|
NCSA Virus Report #96
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
???????????????????????????????
? VIRUS REPORT ?
? New Zealand Virus ?
???????????????????????????????
Synonyms: Stoned Virus, Australian Virus, Hawaii, Marijuana, San Diego
virus, Smithsonian virus.
Date of Origin: early 1988.
Place of Origin: Wellington, New Zealand.
Host Machine: PC compatibles.
Host Files: Remains resident. Infects boot sector of 360K floppy disk.
OnScreen Symptoms: The screen will sometimes display "Your PC is now
stoned!"
Increase in Size of Infected Files: n/a.
Nature of Damage: Affects system run-time operation. Corrupts or
overwrites boot sector. Directly or indirectly corrupts file linkage.
Detected by: Scanv56+, CleanUp, F-Prot, IBM Scan, Pro-Scan.
Removed by: CleanUp, MDisk, F-Prot.
Scan Code: 1E 50 80 FC 02 72 17 80 FC 04 73 12 0A D2 75 0E 33 C0 8E D8 A0
3F 04 A8 01 75 03 E8 07 00. You can also search at offset 045H for B8 01
02 0E 07 BB 00 02 B9 01.
History: This virus was first reported in Wellington, New Zealand in
early 1988.
Description of Operation: This virus consists of a boot sector only. It
infects any disk inserted in a drive after it becomes activated during a
boot, and it occupies 1K of memory. The original boot sector is held in
track zero, head one, sector three on a floppy disk, and track zero, head
zero, sector two on a hard disk. The boot sector contains two character
strings: "Your PC is now Stoned!" and "LEGALISE MARIJUANA!". The first
of these messages is only displayed one in eight times when booting from
an infected floppy, the second is unreferenced. In some variations, the
message is displayed on every 32nd boot.
In the original version of this virus, only 360 KB 5 1/4" floppies
were infected. While the original version was unable to infect a hard
disk, other versions (such as New Zealand B) are capable of doing so.
The virus can (unintentionally) trash 1.2 Mb floppies if they have
more than 32 files, and trashes about 5% of hard disks.<Note: Dr. Alan
Solomon. "The Information Center - PC Security", 1989.>
Removal: The Stoned virus can be removed from 360KB diskettes by using
either the MDisk, CleanUp, or F-Prot programs. It can also be removed
from diskettes by using the DOS SYS command. Be sure to power down your
system and reboot from a clean, write-protected floppy prior to
attempting disinfection.
??????????????????????????????????????????????????????????????????????
? This document was adapted from the book "Computer Viruses", ?
? which is copyright and distributed by the National Computer ?
? Security Association. It contains information compiled from ?
? many sources. To the best of our knowledge, all information ?
? presented here is accurate. ?
? ?
? Please send any updates or corrections to the NCSA, Suite 309, ?
? 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS ?
? and upload the information: (202) 364-1304. Or call us voice at ?
? (202) 364-8252. This version was produced May 22, 1990. ?
? ?
? The NCSA is a non-profit organization dedicated to improving ?
? computer security. Membership in the association is just $45 per ?
? year. Copies of the book "Computer Viruses", which provides ?
? detailed information on over 145 viruses, can be obtained from ?
? the NCSA. Member price: $44; non-member price: $55. ?
? ?
? The document is copyright © 1990 NCSA. ?
? ?
? This document may be distributed in any format, providing ?
? this message is not removed or altered. ?
??????????????????????????????????????????????????????????????????????
|
|
