From owner-freebsd-questions Fri Oct 29 4:41:11 1999 Delivered-To: freebsd-questions@freebsd.org Received: from mb07.swip.net (mb07.swip.net [193.12.122.211]) by hub.freebsd.org (Postfix) with ESMTP id B827214C05 for ; Fri, 29 Oct 1999 04:41:07 -0700 (PDT) (envelope-from andy@flame.org) Received: from s-709836 (d212-151-36-198.swipnet.se [212.151.36.198]) by mb07.swip.net (8.8.8/8.8.8) with ESMTP id NAA20814; Fri, 29 Oct 1999 13:41:03 +0200 (MET DST) Message-Id: <4.2.0.58.19991029133747.0164c2b0@atlantis.fukt.hk-r.se> X-Sender: andy@atlantis.fukt.hk-r.se X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Fri, 29 Oct 1999 13:40:50 +0200 To: Konrad Heuer From: Andreas Berg Subject: Re: FreeBSD detected as a virus.. Cc: freebsd-questions@FreeBSD.ORG In-Reply-To: References: <4.2.0.58.19991029131003.0164f400@atlantis.fukt.hk-r.se> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG At 13:36 1999-10-29 , Konrad Heuer wrote: >On Fri, 29 Oct 1999, Andreas Berg wrote: > > > I have FreeBSD 3.3-STABLE installed, a snapshot from 26/9. I also have > > Windows 98 installed, and with Win98 I use Norton Antivirus to keep my > > system clean of viruses. Something in FreeBSD is detected as a > > Bloodhound.MBR virus and if I choose repair, FreeBSD dissapears from my > > system as if it never existed. Has anyone else experienced this? > >The `booteasy' boot manager that comes with FreeBSD is typically written >to the MBR (master boot record) of your hard disk during installation. >Probably Norton Antivirus has eliminated the boot manager. Actually, it eliminated the partition info aswell ;/ >Boot from floppy/cd into the install program again, choose post-install >configuration, fdisk disk slice editor, don't change anything, type `w' >for write, select then boot manager installation, type `q' for quit and >leave the whole thing. I tried that, FreeBSD fdisk detected the harddrive slice I used for FreeBSD as unused ;/ >You will be able to boot the hard installation again, but you may want the >protect the MBR of your hard disk against modification before by an >appropriate bios setting (often but not always supported). After that, >Norton Antivirus won't be able to eliminate booteasy again, and no virus >will be able to copy itself into the MBR. I have that setting on now, however, it is unlikely that I will let Norton Antivirus 'repair' my MBR again ;) > Konrad Heuer regards, Andy To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message