Re: May 1st Windows Attacks??

Date view Thread view Subject view Author view

From: Al Stangenberger (forags@nature.berkeley.edu)
Date: Fri May 03 2002 - 17:31:41 PDT

I had one in ESPM - Win NT 4 (unknown service pack, probably poor virus
protection.)

I did find that the disks were apparently not totally erased. I found a
fairly cheap
data-recovery package (RT-Studio) on the net which seems to be able to recover
lots of the files. It even found lots on a drive whose partition table had
been
messed up so badly that Windows thought the disk was empty...

The ntoskrnl problem might also be related to having installed NT on a big
(20 gig)
partition. Microsoft says anything over about 7 gigs is unsupported,
apparently NT
can't deal with big partitions during the initial boot process.

-Al Stangenberger

At 04:16 PM 5/3/02 -0700, Dan Percival wrote:
>At 02:49 PM 5/3/2002 -0700, Tim Heidinger wrote:
>>I've heard of a two instances where Windows machines that were rebooted
>>on May 1st had their hard drives rendered unusable. I'm wondering if
>>this was a limited thing of if others experienced the same thing?
>
>Two machines in MCB were struck by this problem, both running NT4 (service
>pack 5). The main symptom is widespread file deletion including NTLDR,
>ntoskrnl, etc. Both users also reported having problems with programs
>crashing out and some files disappearing just before the reboot that ended
>it all.
>
>This may be a bit of a red herring, but both machines were provided by
>Affymetrix for data analysis with all software pre-installed. The
>vendor-supplied software did not include virus protection. Affymetrix had
>nothing to say on the subject.
>
>No info yet, but you're not alone.
>
>Dan Percival
>MCB Computer Help
>
>
>------------------------------------------------------------------------
>The following was automatically added to this message by the list server:
>
>For information about Micronet, including subscribing to
>or unsubscribing from its mailing list and finding out
>about upcoming meetings, please visit the Micronet Web site:
><http://micronet.berkeley.edu/>.

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.

Date view Thread view Subject view Author view

This archive was generated by hypermail 2b29 : Fri May 03 2002 - 17:32:12 PDT