-=> Mocking Michael to Paul <=-
  (Mock, mOck, moCk, mocK)
 MM>> *OneHalf* (Can be cleaned without format too but only if you have an
 MM>> idea where and how to get the cleaner. Think of it should be
 PW> Can be cleaned by F-Prot, presumably DSAV, etc. without a format. Next?
 MM> Are you sure they do not only clean the virus but leave the HDD
 MM> encrypted?
dr. solly's DOES decrypt the encrypted sectors, i don't know about
f-prot though...
 MM> F-Prot notices the user that after a cleaning all data on
 MM> HDD maybe lost! So formating the disk after clean maybe needed.
 
formatting? why? the most that will be encrypted by one_half is the
bottem half of the drive... ergo the most you'll need to restore due to
encryption is half the contents of the drive, not the whole thing...
also, it's not particularly hard to backup the data on the hard drive
while the virus is active and use that to restore the files when the
virus has been removed...
 MM>> *OneHalf*
 PW> That just encrypts two cylinders each time it runs, I thought.
 MM> Yep, it does so and it may also hit your FAT. But you may not notice
 MM> it aslong as the virus is present. You'll begin to see what was happend
 MM> after you removed the virus with the wrong AV-program.
i've never heard of it encrypting the fat... are you sure the situation
you're thinking of isn't a coincidental fat corruption? one_half is only
supposed to encrypt the last two unencrypted sectors on the hard drive
until half the hard drive is encrypted... unless you have a complete
bizarre drive layout your fat should not be in the area that was
encrypted...
... GIF = General Intellect Fault...
~~~ TGWave v1.20 Beta-07+
--- Telegard 3.02/Gecho
---------------