Partition Virus/Non-system Drive Virus

[Victor S]

I don't think much about virii because I image my system, and can always put it back to before the virus hit. Always worked perfectly.
I use Win firewall and MSE.
But I've heard there are virii that partition the HD or SSD.
And virii that go to non-system drives.
Anybody actually run across one of these?
I want to be prepared.
Is there a recommended remedy - or precautionary measure - for recovering from a virus that creates a partition or infects a non-system drive?
I might already be doing it with my imaging and data backup strategy, but don't understand the partition virus. Would that partition be visible doing a restore, or is there a specific method to detect it?

 

[Borg 386]

The Alureon virus and some older variants of Sirefef will place a cloaked, boot partition at the end of the drive. These usually don't show up in the Disk management, but using a boot partition manager, like G Parted will reveal them. The hidden partition is generally 1 - 3 MB in size, although these can be as big as 10MB.

The recommended action for most boot viruses nowadays is to also wipe the drive before reinstalling to eliminate any such hidden partitions.

 

[Victor S]

Thanks for the info, Borg 386. Looks like I should try out G Parted and perhaps make it part of my image restore process. I've been thinking I should have a partition tool handy in any case.