Virus Checker This Program Virus_Checker is a freely distributable, copyrighted piece of software. You do not have to pay money to use it, and may upload it wherever you choose, but you are not allowed to sell Virus_Checker for profit, or include Virus_Checker on a disk which is sold for profit, without the author's (John Veldthuis) permission. Commodore New Zealand Have this permission already I can be contacted at the address below. Please send me any more viruses so I can update Virus_Checker John Veldthuis 21 Ngatai Street Manaia, Taranaki New Zealand Phone (0624) 8409 To use, place in your startup-sequence the following line Virus_Checker this will run virus_checker upon running Virus_Checker will first check your memory for viruses and tell you if any where detected. They will either be removed or disabled. Next all disks in the drives will be checked. Any disk put into any drive (df0: to df3:) will be checked. The rest is easy Sometimes the machine may GURU when it disables the LAMER Exterminator virus in memory but if you reboot it should be gone. Virus Checker will check the startup-sequence file for the Xeno virus. If it finds this virus it will let you check all the files on any drive for the virus. If you want to check a disk for this virus then put the disk in any drive. Make sure the Virus_Checker window is active the press and release the right mouse button. This will bring up a requester asking you which drive to check. Enter the drive name in the box, eg. DF0:, DH1:,RAD: etc. It will then check all the files on that drive. You can also enter directories if you want to eg, c: df0:c, df0:libs etc If Virus_Checker brings a requester up that says a program just run has infected your memory with the Xeno Virus, it has already disabled it. You should immediatly check all files on the disks that are in the drives at that time. This means that a program that you just ran or a program some other program just ran is infected with the virus and all files should be checked to find out which one it was. With viruses which use a RomTag I have decided to clear out all RomTags to make sure I remove the Viruses from the list. In doing this you will lose things like Recoverable ram disks such as RAD:, VD0: etc. If You have a virus make sure that you save anything in the ram disks that you want before rebooting. The ramdisks and others will disappear on a reboot. My policy is better safe than sorry. V1.0 was an arp.library version V1.1 was an port to the normal libraries V1.2 had the ByteBandit virus detection added into it V1.3 had detection of the 3 Viruses in memory and removal of them V1.4 added code to detect + remove the Byte Warrior Virus from memory and disk V1.41 found a slight bug when using DSM to disassemble this the program was testing low memory instead of a value when checking for the Revenge Virus V1.42 changed code to be assembled by the CAPE 68K assembler which is much faster than A68k or Assem. Now also uses base register addressing mode for data access V1.43 changed code to cut down executable code V2.0 added Pentagon, System Z, North Star, Obelisk and the new IRQ virus which lives in files and not in the Boot Block V2.1 corrected a few little bugs in program V3.0 Did a listing of Source code and found many bugs Did a major rewrite to clean it up and saved about 400 bytes V3.0 now checks for the viruses listed SCA, AEK, Byte Bandit, Byte Warrior, Revenge, Pentagon Circle System Z, North Star, Obelisk, Disk-Doktors and the latest IBM type virus the IRQ virus. V3.01 got a new virus. Lamer Exterminator. added code to get rid of it V3.02 got a second Version of the LAmer Exterminator virus V3.03 After many requests decided to add checking of BootGirl BootBlocks which where being registered as Non-Standard. It now Just Ignores BootGirl BootBlocks V4.00 Updated to make better use of the Stack. Now store all variables on the stack for a saving of 124 bytes in the Executable V4.10 TimeBomb virus added to code V4.20 Altered startup code to start a separate process to avoid doing a RunBack -2 Virus_checker V4.22 Added Gadaffi virus to checker V4.23 Found a potentially Fatal Error in Code When accessing Unit Byte off the Stack. V4.24 Added Graffiti, Ultra Fox, and Phantasmumble Viruses Don't actually have these last 3 viruses so Anyone please send them To me if you find them. Still looking for the IRQ Virus as well V4.25 Added BSG9 virus to code V4.26 Changed Error Checking on BSG9 virus abit V4.27 Got the War Hawks virus and added it. Also added V3 of Lamer exterminator virus. Changed checking for BSG9 virus. Now checks when disk is inserted into drive V4.28 Found I was losing the memory that was used by the program when it exited. This was caused by me not UnLoading