ON - LINE Entertainments Ltd Presents THE A M I G A V I R U S K I L L E R Virus Killer Copyright й 1992 Software Developments Ltd Published and Marketed by Online Entertainments Ltd If you would like to be kept up to date with information on the war against viruses, then register with Software Developments Ltd as a Virus Killer user. To do this, simply write to Software Developments Ltd stating your name address and computer type to: Software Developments Ltd 27 Withyham Road Bexhill-On-Sea East Sussex BN22 9HZ United Kingdom Telephone No. (04243) 6970 Registered Virus Killer users will be able to purchase future upgrades at a major discount and do not forget, that you now have access to Virus Killer support services. Introduction - Instructions V1.0 нннннннннннннннннннннннннннннннн Virus Killer Instructions V1.0 have been implemented as a seperate task to Terminator V3.2. This allows the instructions to be referenced, whilst using Terminator V3.2. The instructions window can be moved to the front or back by using the WINDOW TO FRONT and WINDOW TO BACK gadgets positioned at the top right of the Instructions window. The Instructions task can be closed by simply clicking on the WINDOW CLOSE gadget, which is positioned at the top right of the instructions window. The Instructions can be restarted by simply selecting the Instructions ICON. Terminator V3.2 - The AMIGA Virus Killer ннннннннннннннннннннннннннннннннннннннннн Introduction нннннннннннн Virus Killer (Terminator V3.2) was released by CRL Group under the Practical label in May 1989 and has now undergone four major updates in order to remain effective against Amiga virus. Virus Killer is one of the most effective commercial virus killers and is the MOST cost effective at present. Virus Killer can eradicate all known and UNKNOWN Boot Code virus from memory and disk! Virus Killer will detect file virus as they appear on your system. BSG9 File virus recovery now allows recovery from a new BSG9 strain. Please note, that Terminator V3.2 operates correctly on the Amiga A500+. However, it should be noted that 90% of the currently active virus WILL NOT operate on the A500+! Software Developments Ltd has recently taken over Virus Killer regristration and virus investigation from CRL Group PLC, who no longer exist! Online Entertainments, recently took over the marketing of Virus Killer and has plans for a Virus Killer user bulletin board and repackaging of Virus Killer among other things. What is a Virus ннннннннннннннн A Virus is simply a program written by a programmer, who for reasons known only to himself, wishes to inflict the world with his creation. People can have many excuses for writing a virus. They may wish to get back at a person(or past employer) anonomously or simply want to spread a message to friends. A virus must be capable of spreading to other systems by some method in order to exist to perform its nasty deed. The Boot Code Virus ннннннннннннннннннн The Amiga requires to be booted up using a bootable floppy disk, which can be either a game disk or a standard Workbench type disk. Boot Code Virus infect the Amiga by simply writing over the original boot code with itself. This enables the virus to be run at boot up and allows it to install itself into memory and also to infect any disk inserted into any disk drive on the Amiga. Games diskettes use the boot code to incorporate copy protection therefore, the game is unusable after the virus has performed its nasty work, even if the virus was intended only to carry a message to friends of the virus writer. The File Virus нннннннннннннн Until recently only Boot Code virus were active on the Amiga. However, virus writers have now turned to writing File Virus, which infect only executeable(runable) files. Both floppy disks and hard disks are now in danger of being infected or even corrupted in some way. File virus are very difficult to find unless they display a message or actually start corrupting data or runtime files. File virus append themselves to run time files and are active only after the infected file has been run. Known files virus on the Amiga at present are as follows: IRQ BSG9 (or TTV1 virus) V1.0 and V2.0 The obvious way to spot a new file virus is to search for run time files that increase in size. Terminator V3.01 searches for Amiga DOS commands increasing in size as they shall normally be run every time the Amiga is in use. Once new virus are discovered, methods can be formulated to remove them from infected files. However, we require you our customer to forward suspect virus to us for investigation. Terminator V3.2 Features нннннннннннннннннннннннн Terminator V3.2 incorporates the following features: - Workbench or CLI(Shell) startup. - Simple mouse driven operation. - Instant recognition of all KNOWN Boot Code virus. - AmigaDOS command file