74 Is my disk infected with the Stoned virus?
Description
This article is from the Computer Viruses FAQ, by Nick FitzGerald n.fitzgerald@csc.canterbury.ac.nz with numerous contributions by others.
74 Is my disk infected with the Stoned virus?
Of course the answer to this, and many similar questions, is to obtain a
good virus detector. There are many to choose from, including ones that
will scan diskettes automatically as you use them. As Stoned is a boot
sector infector, remember to check all diskettes, even non-system or
"data" diskettes (see E1).
It is possible, if you have an urgent need to check a system when you
don't have any antivirus tools, to run CHKDSK or MEM and note down the
values reported (see C1) and then to boot from a known clean system
diskette and compare the results returned by CHKDSK or MEM. If the
total amount of conventional memory reported is different between the
two boots then you may have a viral problem but this information alone
cannot tell us if it is Stoned. If you cannot see the PC's hard disk
(usually the C: drive) then it is even more likely you have a virus
problem, though definitely not Stoned. If you have a "disk editor" type
program, looking at the boot sector of a suspect floppy, or the MBR of
the suspect hard drive may be helpful. If you have Stoned, the first
byte will indicate the characteristic far jump of the virus (hex: EA)
instead of the more common short jump (hex: EB) of the boot loader.
Even if that is the first byte, you could be looking at a perfectly good
disk that has been "inoculated" against the virus *or* is infected with
some other virus which makes similar changes, or at a diskette that
seems safe but contains a totally different type of virus.
Continue to:
My Books
