***************************************************************************** ****************************** VirusZ V2.08 ****************************** ***************************************************************************** «·» VirusZ V2.08 «·» ------------ supplied By :::::::::. :::::::::. .::::::::. tm :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::::::::' ::::::::: :::::::::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::: :::::::::' :::: :::: F O R ####### ###### ### ###### ####### ##### ###### ### #### # ### #### ### # #### #### # ### ###### ### ##### ### ####### ###### ### # #### ### #### ### # #### # #### ### # #### ### ###### ### # #### # #### ###### ###### ###### ###### ###### ###### ####### ##### ###### #### # #### #### # #### #### #### ### #### # #### # ###### ####### #### # ##### ####### #### ### #### # ###### # #### #### #### # #### #### #### ### #### # # #### # #### ###### ###### ###### ###### ###### ### ##### # #### ***************************************************************************** ****************************** VirusZ V2.08 ****************************** ***************************************************************************** ***************************************************************************** ************ Welcome to the VirusZ 2.08 (04.01.92) User Manual ************ ***************** Copyright (c) 1991, 1992 Georg Hoermann ***************** ***************************************************************************** 1 GETTING STARTED 1.1 Introduction 1.2 Installing VirusZ 1.2.1 The VirusZ Package 1.2.2 The Libraries 1.3 VirusZ Startup 1.3.1 CLI/Shell 1.3.2 WorkBench 1.3.3 VirusZ.config 2 VIRUSZ FUNCTIONS 2.1 Memory 2.1.1 The Vector Check 2.1.2 The Virus Check 2.2 Disks 2.2.1 The Bootblock 2.2.2 The Disk-Validator 2.2.3 Files 2.3 Key Shortcuts 2.3.1 Ascii-Dump (A) 2.3.2 Save Bootblock (B) 2.3.3 Drive Check (C) 2.3.4 Repeat Delay (D) 2.3.5 Check Files (F) 2.3.6 Help (H) 2.3.7 Install Bootblock (I) 2.3.8 Load Bootblock (L) 2.3.9 Quit VirusZ (Q) 2.3.10 Scan Disk (S) 2.3.11 Vectors (V) 2.3.12 Work Info (W) 2.3.13 Hex-Dump (X) 3 SPECIAL NOTES 3.1 The Author 3.2 New Viruses 3.3 Bugs 3.4 Source Code 3.5 New Ideas, Suggestions 4 APPENDIXES 4.1 Lists of Recognized Viruses/Utilities 4.1.1 Bootblock Viruses 4.1.2 Custom Bootblocks 4.1.3 File, Link and Disk-Validator Viruses 4.1.4 Viruses in Memory 4.1.5 Utilities in Memory 4.2 Thankslist 4.3 Smileys (A short Introduction) 1 GETTING STARTED 1.1 Introduction VirusZ is another try to make the perfect viruskiller. Although there are already hundreds of killers, none had to offer the, in my opinion, most important features. These are to be short, fast and not to keep the user from working by opening a big screen with hundreds of gadgets or locking the drives. If you like the other type of viruskiller, forget VirusZ. 1.2 Installing VirusZ 1.2.1 The VirusZ Package The VirusZ package consists of the following files. If anything is missing, look out for another source to get your programs in future. Note that the original package was released as 'VirusZ208.lha' archive. VirusZ (dir) Docs (dir) .info the drawer's snapshot info COPYRIGHT.doc copyright and distribution notes COPYRIGHT.doc.info the text's icon HISTORY.doc guess what? HISTORY.doc.info the text's icon VirusZ.doc the file you are reading VirusZ.doc.info the text's icon Libs (dir) reqtools.library.13 the Kick 1.3 version of ReqTools reqtools.library.20 the OS 2.0 version of ReqTools virusz.library includes all virus data S (dir) VirusZ.config a sample config file .info the drawer's snapshot info Docs.info the Docs drawer's info Install \ Install.info > library installation script Install.script / VirusZ the main program VirusZ.info the nice little rabbit VirusZ.info the main drawer's info All these files must be kept together for distribution. On a single machine environment you are allowed to copy only the files that are necessary for work (reqtools.library, virusz.library & VirusZ). Read the 'COPYRIGHT.doc' file first if you want to spread the package. 1.2.2 The Libraries VirusZ requires the 'reqtools.library' and the 'virusz.library' in order to work correctly. Included in this package are two versions of the 'reqtools.library', one for Kick 1.3 and one for OS 2.0. Chose the one that fits with your OS, copy it to the 'libs:' drawer of your boot disk and remove the suffix (simply rename it). The 'virusz.library' may be simply copied to the 'libs' drawer. If you don't want to do the copy work yourself, click on the Install icon from WorkBench. This will start an installation script. 1.3 VirusZ Startup On startup VirusZ prepares itself for its duties by initialising all necessary resources, creating the main process etc. But the very first thing it does is to compare its internal CRC16 checksum with the one computed on startup. This provides a maximum of security against virus infection and other modifications. There are several message alerts included in the startup module. If anyone of these flashes up, there is something wrong. These alerts are self explaining so we skip a detailed description. 1.3.1 CLI/Shell To start VirusZ, type its name to any CLI/Shell. You don't have to start VirusZ with 'Run' or 'RunBack' because it will start its own process. This release of VirusZ also provides some command line parameters. These are: -C turns the CRC16 internal checker off. Use this when VirusZ brings up an alert saying 'VirusZ has been modified!' and you are sure it's not a virus (might be a bad cruncher). -D### where ### is any value between 10 and 120 that describes the amount of seconds to be passed between two memory checks. Other values will be ignored, 0 turns off the interrupt (See chapter 'Memory' for a complete description). -X### where ### is the x-coord of the VirusZ window from the top left corner of the WB screen. -Y### where ### is the y-coord of the VirusZ window from the top left corner of the WB screen. Note that all parameters MUST begin with '-' and that there MUST be at least one SPACE or TAB between two parameters. The characters after '-' can be upper and/or lower case. Parameters defined on CLI startup have a higher priority than those defined in the 'VirusZ.config' file. 1.3.2 WorkBench Starting VirusZ from WB is nothing more than double-clicking its icon. As an addition VirusZ offers you the possibility to define some tooltypes in its icon. If you don't know what tooltypes are, here is a short explanation: You can find the tooltypes of a program by clicking its icon once and then selecting the menu-item 'Info' from the 'Workbench' menu (Kick 1.2/1.3) or the menu-item 'Information...' from the 'Icon' menu (OS 2.0). A window will be opened that contains a string gadget called tooltypes. Here you may enter the definitions you want to have. After that select 'SAVE' to save your entries. This release of VirusZ offers you the following tooltypes: NOCRC=undefined where 'undefined' is anything you like. You have to specify this value only to satisfy Intuition. This tooltype makes VirusZ ignore its internal CRC16 checksum when the alert 'VirusZ has been modified!' comes up. REPDELAY=secs where 'secs' is any number from 10 to 120 that describes the 'Int. Repeat Delay' that should be used as default. Other values will be ignored, 0 turns off the interrupt (See chapter 'Memory' for further information). Not using the tooltype causes VirusZ to use 10 as default. WINDOWPOS=x|y where 'x|y' are the coords from the top left corner of the WB screen. Any values are allowed, but those that would cause the window to appear outside the screen will cause VirusZ not to open its window and quit immediately. The default window opens at the middle top of the screen. Tooltypes have a higher priority than the parameters defined in the 'VirusZ.config' file. 1.3.3 VirusZ.config Whenever you have found out that a certain configuration fits best with your Amiga, you can save it in a file called 'VirusZ.config'. This file must be placed either in the S: or DEVS: drawer of your bootdisk, or in the same drawer from which you start VirusZ (only from WorkBench without CD, from CLI you have to type 'CD ' first). Use any text editor to change the entries in the config file. The file provides the same features as the CLI parameters (See chapter 'CLI/Shell' for a detailed description, see the sample config file contained in this package as an example). Any CLI parameters or WB tooltypes override the definitions in the config file. 2 VIRUSZ FUNCTIONS 2.1 Memory 2.1.1 The Vector Check This is done once on startup and can be repeated by