🚀 go-pugleaf

 
The Gipsy Scholar (Bruce Bathurst, bathurst@phoenix.princeton.edu),
writes:

> Last week a friend asked me to fix a floppy--an original disk from 
> a commercial program.  The boot record (and following sector) had 
> unusual code, so I suspected a boot-record virus.  Because no 
> messages were displayed on his screen, I guessed it was the Stoned 
> virus, and checked the spot it places the correct boot record.  
> There was code--out of place--but different from the correct boot 
> code and different from that in the first sector.  This was 
> Michelangelo.  The poor floppy caught one, then the other.

Fortunately, computer virus "infections" are fairly rare occurrences.
Double computer virus "infections" are even rarer.  A mad dog could 
have bitten your friend, and the dog could have been rabid, and 
there might not have been any good vaccine left in the hospital, and 
the power went down at the same time, so that the hospital couldn't 
get any fresh vaccine, and your friend may have died as a result. 

But I am not going to loose any sleep over mad dogs because of
such possibility.

The operation you suggest (re-activating the Michelangelo while 
cleaning the Stoned infection), while theoretically possible, has 
seldom caused an actual problem in the field that I am aware of. 
Do you know of any verifiable, documented case(s) which could be 
confirmed by an independent observer?  (I don't mean the double 
infection - I do believe you found one, and I've seen some myself, 
mostly experimental, but I mean that "reactivation" you suggest. )

> BTW, the little program in the boot record is run not only during 
> booting, but any time the computer needs to know what medium is in 
> the drive.  This is why disks copy-protected with an odd format 
> don't surprise your computer.  In principle, if you insert a 
> floppy with a boot-record infection and type "C:\DOS>dir a:", 
> your machine can be infected.

I believe the =code= written in the diskette's Boot Sector gets 
executed only during a booting process or attempted booting process.
At other times, i.e., when reading the disk to see what kind of disk 
it is, there is no execution of code. There's only reading of =data=, 
which the boot sector also contains. If the =data= is incorrect, the
system might assume some weird things about the disk, but no boot
sector code gets executed just from reading it for information
purposes (i.e., to determine disk size, type, etc.)

Once a virus becomes TSR on the system, all kinds of things can 
happen when you access a diskette, because accessing a disk is 
executing =code=, the system's (BIOS) code, to read the boot sector 
=data=, but NOT EXECUTING THE BOOT SECTOR CODE.  So initial 
infection from the diskette to the system does not take place the 
way you suggest.  

( Unless somebody just discovered a new way to accomplish it! <g>. )