virus - re format

Steve B · Post by **Steve B** » 6 Feb 2001 8:40 pm

My computer (I am on my old spare computer right now) has a virus & I need to start from scratch. I have the boot disk, but how exactly do I re-format??

Jim Smith · Post by **Jim Smith** » 6 Feb 2001 9:02 pm

Once you boot from the floppy you'll be at the A: prompt. Type format c: /u /s. That will do an Unconditional format and transfer the System files so you can boot from the drive.

Craig Allen · Post by **Craig Allen** » 7 Feb 2001 5:03 am

Steve, it depends on the type of "virus" you've contracted as to whether or not a re:format will help. If you have a memory resident virus, you can re:format 'till the cows come home, and it will make no differance.

I have not done an 'unconditional', format, but when I need to re:format, I don't care about saving files. I store very little on my hard drive, as it is.

Get to a "C" promt.then type format, and let er go boys.. {C:format} Make certain that you have any product keys, or authorization codes that you will need, to reload your system. But I say to you, that if you have a memory resident virus, this will serve no purpose. It will likly re-infect your machine.

b0b has a lot of snap about these things, and knows some sites that may be helpful with info on your particular virus, and how to kill it.

Bon Chance

Jack Stoner · Post by **Jack Stoner** » 7 Feb 2001 6:22 am

I'm confused. If I have a "memory resident" virus, it's only "memory resident" as long as the PC is on. If I turn the PC off and then back on, the virus info is on the hard drive and will reload in memory - Correct? If my assumption is correct, reformatting the hard drive would delete it. That is reformatting and erasing all the data on the hard drive, not just a quick reformat as the data will still be there just the flag will be set that that sector can be used.

I've never used the "U" option, does that completely erase the drive or just force it to reformat the complete drive rather than a "quick format"? If it gets to the point the hard drive needs reformatting, I would assume it needs all the data "erased".

Jim Smith · Post by **Jim Smith** » 7 Feb 2001 8:06 am

the /u parameter does force an unconditional format without saving unformat information. Another nice parameter is /c which forces the format to check all blocks that have previously been marked bad. The help on format is surprisingly good, just type format /?.

Tom Diemer · Post by **Tom Diemer** » 7 Feb 2001 7:25 pm

Jack,

A memory resident virus is stored in the boot sector of the hard drive. A high level format ( the format c: command ) does not replace the boot sector. Besides, the computer has to be on (thus, memory is used containing the virus) in order to format it.

Usually, booting from a clean, write protected floppy, and using the command 'format c: /MBR' will rewrite the boot sector, and remove the virus pointers. MBR means 'Master boot record'

Keep in mind, it would be VERY rare to get a memory resident virus these days. Those are for the most part, antique. Modern virus's are the script types, and do not retain in memory or boot sector. Since everyone uses Windows, a Windows virus is all you need to mess them up. Memory resident was more from the DOS world. Not unheard of, but rare.

Tom

Tom Diemer · Post by **Tom Diemer** » 7 Feb 2001 9:22 pm

Ooops. I made a mistake in my earlier post. Guess this cold has me down more than I thought.

The command to clear the MBR is FDISK /MBR, not format c: /MBR

Some ROM's do have format abilities, but those are usually SCSI adapters with that feature. Part of the SCSI bios is the format ROM chip. Using SCSI type hard drives. They commonly refer to that as 'initializing' the drive. Same as a low level format. After that is done, you must Fdisk to create the partitions, then format c: (high level format)before the drive can be used to store files.

It is true that many of the newer PC's will boot and install from the CD-ROM, if that's what you meant. But that is a high level format only.

I'm not aware of any IDE drive systems that format from ROM. Perhaps I am mistaken?

IDE drives are factory initialized, and need a special program to low level format them. Example is WDFMT.EXE for Western Digital drives. Or Data Lifeguard tools, (free download from Western digital),Microscope, Checkit, or Troubleshooter, to name a few.

Hope this helps, and is accurate.

Most of the newer virus's are more a nuisance than damaging. I deal with them often in my work. If I can help , please drop me an email, Ill try to give you a line on how to remove it, and what damage, if any, was done, during removal, and what to do to repair the OS. Lot's of good info on Symantic's support sight, [url=http://www.sarc.com,]www.sarc.com,[/url] I believe it is.

Tom (MCP, CNE, A+)

Jack Stoner · Post by **Jack Stoner** » 8 Feb 2001 4:32 am

Tom, I was referring to a low level or "Fdisk" as what would be needed to completely erase the disk.

I keep a copy of the older WD EZ Disk program that will format either FAT16 or 32 drives. I still have two clients that have older OS's and the FAT16.

BTW I used to be 3.12 Novell certified. Once I retired there wasn't any reason to spend the money to get upgraded.

Steve B · Post by **Steve B** » 8 Feb 2001 7:35 am

Thanks for all the tips. I got it all reformated and all my software loaded back on, including a virus shield.

Bobby Lee · Post by **Bobby Lee** » 8 Feb 2001 9:33 am

Format is not in ROM on any computer I've ever owned. Most people use Microsoft's format.exe program, which comes with DOS or Windows.

Jim Smith · Post by **Jim Smith** » 8 Feb 2001 9:46 am

I think Mickey was talking about a low level format, which is in ROM on most SCSI controllers.

Jack Stoner · Post by **Jack Stoner** » 8 Feb 2001 10:32 am

None of the "home" or "consumer" PC's that I've seen have SCSI hard drives. The only ones I've seen SCSI in has been servers and the old IBM PS/2's.

Jim Smith · Post by **Jim Smith** » 8 Feb 2001 12:39 pm

Granted most consumer PC's don't use SCSI, but I've run SCSI in all of my home-built PC's since the 80's. You can't beat it for UNIX or Linux, and I still use a SCSI CD burner. I've never had a buffer underrun when burning a CD, and I can continue to work while burning without having to shut down extra processes.

David Pennybaker · Post by **David Pennybaker** » 8 Feb 2001 12:43 pm

<SMALL>I've never had a buffer underrun when burning a CD, and I can continue to work while burning without having to shut down extra processes.</SMALL>

Check out the latest CD-R drives with "Burn-Proof" technology. No more coasters do to buffer under-runs. Even on IDE!

------------------
The Unofficial Photographer of The Wilkinsons