I have a Windows 95 Upgrade 3.5" DMF installation disk set where several disks were infected by the boot sector virus known as "Chance.A". I'm interested in restoring these to their original contents.
Before rewriting the disks using disk images from another source, I imaged the contents, and started to compare those images with the other set. The affected Disk 1 has
- an altered region at the beginning of the disk including the boot sector,
- a partial backup of the original boot sector code in the normally-zeroed area at relative offset 0x3e00
- a different last 9 digits of the string "/U:xxxxx-xxx-xxxxxxx" (where "x" is a decimal digit) at offset 0x131376, which looks suspiciously like a Product ID although I cannot confirm this, and
- a binary difference around offset 0x15d960.
The first two of these are both things that I would expect to result from the modifications by "Chance.A", but the string difference especially makes me suspect that the disks' contents were different even without the involvement of "Chance.A".
What did Microsoft customize, if anything, on different installation disk sets, either at time of manufacture individually or across different batches / production runs, or through having the installer itself modify the disk contents?
Note: In Microsoft's terminology, a product ID is a sort of serial number that should not be confused with the product key a.k.a. CD-key that must be entered at install time, although for CD-based products the product ID is usually determined by the product key