VIRUS MEMORY KILL V2.7 By CHRIS HAMES. Edited by PARASITE. (REMEMBER! no virus can copy itself to a write-protected disk.) This utility is perfect to put in the startup-sequences of your important disks being only 2392 bytes. It will detect and remove from memory the viruses listed but more importantly detect new viruses. You will know when you have an outbreak of a virus and can then disinfect your disks with an appropriate disk virus killer. The version number of VMK refers to the amount of viruses it knows. VMK will detect nearly all new viruses that stay resident(survive reboot) because it checks if CoolCapture, ColdCapture, WarmCapture or the KickTagPtr is not zero. It also checks the jump addresses of routines commonly used by viruses:- AddTask, DoIO, OldOpenLibrary, RemTask, SumKickData, Open, Close, LoadSeg, Lock, Write, VerticalBlank, TrackDiskDoIO, and KeyReset. When VMK finds that any of the above are abnormal it alerts you telling you what is not normal, gives you the value that is not normal and displays the memory around the location, which is indicated by a = on left hand side of the actual location. You can look for text indicating what is causing the problem in the memory display. eg "ByteBimboVirus". When VMK finds a virus or something that looks like it is being caused by a virus you have an option of cold reseting or doing nothing. If you think or know the alert was caused by a virus select cold reset(kills everything in memory) then boot off a clean disk and use a disk virus killer check your disks. VMK recognizes most of the non-virus programs that use one of the checked values and with not alert you. If it finds the SystemZ Anti virus in memory it will print a message telling you of its presence but not alert you. If you find a program that is not a virus and is causing alerts just tell me and I will get around the problem in the next version. Usage: VMK tkc? c will cold reset(if you want a virus safe reset) t will stop KickTagPtr checking k will stop KeyReset checking ? will show information about VMK and then run it If you find a new virus, or want to make a donation for the many hours of work that have gone into this program, of money or anything I might find of use. I can be contacted:- C Hames 6 Pamela Crt Blackburn South VIC 3130 Australia (The land with practically no Amiga Software Companies) OR contact me on the BBS's(Hotline Phoenix AmigaLinkII) or at AUG meet or Wake me up at a Monash Uni Lecture. This program may be copied for any purpose as long as it is unaltered and accompanied by this doc file unaltered. I take no responsibility for any problems that occur using this program. It performed fine when tested. Viruses Known by this version BootBlock Viruses:- AustralianParasite Australian idiot! Turns screen upside down after time. BackFlash Another typical boot block virus 16BitCrew Another typical boot block virus ByteBandit Infects bootable disks inserted. Starts interrupt that will blank screen after certain time. To recover:- Press these keys in order and keep holding down as you press the others. Left-Alt, Left-Amiga, Space, Right-Amiga, Right-Alt. Look for "Byte Bandit" in boot block. ByteWarrior(DASA) Infects inserted disks. Plays tune and flashes power led if Cool or Cold Capture are not zero at boot(eg detects SCA). Works with Kick 1.2 only. Look for "DASA.2" in boot block. DiskDok Infects inserted disks. Eventually starts formatting every 5th disk inserted from block 880. Works with Kick1.2 only. Look for "Disk-Dok" in boot block. Gadaffi Infects evry disk inserted. Works with Kick1.2 only. Look for "GADAFFI" in bootblock. Graffiti Does 3D graphics. Infects disks booted off. HCS4220 Infects disks booted off. Starts interrupt power led flashs with drive step and also every sec. So called detector. HCS II LamerExterminator Infects disks inserted. When in memory will return a normal boot block when it is actually the virus. Writes random blocks filled with "Lamer!". Boot block changes each time except for some start and end bytes. Microsystems Infects inserted disks. Eventually puts up screen "..MICROSYSTEMS". Works with Kickstart1.2 only. Look for "MICROSYSTEMS" in boot block. Northstar & OldNorthStar Infects disks booted of that have $43fa0012 at $12 in bootblock (normal bootblocks). Look for "NorthStar" in boot block. So called Detector. Obelisk Infects only if you have no fast ram and only disks you boot off that have $4eaeffa0(jsr FindResident(a6)) which cuts out most non dos loader disks. Puts up screen when booting "Obelisk..". Pentagon Another so called detector. Phantasmumble Another typical boot block virus Revenge Changes pointer to a male part of the body a minute after boot up. Look for "Revenge" in boot block. SCA & LSD & AEK Infects booted disks that don't have $37fcbb02 CheckSum. Every 16th recreation, screen comes up with a message. Look for SCA or LSD or AEK in boot block. UltraFox After approx 16 copies puts up message "..Ultrafox..". Some Australian idiot. WarHawk Boring. File Type Viruses:- Devs2608 NOT A BOOTBLOCK VIRUS. Ocassionally puts up message "A COMPUTER VIRUS IS A DISEASE TERRORISM IS A TRANSGRESSION SOFTWARE PIRACY IS A CRIME THIS IS THE CURE". BUNDESGRENZSCHUTZ SEKTION 9 BSG9 SONDEKOMMANDO "EDV" It looks for the first file in your startup-sequence renames it "devs: " then renames itself(2608 bytes) your program name so it gets executed each time you boot a disk. So look in your devs directory for a file called " " which is your old file & the virus named after your program and 2608bytes size. IRQ NOT A BOOTBLOCK VIRUS. Attaches itself to the first file in startup-sequence or c:dir. Every disk that is inserted that is write protected will cause a requestor("Volume is write protected"). Changes window to "...IRQ virus". LamerRevenge This is a file type version of the Lamer. Xeno Attaches itself to files. Spreads fast.