🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #67

Re: Stoned Virus

#67
From: Maryse Dumas
Date: Wed, 27 May 1998 00:00
250 lines
9118 bytes

--------------E630FF859DCFB15E3D4BCB40
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit

Hello -

Stoned virus is a strange one that can cause severe damages...

If infects fixed disk partition table, floppy diskette boot sector and
installs himself in memory.

It can corrupts directly or not file linkage, corrupts or overwrites boot
sector and affects system run-time operation.

Try this procedure (it helped me get rid of "a Stoned virus epydemia" in one
of our classroom PC lab for our students few years ago):


  1. 1 -    Back-up all critical files that you don't want to lose (only
     non-systems files)
  2. 2 -    Turn off your computer
  3. 3 -    Restart it from a clean boot diskette
  4. 4 -    Use CLEAN  program to clean disk
  5. 5 -    Turn off computer
  6. 6 -    Turn it on with a clean boot diskette
  7. 7 -    Do a low-level format of the hard drive
  8. 8 -    Do FDISK command
  9. 9 -    Do FORMAT C: /S
 10. 10-    Turn off computer
 11. 11-    Restart it without boot diskette
 12. 12-    Reinstall complete MS DOS and others softwares
 13. 13-    Copy your backup files

N.B. If CLEAN program doesn't work, try find M-DISK utility (an older program,
done by McAfee)...

I hope these steps can help you and your friend.


--
Maryse Dumas
Technicienne en informatique
Services administratifs (informatique)
Coll�ge de Sherbrooke
Sherbrooke, Qc
Canada
e-mail:dumasma@collegesherbrooke.qc.ca



Kurt Wismer wrote:

> Irene Lowe (icypole@nettrek.com.au) wrote:
> : Hello to everyone,
>
> : I have a strange problem.  A friend has an old XT. It somehow was
> : infected with the Stoned virus and after a few months of use, the
> : computer became useless.
>
> : She asked me to fix the problem and it turned out to be the virus.
> : Because the unit still uses 5 1/4 inch floppies, I was able to find an
> : old version of McAfee's Virus Scan and Virus Clean which would work on
> : her machine. I completely scanned and cleaned the hard drive and also
> : all the 5 1/4 inch floppies she had.
>
> : A few months down the track and it appears that the virus has returned
> : from nowhere.  I scanned the hard drive and there it was again.  There
> : was no way that she could have used an infected floppy disk in the drive
> : and I am at a loss as to how the virus could have reinfected itself on
> : the hard drive. I cleaned it again two weeks ago and she has phoned me
> : tonight to tell me that the computer is doing silly things again. I
> : suspect that the virus had done it again! Does this virus has a way of
> : recreating itself once you have cleaned the suspect disks?
>
> 3 possibilities as i see it...
>
> 1) a dropper is present (a dropper is a program that injects the virus
> into the clean system)..
> 2) scan/clean didn't really clean the machine or there was a disk that
> was missed or otherwise not cleaned...
> 3) amazing as it sounds perhaps she's (or someone else) using her disks in
> another (infected) machine that you've as yet not been made aware of...
>
> : If anyone could help me solve this puzzle, please can you email me
> : directly (to save the sanity of my poor friend!)
>
> for number one, try a different scanner - droppers attempt to hide the
> virus but they don't necessarily succeed to hide it from all scanners...
> for number 2, try a different (or newer) scanner again...
> for number 3, grill her and anyone else who could possibly get access to
> the computer - apply a thin layer of barbeque sauce, turn, and then grill
> the other side...
>
> : Thanks all.
>
> you're welcome, hope this helps...
> --
> "do as i say not as i do because
>  the shit so deep you can't run away
>  i beg to differ on the contrary
>  i agree with every word that you say"




--------------E630FF859DCFB15E3D4BCB40
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<HTML>
Hello -

<P>Stoned virus is a strange one that can cause severe damages...

<P>If infects fixed disk partition table, floppy diskette boot sector and
installs himself in memory.

<P>It can corrupts directly or not file linkage, corrupts or overwrites
boot sector and affects system run-time operation.

<P>Try this procedure (it helped me get rid of "a Stoned virus epydemia"
in one of our classroom PC lab for our students few years ago):
<BR>&nbsp;
<OL>
<LI>
1 -&nbsp;&nbsp;&nbsp; Back-up all critical files that you don't want to
lose (only non-systems files)</LI>

<LI>
2 -&nbsp;&nbsp;&nbsp; Turn off your computer</LI>

<LI>
3 -&nbsp;&nbsp;&nbsp; Restart it from a clean boot diskette</LI>

<LI>
4 -&nbsp;&nbsp;&nbsp; Use CLEAN&nbsp; program to clean disk</LI>

<LI>
5 -&nbsp;&nbsp;&nbsp; Turn off computer</LI>

<LI>
6 -&nbsp;&nbsp;&nbsp; Turn it on with a clean boot diskette</LI>

<LI>
7 -&nbsp;&nbsp;&nbsp; Do a low-level format of the hard drive</LI>

<LI>
8 -&nbsp;&nbsp;&nbsp; Do FDISK command</LI>

<LI>
9 -&nbsp;&nbsp;&nbsp; Do FORMAT C: /S</LI>

<LI>
10-&nbsp;&nbsp;&nbsp; Turn off computer</LI>

<LI>
11-&nbsp;&nbsp;&nbsp; Restart it without boot diskette</LI>

<LI>
12-&nbsp;&nbsp;&nbsp; Reinstall complete MS DOS and others softwares</LI>

<LI>
13-&nbsp;&nbsp;&nbsp; Copy your backup files</LI>
</OL>
N.B. If CLEAN program doesn't work, try find M-DISK utility (an older program,
done by McAfee)...

