From: CCTR132@csc.canterbury.ac.nz (Nick FitzGerald)
Newsgroups: comp.virus
Subject: Re: Strange MBR (PC)
Date: 14 Aug 92 00:06:42 GMT

*********************************************************************
phil@cs.utexas.edu (Philip Smolen) wrote:

>I noticed a machine with a strange MBR at work recently.  The first 16
>bytes look like this:
>EA 05 00 C0 07 E9 99 00 02 6F 79 00 F0 E4 00 80
>
>The machine I found this on refused to boot.  SCAN could not find
>anything unusual.  Glancing at the code it looks like it was made for
>a boot sector or MBR.  The first instruction, for example, is jmp
>07C0:0005.  (On bootup this translates to jump to the next
>instruction.  After DOS has loaded normally, this translates to crash
>and burn.)
>
>Has anyone seen anything like this?  Does anyone know what could have
>caused this?

Yep - I see something -quite- similar to this all the time.  Compare:

Phils MBR:        EA 05 00 C0 07 E9 99 00 02 6F 79 00 F0 E4 00 80
My diskette:      EA 05 00 C0 07 E9 99 00 00 1A 03 00 C8 E4 00 80

My diskette happened to be the first sample of a Stoned infected
diskette I could lay my hands on.  The first difference between these
two is at offset 8 - this is the byte Stoned uses to decide whether it
is booting from a floppy - 00h - or a HD - 02h.  Without digging out the
rest of my disassembly notes (which are at home), I can't clearly
comment on the significance of the other differences.

You may have a new Stoned-based boot sector infector or a disk which has
been "innoculated" against Stoned.  I find the latter less likely, as
it's only necessary to have the first four bytes of the MBR match Stoned
to fool its infection check (for what it's worth, such "inoculations"
are not a good idea).

If it's a virus, save a copy of the MBR to a disk file and only
give/send copies to reputable anti-virus researchers like Frisk, McAfee,
the VTC in Hamburg, etc.  Look through the first few physical sectors of
the HD.  You should (?) find a copy of the original MBR stashed away
somewhere.  The failure to boot may be because the virus isn't correctly
locating/loading/executing the original MBR, or may be due to corruption
of the original MBR.  If you find an apparently OK copy of the original
MBR, copy it back to absolute sector 0,0,1.  If you have DOS 5.0 and the
viral MBR still has a good intact partition table (booting from a floppy
allows you normal access to your HD), you can, instead, use the
undocumented:

      FDISK /MBR

to re-write the MBR's bootstrap code.  Corruption of the original MBR is
common with Stoned and related viruses on HD's that were partitioned
with pre-DOS 3.0 versions of FDISK, as it did not reserve all of the
first track for the MBR; thus Stoned overwrites part of the FAT when
stashing away its "safe" copy of the original MBR on such machines. 
(That's fairly garbled - if you don't understand some of it or for more
detailed help, mail me.)

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Nick FitzGerald, PC Applications Consultant, CSC, Uni of Canterbury, N.Z.
 n.fitzgerald@csc.canterbury.ac.nz    (64)(3)  642-337 Voice,  642-332 FAX
Xref: sparky comp.msdos.programmer:44 comp.lang.c++:12767