Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!wuarchive!ukma!cs.widener.edu!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson)
Newsgroups: comp.virus
Subject: Stoned (PC)
Message-ID: <0011.9103281641.AA28811@ubu.cert.sei.cmu.edu>
Date: 27 Mar 91 20:17:47 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 19
Approved: krvw@sei.cmu.edu

>From:    Pat Ralston <IPBR400@INDYCMS.BITNET>
>Subject: Mutation (or not) of Stoned (PC)

>Stoned can be found on floppy disks but not the hard disk.

There appear to be two cases in which the STONED will not infect a
hard disk: one has to do with an internal variable in the virus
(offset 8). The second is if the first four bytes of the master boot
record (absolute sector one) match those of the virus (EA 05 00 C0).
In this case, the virus "thinks" that the disk is already infected. I
have heard of several "vaccines" that perform this function. The
dangerous part is that the virus still goes resident in such a machine
and while it will not infect the fixed disk, it will infect floppies
presented to it. (some variants only 360k, some anything).

At least the STONED is easy to detect/get rid of.

						Padgett
                           (we also walk dogs)