🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #54

Re: Stoned Virus

#54
From: Paul Ducklin
Date: Thu, 04 Jun 1998 00:00
33 lines
2143 bytes

> So Stoned copying the original MBR to 0,0,7 should be safe, right?

*Should* be.

If you believe in "benign viruses", you'll believe that Stoned (or any
other MBR virus which overwrites one of the sectors in Track 0 Head 0,
usually unused) is benign. No such thing.

Viruses are guilty of two crimes under the UK's Computer Misuse Act --
unauthorised access and, worse, unauthorised modification. Just
because a virus caused no bad side-effects on the author's machine (if
the author tested it, that is) doesn't mean that it will work
perfectly on *your* computer should you become infected. 

Example: back in the days when Stoned was common, there were *lots* of
of Olivetti M24s around -- they shipped with a version of Olivetti DOS

which started the C: drive at Track 0, Head 0, Sector 2. So 0.0.7 was
very much in use (part of the FAT!) on those machines. 

How wrong you can be when you rely on "should be" :-)

No such thing as a "benign virus". So there...

Paul
Sophos Anti-Virus

   /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
   \  Paul Ducklin   -   Head of Research   -   Sophos Anti-Virus /
   /  UK +44-1235-559933 - support@sophos.com - US 1-888-SOPHOS-9 \
   \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
Technical Details
Message-ID: <357703db.2906395@news.demon.co.uk>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au> <35706B97.E4458643@ran.es> <6l1d0k$ej1$1@elrond.sophos.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d683,70a58627a995bf35
X-Google-Attributes: gid10d683,public
X-Google-Thread: fcd68,70a58627a995bf35
X-Google-Attributes: gidfcd68,public
From: duck@sophos.com (Paul Ducklin)
Subject: Re: Stoned Virus
Date: 1998/06/04
Message-ID: <357703db.2906395@news.demon.co.uk>
X-Deja-AN: 359614376
X-NNTP-Posting-Host: nota.demon.co.uk:212.228.52.126
References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au> <35706B97.E4458643@ran.es> <6l1d0k$ej1$1@elrond.sophos.com>
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 896997108 nnrp-11:820 NO-IDENT nota.demon.co.uk:212.228.52.126
Organization: Sophos Plc
Reply-To: duck@sophos.com
Newsgroups: alt.comp.virus,aus.computers.ibm-pc