Stoned (computer virus)

Stoned

Hexcode showing "Your PC is now Stoned!" statement at the last 512-byte sector of Master Boot Record
Classification Unknown
Type Computer worm
Subtype Boot virus
Point of origin New Zealand

Stoned is the name of a boot sector computer virus created in 1987. It is one of the very first viruses and is thought to have been written by a university student in Wellington, New Zealand.[1][2] By 1989 it had spread widely in New Zealand and Australia,[3] and variants became very common worldwide in the early 1990s.[4]

A computer infected with the original version had a one in eight probability[5][6] that the screen would declare: "Your PC is now Stoned!", a phrase found in infected boot sectors of infected floppy disks and master boot records of infected hard disks, along with the phrase "Legalise Marijuana". Later variants produced a range of other messages.

Original version

The original "Your computer is now stoned. Legalise Marijuana" was thought to have been written by a university student in Wellington, New Zealand.[7][8]

This initial version appears to have been written by someone with experience only with IBM PC 360KB floppy drives, as it misbehaves on the IBM AT 1.2MB floppy, or on systems with more than 96 files in the root directory. On higher capacity disks, such as 1.2 MB disks, the original boot sector may overwrite a portion of the directory.

On hard disks, the original master boot record is moved to cylinder 0, head 0, sector 7. On floppy disks, the original boot sector is moved to cylinder 0, head 1, sector 3, which is the last directory sector on 360 kB disks; the author presumably believed that it was "safe" to overwrite. The virus will "safely" overwrite the boot sector if the root directory has no more than 96 files.

Variants

The virus image is very easily modified (patched); in particular a person with no knowledge of programming can alter the message displayed. Many variants of Stoned circulated, some only with different messages.

Beijing, Bloody!

The virus has the string "Bloody! Jun. 4, 1989". On this date the Tiananmen Square protests were suppressed by the People's Republic of China.

Swedish Disaster

The virus has the string "The Swedish Disaster".

Manitoba

Manitoba has no activation routine and does not store the original boot sector on floppies; Manitoba simply overwrites the original boot sector. 2.88MB EHD floppies are corrupted by the virus.

Manitoba uses 2KB memory while resident.

NoInt, Bloomington, Stoned III

NoInt tries to stop programs from detecting it. This causes read errors if the computer tries to access the partition table. Systems infected with NoInt have a decrease of 2 kB in base memory.

Flame, Stamford

A variant of Stoned was called Flame (later unrelated sophisticated malware was given the same name). The early Flame uses 1 kB of DOS memory. It stores the original boot sector or master boot record at cylinder 25, head 1, sector 1 regardless of the media.

Flame saves the current month of the system when it is infected. When the month changes, Flame displays colored flames on the screen and overwrites the master boot record.

Angelina

Angelina has stealth mechanisms. On hard disks, the original master boot record is moved to cylinder 0, head 0, sector 9.

Angelina contains the following embedded text, not displayed by the virus: "Greetings from ANGELINA!!!/by Garfield/Zielona Gora" (Zielona Góra is a town in Poland).

In October 1995 Angelina was discovered in new factory-sealed Seagate Technology 5850 (850MB) IDE drives.[9]

In 2007 a batch of Medion laptops sold through the Aldi supermarket chain were found to have the Stoned.Angelina virus already present on the preinstalled Windows Vista operating system.[10] A Medion press release explained that the virus was not really present, but that a bug in pre-installed malware protection software Bullguard produced a spurious warning; a patch was released to fix the error.[11]

Other variants

  • Zapper
  • Sanded
  • June 4.a
  • Sex Revolution 1.1 and 2
  • Rostov
  • Stoned-8
  • Stoned-16
  • Stoned.16.a
  • Stoned.2(b)
  • Damien
  • Bravo
  • Laodung
  • Noint (Bloomington)
  • Azusa.a
  • Bunny.a
  • Dani ela
  • Dinamo Empire.INT.10.b
  • Standard.a
  • Lzr
  • Empire.Monkey.a
  • Empire.Monkey.b
  • Kiev
  • NOP
  • Manitoba
  • W-Boot
  • Michelangelo.a
  • No INT.a

Several other variants include:

  • Teraz
  • b, c, d, e
  • Sonus
  • Nulls
  • Donald
  • Flushed
  • In love
  • stoned-floppy
  • Mexican
  • WD1 to WD7.

See also

References

  1. ↑ "...a brief history of PC viruses.", IBM Research
  2. ↑ "The early days", History of Malware
  3. ↑ "Marijuana Virus wreaks havoc in Australian Defence Department". The Risks Digest. 9 (9). 14 August 1989. Retrieved 2007-08-07.
  4. ↑ "F-Secure Virus Descriptions : Stoned". F-secure.com. Retrieved 2007-08-07.
  5. ↑ "Analysis of Stoned", Peter Kleissner
  6. ↑ "The “Stoned” PC Virus", Commented disassembly of virus code at computerarcheology.com
  7. ↑ "...a brief history of PC viruses.", IBM Research
  8. ↑ "The early days", History of Malware
  9. ↑ "Virus:Boot/Stoned". Retrieved 2010-08-27.
  10. ↑ "Boot virus shipped on German laptops". Virus Bulletin. Retrieved 2008-01-08.
  11. ↑ "Medion press release explaining Angelina problem".
This article is issued from Wikipedia - version of the 9/4/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.