[comp.virus] Stoned Remover

MMCCUNE@sctnve.BITNET (07/31/90)

The stoned is a troublesome virus because it infects the hard disk
partition table. If left on the hard disk, it will eventually corrupt
the FAT (this is due to compatability problems and was not intended by
the author of the virus). Here is a short assembler program to remove
it from the hard disk. It can be assem- bled through DEBUG

DEBUG
- -A
MOV DX,80    ; THE HARD DISK, HEAD 0
MOV DX,7     ; CLUSTER 0, SECTOR 7
MOV BX,200   ; MEMORY LOCATION 200
MOV AX,201   ; READ FROM HARD DISK TO MEMORY
INT 13       ; DISK ACCESS
MOV CX,1     ; CLUSTER 0, SECTOR 1 (THE PARTITION TABLE)
MOV AX,301   ; WRITE FROM MEMORY TO HARD DISK
INT 13       ; DISK ACCESS
MOV AH,0     ; RESET AH REGISTER
INT 21       ; TERMINATE

N STONEDHD.COM
RCX
:30
W
Q

Only use this on hard drives that are infected. It will destroy the
partition table on uninfected drives.

This program will remove it from drive A:

DEBUG
A
MOV DX,100  ; HEAD 1, DRIVE A:
MOV CX,3    ; CLUSTER 0 SECTOR 3
MOV BX,200  ; MEMORY LOCATION 200
MOV AX,201  ; READ FROM DISK TO MEMORY
INT 13      ; DISK ACCESS
MOV DX,0    ; HEAD 0 DRIVE A:
MOV CX,1    ; CLUSTER 0, SECTOR 1 ( THE BOOT RECORD)
MOV AX,301  ; WRITE FROM MEMORY TO DISK
MOV AH,0    ; RESET AH REGISTER
INT 21      ; END

N STONEDA.COM
RCX
:30
W
Q

This will remove it from drive A:
To do a lot of disks, try this
Put an uninfected disk in A:
DEBUG
L 0 0 0 1
Put an infected disk in A:
W 0 0 0 1
Put another infected disk in A:
W
Repeat as often as necessary

If you have any mor questions or need any more help, drop me a
line.............

Mike McCune...<MM>