This article was brought in Amiga User International July 91: VIRUS HUNTING IN PRACTICE. Unfortunately all Amiga owners have gradually noted a diminishing of their original pleasure , once they have had the Amiga a while . They bought a computer, brought it home, turned it on and realised pretty quickly that a computer isn't all brightness and light. We have often heard about viruses that have caused terrible damage to public data installations on the TV and read about them in the papers ; but new Amiga owners often forget that we are a smaller data installation, and just as vulnerable as the big data installations. Please attention ..., it is just not enough to have a couple of good virus killers , and imagine that they will cure all your problems. I have followed the virus problem for the past four years and it has gradually become my hobby to 'research' into various viruses...believe it or not. I must be one of the few people in the world who is pleased to meet a new virus. (Think at me next time you meet one....!) Yes, lots of you will say: "I can probably manage to 'wave' a new boot virus, if I find one;" but alas! today the situation is quite different. Now.......a new Amiga virus comes up every week and, even worse, a lot of them are non-boot viruses . Thus April 1991 was marked by no less than two of these, together with five new boot viruses. In other words, more viruses in a single month than we had in the whole three first years the Amiga came onto the market! In my view, this development will become pretty serious if we don't all do something to stop the spread, that is to say....it means YOU TOO! Some simple rules ----------------- So what can one do? Yes, this time I won't go into more technical de- tails, but will just lay down some ground rules: 1. Always keep your disks write protected. If you need to write on the discs then turn off the Amiga for 60 seconds so that any possible viruses which could have sneaked into the memory will have gone. 2. An embarrassing topic, pirate copies, never swap games and the like with someone you don't know. Viruses flourish typically in school yards and the like amongst children and the young who only consider the Amiga as a fun games machine. Learn....... to say no thank you! 3. Once the accident has happened, don't despair but try to get hold of one of the newest virus killers which can often be found on our excellent Amiga BBS modem bases. I will mention another possibility later in this article. 4. If you download programmes by modem, ask the 'SYS OP' which virus kil- ler program it uses to ensure that the files on the base are virus free and, last but not least, which version. Not infrequently has the 'SYS OP' been asleep for the past hour. Avoid bases like that, especially if you have a hard disk. 5. If you are one of the fortunate owners of an Amiga 500 from and with revision 6 and after, or an Amiga 2000 type B, I strongly recommend you go and buy the new Super Fat Agnus (around $ 70), which nearly hinders all viruses from lying hidden in the memory and infecting the hard disk or other disks. In other words, when you do a normal reset (Amiga- Amiga-Ctrl) your machine will now make a 'cold reset' and.........whoosh, away with possible viruses. 6. If it so happens that it is a 'friend' who has made the virus, then go straight to the police, or to me. Kids like that aren't clever, good fri- ends but rather something else.... Think of Robert Morris in America, the man behind the RTM virus in the PC's. Now he owes society millions......a bottomless debt and a ruined life! But I don't have any sympathy for him, do you? Do you realise that there is a worldwide reward here in Denmark $ 1000? for the names. Please contact me for more informations! Hardware Problems ----------------- Many Amiga Owners, as much the new as the old Amiga enthusiasts, have a tendency to 'explain' everything peculiar that happens to their Amiga as a virus attack . Viruses can of course have several underhand effects: like the disk drive going berserk , the picture suddenly appearing upside down, or your clock suddenly running backwards. However, the Amiga have general faults, which is often confused with virus attack , and it is therefore understandable , that even the best virus killers have to give up on this. The most common fault in Amiga 500 and 2000 models comes from the two port circuit 8520 , which is positioned behind the main printed circuit where all the sockets are. It is my view that up to 75% of all hardware failures lead back to this touchy circuit which , in certain cases, can create 'weird' permanent or intermittent failures , when you use the printer, mouse, floppy drive or other external hardware. Both the internal and external drive can behave oddly due to a defective 8520 circuit and the Amiga can, for example, ask you to insert disk xxx in drive df0, even if it's already there, or you can get the message (now and then) : "Not a dos disk" on a disk which is otherwise completely fault free . (Remember it is always a software failure, when the fault happens every time on a specific disk.) Not long ago I was phoned by a desperate Amiga owner who had "got a new virus" , which meant that the mouse froze on the screen, but the buttons still worked. A new 8520 circuit soon cleared up the problem. A good rule to limit these problems is to screw all plugs well home and never.....swap plugs when the Amiga is turned on. Yesterday I was phoned by a new Amiga owner, who had buyed a used Amiga, and 400 disks full with pirate games, everyone infected with viruses. He told me that "installed" write protected disk got new viruses very short time after using. I asked him to try to copy to a write....protected disk! The problem was the tiny pin in his disk drive, which is controlling the disk protection. A pincers solved the problem in few seconds. The price of RAM extensions has fallen dramatically recently but so, unfortunately, has the quality. One big problem with the RAM card, and all other circuit printing which is used in the Amiga , is this card's requirement for an extremely small contact resistance between the plug in your Amiga and the circuit board's edge connector. Many problems can be avoided by rubbing the edgeconnector's gold coating vigorously about 40-60 times with apaper tissue and then afterwards put on a thin layer of acid-free vaseline or silicone grease . After 3-4 minutes dry all the visible remnants of grease CAREFULLY off the surface. A sure sign of either a defective RAM card, or a poor connection to it, is a yellow screen at the start up, instead of the normal kickstart picture. A regular source of anguish is Commodore's poorly constructed internal clock, where a software fault can put the clock out completely so that you get the message: "Battery backed up clock not found", or . If you try to put the clock in again it will run again ("Setclock opt save"), but the next time the Amiga is turned on it will often be apparent, that the clock has gone completely nuts, and can show any time imaginable. Here are a couple of little "cheats" which can rescue you: 1. When you have to set up the clock, start by writing "Setclock opt reset". 2. Or use your Amiga Basic on the Extras Disk", and write "Poke 14417980", and you will get a logical 0 on "hold" in your clock, and the clock will start normally. 3. The newest setclock commands on 4972 bytes should be improved so that the faults mentioned above don't occur. Software Problems ----------------- It is well recognised that a number of virus killer programs can set vectors , or they can be residual, (that is to say, the program survives a "warm reset" Ctrl-A(miga)-A(miga)),in your RAM. One example is the virus killer program "System Z". A little number of utility programs , demos and intros and so on can give the same problems and ought therefore be completely avoided. The problem with these programs is that they can trick the virus killer into believing that there is a new virus in the machine. In individual cases, I have experienced a virus killer mistakenly taking a disk as being infected by a virus (with the name of the virus), despite the fact that it was an innocent bootloader, which was in the boot. This can happen sometimes, and can be explained by the fact that the virus killer's recognition code is on rather few bits for every individual virus. This code can then, in a few situations , coincide with an innocent program. Disk failure can also cause suspicion as to whether the diskette is infected with a virus . One common fault is that you get the message: "Error validating disk", "Please insert volume Lazarus", or a read/write error message. These messages are disk failure not viruses, but in many caseses you will get these disk errors , after your disks have been infected by a virus. Another irritating thing is that certain disks can ask you to remove the write protect in a systems message during the startup-sequence. One must be particularly alert here. Normally the reason is that a type of virus can be in the memory which is programmed to lure you into a trap, but it can in some cases be pretty harmless. If you have the slightest doubt, you should try to infect another disk, to ascertain whether it really was a virus. Virus Problems in General ------------------------- The simplest virus types are the bootblock viruses, because they are easy to remove by overwriting them with "install". Individual disks use a special "loader system" and will be destroyed if they are overwritten. It is very likely that the disk was already destroyed when the virus infected it, so that you will never be able to destroy a disk which is infected beforehand. On the other hand one must advise against indiscriminate use of "Install" on unknown bootblocks, one can easily destroy a disk; if in any doubt, always copy the disk first. If you have kickstart 1.3 in your Amiga you can find the disks infected with virus starting up with a guru or like, and the card crashing not long afterwards. This can be because the disk is infected with a virus which can only work on Kickstart 1.2. In such a case a lot of diskettes can be saved, which you would otherwise have hought were faulty, by "Install"ing them. There is a special type of "virus" which is characterised by the fact that they cannot infect other media such as diskettes, harddisks or the like. They can cause serious damage by acting as destructive programmes which, for example, can re-format a whole harddisk. These viruses ("hacks") can appear in the boot (like normal bootviruses), or as an individual file (like a normal file virus) together with a link, that is to say, a file which has hooked itself to another programme (ie. the two files' size in bytes has increased, which we know from regular link viruses). If you have got a new unknown type of one of these viruses, which your virus killer doesn't know, it is impossible for even the newest and best virus killers to find them. The best virus killers today have analysis functions, which check up on all "occupied" vectors and check the Amiga's memory for residual programs, which can survive a "warm reset". This doesn't much help against these viruses mentioned above, so the only way you can prevent them is if your virus killer knows the type. There is therefore good ground for being watchful, especially if you have a harddisk. Rumours of the clock virus has several times caused even experienced Amiga users to tremble with fear. Just think, if a virus got into the clock in our Amigas, and could just hide there, undiscovered, for months..dreadful! No, you can all relax. It's only a rumour, it's a physical impossibility, there are only few bytes free in the clock, but definitely not enough for even the minutest program. On the contrary, the rumours about various types of viruses making your clock run amok are true. I have heard from several sources that there are supposed to be two types of virus or "hacks"(?), in Germany and the USA at least. One of them is supposed to make the clock run backwards, the other makes it go 10 to 20 times faster. I'm very interested in these viruses and of course, in other NEW viruses, and to say thank you for one, I will send you a disk I make which is called "The New Superkillers", where the newest and best Public Domain virus killers can be found , together with an amount of valuable documentation from Virus killer programs which I cooperate on. We can only make good virus killers, if we get help from you! This disk can be found on many BBS's round the world, but the newest version (updated 40-50 times a year), can always be found in Denmark on: Valby Amiga BBS: Line 1 (2400 - 14400 Baud) 0000-2400 Phone +45 31466166 Line 2 (1200 - 2400 Baud) 0000-2400 Phone +45 36450037 I have been contacted by several people who have had various problems in removing the link and file virus from both diskettes and harddisks. A recurrent problem is probably the "BGS-9" file virus, which causes several problems, maybe because it is not one of the most difficult to remove, but more likely because it is one of the most widespread. A contributory cause to the stubborn problems with the BGS-9 virus is cause by bad coding of the virus killers KDV III and VirusX. These virus killers don't look for the viruses themselves, but for an empty file in the Devs Directory. To put things a little in place, I will go through how one removes these and similar viruses: 1. Look in the disk's startup-sequence and find the name of the first command, note the name down on a piece of paper. 2. Look for this name in C/Dir...if the BGS-9 virus has taken over this name (BGS-9 on 2608 Bytes) the file will have been deleted. 3. Go into Devs and find the nameless file, give it the name from point one, and move it back to its original position in the C Directory. NB. Please attention always to remove the emty file in the devs directory otherwise VirusX and KDVIII will give a requester saying: "infected by a virus like BGS-9, but not the viruses itself". Harddisk and Virus ------------------ Many harddisk owners know that they should be particularly careful with all "non-boot viruses" and don't think twice about boot viruses. Watch out! A lot of boot viruses can also get into a autoboot harddisk. PLEASE ATENTION,......that a boot virus infection on your harddisdisk is the MOST SERIOUS thing, that can happen your harddisk! I know, unfortunately, several experienced Amiga owners, who have spent weeks to bring their infected harddisks back to life. The boot virus write itselves onto sector 0 and 1 of cylinder 0 on your autoboot harddisk, and you will get a system message which says: "Not a Dos disk in unit 0". If the accident has happened, try to revive your harddisk by starting up your harddisk installations disk, then format your cylinder 0, and prep your harddisk again. If it is a file virus which has jammed your harddisk , remember that most of these are in the first command in the startup-sequence , note the name in the startup-sequence, delete the file which has that name in your C/Dir and reestablish the original c command from , for example, your workbench disk. Xeno virus, and similar link viruses, can create other problems because they can attack several of the files. Because these files still have their original names, it can be hard to find them, if you don't have the exact viruskiller which knows this virus. A piece of good advice here - make a list of the harddisk and note the date, look for the most recent, and delete all these files. Remember when you make a backup of your harddisk, that if you are doing it too often, you maybe can get a backup infected with a link virus. Vision for the future --------------------- I think the only way to stop virus spreading is to catch the man, who had made the virus and tell others about the consequences. Many young one think, that virus making is like making graffiti or like. The fact is that the laws punish VERY HARD for data terrorism, in Denmark up to 4 years jail, and e.g. in Gemany you can get up to 6 years jail. Please contact me if you know somebody, who had made a virus, there is now a world wide reward $ 1000..... for supplying the names of these virus terrorist. Everyone is welcome to send virus questions, or suggestions for the next article to our mailbox, or to me. I will be writting shortly about what happend some virus terrorists , who was caught by the police, and e.g. what the laws says about data crime in different countries. Last news --------- Please be very , very carefull , if you get the new "Saddam Hussein" file/ link virus. Attention that there is a boot virus with the same name, don't be confused. Here you have some facts about this virus: 1. The virus is a "multi-headed" file- and link virus. Always infected in L/Dir, if not L/Dir on the disk, it will make one by itself. 2. The Saddam file virus part is always to find in L/disk-validator , with the same file lenght (1848) and of cause the same name.....a diabolical thing oh...! 3. It can infect as the only one (I know) , even if you have the new super Fat Agnus (1 MG ChipRam) and survive a reset. 4. The Saddam link virus part is a VERY , VERY...... easy spreading virus, where it link to all files , e.g. to all executed , written or copied files , but don't change the file lenght only write "IRAK" in the start of the files. Please remark that all this infected files will get "Read /Write" errors! 5. It is impossible to delete the virus or the link infected files with a fileeditor like "Diskmaster", or from CLI. 6. Please attention , that the new BootX 3.64 will find the "Saddam" virus but can't remove it. I recommend as the only way, that you formats your infected disks, I don't think you can repair your disk again. E.L.S. Erik Lovendal Sorensen can be contacted at: Snaphanevej 10 DK 4720 Praestoe Denmark Phone: 011 45 53 792512 Fidonet 2:230/114.26 Modem Robotics HST, V42, 38.400 Baud