DIA WASHINGTON DC//DSM-4//
          STANDARD DISTRIBUTION

SUBJECT:  COMPUTER SECURITY ALERT REPORTED VIRUS ON ORACLE
SOFTWARE (ASSIST 91-7) (U).
1.  (U) DISCUSSION:  IT HAS BEEN REPORTED THAT A NUMBER OF ORACLE
DEMO DISKS HAVE BEEN RECENTLY DISTRIBUTED BY ORACLE WHICH
CONTAINED THE STONED VIRUS.  IT IS NOT CLEAR WHETHER ANY OF THESE
DISKS WERE SENT TO DODIIS USERS.  RECOMMEND ALL DISKS RECEIVED BE
SCANNED FOR VIRUSES.  IN THE EVENT YOU EXPERIENCE UNEXPLAINED
ANOMALIES ON YOUR PERSONAL COMPUTER OR SUSPECT A VIRUS INFECTION,
PLEASE CONTACT YOUR LOCAL COMPUSEC OFFICER OR THE ASSIST FOCAL
POINT LISTED BELOW.
2.  (U)  DESCRIPTION:  THE STONED VIRUS WAS FIRST REPORTED IN
1988.  THIS VIRUS IS A BOOT SECTOR VIRUS WHICH IS MEMORY RESIDENT
FOLLOWING A SYSTEM BOOT FROM AN INFECTED DISK.  IT WILL INFECT
BOTH HARD DISKS AS WELL AS FLOPPY DISKS.  THERE IS AN ONE IN
EIGHT CHANCE THAT A COMPUTER BOOTED FROM AN INFECTED DISK WILL
DISPLAY THE MESSAGE: "YOUR PC IS STONED!" A MESSAGE "LEGALIZE
MARIJUANA" IS EMBEDDED WITHIN THE VIRUS BUT IS NEVER DISPLAYED. 
THE VIRUS IS NOT DESIGNED TO BE DESTRUCTIVE BUT DUE TO THE
VIRUS'S INABILITY TO HANDLE 5 1/4 INCH FLOPPY DISKETTES
CONTAINING MORE THAN 360K BYTES AS WELL AS 3.5 INCH DISKETTES,
THERE IS A POSSIBILITY OF DESTRUCTION OF DATA ON THESE STORAGE
MEDIA.  THE VIRUS STORES ITSELF IN AN UNIQUE AREA IN THE BOOT
SECTOR AREA ON HARD DISKS THAT IS ALMOST ALWAYS VACANT.  IN MOST
CASES THIS IS VALID, BUT IN SPECIAL CASES, THIS AREA CAN CONTAIN
DIRECTORY DATA WHICH THE VIRUS WILL OVERWRITE.
3. (U) ASSIST POINT OF CONTACT FOR THIS MATTER IS MIKE HIGGINS,
COMM (703) 284-0182 / DSN 251-0182.  ASSIST CAN BE REACHED 24
HOURS PER AT PAGER (202) 896-6863, AFTER THE TONES FROM A TOUCH
TONE PHONE ENTER THE CALL BACK NUMBER, OR DSN 243-8000 AND ASK TO
HAVE THE ASSIST DUTY OFFICER PAGED.