From: WALKER@aedc-vax.af.mil (William Walker C60223 x4570)
Newsgroups: comp.virus
Subject: Stoned, No-Int, and SCANV86B (PC)
Date: 24 Mar 92 14:50:00 GMT
Organization: Lehigh University

From:    bm656@cleveland.Freenet.Edu (Mark D. Gold)
> ... While checking for the Michaelangelo virus with SCANV86B, I
> noticed that all of teh computers are infected with No-INT (Stoned)
> virus in the partition table.  I'd like to find out more about teh
> Stoned virus, but what I really need to know is the following: Will I
> either have to (a) SCAN all of the hundreds of diskettes in the office
> and clean them if infected or (b) buy software that checks diskettes
> when they're inserted into a disk drive?

From:    861033h@aucs.acadiau.ca (Michael S. Hogan)
> One of my professors here at Acadia has been having a recurring
> problem with the No-Int Stoned virus.  I, as well as our computer
> centre, have cleaned it off his machine using MacAfee's Clean program
> and FDSIK /MBR among others.

> How is the Virus transferred?  We try to scan all disks prior to their
> use in the machine, but it never finds anything.  I have installed the
> VSHIELD program and it doesn't seem to catch it prior to infection.

> Once the drive has been cleaned, we are having problems with storing
> and retreval of files (almost requiring a complete re-installation).
> Does this virus do anything other than infect the partition table?
> Is there a way to correct the problems it creates (clean it out) and
> have reasonably good performace afterwards??

From:    cmcl2!panix.com!ss@uunet.UU.NET (Steve Steinberg)
> evans@aplcen.apl.jhu.edu (Robert Evans) writes:
> > With the Michelangelo scare, he has used SCANv86b, which has reported
> > a virus found "No Int [Stoned]" and is wondering is the the strain to
> > which Michelangelo belongs, or is it a different one?
> > 1) What damage does it do?
> > 2) How does it get activated?

> I also found No-Int (with Stoned) on 15 out of 50 PCs.  I'm not sure
> about what it does.  I pushed the date ahead to Fri. the 13th
> (3/13/92) and nothing happened.

From:    Hama@DOCKMASTER.NCSC.MIL (Gord Hama)
> I noticed that when I scanned a MICH infected diskette with SCANV86B
> that it reported reported the NOINT, The diskette was re-scanned using
> V84 and sure enough the MICHAELANGELO was reported.  I recall that on
> the week of Mar 02 there were numerous NOINT reports, but few
> MICHAELANGELO's being found.  II tested a NOINT sample with V84, but
> it is reported as a STONED related virus.

> I wonder if the NOINT reports were really NOINT or MICHEALANGELO?
> Anyone notice a sudden surge in NOINT reports?

McAfee's ViruScan 8.3V86B has a bug in it (or more likely, an error in
the scanning strings) which causes it to identify the "Stoned" virus as
"No-Int Virus [Stoned]."  Also, when CleanUp is removing this virus, it
reports "Found No-Int Virus [Stoned]" and "Found Stoned Related Virus
[Stoned]" both, but only "1 virus removed."  This has been reported to
McAfee Associates.  I don't know how SCAN, CLEAN, or VSHIELD 86B treat the
REAL "No-Int" virus, since I don't have a copy of it.  You can use a disk
editor (Norton, PC-Tools, etc.) to look at an infected boot sector to see
which virus it actually is -- "Stoned" will have "Your PC is now Stoned!
LEGALISE MARIJUANA!" or something close, but "No-Int" will not.

"Stoned" and "No-Int" infect a PC's hard disk when a machine is booted
from an infected floppy, either intentionally or accidentally, and
regardless of whether the floppy is completely bootable or not.  Once
there, it will be loaded on every boot from the hard disk, become resident
in memory, and reduce "total bytes memory" (as reported by CHKDSK) by 2048
bytes.  From there, it will infect EVERY floppy accessed in the A: drive,
even by doing so little as a DIR A:.  "Stoned" has no activation date or
intentionally destructive payload, though it can, by the way it infects
disks, can cause damage, ranging from lost files to a corrupted FAT,
depending on the system, diskette density, and hard disk format.  "No-Int"
is less likely to damage a high-density diskette, but it does have a
simple stealth capability -- it prevents access to the boot sector when
it's in memory.

To clean the virus from the hard disk, you must first boot from a known
clean boot floppy, then remove the virus from the drive.  Often, a
recurring infection will result from attempting to remove the virus from
the hard drive without first booting from a clean floppy, or from not
cleaning ALL of the associated floppies.  Remember, it takes only ONE
infected floppy to start it back up again.  If it had overwritten part
of the directory, you may be able to use CHKDSK /F to recover those
files which had their directory entries wiped out by the real boot sector.
If it had overwritten part of the FAT, good luck.  Most likely only a
person very experienced at disk recovery or a restoration from a complete
backup can help.

As for why VSHIELD won't recognize it in Mr. Hogan's case, I don't know.
Since the scan strings for SCAN and CLEAN are faulty, it's possible that
the strings for VSHIELD are faulty, too.  It may also be possible that
the strings these programs use were accidentally matched to the "Stoned"
virus, and Mr. Hogan has the REAL "No-Int" virus.  Aryeh, do you have an
idea on this?

I have not observed the identification problem Mr. Hama reports, that
SCAN 86B mislabels "Michelangelo" as "No-Int."  SCAN 86B identified
"Michelangelo" as "Michelangelo Virus [Mich]" for me, and CLEAN 86B
successfully cleaned it.  Perhaps there is another strain of
"Michelangelo," or Mr. Hama's copy of "Michelangelo" was damaged in such
a way to cause the misidentification.

"Michelangelo" is not a strain of "Stoned," because it is too different,
but it is close enough for analysts to say that it may be a poorly hacked
version of "Stoned."

> Maybe Stoned/No-Int is corrupted.  Can I get my money back?

"Stoned" and "No-Int" are distributed on an as-is basis.  No warranties
are either expressed or implied.  However, the authors SHOULD be held
responsible for any damage resulting from the use of these programs. ;-)

Bill Walker ( WALKER@AEDC-VAX.AF.MIL ) |
OAO Corporation                        | "Non sequitur -- your facts are
Arnold Engineering Development Center  |  un-coordinated."
M.S. 120                               |           -- NOMAD
Arnold Air Force Base, TN  37389-9998  |