<P>I hope these steps can help you and your friend.
<BR>&nbsp;

<P>--
<BR>Maryse Dumas
<BR>Technicienne en informatique
<BR>Services administratifs (informatique)
<BR>Coll&egrave;ge de Sherbrooke
<BR>Sherbrooke, Qc
<BR>Canada
<BR>e-mail:dumasma@collegesherbrooke.qc.ca
<BR>&nbsp;
<BR>&nbsp;

<P>Kurt Wismer wrote:
<BLOCKQUOTE TYPE=CITE>Irene Lowe (icypole@nettrek.com.au) wrote:
<BR>: Hello to everyone,

<P>: I have a strange problem.&nbsp; A friend has an old XT. It somehow
was
<BR>: infected with the Stoned virus and after a few months of use, the
<BR>: computer became useless.

<P>: She asked me to fix the problem and it turned out to be the virus.
<BR>: Because the unit still uses 5 1/4 inch floppies, I was able to find
an
<BR>: old version of McAfee's Virus Scan and Virus Clean which would work
on
<BR>: her machine. I completely scanned and cleaned the hard drive and
also
<BR>: all the 5 1/4 inch floppies she had.

<P>: A few months down the track and it appears that the virus has returned
<BR>: from nowhere.&nbsp; I scanned the hard drive and there it was again.&nbsp;
There
<BR>: was no way that she could have used an infected floppy disk in the
drive
<BR>: and I am at a loss as to how the virus could have reinfected itself
on
<BR>: the hard drive. I cleaned it again two weeks ago and she has phoned
me
<BR>: tonight to tell me that the computer is doing silly things again.
I
<BR>: suspect that the virus had done it again! Does this virus has a way
of
<BR>: recreating itself once you have cleaned the suspect disks?

<P>3 possibilities as i see it...

<P>1) a dropper is present (a dropper is a program that injects the virus
<BR>into the clean system)..
<BR>2) scan/clean didn't really clean the machine or there was a disk that
<BR>was missed or otherwise not cleaned...
<BR>3) amazing as it sounds perhaps she's (or someone else) using her disks
in
<BR>another (infected) machine that you've as yet not been made aware of...

<P>: If anyone could help me solve this puzzle, please can you email me
<BR>: directly (to save the sanity of my poor friend!)

<P>for number one, try a different scanner - droppers attempt to hide the
<BR>virus but they don't necessarily succeed to hide it from all scanners...
<BR>for number 2, try a different (or newer) scanner again...
<BR>for number 3, grill her and anyone else who could possibly get access
to
<BR>the computer - apply a thin layer of barbeque sauce, turn, and then
grill
<BR>the other side...

<P>: Thanks all.

<P>you're welcome, hope this helps...
<BR>--
<BR>"do as i say not as i do because
<BR>&nbsp;the shit so deep you can't run away
<BR>&nbsp;i beg to differ on the contrary
<BR>&nbsp;i agree with every word that you say"</BLOCKQUOTE>
&nbsp;
<BR>&nbsp;</HTML>

--------------E630FF859DCFB15E3D4BCB40--
Technical Details
Message-ID: <356C64CD.4172A52C@CollegeSherbrooke.qc.ca>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <356AA597.1F258B7D@nettrek.com.au> <EtMLso.28q.0.queen@torfree.net>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII
X-Google-Thread: 10d683,70a58627a995bf35
X-Google-Attributes: gid10d683,public
X-Google-Thread: fcd68,70a58627a995bf35
X-Google-Attributes: gidfcd68,public
From: Maryse Dumas <Dumasma@CollegeSherbrooke.qc.ca>
Subject: Re: Stoned Virus
Date: 1998/05/27
Message-ID: <356C64CD.4172A52C@CollegeSherbrooke.qc.ca>
X-Deja-AN: 357049866
References: <356AA597.1F258B7D@nettrek.com.au> <EtMLso.28q.0.queen@torfree.net>
MIME-Version: 1.0
NNTP-Posting-Date: Wed, 27 May 1998 15:10:49 EDT
To: Kurt Wismer <cr764@torfree.net>, Irene Lowe <icypole@nettrek.com.au>
Content-Type: multipart/alternative; boundary="------------E630FF859DCFB15E3D4BCB40"
Organization: College de Sherbrooke
Newsgroups: alt.comp.virus,aus.computers.ibm-pc