Short: Mem viruskiller for the new Packetviruses Author: gzenz@ernie.mi.uni-koeln.de (Gideon Zenz) Uploader: gzenz@ernie.mi.uni-koeln.de (Gideon Zenz) Type: util/virus -----BEGIN PGP SIGNED MESSAGE----- PURPOSE As probably some of you know, a crazy guy postet the source of a really dangerous stealth-virus (Beol3) to the usenet. I decided to debug this piece in order to protect myself from it, as the danger of clones with destructive routines seemed to be pretty high. When testing it, I had to make sure not to infect myself, and to clean the memory from the virus when I finished. So AntiBeol was born, in order to clean the memory from all viruses working like this one. I got in contact with Markus Schmall (Virus Workshop) so I could maybe help him a bit, and he encouraged me to improve AntiBeol, as other peoples might find such a tool handy. He sent me some more viri, so it`s now able to detect and clear the most important one. The difference to probably the most viruskillers is that this one doesn`t only notify you when it encounters a known virus, but also if it detects some abnormal changes, so it can (hopefully) detect new viri. All in all, it doesn`t replace a good background checker like VirusZ is, but it gives you additionally help on this comming-up packetviri. USAGE It`s pretty easy to use. Just put it somewhere in your User-Startup with a run, e.g.: Run <>NIL: C:AntiBeol You won`t notice anything on normal work, but if it detects something, a reqtools requester will pop up and inform you about it. The following viri are detected untill now: Beol 3, Beol 2, Beol 96, and SMEG. But you can get another ones, which are: Dospacket virus and Volumelauncher virus. NOTE: These ones mean that AntiBeol found a program that used some techniques NORMALY only viri (like the above mentioned) use. It DOESN`T need to be a virus, but it probably is. So IF you start a program you 100% KNOW about it`s virus-free (and it crashes), please mail me, and try using the NOSTRICT option. TECHNICAL This paragraph is for advanced users only, so don`t get mad because you don`t understand a word :) So how does this thingie work? Basically quite easy: Every five seconds, it checks some vectors of the system (pr_WaitPkt of all Volumes, Processes, and TC_LAUNCH of every task), as they`re used by the above mentioned viruses. If such a virus is detected, or some other program is found there (these vectors are normaly not used by any program I could find) they`ll get cleared, the suspicious piece of code get`s disabled and you`ll get notified. For the curious ones: AntiBeol also changes it`s name randomly every 5 seks, so don`t get a heart attack if you see a process like "CLI(15):r7a9wOeci". This will prevent the FindTask("SnoopDos")-trick. So what do these "future-viri" requesters mean? Dospacket means that someone hooked up in pr_WaitPkt, either in the Processes or in the Volumes, and Volumelauncher means someone hooked up in the TC_LAUNCH field of the Volumes` tasks. This will hopefully help you to debug. LAST WORDS I really do have to thank Markus Schmall for his help and providing of viri! Without him I wouldn`t even have thought about releasing this program! DISCLAIMER This software is subject to the "Standard Amiga FD-Software Copyright Note" It is Freeware as defined in paragraph 4a. For more information please read "AFD-COPYRIGHT" (Version 1 or higher). AUTHOR If you have some comments, please don`t hesitate to contactme! Gideon Zenz Giersbergstr. 41 53229 Bonn GERMANY EMail: gzenz@ernie.mi.uni-koeln.de -Gideon Zenz, 23-Sep-96 SECURITY If you want to be shure you have the original programs, check with "md5sum -c AntiBeol.readme". (md5sum is part of the PGP package), and of cause check the integrity of this readme with PGP! cfdcc7e7e813213b51d72fc4917efe76 *AntiBeol dfdf15f58f042ffa0f018ba8277124f7 AFD-COPYRIGHT - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAi3izr8AAAEEAMi+7o+iKDG26t8EuoX0NJ92iwhkviRC3GdJ1Uvef4+xJA3V ey20ZnzBg/OokPdo0a3VxhwyjD2auyFmp7DLupQTko7Wx2zLk19EzVBxI6NggUev ep+eaVvAi8V/YosYh0Xg4/dScOq391irO6k9+BPqkQPH+bRNCUBgnhXGkfElAAUR tClHaWRlb24gWmVueiA8Z3plbnpARXJuaWUuTUkuVW5pLUtvZWxuLkRFPokBFQMF EDH2trkAYAKC86RPCQEBgTUH/A8KTc/9NKi/mbzkPGUyywI3krp/HqGDAQVN89QF ynq5PtTSuKy5Q4DAmJwQ4gna9GJQytme1YbaXKjNNxMi2b33Rhd9aj5HKVHx6bRg uJ7LpgAotz6FuI6Ny76V1ccwQQnbxroy+EKOR2uOnOh/Gr4NbVz1QTVqksYyp/T5 rwI1esgJlTKxow6Y9BAutyC4M3n9Snc6sViGQwZsH9Xxts9c9meI7LRjleWjSFcl 7LuZVyf6LFFuzo9jQQTt+Ak69wCeN4Qq5oTzLJQa9KzgQaxj70oP9LyTPBkdYPWH a+JYPCxgyBojY8igq7PmSRiMnJKhWkQx+uRQbnpuDHPgvgSJAJUDBRAx0dc3QGCe FcaR8SUBAciDA/4qaRFv5KZGlIbAeGphlR33+aBjMZDf1MlC1QcIk2yPY9tTMIis z06IckZw7Oq+RVBmJOvOZtJJJuVCuufyHKSg3+HRj6YE4lQ7/ojCU7yPcrdfny4o LKEpehRB/F89Mzan7cjyLI9qH07I2wq7a9wCwP4BDpa0lxMAQd9Uk+UN6rQpR2lk ZW9uIFplbnogPGd6ZW56QEVybmllLk1JLlVuaS1Lb2Vsbi5ERT6JARUDBRAx9ra5 AGACgvOkTwkBAYE1B/wPCk3P/TSov5m85DxlMssCN5K6fx6hgwEFTfPUBcp6uT7U 0risuUOAwJicEOIJ2vRiUMrZntWG2lyozTcTItm990YXfWo+RylR8em0YLiey6YA KLc+hbiOjcu+ldXHMEEJ28a6MvhCjkdrjpzofxq+DW1c9UE1apLGMqf0+a8CNXrI CZUysaMOmPQQLrcguDN5/Up3OrFYhkMGbB/V8bbPXPZniOy0Y5Xlo0hXJey7mVcn +ixRbs6PY0EE7fgJOvcAnjeEKuaE8yyUGvSs4EGsY+9KD/S8kzwZHWD1h2viWDws YMgaI2PIoKuz5kkYjJySoVpEMfrkUG56bgxz4L4EiQCVAwUQMdHXN0BgnhXGkfEl AQHIgwP+KmkRb+SmRpSGwHhqYZUd9/mgYzGQ39TJQtUHCJNsj2PbUzCIrM9OiHJG cOzqvkVQZiTrzmbSSSblQrrn8hykoN/h0Y+mBOJUO/6IwlO8j3K3X58uKCyhKXoU QfxfPTM2p+3I8iyPah9OyNsKu2vcAsD+AQ6WtJcTAEHfVJPlDeq0KEdpZGVvbiBa ZW56IDxNYXJ2aW5AQmlnQmVuLmRzc2Quc3ViLm9yZz6JAJUDBRAwoAVgQGCeFcaR 8SUBAd82BACk9NcwWKnRyDaChZELL/S/oR5XIMKcWIe7RYqTuB4eQfPZLV6yIXzs p51w0+ZaGfvlmSddoYXNaRf9CfF2Hk+TcDJN3MNRGe7VYE3aWcuG5duYIrTyPesG 28urStmDYvwO+l/+uNNIHzpRd/jsyBH5ajDm+W3C8vU0QjUYAJgGmbQmR2lkZW9u IFplbnogPE1hcnZpbkBCSUdCRU4ud3diLnN1Yi5kZT6JAJUCBRAu6fGfKzgl0jY0 OvkBAWw1BACOOk5H5ytBljxFe+JYa4norzTpuH2YIg5heZ+ZomWLZoQjaqlsto34 rf3i6wrRzKeV4ZUUKQ58Br4nc9BMg49JMH7ynaZwA3Ym5lZHzl5QTokrJFT3oPxz foI2ArHK16UO4PgkDADqAb8KKqIQKvn2CdpobCuSkvqH6IwFBxhvDLQyTk9URTog TWFydmluQEJJR0JFTi53d2Iuc3ViLmRlIG5vdCB2YWxpZCBhbnkgbW9yZSG0FUdp ZGVvbiBaZW56IDI6MjQ0MC85OQ== =f1SE - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQCVAwUBMkicn0BgnhXGkfElAQHFagP6Agrh1oG1KIF55NNWE663yeJiV1yYV7wc 7/AZrX3Cspm9qLENH6Q8TDVgodq8Jc/H6CcUSQLPKpsPoO/weljjqc5JJQ9kJxYu iNq3BXRFEz0FuzRTZ2wZbYUvrPMgElEeh5bfIPqYUd7eDEhMzDqzb5cBfYOHFGVA 0VcOsl8Vais= =8HOh -----END PGP SIGNATURE----- ============================= Archive contents ============================= Original Packed Ratio Date Time Name -------- ------- ----- --------- -------- ------------- 7266 2858 60.6% 08-Jul-95 12:00:00 AFD-COPYRIGHT 1176 959 18.4% 24-Sep-96 20:42:26 AntiBeol 7038 4170 40.7% 24-Sep-96 20:45:52 AntiBeol.readme -------- ------- ----- --------- -------- 15480 7987 48.4% 03-Oct-96 08:49:38 3 files