{"id":87613677,"date":"2003-11-17T20:38:28","date_gmt":"2003-11-18T03:38:28","guid":{"rendered":"http:\/\/www.geckotemple.com\/blog\/?p=87613677"},"modified":"2003-11-17T20:38:28","modified_gmt":"2003-11-18T03:38:28","slug":"mustve-touched-a-nerve-or-something","status":"publish","type":"post","link":"http:\/\/www.geckotemple.com\/blog\/?p=87613677","title":{"rendered":"Must&#8217;ve touched a nerve or something&#8230;"},"content":{"rendered":"<p><i><b>So I get this thing sent to me a while ago, and didn&#8217;t read through it until today.<\/b><\/i><\/p>\n<p>>&#8221;S&#8221; says:how goes<\/p>\n<p>>&#8221;K&#8221; says:meh. same as always.<\/p>\n<p><i><b>{What a happy camper.}<\/b><\/i><\/p>\n<p>>&#8221;S&#8221; says:i got a question for ya<br \/>\n>&#8221;S&#8221; says:what is your favorite way to do a low level format on a <br \/>\n>drive that has no os on it, just sitting in a box<br \/>\n>&#8221;S&#8221; says:i use to use win 98 boot disk<\/p>\n<p>>&#8221;K&#8221; says:why do you need to do a low-level format? are you <br \/>\n>going to put 98 back on it?<\/p>\n<p><i><b>{Huh?}<\/b><\/i><\/p>\n<p>>&#8221;S&#8221; says:just tried dos 6.21, f3&#8217;d out leaving it in dos, but <br \/>\n>can&#8217;t go to c:<br \/>\n>&#8221;S&#8221; says:2k, and I did, but there are a shit load of viri on here, <br \/>\n>and they need to written over. I reinstalled 2k on the drive, and <br \/>\n>norton&#8217;s found the binary to the viri again, admittedly, it is not in <br \/>\n>the index of the drive, but the binary is still there<\/p>\n<p>>&#8221;K&#8221; says:then you&#8217;re doing something wrong. A hdd formatted <br \/>\n>via NTFS overwrites everything. There is no bootsector for NTFS, it <br \/>\n>doesnt work that way<\/p>\n<p>>&#8221;S&#8221; says:nope, not a normal format, like the one on the 2k <br \/>\n>install, it only deletes the list to the drive<\/p>\n<p>>&#8221;K&#8221; says:look, if you have all the answers, why ask me? Im <br \/>\n>telling you point blank, do an NTFS format, no virus will survive <br \/>\n>unless it resides on an untouched partition.<\/p>\n<p><i><b>{Mr. Personality strikes yet again.}<\/b><\/i><\/p>\n<p>>So is he full of it, am I? I use to know what the boot sectors were in <br \/>\n>98, fat32, and I even edited a few. Haven&#8217;t done anything like that <br \/>\n>since 2k and Xp. I would just reinstall before trying that shit again.<br \/>\n>But as far as I know, isn&#8217;t the drive one big primary dos partition, <br \/>\n>then there is the active main partition, with extended partitions after that.<\/p>\n<p><i><b>And then something in my head burst, and this is what spewed out:<\/b><\/i><br \/>\n<i><b>Names have been changed to protect&#8230; uh&#8230; nobody in particular.<\/b><\/i><\/p>\n<p>1. You&#8217;re both on crack, essentially.  The difference was that one of you was misunderstanding a term, I think, and the other was being a flippant goof.  I suspect the machine in question was being reinfected &#8220;on the fly&#8221; during the time it took for your first boot, and the WindowsUpdate or Norton LiveUpdates.  If that thing had a live IP on the &#8216;net, it could be hit in under a minute.  The MSBlaster and its family move fast &#038; furiously.  On our network, we *STILL* have a machine or two (usually laptops) that are infected, and EVERY SINGLE WORKSTATION that we build will be hit by the Nachi worm before you have a chance to patch.  We now carry little USB thingies with the patches on them when working with less-common Ghost images.  We ghost &#8217;em, unplug &#8217;em from the network, patch &#8217;em, and then plug &#8217;em in again.  The average machine &#8220;in the wild&#8221; (without a firewall or something) will get hit by Blaster or Nachi (the anti-Blaster virus) in seconds by one of your DSL\/Cable neighbours.<\/p>\n<p>1a. Norton was doing exactly what it&#8217;s supposed to be doing.  You updated it, and suddenly it could see a virus.  Chances are pretty good that you actually did have a virus.  MSBlaster is the base infector, which will then download another trojan\/virus app via an TFTP client, which will then drop a keycapture application, and (under the right conditions) connect to an IRC channel for more abuse.  Win2k &#038; WinXP are susceptible out of the box.  Cheap like borscht.  Bada-bing, bada-blaster!<br \/>\nhttp:\/\/securityresponse.symantec.com\/avcenter\/venc\/data\/w32.blaster.worm.html<\/p>\n<p>2. I *think* what you two were talking about is a &#8220;Quick Format&#8221; which does just blow away the FAT (which is not a FAT32 vs. NTFS thing, I&#8217;m talking about the File Allocation Table), which does just scrub the &#8220;table of contents.&#8221;  A virus can&#8217;t make it through that either, but if you want to be sure, there many many many ways to do that.  The better\/faster way to make sure a drive is really wiped is to delete the *PARTITION* and then create a new one (doesn&#8217;t matter whether it&#8217;s FAT\/NTFS) and then format that with either Quick or Full format.  Full doesn&#8217;t zero-fill the drive, it just erases the volume and does a bad sector check (which is what takes so freakin&#8217; long).  Zero-filling doesn&#8217;t do a damn thing when it comes to formatting a volume.  Formatted is formatted is formatted, no matter how long it took.  