Stoned (computer virus)
| Stoned | |
|---|---|
| Surname | Stoned |
| Aliases | New Zealand, Marijuana |
| Known since | 1987 |
| First location | New Zealand |
| Virus type | Boot sector virus |
| Authors | Unknown |
| File size | 512 KB |
| Host files | Boot sector, MBR |
| Polymorph | No |
| Stealth | No |
| Memory resident | Yes |
| system | MS-DOS |
| programming language | Assembler |
Stoned is a boot sector virus of which numerous versions are known. The original virus was first discovered in 1987 in the city of Wellington , New Zealand .
The virus was developed primarily for MS-DOS systems.
Stoned is often mentioned in connection with the MS-DOS viruses Vienna and Jerusalem . Not only were these three malware programs very well known and widespread, they were also the origin of a large number of other virus derivatives. For example, in 1992 one of the variants of the Stoned Virus triggered the so-called Michelangelo hysteria .
infection
Infection occurs via the boot process of an infected floppy disk. When you start the computer , the virus is installed on the hard drive , copies the master boot record to a different place and overwrites the MBR on the previous point. When the hard disk starts, the MBR is normally executed, but the original MBR was overwritten by the stoned virus. At this point the virus is memory resident . The virus is loaded into the main memory, which occupies 2048 bytes. Next, the stoned virus intercepts interrupt 13h (read from / write to disk) and then executes the original MBR, whereby the start process continues as normal from now on. When the floppy disk is accessed, the virus reads the floppy disk (possibly not yet infected by other viruses) and checks whether it has already been infected with a stoned virus. If the floppy disk is not yet infected, the virus will install itself in the boot sector of the floppy disk if it is not write-protected . Thus, this floppy disk will infect any computer when it is booted. In the end, the virus tries to infect every non-write-protected disk in drive A: that is accessed (drive B: is not affected). In the end, the boot sectors of the floppy disks, the MBR (master boot record or master boot partition sector) and / or the DOS boot record or the DOS boot sector are infected by this virus.
Payload
Depending on the variant, these symptoms can indicate a viral infection, but the symptoms can be different for each stone version.
Text messages
The message appears during the boot process
„Your PC is now Stoned“
or
„Your Computer is now Stoned. Legalize Marijuana“
However, there are also other strings depending on the version . The variant "Stoned.SwedishDisaster", for example, uses the string "The Swedish Disaster".
Audio messages
- O Christmas tree or many other songs.
More symptoms
- The working memory is occupied with 2048 bytes by the virus from the start until the computer is switched off.
- Simulations of hardware defects
- Program malfunctions
- Some files disappear
Characteristic
Stoned only spreads via floppy disk, not via the Internet . The word or the string “Stoned” is also contained in the source code, although this was only given as a name by the author . Stoned only infects the boot sector , the partition sector of hard disks and of course the boot sector of floppy disks.
development
The stoned virus had a lot of influence on modern viruses such as B. Cabir, CommWarrior (abbreviation Comwar) and Skuller.gen. Various Trojans, viruses and worms such as Mabir.a, Fontal.A, StealWar, Lasco and Pbstealer emerged from Cabir - although the source codes of StealWar, Lasco and Pbstealer are not at all similar to the Stoned virus, even the Cabir virus, they are Viruses are all very close relatives. However, the behavior with the new viruses is much more aggressive, although at first glance you would not notice that a boot virus has anything to do with a network or even a cell phone virus.
Without a doubt, the greatest sensation was caused by the Stoned.Michelangelo.a variant in the spring of 1992 . The malware became known in the media and the general public as the "new" Michelangelo virus . The virus was modified accordingly in order not to be recognized by the same search patterns as its original version. The trigger was activated every March 6th, based on the set system date. In contrast to Stoned, this variant could cause massive damage through complete data loss. The payload overwritten all data and an effective means of recovery could not be found. The press reported in advance of millions of infected computers, but on March 6 there were only around 10,000 to a maximum of 20,000 cases of damage. At that time, John McAfee was still one of the first manufacturers of anti-virus software. Its sales exploded in 1992 due to the Michelangelo hysteria. When the damage did not come close to the expected level on March 6, 1992, the mass media quickly lost interest in Stoned.Michelangelo.a again.
distribution
- Cabir spreads via bluetooth
- ComWar spreads via MMS
- Skuller spreads via bluetooth
- Mabir spreads via MMS
- Fontal spreads via Bluetooth and MMS
- StealWar spreads via bluetooth
- Lasco spreads via bluetooth
- Pbstealer spreads via bluetooth
variants
- Stoned.Zapper
- Stoned, sanded
- Stoned.June4th.a
- Stoned.SexRevolution1.1
- Stoned.SexRevolution2.0
- Stoned.SwedishDisaster
- Stoned.Rostov
- Stoned.Stoned-8
- Stoned.Stoned-16
- Stoned.Stoned.16.a
- Stoned.Damien
- Stoned.Bravo
- Stoned, loading
- Stoned.Noint
- Stoned.Azusa.a
- Stoned.Bunny.a
- Stoned. Dani ela
- Stoned.Dinamo Empire.INT.10.b
- Stoned.Standard.a
- Stoned.Lzr
- Stoned.Empire.Monkey.a
- Stoned.Empire.Monkey.b
- Stoned.Kiev
- Stoned.NOP
- Stoned.Manitoba
- Stoned.W-boat
- Stoned.Michelangelo.a
- Stoned.No INT.a
- Stoned.Teraz
- Stoned.b
- Stoned.c
- Stoned.d
- Stoned.e
- Stoned.Sonus
- Stoned.Nulls
- Stoned.Donald
- Stoned.Flushed
- Stoned in love
- Stoned.stoned-floppy
- Stoned.Mexican
- Stoned.WD1
- Stoned.WD2
- Stoned.WD3
- Stoned.WD4
- Stoned.WD5
- Stoned.WD6
- Stoned.WD7
- Stoned.Australian
- Stoned.Bloody
- Stoned.Brunswick
- Stoned, Epbr
- Stoned.Hawaii
- Stoned.Hemp
- Stoned.HongKong
- Stoned.Lisa2
- Stoned, marijuana
- Stoned.Monkey
- Stoned.Monkey2
- Stoned.NewZealand
- Stoned.NOP
- Stoned.SanDiego
- Stoned, sanded
- Stoned.SexRevolution
- Stoned.Smithsonian
- Stoned.Stonehenge
- Stoned.Whit
- Stoned.Sbtv
- Stoned.1 (found on Mac OSX Mavericks 10.9.2)
- Stoned Angelina