Virus stones micros in Canterbury

Press, 16 August 1988, Page 14

Virus stones micros in Canterbury

One virus has been unearthed in our competition for the first person to bring in a diskette carrying an MS-DOS virus. Five diskettes were sent in, each with the Stoned virus, also known as Type One. Our judges, two computer scientists who do not want their names disclosed, say the program meets their criteria for classification as a virus: it copies itself between disks and damages files. First to present a copy of the virus at the offices of “The Press” was Mr Mike Galien, a final-year student in electrical engineering at the University of Canterbury. The electrical engineering network was at one stage contaminated with the virus, and Mr Gallen put the virus into his own PC by taking studies home.

The virus flashes a message to the screen, “Your PC is stoned,” and destroys files on 1.2 Mb floppy disks. Clearly other viruses will appear in the South Island, and all microcomputer users should take precautions: ® Be cautious about copying software from public networks and bulletin boards. © Format disks only on a trusted machine. @ Do not copy DOS, except from distribution disks.

© Copy files rather than copy disks. ® Always keep back-ups so that if a hard disk is contaminated it can be cleaned by reformatting with as little inconvenience as possible.

© Restrict access to microcomputers. © Restrict staff or students from bringing outside disks on to the system.

© Keep write-protect tabs on floppy disks as a matter of course. The virus submitted has been in New Zealand for some months. Some Armed Services networks have been affected.

Mr Les Kokay, who submitted the second virus diskette received at “The Press,” has studied the program and says it can be erased from a hard disk by copying the systems files from an uncontaminated floppy. However, Mr Charles Lake, of the electrical engineering department at the University of Canterbury, says decontaminating a hard disk can be difficult. Six of eighteen microcomputers in the department’s network were contaminated by the stoned virus. An attempt was made to clear it from the hard disk by reformatting, and this failed at the first attempt. It succeeded when a machine was booted from a clean floppy, and then reformatted.

Mr Kokay says the Stoned virus cannot be copied to a floppy in file-by-fiie movement. It spreads in the disk-copy feature of DOS and in some other whole-disk copying programs such as Copywrite. Mr Lake says the virus can wipe files on 1.2 Mb floppy disks. On these it writes into the third directory sector. Thus if there are more than 32 files in the root directory, some will be wiped out by the virus. He and Mike Gallen have written two programs which check for the presence of the virus. Hvirus checks a hard disk for the virus, and Fvirus for floppies. They have put these in the public domain, so they are available free. Copies will be obtainable through the Christchurch IBM and Compatible PC Users Group, which also has another vaccine program to decontaminate hard and floppy disks.