Emp-a-tee&#8230;  http:\/\/support.microsoft.com\/default.aspx?scid=kb;en-us;302686<\/p>\n<p>2a. A &#8220;low-level&#8221; format was only for very very old drives, and would be performed by the BIOS itself, sending direct hardware commands to the drive, which in the pre-540MB drive days, could result in permanently hooping your drive if your C\/H\/S settings were even slightly wrong (or had been translated).  If &#8220;K&#8221; is so freakin&#8217; up on his technology, why doesn&#8217;t he know the definition of &#8220;Low Level&#8221; format, which is not possible from a boot disk (or bootable CD, either).  There are *SOME* hard drive utilities that will attempt a &#8220;low level&#8221; format, but it&#8217;s usually only done by the drive manufacturer.  First hit on Google for &#8220;low level format&#8221; http:\/\/www.pcguide.com\/ref\/hdd\/geom\/formatUtilities-c.html<\/p>\n<p>3. &#8220;K&#8221; went from zero to asshole in two questions.  No wonder he&#8217;s having trouble finding work.  He&#8217;s welcome to apply to Xxxxxxx, but if he ever asks me for a job at Xxx, I&#8217;m laughing in his face.  He&#8217;s more highly certified than I am with his MCSE, but he&#8217;s an insufferable prick whenever I&#8217;ve heard about him doing anything that has anything to do with technology.  As my manager Xxxxxxx likes to say:<\/p>\n<p>&#8220;You can teach just about anyone just about anything, except how NOT to be an asshole.&#8221;<\/p>\n<p>4. Without knowing what virus we were talking about, I can&#8217;t really tell you much more about what may or may not have been possible given a particular type of partition (NTFS or FAT32).  I have no idea why &#8220;K&#8221; would tell you to format with NTFS in order to get rid of a virus.  You can delete and then create new partitions from within the installation for Win2k or XP, there&#8217;s no need to do it from a boot disk under a different version of Dos.<\/p>\n<p>The whole driving force for knowing this stuff should be for the purposes of solving problems and\/or helping people use technology.  If you&#8217;re in it for the &#8220;glory of knowing more than the next guy,&#8221; you&#8217;ve picked the wrong career.  Sooner or later, there&#8217;s going to be someone who knows more than you do, and how stupid you end up looking is based entirely on how you acted when you didn&#8217;t think the other guy knew, either.<\/p>\n<p>And hey, I&#8217;m not perfect, not by a long shot.  I&#8217;ve &#8220;yeah, sure&#8221;d my way through more than my fair share of conversations that were going way over my head.  Being &#8220;in computers&#8221; is kinda like being &#8220;in science:&#8221; it&#8217;s freakin&#8217; HUGE.  There&#8217;s SO much to learn that there&#8217;s really no point in burning bridges with &#8220;if you know all the answers&#8221; sorts of responses.  I might have thought of someone like &#8220;K&#8221; as a trained guy who I could bounce things off of from time to time, except for the simple fact that he would be a jerk about it.  He&#8217;d either lie about knowing, and then say a bunch of stuff that doesn&#8217;t make sense, or he&#8217;d under-explain his answer to intentionally make it look like this should be simple, unless you&#8217;re retarded.<\/p>\n<p>Left you wondering about your skillset, didn&#8217;t it?  Belittling, and demeaning.  For what?  What&#8217;s the point of that?  I hate that attitude, and all the snivelling worms like him that I run into again and again over the years.  They&#8217;re always looking for work somewhere, &#8217;cause they can&#8217;t manage to figure out that being a schmuck doesn&#8217;t equal job security.  Sooner or later, they get caught out not knowing something, and then they freak out and embarrass themselves, their department, and more often than not, their company.<\/p>\n<p>Besides, you never know when you&#8217;re going to meet your next boss.  Being hunted by XX taught me that more surely than just about any other hiring process I&#8217;ve ever been through.  The &#8220;friend of a friend&#8221; network is really tight in Xxxxxxxxx, and it often works very well.<\/p>\n<p>There&#8217;s no such tag as <rant> but there should be.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So I get this thing sent to me a while ago, and didn&#8217;t read through it until today. >&#8221;S&#8221; says:how goes >&#8221;K&#8221; says:meh. same as always. {What a happy camper.} >&#8221;S&#8221; says:i got a question for ya >&#8221;S&#8221; says:what is your favorite way to do a low level format on a >drive that has no [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-87613677","post","type-post","status-publish","format-standard","hentry","category-people"],"_links":{"self":[{"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/87613677","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=87613677"}],"version-history":[{"count":0,"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/87613677\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=87613677"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=87613677"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.geckotemple.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=87613677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}