VIRUS HUNTING AND HARDWARE FAILURES IN PRACTICE STRANGE THINGS CAN HAPPEN TO YOUR AMIGA, BUT MAYBE THE HELP YOU HAVE BEEN WAITING FOR IS HERE Unfortunately all Amiga owners have gradually noted a diminishing of their original pleasure , once they have had the Amiga a while . They bought a computer, brought it home, turned it on and realised pretty quickly that a computer isn't all brightness and light. We have often heard about viruses that have caused terrible damage to public data installations on the TV and read about them in the papers ; but new Amiga owners often forget that we are a smaller data installation, and just as vulnerable as the big data installations. Please attention ..., it is just not enough to have a couple of good virus killers , and imagine that they will cure all your problems. COMPUTER VIRUS A GROWING PROBLEM I have followed the virus problem for the past four years and it has gradually become my hobby to 'research' into various viruses...believe it or not. I must be one of the few people in the world who is pleased to meet a new virus. (Think at me next time you meet one....!) Yes, lots of you will say: "I can probably manage to 'wave' a new boot virus, if I find one;" but alas! today the situation is quite different. Now.......a new Amiga virus comes up every week and, even worse, a lot of them are non-boot viruses. Thus jannuary 1992 was marked by no less than 3 of these, together with 6 new boot viruses. In other words, more viruses in a single month than we had in the whole three first years the Amiga came onto the market! In my view, this development will become pretty serious if we don't all do something to stop the spread, that is to say....it means YOU TOO! SOME SIMPLE RULES So what can one do? Yes, this time I won't go into more technical de- tails, but will just lay down some ground rules: 1. Always keep your disks write protected. If you need to write on the discs then turn off the Amiga for 60 seconds so that any possible viruses which could have sneaked into the memory will have gone. 2. An embarrassing topic, pirate copies, never swap games and the like with someone you don't know. Viruses flourish typically in school yards and the like amongst children and the young who only consider the Amiga as a fun games machine. Learn....... to say no thank you! 3. Once the accident has happened, don't despair but try to get hold of one of the newest virus killers which can often be found on our excellent Amiga BBS modem bases. I will mention another possibility later in this article. 4. If you download programmes by modem, ask the 'SYS OP' which virus kil- ler program it uses to ensure that the files on the base are virus free and, last but not least, which version. Not infrequently has the 'SYS OP' been asleep for the past hour. Avoid bases like that, especially if you have a hard disk. 5. If you are one of the fortunate owners of an Amiga 500 from and with revision 6 and after, or an Amiga 2000 type B, I strongly recommend you go and buy the new Super Fat Agnus (around $ 70), which nearly hinders all viruses from lying hidden in the memory and infecting the hard disk or other disks. In other words, when you do a normal reset (Amiga- Amiga-Ctrl) your machine will now make a 'cold reset' and.........whoosh, away with possible viruses. 6. If it so happens that it is a 'friend' who has made the virus, then go straight to the police, or to me. Kids like that aren't clever, good fri- ends but rather something else.... Think of Robert Morris in America, the man behind the RTM virus in the PC's. Now he owes society millions......a bottomless debt and a ruined life! But I don't have any sympathy for him, do you? Do you realise that there is a worldwide reward here in Denmark $ 1000? for the names. Please contact me for more informations! HARDWARE PROBLEMS Many Amiga Owners, as much the new as the old Amiga enthusiasts, have a tendency to 'explain' everything peculiar that happens to their Amiga as a virus attack . Viruses can of course have several underhand effects: like the disk drive going berserk , the picture suddenly appearing upside down, or your clock suddenly running backwards. However, the Amiga have general faults, which is often confused with virus attack , and it is therefore understandable , that even the best virus killers have to give up on this. The most common fault in Amiga 500 and 2000 models comes from the two port circuit 8520 , which is positioned behind the main printed circuit where all the sockets are. It is my view that up to 75% of all hardware failures lead back to this touchy circuit which , in certain cases, can create 'weird' permanent or intermittent failures , when you use the printer, mouse, floppy drive or other external hardware. Both the internal and external drive can behave oddly due to a defective 8520 circuit and the Amiga can, for example, ask you to insert disk xxx in drive df0, even if it's already there, or you can get the message (now and then) : "Not a dos disk" on a disk which is otherwise completely fault free . (Remember it is always a software failure, when the fault happens every time on a specific disk.) Not long ago I was phoned by a desperate Amiga owner who had "got a new virus" , which meant that the mouse froze on the screen, but the buttons still worked. A new 8520 circuit soon cleared up the problem. A good rule to limit these problems is to screw all plugs well home and never.....swap plugs when the Amiga is turned on. Yesterday I was phoned by a new Amiga owner, who had buyed a used Amiga, and 400 disks full with pirate games, everyone infected with viruses. He told me that "installed" write protected disk got new viruses very short time after using. I asked him to try to copy to a write....protected disk! The problem was the tiny pin in his disk drive, which is controlling the disk protection. A pincers solved the problem in few seconds. WHAT THE OPERATIVE SYSTEM IS ALL ABOUT Many people have discovered that, just below the very userfriendly surface, the Amiga is not so absolutely simple. So maybe it is both right, and at the same time wrong, to call the Amiga a beginner's computer. Not less than 256 BB or 512 KB (on OS 2.0) of the operative system is in the ROM circuit in the machine and a large part of it is test and control routines which the user hardly knows anything about, except in the form of Guru messages. After thinking it over, it must be said that Commodore probably has a good sense of humour, but anyway I personally could well do without the Gurus in my machine. One can quickly feel powerless and, although salvation is near if you get hold of the programmes Guru (Fred Fish no 239) or SnoopDos (Fred Fish 451). These programmes are widely different from each other: Guru explains your guru messages, while SnoopDos continually gives messages on everything that is happening in your machine's operative system. Can this be better? THE AMIGA'S SELF TESTING Many people who have just got themselves an Amiga often have various problems. If everything on your computer is shades of grey, then your Amiga is OK. Why so? If the machine shows anything other than a dark grey screen, a paler grey screen and then a white screen and afterwards the workbench hand, it has a fault. So the only thing you can do is to send it in to be repaired, even if it has shown other colours for only for a short period, maybe a second. Here is a little tip for the dexterous Amiga user: if your screen stays green for a shorter or longer period during start-up it is often due to a bad connection in the Agnus circuit socket. TEST PROCEDURE IS AS FOLLOWS: Clear Chips, "forget everything" Disable DMA and Interrupts; "stop everything else" Clear the Screen; "white screen" Check the Hardware; "is the whole machine alright?" Pass or fail the Hardware to the Screen; "if yes, show a dark grey screen" Checksum the ROMs; "are the Kickstart and keyboard circuits alright?" Pass or fail the ROMs to the Screen; "if no, show a red screen" System setup; "configure the machine" Check for RAM at $C00000; "is the chipram in place?" Move SYS-BASE to $C00000 if it exists; "if yes, use it!" RAM Test; "if the ram circuit is OK and correctly connected, the Fat Agnus is OK" Pass or fail the RAM to the screen; "If no, show a green screen" Check the software; "it looks as though the Kickstart's software makes sense" Pass or fail th e Software to the Screen; "if yes, show a light grey screen" Set up the RAM; "configure the screen" Link the Libraries; "find the ROM based functions" Find External RMA and link it to the list; "find all memory expansions" Set up Interrupts and DMA; "use the road signs and the traffic lights on the bus" Start Default Task; "look for boot-disk" Check for 68010, 68020 and 68881; "is it a standard CPU or what?" Check for an Exception; "are there other faults? If yes, show a yellow screen, if there is a help circuit which is at fault, show a blue screen". NB, certain forms of virus can be the reason for a yellow screen here. System Reset; "You are allowed to show a white screen and ask for Workbench now" CAPS LOCK TEST If the keyboard functions are not alright it will flash - all according to the fault in various rhythms - with the "Caps Lock" LED. In rare cases this fault can occur after serious system crashes of the type where it also forgets time and place and the clock has to be set up again. I have myself experienced such asystem crash where the machine wasn't up and ready until two hours later, this long is a rarity but it can often take around 20 minutes on a particular occasion like this. Here is yet another little tip for the dexterous Amiga 500 owner: If your Caps Lock lights up constantly, it is almost always the big IC 6570 circuit underneath the keyboard which is faulty. This fault is unknown on the Amiga 2000. A good rule to restrict these problems is to tighten all screws well home and never plug or unplug anything while the Amiga is on. RAM EXTENSIONS The price of RAM extensions has fallen dramatically recently but so, unfortunately, has the quality. One big problem with the RAM card, and all other circuit printing which is used in the Amiga , is this card's requirement for an extremely small contact resistance between the plug in your Amiga and the circuit board's edge connector. Many problems can be avoided by rubbing the edgeconnector's gold coating vigorously about 40-60 times with apaper tissue and then afterwards put on a thin layer of acid-free vaseline or silicone grease . After 3-4 minutes dry all the visible remnants of grease CAREFULLY off the surface. A sure sign of either a defective RAM card, or a poor connection to it, is a yellow screen at the start up, instead of the normal kickstart picture. A regular source of anguish is Commodore's poorly constructed internal clock, where a software fault can put the clock out completely so that you get the message: "Battery backed up clock not found", or . If you try to put the clock in again it will run again ("Setclock opt save"), but the next time the Amiga is turned on it will often be apparent, that the clock has gone completely nuts, and can show any time imaginable. Here are a couple of little "cheats" which can rescue you: 1. When you have to set up the clock, start by writing "Setclock opt reset". 2. Or use your Amiga Basic on the Extras Disk", and write "Poke 14417980", and you will get a logical 0 on "hold" in your clock, and the clock will start normally. 3. The newest setclock commands on 4972 bytes should be improved so that the faults mentioned above don't occur. SOFTWARE PROBLEMS It is well recognised that a number of virus killer programs can set vectors , or they can be residual, (that is to say, the program survives a "warm reset" Ctrl-A(miga)-A(miga)),in your RAM. One example is the virus killer program "System Z". A little number of utility programs , demos and intros and so on can give the same problems and ought therefore be completely avoided. The problem with these programs is that they can trick the virus killer into believing that there is a new virus in the machine. In individual cases, I have experienced a virus killer mistakenly taking a disk as being infected by a virus (with the name of the virus), despite the fact that it was an innocent bootloader, which was in the boot. This can happen sometimes, and can be explained by the fact that the virus killer's recognition code is on rather few bits for every individual virus. This code can then, in a few situations , coincide with an innocent program. Disk failure can also cause suspicion as to whether the diskette is infected with a virus . One common fault is that you get the message: "Error validating disk", "Please insert volume Lazarus", or a read/write error message. These messages are disk failure not viruses, but in many caseses you will get these disk errors , after your disks have been infected by a virus. Another irritating thing is that certain disks can ask you to remove the write protect in a systems message during the startup-sequence. One must be particularly alert here. Normally the reason is that a type of virus can be in the memory which is programmed to lure you into a trap, but it can in some cases be pretty harmless. If you have the slightest doubt, you should try to infect another disk, to ascertain whether it really was a virus. VIRUS PROBLEMS IN GENERAL The simplest virus types are the bootblock viruses, because they are easy to remove by overwriting them with "install". Individual disks use a special "loader system" and will be destroyed if they are overwritten. It is very likely that the disk was already destroyed when the virus infected it, so that you will never be able to destroy a disk which is infected beforehand. On the other hand one must advise against indiscriminate use of "Install" on unknown bootblocks, one can easily destroy a disk; if in any doubt, always copy the disk first. If you have kickstart 1.3 in your Amiga you can find the disks infected with virus starting up with a guru or like, and the card crashing not long afterwards. This can be because the disk is infected with a virus which can only work on Kickstart 1.2. In such a case a lot of diskettes can be saved, which you would otherwise have hought were faulty, by "Install"ing them. There is a special type of "virus" named "Bombs" which is characterised by the fact that they cannot infect other media such as diskettes, harddisks or the like. They can cause serious damage by acting as destructive programmes which, for example, can re-format a whole harddisk. These viruses ("hacks") can appear in the boot (like normal bootviruses), or as an individual file (like a normal file virus) together with a link, that is to say, a file which has hooked itself to another programme (ie. the two files' size in bytes has increased, which we know from regular link viruses). If you have got a new unknown type of one of these viruses, which your virus killer doesn't know, it is impossible for even the newest and best virus killers to find them. The best virus killers today have analysis functions, which check up on all "occupied" vectors and check the Amiga's memory for residual programs, which can survive a "warm reset". This doesn't much help against these viruses mentioned above, so the only way you can prevent them is if your virus killer knows the type. There is therefore good ground for being watchful, especially if you have a harddisk. ABOUT CLOCK VIRUS Rumours of the clock virus has several times caused even experienced Amiga users to tremble with fear. Just think, if a virus got into the clock in our Amigas, and could just hide there, undiscovered, for months..dreadful! No, you can all relax. It's only a rumour, it's a physical impossibility, there are only few bytes free in the clock, but definitely not enough for even the minutest program. On the contrary, the rumours about various types of viruses making your clock run amok are true. I have heard from several sources that there are supposed to be two types of virus or "hacks"(?), in Germany and the USA at least. One of them is supposed to make the clock run backwards, the other makes it go 10 to 20 times faster. I'm very interested in these viruses and of course, in other NEW viruses, and to say thank you for one, I will send you a disk I make which is called "The New Superkillers", where the newest and best Public Domain virus killers can be found , together with an amount of valuable documentation from Virus killer programs which I cooperate on. We can only make good virus killers, if we get help from you! GET THE NEWEST VIRUS KILLERS This disk is updated at least 12 times per year and is gradually found on many BBS's around the world, but you can always find the newest version in Denmark at: Denmark: DAN BBS 0000-2400 Sysop: Bo Bendtsen Line 1: 00 45 42643827 2400 - 19200 Baud Line 2: 00 45 43628230 1200 - 2400 Baud Otherwise you can order it from me by sending 10 DM or 4 Dollars in NOTES (inclusive of post, packing and disk). You can also subscribe for the disk for 6 months, 6 disks for 36 DM or 24 Dollars, so that you can be certain that you always have the best and newest virus killers. The disk is sent out on the first of every month. ABOUT FILE VIRUSES I have been contacted by several people who have had various problems in removing the link and file virus from both diskettes and harddisks. A recurrent problem is probably the "BGS-9" file virus, which causes several problems, maybe because it is not one of the most difficult to remove, but more likely because it is one of the most widespread. A contributory cause to the stubborn problems with the BGS-9 virus is cause by bad coding of the virus killers KDV III and VirusX. These virus killers don't look for the viruses themselves, but for an empty file in the Devs Directory. To put things a little in place, I will go through how one removes these and similar viruses: 1. Look in the disk's startup-sequence and find the name of the first command, note the name down on a piece of paper. 2. Look for this name in C/Dir...if the BGS-9 virus has taken over this name (BGS-9 on 2608 Bytes) the file will have been deleted. 3. Go into Devs and find the nameless file, give it the name from point one, and move it back to its original position in the C Directory. NB. Please attention always to remove the emty file in the devs directory otherwise VirusX and KDVIII will give a requester saying: "infected by a virus like BGS-9, but not the viruses itself". ABOUT THE SADDAM FILE VIRUS Please be very , very carefull , if you get the new "Saddam Hussein" file/ link virus. Attention that there is a boot virus with the same name, don't be confused. Here you have some facts about this virus: 1. The virus is a "multi-headed" file- and link virus. Always infected in L/Dir, if not L/Dir on the disk, it will make one by itself. 2. The Saddam file virus part is always to find in L/disk-validator , with the same file lenght (1848) and of cause the same name.....a diabolical thing oh...! 3. It can infect as the only one (I know) , even if you have the new super Fat Agnus (1 MG ChipRam) and survive a reset. 4. The Saddam link virus part is a VERY , VERY...... easy spreading virus, where it link to all files , e.g. to all executed , written or copied files , but don't change the file lenght only write "IRAK" in the start of the files. Please remark that all this infected files will get "Read /Write" errors! 5. It is impossible to delete the virus or the link infected files with a fileeditor like "Diskmaster", or from CLI. 6. Please attention, that the virus killer Schwarzkopf by RAM can find the "Saddam" virus and make it passive and repair the infected files very near 100 %, but can't remove the virus itself, you have to re-install the original Disk-vaildator. I think, that Schwartzkopf is the best killer concerning Saddam Hussein infected disks. HARDDISK AND VIRUS Many harddisk owners know that they should be particularly careful with all "non-boot viruses" and don't think twice about boot viruses. Watch out! A lot of boot viruses can also get into a autoboot harddisk. PLEASE ATENTION,......that a boot virus infection on your harddisdisk is the MOST SERIOUS thing, that can happen your harddisk! I know, unfortunately, several experienced Amiga owners, who have spent weeks to bring their infected harddisks back to life. The boot virus write itselves onto sector 0 and 1 of cylinder 0 on your autoboot harddisk, and you will get a system message which says: "Not a Dos disk in unit 0". If the accident has happened, try to revive your harddisk by starting up your harddisk installations disk, then format your cylinder 0, and prep your harddisk again. If it is a file virus which has jammed your harddisk , remember that most of these are in the first command in the startup-sequence , note the name in the startup-sequence, delete the file which has that name in your C/Dir and reestablish the original c command from , for example, your workbench disk. Xeno virus, and similar link viruses, can create other problems because they can attack several of the files. Because these files still have their original names, it can be hard to find them, if you don't have the exact viruskiller which knows this virus. A piece of good advice here - make a list of the harddisk and note the date, look for the most recent, and delete all these files. Remember to regularly take a backup of both your hard disk and your disks which have important data; but remember also if you do it too often you can risk also getting virus on your backup. Remember Murphy's law: "If something can go wrong, it will go wrong". VISION FOR THE FUTURE I think the only way to stop virus spreading is to catch the man, who had made the virus and tell others about the consequences. Many young one think, that virus making is like making graffiti or like. The fact is that the laws punish VERY HARD for data terrorism, in Denmark up to 4 years jail, and e.g. in Gemany you can get up to 6 years jail. Please contact me if you know somebody, who had made a virus, there is now a world wide reward $ 1000..... for supplying the names of these virus terrorist. Erik Lovendal Sorensen can be contacted at: Snaphanevej 10 DK 4720 Praestoe Denmark Virus helpline: Phone 00 45 55 992512 between 1600-2200 GMT Virus helpline: Fax 00 45 55 993498 between 0000-2400 GMT