Virus Name: Stoned
Aliases: 1991 Boot, Donald Duck, Hawaii, Marijuana, New Zealand,
Rostov, San Diego, Sex Revolution, Smithsonian, Stoned II,
Deunis, Stoned-16, Stoned-AT Love, Stoned-Collor,
Stoned-Mexican, Stoned Mutation
V Status: Common
Discovered: February, 1988
Symptoms: BSC; TSR; messages; RLL controller hangs
Origin: New Zealand
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV
Removal Instructions: MDisk, F-Prot, NAV
The Stoned virus was first reported in Wellington, New Zealand in
early 1988. The original virus only infected 360KB 5-1/4"
diskettes, doing no overt damage. The original diskette-only
infector is extinct, however, and all known variants of this virus
are capable of infecting the hard disk master boot sector
(partition table) as well as may damage directory or FAT
information. Most variants of this virus have only minor
modifications, usually in what the message is that the virus may
display on boot.
When a computer system is booted with a Stoned infected disk, this
virus will install itself memory resident at the top of system
memory. The interrupt 12 return will be moved, and ChkDsk will
indicate that the computer system as 2K less total memory than what
is installed. If the system boot was from a diskette, the virus
will also attempt to infect the hard disk master boot sector, if it
was not previously infected.
During the boot process, the Stoned virus may display a message.
The message is displayed more or less on a random basis. The most
common text for the message is:
"Your computer is now stoned."
"Your PC is now Stoned!"
After Stoned is memory resident, it will infect diskettes as they
are accessed on the system. When Stoned infects a diskette, it
moves the original boot sector (sector 0) to sector 11. The Stoned
virus then copies itself into sector 0. Since sector 11 is
normally part of the diskette root directory on 360K 5.25"
diskettes, any files which had their directory entries located in
this sector will be lost. Some versions of DOS have sector 11 as
part of the File Allocation Table, which may also result in the
disk's FAT being corrupted.
When Stoned infects that system hard disk, it copies the hard disk's
original master boot sector to side 0, cyl 0, sector 7. A copy
of the Stoned virus is then placed at side 0, cyl 0, sector 1, the
original location of the hard disk master boot sector. If the hard
disk was formatted with software which starts the boot sector, file
allocation table, or disk directory on side 0, cyl 0 right after
the master boot sector, the hard disk may be corrupted as well.
In order to disinfect a system infected with the Stoned virus, the
system must be powered off and booted with an uninfected, write-
protected boot diskette. If this is not done, the virus may
re-infect diskettes as soon as they are disinfected.
There are many programs which can disinfect Stoned infected
diskettes and hard disks. To successfully use one of these, follow
the instructions with the program.
To remove Stoned manually, the DOS SYS command can be used on 5.25"
360K diskettes. On the hard disk, the original master boot sector
must be copied back to side 0, cyl 0, sector 1. This can be
performed with Norton Utilities, or other sector editors.
Known variant(s) of Stoned are:
Deunis : Based on the Stoned virus, Deunis is a variant received
from Spain in July, 1991. The text contained within the
virus is now:
"DeunĦs abras˘ tu Cpu!"
PS-Stoned: Based on the Stoned virus, PS-Stoned is a variant which
has been altered to avoid detection. Unlike most
members of the Stoned Family, PS-Stoned does not contain
a message, and does not display any message when the
system is booted from an infected disk. This variant
will infect the boot sector of both normal and
high-density diskettes, as well as the hard disk master
boot sector. In the case of the master boot sector, the
original master boot sector is moved to cylinder 0,
side 0, sector 17. On low density diskettes, the
original boot sector is moved to sector 11, while on
high density diskettes it can be found at sector 16.
This variant was originally received in February, 1991,
from New Brunswick, Canada after being isolated at a
university. As of May, 1991, no anti-viral products
detect this variant which can be just about invisible on
Rostov: Similar to Stoned-B, this variant does not display any
message. It contains the text: "Non-system disk" and
"Replace and strike". Submitted in December, 1990, origin
Sex Revolution V1.1: Submitted in December, 1990, this variant is
similar to Stoned-B. This variant may display
the following message:
"EXPORT OF SEX REVOLUTION ver. 1.1"
Sex Revolution V2.0: Similar to Sex Revolution V1.1, the message
has been changed to:
"EXPORT OF SEX REVOLUTION ver. 2.0"
Stoned-16: The variant does not contain a text string as the
original text string in the Stoned virus has been
replaced with binary zeros. On 5.25 inch 360K diskettes,
the boot sector will not be saved by the virus. On 5.25
inch 1.2M diskettes, the original boot sector is saved at
sector 17, part of the root directory. The system hard
disk's master boot sector will have been relocated to
Side 0, Cyl 0, Sector 16.
Origin: Unknown May, 1992.
