[comp.virus] STONED in files

Padgett Peterson (02/05/91)

	For those wanting to check for STONED in executables as
mentioned earlier using the McAfee /ext switch, I would suggest trying
the string "a1 4c 00 *(2) a3 ? ? a1 4e 00 a3" <name>

	While this may generate some "false positives", I would like to
know about ANY files that try to do this since it may indicate a low level
(not through DOS) access of the INT 13 vectors.

	Note: use your own <name> since duplication of one of Mr. McAfee's
names may result in SCAN not checking for the virus otherwise.

							Padgett