[comp.virus] Joshi & Stoned 2

3501P@NAVPGS.BITNET (Jeffrey) (01/09/91)

   My IBM PC has been hit with 2 viruses, Stoned-2 and Joshi.  The
computer hangs when we try to boot, and now it looks as if the
hard-disk has been affected.

   What long range effects do these viruses have on recovering files
from the Hard-disk?  I have never heard of Joshi.  I thought Stoned-2
just affected the boot-up.  Do either of these viruses affect the FATS
table or somehow make recovery of disk files impossible?  How about
using something like Norton utilities to get these files off the disk?
Are we totally screwed?

   The guy that is "curing" the problem indicated that the
two viruses in combination created some sort of unique problem
and that Joshi may be a "Friday the 13th" type bomb.

   Any info, on the list or direct to me would be appreciated.
Thanks very much.  We are in the Central California area, BTW.
                        --Jeffrey

CHESS@YKTVMV.BITNET (David.M.Chess) (01/11/91)

I'd guess that you just have the usual Stoned virus (at least one
version of one popular scanner was reporting "Stoned 2" on normal
Stoned infections); as far as I know, the Stoned-2 hasn't reached the
U.S. population yet.

Anyway, assuming you have the usual Stoned virus and the usual Joshi
virus, neither of them "intentionally" do any damage to files (that
is, there's no piece of code in either one to which one can point and
say "this was clearly intended to trash the disk / files").  On the
other hand, both are doing odd and unexpected things to your disk, and
there are definitely circumstances in which (for instance) the Stoned
by itself can overlay part of your FAT with a copy of the original
master boot record (producing, to say the least, unexpected results).
I wouldn't be at all surprised if on some machines a combined
Stoned+Joshi infection would damage something on the disk!  I would
except, though (assuming, again, that you have the "vanilla" viruses),
that only a few sectors have actually been trashed, and that virtually
all your data is still there *somewhere*...

DC