************************************************************************ Virus_Checker Documentation by John Veldthuis Member of SHI Anti Virus Group ************************************************************************ Distribution About Safe Hex International Setting Up Virus_Checker Documentation for French Users Virus_Checker Version Notes Viruses Virus_Checker Deals With: Credits ************************************************************************ DISTRIBUTION: Virus_Checker is a freely distributable, copyrighted piece of software. You do not have to pay money to use it, and may upload it wherever you choose, but you are not allowed to sell Virus_Checker for profit, or include Virus_Checker on a disk which is sold for profit, without the author's (John Veldthuis) permission. Commodore have this permission already. Money is not solicited but would be welcome. I can be contacted at the address below. Please send me any more new viruses so I can update Virus_Checker, but please don't send a letter asking for a copy without sending me money to cover postage and disks. I cannot afford to send everyone a disk out of my own pocket. If you send just a disk then don't be surprised if you never see it again. John Veldthuis 21 Ngatai Street Manaia, Taranaki New Zealand Phone +64-6-274-8409 Email addresses: FIDO 3:771/440.0 USENET johnv@tower.actrix.gen.nz ABOUT SAFE HEX INTERNATIONAL SAFE HEX INTERNATIONAL HAS MY PERMISSION TO DISTRIBUTE THIS PROGRAM IN THE ARCHIVE "THE NEW SUPERKILLERS" OR IN ANY FORM THEY WISH TO If you know a virus programmer you can get a reward of $1000 for supplying his name and address. The fact is that the law punishes data crime very severely. (5 years in jail in most countries). We are an international group with more than 500 members who are trying to stop the spread of viruses. Let me give you some example: 1. Our motto is: "Safe Hex", who dares do anything else today?". 2. A virus bank containing more than 1800 Amiga and PC viruses to support good shareware anti virus programs. 3. We help people to recover money lost by virus infection. 4. We write articles about virus problems for about 20 computer magazines worldwide. 5. We release the newest and the best virus killers around. 6. We have more than 35 PC and Amiga "Virus Centres" worldwide where you can get free virus help by phoning our "Hotline", and the newest killers translated into your own language at very little cost. For more information in the UK contact: Paul Browne [Please send a ] SHI Regional Virus Centre UK [stamp for ] 304 Leeds Road [return postage.] Eccleshill BRADFORD W. Yorks BD2 3LQ shiuk@cix.compulink.co.uk 2:250/320.4@fidonet.org 39:138/14.4@amiganet.ftn BOOTBLOCK.LIBRARY As from version 6.29, Virus_Checker can use the SHI Bootblock.library by Johan Eliasson Phone: +46 11 169138 Bäckgatan 6 60358 Norrköping SWEDEN What this does is add a brainfile of Bootblock viruses to Virus_Checker. You can update this file as SHI release new brainfiles. This way you can update Virus_Checker to recognize new BootBlock viruses without getting a new program. The file BootBlock.brainfile has to go in the L: directory and the Bootblock.library file in the LIBS: directory. The Install script will put it there automatically. DECRUNCH.LIBRARY As from version 6.23, Virus_Checker can use decrunch.library by Georg Hörmann Am Lahnewiesgraben 19 8100 Garmisch-Partenkirchen GERMANY Many thanks for the use of this. The decrunch.library file must be in libs: so that Virus_Checker can use it. WARNING!WARNING!WARNING decrunch.library seems to have a problem in that it picks up some files as crunched files when they are not. It then crashes the machine totally. This is not Virus_Checker crashing and I can do nothing about it except to say. If Virus_Checker crashes when you are scanning file and you have crunched file checking turned on then turn it off and check again. If it still crashes then the problem lies with Virus_Checker. If not then the problem is decrunch.library and I cannot do anything about it. INSTALLATION: To run Virus_Checker once, either type it's name into a CLI window (while the program is in the current directory), or double-click on it's icon from the Workbench. The program will be active until you quit it or reset your computer. Installing Virus_Checker so that it will be active all the while your computer is running is a good idea. This is because viruses can be on any disk you insert into any disk drive. With Virus_Checker always active, you will be protected. THE WORKBENCH STARTUP WORKBENCH 1.3 USERS INSTALL WORKBENCH 2.xx USERS INSTALL VIRUS_CHECKER OPERATION THE AREXX INTERFACE THE USE OF THE DECRUNCH.LIBRARY THE USE OF THE BOOTBLOCK.LIBRARY NOTICE FOR USERS OF FILE PACKERS AND CRUNCHERS: ENFORCER USERS: WorkBench 1.3 install Under 1.3, to install Virus_Checker so that it will be run whenever you reset your computer, edit your startup-sequence to include simply "Virus_Checker". The