🚀 go-pugleaf

The Gipsy Scholar (Bruce Bathurst, bathurst@phoenix.princeton.edu),
writes:

> Last week a friend asked me to fix a floppy--an original disk from 
> a commercial program.  The boot record (and following sector) had 
> unusual code, so I suspected a boot-record virus.  Because no 
> messages were displayed on his screen, I guessed it was the Stoned 
> virus, and checked the spot it places the correct boot record.  
> There was code--out of place--but different from the correct boot 
> code and different from that in the first sector.  This was 
> Michelangelo.  The poor floppy caught one, then the other.

Well, you are not the first person to have this problem - I have seen several
reports of it elsewhere.  The "Stoned" virus has been around for a long time,
and with Michelangelo slowly becoming more common, others will have it too.

The real problem starts when a hard disk gets infected by both, as the
viruses attempt to relocate the original MBR to the same location (0,0,7),
with the result that wen the second virus infects the system, the original
MBR is lost, and the machine becomes non-bootable, which is usually how
the double-infection is discovered :-)

It is not a proper double-infection, though, as the viruses are not
compatible with each other, but as I said it happens occasionally.

> don't surprise your computer.  In principle, if you insert a 
> floppy with a boot-record infection and type "C:\DOS>dir a:", 
> your machine can be infected.

Well, no ... the boot sector is read into memory, and if you run a virus
scanner it may report "Stoned was found in memory", but the machine is not
infected.

It is *possible* to become infected just by giving a DIR command, but only
by using a really weird trick when creating the diskette originally, which
I will not (for obvious reasons) describe here. 

-- 
--
Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801