Article View: alt.comp.virus
Article #61Re: Stoned Virus
From: Jose A. Sobrino Crego
Date: Sat, 30 May 1998 00:00
Date: Sat, 30 May 1998 00:00
79 lines
3902 bytes
3902 bytes
Mitch wrote: > >[...] Stoned is a mbr / boot virus, so it can't infect files. > > The original "stoned" virus did just that BUT it is a very very rare > beast indeed. Early virus developers (for want of a better term :) > used this virus as a building block and it became modified to > the stage where there were hundreds of slightly different versions. > Among these hybrids _were_ executable file infectors. It makes no difference. If the executable file infectors are hybrids,they are not the original stoned virus. And it's not as rare as you think... You'd ve susprised if you knew how many stoned standard infections occur... even today. > >But I think that you don't really have the stoned.standard, because > you > >say the hard disk became useless, and the stoned virus does not harm > >the hard disk at all. > > Can I be pedantic here? The original "stoned" virus was responsible > for data destruction as o/s updates turned an otherwise > innocuous mbr infector into an fully fledged fat killer. > If you wish to argue the point, 1st ask someone with > access to IBM's virus database or (better still) load a > copy of the original stoned virus to any modern o/s > on three different machines. At least one machine should fall over. Well...I don't like to argue, I did not tried to argue and I feeluncomfortable arguing but... 1) Stoned standard infects mbr (cyl 0, head 0, sector 1) and moves the original one to cyl 0, head 0, sector 7. No fat there and no other data in any other sector placed in cyl 0, head 0. The first fat starts in cyl 0, head 1, sector 2. Where's the fat killing, then? 2) I've tested a lot of stoned infections. What's more, I have disassembled it and I have got the code fully commented and annotated. 3) As said before, stoned standard can't harm hard disks by itself... But it can harm FLOPPIES, because it was designed to infect 360 Kb. 5 1/4 inches floppies, storing the original boot in the last sector of the root directory. That can harm 1,2 Mb., 720 Kb. or 1,44 Mb. floppies. I think you should explain why o/s updates can turn the humble stoned into jack the ripper... By the way... what do you mean by 'modern o/s'?... > >May be some version... Get a real good antivirus, > >(forget scan an Mcaffe), find out what virus has infected the hard > disk > >and post your message again. I'll be around to help you. > > What anti virus program do you suggest and why? I suggest AVP, Dr. Solomon, F-Prot. The three of themworking together if possible. Why? Easy. Because I've tested all of them (add scan here) against a collection on 11.000 viruses and they proved to be the best to detect, identify and clean the infected files. Scan got the worse results by far... Anyway, I don't see the point in arguing. I just said stoned standard couldn't harm the hd by itself. Let's wait for an accurate identification... Even though I don't agree with you, yours has been a very interesting reply and mine does not mean to offend you or anybody else in the area. Greetings. -Jose Antonio Sobrino Crego- http://www.geocities.com/SiliconValley/Haven/9955/
Technical Details
Message-ID:
<35706B97.E4458643@ran.es>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10d683,70a58627a995bf35 X-Google-Attributes: gid10d683,public X-Google-Thread: fcd68,70a58627a995bf35 X-Google-Attributes: gidfcd68,public From: "Jose A. Sobrino Crego" <jscrego@ran.es> Subject: Re: Stoned Virus Date: 1998/05/30 Message-ID: <35706B97.E4458643@ran.es> X-Deja-AN: 358014176 Content-Transfer-Encoding: 7bit References: <356AA597.1F258B7D@nettrek.com.au> <356c2214.8549609@news.zeta.org.au> <356C5C6F.ECA04AEB@ran.es> <6kllle$rbd$1@llama.teragen.com.au> X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Organization: Telefonica Transmision de Datos Mime-Version: 1.0 Newsgroups: alt.comp.virus,aus.computers.ibm-pc