size checks (new File Virus detection). - Boot Code backup and restoration facility (this allows all Games boot codes to be saved and recovered to floppy disks). - Boot code search facility ( detailed in seperate section). - Termination of Virus in memory. - Termination of virus on floppy disk Boot Sector. - Floppy disk Install facility (makes a disk bootable). - Multi-tasking - allows other applications to be run at the same time as Terminator. This allows you to use your Amiga for most purposes, whilst Terminator checks all disks inserted. - Hard Disk file checks. ( monitor changes in file size ) - Recovery from BSG9 file virus infection. Terminator shall be continually updated to provide protection against both new File and Boot Code virus as and when they appear. Terminator V3.2 Operation ннннннннннннннннннннннннн Terminator is fully WIMP(Window Icon Mouse Pointer) driven and so allows it to be activated and used from Workbench and the CLI with ease. To run Terminator from the CLI(Command Line Interface) simply type the program name: Terminator If you wish to run Terminator from WorkBench simply open the Terminator window and double click on the Terminator gadget. Terminator Startup нннннннннннннннннн On startup Terminator firstly inspects memory for resident virus either known or unknown. In both cases, if a virus or unknown task is present, a requester is displayed and prompts you to either Terminate It or Let it Go. If Terminate is selected, all corrupt system vectors are restored and the virus is wiped clean from memory. This disables the virus from infecting any more files or disks. Terminator, then inspects all connected floppy drives for non standard boot codes. Terminator boot code checks are detailed in the next section. Terminator V3.2 Boot Code Checks нннннннннннннннннннннннннннннннн Terminator automatically inspects all disks inserted for either KNOWN Boot Code Virus or non standard boot codes, which could be. possible virus. The following known virus are detected automatically by Terminator: - SCA Virus (and all variants) - Byte Bandit Virus - North Star #1 and North Star #2 - Byte Warrior Virus (known also as DASA 02 virus) - Lamer Exterminator ( I and II ) - Ellershaw Virus ( Lamer III ) - Australian Parasite Virus - Micro Master of the CCW Virus - Revenge V1.2 Virus - VKill V1.0 Virus - GADAFFI Virus - Obelisk Crew Virus - The Pentagon Circle Virus Slayer Virus - The Gremlin (L.A.D.S) Virus - Revenge Boot Loader Virus If Terminator detects any of the above Boot Code virus it displays a requester asking you to either Terminate It or Let It Go. If the Boot code is of the non standard type a different requester is displayed, which asks you to either Investigate or Forget It. If Investigate is selected the ASCII Boot Code screen is entered. This allows a visual inspection of the boot and also allows Saving, Restoring, Edit Dbase, Search Dbase and Boot Code Termination facilities. The Investigation of Non standard boot codes is detailed in the ASCII Boot Code Display section of these instructions. Terminator Main Menu нннннннннннннннннннн The Terminator Main Menu has the following menu items: System File Virus Checks Utilities --------------------------------------------------- Screen To Back Snapshot Install Disk About Virus Killer File Checks Edit Database Exit Terminator Restore Boot Code Main Menu - Screen to Back Item ннннннннннннннннннннннннннннннн The Amiga with 512K can display up to 6 different screens at the same time. This allows multiple applications to be run at the same time, whilst using their own screens. Terminator takes advantage of this fact and creates it own screen, which can be pulled in or pushed out of view when required. This allows Terminator to sit in the background, whilst you write letters, draw pictures, make music,etc. On selecting Screen to Back, the Terminator screen is pushed to the back of all other screens present on you Amiga system. You may also use the standard intuition screen back/front gadget to perform the same operation. Main Menu - About Virus Killer Item ннннннннннннннннннннннннннннннннннн On selection of the About Virus Killer menu item, a requester is displayed, which details among other things a Virus Killer user support telephone number. If you have any problems, use it, all support is free of charge! Main Menu - Exit Terminator Item нннннннннннннннннннннннннннннннн On selecting this item Terminator is closed down, freeing up all memory used by Terminator for use by other applications. Terminator - File Virus Checks Menu ннннннннннннннннннннннннннннннннннн File Virus Checks Menu - Snapshot Item нннннннннннннннннннннннннннннннннннннн Snapshot allows you to take a 'picture' of file sizes within the selected drives 'C' directory. This can then be used to monitor changes to file sizes that will signify