A closer look at the Stoned Virus on my XT machine (Part 2/3)
HTML-код
- Опубликовано: 3 июл 2024
- In this video w're going to take a closer look at the Stoned Virus that I found on my XT machine.
This video is sponsored by PCBway If you want your circuit board design realised and printed, You should check out www.pcbway.com/ Starting Prices as low as 5$ for a 1 or 2 layer design.
Surprised to see this listing in a local add online for over 10 days so decided to pick up this "little" computer.
0:00 - Introduction
0:36 - A word from our sponsor
01:14 - What is a virus ?
02:21 - What is the Stoned Virus ?
02:47 - How did the Stoned Virus spread ?
03:40 - Stoned Virus variants
04:37 - What is a bootsector virus ?
09:21 - Boot sectors
10:38 - How does it all start ?
11:40 - How does the Stoned Virus infect other floppies ?
14:11 - What happens if you have the Stoned Virus ?
15:16 - How do you know if you have the Stoned Virus ?
16:50 - Creating Patient Zero
21:01 - The source code
21:41 - Thank you
References :
- en.wikipedia.org/wiki/Stoned_...)
- www.f-secure.com/v-descs/ston...
- computerarcheology.com/Virus/...
- teaching.idallen.com/dat2343/0...
#virus #stoned #xt 
Наука
![Sean Rii, Karyon, Sharzkii - Taungule [My Love] (Official Visualizer)](http://i.ytimg.com/vi/eJoMuypbSzQ/mqdefault.jpg)
The first and only virus to ever infect one of my computers, way back in 1990. I think I had a 486 at the time, but it might have still been a 386. It got me really interested in doing backups, and later disk images of my computer -- something I still do to this day.
Efficient! Doing a disk image to preserve the infected disk contents! :-)
I got it from a bootleg copy of civilization.
1990 would have been really early for a 486, I know my dad got a 286 in 1991.
Maybe you got one of the first 486 like the 16 mgz (20?) version but i remember I had the oppoturnity to buy a Amd 386 Dx-40 in 1992 so this might be on the same timeline
@@rogerwilco2 My friend had a 486 in 1990 or 91, but I didn't get my first PC; a 286, until a few years later. My 286 was second-hand; the seller was upgrading straight to a Pentum. In those days, people upgraded whenever they wanted. It was nice for consumers (particularly given the expense of hardware), but perhaps not so much for developers. :) Edit: Now I think about it, it meant a developer could make a living with DOS knowledge alone all the way from 1982 to late in the 90s, or even all through the 00s and into the 10s in the industrial and embedded fields. I think there might still be DOS-powered industrial systems.
I remember seeing this virus on a old Packard bell p75. Absolutely all of the floppies inserted to this pc would corrupt the boot sector. It actually led me to learn low level formatting at the age of 11 so kinda grateful for that.
I recall the days of fdisk. That was interesting.
What would happen if you installed several boot viruses on one disk?
@@kirill9064 It boots the first one I'd suppose.
@@TheCrystalGlow Same here. I didn't had an internet connection back then so I learned hella much stuff about computers just by trial and error. :)
I want to upvote your comment but I didn't want to be person #70 ;)
Your PC is now Stoned! I remember this from high School computer lab in 1988/1989.
My entire programming class in high school got infected with this virus around 91-92.
I went on a fix it call in the late 80s early 90's to The Gambia, Africa. Turned out there was nothing wrong with the hardware at all, but the HD and every 3.5" floppy disk was infected with multiple viruses. First clue was the catchy tune it played at boot time.. In those days I carried a disk set of various virus killers and everything I need to rebuild systems from scratch. I went to work on the system and killed everything I could find, and then checked through multiple boots to recheck to verify it was clean. Then I rebuilt it from scratch just to be sure. Then I cleaned every floppy disk in the building, took all day. Then I went home to the managers house and cleaned his equipment and every floppy disk he had, they were all infected too. I schooled him on checking and killing viruses and basic measures to prevent infection in the first place, i.e. trust no floppy unless the checker prog. says its clean.
Found out latter that UN projects were well known for propagation of viruses world wide. The site I had fixed was again non functional within 2 months. They had even managed to infect the disk I gave them to kill viruses. Yup, they defeated the write protection to copy something...
the virus defeated write protection or someone moved the tab ?
Damn. That’s really fascinating. Did you work worldwide ?
@@highpath4776 Yeah, they moved the tab. You just cant teach some people.
@@Kubulek17 I filled up 2 passports doing installs, training, and service. The Gambia was an odd one, one paved road, vacation spot for French tourists, lots of army checkpoints on that lone paved road.
As an IT guy now this is a fascinating story. Nice to hear from someone doing IT back when I was a little boy and internationally at that.
There's a video by The 8-bit Guy about some absolute hardcore coders who managed to program games onto that 512-byte boot sector.
Yeah saw that one too ... I'm not really familiar with assembly language. Perhaps I should take it up as a hobby (being a developer in real-life).
There are games fitted into 64 to 256 bytes
@@RetroSpector78 Superoptimizing assembly is interesting, you start learning lots of weird tricks to reuse the same chunk of code different ways - have multiple entry points to a function, overlap the first instruction of a routine with some data that just happens to match, sometimes you can even overlap two pieces of code that do different things depending on the reading frame. For example you can abuse a "load register with immediate data" type instruction as a one byte jump over a two byte instruction that forms the first instruction of an alternate entry point to the next part of code, etc.
If you have enough code space that you can use a decompressor, then you might start trying to organize assembly sequences so that they compress better. Sometimes adding unneeded code makes it smaller compressed if it makes it match other code better. Lots of work to shave off a byte or two at a time but it can lead to some impressive results. I made a semi-minimalist BIOS implementation for the Sanyo MBC-55x (hardware summary screen, basic video support on the proprietary graphics, CGA text mode initialization if present, keyboard, floppy disk, custom AES disk encryption with an invisible menu to set the crypto keys) and it's less than 4KB compressed and contains a FreeDOS boot sector. On a double sided disk, it doesn't even need to leave track 0 to get the BIOS loaded.
The biggest shrinks were using UPX as a packer, having the code generate the AES lookup tables at boot, and then the collective effort of trickery reorganizing the code and in probably the coolest optimization, I was able to merge two of the AES subroutines into one by making the x86 direction flag effectively change some byte rotation directions and reuse one stretch of code for two behaviors depending on the direction flag. It's like one of those optimizations that should just never happen but on a hunch I worked through what the backwards direction flag would do and only had to make minor changes to make it do the right thing.
@@big0bad0brad Fascinating stuff, do you have a writeup of it (or other cool projects) anywhere?
@@RetroSpector78 good buddy of mine taught himself Assembly Language in the early 80s on a TRS 80 (TRS DOS). We are both in our 60s. He’s turned his understanding if AL into a life long job. High level IT work.
The bootsector, it’s been 512 bytes for a long time, it’s only since recent years with the UEFI firmware and today’s HDD sizes with larger sector sizes that this has changed. It’s quite amazing that some developers could even squeeze little games into those 512 bytes. Funny though with SSD’s we’re still referring to sectors, the terminology has stuck around even though physically it’s not a spinning disk anymore.
We still refer to sectors on solid state drives because the flash memory used is designed that way. Typical flash memory will be organized as 4KB sectors of data and 64KB or larger banks. When reading from the flash memory you can access any address directly. But, when writing, you must write to a 4096 byte boundary, and you must write all 4096 bytes to the memory. This is because flash memory must be erased prior to writing, and forcing an erase procedure to erase 4KB at a time saves a tremendous amount of silicon real estate that allows a single chip to hold 256GB, or more, data. (In almost all types of flash memory when data is erased all bits are set to 1. Writing a 1 bit does nothing, but writing a 0 (zero) bit flips the bit from 1 to 0.) The larger banks of 64KB or more are provided to allow erasing more data in a single operation since erasing is time consuming, and this allows much higher effective write speeds.
This architecture allows for significantly more data storage in flash-type solid state memories. (As opposed to EEPROM memories where individual bytes can be erased and written, but are still limited to very low capacities like 32KB.)
Note that the most modern solid state storage devices (NVME drives) have their contents mapped directly into the normal address space of the CPU. This allow for more efficient storage memory access, but the same "sector" boundary rules apply.
One final thing: LBA (logical block addressing) eliminated the use of the cylinder/head/sector method of indexing data on all disk drives at the end of the 90's. Before that, if you were working with a solid state disk drive you were most likely working in an enterprise level data center.
Anyway, I hope this helps to clarify why the sector terminology is still used, and that this wasn't wasn't too long winded and boring. :)
The CHS nomenclature was a lie from early in the DOS days. I have a 386SX with a 119MB Seagate HDD that has “14” heads. Sure it does. 🙄 The smallest IDE drive I have is 85MB. It has “4” heads. That may or may not be real.
CHS was obsolete before DOS 5.0, and stuck around as the sole addressing scheme (without overlays and disregarding SCSI) until DOS 6 - well past its sell-by date.
You also have to know that until early 90s all hard drives reported in MiBs or KiBs. A KiB is 1240Bs vs modern 1024B. This eben carried over to Optical drives. If you look at CDs they are 750MiBs. If you do the conversion Mhz, channel, and bit of music it does not equal 750MB. The reason CDs opted for MiBs vs MB was dats had to do less scaling. Also UEFI with Secure Boot and GPT no longet keeps the MBR on the start of the hard drive or SSD. Instead the MBR fils has pieces in UEFI, MBR area, and root of the GPT partition. If you add optane the MBR partion record is spread across 4 places. Though with secure boot a key on the drive mirrors the secure boot. The table sets on drive MBR. and root of GPT
@@thepoliticalstartrek You got something wrong. A Kibibyte (KiB) is 1024 byte and 1 Mebibyte (MiB) = 1024 × 1024 Byte = 1.048.576 Byte. These are the binary- or IEC-Prefixes based on 2^x. The SI-Prefixes, kilo=1000, mega=1000000, etc. in kB or MB are based on the decimal 10^x system. I know you US guys have some problems with that ... but you have obviously the Internet and Wikipedia(please not the English one, they got it wrong, too:) ), don't you?:)
The official standard for CDs is 650MB, although you can get them in capacities from 650 to 900 MB (12 cm) or in smaller 8cm with 194MB versions. The size specification for CD is (650 × 2^20) which is MiB ... and so MB is not correct and misleading. The correct value would be ≈ 682MB for the standardized 650"MB" CD. Maybe there is your "750MB" value from: For audio our candidate can hold 74min of audio with the different format that equals to ≈ 747MiB(near your value but wrong unit, Edit: Excuse me, that is the one case you got it right ... to 3MiB accurate) = 783MB. That is because audio uses 2352 Byte/Sector and data storage allows 2048 Byte/Sector.
Nobody has a clue, not even the manufacturers ... at least till they found out how to make the best profit:)
Besides all that hard to follow stuff, one cannot make up prefixes and numbers to their liking. There is a standard! Otherwise I'm just going to buy GOLD from these guys. 650 kilos bought and 682 got in reality? Who else wants to join?:)))
@@dieSpinnt I saw 750GiB CD-R(W?) in use in the 90s. I think you're correct about the original specification, but they evidently figured out how to cram in an extra 100MiB all the way back then, and there must be a 750MiB standard or the disks wouldn't be useful.
"A little knowledge is a dangerous thing," goes the old saying. Well, a little knowledge about standards is an irritating thing. ;)
i somehow got this on our first computer way back in the day, i guess it came from a friends floppy disk lol. at the time i was young and had no idea what 'stoned' even meant, and thought it was more like in the biblical sense of getting stoned. very interesting to finally know more about it
I remember spending a whole bunch of time in debug, figuring out aspects of this, back in 88, thanks to my friend infecting one of my game disks with Stoned. I had completely forgotten all of that, until right now.
Back around the time of this damned annoyance, I had my first IT job and managed all the software and data disks (hundreds of floppies) for a software company and sure enough, this got into the building and spread. I eventually eradicated it by collecting every floppy (a lockdown!), scanning, removing any infection as well as all the PC hard-disks (the 20MB kind).
Ran into this running a BBS way back. Deep dive wondering. Great video
(12:21) The old AVG… that brings back memories…
Yeah had to find an old version to be able to install it on windows XP on my old Athlon ... always a bit tricky finding old versions if virus scanners on dodgy sites :)
Love the pointless little goblin that appears 😂
lightweigh and effective...used it a lot when i worked at a store repairing computers around 15 years ago
@@MrHBSoftware
And I used the old AVG on Windows XP and Vista, before switching to different versions of Windows Security over the years. Until a few years ago, I didn't know AVG got acquired and became awful and/or annoying.
I use to write in 6502 and x86 assembly back in the 80's. Wrote all kinds of boot sector programs. Many were related to hardware manipulations before the OS tried to boot. Made a few traps for people that might be so inclined to snatch a floppy. Ohh the good old days. 👍
good ol' days when we wrote our own boot sectors, copy protection systems that would store it's data in the nvram and keyboard drivers that used no RAM at all! 😌
Another awesome video. I especially found your explanation and usage of the debug command very informative. Thanks.
I just want to say thank you for refreshing our memories. Waiting for part three :)
Well .. first time I've ever just sat there and listened to the plug for PCBWay ...
The rhythm. The enunciation. A pleasure to listen to.
thanks for the video, i appreciate your work on this virus theme. will wait for next chapter!
Glad you enjoyed it!
Very interesting and instructive video, thank you very much !!
Love the time warp!
Excellent video, thanks for the content. I appreciate how much you looked into the virus!
Thx .... I have to say it has given me a cold :) Hope I'll get better soon ...
I'm mostly concerned about sector 11 being overwritten and something there from before could be deleted. I play with boot sectors quite a lot and they can be restored by the simplicity of writing the old one back.
Or what if real data gets written into that sector? That would stop the machine from booting off the disk. Unless the virus marks the sector as used in the FAT (and I don't know if it does or not) this could easily happen.
@@eDoc2020 You can still restore a boot. It's not a big deal and you will pile up some tools. The real problem is some rare data getting lost.
In the MS-DOS 360KB format, the disc starts with one boot sector, two copies of the FAT, 2 sectors each, followed by the root directory, having 112 entries. As a FAT directory entry occupies 32 bytes, you can fit 16 entries into a sector, which makes the root directory occupy 7 sectors. As Adrian started counting sectors at 0, sector 11 is actually the 12th sector on the disk. The boot sector and the FAT occupy 5 sectors in total, the 12th sector is the 7th sector of the root directory - which is the *last* of the seven sectors.
For performance reasons, DOS does not scan the whole root directory, but ignores everything after the first "empty" directory entry. An empty directory entry is defined by its first byte being 00 instead of the first byte of a name. So as long as the first 6 directory sectors are not completely filled with directory entries, DOS will see an empty entry terminating the root directory (not unlike a NUL character terminating a C string), and ignore sector 11. 6 sectors can store 96 directory entries. As there must be a terminator entry, too, you can store 95 files on a stoned-infected 360KB floppy disk before running into conflicts on sector 11. After storing the 96th file, DOS will start seeing the original boot sector at location 11 as part of the root directory, which will show up as corrupted additional entries in the directory. If you run chkdsk to fix that mess, chkdsk will erase all the invalid directory entries, corrupting the original boot sector and making the disk unusable unless you re-write a proper boot sector to it, e.g. by reformatting it.
That is the biggest issue! It ruined so many of my legitimate floppies because of over written sector 11. And if you try to reformat and load an image to the floopy on a clean machine you infect that machine, and vice versa. You can't win with this viris, it is the worst virus ever, it is only harmless on bkank media or anything that has not written to sector 11. There is no way to fix it other than to stop using all of your floppies, re-format your HDD, and start all over with fresh floppies. Antivirus can usually always detect it but that is all it can do- setect it. Not clean ram, HDD, or Floppy. I remember I finally was all in order... and then I forgot about my school 3.5 floopy with MS Works documents and it started all over again. And because of that the schools computer had it and I either couldn't edit at home or had to just accept stoned.ini... which I did until I got my socket 7 (CDRW DLA & Direct CD ect.) and the school upgraded their computers. This video gives me PTSD because I remember how much I hated that virus back in the day.
Excellent Boot sector description, Thanks.
Glad it was helpful!
thanks for the pcb site i never knew such a thing existed! : )
Important detail: You don't need to boot off that floppy. It's sufficient that the BIOS TRIES to boot off that floppy. Which happens every time you forget the floppy inside the drive when you switch off and later on.
So the floppy does not have to contain a bootable OS.
Always reset the computer when changing floppy disks... which is no use when you have a hard disk inside.
I had some variant of this on an old 8088 PC, got it from a bunch of floppies I borrowed from a friend. This virus would wreak havoc on his PC, stopping it from booting from the HDD every so often. I had no idea it was a virus at the time as I never saw the "your PC is now stoned" message, the only way to get his PC booting again was to use a boot floppy and then reboot a couple of times. On my PC it didn't seem to do much other than waste 1KB of RAM and occasionally infect other floppies - which it didn't do all of the time. I think the virus struggled to replicate itself on newer versions of DOS, as I'd upgraded from DOS 3.20 to DOS 5.0 on my PC. I only found out I had the virus years later when I got a newer PC and let an anti-virus scan some of my old floppies.
I was very confused by the Ghost virus on my Atari ST. I have no idea why I didn't realise it was a virus. It reversed the Y axis of the mouse, and just when you'd gotten used to it, it would reverse it back!
love the new editing!
Just wanted to structure the video a bit ... got lots of ideas in my head on visuals / animations and how I would like a video to look but don't have the skills to do it :)
Super leuke video's! Groet, Jan
Great video.
I remember getting this to my 386 back in 1992-93..
If you use the write protection tabs, the virus won't be able to copy itself onto clean floppy disks. Back in the days of DOS, you would get a message that said 'error writing drive A:', or something like that, when you actually just wanted to read or copy files from the floppy, not write to it. That was an indication your PC was infected.
This was awesome! I never really studied how all this was done, now I know... It was so simple back then wasn't it....
As an OrCad user, it was fun seeing the vintage OrCad floppy.
Great job !!
thats fascinating
i remember as a kid inserting a floppy and having Norton tell me it was infected with Stoned.Empire.Monk Virus lol! I lol'd at that back then as it sounded funny.
I just had to revisit this video. All my DOS and Win 3.11 floppies were infected. Still have to clean the hard drives, but now I know what I have to do. Thanks!
Nice work man
Talk about doing that the long way around. I just used anti-virus program or clean up disk boot disk. I remember my uncle sent me some crazy amount of 360k used floppies. I not only formatted to see what was good. But also once in a while the virus program would go off. :)
ruclips.net/video/AZYVzIhgwpU/видео.html
I really enjoyed this video, it made me remember the boot sector hell virus I got a looong time ago x) There was a pretty common boot sector virus in late ms dos / early windows 95 days, I dont remember the name. Greetings from Ath !
Nice video, keep it up, thanks :)
That was great!
now that I no longer have access to a UV light box, or Etch tank, I have considered just buying them from PCBWay. In fact a former colleague ordered a pack of 20 of one of the circuits I'd previously designed to use in his new work place (since they don't have an Etch tank either.)
Worst part is we'd just bought a brand new etch tank for work, then they got rid of the electronics department. Last I saw of it, it was sitting on the floor in one of the science labs.
Hi, wow this takes me back. Retired Tech my first box was a Kit from Tandy. I have thumb drives containing 1/2 a Terabyte.
Oh the memories! Stoned was also my first virus, and yes it was from sharing games with friends.... I guess that's what I get for piracy! The lack of a HDD on my Amstrad PC1512 meant the damage was somewhat mitigated, due to using clean boot disks each time I started up.
I no longer have the Amstrad, but I still have a functional Multitech/Acer 500+ XT with CGA monitor, 40MB MFM, and 2400 baud modem. I also still have my entire 5.25" 360Kb floppy disk collection, and I'm sure the Stoned virus is still on a number of them!
Nitpick at 5:00 - a standard PC BIOS doesn't look at the first sector of every storage device. It only looks at the *first* floppy drive and then at the first hard drive.
This is a very interesting video
"so how do you get a virus in there?" *Allstate ad plays* best ad timing XD
I remember these old viruses that was a common virus in my early days of computing in the early 90s, ping pong virus was just a random character going around the screen, there was also key press that made strange sounds on the speakers there was all sorts of funny viruses from the DOS days.
8:55 I opened a working hard drive before. replaced the lid with perspex, because I was told to, so students could see the inside of a working hard drive.
Yes it still worked after I did it, amazingly. And yes, the Demo machine that students look at to see how they work kept running for many years with this perspex lid hard drive.
