A question concerning the 'dd'-command

Nyx · 02-01-2007, 06:09 AM

Hello,

would the simple use of

dd if=/dev/zero of=/dev/hdX

get rid of a bootvirus? I'd think that it is sufficient, yet am not completely sure about it.

Regards,

Nyx

syg00 · 02-01-2007, 06:14 AM

Yep.
But will take a while on a reasonable sized disk. As in several hours. Try

Code:

dd if=/dev/zero of=/dev/hdX bs=1 count=446

to save some time,and have the same effect.

saikee · 02-01-2007, 06:21 AM

I think the bs=446 will nuke the MBR portion of the boot loader. The rest can be inside the rest of the boot sector which is the track 0. Norton Ghost for example can store the entire cloning program inside the boot sector when exiting Xp, reboots and fires up the cloning program in DrDos.

Mind you syg00 is right in saying hdX will take a long time as you are cleaning up the entire disk.

syg00 · 02-01-2007, 06:35 AM

"Boot viruses" as they are known in the windoze world must exist in the area reserved for executable code in the MBR.
Generally they use "unused" areas within that 446 byte range.

My first foray into intel assembler code was to hand de-code the Michaelangelo virus that had eaten one of our office machines.
What a piece of work that was - code in its most extreme simplicity.
I still have an "infected" floppy for educational purposes.

Nyx · 02-02-2007, 08:20 AM

Thank you for your answers. I was planning to wipe the disk anyway so I'll just let it work for a few hours. I don't think I have caught any virus, just wanted to be sure 'dd' would do the trick.

Another question about the blocksize: the default bs is 512 bytes. Is a 'dd' with decreased blocksize more accurate/slower?

It's obviously needed if one wants to take care about a smaller part of a storage device - but is there more to it than just that?

syg00 · 02-02-2007, 05:02 PM

Nope - was required in that case.
For doing a whole disk think about using a *large* blocksize. I use 4k out of habit, but no reason (other than memory maybe) not to use something significantly larger.
Will speed things up nicely.

Nyx · 02-04-2007, 04:52 AM

Thank you for your help.

Nyx

Junior Hacker · 02-04-2007, 05:49 AM

You know, ......

Well,.........OK, I'll keep my smart mouth shut for saikee.

saikee · 02-04-2007, 06:20 AM

Junior Hacker,

Is your post in the wrong thread? Why would you need to shut your mouth in the very first post to thread?

Being human I am not always right and am just learning from others experience here. For example syg00 has taught me something about boot viruses that I am not aware of.

Nobody needs to shut up. If he/she has something to bring to the table the more the merrier.

Junior Hacker · 02-04-2007, 08:03 AM

Thought I would spark interest from the thread starter, not ruffle your feathers, but then again, I was looking for both. You and I are somewhat two of a kind, we should converse through the e-mail link associated with our forum names rather than duke it out in a public place. I'ts 7 am here, time to hit the hay, please talk to me, I'll respond in due time. (When I awake).

PS: I'm pretty sure I found a friend.