program will have to be either in the root directory of the disk you are booting off of, or in the C: directory, for this to work. WorkBench 2.xx install Under the 2.0 operating system, installation is much easier. All you have to do is drag the icon for Virus_Checker into the WBStartup drawer on your Workbench disk (or your boot partition if you use a hard disk), and Virus_Checker will automatically be loaded when the Workbench is loaded. If you don't load or use WorkBench then edit the user-startup file in the s: directory and simply include "Virus_Checker" somewhere in it. NOTICE FOR USERS OF FILE PACKERS AND CRUNCHERS: If you use a program such as PowerPacker to make your files smaller then be aware that you must check these files before you crunch them. If the file is infected and you crunch them then VC will not find the virus in the file unless you have the crunched checking option turned on ENFORCER USERS Just a quick note for people who use the program called enforcer. Virus_Checker will cause Enforcer hits when it does it's memory scan. There is no way around this as it is the only way to detect a couple of viruses. For each low memory read Virus_Checker will cause 1 enforcer hits. This will happen only when Virus_Checker starts up and when you cause it to do a full memory scan via the menu or 'm' key. There should be 4 enforcer hits. The reads are from location $20 and location $6c. FRENCH USERS Someone has gone to the trouble of translating the Virus_Checker docs into French. If you wish to get them then please read the following You can get the French doc from AUGL or order it for 20 French Francs at: BUGSS c/o Christophe Guillon 12 allee des ecureuils La residence La Chataigneraie Appt 22 33600 PESSAC FRANCE Direct any questions to rullier@platon.emi.u-bordeaux.fr or 2:324/8.1 2:324/8.3 COMMAND LINE OPTIONS: The syntax is: Virus_Checker [-l###] [-t###] [-w###] [-b] [-q] [-i] [-n] [-m] -c# [dirname] Where: -l### tells Virus_Checker how far from the left edge of the screen to open the Virus_Checker window. -t### tells Virus_Checker how far down from the top edge of the screen to open the Virus_Checker window. -w### tells Virus_Checker how wide you want the window. It has a maximum size of 386 pixels and a minimum of 200. Any numbers out of this range are ignored. This is ignored by Workbench 2.0 as there is really no need for it due to being able to 'pop' the window up when you want it and hide it when you don't want it. -b tells Virus_Checker to send its window to the back of all the other open windows. -n tells Virus_Checker not to open a window. It will check memory and disks inserted but you will have to use the ARexx port or the commodities 'Exchange' program (or the hotkey) to get it to scan the whole disk for Link/File viruses or to view the user interface. To stop VC, run VC again, use the ARexx port, or send it a Kill command from the commodities 'Exchange' program. -q tells Virus_Checker to check all memory, files, and disks for viruses, then exit. To check the dh0: partition and exit, do the following: "Virus_Checker -q dh0:". This will check memory, disks, files, and dh0:, then exit. -i tells Virus_Checker not to put up a requester when it can't read the bootblock of a disk. -m tells Virus_Checker to watch the file s:startup-sequence for any changes. Some viruses will change this file and VC will catch it. (Only works under WB2.0 and above) -c# where # is 0 or 1 If -c0 is used then checking inside crunched files is turned off if -c1 is used the the checking is turned on. dirname is the directory/file you want checked for File Viruses on startup. An example to open the window at x/y position of 200/100 and check DH0: is: "Virus_Checker -l200 -t100 dh0:". Virus_Checker l 10 top 20 b i dh0:test This will set the VC window at x/y position of 10,20, make it into a backdrop window, ignore errors from the BootBlock reads and check the file dh0:test when it starts up. For the window coordinates, any values outside the size of the WB screen are ignored and any non numerical values are ignored. There must be no spaces between the options and the numbers. Options may be given in any order. If Virus_Checker is already running, and you invoke it again from the command line, it will pop open the already running version. For WB2.0 users the command line is L=LEFT T=TOP B=BACKDROPWINDOW N=NOWINDOW Q=QUIT I=IGNOREBB W=WATCHSS CHECKCRUNCHEDON CHECKCRUNCHEDOFF K=KILL S=STDOUT IGNORECAPTURE BBLIB LOWOFF DIR L=LEFT is tells Virus_Checker how far from the left edge of the screen to open the Virus_Checker window. T=TOP tells Virus_Checker how far down from the top edge of the screen to open the Virus_Checker window. B=BACKDROPWINDOW sets the Virus_Checker window as a Backdrop window N=NOWINDOW Virus_Checker not to open a window. It will check memory and disks inserted but you will have to use the ARexx port or the commodities 'Exchange' program (or the hotkey) to get it to scan the whole disk for Link/File viruses or to view the user interface. To stop VC, run VC again, use the ARexx port, or send it a Kill command from the commodities 'Exchange' program. I=IGNOREBB tells Virus_Checker not to put up a requester when it can't read the bootblock of a disk. W=WATCHSS tells Virus_Checker to watch the file s:startup-sequence for any changes. Some viruses will change this file and VC will catch it. CHECKCRUNCHEDON turns on checking inside crunched files CHECKCRUNCHEDOFF turns off checking inside crunched files K=KILL will delete files with LINK viruses in them and not try to remove it Q=QUIT tells Virus_Checker to check all memory, files, and disks for viruses, then exit. To check the dh0: partition and exit, do the following: "Virus_Checker QUIT dh0:". This will check memory, disks, files, and dh0:, then exit. S=STDOUT This is a special mode for Virus_Checker. It implies that Virus_Checker will quit as soon as it finishes it's checks, Will not put up any requesters, opens no window, and if it finds any virii it will not delete them but will write the name of the file and virus to the shell from which it started. This can be used by BBS operators to check archives automatically. a line like Virus_Checker >ram:infected STDOUT DH0: would check all files in DH0: and if it found any would write the results to a file called ram:infected. IGNORECAPTURE tells Virus_Checker to ignore the initial check on the capture vectors. It will still warn you of changes while it is running. BBLIB This tells Virus_Checker to use the SHI BootBlock.library. This should be used as any viruses detected by this library will not be added to the normal Virus_Checker checking. You need BootBlock.library in the LIBS: directory and BootBlock.brainfile in L: LOWOFF tells Virus_Checker to ignore the low memory vectors so that it will not cause any Enforcer hits. BEWARE this disables a couple of memory checks for viruses so use it at your own risk DIR is the name of a dir/file to check for viruses on startup THE WORKBENCH STARTUP: SPECIAL NOTE: If Virus_Checker is not run from Workbench it will look for the file S:VIRUS_CHECKER.INFO This is just a standard workbench info file and can be used as described in the next section. This is to allow 1.3 users who run VC from their startup-sequence to config VC easily. It will work for 2.0 users as well. I have done it this way because it is too hard to find where a program ran from under 1.3. This way I only have to look for 1 file in one directory. To use it add the stuff you want under Workbench and save it. Then copy the Virus_Checker.info file to the S: directory. Support for the icon stuff has now been put in. These will override the default settings and also the settings in the S:Virus_Checker.config file. It will only affect those things that are given in the ICON. The rest will be left as default or as the config file sets them. The things that you can put in via the Information menu on Workbench are as follows. These will be used if VC is started by Workbench HOTKEY is only used by WB2.0 HOTKEY=string /* HOTKEY=lcommand shift del */ LEFT=num /* LEFT=150 */ TOP=num /* TOP=25 */ WINDOW=ON/OFF /* WINDOW=ON or WINDOW=OFF */ RESIDENT=ON/OFF /* RESIDENT=ON or RESIDENT=OFF */ IGNOREBBERROR=ON/OFF /* Ignore BootBlock Read Error */ /* use IGNOREBBERROR=OFF to turn requester off*/ WATCHSS=ON/OFF /* WATCHSS=ON or WATCHSS=OFF */ CHECKCRUNCH=ON/OFF /* Turn on/off Crunched file checking */ DF0=ON/OFF /* DF0=ON or DF0=OFF */ | V ;If Off VC will not check BootBlock or startup-sequence DF3=ON/OFF FULLCHECKDF0=ON/OFF /* FULLCHECKDF0=ON or FULLCHECKDF0=OFF */ | V ;If ON VC will scan all files on the inserted disk. FULLCHECKDF3=ON/OFF BBLIB=ON /* Tells VC to use BootBlock.library */ IN ALL CASES DO NOT USE THE QUOTE MARKS " or ' in any place. VC can see the spaces between strings without them. THE AREXX INTERFACE: VC has an ARexx port, which means you can send VC commands using the REXX language, available from your Amiga dealer, or as part of the 2.0 Operating System. The port name is "Virus_Checker". Be aware that case is important and ARexx will not find it if the name is not spelled right. Here is an example ARexx program that talks to VC: /* ARexx programs must start with a comment */ address 'Virus_Checker' /* Talk to Virus_Checker */ 'checkdrive\df0:' /* Make virus_Checker check df0: */ /* for viruses */ 'scanforsaddam\df0:' /* Make VC check df0: for Saddam */ /* virus damage */ 'quit' /* Make Virus_Checker shut down. */ 'drive\df1: off' /* Turn off df1: from being scanned */ Notice the '\' between the command and the drive name in the middle examples. This must be put between all commands and their options. 'quit' does not take an option so does not need the '\' character there. Virus_Checker will take the following commands: checkdrive\drivename Check drive 'drivename' for file viruses. scanforsaddam\drivename Check drive (DF0:-DF3) for Saddam damage. quit Make Virus_Checker shut down. saveconfig Save the s:Virus_Checker.file file window\option Open or Close window (Option = on or off) drive\df?: option Turn on/off Drive scan (Option = on or off) resident\option Turn on/off Resident flag "" "" "" checkfile\device:dir/filename checkbootblock\df?: Check the Bootblock in df? for viruses Special note for 'checkfile' command. This one turns off any requesters while doing it's work. If the command OPTIONS RESULTS is used it will return RESULT if no virus found or if a virus is found then the string VIRUSNAME Virus was/is present in the file. This does not mean the virus is gone as there may have been errors trying to remove the virus. This is really for BBS users who want to check files as they come in. You could write an arexx script to search files and log any that come up with viruses. Later after findong which ones where infected you would run VC over them again via the main menu thus making sure they where clear. CheckBootBlock command This one also needs the options results and returns messages. If the disk is clear or you give it a number outside the range of df0: to df3: it will return 'Okay', if VC had trouble reading the disk the message returned is 'ERROR reading BOOTBLOCK', if the bootblock is Not the normal one then 'NON-STANDARD BOOT CODE' is returned. If the Bootblock is infected then the virus name will be returned. At present there is no way to clear the virus from Arexx but I am working on it. Requesters are disabled while this is done. VIRUS_CHECKER OPERATION: Upon running Virus_Checker, it will first check your memory for viruses and tell you if any were detected. They will either be removed or disabled. Next all disks in the floppy drives will be checked. Any disk put in any drive (df0: to df3:) will be checked. If Virus_Checker finds and disables the LAMER virus in memory, the machine may guru. Once the machine is reset, however, the virus should be gone. THE 2.0 USER INTERFACE: Many Thanks goes to Steve Tibbett for designing and most of the C code for this section. All I did was translate it into assembly and intergrate it into Virus_Checker. This section describes the user interface that Virus_Checker uses when Kickstart 2.0 is detected in your computer. This section does not apply for users with Kickstart 1.3. Kickstart 1.3 users can see the special note for using the Config file below. Virus_Checker can be used either with a window open, or with no window open. When used with the window closed, Virus_Checker will only show itself when it has something to tell you about. If you insert a disk containing a virus, Virus_Checker will pop up a requester telling you about it, and give you some options to deal with it. The normal Virus_Checker user interface can present itself in two forms. One is the 'TitleBar Window', where only the close gadget, the depth gadget, the Zoom gadget, and the program name are visible. If you click the Zoom gadget, Virus_Checker's window will change into a window occupying nearly half a normal 640x200 Workbench screen. This window is broken up into three sections: The Preferences section, the Files section, and the Drives seection. In the Preferences section, you can tell Virus_Checker whether it should open a window or not, whether the window should be a Backdrop window, and whether Virus_Checker should quit immediately when run, or whether it should stay resident. You can also set the window position, and the hotkey that will call Virus_Checker when you want to open it's window or pop it to the front. (The hotkey format is described in the AmigaDOS 2.0 manual, in the section on the commodities exchange). As from 6.05 you can also tell Virus_Checker to ignore errors when reading the BootBlock. It will be saved in the config file. THE DEFAULT HOTKEY is Left-Amiga Shift del The Files section is where you list the drives or directories that Virus_Checker will check when you click the Check button. If you 'Add' DF0: and DF1: to the list, then choose Check, then Virus_Checker will check all the files on both DF0: and DF1: for file viruses. The Drives section lets you specify which of your floppy disk drives will automatically be checked for bootblock and file viruses when you insert a disk. If you have a program like CrossDOS and you don't want Virus_Checker looking at the msdos disks then simply disable it and Virus_Checker will never look at that drive again. Unless you enable it again. The Second row of Drive gadgets turn on and off the automatic scanning of the entire disk. These are disabled by default. If you turn them on, then Virus_Checker will scan the entire disk every time you insert one. Checking for file viruses takes some time, so you may not want this on for a drive that you are constantly moving disks in and out of. The state of these gadgets is also saved in the Config file. Any of the Gadgets that have text with an UnderScore beneath then can be accessed by simply pressing the that key on the keyboard. For example. If you wished to change the Hotkey you will notice that the H in HotKey is Underlined. This means simply by pressing the 'h' key that gadget will become active. The options that you set in the user interface can be saved to disk using the Save button. The options are saved to the file "S:Virus_Checker.Config", and are read from there whenever the program is loaded. KEYSTROKES: The Following keys will activate the following functions, when typed into the Virus_Checker window: s - Will activate the Scan mode m - Will immediately do a complete memory scan (same as startup) f - Will activate the Saddam Disk Scan (used to fix Saddam virus damage) 0 - 3 Will check the First File in startup-sequence and bootblock on disk in drive which matches number There are also some options on the menu (hold the right mouse button to get to the menus) which have keyboard-equivalent shortcuts. These are next to the inverse A on the menu. LINK/FILE VIRUS CHECK: If you want to check a disk for Link/File viruses then put the disk in any drive. Make sure the Virus_Checker window is active and use the right mouse button to bring up the Project Menu. Select the "Link/File Scan" and release the mouse button. An alternative way is to just press the 's' key on the keyboard. This will bring up a requester asking you which drive to check. Enter the drive name in the box, eg. DF0:, DH1:,RAD: etc. Under WB2.0 you can also use the "Use Requester" option. It will then check all the files on that drive. You can also enter directories if you want to eg, c: df0:c, df0:libs etc. When Virus_Checker is scanning the disk and you know that a directory is clear and don't want to check it press control-d in the window with the filenames and Virus_Checker will ignore that directory and go back up one level. If you want to stop the check completely press control-c in the window with the filenames and Virus_Checker will print a break message then stop scanning the disk and go back to normal scanning. If Virus_Checker brings a requester up that says a program just run has infected your memory with the Xeno Virus, it has already disabled it. You should immediately check all files on the disks that are in the drives at that time. This means that a program that you just ran or a program some other program just ran is infected with the virus and all files should be checked to find out which one it was. With viruses which use a RomTag I have decided to clear out all RomTags to make sure I remove the Viruses from the list. In doing this you will lose things like Recoverable ram disks such as RAD:, VD0: etc. If you have a virus make sure that you save anything in the ram disks that you want before rebooting. The ramdisks and others will disappear on a reboot. My policy is better safe than sorry. BRAINFILE ADDITION: When VC finds a Non-Standard bootblock it will bring up 4 gadgets. One of these gadgets is Learn. Pressing this will allow VC to remember this BootBlock and not bother you again with it. To do this VC writes a file called VCBrainFile to the S: directory. If you have a single drive this will invoke a requester asking that Volume something be put in the drive. This will then save to the file. On Startup VC will check for the file in the S: directory and read it if it is there. If not it will carry on without it. If you get an error then VC will tell you about it and will happily write over the file next time. NON-STANDARD BOOT CODE: When Virus_Checker brings up a Requester that says the disk has non-standard boot code, this means that the code in the boot block is not what should be there. This does not mean that it is a virus as many games use copy protection in their boot blocks, and there are many bootblocks that do interesting things, that are not viruses. You should however be cautious if it is not a game. Do not replace the boot block if you are not sure. If something strange happens then please send a copy of the disk to me so that I can check it out. To determine if an unknown bootblock is likely a virus: 1. Format a blank disk so you know it is clear. 2. Make sure all disks except the one just formatted are write protected. 3. Boot from the disk that you suspect. 4. Place formatted disk in drive zero and then reboot. 5. Take disk out of drive zero and turn off computer for about 30 secs. 6. Run the Virus_Checker program. If the Virus_Checker finds non-standard boot code on the newly formatted disk, you have found a new virus. Please send it to me. CREDITS: My thanks go out to... Steve Tibbett. For designing and most of the C code for the 2.0 User Interface on Virus_Checker. Georg Hörmann. For the inclusion of the DECRUNCH.LIBRARY. Tim Nugent. For the conversion of this doc file to AmigaGuide format. ARexx. Developed on an Amiga 1000 and is a 100% Amiga product. John Veldthuis. ************************************************************************