O R D E R Y O U R VBUSTER T O D A Y . . .
We have frequently been asked on the steps to be taken if a virus is detected in memory on bootup.
There is no such thing as a memory virus. The virus usually comes from the Boot Sector or Partition Table or one of the System Files or a file listed in Autoexec.Bat.
The steps listed below will give you an idea of the steps to be taken. 1. Check the SETUP of your computer and make sure that the Boot Sequence or Boot Priority is set to A:C. You can go to SETUP usually by tapping the Delete key while booting. Some computers may use other keys. You should consult your computer's manual if tapping the Delete key is unsuccessful.
It is very important that the Boot Sequence is set to A:C. If the Boot Sequence cannot be set to A:C you should change the attribute of one of the System Files to read/write, i.e. to 20, then rename the System File to another name.
This will force a Hard Disk boot failure and the bootup will default to drive A. The name and attribute of the System File can be restored to its original state after the virus has been removed. 2. Boot up a clean DOS diskette in drive A. Use MS DOS 6.22 or earlier if you have a virus in the Boot Sector or Partition Table.
Do not use the Windows Startup disk or Windows 95 or 98 DOS. 3. Run Vbuster. Exe either from Drive A or from your Hard Disk and use it to rebuild the Boot Sector or Partition Table if it is a Boot virus or clean the infected files if it is a file virus. You can also use Sys.Com if the virus is in the Boot Sector. If you have a 32 bit FAT table you will have to boot up Windows 95 or 98 DOS before you can clean the infected files as MS DOS 6.22 or earlier cannot read a 32 bit FAT table. 4. If it is a Boot virus and you have created Sentry.Com with Hdsentry.Com, all you have to do is to run Sentry.Com. Sentry.Com will rebuild the Partition Table or Boot Sector for you. Some viruses like a strain of Diehard will hide an image of itself somewhere in your hard disk. This image of the virus is usually activated through the File Allocation Table of one of the files in the Root Directory or a file listed in Config.Sys or Autoexec.Bat.
If your hard disk is infected by the Diehard or similar virus, you should do the following: Set the Boot Sequence to A:C. Boot up a clean DOS diskette in Drive A. Copy all the files in the Root Directory as well as all the files listed in Config.Sys and Autoexec.Bat to a temporary directory or a diskette. Erase the original files. Copy all the files from the temporary directory or diskette back to your hard disk. Run VBuster.Exe and use it to rebuild all the infected files.