how to deactivate TSR ,how could we restore partition table
hi there
i am working on boot sector viruses and antiviruses and making an TSR antivirus using C.
but i have a problem
i can easily make my antivirus reside but how to deactivate it from memory????
one more question..
if a virus destroyes/overwrites/appends/copy anywhere the partition table,how could i restore it back.
thanks.
Last edited by sadat; 03-27-2002 at 01:09 AM.
Hi
Not to sure if you can restore a partition table once it is removed, but check out microsofts web site.
They should have something there, I found the asm to remove any partition there.
And To All Those Opposed, Mmm Well
Hi there,
I havent worked with removing the TSR's from memory but for the other part... You have the partition table located on the disk in some bytes (I would refer my book and get back on it) and what u do is, create a backup copy of those bytes in a file or something. When you need to restore ur partition table, simply re-dump those bytes into their original location.
I hope this would solve the second part of ur problem.
A possibility for the first part of the problem,....
First you reset the Interrupt so that it points to the default interrupt handler (removing ur functions address there) and then use a function like free or something to remove ur program from memory.
Best Regards
