Natsa virus

can anyone tell me what this virus is ???
it affected my box and i had to format c: drive
my mouse pointer disappeared then i had problems while rebooting ........

couldnt find natsa but found natas

http://www.pspl.com/virus_info/dos/natas.htm

natas is a horrible virus. An AV Bootdisk should pick it up since it resides in the MBR. I've unfortunately had some previous experience with it due to some 3Com Network Drivers being infected with it.

you recently just had a natas virus? i can remember it's an ancient virus.. together with die-hard, sayha-watpu, etc.. before the era of gui os'.

kinda have that nostalgia effect .. "elder days"

Not that recently. It was about 4-5 years ago. We used to use those 3Com 3c509 ISA cards. The virus was in there and I, luckily, didn't get the 1-in-512th chance of a hard drive erasure.

Well, I got it too, about 1996, I think it was.......and unfortunately, mine was apparently that 512th chance! That poor old 386!

That's one virus I will never forget! I had just tricked Windows 95 into installing on that old thing about a week before! Talk about pissed! I was so mad that kicked a hole in the front of that old minitower, and went and bought a new computer.

i use avg but i don't know how it got in but had to format my drive and spent the day reinstalling everithing

This is a MBR virus. It's unlikely that the MBR is scanned during bootup and really the only way to check for this kind of virus is to do a bootdisk scan. So it's very conceivable that you got it from some floppy (it's an older virus) and it remained resident in the MBR before doing anything.

Read about it here:

http://vil.nai.com/vil/content/v_98225.htm

thanks msmittens

Here's an interesting question. If the MBR is infected, shouldn't you be able to fix it just by overwriting the mbr with a valid one. EG: fdisk /mbr (for win9x), fixboot and fixmbr (for win 2k/xp) or /sbin/lilo or /sbin/grub (for linux)?

Cheers,
cgkanchi

Oh certainly. That's in fact one of the easiest ways to fix it. But first you have to identify what the cause is. When I got infected, it wasn't apparent and very random items happened in the OS (Win98 at the time). Heck, I thought it was just a bad network card. Took almost 8 hours of various troubleshooting (while helping others at the same time) before the clue meter kicked into gear and I decided to check with a boot disk.

Another way you can get rid of an MBR virus is to blow away the mbr by running an assembler script from the debug console. I posted one earlier in the thread on "Erasing BIOS ". Of course, if you do that, you'll lose everything on the HDD, but the virus is guaranteed to be wiped out! :D