[comp.virus] Stoned and Joshi

p1@rlyeh.wimsey.bc.ca (Rob Slade) (01/11/91)

3501P@NAVPGS.BITNET (Jeffrey) writes:

>    The guy that is "curing" the problem indicated that the
> two viruses in combination created some sort of unique problem
> and that Joshi may be a "Friday the 13th" type bomb.

Get a new expert.

The dual infection may indeed cause some "conflict" problems between the
viri, but the "hanging" of the computer is a common symptom of Joshi.
But only on January 5th.

According to Pat Hoffman's December '90 listing, Joshi cannot be removed
from a hard disk without a low level format, but you might try FPROT
version 1.13.  FPROT's BOOTVIR.TXT does not state whether or not it will
remove Joshi, but it does a fine job with Stoned (1 or 2).

Joshi is a "Friday the 13th" type bomb *only* in the sense that it is
date activated.  There is no report of deletion of files.

Finally, yes, Jeffrey, recovery is possible.  Quite easily.  *Boot from a
known clean system disk first!*  Both Joshi and Stoned are boot sector
viri.  In fact, if you are willing to boot from floppy, you can know use
your computer as is.  As long as you don't boot from the hard disk, the
viri will never activate.  But, assuming you don't want to go along with
such an awkward kludge, having booted clean you can now use any back
utility to backup your files, and then do any disinfection procedures you
wish, with FPROT, SCAN, CLEAN or even a low level format.

OK, one caveat.  With the two viri operating and moving sectors around,
your FAT *may* have suffered some damage.  But I don't think it very
likely.