the Segment used for The program. Fixed V4.29 Found program got into a continuous loop when there where no RomTags present in the system. Fixed Also cut code size down abit more by combining a few checks V4.30 Put further checking in for the BSG9 virus as sometimes the checker would not find the file on the disk depending on which directory it was in. Put VKill virus checking in Also Ultra Fox and PVLProtector virus checking in V4.40 Put in DosSpeed virus and an Unknown virus.It does not have any names at all V4.41 Stopped Requester that comes up after pulling disk out. V4.42 Added JITR virus which was sent to me by Jonathan Potter (AUST) V4.43 Added MicroSystems virus checking to code and BootBlock checking of the HCS II, Opapa, BackFlash, and Australian Parasite viruses V4.44 Changed code around abit to get better use of tables and added Xeno virus check for Memory only V5.00 Changed user interface to give a new look and better messages V5.01 Major Bug repaired. V5.00 GURU'ed when checking disk. Worked with 68020 CPU but failed on standard Amiga's due to a bad address. V5.02 Was not checking startup-sequence properly when disk was put in 3 1/2" drive when a filename was given as C:SetCPU or something like that. Came up with a strange filename not being checked. Fixed Added second version of Byte Bandit Virus, Someone hacked it Added code to remove Xeno virus from files V5.03 Slight bug corrected in code V5.04 Have changed this from PD to Freely Redistributable after an offer from someone to sell Virus_Checker. I feel this still needs to be at minimal (copying charge) or no charge to be effective. Also cleaned up the code abit. This may introduce new bugs so please tell me about them if you find them Added checking of IRQ virus when checking for Xeno files on disk. As the file is in the buffer already this adds very litle extra time to the check. And better safe than sorry. V5.05 Changed text when Xeno Virus found after a program has been run to warn that the program just run maybe the culprit V5.06 Added 16 Bit crew Virus, New Alien Beat Virus, Digital Emotions virus, Graffiti Virus, two new versions of the Byte Bandit virus, ScarFace virus, Turk virus, Joshua virus Also a little bug when used with NTSC machines. You could not display the Boot Block Sectors. Now Startup alters for which machine it is on. The Startup code is only used once and then the memory for it is freed. ************************************************************************ NON-STANDARD BOOT CODE - When Virus_Checker brings up a Requester that says the disk has non-standard boot code this means that the code in the boot block is not what should be there. This does not mean that it is a virus as many games use copy protection in their boot blocks. You should however be cautious if it is not a game. Do not replace the boot block if you are not sure. If something strange happens then please send a copy of the disk to me so that I can check it out. Here is a way of checking non-standard boot code 1. Format a blank disk so you know it is clear. 3. Make sure all disks except the one just formated are write protected 3. Boot from the disk that you suspect. 4. Place formatted disk in drive zero and then reboot. 5. Take disk out of drive zero and turn off computer for about 30 secs. 6. Run the Virus_Checker program. If the Virus_Checker finds non-standard boot code on the newly formated disk you have found a new virus. Please send it to me Viruses Dealt With: ------------------- SCA - The SCA is the simplest virus to deal with, as it's notactually DOING anything except hiding in memory, until you reboot. We just look at CoolCapture and fix it to get it out of RAM. AEK - This is a clone of the SCA virus and we get rid of it in the same manner LSD - Another SCA clone and uses the same code Byte Bandit (Now 4 versions) (Amiga Freak) - The Byte Bandit virus takes the DoIO() vector and re-directs it through itself. Thus, any attempt to read or write the boot block (ie, AmigaDOS trying to figure out what kind of disk it is) results in the BB writing itself onto that disk. We couldn't just rewrite the boot block, we have to get him out of RAM first. This virus also has an interrupt that crashes the machine every 5 minutes or so after it's infected a few of your disks. Ow. It stays in memory not via the Capture vectors, but by a Resident module. When machine looks crashed press these keys at the same time from left to right LAlt,LAmiga,Space,RAmiga,RAlt. This will restore things for another 5 minutes Revenge - Basically, a Byte Bandit clone except it will bring up an obscene pointer a few minutes after you reboot. We treat it much like the byte bandit. Byte Warrior - Jumps right into 1.2 Kickstart. Won't work under 1.3. Hangs around via Resident struct, doesn't do any damage. North Star/ StarFire - Like SCA, hangs around via CoolCapture, killing CoolCapture kills the North Star. Obelisk Softworks Crew - Hangs around via CoolCapture, also watches reads of DoIO() (but doesn't infect EVERY disk - only ones you boot off of) IRQ - This is the FIRST Non-Bootblock Virus. It copies itself from place to place via the first executable program found in your startup-sequence. It SetFunction's OldOpenLibrary(), has a KickTagPtr, and lives in the first hunk of an infected program. Pentagon Circle - This one looks at the DoIO vector, and has a CoolCapture vector. It will write itself over any virus inserted, but not onto anything else. No danger, easy to eliminate. Holding left button while booting with this one shows different screen colour, but doesn't get rid of it. HCS Virus - Hooks into the System Z protector - This is another virus protector that can write itself to disks. Anything that spreads itself, under any name, is a virus. Doesn't do anything except during a reboot, then examines disks and writes over viruses. Disk-Doktors - This is another virus which looks at the DoIO routine for the reading of any bootblocks. If it finds one it will rewrite a copy of its code to it if it can. This one also patches into the Vertical Blank interrupt and seems to format you disk after a certain number of interrupts (can't be sure though).The nasty bit is it also creates a task called clipboard.device which spends its life copying itself through memory fragmenting the memory into small blocks. Calls ROM CODE direct so wont work under V1.3. We restore the DoIO routine, the Vert Blank interrupt and RemTask the clipboard.device LAMER Exterminator - This virus was sent to me by Andrew Mercer of the Palmerston North group. His letter said that He noticed strange things on his disks. On disassembling the virus I found that most of it was encrypted and the data was encrypted randomly using the beam position of the screen. Thus it appears different each time. It patches the trackdisk.device to look at reads and writes, It patches the Sumkick vector in exec in case someone tires to get rid of it. When it detects a read or a write it will randomly select a sector on the disk and will check if it is a data block. If it is it will write LAMER! all over the sector and rewrite it. Some say this Virus will write to write protected disks. I have not had this happen to me and I can see no special code in the disassembly to accomplish this feat. TimeBomb Virus - This is a strange Virus. It does not insert itself into any vectors.However it will copy itself back to the disk it came from. When the count gets to 2 it will wipe out the Root Directory of the boot disk and display an alert. If the count is over 2 it will just display and alert GADAFFI Virus - Inserts itself into the CoolCapture vector, Uses a RomTag structure and patches the DoIO vector Jumps directly into the Kickstart so will only work under V1.2 Kickstart. After 13 copies it will Step the Heads of drives 0 and 1 in and out. We simply clear all vectors and Use the old V1.2 DoIO code entry point BSG9 Virus - This is similar to the IRQ virus in that it does not live in the Boot Block. It operates differently. Inserts itself into the RomTag pointer. It then loads the program it replaced and executes it. On Reboot the RomTag is called. It patches the Intuition OpenWindow Routine to its code. It then returns. Once AmigaDos opens up the CLI window the virus code gets run. This gets the startup-sequence file and gets the first command that is run. It then checks if it is already here. No, then it moves this program from it's directory into the devs: directory and renames it a strange name.It then copies itself to replace the command it just moved. A give away is the file size. The Virus size is 2608 bytes and there will be a file with what looks like spaces for its name in the devs: directory. To get rid of we copy the file in devs: back to the c: directory and rename it.Then delete the file in the devs: directory. In memory all we do is change the RT_INIT code which is run on reboot to do an immediate RTS The memory for the program is still used but the Virus is disabled. It will display a screen of its own which says A Computer Virus is a disease Terrorism is a Transgression Software Piracy is a crime This is the Cure BSG9 plus some other junk War Hawks - This Virus installs itself into the CoolCapture Vector. It copies itself to the disk when the computer is warm booted. After every four copies it displays a message. To get rid of it we simply clear the CoolCapture vector VKill Virus - This is another virus hidden as a Virus protector. When booted it copies itself to the stack area that is not used. It then patches the CoolCapture vector to survive a reboot. It patches the PutMsg vector of ExecBase to watch for BootBlock reads and writes.When it finds one it checks it and tells you if a virus is present.If you want to get rid of it it will copy itself to the disk.To remove it we Clear the CoolCapture Vector and SetFunction the PutMsg vector Ultra Fox - This one lives in the CoolCapture vector. When you reboot it will change the DoIO vector and wait for a BootBlock read.When it finds one and the disk is not already infected it will write itself to the bootblock.After every 16 copies it will put a custom copper list which displays greetings PVLProtector - This one is another bootblock protector.When it finds a virus it will write itself to the disk instead of a proper bootblock. All we do is set the RomTag to do a RTS DosSpeed - This is another file virus. It is supposed to speed up disk operations by 800%. This was found on a BBS and when run patches itself into several places. It will read the s:startup-sequence file on reboot and will edit it so that it runs itself as the program. It sticks out because the first line in the startup-sequence will be blank.When the Checker finds it look in the Root directory and you will find what looks like a blank filename. Virus Checker will rename this virus for you. You can then delete the virus and alter your startup-sequence to get rid of the first blank line UnKnown - This is a virus that has no names anywhere and will only work under V1.2 Kickstart. Very easy to get rid of. JITR Virus - Very mild sort of virus this one. Only writes itself to the BootBlock. Does nothing else. Easily fixed by clearing the CoolCapture vector MicroSystems - Haven't got this one yet so can't tell you much about it. Just have to restore a vector in the Exec.library and clear the Exec CoolCapture vector. Xeno Virus - This virus is a very nasty one in the way that it infects all programs that can be run. It does not need the program to be run but even someone doing a list or dir on a disk when the virus is present will infect all those other files on disk. It patches into the dos.library and takes over the OPEN,LOCK and LOADSEG calls in dos. This way it can intercept the files being looked at. It will copy itself to the start of every runnable program and alter the file so that it still works. There is also an encrypted message which says 'Greetings from the Xeno Virus' but I hav not worked out when this appears yet. To get rid of it from meory we have to reset the changed vectors. To get rid of it from the file is very much harder. First the file has to have the virus removed from the code. Then the relocation data pointers have to be changed so that everything still works. When Virus_Checker finds a file infected with the Xeno Virus it will tell you which file it is and bring up a requester. You can now check the files on drive zero for furthur viruses if you want. I will soon add a string gadget so that all drives can be checked. 16 Bit Crew - This virus does not do much and only infects disks that you boot with. To get rid of it from memory we clear the CoolCapture Vector and restore the DoIO vector. New Alien Beat Virus - This one will only work under Version 1.2 Kickstart as it jumps into the ROM code directly. To fix in memory we have to manually patch the DoIO vector and FindResident Vector with the correct values for 1.2. and clear the Capture vectors. BlackFlash virus - This virus will display a message after a certain ammount of copies of it have been made. It says that your computer is sick and has a virus. To remove it we just restore the DoIO vector and clear out the capture vectors. Digital Emotions virus - This is another tame virus. Only infects disks when it is rebooted. Clean out the Captures vectors and it is gone. ScarFace Virus - This takes over the BeginIO routine in the trackdisk.device to watch for reads and writes to the disk. When it finds one it will write itself to the disk. It also has a VertBlank intterupt which will do something after awhile. I think it only reboots the machine. It also has a romtag which we have to clear out. Turk Virus - Another simple virus. Does not do very much. Simple to get rid of Joshua Virus - Again, lives in the TrackDisk BeginIO and VertBlank Intterupt. Also has a RomTag to survive reboots. This one will display a sprite after so many intterupts. I am not sure what it looks like but maybe someone wants to wait until it is triggered. It counts intterupts. It will also infect every disk but in the drive that is not write protected. Data in it that says something is encoded. To remove we simply restore the BeginIO code and VertBlank Interrupt and wipe out the RomTag.