> >  [] Note that this virus *also* overwrites about the first 2000
> blocks of
> >hard disk, including the partition table, FAT and root directory;
> recovering
> >from this could be somewhat harder.
>
> This is exactly what has happened to me. The BIOS is safe but the
> first 2000
> blocks have been
> overwritten. I have used FDISK to recreate my old partitions of
> exactly the
> same size as before. Now
> I have 2 options:
> 1.    Use a disk editor like Norton Disk Editor to try and
> manually mark the
> partitions as FAT16B
> 2.    Format the dirive and then Unformat it??

        Unfortuately neither of these techiques hold much hope. You're FAT is gone,
overwritten, there is simply no way to get it back. I don't see what setting
the drive to FAT16B would do, since the FAT is gone. I wouldn't format the
drive yet either. If you have alot of time on your hands this is what I
recommend you do. This technique however depends on the drive having been
defraged before the "event", if it wasn't it will be less likely to work.
Now please understand, getting back all the contents is practically
impossible, however you can get some of your data back. First get a low
level disk reading utility, one of those that let you read the disk sector
by sector. Open the program, specify read absolute sector, and start with
sector 2000 (sector 7D0 in hex) since everything before is toast. Now,
scroll through each sector, each time you see something that looks like one
of your files, save the chunk to a floppy. Word processing files will be
easiest to recognize, you will save the data but not the formatting. Other
files will be much harder to recognize, but after a while you will get the
hang of it. This will take a long time, but it does work, I myself have done
it on a couple of drives that suffered head crashes, didn't get everything
back, but quite a bit. Of course if you don't have the time, there are
companies out there that will do the same for you, although they have
software to automate the task, but it will cost a nice chunk of money. I
hope this helped, TTYL

            Do you want to signoff PCBUILD or just change to
                    Digest mode - visit our web site:
                    http://nospin.com/pc/pcbuild.html