Bijorn wrote: ---------------- Use this (or similar software) to make backup copy of MBR, hide the file as txt or whatever. Then, upon every boot run MBRWORKS to create a temp file of current MBR. Then use a filecompare utility, comparing the temp file (current MBR) with the backup (last known good MBR). Figure out exit codes and routine to use if mismatch (fx. if mismatch - replace current MBR with backup, then reboot, or - sound alarm - or - whatever) -----------------------------
Actually I believe tech0worm updated older program that save a copy of the boot sector, partition table, and FATs to work with FAT32. These utilities will compare these parts of the disk to corresponding files on boot up. As you say, by then the OS has already been loaded and stealth viruses might already be in memory. One can instantly turn off the machine when the compare finds differences. However, some viruses can probably delete lots of funs or do other nasty things, as part of the boot process, even though you do not run any programs. That is why disksecure is safer: it stops/detects viruses before the OS is loaded in ram and thus before viruses or other programs can be executed. To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with unsubscribe SURVPC in the body of the message. Also, trim this footer from any quoted replies. More info can be found at; http://www.softcon.com/archives/SURVPC.html
