🚀 go-pugleaf

msp2@midway.uchicago.edu (Michael S. Post) writes:
>I just got a new 486DX, and I partitioned the hard drive, putting DOS
>5.0 into one partition and OS/2 2.0 into the other.  Now, I am having
>problems reading SOME of my high density 1.44" drives when I am in

I am assuming that you have set up a "dual boot" machine with a FAT
structure.  The problems with the high density drives are a dead
giveaway: it could almost be called another indicator of Stoned.

>DOS.  If I format a disk, and then type 'a:' to switch to the drive,
>it tells me it can't read the disk.  Also, some of my old disks can't
>be read.  In OS/2, I can read these same disks and format.  I

Yes, this is a common indicator of the presence of an MS-DOS boot
sector infector.  It'll work under DOS, but will not infect under OS/2
(even though it may possibly be present).

>discovered that when my disks are write protected, they will continue
>working if they already were.  As soon as I remove write protection,
>and the a: drive is used, even just doing a dir, suddenly something is
>damaged.

Quite so.  As long as the diskette is protected, nothing will happen
to it.  However, as you have found, Stoned (and Michelangelo) are very
infectious.  When they infect a disk (and yes, just a DIR can do it)
they reposition the original boot sector to an area that is mostly
unused on low density disks.  Unfortunately, it is vital on high
density floppies.

>When I ran SCAN v.93, it said that it found [Stoned] in memory and
>Michaelangelo in the partition.  Are these viruses causing the problem
>with the disk drive, or is it something else?  Note: my 1.2Mb 5.25"
>drive, b:, is working just fine.

You probably only have one virus, although it is possible to get both.
You should boot your computer from a "known clean system disk" in
order to get the most accurate diagnosis.  You should also scan with
another scanner in addition to SCAN.  F-PROT and VIRx should be widely
available, as should TBSCAN and HTSCAN.

>I renamed autoexec.bat and config.sys, and still booting off of the
>hard drive makes the stoned virus appear in memory.  Where is it
>coming from when I turn on the machine?  The IO.SYS and MSDOS.SYS
>files?  They went through the scanning program OK.  Could my purchased
>install diskettes have a virus?

Stoned (and Michelangelo, which is derived from Stoned) are "boot
sector infectors".  They do not attach to program files on the disk,
but rather replace the boot sector program which has a given position
on every disk.  Specifically, they replace the "master boot
record/sector" on the hard disk, and so they are the first thing to
run when you turn the computer on.  F-PROT should be able to clean it
up for you (unless you have a more complex situation).  DISKSECURE can
also help, as possibly can running "FDISK /MBR".

>Thanks.  PLEASE, if you are responding, send a duplicate back to me.
>Either reply to this address or send e-mail to mpost@math.ucla.edu.
>Thanks again.

I'll try!  :-)

 
==============
Vancouver      ROBERTS@decus.ca         | "If you do buy a
Institute for  Robert_Slade@sfu.ca      |  computer, don't
Research into  rslade@cue.bc.ca         |  turn it on."
User           p1@CyberStore.ca         | Richards' 2nd Law
Security       Canada V7K 2G6           | of Data Security