Re: NT Partitions

Hello David,

Sometimes, we have to take the qualification of the person who claims "a virus attack is responsible"
into consideration as to what had really happen. Usually claiming a virus attack is an easy way to
escape responsibility - especially if someone had actually done the "Format C" itself and didn't
want to be responsible.

If you already had put in sufficient safe guards such as Virus Protection, you would probably need
to put in sometime to investigate the cause. Steps that help to determine what might includes analysing
the System Logs, knowing who have access to that system, and who was supposed to be responsible
for that system when you are away.

Best Regards,

Ibrahim

                                                                                                                   
                    De Velopment                                                                                   
                                                      
                    arker.org>           cc:     focus-virus@securityfocus.com                                     
                                         Subject:     Re: NT Partitions                                            
                    13/05/2003                                                                                     
                    11:25 PM                                                                                       
                                                                                                                   
                                                                                                                   

Hello Dave,

There are a number of Viruses, Trojans and Worms that, as one of their eventual payloads, attempts to do a "Format C:". If it is successful, the NT partition is definitely wiped out. One question: Is it readable, but blank, or inaccessible? Because another behavior of malware is to encrypt the hard drive so that it's accessible only if the virus, worm, or trojan, itself is running. If you clean it, you no longer have access to the decryption routines and, therefore, can't access the hard drive.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Good luck and best regards,

Ken Parker

On 12 May 2003, David Brown wrote:

> Is there a virus that wipes out NT partitions ?? I have been off work

ensure your place. http://www.securityfocus.com/BlackHat-focus-virus

• Wireless LAN Policies for Security & Management - NEW White Paper *** Just like wired networks, wireless LANs require network security policies that are enforced to protect WLANs from known vulnerabilities and threats. Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs.

To get your FREE white paper visit us at: http://www.securityfocus.com/AirDefense-focus-virus