chkv \ rstv - protection against viruses clrv / --------------------------------- Copyright ©1990 by Arthur Hagen Most viruses live in memory by attaching themselves to one of the capture-vectors which will be called at boot-time, or by making a resident structure which also will be run at boot-time. Most virus killers handle these viruses nicely, and some of them even manages to find new viruses by actively checking these few crucial places in memory. Alas, everything hanging around at these addresses need not be viruses. E.g. if you have more than one meg of chip-ram, and run 'setpatch r' for use with RAD:, two of the vectors will be set just to recover this. If you use ZKick to boot with O/S 2.0, four of the vectors will be set. Other utilities like some resident virus killers may also use these vectors. So, if you include a virus-killer like 'VirusX' in your startup-sequence, you may actually kill more than you wanted! Here chkv, clrv and rstv come in handy. chkv is a small routine that will list the boot-vectors to screen or any specified file. When running chkv, note if you get any values shown other than zeroes. This could mean (a) that you have some resident utility that survives reboot or (b) that you have a virus in memory. If you are quite certain that you don't have any viruses running, use "chkv >S:Vectors" to save a copy of what these vectors should be on your specific system. Now you can use rstv to actually restore these vectors to YOUR defaults after some virus killer or virus have altered the contents! Just enter "rstv", and the vectors will be restored, allowing you to reboot as usual. If you accidentally have rebooted and found out that your RAD: has disappeared (most probably because of an inferior virus killer or a virus), you might very well recover your RAD: by running rstv and then reboot. Note that you MUST have a file named S:Vectors that contain a list of the vectors and their value. If you don't want to restore some of the vectors, just use any text editor to delete the line with the vector you want to leave alone. Sometimes you may want to kill off all boot-resident programs, and start all over with a clean machine. clrv will do this, if you just enter "clrv" from the CLI. If you change your mind, just use rstv to restore the vectors as they should have been. chkv comes in two flavours, one short and speedy, and one that should function well even with 68020+'s with cache-ram. For automatic check at bootup, put chkv2 into the c: directory, and the following first in your s:startup-sequence: chkv2 >NIL: If WARN Echo "POSSIBLE VIRUS IN MEMORY!" rstv Break 1 d Else Echo "Memory O.K." EndIf That's it! Oh, yeah, the programs are Public Domain, so you can spread them, modify them, eat them or do whatever you like. If you like these programs, try out VScan by the same author. *Art