Part 3 please
The Stoned Virus that was in the old XT I found was considerably more aggressive than the one here, if I remember. Just about every time I tried to use DOS commands or do just about ANYTHING, the "Your PC is now stoned!" message would flash across the screen with a long "dute!" (not a beep like here) sound from the speaker while wiping the screen completely clean of data! It made the PC pretty worthless until I removed it! It may have been a modified and much more aggressive version of the virus that I actually found! I wish that I had kept that old XT! It also had a lot of add-in cards if I remember that I may still have around somewhere...🤔
The first virus that I got on my 286, this along with Michelangelo led me to discover antivirus, scan, clean. Even before F-PROT era...thanks to my elemental school pal, Daniel Perez hahaha, so much great memories!!!
educational content
My big virus encounter was in the early 2000's when I got one of the early polymorphic viruses. It infected every executable file (not just .exe) on any device ever attached to the computer. I tried multiple high priced software programs and none of them could fix the issue. To this day I have all of that data stored in a separate location in case I need it - I doubt it would affect windows 10 but I'm not opening that can of worms again. I ended up clean booting numerous computers at the time.
I remember getting the stoned virus. What a pest. Thanks for making this video. Believe it or not but fond memories. 😁👍
Good vids man I like your channel can you make the next part next episode
In the 90s my DOS CD-ROM drive started to act funny, then MSCDEX and other TSRs started giving up. After some time I got the message at boot: "Dis is one half. Press any key to continue ...". :)
What does a grape say when it is stepped on? Nothing, it just lets out a little wine
"How can you tell if you are stoned?" Sit down next to me, son. Lemme tell you about a nifty little plant...
Floppy disks are read much like records, the disc spins and the head stays static for the rotation. When skipping into the next 'ring' it moves, much like the grooves in the record cause the head to move towards the centre.
Very informative watch, I really enjoy learning about those things. Back in the day having viruses was so scary to the kid, but now that I can understand it better, it's less about fear and more about "how do I fix it".
I'm curious about one thing... when accessing and infecting the floppy, would it change anything to add a sticker on the write protect notch? I always thought that this mechanical protection was allowing-disallowing writing on the floppy at the initial level of the floppy drive itself.
Yes, that’s correct, if you write-protect it like that the virus cannot infect it. I always pulled up the write-protect notch on my 3.5” floppies when sharing them with friends to not get them back infected.
One virus writer famously claimed his virus could write "through" write-protection, but I don't know if anyone ever really believed it. :) I'd need to refresh my knowledge of floppy drive controllers to know if it's even remotely possible, but it certainly wouldn't be easy. The electronics for the normal write functions are physically disabled when a write-protected disk is inserted, in the PC. I can't remember if the virus worked on PC or Atari, anyway.
@@eekee6034 I do remember people not 100% trusting the little write-protect tab and taping it over to be 'extra safe'. I can imagine virus writers tapping into this fear. And history repeats itself, because nowadays people tape over their webcams to be 'extra safe'.
Very interesting video, thanks. The only viruses i got back in the day were on my amiga without any harddrive installed, luckily:-)) Would there be a chance to repair the boot sectors without infecting them again?
I always wondered if my computer enjoys being stoned as much as I do 🤤😋
1:50 ...watching this tired and ready to go to bed and I clicked on the cookie agreement to go away. Facepalm...
I tried scrolling something in a video the other day... or did I try to use a game's camera controls? Many years ago, I dropped something behind my monitor IRL, and tried to use the camera controls of the game I was playing to look behind the monitor. XD
Back around the time this computer came out I was listening to a late night radio show and the question what was the name of the first computer virus so I answered Brain and won a copy of Norton Antivirus. Must have been version one since it came on 5 1/4 with a ring bound manual. I didn't even have a PC at the time. Should have kept it since maybe it's worth something to somebody now.
Wow I remember using assembler language in school. It was fun.
Oh, and another thing- it wasn't just Europe in the 90s it was also the US. We were all downloading from the same BBS Systems and basically efin without rubbers...
its weird hearing a PCB Way ad without Perifractic's "PCB Waaaaaaay!"
What happens if there is already data in boot sector 11? The virus overwrites it?
Also, if the disk is a bootable disk, the stoned virus mantains the logic so it can be booted again?