Stoned-1991 Boot: Submitted in May, 1992, this variant of Stoned
differs in that it infects the boot sector of the DOS boot
partition of the hard disk, overwriting the original boot
sector. It infects diskettes similar to the original
Stoned, moving the original boot sector on 360K 5.25"
diskettes to sector 11. It does not contain typical
Stoned virus messages, but does contain the text string
"1991" near the beginning of the virus.
Origin: Unknown May, 1992.
Stoned-A: Same as Stoned above, but does not infect the system
hard disk. This is the original virus and is now extinct.
The text found in the boot sector of infected diskettes
is: "Your computer is now stoned. Legalize Marijuana".
The "Legalize Marijuana" portion of the text is not
Stoned.Angelina: Similar to Stoned indicated above. This
variant contains the following encrypted text string:
"Greetings for ANGELINA !!!/by Garfield/Zielona Gora"
Origin: Unknown December, 1997.
Stoned.Arc Hub: Based on the Stoned virus above, this is a
stealth variant. When memory resident, it will hide
the infection on disk. Its size in memory is 2,048
bytes. This variant contains the following text
"ARC HUB 8A"
Origin: Unknown December, 1997.
Stoned-AT Love: Similar to the PS-Stoned variant, this variant
moves the original boot sector on 5.25 inch 360K
diskettes to sector 11, the last sector of the root
directory. On 1.2M 5.25 inch diskettes, the original boot
sector will be moved to sector 17, in the middle of the
root directory. The master boot sector on the system hard
disk will have been moved to Side 0, Cyl 0, Sector 17.
It contains the following text string which may be
displayed when the system is booted:
"˙available Your PC is now StNED in LVE with AT ˙becomes
Origin: Unknown May, 1992
Stoned-B: Same as Stoned indicated above. Systems with RLL
controllers may experience frequent system hangs. Text
typically found in this variant is: "Your computer is now
stoned. Legalise Marijuana". The "Legalise Marijuana"
may also be in capital letters, or may be partially
overwritten. It is not displayed.
Stoned-C: same as Stoned, except that the message has been
Stoned-Collor: Similar to the original Stoned, this variant
from Brazil's main distinction is that the text strings
within the virus have been changed to:
"Collor, um tiro basta!"
Origin: Brazil 1991.
Stoned-D: same as Stoned, with the exception that this variant
can infect high density 3.5" and 5.25" diskettes.
Stoned-E: Similar to Stoned-B, this variant now emits a "beep"
through the system speaker when the following message is
displayed: "Your PC is now Stoned!" The text "LEGALISE
MARIJUANA!" can also be found in the boot sector and
system master boot sector.
Stoned-F: Similar to Stoned-E, this variant also emits a "beep"
through the system speaker when its message is
displayed. The displayed message is: "Twoj PC jest teraz
be!" The text "LEGALISE MARIJUANA?" can also be found in
the boot sector and system hard disk master boot sector.
Stoned II: Based on Stoned-B, this variant has been modified to
avoid detection by anti-viral utilities. Since its
isolation in June, 1990, most utilities can now detect
this variant. Text in the virus has been changed to:
"Your PC is now Stoned! Version 2" Or: "Donald Duck is
a lie." The "Version 2" portion of the text may be
corrupted as well.
Stoned-LM: Based on the Stoned virus, this variant will only
infect diskettes when the boot sector is directly accessed
with read and write intent, usually resulting in a system
hang. The location of the original boot sector and the
hard disk master boot sector is similar to the original
Stoned virus described above.
Origin: Canada October, 1992.
Stoned-Mexican: Discovered in Mexico in May, 1992, this variant
of Stoned contains the following text string:
"NO VOTES FOR EL PRI".
Origin: Mexico, May 1992.
Stoned Mutation: Submitted in June, 1992, Stoned Mutation is a
minor variant of the Stoned virus. Its major destinction
is that it does not infect diskettes unless the diskette
boot sector is accessed with write-intent. It contains
the same text strings as the original virus.
Origin: Unknown, June 1992.
Stoned-NSD: Isolated in October, 1991 in the Eastern United
States, Stoned-NSD is a minor variant of the Stoned
virus. Its major difference is that the text strings
have been altered to: "Non SYStEM dISc" and
"LEGALISE MARIJUANA", though the second string will
usually be corrupted to "LEGALISE4". Once this second
string is corrupted, all later infections will have
the corrupted string. Stoned-NSD can infect high
density, 1.2M 5.25" diskettes, moving the original
boot sector to sector 17.
Stoned-NZ: Received from New Zealand in October, 1991, this
variant of Stoned has one slight difference. It does
not always save the original hard disk master boot sector
when it infects the system hard disk. The text string
found in the virus is: "YOUR PC IS NOW STONED!".
See: Evil Empire Horse Boot Swedish Disaster NoInt