Article View: comp.virus
Article #4739Re: Is this a new virus? (PC)
From: Kevin Marcus
Date: Thu, 24 Dec 1992 07:03
Date: Thu, 24 Dec 1992 07:03
22 lines
1616 bytes
1616 bytes
bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes: >tck@fold.ucsd.edu (Kevin Marcus) writes: > >> I have varients of stoned which copy to 0,0,15, and 0,0,7, as well as a >> few other locations. They do not necessarily copy to the same spot. > >And we have here variants that put the original MBR at 0,0,2 and >0,0,8. This is irrelevant. What is rellevant is that the problem with >Michelangelo occurs exactly because the "standard" Stoned variant put >the original MBR at 0,0,7 - at the same place as Michelangelo, and >because the two viruses do not recognize each other. Oh, come on, it is relevant. The original problem: Disinfection of a Stoned and MIchelangelo infection. Where they move the orig. MBR is quite important, because in one case, it is possible to remove the viruses by pulling the original MBR up, and in the other, it is not. - -- || Kevin Marcus, Computer Virologist. (619)/457-1836; RE-xxx, TSCAN || || INET: tck@bend.ucsd.edu []-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[] || tck@fold.ucsd.edu || All I wanted was a Pepsi... || || datadec@watserv.ucr.edu || And she wouldn't give it to me...||
Technical Details
Message-ID:
<0010.9301051858.AA13030@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!elroy.jpl.nasa.gov!usc!cs.utexas.edu!qt.cs.utexas.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!elroy.jpl.nasa.gov!usc!cs.utexas.edu!qt.cs.utexas.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: tck@bend.ucsd.edu (Kevin Marcus) Newsgroups: comp.virus Subject: Re: Is this a new virus? (PC) Message-ID: <0010.9301051858.AA13030@barnabas.cert.org> Date: 24 Dec 92 07:03:27 GMT Sender: virus-l@lehigh.edu Lines: 22 Approved: news@netnews.cc.lehigh.edu