******************************************************************************* * * * THE ULTIMATE MEM-CHECKER v3.3 * * written and copyright by Georg Hoermann * * * * All rights reserved by the author. * * This program is FREEWARE! * * * * Send donations, bug reports and NEW VIRUSES to: * * * * Georg Hoermann * * Am Lahnewiesgraben 19 * * 8100 Garmisch-Partenkirchen * * GERMANY * * * ******************************************************************************* ******************************************************************************* * Special thanks go to Ralf Thanner for sending me his great virus collection * ******************************************************************************* UMC and UMC.doc are (c) 1991 by Georg Hoermann. You are allowed to freely distribute this program under the following conditions: - The program and the corresponding docs remain together. - No changes have been made concerning program and docs. - No profit is made by selling this program except of costs for disks. Special hint to Stefan Ossowski: This program is not low-cost, but FREEWARE! ******************************************************************************* * REVISION HISTORY R = Released version * ******************************************************************************* This is only a rough overview. Every coder knows how often especially in assembler some small or even smallest improvements are made. v1.0 - simple CLI interface, options C K P - recognizes about 10 viruses v1.1 - some viruses more - help option added (very important) v1.3 - UMC-Handler added - code shortened v1.4 - UMC-Handler improved - some other routines improved v1.6 - UMC-Handler removed I tried everything, but this ... handler slowed down the whole system (fu..ing task). - now I'm thinking about a new great idea v1.8 - option P now displays the pointers as hex-values - option L added (displays some important values) v1.9 - option V added (interrupt vectors) All display-options use hex-values now. v2.0 - library-checker improved --> now checks the checksums - options can be written in small and capital letters now v2.2 - Got a great virus collection from Ralf Thanner today. Thanks a lot, Ralf. - Added the first new viruses .... weeks of decoding viruses and developping killing routines .... v2.7 - Finally I made it. UMC now recognizes all viruses I got (over 100) v2.8 - new method of analysing CLI options (shorter and faster) - options need a '-' in front now I made this because there was a fault (possibly Commodore's). More than 3 options without '-' and you got a forth one. - code cleanup (about 200 Bytes) R v3.0 - Now I got the best idea ever: a new link-checker is born - options I and R added - link-checker finished --> that's worth releasing it v3.1 - preparations for WB interface - all routines improved for usage on both WB and CLI - code shortened about 1kB (it's unbelieveable!) - help option improved (no '-' in front any longer) v3.2 - first try on WB with 2 gadgets - further improvements - option w added - only disadvantage: the days without _reloc32 are over R v3.3 - WB interface is now bugfree (hopefully) - status added - now 7 gadgets (it's growing every day) - a final code cleanup Release date: 3/Sept/1991 ****************************************************************************** INTRODUCTION There are dozens of virus tools, but all these programs have one major disadvantage: they don't detect all of these little bastards. Although VirusX or ZeroVirus are nice programs, they don't do what they should do: kill viruses. This was the main reason for me to code this ULTIMATE virus tool. UMC finds and kills over 100 bootblock, link and fileviruses. Additionally, it kills all of them PROPERLY. This includes restoring all changed pointers, giving back all allocated memory and completely deleting the virus's code. Using UMC gives you the security that no unliked guests visit you or send you to India (GURU). Use UMC with option -I in your startup-sequence and you are protected 100% until the next reset. Possible bootviruses are killed in memory and cannot be re-initialized without booting, linkviruses are also killed and -I protects you from new infections. ****************************************************************************** CLI-STARTUP UMC offers you the possibility to use the WB interface from CLI. If you wish to use this, simply type UMC w (See further description in chapter WB-STARTUP) What's that? UMC ? Ahh, the help screen (totally new!). All other options or no options lead to the following: First thing you will see after executing UMC is a colored bar containing the program's name and the shareware & copyright note. After this, the automatic memory check is getting started. When UMC finds a virus, the virus's name will be printed after 'Virus found:', when nothing is found, nothing is found (true?). Everything after the virus check depends on you. UMC offers you the following options: -P Captures & KickPtrs -L Libraries & Devices -V IntVectors $64-$7c -C Clear Captures -K Clear KickPtrs -I Install Link-Checker -R Remove Link-Checker (Note that all options must have a '-' in front) P Displays Captures, KickPtrs and KickChkSum. Captures/KickPtrs should be zero, KickChkSum can be -1 too. L Displays the checksums of the most important libraries and devices. O means checksum is ok, E means it is wrong. Most viruses don't use SetFunction when changing offsets, this means you can recognize them because of wrong checksums. After the checksums, some important vectors are shown: DoIO(), SumKickData(), PutMsg(), AddTask(), OldOpenLibrary() and TD_BeginIO(). All vectors should point to locations higher than $fc0000. V Displays a list of the AutoInterruptVectors. They are often used by viruses to increase a counter and to decide whether there should happen anything if the counter has reached a certain level. You can find these AutoIntVects at location $64-$7c. Additionally this option shows you the address of exec's VBI server 148(a6). All vectors should point to locations higher than $fc0000. C,K I added two separate killing routines for KickPtrs (K) and Captures (C) because this might be useful if you use RAD: or another resident utility. Example: You have a new virus in memory that cannot be found by this version of UMC. You also have RAD: mounted. When using option P, UMC tells you that not only the KickTagPtr (RAD:), but also CoolCapture (virus) is changed. So you use option C to kill CoolCap and the virus will be removed without removing RAD: too. Certainly you can also use these options to remove resident utilities like RAD: if you no longer need them. I Installs a special linkvirus checker. Read chapter CHECKER for further imformation. R Removes the linkvirus checker. You can combine all these options without a special order. UMC executes the options in the same order as you entered them. ****************************************************************************** WB-STARTUP This release of UMC contains a brandnew WB interface. It's totally mouse-driven and very user-friendly (took a long time). You reach it when executing UMC from WorkBench or using option w from CLI. All functions should be self-explanating. (actually they do the same as the CLI options) Whenever status tells you that either pointers are in use or checksums are wrong, use the CLI options to specify the changes exactly. It would be too much work to add this to the WB interface. ****************************************************************************** CHECKER This is one of the best features of UMC. Suddenly it popped in my mind. Why should we use a task, interrupt or anything else to check for linkviruses? How are linkviruses started? With LoadSeg() from DOS. So why not patching LoadSeg()? Clever idea, eh? That's the trick: We add a small routine to LoadSeg() which compares the program it actually has loaded with some data taken from linkviruses. If no data fits, everything is ok. But if we have found a virus, we put up an alert (this is the best media for important messages) to warn you. Additionally you can chose whether to kill the virus or not (NEVER chose 'not'). All fileviruses will be skipped, files infected by a linkvirus will be executed without initializing the virus. (simply jump over the corresponding parts in its code) This patch needs more or less no memory and no processing time. There is no shorter and faster possibility. Certainly the checker recognizes all linkviruses listed below. ****************************************************************************** VIRUSES Here's a list of all viruses detected by UMC: (SCA-Clones & ByteBandit-Clones are not detected by name. The reason is that a routine checking all viruses to get their names would be dozens of times longer (and slower) than it is that way.) - SCA/CLONE 2001, 16 BIT CREW, AEK, BS1, BUTONIC-BAHAN, DAG, DIGITAL EMOTION, GRAFITTI, ICE, HCS, JITR, KEFRENS, KAUKI, LSD, MEXX, NORTHSTAR 1-3, OBELISK 1, PARATAX, PENTAGON CIRCLE 1-3, DISK HERPES/PHANTASTOGRAPH, SCA, SUPERBOY, TARGET, ULTRAFOX, VERMIN, WARHAWK - BYTE BANDIT/CLONE AMIGAFREAK, BYTE BANDIT 1-3, FORPIB, INGER IQ, MORBID ANGEL, POWERBOMB - OTHERS ALIEN NEW BEAT, ASS PROTECTOR, AUSTRALIAN PARASITE, BLACKFLASH, BLOWJOB, BYTE VOYAGER 1-2, BYTE WARRIOR (DASA), CCCP, CLAAS ABRAHAM, CLIST, CODER'S NIGHTMARE (CODER), DISKDOKTORS, DESTRUCTOR, DISKGUARD v1.0, FAST 1-2, FICA, GADAFFI, GREMLIN, GXTEAM, HILLY, INCOGNITO, JOSHUA 1-2, JULIE (VIRUS PREDATOR), LAMER 1-6/AIDS, LAMESTYLE UK,MEGAMASTER, MICROSYSTEMS, OBELISK 2, OPAPA, PARADOX 1-2, RENE, REVENGE/SENDARIAN, REVENGE BOOTLOADER, SADDAM HUSSEIN, SCARFACE, SWITCH OFF, TERMIGATOR, TIMEBOMB/TGTS, TRAVELLER v1.0, TURK, VIRUS SLAYER v1.0, VKILL v1.0 - LINK & FILEVIRUS BGS9, BRET HAWNES, BUTONIC v1.31/v3.00, CCCP, CENTURION (SMILY CANCER), DISASTER MASTER v2, IRQ-TEAM v41.0, THE RETURN OF LAMER EXTERMINATOR, THE REVENGE OF LAMER EXTERMINATOR, TERRORISTS, THE TRAVELING JACK, XENO ******************************************************************************