Virus that affects MS Scandisk???
David Kusel
Version: 4.0
Hello,
I was helping a friend that has Norton Antivirus and he updates the
DAT files each month.
To make a long story short, his hard disk is physically failing from
my experience & opinion.
My friend has been having erratic behavior with his PC for several
months.
We ran scandisk/thorough and it found some bad clusters and marked
them as bad.
We restarted the PC and it failed to boot into windows.
We restarted and used F8 boot to C prompt only.
Ran scandisk/thorough and it found a lot more bad clusters.
Marked them bad, then we tried to access windows again but this time
we couldn't even get to the F8 C prompt only.
We used the Win 95 boot disk and ran Scandisk/thorough and it found
even more bad clusters.
We were able to access the C drive and copy some of his files he
hadn't backed up to floppies. We tried to use the Colorado DOS backup
utility but it ran into many corrupted files and refused to continue
backing up.
Gateway claims it is probably a virus that causes MS scandisk to
think there are bad clusters and then mark them as bad.
When scandisk is trying to read these bad clusters you can hear the
read heads growling trying to read these spots on the HDD.
We then used FDISK to remove/add the partition and then formatted.
When format was through it reported almost 500 bad clusters.
My question is--
Does a virus exist that makes MS scandisk to have problems reading a
HDD and then incorrectly mark Clusters as bad?
Can a virus survive FDISK/Format??
When I removed/readded the partition it was a FAT 16 DOS partition
and there weren't any other partitions listed.
I didn't see a non DOS partition that a boot sector virus creates.
Thanks for you time
David Kusel
LaVonne Perry [Symantec]
>Does a virus exist that makes MS scandisk to have problems reading a
>HDD and then incorrectly mark Clusters as bad?
>
>Can a virus survive FDISK/Format??
Hello David,
Both of these are possible. However, given the description of what is
happening, it's difficult to determine exactly what may be happening
on the system. If a virus is involved, then it should be possible to
capture a sample of it. You could then send this sample into the
virus lab for analysis. This is the best route to take if NAV or NAVC
is not detecting anything with the latest definitions.
To submit a sample, use notepad or some other editor to fill out the
SUBMIT.TXT file located at:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/submit.txt
Make sure to include complete information or the sample will be
rejected. Follow the instructions at the bottom of the INSTRUCT.TXT
file for submitting file infecting viruses to our Symantec Antivirus
Research Center. The INSTRUCT.TXT file is located at:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/instruct.txt
If there is an actual virus in your sample, SARC will generate a
detection and repair for you. That definition would then be
distributed to all our customers shortly after that.
The sample can be emailed to
or sent to the address in INSTRUCT.TXT
Let me know if I can be of further assistance.
Regards,
LaVonne Perry
Senior Support Analyst
Symantec Corporation
Please continue to post your messages to the public discussion group as
Symantec does not provide support via private e-mail. Thank you.
If you have difficulty getting a response, please read the following article:
http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/1998527114414
For free technical support newsletters, Knowledge Base support articles, our Online Support Genie, and FAQs, visit our Norton AntiVirus support page:
http://www.symantec.com/techsupp/nav.html
Personalize your technical support pages at: