Boot Sector Virus Shipped on German Laptops 79
Juha-Matti Laurio writes "A consignment of laptops from German manufacturer Medion, sold through German and Danish branches of giant retail chain Aldi, have been found to be infected with the boot sector virus 'Stoned.Angelina', first seen as long ago as 1994. The affected notebook models (German language) Medion MD 96290 have been pre-installed with Windows Vista Home Premium and Bullguard anti-virus, which reportedly is unable to remove it. A special removal tool was released to clean the laptops. Aldi has shared the same warning as well. Two years ago several thousands of Creative Zen Neeon MP3 players were shipped with a Windows worm Wullik.B."
Not jut Creative... (Score:2, Informative)
Re: (Score:2)
Re: (Score:1)
I think this is a common experience, because of quality control issues and manufacturing being outsourced to contractors. Here Apple talking about iPods shipping with a Windows Virus on it... straight from Apple's site. Click here [apple.com]. Apparently, a contractor was to blame.
Apparently, Apple was to blame. I don't really care about whether or not it's an inhouse or an outsourced screwup, when I purchase Apple gear, they've branded the item as theirs. The only exemption from this is if some computer store that sells the iPods has the added service to update the official firmware before selling the ipods as an added service to the customers, and the computer they then hook the iPod up to infects the iPod.
Now that's what I call.... (Score:5, Funny)
stoned.angelina (Score:5, Funny)
Re: (Score:2)
hah (Score:2, Funny)
Cant even clean up with their own AV.. Sucks to be them..
Re: (Score:2)
Re:Fix in O(1)-time (Score:5, Informative)
A lot of times the boot sector virus will move the boot sector to another part of the disk and relay the content to itself. It can also mark sectors as bad and thereby hiding it's content. When you install a boot loader, it will actually install to the moved version of the boot sector. I have seen in the past, and I don't remember which one, but a normal Format would erase the portion of the boot sector hiding the code and it would execute again. You would need to boot in a way that the disk wasn't accessed until after you loaded tools to specifically deal with them. Usually an Fdisk/mbr with a regular Fdkisk to rebuild the partitions and then another
This whole process got more complicated with the logical block addressing and a write cache. The main board is now expecting the drives to represent something different then they actually read in order to maintain compatibility. With a LBA drive, you aren't actually accessing the drive in itself but asking it to access it. It is possible to have the code you are attempting to remove be accessed and running before your tools actually write over it and remove it. Of course once the boot process (boot to floppy/cd) is over, the underlying OS isn't really susceptible to executing the code as it is in the original Bios boot process. But nothing is there to ensure it won't happen. Some of the bad blocks that could be hiding code placed outside the boot sector could be accessed and contain something that is executable in the boot environment you are using.
In all, it is difficult to remove a boot sector virus and retain any information on the disk. What I wrote is a little bit dumbed down of the actual processes that can happen. I have seen claims of boot virus being able to do things even more elaborate but don't know of any in actual existence. I guess I am amazed that in this late in the game, they are still a problem. Almost every anti-virus app should be able to detect and at least disable them. A simple scan of an image waiting to be burned to a hard drive should catch any nasty unwanted things before going into production. Maybe they cannot scan the images now?
Re: (Score:1)
Your boot sector (MBR) has a data section that stores the partition table/drive information for that hard drive/disk and a code section that contains the actual boot loader. A virus could either overwrite only the code section - in which case your data is still readable and the virus can simply be
Re: (Score:2)
What could happen is that the Jump sequence that moves the drive to executable portion of the MBR which doesn't have to be in the MBR could be over written and place
Re: (Score:2)
Hmm (Score:5, Informative)
Ouch (Score:4, Funny)
What was whoever doing on the base image that caused it to become infected? I build system images, and rule #1: Make sure it works cleanly when you're done.
Somebody's Head
------------------- = Silver platter
(Silly junk character filter, I can't even ASCII Art a silver platter)
So, is this... (Score:5, Funny)
Re: (Score:2)
Re: (Score:1)
ALDI-Notebook NOT infected... (Score:5, Informative)
Quick translation: Since there was some Press-noise, MEDION feels the need to say that the ALDI-Notebook is not infected with the Stoned Angelina virus.
Re: (Score:1)
Due to isolated press reports to the contrary, MEDION AG clarifies that the ALDI-Notebook has not been being delivered with the virus Stoned Angelina.
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
In other news... (Score:2)
Re: (Score:2)
Re: (Score:2)
The Animal game eventually stopped replicating when there were changes to the Univac filesystem that broke its copy test.
Special removal tool? (Score:1)
Thank goodness it wasn't a BIOS trojan.
Isn't Adli a grocery store? (Score:5, Funny)
No, it's a supermarket. (Score:4, Informative)
Re: (Score:2)
Aldi isn't really a grocery store - they're more like a large convenience store... i.e. supermarket.
Ah -- the German equivalent of a Super Wal-Mart or Target.
Yes it is a grocery store... (Score:1, Flamebait)
Re: (Score:1)
Not that I would buy a PC at a supermarket, anyway. I recommend buying from smaller specialized retailers, which will also be happy to build a PC by your specifications and with your OS of choice (or no OS at all).
Re: (Score:1)
I guess that's why Wal-Mart had the "smile or get fired" policy.
Re: (Score:2)
These are usually very good value for money. The drawback is that you have no choice, as they only sell one model.
They can be so cheap because of their buying power, there are about 8.000 Aldi stores in Europe, and each gets 15 computers to sell as a minimum, AFAIK. The next week it w
Re: (Score:2)
Always run DBAN or some other eraser first (Score:3, Informative)
Re: (Score:1, Informative)
Re: (Score:2)
DBAN and similar tools are great for erasing data on a hard drive you're loosing physical possession of (for whatever reason), but there's no need to spend hours or days cleaning a disk you've just acquired. If you erase the boot sector and partition information then you have destroyed everything you need to destroy in order to ensure it's "clean" - i.e. as far as the BIOS or OS is concerned there is nothing stored on the disk to load and execute. This can be achieved in just
Bullguard anti-virus (Score:1)
Re: (Score:1)
Efficient! (Score:2)
I smell a conspiracy.
Where do you get such an old virus? (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:1)
Remember the KAK worm. Shut down computers at 5:00 PM on Friday. Something like that. It was spread in an invisible executable signature in Outlook Express. I had a good deal of admiration for that one, and we made a lot of money cleaning it up. Now who would have thought about a script as a signature that copied its
Re: (Score:1)
Re: (Score:1)
Boot sector virus? (Score:2, Funny)
so, there's a tool to clean it up, use it (Score:1)
Re: (Score:2)
Oblig (Score:1)
Just imagine if... (Score:2)
Cool! Preinstalled virus! (Score:2, Funny)
I work at Medion's Hotline (Score:3, Informative)
We also have a nice little fix for it, even though it oughtn't have been nescesary to make one in the first place.
But it's always fun to get 3x the amount of calls as normal due to a cock-up like this.
And to be honest - it's an MBR virus. Has no payload, spreads primarily through floppy disks. It's about as dangerous to computers today as diarrhoea [wikipedia.org] is in a western country. Sounds bad, but nothing to worry about.
FDISK (Score:4, Informative)
Re: (Score:1)
The first time I saw this one (Score:1)
I got this virus in early 90's (Score:2)
remind me (Score:3, Insightful)
just be thankful ... (Score:2)
At least you're still able to re-format and start from scratch.....