<<< NOTE >>> The complete package contains the following files: -File- -CRC- -Description- CRC $DEDC902B Calculates the CRC-checksum of a file ProKiller $9D939ACC The viruskiller ProKiller.doc This document The checksums can be calculated with CRC. If some of the checksums is wrong, the file is corrupt. In that case you must not use it. These files are freeware and they may be freely spread and used as long as they are left unchanged. These programs are written in assembly. They are completely re-entrant (pure) and pc-relocatable. They should work on all Amiga models and configurations and they are carefully tested, but we are not responsible for any damage caused by them. Send bug reports, suggestions and other mail to: Markku Vähäaho or Terje Bergström Eerontie 17 Jukolanahde 4 D 15 02180 Espoo 02180 Espoo Finland Finland Usenet: terje.bergstrom@f500.n515.z2.fidonet.org Fidonet: Terje Bergstrom@2:515/500.14 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> ###### ###### ##### ## # ## # ## # ## # ## # ## # ###### ###### ## # ## ## # ## # ## ## # ## # ## ## # ##### Proudly presents >» ProKiller V1.03 coded by MV / Lightning Inc. «< To contact Pro, call their BBS in Finland: Amiga-Power (24h) Tel. +358-0-4208168 Lightning Inc. is also contactable there... ProKiller is a Guardian-style viruskiller which stays in memory watching for viruses... Hey! Read on, this is NOT an ordinary killer, this is a PRO killer... <<< FEATURES >>> !!! Read this feature-list, it contains information not found anywhere else in this document. !!! * Checks the bootblock every time you boot, but this time with a small analyzer! This means that it recognizes both old and new bootblock-viruses! * Checks for fileviruses, too! You can install it as a task (well, exactly as a process) which runs at the priority of -1. Normally it waits with Delay() (no busy waiting) and every 15th second it checks the following pointers: - ExecBase checksum: usually viruses change some jump vector here, but they don't use SetFunction(), which means that when ProKiller calculates the checksum and compares it with the current one, it finds almost all viruses. However, sometimes this is not enough, so: - ColdCapture-vector \ - CoolCapture-vector \ about 19 of 20 viruses use these reset-vectors. - Resident-vector \ - OldOpenLibrary(): many link viruses use this, so ProKiller checks if this vector doesn't point to ROM. - DoIO(): almost all bootblock viruses use this... - SumKickData(): and some viruses use this. - Open(): a nice place for viruses to live... - Close(): even better - Lock(): no comments - LoadSeg(): hey, Imploder (when using explode.library) uses this vector illegally, so recrunch all those files with PowerPacker or some other cruncher (or disable ProKiller's library vector checking, if you really like Imploder and its style of doing things...) - Write(): don't know whether any viruses can live here, but... And then, ProKiller checks also for Jack & Xeno-viruses, which don't use these vectors. No virus has yet slipped through ProKiller's hands, and when one does, I'll improve ProKiller again. * (Almost) every option can be turned off: you can disable the resident bootblock-checker, the checker-task and even library vector checking. * Uses about 5 kb memory when fully installed (is that too much?) * The resident bootblock-checker uses Resident-vector, no crashes if some program overwrites it. With 'legal' programs, this shouldn't happen anyway, because the resident checker allocates all the memory it needs. * The resident checker is always in the place UpperLimitOfChipMem-9216, so it works also if you have more than 512 kb chip-memory (and even if you have less!) This location is usually a safe place, even demos and games (which don't allocate the memory they use) don't usually overwrite it. * If the resident checker finds a virus on the bootblock, you can install the disk or boot anyway. * By pressing the right mouse button while booting you can install the boot disk even if there is no virus on it (yippee!) * If the checker-task finds a virus, it Alert()s you, and you can either do a cold reset (kills all of them) or continue. If you choose , ProKiller won't bother you every 15th second, but every 40th second, so you can check & kill the virus with your favorite viruskiller, and ProKiller doesn't alarm you all the time. * Uses the newest reset-code (resets all Amiga models properly) * You don't have to use run- or runback-commands, just write "ProKiller". Smart people will run ProKiller in their Startup-sequences. * If ProKiller is already in memory, it doesn't try to install itself again (very intelligent, isn't it :^) * Works with "SetPatch r". ProKiller stores the initial value of the ColdCapture-vector and detects changes on it. This way it doesn't complain if you run SetPatch BEFORE ProKiller. Also, when doing a cold-reset, ProKiller doesn't wipe SetPatch out. * Really fast, you can't even see that it's there! It uses 0.0 % of the CPU-time while waiting, and about 0.6 % while checking (every 15th second). <<< REQUIREMENTS >>> - arp.library V39.1+ in LIBS: - 5 kb free memory <<< USAGE >>> Use ProKiller like this (from CLI): ProKiller [NoRes] [NoTask] [NoLibVec] NoRes = don't install the resident bootblock-checker NoTask = don't install the checker-task NoLibVec = don't check the vectors of dos.library and exec.library The simpliest (and the best) way to use ProKiller is to run it in your Startup-sequence (after SetPatch, if you use it). <<< ALERTS >>> If an alert appears when booting from a disk, ProKiller has found a virus (or a virus killer) from the bootblock. By pressing the left mouse button you can install a normal bootblock on the disk, and with the right mouse button you can boot anyway. If an alert appears suddenly after running ProKiller or after it, there's probably a link-virus in memory. By pressing the left mouse button you can do a cold reset (kills all of them) or press the right button to continue. If you continue, ProKiller will remind you of the virus every 40th second. Note that files crunched with Turbo Imploder V3.1 (V3.0 too?) and explode.library use the LoadSeg()-vector, and this might cause alerts. If you really can't crunch those files with PowerPacker, just disable library vector checking ("ProKiller NoLibVec"). NOTE: Don't install a disk which hasn't been formatted/used before, the disk will become unusable and you must install it again with some other program. <<< REMOVING >>> You can remove the resident checker by holding the left mouse button down while resetting. The checker-task isn't removable. <<< THE FUTURE >>> The future depends on you. If you find a new virus and ProKiller doesn't recognize it, send it to us (or at least send a message and some information on it!) Markku Vähäaho, Lightning Inc. <<< HISTORY >>> 1.01 - The first released version 1.02 - Whoops, this version didn't do what it should have done. Just discard it. 1.02a - Checks if the checker-task is already in memory - If the boot disk isn't really bootable, ProKiller doesn't think that it is (getting smarter all the time) 1.03 - Many internal changes made - should be compatible with Kickstart 2.0 in ROM - The resident checker should finally work OK with autoboot- harddisks. However, if it doesn't, disable it. - Should work OK also with other file systems than OFS and FFS - Very small bugs removed - Works with "SetPatch r"! ProKiller stores the initial value of the ColdCapture-vector and detects changes on it (doesn't complain if "SetPatch r" is run BEFORE ProKiller). Also, when doing a cold-reset, ProKiller doesn't wipe SetPatch out.