Don't try this at home!

[bdunn]

Recently we had a bunch of computers that have had their hard drives wiped on booting up in the morning. as an additional precaution I left a floppy in the drive and set it to check "a" first.

I I havent found the culprit but I did catch what was happening. I booted the system from a different boot floppy and looked at config.sys and autoexec.bat on the c: drive.

Sure enough the last line in autoexec.bat was format c: /autotest /q

If I had booted that my drivbe would have been wiped too. I odnt know whether its a virus or an employee yet but I let everyone know.

[spinning]

Hmmm, sounds like a disgruntled employee to me.

Have you looked on the mcafee or symantec virus database for any info?

[jasonflorida1]

Maybe I'm mistaken(probably)but I didn't think you could Format the drive that the Format command is on(in your case C ? I have never tried it, and I'm not going to on my machine!

[Revenant]

Yes Jason, you can... (experience... format D, not C! anything but C... F-O-R-M-A-T C-: ... Amazing, but a very fast power off can save you... )
I definitely agree that it sounds like an employee. Not too many viruses are that overt in their payload.

------------------
What's this button d--

[shawnMt]

The autotest switch is good but in the wrong hands can be dangerous. That's almost definately an employee.

------------------
Cannot find REALITY.SYS. Universe halted

Paint your old laptop!

[WildTech]

I agree!! You have an @$$hole in your company thats playing games. Some people are just real losers.

------------------


WildTech

**I'd rather be lucky than smart!!**

[thirdfey]

Or a stupid employee, wasn't there a version of the ILOVEYOU.vbs virus that would add that command to the autoexec.bat?

[The-Fro]

I've never heard of the "/autotest" switch. What does it do? I checked format /? and it wasn't there. Is it similar to the /y switch in something like xcopy?

------------------
A mind really is like a parachute: It's a million-to-one you'll need one in this lifetime.

[shawnMt]

It don't ask no questions - it just formats. I have a batch file on my desktop "format a:/q/autotest"

It's a very quick way to format floppies.

------------------
Computer Geek + Football Freak - man I have issues

Paint your old laptop!

[Revenant]

The long and short of it: Autotest disables the questions that format asks you. (Are you sure you want to format?)

------------------
What's this button d--

[hireintelligence]

I am wondering if you could use autotest on NT! I don't think so, because NT does not allow direct access to hardware (Floppy drive for instance) Correct me if I am wrong. Now my question is what do you use something like autotest to format floppies? without having to answer Are you sure?

[Shard92]

I have heard of several virus/trojans that but the format c: in the autoexec so before going and accusing someone look into that too. You can try going to Datafellows.com they have a lot about the different virus but without knowing a name or anything I don't know as though that will help. I'm not sure of their exact website either as they just changed awhile back. On second thought though, if this keeps happening I'd say it's probably an employee, especially if it happens on the same machine more than once.

GLSmith

[underfunded]

Wow! I love that /autotest. I just created a quick bat file on my desktop and it is FAST. Thanks.

[The-Fro]

Hire, I think you're right. I just tried it on my Win2K box and got "invalid parameter - /autotest". Oh well.

------------------
A mind really is like a parachute: It's a million-to-one you'll need one in this lifetime.