🚀 go-pugleaf

tck@fold.ucsd.edu (Kevin Marcus) writes:

> trinh@camins.camosun.bc.ca writes:
> >[description of a typical Stoned+Michelangelo problem deleted]

> It looks like you had a multiple infection.  Stoned and it's varients
> (Michelangelo is one...) don't always copy the MBR to the same spot.

No, the problem is cause by exactly the opposite - both Stoned and
Michelangelo copy the MBR to exactly one and the same spot (on the
hard disk), which results in the original MBR being lost.

> Michelangelo finds it's way onto your system; your MBR at 0,0,0 is
> moved to 0,0,7.  Shortly after, some copy of Stoned decides to find
> its way there, too, moving 0,0,0 (which is Michelangelo) to 0,0,15.
>  
> Now, upon a normal boot, the sectors are executed like:
> 0,0,0  (Stoned)
> 0,0,15 (Michelangelo)
> 0,0,7  (Real MBR)
>  
> Removal of this can be funny because some varients of Stoned store
> the real MBR at 0,0,7, as well as Michelangelo.  What probbaly

Removal of the above is very easy: you read 0,0,0, see Stoned in it,
get 0,0,7 and put it at 0,0,0. Since (according to your description),
it contains the real MBR, the problem is solved.

> tried to remove the real mbr.  (Though I don't know why this is so,
> since Mich uses sector 7, if my memory serves me right).

Correct, so in reality this is what happens:

1) Clean disk:

	0,0,0	(Real MBR)
	0,0,7	(unused)

2) After a Michelangelo infection:

	0,0,0	(Michelangelo)
	0,0,7	(Real MBR)

3) Now comes a Stoned infection:

	0,0,0	(Stoned)
	0,0,7	(Michelangelo, put there by Stoned, overwriting the
		 real MBR)

4) A scanner sees Stoned in the MBR and tries to remove it, by
restoring what it believes is the real MBR from 0,0,7 (where Stoned
puts it):

	0,0,0	(Michelangelo - fetched from 0,0,7 by the remover)
	0,0,7	(Michelangelo - still there, unless wiped out)

5) The scanners no sees the Michelangelo and tries to remove it by
restoring what it believes is the real MBR from 0,0,7 (where
Michelangelo puts it):

	0,0,0	(Michelangelo - fetched from 0,0,7 by the remover)
	0,0,7	(Michelangelo - still there)

And so on ad infinitum...

If the remover is smart enough, it will wipe out the sector at 0,0,7
at step 4. Also, at step 5 it will figure out that the sector at 0,0,7
now is wiped out and contains no valid MBR (this is what F-Prot does).
Now, if the remover is -really- smart, it will install a valid MBR
program that it carries with it, just for such cases... Of course,
there are some pitfalls with preserving the partition table data, but
they can be dealt with... Does anybody know a scanner that is that
smart?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany