Stoned (computer virus)
Encyclopedia
Stoned is the name of a boot sector computer virus
created in 1987.
Notable for being an early boot sector virus
, it was thought to have been written by a university student in Wellington, New Zealand - and by 1989 it had spread widely in New Zealand and Australia. It was one of the very first viruses, and was, along with its many variants, very common and widespread in the early 1990s.
When an infected computer started, there was a one in eight probability that the screen would declare:
The phrase is found in infected boot sectors of infected floppy disks and master boot record
s of infected hard disks along with the phrase "Legalise Marijuana".
A version appears to have been written by someone with experience only with IBM PC
360KB floppy drives, as it misbehaves on the IBM AT 1.2MB floppy, or on systems with more than 96 files in the root directory.
On hard disks, the original master boot record is moved to cylinder 0, head 0, sector 7. On floppy disks, the original boot sector is moved to cylinder 0, head 1, sector 3. Cylinder 0, head 1, sector 3 is the last directory sector on 360 Kb disks, and the author believed that it was "safe" to overwrite. The virus will "safely" overwrite the boot sector unless the root directory has more than 96 files.
On higher capacity disks, such as 1.2 MB disks, the original boot sector may overwrite a portion of the directory.
were suppressed by the People's Republic of China
.
Manitoba uses 2KB memory while resident.
Flame saves the current month of the system when it is infected. When the month changes, Flame displays colored flames on the screen and overwrites the master boot record.
Angelina contains the following text: "Greetings from ANGELINA!!!/by Garfield/Zielona Gora
" (Zielona Góra
is a Polish
town). The text is never displayed by the virus.
In October 1995 Angelina was discovered in new Seagate Technology
5850 (850MB) IDE drives. The drives were still factory sealed.
In 2007, a batch of Medion
laptops sold through Aldi
chain were found to have the Stoned.Angelina virus already present on the preinstalled Windows Vista
operating system.
Medion disseminated a press release explaining that Angelina virus was not really present in the laptops but the problem was about a pre-installed malware protection software (Bullguard) having a bug that gives an alert reporting the presence of the virus. The bug can be corrected via a patch released by Medion itself.
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
created in 1987.
Notable for being an early boot sector virus
Brain (computer virus)
Brain is the industry standard name for a computer virus that was released in its first form in January 1986, and is considered to be the first computer virus for MS-DOS...
, it was thought to have been written by a university student in Wellington, New Zealand - and by 1989 it had spread widely in New Zealand and Australia. It was one of the very first viruses, and was, along with its many variants, very common and widespread in the early 1990s.
When an infected computer started, there was a one in eight probability that the screen would declare:
Your PC is now Stoned!
The phrase is found in infected boot sectors of infected floppy disks and master boot record
Master boot record
A master boot record is a type of boot sector popularized by the IBM Personal Computer. It consists of a sequence of 512 bytes located at the first sector of a data storage device such as a hard disk...
s of infected hard disks along with the phrase "Legalise Marijuana".
Original version
The original "Your computer is now stoned. Legalise Marijuana" was written in 1979 on a mainframe computer in South Africa.A version appears to have been written by someone with experience only with IBM PC
IBM PC
The IBM Personal Computer, commonly known as the IBM PC, is the original version and progenitor of the IBM PC compatible hardware platform. It is IBM model number 5150, and was introduced on August 12, 1981...
360KB floppy drives, as it misbehaves on the IBM AT 1.2MB floppy, or on systems with more than 96 files in the root directory.
On hard disks, the original master boot record is moved to cylinder 0, head 0, sector 7. On floppy disks, the original boot sector is moved to cylinder 0, head 1, sector 3. Cylinder 0, head 1, sector 3 is the last directory sector on 360 Kb disks, and the author believed that it was "safe" to overwrite. The virus will "safely" overwrite the boot sector unless the root directory has more than 96 files.
On higher capacity disks, such as 1.2 MB disks, the original boot sector may overwrite a portion of the directory.
Beijing/Bloody!
The virus has the string "Bloody! Jun. 4, 1989". On this date the Tiananmen Square protestsTiananmen Square protests of 1989
The Tiananmen Square protests of 1989, also known as the June Fourth Incident in Chinese , were a series of demonstrations in and near Tiananmen Square in Beijing in the People's Republic of China beginning on 15 April 1989...
were suppressed by the People's Republic of China
People's Republic of China
China , officially the People's Republic of China , is the most populous country in the world, with over 1.3 billion citizens. Located in East Asia, the country covers approximately 9.6 million square kilometres...
.
Manitoba
Manitoba has no activation routine and does not store the original boot sector on floppies; Manitoba simply overwrites the original boot sector. 2.88MB EHD floppies are corrupted by the virus.Manitoba uses 2KB memory while resident.
NoInt/Bloomington/Stoned III
NoInt tries to stop programs from detecting it. This causes read errors if the computer tries to access the partition table. Systems infected with NoInt have a decrease of 2 kB in base memory.Flame/Stamford
Flame uses 1 kB of DOS memory. Flame stores the original boot sector or master boot record at cylinder 25, head 1, sector 1 regardless of the media.Flame saves the current month of the system when it is infected. When the month changes, Flame displays colored flames on the screen and overwrites the master boot record.
Angelina
Angelina has stealth mechanisms. On hard disks, the original master boot record is moved to cylinder 0, head 0, sector 9.Angelina contains the following text: "Greetings from ANGELINA!!!/by Garfield/Zielona Gora
Zielona Góra
Zielona Góra is a city in Lubusz Voivodeship, in western Poland, with 117,557 inhabitants within the city limits and 294,000 inhabitants within the metropolitan area, including three neighbouring counties ....
" (Zielona Góra
Zielona Góra
Zielona Góra is a city in Lubusz Voivodeship, in western Poland, with 117,557 inhabitants within the city limits and 294,000 inhabitants within the metropolitan area, including three neighbouring counties ....
is a Polish
Poland
Poland , officially the Republic of Poland , is a country in Central Europe bordered by Germany to the west; the Czech Republic and Slovakia to the south; Ukraine, Belarus and Lithuania to the east; and the Baltic Sea and Kaliningrad Oblast, a Russian exclave, to the north...
town). The text is never displayed by the virus.
In October 1995 Angelina was discovered in new Seagate Technology
Seagate Technology
Seagate Technology is one of the world's largest manufacturers of hard disk drives. Incorporated in 1978 as Shugart Technology, Seagate is currently incorporated in Dublin, Ireland and has its principal executive offices in Scotts Valley, California, United States.-1970s:On November 1, 1979...
5850 (850MB) IDE drives. The drives were still factory sealed.
In 2007, a batch of Medion
Medion
Medion AG is a German consumer electronics company. It operates in Europe, the United States, and the Asia-Pacific region. The main products are computers and notebooks, but also TVs, refrigerators, toasters, and fitness equipment. The company is becoming popular in Europe but has had mixed success...
laptops sold through Aldi
ALDI
ALDI Einkauf GmbH & Co. oHG, doing business as ', short for "Albrecht Discount", is a discount supermarket chain based in Germany...
chain were found to have the Stoned.Angelina virus already present on the preinstalled Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
operating system.
Medion disseminated a press release explaining that Angelina virus was not really present in the laptops but the problem was about a pre-installed malware protection software (Bullguard) having a bug that gives an alert reporting the presence of the virus. The bug can be corrected via a patch released by Medion itself.