Article View: alt.comp.virus
Article #54Re: Stoned Virus
From: Paul Ducklin
Date: Thu, 04 Jun 1998 00:00
Date: Thu, 04 Jun 1998 00:00
33 lines
2143 bytes
2143 bytes
> So Stoned copying the original MBR to 0,0,7 should be safe, right? *Should* be. If you believe in "benign viruses", you'll believe that Stoned (or any other MBR virus which overwrites one of the sectors in Track 0 Head 0, usually unused) is benign. No such thing. Viruses are guilty of two crimes under the UK's Computer Misuse Act -- unauthorised access and, worse, unauthorised modification. Just because a virus caused no bad side-effects on the author's machine (if the author tested it, that is) doesn't mean that it will work perfectly on *your* computer should you become infected. Example: back in the days when Stoned was common, there were *lots* of of Olivetti M24s around -- they shipped with a version of Olivetti DOS which started the C: drive at Track 0, Head 0, Sector 2. So 0.0.7 was very much in use (part of the FAT!) on those machines. How wrong you can be when you rely on "should be" :-) No such thing as a "benign virus". So there... Paul Sophos Anti-Virus /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ \ Paul Ducklin - Head of Research - Sophos Anti-Virus / / UK +44-1235-559933 - support@sophos.com - US 1-888-SOPHOS-9 \ \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
Technical Details
Message-ID:
<357703db.2906395@news.demon.co.uk>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au> <35706B97.E4458643@ran.es> <6l1d0k$ej1$1@elrond.sophos.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10d683,70a58627a995bf35 X-Google-Attributes: gid10d683,public X-Google-Thread: fcd68,70a58627a995bf35 X-Google-Attributes: gidfcd68,public From: duck@sophos.com (Paul Ducklin) Subject: Re: Stoned Virus Date: 1998/06/04 Message-ID: <357703db.2906395@news.demon.co.uk> X-Deja-AN: 359614376 X-NNTP-Posting-Host: nota.demon.co.uk:212.228.52.126 References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au> <35706B97.E4458643@ran.es> <6l1d0k$ej1$1@elrond.sophos.com> X-Complaints-To: abuse@demon.net X-Trace: news.demon.co.uk 896997108 nnrp-11:820 NO-IDENT nota.demon.co.uk:212.228.52.126 Organization: Sophos Plc Reply-To: duck@sophos.com Newsgroups: alt.comp.virus,aus.computers.ibm-pc