known/unknown file virus activity. On selecting SNAPSHOT a requester will appear. Select SYS: if you wish to build a snapshot of your hard disk or DF0: if you wish to snapshot a floppy disk. It should be noted that a snapshot should only be created once! Only if new files are added or files deleted, should you make another new snapshot. Otherwise, continous snapshots could hide a new file virus infection until its too late! File Virus Checks Menu - File Virus Checks Item ннннннннннннннннннннннннннннннннннннннннннннннн File virus checks firstly checks for BSG9 on the disk in drive DF0:. *** Known BSG9 virus do not infect Hard disks *** On detecting BSG9 virus, terminator will display a requester, which allows recovery or the ability to leave it on the disk! On completion of BSG9 checks a requester will appear requesting that you insert the suspect disk in DF0: or SYS: (hard disk). If you wish to continue select the File Check gadget or select the Cancel gadget to exit file virus checks. On selecting the File Check gadget, Terminator inspects some of the more commonly used AmigaDOS commands for incorrect file sizes. Both Workbench V1.2 and V1.3 file sizes are tested for. Note that these checks are there to detect virus prior to Virus Killer installation. After this phase a comparison is made between the snapshot created previously and a new one. If differences occur a warning requester will be displayed along with the suspect file. Remember... If in doubt send all suspect files to Software Developments Ltd, or phone our support line. Terminator - Utilities Menu ннннннннннннннннннннннннннн This menu has the following items: - Install Item - Edit Database - Restore Boot Code Utilities Menu - Install Item ннннннннннннннннннннннннннннн The Install item allows you to make a newly formatted AMIGADOS diskette bootable. This operates in the same way as the AMIGADOS install command. On selection, a requester will appear with instructions to insert the disk in drive DF0: internal drive. On selecting the Install gadget Terminator then installs the Commodore recommended boot code on to the disk. Utilities Menu - Edit DataBase Item ннннннннннннннннннннннннннннннннннн The Edit Dbase item allows entries Saved to the boot code database to be removed. On selection, the Edit Database window will appear and list all entries in the Boot Code database. Use the mouse to click on one entry, which should then be highlighted and select the Remove gadget. Future releases shall allow multiple database entry removals and also a database recovery routine to recover accidentally removed boot codes. Utilities Menu - Restore Boot Code Item нннннннннннннннннннннннннннннннннннннннн The Restore item is used in conjunction with the Save item. Boot Codes from your favourite disks can be saved and then restored if the disk boot code is destroyed by a virus or by accident. On selection, the Restore Boot Code window will appear and list all database entries. Select the entry that you wish to recover and click on the Recover gadget. Terminator will then load the Boot code from the database and display a requester. The requester will prompt you to insert the damaged disk in DF0: the internal drive. If you wish to restore the boot code you should click on the Restore gadget or select Cancel to quit from the restore procedure. ASCII Boot Code Display ннннннннннннннннннннннн On detection of a non standard boot code Terminator will request you to either Investigate or Let it Go. On selecting Investigate the ASCII Boot code display is present. The display is a textual representation of the Boot code. This serves only one purpose - to identify text strings, which may provide information about the Boot Code. Typical virus text strings inform you of the Virus name and when it was created or even a greeting to a Hacking group. Note that a virus may be encrypted to hide such information. Virus that encrypt themselves are Byte Warrior, Lamer Exterminator and the Ellershaw Virus, however Terminator recognises these particular strain of virus. The ASCII boot code display also has a Menu, which allows Saving, Restoring, Printing and Termination of boot codes. This menu also allows searches of the Database for similar boot codes and deletion of database entries. ASCII Boot Code Menu - Terminate нннннннннннннннннннннннннннннннн On selection of the Terminate item, a Commodore recommended Boot Code is written over the existing Boot Code uder investigation. Therefore, it is strongly advised that you save the Boot Code under investigation IN CASE OF MISTAKES before Termination. Prior to writing the Boot Code to disk a requester is displayed to ask if you still wish to Terminate the Boot Code. ASCII Boot Code Menu - Search ннннннннннннннннннннннннннннн The Search Item provides a facility to compare a Boot Code under investigation