Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!samsung!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: maven@rata.vuw.ac.nz (Jim Baltaxe)
Newsgroups: comp.virus
Subject: Re: How safe are FTP sites from viruses?
Message-ID: <0009.9011261543.AA06200@ubu.cert.sei.cmu.edu>
Date: 19 Nov 90 21:51:29 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 32
Approved: krvw@sei.cmu.edu

mitchell@thesis1.hsch.utexas.edu (Philip Mitchel) writes:
>The question was asked, "How safe are anonymous FTP sites from
>viruses"?  I'd like to know the answer as well.  A user at our site
>just retrieved some text files from the anonymous ftp server at
>apple.com and found that her floppies began to be corrupted.  McAfee's
>virus scan identified the Stoned virus in the partition table.  The
>only known route of "infection" was the ftp connection.

     Just a reminder that the Stoned virus is a boot sector invader
     and executes only when a machine is booted from an infected disk.
     Simply running _any_ program whether FTP'd or not will not result
     in activating this virus. Therefore, there must have been another
     route of infection (vector?). For beginners (aren't we all...)
     tell people never to leave a disk in a drive when you turn a
     machine either on or off. On is obvious - to avoid executing a
     boot sector virus (this can happen even if the diskette is not
     a system disk). Off is included simply to prevent people from
     forgetting to take it out before they turn the machine on again.

>     By the way, what is the usual process for removing a virus such
>as this once found?  (I know, rank beginner question...we all start
>somewhere).  Thanks.

     Most of the major anti-virals will find and remove the stoned virus
     but if you want a specific for the Stoned virus, try using our
     NOSTONE.EXE which is available for anonymous FTP from several
     sites including our own, rata.vuw.ac.nz. Get /pub/nostone.exe.

Jim Baltaxe - MAVEN@vuw.ac.nz
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
There are some days when I can't be sure whether life is trying to
pass me by or trying to run me over.