I have a Virus and need help!

**d1sc g0lf3r** · December 25th, 2002, 04:42 PM

I setup my machine to dual-boot Win2k and Linux Mandrake 9.0 when it boots up now I get a box that says Trend ChipAwayVirus has detected a boot virus on your hard disk!

It says to insert a clean bootable floppy into my floppy driver and press <R> to restart your system.

I am guessing that this Antivirus Software was installed with linux because I only own Norton Antivirus 2001.

I am not sure what bootable floppy to put in? I would appreciate any help getting rid of this thanks.

I am on my way to work soon so I will check back here when I get home.

**NeoStarO1** · December 25th, 2002, 04:47 PM

First of all, There is not one distro of linux that installs a antivirus. those are seperate installs.

I would boot to windows and run a full scan and if that takes it out great. If not head over to hear at housecall a free online virus/trogen scanner.
http://housecall.trendmicro.com/hous...start_corp.asp

Anytime you need to put in a boot disk to run a scan or whatever make sure the disk itself is WRITE PROTECT. you know slide that little tab on there so that way if its a boot sector virus you won't infect your floppy.

**d1sc g0lf3r** · December 25th, 2002, 05:00 PM

Ok I booted into Windows and ran a full system scan but it could not scan drive D: which is the partition that Linux is on. I also ran the Housecall from Trendmicro on Windows and it found nothing. I am going to boot into Linux and run Housecall also though I don't have time now have to go to work

BTW Norton did not detect a Virus on the rest of my drive.

**NeoStarO1** · December 25th, 2002, 05:16 PM

Hmm intersting, read this page about trend Micro's ChipAwayVirus. Doesn't appear to be a virus. http://www.networkcomputing.com/606/606rev2d.html

**Xeroid** · December 25th, 2002, 11:48 PM

Yep, I think Neo is correct. This is what I think you are seeing. Most motherboards these days come with a BIOS feature that looks for changes in the MBR (master boot record) on your hard disk drive. When a change takes place it is interpreted as a virus. Think about it. You just installed Linux. You are dual booting. Your MBR has changed because a bootloader (lilo or grub) was used that changed your MBR to allow you to dual boot.

I (like Neo) don't think that you have a virus. What I think you are seeing is the BIOS Virus Warning interpreting the change in your MBR as a virus but it's actually due to a change made by Lilo or Grub.

If it gets annoying just go into your BIOS setup and turn off the virus warning. On my mobo it's found in Advanced BIOS Features/Virus Warning.

Mike

EDIT: Forgot to mention that Trend ChipAway Virus detector is embedded into Award’s Basic Input Output System (BIOS) software on many motherboards.

**d1sc g0lf3r** · December 26th, 2002, 12:29 AM

I think you are right I just got home from work and booted my machine to find that it no longer reports the virus. Well hopefully that is out of the way. Thanks for the replies

**Bopper** · December 27th, 2002, 08:19 PM

If you see it happen again try emptying the Error Log file in the BIOS, if your MBD has that feature. Our's at the Big moo here call it DMI event Logging. Sometimes the errors can seemingly get stuck, so to speak causing errors to keep coming up at bootup even if there is no error present, and clearing the log is a way to get rid of it.