IMPORTANT NOTES SHERIDAN COLLEGE makes no claim, implied or otherwise, on the successfull use of this software. This vaccine software is supplied to you AS IS, without warranty as to performance. USE AT YOUR OWN RISK. We warrant only that the vaccine has proved effective in eliminating the "Stoned" virus that infected the Oakville Campus student labs. Please run the README.BAT file and follow the instructions carefully. The vaccine has proven effective in cleaning the virus from 5 1/4" floppy disks and 3 1/2" floppy disks. H.EXE will clean the virus from the hard drive of a DOS-based microcomputer. The vaccine is freeware and may be freely copied and distributed by you. The user must assume the risk of using this software. *** KEEP A WRITE PROTECT TAB ON THE VACCINE SOFTWARE DISK OR ELSE YOU RISK CONTAMINATING IT WHILE CHECKING FOR THE VIRUS. *** AFTER CLEANING THE VIRUS FROM THE HARD DRIVE, RE-BOOT THE COMPUTER BEFORE ANY OTHER DISK ACCESS OF DRIVE A OR DRIVE C. RE-BOOTING REMOVES THE VIRUS FROM RAM MEMORY. Please send a cheque payable to SHERIDAN COLLEGE - C & TS for $5.00 to help defray the costs or send us a virus-free disk. Our address is SHERIDAN COLLEGE Computing & Technical Services Attn: Uwe Soeder 1430 Trafalgar Road Oakville, Ont L6H 2L1 SHERIDAN COLLEGE - STONED "B" VIRUS ANTIDOTE PROGRAMS: file: CHK_STER = checks floppy disks and sterilizes them ... and allows USER to EXIT by pressing the Enter Key file: FLP_CB = checks floppy disks and sterilizes them ... and allows USER to EXIT by pressing both Ctrl and Scroll Lock keys file: FLP_NCB = checks floppy disks and sterilizes them ... but does not allow USER to EXIT until the system is Re-booted . . . file: H = checks and sterilizes HARD disks ... file: HARD = stand-alone HARD disk sterilizer (no checking) file: M = menu system: user is presented with 2 choices Type a number then press the enter key OR Type H to sterilize the hard drive ... Recommendations for removing the Stoned-B virus from the hard drive. - Insert the 5 1/4" vaccine disk in drive A and enter the following command after making A the default drive. A:> M This command will execute the program M.BAT which will give the user instructions for running programs to check and remove the virus from the hard disk or a floppy disk. These messages are contained in the file CHK-MENU.TXT. As indicated on the screen: - Enter the following command to check the hard drive for the virus. ** DO NOT ATTEMPT TO REMOVE THE VIRUS WITH THIS OPTION UNLESS THE CHECK INDICATES THE PRESENCE OF THE VIRUS ** A:> 2 This command will execute the program 2.BAT which will, in turn, execute the program H.EXE. H.EXE is a machine language program which will display the boot sector on the hard drive and another sector which will contain nulls on a computer that has never been infected with the Stoned-B virus and the original boot record on an infected computer. If the boot sector contains the message, "This PC is stoned!", then the second sector should contain a good copy of the original boot record. If the computer is NOT INFECTED, do NOT ATTEMPT TO REMOVE the virus from the hard drive. This could copy nulls over your good boot record and thus your computer would no longer boot from the hard drive. For a computer infected as described above, you may remove the virus by following the instructions displayed on the screen by the program. If you select to remove the virus it will be removed by taking a copy of the good boot record and copying it over the virus program in the boot sector. - When the menu reappears the virus will have been eliminated from an infected hard drive but not from RAM memory. Any further disk access of drive C or A will cause the resident virus to contaminate any disk in drive A that is not write-protected. REMOVE THE VIRUS FROM RAM by doing a cold boot of the computer without any disk in drive A. - You may now run the menu program, M.BAT, once again to check the hard drive or any floppy disks for evidence of the virus. Recommendations for removing the Stoned-B virus from a floppy disk. - Perform a cold boot of your computer after you have made sure that the hard drive is not contaminated. The virus will therefore not be resident in RAM. - Insert the 5 1/4" vaccine disk in drive A and enter the following command after making A the default drive. A:> M This command will execute the program M.BAT which will give the user instructions for running programs to check and remove the virus from the hard disk or a floppy disk. These messages are contained in the file CHK-MENU.TXT. As indicated on the screen: - Enter the following command to check the floppy disk for the virus. A:> 1 This command will execute the program 1.BAT which will, in turn, execute the program CHK_STER.EXE. CHK_STER.EXE is a machine language program which will display the boot record of a disk in drive A. The disk does not have to be bootable. If the boot sector contains the message, "This PC is stoned!", then the disk is contaminated. For a computer infected as described above, you may remove the virus by following the instructions displayed on the screen by the program. If you select to remove the virus, it will be removed by taking a copy of a good boot record for MS-DOS 3.3 and copying it over the virus in the boot sector. If the disk was originally bootable, it will no longer be bootable unless it was originally formatted with MS-DOS 3.3. The disk will however be useable and it will not have the virus. - When the menu reappears, the virus will have been eliminated from an infected floppy disk. You may check the disk once again by entering the command: A:> 1 RECOMMENDED PROCEDURES FOR: Preventing the virus from re-contaminating your hard drive. If your hard drive has already been contaminated once and after you have removed the Stoned-B virus using the above procedure, you may use HARD.COM to prevent re-contamination from a floppy disk. ** DO NOT USE HARD.COM UNLESS A GOOD COPY OF THE BOOT RECORD EXISTS IN SECTOR 7 OF THE BOOT TRACK *** NOTE: A good copy of the hard disk boot record will be in sector 7 of the boot track if the disk has previously been contaminated with the Stoned-B virus or if you have used a utility program to copy the good boot record from sector 0 to sector 7. The program, 2.BAT, mentioned above, will display the contents of sector 0 and sector 7 of the boot track. If they both are the same and neither contains the message, "This PC is stoned!", then you are likely safe to use HARD.COM. To be absolutely safe, you must use debug or some utility software to copy the good boot record to sector 7 of the boot track on your hard drive. If the above conditions have been met, copy HARD.COM to your hard drive and enter HARD as a command in your AUTOEXEC.BAT file. Additional Notes: 1. To be sure that you have the Stoned-B virus you may use a commercial-type virus scanning program to identify the type of virus... A message should appear to indicate that the "STONED VIRUS" has infected the boot track area. Most computer bulletin boards like SHERIDAN COLLEGE'S (416)845-3224 bulletin board will have at least one public domain type of virus scanning program to help users. 2. FLP_CB.EXE or FLP_NCB.EXE may be used in a facility to set up one computer station with the Stoned-B virus checker and remover running continuously. Thus, any person may take their floppy disk to the station, check it, and remove the virus, if necessary.