Legalize!
I think you don't need to boot from the floppy, just insert and read it. IIRC dos executes code from boot sector to read it, which was dangerous.
Excellent point. I believe it does not work in the other direction (PC → floppy): if it cannot write, it cannot spread. The user would either have to give the virus write access to a disk, or the virus would need some way to override the write protection.
I used to keep individual floppies of "captured" viruses for my own little virus library. In middle school, I'd tell other kids "Some people collect basketball cards. I collect viruses" >.
This is the one and only virus I ever had to deal with on my own computers. I had to go through over one hundred 5,25" floppy disks with msav on my 1512 to get rid of it. It took a while... After that I scanned all incoming floppies. Having witnessed how effectively this virus spreads I was then cautious enough not to ever get any of my computers infected again to this day. Well I didn't have to be cautious for too long as I mostly switched to Linux in 1997 anyway.
Of course, the virus would need to be able to write to the floppy disk in order to transmit. If the floppy disk can't be written to, then the virus can't spread that way (until it is given a disk that it can write to).
We had a Flip virus, a Yankee Doodle virus and a Delwin.1759, We had another one on our 386 sx that I can't remember. We lost nearly all software some way. I remember that eventually we cleaned up everything with "Toolkit antivirus", but a lot of software broke.
Que programa usaste para ver el sector de arranque del disquetes
15:17 "How do you know if YOU or your computer are stoned?"
Me: what?!
Previously you mentioned that the "Stoned" message appears not always, but at a probability of 1/8 th of the boots. How does this inconsistency work?
If you delve into the code of the virus (link in the description) you’ll see it’s watching a hardware clock-tick, if that has a certain composition (1/8 probability) it will show the message
15:55: Is there a reason the sixteen hexadecimal bytes in each line are displayed as pairs of eight hex bytes separated by a dash?
Just because someone thought a '-' halfway through would aid legibility? (That's just a hunch. Does someone know authoritatively?)
There's what appears to be a single piece of cat litter in front of the computer at 10:42 that's driving my OCD crazy...
RetroSpector78: How do you know if you're stoned?
Me: Well...
Very funny :D and of course very informative video. As always. Thanks.
Second PC virus I ever saw was the Stoned virus. I wrote a tiny pascal program that would get rid of it if it was there, called "unstone". Before that, I caught the Pakistani "Brain Software" virus from playing video games and sharing floppies. Removed it manually, using DOS Debug.
Can you finish info on the stone virus i would like to know more about it.
I missed one part in your nice demonstration of this virus. You never explained how an infected floppy or HD is able to boot from sector 11 once the virus is the boot sector. Does the virus write some code in the boot sector telling the PC to go look in sector 11
It could just load the sector into memory and jump to it, or ignore the backup entirely and load io.sys and msdos.sys by itself, although I believe it does the former.
I didn't analyze the stoned virus, but it's competitor on being the most common boot sector virus in Europe. I expect them to be technically very similar, as they are both basic boot sector/MBR viruses. That one is the "parity" virus. It makes your PC crash with a fake memory parity error message at the next full hour, but gives you another hour of computing time before it crashes your system for every floppy it could infect.
The parity virus installs a BIOS hook that redirects all reads (but not writes!) to the boot sector to sector 11. It then re-executes the BIOS boot function by calling INT 19. This interrupt causes the BIOS to load the boot sector from A: or the MBR from C: again, this time with BIOS hook installed, so the computer boots from sector 11.
As writes are *not* redirected by the parity virus, you can just read the boot sector/MBR and re-write the data you just read to get rid of the virus. As soon as you read the boot sector afterwards, the disk will get re-infected, though, so my standard routine to get rid of parity is to read the boot sector (of a floppy) or the MBR (of a HDD), rewrite what I wrote, and power-cycle it. The virus tries to intercept Ctrl-Alt-Del to survive a warm start. Depending on what TSRs you had installed, that interception might fail, though.
lol, Priceless.
What would happen if the floppy disk you put in is nearly full? How would it end up copying your original boot sector?
Someone should try installing the virus in DOS Box!