pressing the according key (see chapter 'Vectors'). The following vectors will be checked: ColdCapture These are simply set to the address CoolCapture of the routine that should be executed. WarmCapture Should always be zero. KickMemPtr Pointer to a resident MemList. KickTagPtr Pointer to some RomTags. KickChkSum Only a checksum, not important. The first group of vectors should always be zero, they are only used by some program (mostly by viruses, because they are easy to use). The only exception is the SetPatch command of Kick 1.2/1.3. Since these ROMs include some bugs, this command tries to repair them by using ColdCapture (only if option -r is specified). If you use this in your startup-sequence, don't clear the vector. The second group is a bit more complicated. Nearly all resident programs like virus detectors, recoverable RAM disks or for example TurboPrint use these to keep parts of their code reset resistant. If anyone of these vectors is set and you use such a program, do not clear vectors or you will lose it after the next reset. 2.1.2 The Virus Check This is the real memory check looking for known viruses. It's executed once on startup, and whenever VirusZ finds a virus, you will get a request telling you which virus was removed. VirusZ removes them automatically. Viruses will not only be patched or disabled, but they will be removed from memory completely. See the list of recognized viruses in chapter 'Viruses in Memory'. In addition to the startup memory check, VirusZ installs an interrupt that repeats the memory check regularly. The time passed between two checks can be changed by the user, default is 10. This means that VirusZ waits 10 seconds until the next check. You can change this value either via tooltypes (see chapter 'WorkBench'), via CLI parameters (see chapter 'CLI/Shell'), via the config file (see chapter 'VirusZ.config) or by pressing the according key after VirusZ is already installed (see chapter 'Repeat Delay'). This is the safest way to find and remove file- and linkviruses from memory. These viruses can appear in memory anytime an infected file is executed. So whenever VirusZ reports a virus in memory, check the disks you are working with at the moment for infection. Note that the time passed between two checks will be slightly shorter on NTSC machines since VirusZ is PAL oriented and works with 50Hz. Also note that any virus using KickTagPtr will cause VirusZ to delete all resident modules. This means that you must save everything you haven't saved yet from your recoverable RAM disk (if used). My policy is better save than sorry. 2.2 Disks 2.2.1 The Bootblock Every disk inserted will be checked for bootblock viruses and non-standard bootcode. This ensures that your bootblocks stay clean. Every known virus will cause a request asking you what to do with it. In the current release of VirusZ, you can install a standard bootblock to delete the virus, display the Ascii-Dump of the virus to look at possible texts, save the virus or ignore it. The last possibility is not recommended. If your disk contains anything else than a virus or a standard bootblock, it will be checked for some known utility bootblocks. If this test is positive (VirusZ knows the bootblock), you won't get a request. If not, VirusZ first checks the bootblock's checksum. If this is not correct, VirusZ simply ignores it because it wouldn't be executed anyway. But if all conditions are met, the bootblock will be reported as unknown. This might happen with most bootload games or demos, so do NOT install anything you don't know. You might trash the program that depends on this boot. But if you are sure that it's a new virus, make a copy of that disk, install the original bootblock and send me a copy for inclusion in VirusZ. (See a list of all known bootblock viruses in chapter 'Bootblock Viruses'.) 2.2.2 The Disk-Validator Currently there exist two viruses that detach themselves to this program. You can find the Disk-Validator in the L: directory of most disks. It was originally thought to correct possible small errors on a disk and is called from the ROM if necessary. The viruses use the feature of being installed by the system itself by corrupting some data on the infected disks that causes the ROM to load the Disk-Validator. Instead of repairing the disk, they install themselves in memory. VirusZ finds both viruses in memory and on disk and offers you the possibility to delete them. Since the original Disk-Validator is copyright Commodore, I'm not allowed to include it in my program. You must copy it back to the cleaned disk from a heal one yourself. The latest validator virus, Saddam, not only infects the Disk-Validator, but also changes some stuff on disk. Such a disk would be ready for the trash since you cannot read the files any longer. But there's a way to repair these disks by simply using the original virus routines in reversed order. And that's exactly what VirusZ does. See chapter 'Scan Disk' for more information on using this feature. 2.2.3 Files This release also provides the feature of checking files. The best way to protect your disks from file- or linkvirus infection is to keep them write-protected. But as you know, sometimes it's necessary to remove the protection and then the risk of getting infected is quite high. To prevent your disks from getting infected, check every new disk you get for viruses. If the viruses are killed before getting started, your disks will stay clean for the future. See chapter 'File, Link and Disk- Validator Viruses' for a list of recognized viruses, see chapter 'Check Files' for a description on how to use the file checker. NOTE: VirusZ can only detect fileviruses if they are NOT crunched. 2.3 Key Shortcuts To use all features offered by VirusZ, you have to work with key shortcuts that represent special functions. They can only be used if VirusZ's window is active. Therefore click to its window before using shortcuts. The following are defined in this release (the according key is in brackets): 2.3.1 Ascii-Dump (A) Displays the ASCII-Dump of any bootblock. This brings up a Request asking you for the unit from which the bootblock to be displayed should be read. This option should help you to discover BB viruses which hold specific text in their code. You can also recognize whether the bootblock is standard or if it's a custom bootblock. NOTE: Don't rely 100% on texts like 'A2000 Memory Allocator v1.0', these can be disguised viruses too. 2.3.2 Save Bootblock (B) Offers you the possibility to save a bootblock as file. This is useful in connection with games or demos that use special bootblocks. If you keep a copy of the bootblock on another disk, you avoid the risk of losing it by a virus or accidentally. In such a case, simply restore the saved bootblock by using 'Load Bootblock'. 2.3.3 Drive Check (C) Checks all connected drives for viruses. This performs the same checks as the initial check on startup. I added this only to get a disk checked again without removing and reinserting it. Read the chapter 'Disks' for more info. 2.3.4 Repeat Delay (D) Change the memory check repeat delay. Pressing this causes an string request in which you can enter the delay (default is 10). What's this this delay? you might ask. The number entered in the gadget is the amount of seconds that should pass between two checks. Read the chapter 'Memory' for more information. 2.3.5 Check Files (F) Checks a drawer for viruses. This brings up a request in which you should enter the path of the drawer to be checked. After that VirusZ automatically checks all files in this drawer for file- and linkvirus infection. If any virus is found, VirusZ asks you whether to remove the virus or continue. Fileviruses will simply be deleted, linkviruses will be removed from the infected file. See chapter 'File, Link and Disk-Validator Viruses' for a list of known viruses. You can abort the check at any time by pressing CTRL-C. 2.3.7 Help (H) Displays Help. This brings up a request that contains all shortcuts with a brief explanation. 2.3.8 Install Bootblock (I) Installs a fresh bootblock. You can use this feature either to kill a bootblock virus or to simply make an uninstalled disk bootable. You can chose the unit and the filing-system that should be used. OFS is the standard filing system, FFS can only be used with OS 2.0. The installed bootblock is Kick 1.2/1.3 and OS 2.0 compatible. NOTE: Never install bootblocks of games or mega-demos if it's not absolutely necessary. Doing this may destroy the game. NOTE: Some other anti virus programs might report the bootblock installed by VirusZ as non-standard since it's from OS 2.0. 2.3.9 Load Bootblock (L) Offers you the possibility to load a former saved bootblock and reinstall it on any disk. This is the counterpart of 'Save Bootblock' and should be used to restore destroyed bootblocks. You can load a saved bootblock and select the disk on which you want to install it. 2.3.5 Quit VirusZ (ESC) Think twice and you'll figure out the function of this. 2.3.10 Scan Disk (S) Scans a disk for Saddam corruption. Saddam is a relatively new type of virus that lives in the Disk-Validator. Option 'S' can be used to repair the damage done by this virus. Therefore all sectors of a disk will be scanned for corruption. See chapter 'Disks' for information on Disk-Validator viruses. You can abort scanning at any time by pressing CTRL-C. 2.3.11 Vector-Check (V) This displays the most important vectors that may be altered by mostly all viruses. These are the Captures and KickPtrs. See chapter 'Memory'. 2.3.12 Work Info (W) Displays some information about VirusZ's environment. 'Int. Repeat Delay' tells you the current memory check repeat delay (see chapter 'Memory'). All other data displayed gives information about the internal hardware of your Amiga. This information can help me to find bugs caused e.g. by an accelerator board. 2.3.13 Hex-Dump (X) Displays the Hex-Dump of a bootblock. This is only interesting for experienced users or programmers. If you know something about OpCodes, this function might help you to find out what the displayed bootblock basically does (e.g. one can easily detect copperlists). 3 SPECIAL NOTES 3.1 The Author I'm a 18-year-old Bavarian student and 'Computaholic' who wants to help other users as much as possible. If you have any problems in using VirusZ, anything new concerning the next chapters, or if you want to honour my work (money will not be refused, MC68030 boards are welcome, but sending a letter or a postcard would be nice too), write to: Georg Hoermann Am Lahnewiesgraben 19 W-8100 Garmisch-Partenkirchen Germany 3.2 New Viruses Although VirusZ recognizes over 100 viruses both in memory and on disk, this is NOT enough until also the very last virus is included. If you ever get a new virus, do not delete it before sending me a copy. I'm still waiting to get the following (these are the ones I know): - BlueBox filevirus - icon.library filevirus - MAD I, MAD III, MAD IV bootblock viruses - Amiga Knights filevirus - TimeBomb filevirus - French Kiss - Fast Eddie, Divina Exterminator, Clonk since I only have some data to find them on the bootblock. Don't forget: I can only help you in your fight against these little bastards if you support me with all the necessary material. Killing a virus without knowing how it works is impossible. 3.3 Bugs There may still be some bugs in this release, but this depends on the configuration of your Amiga. I'm using an A1000 with Kick 1.2/1.3 and OS 2.0, 3MB of RAM, some external disk drives and a 105MB Hard-Disk and couldn't find any further bugs. It was not possible to me to test VirusZ with other processors (MC68010+). But I already got several bug reports about this and hope that everything is fixed now. If NOT, please don't bother and send me a detailed description (if possible) including your system's configuration and when and how the bug appears. You can find information about your hardware configuration in the 'Work Info' request (see chapter 'Work Info'). If VirusZ crashes in connection with other software, I would be glad if you send me a copy of these programs (if the copyright allows it). Please DO NOT report things that I can't repeat on my machine without a detailed description of the circumstances. 3.4 Source Code I don't release the source code of VirusZ because of the risk that somebody might use it as a trojen horse (i.e. inplementing a virus in VirusZ). It also happened, e.g. with VirusX by Steve Tibbett, that some people made their own versions without having any work. They only changed the names and that's it. Since I want to prevent VirusZ from being cloned, I decided to keep the source private. Over 90kB of source are too much work to be misused for misterious activities. 3.5 New Ideas, Suggestions If you ever have an idea or suggestion how to improve VirusZ, let me know. I'll try to do everything to satisfy you. 4 APPENDIXES 4.1 Lists of Recognized Viruses/Utilities 4.1.1 Bootblock Viruses There are some bootblocks in this list you might consider to be utilities. But every bootblock that copies itself instead of a standard bootblock is considered as a virus. And I also added anti virus bootblocks that are likely to crash even under Kick 1.3. 16BitCrew 2001 SCA clone AEK SCA clone AIDS AlienNewBeat AmigaFreak ByteBandit clone Ass Protector Australian Parasite BlackFlash Blizzard anti virus BlowJob BS1 SCA clone Butonic 1.1 (BAHAN) ByteBandit 1 ByteBandit 2 ByteBandit 3 ByteVoyager 1 ByteVoyager 2 ByteWarrior (DASA) ByteWarrior FastLoad not really a virus CCCP link+boot virus ClaasAbraham CList Clonk bad anti virus Coder's Nightmare (CODER) DAG SCA clone Destructor Digital Emotions DiskDoktors DiskGuard 1.0 Divina Exterminator 1 FAST 1 FAST 2 Fast Eddie F.I.C.A. Forpib ByteBandit clone Gadaffi ByteWarrior clone Graffiti Gremlin GXTeam HCS 4220 Hilly Hoden v33.17 Ice Breakers (ICE) SCA clone Incognito Inger IQ ByteBandit clone JITR Joshua 1 ByteBandit clone Joshua 2 Julie (Virus Predator) Kauki Kefrens SCA clone Lamer Exterminator 1 Lamer Exterminator 2 Lamer Exterminator 3 Lamer Exterminator 4 Lamer Exterminator 5 Lamer Exterminator 6 LameStyle UK CList clone LSD SCA clone M&U 5.5 anti virus M&U 6.1 anti virus Mad II Gadaffi clone MegaMaster Mexx SCA clone MicroSystems Morbid Angel ByteBandit clone NorthStar 1 NorthStar 2 NorthStar 3 NorthStar Checker bad anti virus Obelisk Obelisk Format Opapa Obelisk Format clone Paradox 1 (Logic Bomb) Paradox 2 Paratax 1 SCA clone Paratax 2 DiskDoktor clone Pentagon Circle 1 Pentagon Circle 2 Pentagon Circle 3 Phantastograph (Disk Herpes) PowerBomb ByteBandit clone PvL Protector 3.0 anti virus PvL Protector 4.0 anti virus PvL Protector 5.0 anti virus PvL Protector 5.1 anti virus PvL Protector 5.3 anti virus PvL Protector 5.4 anti virus PvL Protector 6.1 anti virus PvL Protector 6.4 anti virus PvL Protector 6.5 anti virus Rene Lamer clone Revenge Revenge BootLoader Saddam Hussein SCA ScarFace ByteBandit clone Sendarian Revenge clone SuperBoy SCA clone Supply Team anti virus Switch Off Target TelStar PvL 6.0 clone Termigator TimeBomb Tomates GenTechnic TimeBomb clone Traveller 1.0 Turk UltraFox Vermin VirusHunter anti virus VirusSlayer 1.0 VKill 1.0 WarHawk 4.1.2 Custom Bootblocks These are bootblocks written either to boot anything special, to offer you some useful functions or just for pleasure. They don't do any harm, and I added them to keep VirusZ from bringing up one requester after the other. ACID Terminator 1.0 ACID Terminator 3.0 Action Replay Boot Pro Alcatraz MegaDemo 3 Amaze Protector Amigo-Copy AntiTrax 2010 Anarchy Boot 1.1 Anarchy Boot 2 Archaos VirusSlayer 3.12 Archaos VirusSlayer 3.13 Aspect Boot 1.0 Atomic Soft Virus Detector Avirex BeerMon 0.36 Installed Betrayal Proboot 1.0 BootBug 0.1 Boot Generation 1987 BootGirl BootIntro 1.2 BootIntro Next Generation BootOut 5.5 BootTune Budbrain/New Dimensions 35 CCS Boot 2.0 CCS Boot 3.0 Copper Boot CopyLock Amiga Cytax Powerboot 1.2 DevWare Antivirus Dietmar Noll ClearMem DOC 1989 Dragons Megademo 1 Dugger FastMem Boot Allocator Hallon Boot 1.4 (Mahoney & Kaktus) HyperBoot 2.82 Hypnosis Boot Inner City VKill 3.4 Interferion Interferion 2 Interferion Pro International Soccer Invisible Brain BootCopy License to Kill LSD 1.0 LSD 1.1 LSD 1.1 (Ocrist) LSD VCheck 2.0 (Marl) Mad Monks Super Bob-Intro Megaboot 1.3 Mirage Noboot No Fastmem NOMAD Utility Boot 1.0 NTSC Warning Omni Boot 3.2 Omni Boot 5.1 Option Boot (Scampy of Adept) Outlaw Checker 1.42 PAL Boot Pe Protector Peter Stuer 4.0 Peter Stuer 5.0 Phenomena Enigma Demo Phenomena Megademo 1 Pinball Wizard Pleasure Boot 1.3+ Powerslaves Demo 1 Pseudo Ops VKiller 2.1 Punishers Proboot 1.0 PvL VirusSound Quartex Drives Off Quartex Utility Boot 1.0 Quazar of Dawn Random Access Virus Killer 2.1 Razor 1911 Observe Rebels Boot RSI Megademo Disk 1 RSI Megademo Disk 2 Sabaudian Boot 1.0 Santurary Boot Scoopex Bootintro Scoopex Mental Hangover Scoopex PAL Boot 2.0 Scoopex Utility Boot 1.0 Scoopex Utility Boot 1.3 Scorpion Developments 1.0 Scorpion Developments 1.1 Seek & Destroy BootCheck 1.0 Seek & Destroy Drive Control 1.0 Sinister Syndicate Slipstream Utility Boot 2.1 Slipstream Utility Boot 3.0 Slipstream Utility Boot 4.0 Slipstream Utility Boot 5.0 Slipstream Utility Boot 6.0 Slipstream Utility Boot 6.1 Slipstream Utility Boot 7.0 Squash 4.3 Stoneboot 1.06 (Cave) SuperDuper NoDrives SysNot TAL Bootleg 2.1 TetraCopy Formatted Disk The Sect Mega Concert TIP Memory Controller 1.2 TIP Memory Allocator 1.3 TLC Demosample TriStar VKiller 1.1 TSB Boot Protector TSB Virusfree Boot Ultimate Boot Writer VCC BootMem VCS Boot 3.2 Venom BootLoader 1.00a Virus Destructor 1 Virus Destructor 2 VirusKiller Prof. 2.0 Vision Megademo 4 Vortex 42 Megaboot 1.3 XCopy Prof. ZeroVirus AutoAddRam ZeroVirus BigScreenTest ZeroVirus Message Boot ZeroVirus NoFastMem 4.1.3 File, Link and Disk-Validator Viruses The viruses listed below will be recognized and removed by the VirusZ file checking routine. BGS9 1 BGS9 2 Bret Hawnes Butonic v1.31 Butonic v3.00 CCCP Centurions (The Smiley Cancer) Disaster Master v2 Installer of TimeBomber IRQ-Team v41.0 1 IRQ-Team v41.0 2 Liberator v1.21 Return Of The Lamer Ext. Revenge Of The Lamer Ext. 1 Revenge Of The Lamer Ext. 2 Saddam Terrorists TimeBomber The Traveling Jack 1 The Traveling Jack 2 Trabbi Xeno 4.1.4 Viruses in Memory All viruses recognized on disk will also be recognized in memory. All the viruses mentioned below will be removed properly in order to let you go on with your work safely. But not all of them will be recognized by name. This is because some clones (especially SCA clones) can be detected and killed all the same way. Including a routine to get their real names as an addition would cause the memory checking routines to get more than twice as large as they are now. And that's not worth it. AlienNewBeat Ass Protector Australian Parasite BGS9 2 different BlackFlash BlowJob Bret Hawnes Butonic 1.31/3.00 ByteBandit clones 8 different ByteVoyager 1-2 ByteWarrior (DASA) CCCP link+boot virus Centurions ClaasAbraham CList Coder's Nightmare (CODER) Destructor Disaster Master 2 DiskDoktors DiskGuard 1.0 FAST F.I.C.A. Gadaffi ByteWarrior clone Gremlin GXTeam Hilly Incognito IRQ-Team 41.0 Joshua 2 different Julie (Virus Predator) if I catch the guy who gave a virus the same name my favourite girl has... Lamer Exterminator several different LameStyle UK CList clone M&U 5.5/6.1 MegaMaster MicroSystems Obelisk Opapa Paradox (Logic Bomb) 2 different Paratax PvL Protector 9 different Rene Lamer clone Return Of The Lamer Ext. Revenge Of The Lamer Ext. 2 different Revenge/Sendarian Revenge BootLoader Saddam Saddam Hussein SCA clones 30 different ScarFace ByteBandit clone Switch Off TelStar PvL clone Termigator Terrorists The Traveling Jack 2 different TimeBomb/Tomates GenTechnic Trabbi Traveller 1.0 Turk 1.3 VirusHunter VirusSlayer 1.0 VKill 1.0 Xeno 4.1.5 Utilities in Memory Since VirusZ only kills what it knows in memory, it's not necessary to add all the resident utilities like RAD:, VD0:, ZKick etc. If you ever have problems with these (it's not very likely that VirusZ thinks these might be viruses), let me know and I'll fix it. 4.2 Thankslist Special thanks for their VirusZ support must go to the following: Ralf Thanner for his virus collection, for testing and spreading VirusZ, for writing long letters, for the 680x0 VBR code and the CRC16 checksum routine, and for other useful suggestions. Nico François for coding the best library ever, ReqTools. Flake of T.S.B. for his new boot- and linkviruses. 4.3 Smileys (A short Introduction) NOTE: This chapter is only a joke and contains no necessary basics for the use of VirusZ. Switch to another channel if you don't like this kind of entertainment. And now for something completely different... It's... Smiley time! (I have to confess that I'm a Monty Python fan. I confess...) (Do you know the sketch with the inquisition and the soft cushion?) Everyone knows what a smiley is, but how to put one on the screen using ascii characters? Nothing more easy than that: You take a ':' and a '-' and finally a ')' and put it together. And what's the result? :-) Put your head on your shoulder (the left one) and there it is. This one smiles only for you. :-)) This one even laughs. :-))) That's the worst case. ;-) How about a blinking one? :-( Is he sad or angry? That's all Folks, wish you lots of successful anti-virus sessions with VirusZ, keep smiley'ing and have fun... Georg :-))