against Boot Code entries in the database. It should be stressed that all of your non standard boot codes should be saved on first use of Terminator. The Search facility can then be used to see how many disks have the same Non Standard Boot Codes and so possibly spot a new virus as it is spreading from disk to disk. You may ask - How do I know if a disk should have a Non Standard Boot Code? The answer is very simple - EVERY disk that boots to the AMIGADOS CLI window straight after about 2 seconds should have a normal boot code. There are Boot Codes on the Amiga, which have been created to switch out additional memory and disk drives. However, MOST of these are in the Terminator database and will be identified as being safe. Another method to determine if the Boot Code is safe would be to save it into the database, then Terminate the Boot code. If on booting the disk you found that the disk no longer operated as it should, you could then restore the Boot Code from the Terminator database back to the original disk from the Main Menu Restore item. ASCII Boot Code Menu - Print нннннннннннннннннннннннннннн The Print Item allows you to obtain a hard copy of the Boot Code under investigation. On selecting Print, a requester will appear asking for both a text string to be entered and also two gadgets to Print the boot code or Cancel the print request. If Print is selected and you do not have a printer connected. Terminator will hang up for approximately 2 minutes, during this period it will try to establish what or where the printer is and if unsuccessful will display a requester. Select Cancel if you wish to cancel the Print or Resume if you wish to try again. ASCII Boot Code Menu - Save ннннннннннннннннннннннннннн The Save item should be used to store Boot Codes into the Database with MEANINGFULL names to enable you to easily recognise where it originated from. On selecting the Save item a requester will appear as in the Print item requesting a text string and whether you wish to Save the Boot Code or Cancel the operation. The text string is preset to NO COMMENTS! to change the string click on the string gadget and modify the text string to correctly represent the Boot Code that you wish to save. Then select either the Save or the Cancel gadget to continue. It should be noted that Terminator can be located anywhere on your floppy or hard disk. However, it references the database by the disk label of Terminator and the database name by Virus.fil. Therefore, Terminator may prompt for the disk named Terminator, the Terminator disk should then be inserted. The Terminator Installation process is detailed in a later section of these instructions. ASCII Boot Code Menu - Restore нннннннннннннннннннннннннннннн The Restore facility is a powerful tool and should only be used to restore your Non Standard Boot Codes or Boot Code virus that you have found and wish to send to CRL. This facility allows you to recover boot codes damaged by either a Virus or mistakes made by use of other programs (sector editors, other virus killers). All of your Games disk or PD type disk boot codes can be saved to the Terminator database. Up to a maximum of 250 boot codes can be saved to the original Terminator disk. No other Virus Killer offers this facility in a single package! If Virus Killer is installed onto a Hard Disk, the number of saved boot codes increases. ASCII Boot Code Menu - Continue ннннннннннннннннннннннннннннннн On selecting the Continue item, the ASCII Boot Code Display window is closed down and the Terminator Main Menu receives control of all user selections. нннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннн H I N T S A N D T I P S нннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннннн Distribution Disk Contents нннннннннннннннннннннннннн Terminator has the following files on the original distribution disk: -> Terminator Terminator virus killer program. Terminator.info Terminator Workbench Icon. virus.fil Boot Code Database. virus.fil.info Boot Code Database Icon. Instructions Terminator Instructions program. Instructions.info Instructions Icon. Instructions.txt The instructions text file. System Installation ннннннннннннннннннн On purchasing Terminator you should immediatly make a backup copy in order to protect your investment. It is adviseable to use the backup copy at ALL times. In order to obtain maximum use of your Amiga, it is adviseable to place the boot code database file (virus.fil) onto a seperate disk. This would allow a maximum of 830 Boot Codes on one disk. The preferred method for creating this database disk is as follows: -> Boot up with your Workbench disk. -> Create an initialised (formatted) disk. -> Insert the Terminator BACKUP disk. -> Open the Terminator Disk window and the RAM Disk. -> Drag the Virus.fil icon over to the RAM disk window. -> Insert the formatted disk and drag the Virus.fil icon over to the formatted disks window (from RAM window). **-> Rename the new disk as Terminator. Single Floppy Disk Amiga System ннннннннннннннннннннннннннннннн If you have a single drive on your Amiga, it is possibly best to boot up with the Terminator Backup disk. Check all of your disks and save all of your Non standard Boot Codes - This will require continually inserting the disk with the Database, which will be requested for by the volume name of Terminator: Note, that all of the known virus at present have been hardwired into Terminator V3.0 therefore, the database disk is not required to search for known virus as Terminator will instantly detect them as the disks are inserted. Multiple Floppy Disk Amiga System ннннннннннннннннннннннннннннннннн If you have more than one disk drive fitted to your Amiga it is probably best, after running Terminator, to keep the Database disk in the same drive at all times. The Database disk can be placed in any connected drive. Note, that all of the known virus at present have been hardwired into Terminator V3.2 therefore, the database disk is not required to search for known virus as Terminator will instantly detect them as the disks are inserted. Hard Disk Amiga System нннннннннннннннннннннн In order to transfer the terminator disk to your Hard Disk to you must first create a Terminator working Directory. This can be accomplished by simply dragging the Drawer Icon provided on the Terminator Backup disk that you made to the window representing the Hard Disk. Then open the new drawer in the Hard disk window and drag all of the other Terminator icons over to the Hard Disk Virus Killer drawer(except the Virus_Killer drawer icon ). <<< Hard Disk Users ONLY >>> The file in the S directory named Startup-Sequence should be modified to have the following additions: ASSIGN Terminator: : ie. ASSIGN Terminator: DH0:Virus_Killer/ This allows the Instructions and Boot Code database to be referenced on the Hard Disk. All Virus Killer and Instructions icons should be dragged to the new hard disk drawer. A Virus Killer drawer icon is supplied with Virus Killer. You should now reboot and Terminator will be fully operational from your hard disk. нннннннннннннннннннннннннннннннннннннннннннннннннннннннннннн What Happens If I Get Infected by a New Virus? нннннннннннннннннннннннннннннннннннннннннннннннннннннннннннн Boot Code Infection ------------------- Terminator, in order to be effective, should be run every time you turn your computer on. However, this can be very inconvenient if you use your Amiga frequently or only have 512K of RAM fitted. Therefore, you may find that disks start to be corrupted or do not operate as they should. On finding that your Amiga 'slows down' or locks(crashes) up or Gurus, you should run Terminator to establish if you have a virus. Terminator will then run its memory checks to establish if your system is clean - if an "Unknown Virus/Task has been found in memory" requester shall be displayed. You should of course Terminate it! Normally, on finding an unknown task in memory, Terminator may inform you of a Non Standard Boot Code. If the disk uses or requires Workbench to boot up it is very likely that the Boot Code is a virus. You should always inspect the Non Standard Boot Code for text messages, which might give you a clue as to the nature of its operation. If you are still unsure you should save the boot code and then Terminate it on the Suspect disk. Reboot and see if the disk operates correctly - If it does not, restore the original boot code and continue to check your disks. If the disk does work then send a copy of the Virus Database disk to Software Developments Ltd and the Boot code can be restored and investigated by our virus research department. File Virus Infection нннннннннннннннннннн Virus Killer will detect file size changes on workbench type AMIGADOS commands (copy, run, delete, ect). However, only Workbench 1.2 and 1.3 are covered. As many people use the ARP (AmigaDOS Replacement Package), these commands may be picked up as having a File Virus. If you are unsure always send the disk to Software Developments Ltd. Certain file virus leave signs of activity in order to indicate which files it has infected. These signs are :- BSG 9.0 (old version) -> files have dates set to DEC 99 9999 There is now a new version of BSG9 file virus that does not leave a trail of bad dates. The new BSG9 was found to confuse other well known virus killers. However, Terminator V3.2 will detect and terminate this new variant. If you have either CLIMATE or DiskMaster you should inspect files on your floppy disks or hard disk for new directories appearing, file dates being incorrect(1995, 9999, 1900, etc). ннннннннннннннннннннннннн Thank you for purchasing Virus Killer.