Virus comes back from dead on German laptops
Red faces as boot sector virus kicks Medion.
By John Dunn | Techworld | Published: 02:09, 17 September 2007
A virus though to have died out years ago is believed to have infected up to 100,000 laptops during manufacture by German vendor Medion.
The exact number of systems affected by the 'Stoned.Angelina’ virus is not known, but the consignment of between 10,000 and 100,000 Medion laptops was destined for sale in Danish and German outlets of European retailing giant Aldi. The company also sells Medion laptops in the UK.
Luckily, the virus in question is a boot-sector master boot record (MBR) infector, and while it can exist on the hard disk boot sector of the laptops in question, it would need a floppy drive to spread itself to new systems. The laptops ship without floppy drives.
Stoned.Angelina was first seen in January 1994, though it has been recorded in the wild as recently as 2001, about the time the floppy drive died out in common use. It has no payload, and would remain dormant if unable to spread.
The systems concerned are identified by anti-virus vendor Bullguard – whose anti-virus software is supplied on the Medion PCs – as being Vista Home Premium systems with the production ID MD96290. Although the virus can’t do anything significant to the laptops, affected machines need to download a special removal tool to get rid of it.
It is fortunate that the standard software can identify the virus on infected systems because anyone running the specially-crafted removal tool on systems not infected is warned that they risk causing damage to the machine.
This all begs the question of how the virus got on to some machines in the first. In fact, malware cropping up on factory machines, or in places it might not be expected, has a history so long some malware has started exploiting the principle.
In May the ‘SillyFD-AA’ worm was found to be targeting removable USB media, in a distant echo of the extinct boot sector infection technique of Stoned.Angelina.
