🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #61

Re: Stoned Virus

#61
From: Jose A. Sobrino Crego
Date: Sat, 30 May 1998 00:00
79 lines
3902 bytes
Mitch wrote:

> >[...] Stoned is a mbr / boot virus, so it can't infect files.
>
> The original "stoned" virus did just that BUT it is a very very rare
> beast indeed. Early virus developers (for want of a better term :)
> used this virus as a building block and it became modified to
> the stage where there were hundreds of slightly different versions.
> Among these hybrids _were_ executable file infectors.

It makes no difference. If the executable file infectors are
hybrids,they are not the original stoned virus. And it's not as rare as
you
think... You'd ve susprised if you knew how many stoned
standard infections occur... even today.

> >But I think that you don't really have the stoned.standard, because
> you
> >say the hard disk became useless, and the stoned virus does not harm
> >the hard disk at all.
>
> Can I be pedantic here? The original "stoned" virus was responsible
> for data destruction as o/s updates turned an otherwise
> innocuous mbr infector into an fully fledged fat killer.
> If you wish to argue the point, 1st ask someone with
> access to IBM's virus database or (better still) load a
> copy of the original stoned virus to any modern o/s
> on three different machines. At least one machine should fall over.

Well...I don't like to argue, I did not tried to argue and I
feeluncomfortable arguing but...

1) Stoned standard infects mbr (cyl 0, head 0, sector 1)
and moves the original one to cyl 0, head 0, sector 7. No
fat there and no other data in any other sector placed in
cyl 0, head 0. The first fat starts in cyl 0, head 1, sector 2.
Where's the fat killing, then?

2) I've tested a lot of stoned infections. What's more,
I have disassembled it and I have got the code fully
commented and annotated.

3) As said before, stoned standard can't harm hard disks
by itself... But it can harm FLOPPIES, because it was
designed to infect 360 Kb. 5 1/4 inches floppies, storing
the original boot in the last sector of the root directory.
That can harm 1,2 Mb., 720 Kb. or 1,44 Mb. floppies.

I think you should explain why o/s updates can turn
the humble stoned into jack the ripper... By the way...
what do you mean by 'modern o/s'?...

> >May be some version... Get a real good antivirus,
> >(forget scan an Mcaffe), find out what virus has infected the hard
> disk
> >and post your message again. I'll be around to help you.
>
> What anti virus program do you suggest and why?

I suggest AVP, Dr. Solomon, F-Prot. The three of themworking together if
possible. Why? Easy. Because I've
tested all of them (add scan here) against a collection on
11.000 viruses and they proved to be the best to detect,
identify and clean the infected files. Scan got the worse
results by far...

Anyway, I don't see the point in arguing. I just said stoned
standard couldn't harm the hd by itself. Let's wait for
an accurate identification...

Even though I don't agree with you, yours has been a
very interesting reply and mine does not mean to
offend you or anybody else in the area.

Greetings.

-Jose Antonio Sobrino Crego-
http://www.geocities.com/SiliconValley/Haven/9955/
Technical Details
Message-ID: <35706B97.E4458643@ran.es>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10d683,70a58627a995bf35
X-Google-Attributes: gid10d683,public
X-Google-Thread: fcd68,70a58627a995bf35
X-Google-Attributes: gidfcd68,public
From: "Jose A. Sobrino Crego" <jscrego@ran.es>
Subject: Re: Stoned Virus
Date: 1998/05/30
Message-ID: <35706B97.E4458643@ran.es>
X-Deja-AN: 358014176
Content-Transfer-Encoding: 7bit
References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au>
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Organization: Telefonica Transmision de Datos
Mime-Version: 1.0
Newsgroups: alt.comp.virus,aus.computers.ibm-pc