🚀 go-pugleaf

KENNEY%NBECC.decnet@consrt.rockwell.com (NBECC::KENNEY) writes:

> - - are StarDot and V801 related?

I have no idea what NAV calls "V801", but the StarDot virus indeed has
such variant. In fact, it has variants with infective lengths 600,
789, and 801. Assuming that NAV calls StarDot.801 "V801", I suspect
that it has messed the two StarDot variants - StarDot.789 and
StarDot.801.

BTW, please not that this virus "pads" the files before infection in
such a way, that their size becomes a multiple of 16. Therefore, while
the length of the virus is 600/789/801 bytes, it can add more than
this amount of bytes to the infected files.

> - - how stealthy was Michaelangelo, and does it survive warm boots?

It isn't stealth at all, and it does NOT survive warm boots.

> - - can you tell where the start and end of an infected file are supposed to
> be algorithmically, so that one routine could trim off all length-variants of
> one or more virii?

Umm... it depends on the particular virus. For some viruses you can,
for some you cannot restore the original file exactly. The StarDot
viruses are one example of viruses, for which it is not possible to
restore the file size exactly. Another example is the good old
Jerusalem - you cannot disinfect more EXE files correctly.

Therefore, it is always a good idea not to rely on disinfection, but
simply to delete all infected files and to restore them from clean
backups.

> 	Since Stoned + Michaelangelo = bye-bye FAT, this is getting

No, Stoned + Michelangelo = bye-bye boot sector, not FAT. The FAT is
damaged only no some (almost not used today) hard disks, and for these
hard disks you don't need both viruses - either of them will do...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany