******************************************************************************* ****************************** VirusZ V2.01 ******************************** ******************************************************************************* «·» VirusZ V2.01 «·» supplied By :::::::::. :::::::::. .::::::::. tm :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::::::::' ::::::::: :::::::::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::::::::' :::: :::: Special greetings to TRSI, Beermacht, Venture, Aspect & Fakebuster! ******************************************************************************* ****************************** VirusZ V2.01 ******************************** ******************************************************************************* ***************************************************************************** ***************** Welcome to the VirusZ 2.01 User Manual ****************** ******************* Copyright (c) 1991 Georg Hoermann ********************* ***************************************************************************** 1 GETTING STARTED 1.1 Introduction 1.2 Installing VirusZ 1.2.1 The VirusZ Package 1.2.2 The ReqTools.Library 1.2.3 VirusZ Startup 2 VIRUSZ FUNCTIONS 2.1 Memory 2.1.1 The Vector Check 2.1.2 The Virus Check 2.2 Disks 2.2.1 The Bootblock 2.2.2 The Disk-Validator 2.3 Key Shortcuts 2.3.1 ASCII-Dump (A) 2.3.2 Save Bootblock (B) 2.3.3 Drive Check (C) 2.3.4 Interrupt Repeat Delay (D) 2.3.5 Help (H) 2.3.6 Install Fresh Bootblock (I) 2.3.7 Load Bootblock (L) 2.3.8 Scan Disks for SADDAM Corruption (S) 2.3.9 Display Vectors (V) 2.3.10 Work Info (W) 2.3.11 HEX-Dump (X) 2.3.12 Quit VirusZ (ESC) 3 SPECIAL NOTES 3.1 The Author 3.2 New Viruses 3.3 Bugs 3.4 Source Code 3.5 Coming Attractions 3.6 New Ideas, Suggestions 3.7 Copyright, History 4 APPENDIXES 4.1 Table of Recognized Viruses/Utilities 4.1.1 Bootblock Viruses 4.1.2 Custom Bootblocks 4.1.3 File, Link and Disk-Validator Viruses 4.1.4 Viruses in Memory 4.1.5 Utilities in Memory 4.2 Thankslist 1 GETTING STARTED 1.1 Introduction VirusZ is another try to make the perfect viruskiller. Although there are already hundreds of killers, none had to offer the, in my opinion, most important features. These are to be short, fast and not to keep the user from working by opening a big screen with hundreds of gadgets or locking the drives. If you like the other type of viruskiller, forget VirusZ. 1.2 Installing VirusZ 1.2.1 The VirusZ Package The VirusZ package consists of the following files. If anything is missing, look out for another source to get your programs in future. Docs (dir) COPYRIGHT.doc copyright and distribution notes HISTORY.doc guess what? VirusZ.doc the file you are reading Kick13 (dir) reqtools.library the 1.3 version of ReqTools Kick20 (dir) reqtools.library the 2.0 version of ReqTools Install install ReqTools Install.script installation script VirusZ the main program 1.2.2 The ReqTools.Library For the correct use of VirusZ, you must copy the reqtools.library to the LIBS: drawer of your system disk. Included in this package are 2 versions of ReqTools, one for Kick 1.3 and one for OS 2.0. Always use the version that fits with your OS to get the best out of it. Installing the library can be done in two ways. Either you copy it by hand via CLI/Shell or you use the installation script included in this package. ReqTools is written and copyright (c) Nico François (PowerPeak). The author gave the permission to use it in freely distributable programs. 1.2.3 VirusZ Startup Since VZ does not need any command line parameters, you can simply start it by typing its name to any CLI/Shell or clicking its Icon on WorkBench. You don't have to start VZ with 'Run' or 'RunBack' because it will start its own process. After successfully initialising all necessary resources, VZ will open a small window (actually its only the titlebar of a window) at the top of the screen. 2 VIRUSZ FUNCTIONS 2.1 Memory 2.1.1 The Vector Check This is done on startup once and can be repeated by pressing the according key (see chapter 'Display Vectors'). The following vectors are checked: ColdCapture These are simply set to the address CoolCapture of the routine that should be executed. WarmCapture Should always be zero. KickMemPtr Pointer to a resident MemList. KickTagPtr Pointer to some RomTags. KickChkSum Only a checksum, not important. The first group of vectors should always be zero, they are only used by some program (mostly by viruses, because they are easy to use). The only exception is the SetPatch command of Kick 1.2/1.3. Since these ROMs include some bugs, this command tries to repair them by using ColdCapture (only if option -r is specified). If you use this in your startup-sequence, don't clear the vector. The second group is a bit more complicated. Nearly all resident programs like virus detectors, recoverable RAM disks or for example TurboPrint use these to keep parts of their code reset resistant. If anyone of these vectors is set and you use such a program, do not clear vectors or you will lose it after the next reset. 2.1.2 The Virus Check This is the real memory check looking for known viruses. It's executed once on startup, and whenever VirusZ finds a virus, you will get a request telling you which virus was removed. VirusZ removes them automatically. Viruses will not only be patched or disabled, but they will be removed from memory completely. See the list of recognized viruses in chapter 'Viruses in Memory'. In addition to the startup memory check, VirusZ installs an interrupt that repeats the memory check regularly. The time passed between two checks can be changed by the user, default is 10. This means that VirusZ waits 10 seconds until the next check. This is the safest way to find and remove file- and linkviruses from memory. These viruses can appear in memory anytime an infected file is executed. So whenever VirusZ reports a virus in memory, check the disks you are working with at the moment for incfection. See chapter 'Key Shortcuts' for further information on how to change the repeat delay. Note that the time passed between two checks will be slightly shorter on NTSC machines since VirusZ is PAL oriented and works with 50Hz. Also note that any virus using KickTagPtr will cause VirusZ to delete all resident modules. This means that you must save everything you haven't saved yet out of your recoverable RAM disk (if used). My policy is better save than sorry. 2.2 Disks 2.2.1 The Bootblock Every disk inserted will be checked for bootblock viruses and non-standard bootcode. This ensures that your bootblocks stay clean. Every known virus will cause a request asking you what to do with it. In the current release of VirusZ, you can install a standard bootblock to delete the virus, display the ASCII-Dump of the virus to look at possible texts or ignore the virus. The last possibility is not recommended. If your disk contains anything else than a virus or a standard bootblock, it will be checked for some known utility bootblocks. If this test is positive (VirusZ knows the bootblock), you won't get a request. If not, VirusZ first checks the bootblock's checksum. If this is not correct, VirusZ simply ignores it because it wouldn't be executed anyway. But if all conditions are met, the bootblock will be reported as unknown. This might happen with most bootload games or demos, so do NOT install anything you don't know. You might trash the program that depends on this boot. But if you are sure that it's a new virus, make a copy if that disk, install the original bootblock and send me copy for inclusion in VirusZ. (See a list of all known bootblock viruses in chapter 'Bootblock Viruses'.) 2.2.2 The Disk-Validator Currently there exist two viruses that detach themselves to this program. You can find the Disk-Validator in the L directory of most disks. It was originally thought to correct possible small errors on a disk and is called from the ROM if necessary. The viruses use the feature of being installed by the system itself by corrupting some data on the infected disks that causes the ROM to load the Disk-Validator. Instead of repairing the disk, they install themselves in memory. VirusZ finds both viruses in memory and on disk and offers you the possibility to delete them. Since the original Disk-Validator is copyright Commodore, I'm not allowed to include it in my program. You must copy it back on the cleaned disk from a heal one yourself. The latest validator virus, SADDAM, not only infects the Disk-Validator, but also changes some stuff on disk. Such a disk would be ready for the trash since you cannot read the files any longer. But there's a way to repair these disks by simply using the original virus routines in reversed order. And that's exactly what VirusZ does. See chapter 'Key Shortcuts' for more information on using this feature. 2.3 Key Shortcuts To use all features offered by VirusZ, you have to work with key shortcuts that represent special functions. They can only be used if VirusZ's window is active. Therefore click to its window before using shortcuts. The following are defined in this release (the key to be pressed is in brackets): 2.3.1 ASCII-Dump (A) Displays the ASCII-Dump of any bootblock. This brings up a Request asking you for the unit from which the bootblock to be displayed should be read. This option should help you to discover BB viruses which hold specific text in their code. You can also recognize whether the bootblock is standard or if it's a custom bootblock. NOTE: Don't rely 100% on texts like 'A2000 Memory Allocator v1.0', these can be disguised viruses too. 2.3.2 Save Bootblock (B) Offers you the possibility to save a bootblock as file. This is useful in connection with games or demos that use special bootblocks. If you keep a copy of the bootblock on another disk, you avoid the risk of losing it by a virus or accidentally. In such a case, simply restore the saved bootblock by using 'Load Bootblock'. 2.3.3 Drive Check (C) Checks all connected drives for viruses. This performs the same checks as the initial check on startup. I added this only to get a disk checked again without removing and reinserting it. Read the chapter 'Disks' for more info. 2.3.4 Interrupt Repeat Delay (D) Change the memory check repeat delay. Pressing this causes an string request with which you can change the delay (default in 10). What's this delay? you might ask. The number entered in the gadget is the amount of seconds that should pass between two checks. Read the chapter 'Memory' for more information. 2.3.5 Help (H) Displays Help. This brings up a request that contains all shortcuts with a brief explanation. 2.3.6 Install Fresh Bootblock (I) Installs a fresh bootblock. You can use this feature either to kill a bootblock virus or to simply make an uninstalled disk bootable. You can chose the unit and the filing-system that should be used. OFS is the standard filing system, FFS can only be used with OS 2.0. The installed bootblock is Kick 1.2/1.3 and OS 2.0 compatible. NOTE: Never install bootblocks of games or mega-demos if it's not absolutely necessary. Doing this may destroy the game. NOTE: Some other anti virus programs might report the bootblock installed by VirusZ as non-standard, but that's not true. 2.3.7 Load Bootblock (L) Offers you the possibility to load a former saved bootblock and reinstall it on any disk. This is the counterpart of 'Save Bootblock' and should be used to restore destroyed bootblocks. You can load a saved bootblock and select the disk to be installed. And that's it. 2.3.8 Scan Disks for SADDAM Corruption (S) Scans a disk for Saddam corruption. Saddam is a relatively new type of virus that lives in the Disk-Validator. Option 'S' can be used to repair the damage done by this virus. Therefore all sectors of a disk will be scanned for changes. See chapter 'Disks' for information on Disk-Validator viruses. 2.3.9 Display Vectors (V) This displays all important vectors that may be altered by viruses. See chapter 'Memory'. 2.3.10 Work Info (W) This displays some information about the state of VirusZ. 'Int. Repeat Delay' tells you how often the memory check is performed. The other numbers are simple counters that tell you what VirusZ has already done. 2.3.11 HEX-Dump (X) Displays the HEX-Dump of a bootblock. This is only interesting for experienced users or programmers. If you know something about OpCodes, this function might help you to find out what the displayed bootblock basically does (e.g. one can easily detect copperlists). 2.3.12 Quit VirusZ (ESC) Think twice and you'll know what this means. 3 SPECIAL NOTES 3.1 About The Author I'm a 17-year-old Bavarian 'Gymnasiast' (student visiting the 12th form) who has nothing else to do than trying to help other users as much as possible. If you have any problems in using VirusZ, anything new concerning the next chapters, or if you want to honour my work, write to: Georg Hoermann Am Lahnewiesgraben 19 8100 Garmisch-Partenkirchen Germany 3.2 New Viruses Although VirusZ recognizes over 100 viruses both in memory and on disk, this is NOT enough until also the very last virus is included. So if you ever get a new virus, do not delete it before sending me a copy. In addition to new viruses, I'm still waiting to get the following: - BlueBox filevirus - icon.library filevirus - MAD I, MAD III, MAD IV bootblock viruses - Amiga Knights filevirus - TimeBomb filevirus Don't forget: I can only help you in your fight against these little bastards if you support me with all the necessary material. Killing a virus without knowing how it works is impossible. 3.3 Bugs There may still be some bugs in this release, but this depends on the configuration of your Amiga. I'm using an A1000 with Kick 1.2/1.3 and OS 2.0, 3MB of ram and some external disk drives and couldn't find any further bugs. It was not possible for me to test VirusZ on other processors (MC68010+). But I already got several bug reports about this and hope that everything is fixed now. If NOT, please don't bother and send me a detailed description (if possible) including your system's configuration and when and how the bug appears. If VirusZ crashes in connection with other software, I would be glad if you send me a copy of these programs (if the copyright allows it). Please DO NOT report things that I can't repeat on my machine without a detailed description of the circumstances. 3.4 Source Code I don't release the source code of VirusZ because of the risk that somebody might use it as a trojen horse (i.e. inplementing a virus in VirusZ). It also happened, e.g. with VirusX by Steve Tibbett, that some people made their own versions without having any work. They only changed the names and that's it. Since I want to prevent VirusZ from being cloned, I decided to keep the source only on my own disks. 3.5 Coming Attractions VirusZ stills lacks of a file testing feature. I promise that I'll work hard on this the next weeks to make VirusZ absolutely No. 1. 3.6 New Ideas, Suggestions If you ever have an idea or suggestion how to improve VirusZ, let me know. I'll try to do everything to satisfy you. 3.7 Copyright, History You'll find the distribution and copyright notes in 'COPYRIGHT.doc' and the VirusZ revision history in 'HISTORY.doc'. 4 APPENDIXES 4.1 Table of Recognized Viruses/Utilities 4.1.1 Bootblock Viruses There are some bootblocks in this list you might consider to be utilities. But every bootblock that copies itself instead of a standard bootblock is considered as a virus. And I also added anti virus bootblocks that are likely to crash even under Kick 1.3. 16BitCrew 2001 SCA clone AEK SCA clone AIDS AlienNewBeat AmigaFreak ByteBandit clone Ass Protector Australian Parasite BS1 SCA clone BlackFlash Blizzard anti virus BlowJob Butonic 1.1 (BAHAN) ByteVoyager 1-2 ByteBandit 1-3 ByteWarrior (DASA) ByteWarrior FastLoad not really a virus CCCP link+boot virus ClaasAbraham CList Coder's Nightmare (CODER) DAG SCA clone Destructor Digital Emotions DiskDoktors DiskGuard 1.0 FAST 1-2 F.I.C.A. Forpib ByteBandit clone Gadaffi ByteWarrior clone Graffiti Gremlin GXTeam HCS 4220 Hilly Ice Breakers (ICE) SCA clone Incognito Inger IQ ByteBandit clone JITR Joshua 1-2 ByteBandit clone Julie (Virus Predator) Kauki Kefrens SCA clone Lamer Exterminator 1-6 LameStyle UK CList clone LSD SCA clone M&U 5.5 anti virus M&U 6.1 anti virus Mad II Gadaffi clone MegaMaster Mexx SCA clone MicroSystems Morbid Angel ByteBandit clone NorthStar 1-3 NorthStar bad anti virus Obelisk 1-2 Opapa Obelisk 2 clone Paradox 1-2 (Logic Bomb) Paratax 1-2 SCA, DiskDoktor clones Pentagon Circle 1-3 Phantastograph (Disk Herpes) PowerBomb ByteBandit clone PvL Protector 3.0 anti virus PvL Protector 4.0 anti virus PvL Protector 5.0 anti virus PvL Protector 5.1 anti virus PvL Protector 5.3 anti virus PvL Protector 5.4 anti virus PvL Protector 6.1 anti virus PvL Protector 6.4 anti virus PvL Protector 6.5 anti virus Rene Lamer clone Revenge Revenge BootLoader Saddam Hussein SCA ScarFace ByteBandit clone Sendarian Revenge clone SuperBoy SCA clone Supply Team anti virus Switch Off Target TelStar PvL 6.0 clone Turk TimeBomb Tomates GenTechnic TimeBomb clone Termigator Traveller 1.0 UltraFox Vermin VirusHunter anti virus VirusSlayer 1.0 VKill 1.0 WarHawk 4.1.2 Custom Bootblocks These are bootblocks written either to boot anything special, to offer you some useful functions or just for pleasure. They don't do any harm, and I added them to keep VirusZ from bringing up one requester after the other. ACID Terminator 1.0-3.0 Alcatraz MegaDemo 3 AntiTrax 2010 Atomic Soft Virus Detector Avirex Betrayal Proboot 1.0 BootBug 0.1 Boot Generation 1987 BootGirl BootIntro 1.2 BootIntro Next Generation BootOut 5.5 BootTune Budbrain/New Dimensions 35 CCS Boot 2.0-3.0 CopyLock Amiga DevWare Antivirus Dietmar Noll ClearMem DOC 1989 Dragons Megademo 1 Dugger International Soccer Invisible Brain BootCopy License to Kill Mad Monks Super Bob-Intro TIP Memory Controller 1.2 TIP Memory Allocator 1.3 No Fastmem NOMAD Utility Boot 1.0 Outlaw Checker 1.42 PAL Boot Phenomena Enigma Demo Phenomena Megademo 1 Pinball Wizard Powerslaves Demo 1 PvL VirusSound Quartex Drives Off Razor 1911 Observe RSI Megademo Disk 1 RSI Megademo Disk 2 Scoopex Bootintro Scoopex Mental Hangover Scoopex PAL Boot 2.0 Seek & Destroy BootCheck 1.0 Seek & Destroy Drive Control 1.0 Sinister Syndicate Slipstream Utility Boot 4.0 Slipstream Utility Boot 6.1 Squash 4.3 SysNot TAL Bootleg 2.1 The Sect Mega Concert TLC Demosample UDC Novirus Boot 1.0 UDC Utility Boot 1.0 Ultimate Boot Writer Venom BootLoader 1.00a Virus Destructor 1-2 VirusKiller Prof. 2.0 Vision Megademo 4 Vortex 42 Megaboot 1.3 XCopy Prof. ZeroVirus AutoAddRam ZeroVirus BigScreenTest ZeroVirus Message Boot ZeroVirus NoFastMem 4.1.3 File, Link and Disk-Validator Viruses All the viruses mentioned below have been analysed already, but I didn't have the time to write file checking routines yet. Sorry. BGS9 1-2 Bret Hawnes Butonic 1.31 Butonic 3.00 CCCP Centurions Disaster Master 2 IRQ-Team 41.0 Return Of The Lamer Ext. Revenge Of The Lamer Ext. 1-2 Saddam Terrorists The Traveling Jack 1-2 Trabbi Xeno 4.1.4 Viruses in Memory All viruses recognized on disk will also be recognized in memory. All the viruses mentioned below will be removed properly in order to let you go on with your work safely. But not all of them will be recognized by name. This is because some clones (especially SCA clones) can be detected and killed all the same way. Including a routine to get their real name as an addition would cause the memory checking routines to get more than twice as large as they are now. And that's not worth it. AlienNewBeat Ass Protector Australian Parasite BGS9 1-2 BlackFlash BlowJob Bret Hawnes Butonic 1.31/3.00 ByteBandit clones 8 different ByteVoyager 1-2 ByteWarrior (DASA) CCCP link+boot virus Centurions ClaasAbraham CList Coder's Nightmare (CODER) Destructor Disaster Master 2 DiskDoktors DiskGuard 1.0 FAST F.I.C.A. Gadaffi ByteWarrior clone Gremlin GXTeam Hilly Incognito IRQ-Team 41.0 Joshua 1-2 Julie (Virus Predator) Lamer Exterminator several different LameStyle UK CList clone M&U 5.5/6.1 MegaMaster MicroSystems Obelisk Opapa Paradox 1-2 (Logic Bomb) Paratax PvL Protector 9 different Rene Lamer clone Return Of The Lamer Ext. Revenge Of The Lamer Ext. 1-2 Revenge/Sendarian Revenge BootLoader Saddam Saddam Hussein SCA clones 30 different ScarFace ByteBandit clone Switch Off TelStar PvL clone Termigator Terrorists The Traveling Jack 1-2 TimeBomb/Tomates GenTechnic Trabbi Traveller 1.0 Turk 1.3 VirusHunter VirusSlayer 1.0 VKill 1.0 Xeno 4.1.5 Utilities in Memory Since VirusZ only kills what it knows in memory, it's not necessary to add all the resident utilities like RAD:, VD0:, ZKick etc. If you ever have problems with these (it's not very likely that VirusZ thinks these might be viruses), let me know and I'll add them as utilities. 4.2 Thankslist Special thanks must go to: Ralf Thanner for sending me a great virus collection, testing VirusZ, writing long letters and for all the useful suggestions. Nico François for programming the best library ever, ReqTools. // and to \X/ Amiga for being the best computer ever. Have fun... *Georg*