🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4202

F-Prot's (v2.05) memory scanning. (PC)

#4202
From: J.EDWARDS
Date: Fri, 13 Nov 1992 19:44
20 lines
1425 bytes
After hours of failing to get Windows to install, the owner suddenly
announced he thought his computer might be infected.  I ran F-Prot
straight away and sure enough it announced it had detected 'Stoned' in
memory.  I booted from my clean floppy and when running F-Prot again
it claimed the hard-disk was infected with not 'Stoned' but
'Michaelangelo'.  I assumed the disk must be infected with both but
let F-Prot clean 'Michaelangelo' anyway, expecting the boot sector to
now become infected with 'Stoned'.  (That would be right, wouldn't
it?)  However after this cleaning, and clean booting again, F-Prot
declared the disk clean.

Q's 1) Could his hard disk still infected with 'Stoned' and/or
          'Michaelangelo' and F-Prot can't detect either for some
          reason?

   or 2) Was F-Prot's detection of 'Stoned' in memory actually a
          mis-identification of 'Michaelangelo'?

Jonathan Edwards - MSc. Scientific Computing
                   University of Sunderland - England
Technical Details
Message-ID: <0003.9211161950.AA15221@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!sun-barr!rutgers!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!sun-barr!rutgers!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: cz1jed@orac.sunderland-poly.ac.uk (J.EDWARDS)
Newsgroups: comp.virus
Subject: F-Prot's (v2.05) memory scanning. (PC)
Message-ID: <0003.9211161950.AA15221@barnabas.cert.org>
Date: 13 Nov 92 19:44:40 GMT
Sender: virus-l@lehigh.edu
Lines: 20
Approved: news@netnews.cc.lehigh.edu