VIRUS-CONTROL V1.3 Herewith I declare VIRUS-CONTROL V1.3 as PUBLIC-DOMAIN !! --------------------------------------------------------- Hallo Amiga-friends, First of all, sorry for my poor school-English (I'm a German). There are a lot of Anti-Virus-Programs. But none of these programs could satisfy me. Therefore I programed my own Anti-Virus-Program, very compact, very easy to use, but lots of useful functions. Now the operating instructions for VIRUS-CONTROL V1.3 - runs on any Amiga - 100 % assembler - survives reset - dangerless Boot from Virus-Disks because of Boot-Simulation - you can switch off FastRam during reset - Disks are checked during insertion - Protection from Link-Viruses by File-Protection-mark - show Bootblock on screen - save Bootblock to a file - overwrite Bootblock with a file - write Original-Commodore-Bootblock, - write NoFastMemory-Bootblock - Inactivate(NoBoot) and reactivate(Boot) of (Virus)disks - an extra task checks system-vectors every second - kill system-virus by system-vectors-restoration - you can change write-access to bootblock to harmless read-access - a suspected Bootblock can be catalogued as dangerless - a suspected Bootblock can be catalogued with a name - the access to files can be controlled by an requester - you can start VIRUS-CONTROL with additional characters -f do not search S:NoWarning, S:VirusName -c no green color-signal during disk-insertion -t do not check already inserted disks -o control File-access I have added the well documentated source-code. VIRUS-CONTROL is carefully thought out and compactly programmed. Nevertheless there is a filelength of nearly 13 KB. In spite of economical Intuition-programming, there are needed 5 KB only for the Intuition-structures. You can start VIRUS-CONTROL in CLI or in startup-sequence with or without 'run'. If you try to start VIRUS-CONTROL, DOIO- and COOL-Vector are checked. If these vectors are changed, you are told, that your Amiga seems to be infected, and best you switch off your Amiga. Then switch on your Amiga again and start VIRUS-CONTROL early. Now no more virus can infect your Amiga in an unrecognized manner. If VIRUS-CONTROL is installed already, you are told about this. If VIRUS-CONTROL finds a changed KICK-vector or a changed BeginIO- vector, there will be an information only, because also serious programs change these vectors (FACC changes Begin-IO, RAD: changes KICK-vectors). The reset-routine jumps to VIRUS-CONTROL by the COOL-vector. VIRUS-CONTROL now checks, if left mouse-button is pressed. In this case VIRUS-CONTROL will be removed. Otherwise a green color-signal indicates, that further VIRUS-CONTROL is controlling the system. Now DOIO-vector is set to VIRUS-CONTROL. From now on each DOIO is checked if it is a DOIO to disk track 0. The following boot-routine, the insertion of a disk or 'loadwb' does a DOIO to disk track 0. If you start VIRUS-CONTROL without -t, there also is a DOIO to disk track 0. Your Amiga only boots from disk, if it is a DOS-disk and if the bootblock-checksum is correct. If this is fulfilled, the disk-bootcode is checked. If the bootcode differs from Standard-bootcode, this bootcode could be a bootblock- virus. But also it could be a harmless Intro or autoboot-game. Such a disk is considered as a 'suspected disk', because it could be a Bootblock-Virus-disk. If your Amiga wants to boot from disk, VIRUS-CONTROL checks if the inserted disk is a 'suspected disk'. In this case there will be a requester, which offers a dangerless Boot-simulation or the real disk-boot-routine. If you select the real disk-boot-routine, there will be another requester, which will inform you about the danger of activating a bootblock-Virus by the real disk-boot-routine. You are working with your Amiga. If you now insert a 'suspected disk', a powerful Warn-Window will appear. If you press right ALT-key and insert a 'suspected disk', VIRUS-CONTROL will not check the disk. No Warn-Window will appear. If you press left ALT-key, there always will be a Warn-Winow, also if the inserted disk is 'not suspected'. In this way you can work on 'not suspected' disks too. If there is not enough memory to open the Warn-Window, a black color-signal will indicate the 