78 I was infected with Flip and now a large part of my hard disk seems to have disappeared. What has happened?
Description
This article is from the Computer Viruses FAQ, by Nick FitzGerald n.fitzgerald@csc.canterbury.ac.nz with numerous contributions by others.
78 I was infected with Flip and now a large part of my hard disk seems to have disappeared. What has happened?
Flip has a logic error, probably based on its author only knowing about
hard disk partitioning schemes under DOS 3.x (where partitions could not
exceed 32MB in size).
Part of Flip's infection routine decrements by six the "total number of
sectors" field in the BIOS Parameter Block (BPB--a table of critical
disk geometry data) in the DOS boot sector of the boot partition. For
partitions of 32MB and under this field is meaningful, but in larger
partitions, this field is set to zero and a field in the "extended BPB"
contains the "big number of sectors" for that partition instead. Not
knowing about larger partitions, Flip renders the large partitions it
meets a shade under 32MB. The fix for this is to use a disk sector
editor to set the word at offset 13h of the affected DOS boot sector to
"00 00" (they should be set to "FA FF" if the situation above applies).
If you don't understand these instructions, do *not* attempt to follow
them and seek the help of a more technically knowledgeable person.
Continue to:
My Books
