Conference noted::ibmpc-95

3011.0. "netware virus, ODS, recovery" by CPEEDY::BRADLEY (Chuck Bradley) Thu May 15 1997 18:06

this is a long request. if i knew exactly what to ask for i'd be able
to make it shorter, or even solve the problem without asking.

i'm looking for information about the on disk structure of netware,
the recovery from disk corruption errors in netware, and the effect
of viruses on netware.  

i've read the directory of the netware conference.
i've searched this one for netware and virus without finding anything.
this posting is here rather than there because i suspect the answer is
more likely to be here than there.  i'll move it if necessary.
there might be something in the security_information conference, but
i've not been able to get to it for two days.

pathworks server engineering produces lanman and netware servers
than run on vms and unix.  the netware server on vms is intended to
be compatible with netware 3.11, a very old version.
we keep a native netware 3.11 server on a 486 box. 
it is our reference functional spec for what we should build.
it is the center of our test system, holding test scripts and 
benchmark results.
it is perhaps a real file server with real data from an unknown
number of users on it.

i seem to have inherited it. as far as anyone knows it has never been
backed up.  i managed to copy the test info to a vms disk.  then the netware
system died.  i hope i can restore the data, but it is not a sure thing.

the system was in use, testing a vms server with scripts copied to
several DOS clients, when it froze up.  no errors on the screen.
no log files that i could find. i rebooted it.  several days later
it froze again. a few repeats. then one day the reboot failed while
starting netware.  

the system, a DECpc 466d2 LP, contains a single 500M disk.
there is a 20M DOS partition.  FDISK knows nothing about the rest.
the rest is supposed to be a netware partition.  

the reboot gets dos up ok.  the autoexec.bat is simple. it sets the prompt,
does a cd to the directory containing the netware exe, and runs that
exe.  the netware program can not find its initialization file so it
asks for its name and address. then it reports a failure in mirroring.

mirroring is similar to vms shadow sets. it is a duplicate disk on the
same controller.  the system has only one disk, so this is apparently
an error.  

all of the netware utility programs are stored in a netware volume
(the equivalent of a lanman share) called sys, in the netware partition.
none of them can be found when i try to run them. that makes sense,
since the partition is not present.

novell recommends keeping some recovery tools in the dos directory.
of course, they were not present.  i recovered them from the installation
kit and tried to use them.

VREPAIR is specifically recommended to recover from mirror errors.
when i run it, it does not see any netware partitions.
MONITOR is recommended to get low level information about the system.
the disk option sees nothing.

the situation seems similar to a boot sector virus in dos.
could the netware partition be clobbered by a boot sector virus?
is there a simple remedy, like there is for dos?
if i have to rebuild it by hand, what does the missing stuff look like?
what tools let me get at the magic sectors that are outside the 
dos partition?

again, my apologies for the length of the topic and for the many questions,
and thanks in advance for any answers, pointers, hints, or suggestions.

Hi,

Slighty off topic: The implementation of NetWare on OpenVMS is even slightly
older than v3.11 Native NetWare. The PathWORKS (NetWare) release notes list it
as Portable NetWare v3.01b. It means you don't have some frills which 3.11 now
does.

As for your immediate problem... the NetWare file system is like DOS in that
it is susceptable to corruption. If you have had server hangs, or abends
during the period before the machine died I would consider it a possibility
that your system was becoming unstable due to a hardware fault which
eventually
claimed the NetWare partition. If the partition is still listed under FDISK as
"non-dos partition" then perhaps it is salvagable. If it is listed as "free
space" then you may want to enlist the services of a dedicated data recovery
beaureau.

If you have the original media (which you should... check under that cupboard
;] )
then you may have some success by attempting an installation and electing to
use the existing partition as the NetWare partition. This may be the most
direct route to recovery.

Logging a call with Novell is always an option - they only charge $200 per
incident. Their stance on supporting NetWare 3.11 I believe is that they
still do it because of NetWare 3.11 SFT III.

Of course my cost center is happy to take your money too if you need a bit of
assistance with a reinstall (on a best effort basis - data recovery is very
murky water and not guaranteed) ;]

A common problem (not necessarily YOUR problem, but consider it) is with IDE
drives which have been working for the last 3 or 4 years "suddenly" failing.
Be aware that your hardware could be the limiting factor in any activity you
chose the undertake during troubleshooting this issue.

My thoughts.

Regards,
Adrian Moore

[Posted by WWW Notes gateway]

thanks for the reply.

the server was unstable for months.  once every few weeks to twice per
day it would issue a fatal error message and die.  the message included 
a partial stack dump.  some netware db claimed it was a memory/mb/cpu
problem.  first we changed the memory. that had no discernable impact.
finally we moved the disk into a new system.  there was no indication of
trouble for about a month.  then the system seemed to freeze up occasionally.

i'm installing netware on a new disk in the same system. then i'll compare
the old disk to the new and discover what is different.  perhaps it will
be possible to fix the old disk.  i have not yet figured out how to
do the comparison, but there is probably some shareware tool to do it.

the space that used to be the netware partition is listed as free by fdisk.

i ran the few nondestructive diagnotics i could find on the old disk
and got no signs of errors.  i also checked the new disk and got no
errors, including from the netware destructive surface scan.

after i get netware back in operation, i'll shutdown more frequently
and run diagnostics.

thanks again for your thoughts.