No need for assembler code. You could achieve the same with a pair of L and W debug commands
I'm just thinking: Wouldn't it be even more easy to just load the stoned.bin into debug and simply execute it? I mean the code has everything in it to replicate it, so it would naturally infect the Floppy. OK, it would do so to the HDD as well, but this was already infected so no harm done.
Finally someone that speaks of stoned 17. I' ve fucked up so many disks before underdtanding it was a virus. I still have some infected floppy. Modern antivirus disinfect such a floppy and was able to recove data loss 30 years ago. :)
stoned virus in the 19s: Im stronk
stoned virus in 2021:get killed by windows antivirus in 0.000000001 seconds
I remember this virus on our family computer. It affects all .exe files not .com files. Our variant displays animation of SW whenever .exe files executed. Not much harm was done to our computer other than the annoying animation "SW" and sometimes halt the computer. It resides in memory to infect all other medias MBR including floppy disk. We managed to remove it using F-PROT Anti Virus Boot Disk.
so the code of the virus actually lets you load the OS anyway by loading on the new sector?
I know you said the virus is harmless, but is it possible for there to be data stored in sector 11 that gets overwritten when it copies the origibal boot sector?
Yes, it could overwrite data on the disk
have u clean it ?
Correct me if I'm wrong, but your computer doesn't have to boot from an infected disk in order to "catch" a boot sector virus. All that has to be done is to access the disk on an already booted computer, and as soon as the computer reads the boot sector, the virus is copied into active RAM. After that, any disc the computer accesses (including it's own HDD, or any readable CD-ROM disc, floppy disc, or RAM stick, will become infected also.
I believe you are mistaken. A sane OS can read the data tables on an infected disk without running any of its code. The malicious code would still be in RAM but it would be inactive. Having said that, if there is a bug in the OS's code the use of specially crafted values in the data tables could lead to execution of the malicious code but I doubt the virus in this video does that.
@@eDoc2020
If what you say is true, virii could not spread. If I had a floppy disc that I always booted from, and never booted from a different floppy, my computer could never be infected, since I only booted from an uninfected disc.
That said, I admittedly have not booted a computer from a floppy disc since about 1990, so don't fully remember, but I believe if the infected disc has programs, all one has to do to get infected is run one of the programs, not necessarily boot from the disc.
The boot sector itself has the malicious code, and the CPU accesses the boot sector every time it accesses the disc. So the malicious code runs and infects the computer's RAM each time it is accessed. The code tells the machine to write itself to each disc that machine ever accesses. If the machine has a HDD, the malicious code writes to the MBR, and thereby infects every disc the machine sees.
@@xenaguy01 There's no conflict here. What I'm saying is that if you _don't_ boot the infected disk and _don't_ run any programs from it you shouldn't get infected.
30+ years of countless computers and not a single virus. Have run Norton since it became a thing. Didn’t exactly always avoid sketchy websites.
i personally would have mentioned that the boot sector is used as just a piece of x86 executable code that runs at the bios level with no security checks. that's why it's so scary to have a boot sector virus because there is not a lot that it can't mess with.
A virus with a good cause. :) I'm sure it was tough to be a cannabis advocate in the 80's. Well, times change fortunately. New Zealand was very close to legalizing last year, and they will eventually.
I had imaged an old MFM hard drive that had this virus. Opening the disk image in a hex editor on an EFI Win 10 machine Windows Defender "helpfully" found the virus and removed it from the image file.
when you copy the data on sector 1 to sector 11 i reckon that that data doesnt appear as a file but its hidden...so the usable capacity of the disk slightly gets smaller right? when using scandisk doing a surface scan were you can see the data blocks does it show it having data in there? can you use debug to fill a disk with data that is invisible andif you do that hjow it will afect the formatting of the disk and the way it appears to the OS???
I don't know if the virus does this or not but one way to hide data is to mark the sectors as bad in the FAT. Usually physically damaged sectors are marked as bad so the OS knows not to put data there. On the surface scan this would appear as a B and at the end it will say there are X bytes (or maybe clusters) of bad sectors.
@@eDoc2020 yes its a red rectangle with a B inside...it would be kind of weird if the virus did that but i really dont know :)
@@MrHBSoftware I thought it was a black rectangle with a red B... Anyways it appears it doesn't do that. Sector 11 is normally the last sector of the root directory table so if you have less than 96 files it would normally be unused.
Part 3?