*BSD News Article 86022


Return to BSD News archive

Path: euryale.cc.adfa.oz.au!newshost.carno.net.au!harbinger.cc.monash.edu.au!munnari.OZ.AU!news.ecn.uoknor.edu!qns3.qns.net!news-out.internetmci.com!newsfeed.internetmci.com!news.xnet.com!news-admin
From: efflandt@xnet.com (David Efflandt)
Newsgroups: comp.os.ms-windows.win95.misc,comp.unix.bsd.freebsd.misc,comp.os.linux.misc
Subject: Re: Windoze 95 Corrupts my Partition ID's
Date: Thu, 02 Jan 1997 04:47:28 GMT
Organization: XNet - Chicagoland's Regional ISP (630) 983-6064
Lines: 51
Message-ID: <32cb2d1d.8757144@198.147.221.35>
References: <5a02an$pm@herald.concentric.net>
NNTP-Posting-Host: efflandt.xnet.com
X-Newsreader: Forte Agent .99e/32.227
Xref: euryale.cc.adfa.oz.au comp.os.ms-windows.win95.misc:219925 comp.unix.bsd.freebsd.misc:33466 comp.os.linux.misc:150063

Malloc@cris.com (Matthew Bancroft) wrote:

>Ive got a 3gigabyte Quantum Fireball IDE drive partitioned into
>
>900meg Linux Native (ID 83)
>100meg Linux Swap   (ID 82)
>1000meg DOS 16-bit  (ID 6)
>1000meg BSD/386     (ID a5)
>
>After i start windoze 95 off another 1gig drive, my partition
>types are suddenly adjusted by windoze 95 and my partitioning scheme
>becomes
>
>900meg Amoeba        (ID 93)
>100meg ???           (ID 92)
>1000meg DOS 16-bit   (ID 6)
>1000meg ???          (ID b5)
>
>FreeBSD refuses to recognize b5 as a valid FreeBSD partition. Luckily, I
>can use Linux fdisk to change the partition types back to what they should
>be. 
>
>Does anyone know how I could fix the Windoze 95 problem that im
>expieriencing?
>
>=----------------------
>=Matt Bancroft	      =
>=matt@mec.edu	      =	
>=bancroft@akamail.com =
>-----------------------

Check if Win95 is running in 32-bit mode or DOS Compatibility Mode.
See bootlog.txt or generate one to look at by hitting F8 when you see
"Loading Win95..." and then whatever will generate a bootlog.

If anything loads loads before io.sys (like mbrint13.sys) it sounds
like you might have a Stoned.Empire.Monk virus on the other drive.  It
moves and encrypts (xor's) the partition table.  It infects all drives
and floppies that are used with that drive (even non-boot floppies).

Another way to tell is to boot with a good 'copy protected' DOS or
WIN95 boot floppy from a computer that is known to be good.  If you
cannot see the C: drive, you've got the virus.  Only infected boot
floppies will work when the HD is infected.

My "refurbished" computer from Computer City in Schaumburg, IL came
compete with this virus along with a bad motherboard and bad RAM.


David Efflandt/Elgin, IL USA
efflandt@xnet.com    http://www.xnet.com/~efflandt/