The way this works is by them inserting code in the rest of the first track
to load a program from the last few tracks. The only sector used on the
first track is the partition table in the first sector. By making the last
few tracks unavailable for partitions there is room to hide their code. This
does require that the program be complete... i.e. no dependencies. This type
of program is usually written in C or assembly. The hidden parts are the
monitoring and email functions. The reporting functions are in a normal
partition and can be deleted. Hope this explains the concept of this type of
program.

-----Original Message-----
From: Satyajeet Hattangadi [mailto:satyajh@m...]
Sent: Wednesday, February 26, 2003 5:36 AM
To: professional vb
Subject: [pro_vb] Re: A very challenging query

Hi Grau,

A little skepticism is expected im sure, but what im actually trying to do
is a security app thats a clone of pcphonehome, with some variations.So if
the laptop gets stolen the legit user is sent a mail.
I repeat its *NOT* a virus

I know fdisk deletes file allocation tables.

By other drives do you mean physical drives or logical partitions??

> But if you wish to prevent it on an other drive, there are several ways to
do this.

Im interested in this approach you havent elaborated on..

Cheers
Satya

----- Original Message -----
From: "Grau Kilian (rds)" <rds@a...>
To: "professional vb" <pro_vb@p...>
Sent: Wednesday, February 26, 2003 3:49 PM
Subject: [pro_vb] Re: A very challenging query

>
>
>
>
>
> Re: [pro_vb] A very challenging query
>
>
>
> Sure this is a Security App and not a Virus *lol*
>
>
> I think you install you app on c.
> So there is no way because this person will use a DOS Shell to reorganise
the HD.
> But if you wish to prevent it on an other drive, there are several ways to
do this.
>
>
> Fdisk is deleting the File Location Table and so there is no way to
prevent it
>
>
> cheers Kilian
>
>
> -----Ursprüngliche Nachricht-----
> Von: Satyajeet Hattangadi [mailto:satyajh@m...]
> Gesendet: Mittwoch, 26. Februar 2003 10:18
> An: professional vb
> Betreff: [pro_vb] A very challenging query
> Wichtigkeit: Hoch
>
>
>
> Hi,
> I'm not even sure if this is possible, but definitely worth asking.
> I'm writing an application that i will install on all users PC's. App
starts up automatically on startup, and cant be seen using ctrl-alt-del.
>
> Before you you guys get any wrong idea, this is not a virus but a security
application.
>
>
> Now my question.
> Is there anyway of preventing my app from getting deleted when the HDD is
formatted using fdisk ?
>
>
> There is a software at http://www.pcphonehome.com that says it can do
so... but they arent letting me in on the so called protection mechanism.
>
> Any pointers/ wild ideas/ urls welcome....
>
>
> Guys ill try anything ....as long as its software based...
>
>
> Thanks
> Satya
>
>
> ----- Original Message -----
> From: "Clif Dunaway" <csdunaway@y...>
> To: "professional vb" <pro_vb@p...>
> Sent: Tuesday, February 25, 2003 10:53 PM
> Subject: [pro_vb] Re: Net Send Command?
>
>
> > Yes, I would like to know more about how to use NetMessageBufferSend.
> > Clif Dunaway
> >
> >
> > Satyajeet Hattangadi <satyajh@m...> wrote:Hey Rekha..
> > A more efficient way would be to to use the NetMessageBufferSend call
from
> > netapi32.dll
> > If you need an example let me know
> > Cheers,
> > Satya
> >
> > ----- Original Message -----
> > From: "Rekha"
> > To: "professional vb"
> >
> > Sent: Monday, February 24, 2003 9:36 PM
> > Subject: [pro_vb] Re: Net Send Command?
> >
> > > Thanks. Got it.
> > > Rekha
> > >
> > > > Here's one way:
> > > S> hell "NET SEND ComputerNameOrIPAddress TextMessage"
> > >
> > > > > Hi All,
> > >
> > > > > I am checking for all the services that are running on a server
and if
> > > a
> > > p> > articular service of interest is down, I have to execute the "Net
> > > send"
> > > c> > ommand to the networking guy and the administrator, informing
that
> > > the
> > > s> > ervice is down. I am able to list all the services running on the
> > > s> erver
> > > a> > s of now.
> > >
> > > > > For Each objService In colListOfServices
> > > > > If (StrComp(objService.Name, "RSVP") And StrComp
> > > (> > objService.State, "Stopped")) Then
> > > > > NetSend("admin", "RSVP service is down")
> > > > > Exit For
> > > > > End If
> > > > > Next
> > >
> > > > > The NetSend function call is something I have assumed. So, what
should
> > > g> o
> > > t> > here? How can I execute "Net Send" command via a vb app?
> > >
> > > > > Thanks,
> > > R> > ekha.
> > >
> >
> > *********************************************************
> > Disclaimer
> >
> > This message (including any attachments) contains
> > confidential information intended for a specific
> > individual and purpose, and is protected by law.
> > If you are not the intended recipient, you should
> > delete this message and are hereby notified that
> > any disclosure, copying, or distribution of this
> > message, or the taking of any action based on it,
> > is strictly prohibited.
> >
> > *********************************************************
> > Visit us at http://www.mahindrabt.com
> >
> >
> >
> >
> >
> >
>
>
> *********************************************************
> Disclaimer
>
>
> This message (including any attachments) contains
> confidential information intended for a specific
> individual and purpose, and is protected by law.
> If you are not the intended recipient, you should
> delete this message and are hereby notified that
> any disclosure, copying, or distribution of this
> message, or the taking of any action based on it,
> is strictly prohibited.
>
>
> *********************************************************
> Visit us at http://www.mahindrabt.com
>
>
>
>
>
>
>
>
>
>

*********************************************************
Disclaimer

This message (including any attachments) contains
confidential information intended for a specific
individual and purpose, and is protected by law.
If you are not the intended recipient, you should
delete this message and are hereby notified that
any disclosure, copying, or distribution of this
message, or the taking of any action based on it,
is strictly prohibited.

*********************************************************
Visit us at http://www.mahindrabt.com