From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: A few questions (Stardot/V801/Michaelangelo) (PC)
Date: 28 Sep 92 11:11:44 GMT

Hello,

this is another item in the Facts & Fibs chapter I want to set
straight, publicly. I've sent a Stoned and Michelangelo memo directly
to NBECC::KENNEY, and I hope somebody else will post info about the
other viruses mentioned.

On 23 Sep 92 18:00:00 -0800 NBECC::KENNEY said:
> [...] Michaelangelo, and does it survive warm boots?

As a MBR infector, Michelangelo will automatically be run early in the
boot sequence. Hence there is no need to deal with a warm boot in any
particular way: the virus will be installed anyway.

> can you tell where the start and end of an infected file are supposed
> to be algorithmically, so that one routine could trim off all length-
> variants one or more virii?

This question is misleading. Remember that it is *not* enough to strip
the virus code off a program; the more important step in disinfecting
is to replace that part of the program that gives control to the virus
with its original contents. Usually, this is contained in the virus
code, but in a form highly dependent on the particular virus; hence,
you must identify the virus reliably before attempting any
disinfection.

Many viruses do not keep enough information to re-construct the original
contents of the program file precisely (e.g. the exact length of the
uninfected program may be unknown); this will render self-checking pro-
grams unoperable. Sometimes, a virus is not identified reliably by the
disinfectant program (e.g., in case of a hitherto unknown variant of the
virus); this may invalidate the info needed to re-construct the original
file. These, and similar, dangers render disinfecting a hazardous
endeaveaour. It is always safe (and sometimes the only option left) to
replace the infected programs with copies from the original, write-pro-
tected distribution disks.

These remarks hold, mutatis mutandis, for all sorts of viruses: You can
remove file-viruses by re-installing the programs, companion viruses by
deleting the companion file (i.e. the part that gives control to the
virus), DOS boot sector viruses by FORMATing the infected disks, MBR
viruses by replacing the infected MBR, etc. (The latter can be accomp-
lished by the DOS-5.0 command "FDISK /MBR, if the partition table is
still in place, which you can check via booting from a floppy disk: if
you can still access all partitions of the HD, read and even modify the
files on those partitions, then the partition table is ok.)

>     Since Stoned + Michaelangelo = bye-bye FAT, this is getting
> very interesting.

Stoned + Michaelangelo (on most systems, and on most days of the year)
does *not* affect the FAT. Rather, the MBR will be lost, hence the
system won't boot from its hard disk, and cannot be disinfected (i.e. by
recovering the original MBR). You can still boot the system from a floppy
disk (or any other external medium, e.g. via a network), and you can
always write an entirely new MBR to the HD to recover from the infection
without loss of data.

Kenney's misconception may stem from the fact that on particular systems
(e.g. DOS 2, on a 20MN HD), Stoned, or Michelangelo, will overwrite
part of the FAT (probaly accidentally) with the original MBR.

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>