. It was found in-the-wild in the middle of March 2001. Magistr virus spreads via Internet with infected emails, infects Windows executable files on an affected machine (local machine) and is able to spread itself over a local network (LAN).

The virus has an extremely dangerous payload, and depending on different conditions it erases hard drive data, CMOS memory and Flash Bios contents in the same way the Win95.CIH (aka Chernobyl) virus does.


Summary:
This Trojan horse is a Windows program which is fitted with the warhead of the CIH virus. Unlike CIH, this is not a virus, so it cannot spread by itself. However, it triggers its warhead every time it is run, not just on specific dates (usually 26 April) like CIH.

The warhead destroys the first megabyte of data on the hard disk and may wipe out the contents of the BIOS chip (though the BIOS damage does not work on every computer).


Summary:
What is a virus?

This question received different answers from the specialists ? all having in common a basic definition of the virus:

The virus is a computer program that is able to replicate.

One who thinks that the virus is a malefic and genial creation of a programmer is wrong. Viruses are usually written by mediocre programmers. Due to the expansion of the Internet, it is very easy for viruses authors to exchange opinions, discoveries, even sources. That is why, after one author makes public a virus's sources, many variants of that virus appear immediately. Let's take for example the virus WIN95/CIH. There are, at this moment, tens of variants for this virus and other viruses based on it, just because its author made public its sources for the interested programmers. More than that, other authors are using routines of old viruses; an example being the routine for destroying the Flash BIOS from WIN95/CIH, already integrated in many other viruses.

People are used to consider trojans and viruses as the same thing. However, these are distinct software types and we should pay attention to each of these categories.


Summary:
The chernobyl virus (or CIH virus) was originally called the ?mother of all viruses? when it first made its appearance last June 1998. During that time, it caused a minor panic. It was purportedly even more destructive than the Michelangelo was in 1992, or the Hare in 1996. It could destroy files, and because it overwrites the BIOS of the computer, it could destroy the computer as well.

SOURCE: SOPHOS

Virus attacks boot files, destroying start-up routines.

Sophos is warning Windows 95 and Windows 98 users of a new virus, known as CIH, which has the capacity to overwrite system start-up routines, as well as wiping data on hard disks. The virus attacks the BIOS, needed to boot up the computer, something which no previous virus has managed to do.

The attack comes in two parts, the first and most dangerous being that on the BIOS. The virus overwrites the start-up mechanism, having first bypassed safety features which prevent unintentional loss of data. This makes the computer unbootable until the chip is replaced. The second attack overwrites data on the hard disk of the machine.

"The attack on the BIOS has been tried before, but without success," said Paul Ducklin, Head of Research at Sophos. "The fact that this attack is coupled with the more usual characteristic of data loss makes this virus doubly destructive. Any machine attacked will both cease to function and lose its data. For the first time, we have a virus with side-effects that can only be cured by physically opening the computer and replacing a component."


0

Response Number 12
Name: I have win xp w/win9
Date: May 23, 2002 at 14:25:23 Pacific
Reply:

I have XP professional, but does win95.cih affect it? Please email me and let me know.


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows Me Forum Home


Sponsored links

Ads by Google


Results for: Virus sitting on HDD after formatting

After format virus is still there www.computing.net/answers/windows-me/after-format-virus-is-still-there/33094.html

Recover data after Formatting www.computing.net/answers/windows-me/recover-data-after-formatting/38098.html

HELP! FAT corrupt after format www.computing.net/answers/windows-me/help-fat-corrupt-after-format/76.html