Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!usc!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: dkrause@orion.oac.uci.edu (Doug Krause) Newsgroups: comp.virus Subject: Re: Stoned in C: (PC) Message-ID: <0015.9012041821.AA14135@ubu.cert.sei.cmu.edu> Date: 4 Dec 90 10:17:11 GMT Sender: Virus Discussion List Lines: 48 Approved: krvw@sei.cmu.edu CCTR132@csc.canterbury.ac.nz (Nick FitzGerald) writes: #Viruses are nasty, an unwanted nuisance, etc - but upping the hysteria with #unfounded accusations of the possible effects of given virii (I'm not sure #which plural I prefer) isn't going to help any. Nothing personal here Doug, #but in my experience the first time CHKDSK ever gets run on a disk is #following a (suspected) viral/trojan attack. I've often seen people complain #about the sort of things you mention above after running CHKDSK (or whatver) #for the first time (after having the machine for months/years), and then #promptly blame the last "unusual" or "suspicious" thing they remember #occurring as the culprit - "That new game", where all that happened was that #someone did a DIR on the floppy and got a "General failure error" message etc. No offense taken. :-) Anyway, here's what happened: I downloaded some info-mac listings files to my pc and was looking at them with LIST. When I tried to move to the second file, LIST complained about my partition table. I ran CHKDSK and it found lost clusters so I ran CHKDSK /V and it created 150 FILE*.CHK files. At this point I also found out that several files were cross-linked and that one of my directories pointed back at the root directory. (This one was real fun.) I also made the nifty discovery that my hard disk was unbootable. I finally gave up and downloaded SCAN and CLEAN from Simtel20. SCAN reported that I had Stoned in the partition table and CLEAN fortunately was able to remove it. Unfortunately CLEAN left C: inaccesible but Norton Disk Doctor cured that and got rid of the directory that was linked to root. (Only one file in that directory and I didn't need it anyway.) #Much better that PC-users are well-informed about the different viruses out #there and that they be made aware of the likelihood and means of infection. I still don't know where I got the virus, but I haven't checked all of my floppies yet. #Have you actually seen these symptoms and were they conclusively due to #STONED?? The symptoms I described are listed in the documentation that comes with SCAN/CLEAN. Maybe not conclusive, but I'll accept it. #I'm not saying STONED is a *safe* virus (perish the thought), but it *IS* #much less of a threat/nuisance than many others. Yes, I know that I could have ended up a lot worse off. Douglas Krause One yuppie can ruin your whole day. - ---------------------------------------------------------------------- University of California, Irvine Internet: dkrause@orion.oac.uci.edu Welcome to Irvine, Yuppieland USA BITNET: DJKrause@ucivmsa Brought to you by Super Global Mega Corp .com