'suspected disk'. The Warn-Window offers a lot of useful and powerful possibilities. Clicking CLOSE-Gadget concludes working on disk. Now you are allowed to remove disk. Clicking 'FINISH VIRUSCONTROL' removes VIRUS-CONTROL. Clicking 'KILL SYSTEM-VIRUS' restores system-vectors. Clicking 'BOOTBLOCK -> SCREEN' shows the total bootblock (1024 Bytes) as an ASCII-Dump. Clicking 'BOOTBLOCK -> FILE' writes the total Bootblock (1024 Bytes) to a file, which name is entered in the string-gadget at the bootom of the window. Clicking 'FILE -> BOOTBLOCK' writes the file, which name is entered in the string-gadget, to the bootblock. In this way you can easily save the bootblock of an important disk to a file and if necessary you can restore this bootblock. Clicking 'STANDARD-BOOTBLOCK' writes the Original-Amiga-Bootblock to disk (like 'install') Clicking 'NOFASTMEM-BOOTBLOCK' writes a bootblock-routine to disk, which switches off FastMem already at the beginning of boot. The NoFastMem-Routine is indicated by a blue color-signal. If you press left mouse-button during reset, NoFastMem-Routine will not be executed. Clicking 'f.CHECKSUM -> NOBOOT' writes a false Bootblock-Checksum to disk. Now this disk is no more a boot-disk. An eventual bootblock-virus cannot be activated any more. Clicking 'r.CHECKSUM -> Boot' writes a correct Bootblock-Checksum. Now this disk is a boot-disk. A bootblock-virus can be activated. r/f.CHECKSUM only changes the BootBlock-Checksum. The contents of the bootblock is not changed. Clicking 'IN S:NOWARNING-FILE' saves the 'suspected bootblock' to the file S:NoWarning. If S:NoWarning exists, the bootblock is appended to S:NoWarning, otherwise first S:NoWarning is created. If the bootblock already exists in S:NOWARNING, there will be a requester, which offers to remove the bootblock from S:NOWARNUNG. If you now insert a disk with a bootblock saved in S:NoWarning, there will only be a red color-signal instead of the Warn-Window. This is useful for harmless No-Standard-Bootblock-disks, like some Boot-Intros or auto-boot-games. Clicking 'IN S:VIRUSNAME-FILE' saves the 'suspected bootblock' to the file S:VirusName. Besides a name for the bootblock is saved. This name is entered in the string-gadget. If S:VirusName exists, the bootblock+name is appended to S:VirusName, otherwise first S:VirusName is created. If the bootblock already exists in S:VirusName, there will be a requester, which offers to remove the bootblock+name or to rename the bootblock. If you now insert a disk with a bootblock saved in S:VirusName, the bootblock-name will be printed into the appearing Warn-Window. Often a bootblock-virus has an infection-counter. Therefore 1 Longword-difference is tolerated. This is printed too. In this way you can acquaint VIRUS-CONTROL with any bootblock. Therefore VIRUS-CONTROL cannot become out of date! If you insert a 'suspected disk', first S:NoWarning is searched, then S:VirusName. If you insert a disk, pressing left-ALT-key, only S:VirusName is searched, since there always shall be a Warn-Window. If you start VIRUS-CONTROL with -f, S:NoWarning, S:VirusName are not searched. All critical functions like write to Bootblock or finish VIRUS- CONTROL are protected by additional requesters. Furthermore there is an requester for write-protected disks. Also an OpenFile-Error is indicated by a requester. You can simultaneously use df0: - df3:. Therefore all Warn-Windows and requesters are marked. If you insert a disk, a green color-signal indicates the correct working of VIRUS-CONTROL. This signal can be switched off by starting VIRUS-CONTROL with -c. If you start VIRUS-CONTROL, all inserted disks are checked. This checking is not done, if you add -t. If you start VIRUS-CONTROL with -o, the OpenFile-vector will be set to VIRUS-CONTROL. Now if there is a file-access, you will be asked by a requester, to allow this access. This file-access-control is very useful to recognize LINK-VIRUSES. Link-Viruses do not spread by Bootblock, but they link themselves to existing files. They lengthen the files and are activated, if the file is executed. If now a Link-virus tries to link itself to a file, this file-access can be recognized and denied. VIRUS-CONTROL offers another protection from Link-viruses. If you click 'FILE-PROTECTION', the file, entered in the String- Gadget, is searched for the VIRUS-CONTROL-protection-mark. If no mark is found, a requester appears, by which you can protect the file (VIRUS-CONTROL-protection-mark is appended to the file). In this protection-mark the original file-length is saved. If you click 'FILE-PROTECTION' again, VIRUS-CONTROL recognizes, that the file is already protected. Now the actual filelength is compared with the original filelength. If there is a difference, a Link-virus has linked itself to the file probably. A requester indicates this danger. You should act like that: - copy your original-files - protect the files with 'FILE-PROTECTION' - check the files periodically with 'FILE-PROTECTION' - if there is a length-difference, copy the original-file 'FILE-PROTECTION' works on directories too. Therefore you can protect or check a total directory. Especially C:directory should be protected. The short operation instructions of VIRUS-CONTROL can be got by starting VIRUS-CONTROL again. Hereby you can set -c -f -t -o too. Also you can set -c -o -f by the corresponding gadgets. (FarbSignal, CheckOpen, searchfiles). If VIRUS-CONTROL is active, no bootblock-virus can infect your Amiga, because VIRUS-CONTROL suggests a harmless Boot-simulation. But it is thinkable, that there are viruses, which pretend to be a normal CLI-program. For instance a better 'dir'-program, which, if executed, installs a virus. But such viruses spread slowly. Nevertheless VIRUS-CONTROL recognizes such viruses too, because VIRUS-CONTROL installs an extra task to control system-vectors. Every second COOL-vector, DOIO-vector, KICK-vectors and BeginIO- vector is checked. If a vector is changed, a requester will appear, by which you can try to kill the virus. 'Kill virus' sets DOIO- vector and COOL-vector to VIRUS-CONTROL again. BeginIO-vector is set to the old adress before changed to a new address. Furthermore COLD-vector and KICK-vectors are cleared, and 1024 bytes at the bottom of the supervisorstack are cleared, because there are viruses which use this area. Sometimes 'Kill virus' crashs the system, because 'Kill virus' collides with the virus. Therefore the best and safest method to remove a virus is to switch Amiga off. In order to find out, if really a 'suspected disk' is a Virus-disk you can act like that: Install VIRUS-CONTROL and then intentionally boot from the 'suspected disk', by this an eventual bootblock-virus is activated. All inserted disks should be write-protected, in order that an eventual bootblock-virus is not spread. If it is a bootblock-virus, you will notice some of the following effects: - Requesters appear, which indicate changed system-vectors - Requester, because of write-access to Bootblock - if you insert disk, no more green color-signal, although colorsignal is set. (DOIO-vector changed by 'Virus') - if you insert disk, pressing L-ALT-key, neither a Warn-Window nor a black color-signal. (DOIO-vector changed by 'Virus') - during reset no more green color-signal. (COOL-vector changed by 'Virus') - If you start VIRUS-CONTROL, you are told, that your Amiga seems to be infected. Your Amiga can be programmed in a very flexible manner. Therefore a virus will not produce all above effects. Sometimes a virus can collide with VIRUS-CONTROL and crash the system. After this test you have to switch your Amiga off, because this is the only safe method to remove a virus. The only reliable method, to identify a Bootblock-Virus is also the most dangerous method. Without installing VIRUS-CONTROL you boot from the 'suspected disk'. Now you insert a not write-protected, and not suspected disk. After that switch your Amiga off and boot from a clean disk. Start VIRUS-CONTROL and insert the not write-protected disk. If this disk has become a 'suspected disk', the bootblock-virus is identified. You should at once write a false checksum to this disk or better overwrite the bootblock. You see, VIRUS-CONTROL is really a very powerful instrument, to eliminate all kinds of viruses. Nevertheless VIRUS-CONTROL is very easy to use. Pius Nippgen, Bergstr. 12, D-6657 Gersheim 8, Tel. 06843/781 or 06843/1522