MMCCUNE@sctnve.BITNET (07/31/90)
The stoned is a troublesome virus because it infects the hard disk partition table. If left on the hard disk, it will eventually corrupt the FAT (this is due to compatability problems and was not intended by the author of the virus). Here is a short assembler program to remove it from the hard disk. It can be assem- bled through DEBUG DEBUG - -A MOV DX,80 ; THE HARD DISK, HEAD 0 MOV DX,7 ; CLUSTER 0, SECTOR 7 MOV BX,200 ; MEMORY LOCATION 200 MOV AX,201 ; READ FROM HARD DISK TO MEMORY INT 13 ; DISK ACCESS MOV CX,1 ; CLUSTER 0, SECTOR 1 (THE PARTITION TABLE) MOV AX,301 ; WRITE FROM MEMORY TO HARD DISK INT 13 ; DISK ACCESS MOV AH,0 ; RESET AH REGISTER INT 21 ; TERMINATE N STONEDHD.COM RCX :30 W Q Only use this on hard drives that are infected. It will destroy the partition table on uninfected drives. This program will remove it from drive A: DEBUG A MOV DX,100 ; HEAD 1, DRIVE A: MOV CX,3 ; CLUSTER 0 SECTOR 3 MOV BX,200 ; MEMORY LOCATION 200 MOV AX,201 ; READ FROM DISK TO MEMORY INT 13 ; DISK ACCESS MOV DX,0 ; HEAD 0 DRIVE A: MOV CX,1 ; CLUSTER 0, SECTOR 1 ( THE BOOT RECORD) MOV AX,301 ; WRITE FROM MEMORY TO DISK MOV AH,0 ; RESET AH REGISTER INT 21 ; END N STONEDA.COM RCX :30 W Q This will remove it from drive A: To do a lot of disks, try this Put an uninfected disk in A: DEBUG L 0 0 0 1 Put an infected disk in A: W 0 0 0 1 Put another infected disk in A: W Repeat as often as necessary If you have any mor questions or need any more help, drop me a line............. Mike McCune...<MM>