Hi Rick,
you wrote in /FIDO/VIRUS_INFO at 25 Dec 96:
kw>> KW>> no, you never have to format your hard drive to recover
TV>> Absolutely incorrect. There are some times where removing a virus
MM>> You right. But just one word - 'never' - did it make wrong.
RC> Please give an example.  Don't use the "encrypted boot sector" cause
RC> (that can be fixed without a FORMAT).
*OneHalf* (Can be cleaned without format too but only if you have an idea
where and how to get the cleaner. Think of it should be impractible to ask
in VIRUS_INFO right after the incident.)
tv>> from your hard drive will leave the boot sector and the FAT
tv>> table encrypted, and the only way to recover from it is to
tv>> format the drive.
mm>> For some viruses there a special removers which decrypt this
mm>> stuff too.
RC> And don't use that example either, then.
RC> BTW - which virus encrypts the FAT?
*OneHalf*
tv>>   The MOST IMPORTANT THING to do when you're infected is to
tv>> BACK UP EVERYTHING to tape or to a ZiP drive or some other
tv>> device. DO
mm>> That's right, as stated above one may have more luck using a
mm>> more special virus remover. Sometimes you will also get the
mm>> info the virus is a data diddler and nobody can say what it did
mm>> change (see Ripper). That's a point where most AV software
mm>> would fail a test, they simple give not enough information to
mm>> the user.
RC> Tell me the advantage of backing up _after_ the system is infected.
RC> That's the statement you were so quick to agree with.
You may to want have your files back after you tried to clean with
Make-A-Fee and found out it sometimes simple delete infected files. :-)
And you may hit *OneHalf* too and after cleaning it all your data are
lost.
Michael
PS: One word could have been the answer too: *OneHalf*
--- CrossPoint v3.11
---------------