** Virus Checker ** Please send me any more viruses so I can update this ** John Veldthuis ** 21 Ngatai Street ** Manaia, Taranaki ** New Zealand ** To use place in your startup-sequence the following ** Virus_Checker ** this will run virus_checker ** upon running Virus_Checker will first check your memory for viruses ** and tell you if any where detected. They will either be removed or ** disabled. Next all disks in the drives will be checked. Any disk put ** into any drive (df0: to df3:) will be checked. The rest is easy ** Placed in the Public domain libraries to help all get rid of Viruses ** ** V1.0 was an arp.library version ** V1.1 was an port to the normal libraries ** V1.2 had the ByteBandit virus dectection added into it ** V1.3 had detection of the 3 Viruses in memory and removal of them ** V1.4 added code to detect + remove the Byte Warrior Virus from memory ** and disk ** V1.41 found a slight bug when using DSM to disassemble this ** the program was testing low memory instead of a value when ** checking for the Revenge Virus ** V1.42 changed code to be assembled by the CAPE 68K assembler ** which is much faster than A68k or Assem. Now also uses base register ** addressing mode for data access ** V1.43 changed code to cut down executable code ** V2.0 added Pentagon, System Z, North Star, Obelisk and the ** new IRQ virus which lives in files and not in the Boot Block ** V2.1 corrected a few little bugs in program ** V3.0 Did a listing of Source code and found many bugs ** Did a major rewrite to clean it up and saved about 400 bytes ** V3.0 now checks for the viruses listed ** SCA, AEK, Byte Bandit, Byte Warrior, Revenge, Pentagon Circle ** System Z, North Star, Obelisk, CrackRight and the latest IBM ** type virus the IRQ virus. ** V3.01 got a new virus. Lamer Exterminator. added code to get rid of it ** V3.02 got a second Version of the LAmer Exterminator vius ** V3.03 After many requests decided to add checking of BootGirl ** BootBlocks which where being registered as Non-Standard. It now ** Just Ignores BootGirl BootBlocks ** V4.00 Updated to make better use of the Stack. Now store all variables ** on the stack for a saving of 124 bytes in the Executable ** V4.10 TimeBomb virus added to code ** V4.20 Altered startup code to start a seperate process to avoid doing ** a RunBack -2 Virus_checker ** V4.22 Added Gadaffi virus to checker ** V4.23 Found a potentially Fatal Error in Code When accessing Unit ** Byte off the Stack. ** V4.24 Added Graffiti, Ultra Fox, and Phantasmumble Viruses ** Don't actually have these last 3 viruses so Anyone please send them ** To me if you find them. Still looking for the IRQ Virus as well ** V4.25 Added TTV1 virus to code ** V4.26 Changed Error Checking on TTV1 virus abit ** V4.27 Got the War Hawks virus and added it. Also added V3 of Lamer ** exterminator virus. Changed checking for TTV1 virus. Now checks ** when disk is inserted into drive ** V4.28 Found I was losing the memory that was used by the program when ** it exited. This was caused by me not UnLoading the Segment used for ** The program. Fixed ** V4.29 Found program got into a continuous loop when there where no ** RomTags present in the system. Fixed ** Also cut code size down abit more by combining a few checks ** V4.30 Put furthur checking in for the TTV1 virus as sometimes the ** checker would not find the file on the disk depending on which ** directory it was in. Put VKill virus checking in ** Also Ultra Fox and PVLProtector virus checking in ** V4.40 Put in DosSpeed virus and an Unknown virus. It does not have ** any names at all ************************************************************************ * * Viruses Dealt With: * ------------------- * * SCA - The SCA is the simplest virus to deal with, * as it's not actually DOING anything except * hiding in memory, until you reboot. * We just look at CoolCapture and fix it to get * it out of RAM. * * AEK - This is a clone of the SCA virus and we get * rid of it in the same manner * * LSD - Another SCA clone and uses the same code * * Byte Bandit - The Byte Bandit virus takes the DoIO() vector * and redirects it through itself. Thus, any * attempt to read or write the boot block (ie, * AmigaDOS trying to figure out what kind of * disk it is) results in the BB writing itself * onto that disk. We couldn't just rewrite * the boot block, we have to get him out of RAM * first. This virus also has an interrupt that * crashes the machine every 5 minutes or so * after it's infected a few of your disks. Ow. * It stays in memory not via the Capture * vectors, but by a Resident module. * When machine looks crashed press these keys at * the same time from left to right * LAlt,LAmiga,Space,RAmiga,RAlt * This will restore things for another 5 minutes * * Revenge - Basically, a Byte Bandit clone except it will * bring up an obscene pointer a few minutes * after you reboot. We treat it much like the * byte bandit. * * Byte Warrior - Jumps right into 1.2 Kickstart. Won't work * under 1.3. Hangs around via Resident struct, * doesn't do any damage. * * North Star/ * StarFire - Like SCA, hangs around via CoolCapture, * killing CoolCapture kills the North Star. * * Obelisk Softworks Crew * - Hangs around via CoolCapture, also * watches reads of DoIO() (but doesn't * infect EVERY disk - onlyt ones you boot * off of) * * IRQ - This is the FIRST Non-Bootblock Virus. * It copies itself from place to place via the * first executable program found in your * startup-sequence. It SetFunction's * OldOpenLibrary(), has a KickTagPtr, * and lives in the first hunk of an * infected program. * * Pentagon Circle * - This one looks at the DoIO vector, and has * a CoolCapture vector. It will write itself * over any virus inserted, but not onto * anything else. (Neat idea!). No danger, * easy to eliminate. Holding left button * while booting with this one shows different * screen colour, but doesn't get rid of it. * * HCS Virus - Hooks into the System Z protector * - This is another 'virus protector' that * can write itself to disks. Anything that * spreads itself, under any name, is a * virus. Doesn't do anything except during * a reboot, then examines disks and writes * over viruses. * * CrackRight - This virus is another nasty which looks at * the DoIO routine for the reading of any * bootblocks. If it finds one it will rewrite * a copy of its code to it if it can. This one * also patches into the Vertical Blank interupt * and seems to format you disk after a certain * number of interupts (can't be sure though) * The nasty bit is it also creates a task * called clipboard.device which spends all its * life copying itself through memory * fragmenting the memory into small blocks. * Calls ROM CODE direct so wont work under V1.3 * We restore the DoIO routine, the Vert Blank * interupt and RemTask the clipboard.device * * LAMER Exterminator * - This virus was sent to me by Andrew Mercer * of the Palmerston North group. His letter * said that He noticed strange things on his * disks. On disassembling the virus I found * that most of it was encrypted and the data * was encrypted randomly using the beam position * of the screen. Thus it appears different each * time. It patches the trackdisk.device to look * at reads and writes, It patches the Sumkick * vector in exec in case someone tires to get * rid of it. When it detects a read or a write * it will randomly select a sector on the disk * and will check if it is a data block. If it is * it will write LAMER! all over the sector and * rewrite it. * Some say this Virus will write to write * protected disks. I have not had this happen * to me and I can see no special code in the * disassembly to accomplise this feat. * * TimeBomb Virus - This is a strange Virus. It does not insert itself * into any vectors. However it will copy itself back * to the disk it came from. When the count gets to 2 * it will wipe out the Root Directory of the boot * disk and display an alert. If the count is over 2 * it will just display and alert * * GADAFFI Virus - Inserts itself into the CoolCapture vector, Uses * a RomTag structure and patches the DoIO vector * Jumps directly into the Kickstart so will only * work under V1.2 Kickstart. After 13 copies it will * Step the Heads of drives 0 and 1 in and out. * We simply clear all vectors and Use the old V1.2 * DoIO code entry point * * TTV1 Virus - This is similar to the IRQ virus in that it does * it does not live in the Boot Block * It operates differently. * Inserts itself into the RomTag pointer. It then * loads the program it replaced and executes it * On Reboot the RomTag is called. It patches the * Intuition OpenWindow call to call its code. * It then returns. Once AmigaDos opens up the CLI * window the virus code gets run. This gets the * startup-sequence file and gets the first command * that is run. It then checks if it is already here. * No, then it moves this program from it's directory * into the devs: directory and renames it a strange * name. It then copies itself to replace the command * it just moved. A give away is the file size. The * Virus size is 2608 bytes and there will be a file * with what looks like spaces for its name in the * devs: directory. * To get rid of we copy the file in devs: back * to the c: directory and rename it. * Then delete the file in the devs: directory * In memory all we do is change the RT_INIT code * which is run on reboot to do an immediate RTS. * Then memory for the program is still used but the * Virus is disabled * It will display a screen of its own which says * A Computer Virus is a disease * Terrorism is a Transgression * Software Priacy is a crime * This is the Cure * BS9 plus some other junk * * War Hawks - This Virus installs itself into the CoolCapture * Vector. It copies itself to the disk when the * computer is warm booted. After every four copies * it displays a message. * To get rid of it we simply clear the CoolCapture * vector * * VKill Virus - This is another virus in the disguise of a Virus * protector. When booted it copies itself to the * stack area that is not used. It then patches the * CoolCapture vector to survive a reboot. It patches * the PutMsg vector of ExecBase to watch for * BootBlock reads and writes. When it finds one it * checks it and tells you if a virus is present. * If you want to get rid of it it will copy itself * to the disk. To remove it we Clear the CoolCapture * Vector and SetFunction the PutMsg vector back. * * Ultra Fox - This one lives in the CoolCapture vector. When * you reboot it will change the DoIO vector and * wait for a BootBlock read. When it finds one and * the disk is not already infected it will write * itself to the bootblock. After every 16 copies it * will put a custom copper list which displays * greetings. * PVLProtector - * This one is another bootblock protector. when it * it finds a virus it will write itself to the * disk instead of a proper bootblock. All we do * is set the RomTag to do a RTS and thats it * * DosSpeed - This is another file virus. It is supposed to speed * up disk operations by 800%. This was found on a * BBS and when run patches itself into several places * It will read the s:startup-sequence file on reboot * and will edit it so that it runs itself as the * program. It sticks out because the first line in * the startup-sequence will be blank. When the * Checker finds it look in the Root directory and * you will find what looks like a blank filename. * To get rid of it off the disk enter the CLI and * type delete ????? Make sure that you do not have * any 5 character filenames as this will get rid of * those as well. If you have a directory utility use * that and delete the file with that. * * UnKnown - This is a virus that has no names anywhere and * will only work under V1.2 Kickstart. * Very easy to get rid of.