🚀 go-pugleaf

GLWARNER@samford.bitnet (THE GAR) writes:

> We had a lab machine die in one of our computer labs yesterday.
> SCAN8.7BV95 said it had a "Generic Boot Virus" (real useful stuff, that).

Sigh... Hints to all producers of scanners: Yes, indeed the most
important question that interests the users is "Am I infected or
not?". However, the NEXT important question is "If I am infected,
which virus is it, i.e. what can it do/has done to me?". (The THIRD
question is usually "How do I get rid of it?".) Reports like "Generic
Boot Virus" or "FamilyQ Virus" are not very informative... Users -do-
want exact identification (or at least "almost exact identification",
if we use Frisk's terminology)...

> hits has been mostly due to bad code.  Stoned has garbled many floppies,
> and we have seen Marijuana messages and bouncing balls, but this is the
> first destructive hard drive hit we've seen.

No kidding, you have seen the Marijuana message? On the screen??
Displayed by the virus??? Then you should have a new variant - none of
the ones we have here displays that message. The original virus
displays only the first part - "Your PC is Now Stoned".

> The virus began in Sector 0, and wrote variations of ASCII 0-255 all the
> way through the boot sector and the FAT table.  (Or so it seemed to me

Ah, this explains the "Generic Boot Virus" report... It seems to me
that SCAN is using some kind of heuristics (Aryeh?) and reports a
"generic" boot (or partition) virus each time when something seems
wrong with the boot sector(s) - like missing names of the hidden DOS
files, missing signature (0AA55h), etc. In your case the whole
contents of the boot sector has been destroyed, so its contents has
become obviously "abnormal". This has triggered SCAN's heuristics
(just a wild guess; I'm not certain that it is indeed so).

In your particular case, the crash might not be caused by a virus. It
might be a normal crash, or be caused by a buggy program... It's the
destruction of the contents of the boot sector that has caused the
report about the "Generic Boot Virus", not the "generic boot virus"
has caused the destruction...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany