Resident 2/Resident - Issue 2 (19xx)(Angelica - SHI).adf/Data/074

Text File | 1993-04-02 | 13KB | 375 lines

¶3SOFTWARE PROBLEMS
¶2-----------------
¶1It is well recognised that a number of
virus  killer programs can set vectors
, or they can be residual, (that is to
say,  the  program  survives  a  "warm
reset"  Ctrl-A(miga)-A(miga)),in  your
RAM.   One example is the virus killer
program  "System  Z".  A little number
of utility programs , demos and intros
and  so  on can give the same problems
and   ought  therefore  be  completely
avoided.    The   problem  with  these
programs  is  that  they can trick the
virus killer into believing that there
is  a  new  virus  in the machine.  In
individual cases, I have experienced a
virus  killer mistakenly taking a disk
as being infected by a virus (with the
name  of  the virus), despite the fact
that  it  was  an innocent bootloader,
which  was  in  the  boot.   This  can
happen sometimes, and can be explained
by  the  fact  that the virus killer's
recognition code is on rather few bits
for every individual virus.  This code
can   then,  in  a  few  situations  ,
coincide  with  an  innocent  program.
Disk  failure can also cause suspicion
as to whether the diskette is infected
with  a  virus  .  One common fault is
that  you  get  the  message:   "Error
validating   disk",   "Please   insert
volume Lazarus", or a read/write error
message.    These  messages  are  disk
failure   not  viruses,  but  in  many
caseses you will get these disk errors
,  after your disks have been infected
by  a virus.  Another irritating thing
is  that  certain disks can ask you to
remove  the write protect in a systems
message  during  the startup-sequence.
One  must  be particularly alert here.
Normally  the reason is that a type of
virus  can  be  in the memory which is
programmed  to  lure  you into a trap,
but  it  can  in  some cases be pretty
harmless.   If  you have the slightest
doubt,   you   should  try  to  infect
another  disk, to ascertain whether it
really was a virus.



¶3VIRUS PROBLEMS IN GENERAL
¶2-------------------------
¶1The   simplest  virus  types  are  the
bootblock  viruses,  because  they are
easy  to  remove  by  overwriting them
with  "install".  Individual disks use
a  special "loader system" and will be
destroyed if they are overwritten.  It
is  very  likely  that  the  disk  was
already   destroyed   when  the  virus
infected it, so that you will never be
able   to  destroy  a  disk  which  is
infected  beforehand.   On  the  other
hand    one    must   advise   against
indiscriminate  use  of  "Install"  on
unknown  bootblocks,  one  can  easily
destroy  a  disk;  if  in  any  doubt,
always  copy  the  disk first.  If you
have  kickstart  1.3 in your Amiga you
can find the disks infected with virus
starting  up  with a guru or like, and
the card crashing not long afterwards.
This   can  be  because  the  disk  is
infected  with  a virus which can only
work on Kickstart 1.2.  In such a case
a lot of diskettes can be saved, which
you  would  otherwise have hought were
faulty,  by  "Install"ing them.  There
is  a  special  type  of "virus" named
"Bombs"  which is characterised by the
fact  that  they  cannot  infect other
media  such as diskettes, harddisks or
the  like.   They  can  cause  serious
damage   by   acting   as  destructive
programmes  which,  for  example,  can
re-format  a  whole  harddisk.   These
viruses  ("hacks")  can  appear in the
boot  (like normal bootviruses), or as
an individual file (like a normal file
virus)  together  with a link, that is
to say, a file which has hooked itself
to  another  programme  (ie.   the two
files'  size  in  bytes has increased,
which   we   know  from  regular  link
viruses).   If  you  have  got  a  new
unknown  type of one of these viruses,
which  your virus killer doesn't know,
it  is  impossible for even the newest
and  best  virus killers to find them.
The  best  virus  killers  today  have
analysis  functions, which check up on
all  "occupied"  vectors and check the
Amiga's  memory for residual programs,
which  can  survive  a  "warm  reset".
This  doesn't  much  help  against the
bomb * viruses mentioned above, so the
only  way  you  can prevent them is if
your  virus  killer  knows  the  type.
There  is  therefore  good  ground for
being watchful, especially if you have
a  harddisk.  One of the newest bomb *
viruses  "Challenger  Bomb"  is  to be
found  at  FRED FISH 622, be careful *
please, but it is relative harmless

¶3ABOUT CLOCK VIRUS
¶2-----------------
¶1Rumours of the clock virus has several
times  caused  even  experienced Amiga
users  to  tremble  with  fear.   Just
think,  if  a virus got into the clock
in  our  Amigas,  and  could just hide
there,        undiscovered,        for
months..dreadful!   No,  you  can  all
relax.   It's  only  a  rumour, it's a
physical impossibility, there are only
few  bytes  free  in  the  clock,  but
definitely  not  enough  for  even the
minutest  program.   On  the contrary,
the  rumours  about  various  types of
viruses making your clock run amok are
true.    I  have  heard  from  several
sources  that there are supposed to be
two  types  of virus or "hacks"(?), in
Germany  and the USA at least.  One of
them is supposed to make the clock run
backwards, the other makes it go 10 to
20  times faster.  I'm very interested
in  these  viruses  and  of course, in
other  NEW  viruses,  and to say thank
you  for one, I will send you a disk I
make   which   is   called   "The  New
Superkillers",  where  the  newest and
best  Public  Domain virus killers can
be  found , together with an amount of
valuable   documentation   from  virus
killer  programmers  which I cooperate
on.   We  can  only  make  good  virus
killers, if we get help from you!


¶3ABOUT FILE VIRUSES
¶2------------------
¶1I   have  been  contacted  by  several
people  who  have had various problems
in  removing  the  link and file virus
from  both diskettes and harddisks.  A
recurrent   problem  is  probably  the
"BGS-9"   file   virus,  which  causes
several  problems, maybe because it is
not  one  of  the  most  difficult  to
remove,  but more likely because it is
one   of   the   most  widespread.   A
contributory  cause  to  the  stubborn
problems with the BGS-9 virus is cause
by bad coding of the virus killers KDV
III  and  VirusX.  These virus killers
don't look for the viruses themselves,
but  for  an  empty  file  in the Devs
Directory.   To put things a little in
place,  I  will  go  through  how  one
removes these and similar viruses:

  ¶31¶2. Look     in    the    disk's
     startup-sequence  and find the
     name of the first command, note
     the name down on a piece of paper.

  ¶32¶2. Look for this name in C/Dir...if
     the BGS-9 virus has taken over
     this name (BGS-9 on 2608 Bytes)
     the file will have been deleted.

  ¶33¶1. Go into Devs and find the
     nameless file, give it the name
     from point one, and move it back
     to its original position in the
     C Directory.

¶2NB.  Please attention always to remove
the  emty  file  in the devs directory
otherwise  VirusX and KDVIII will give
a  requester  saying:   "infected by a
virus  like BGS-9, but not the viruses
itself".



¶3ABOUT THE SADDAM FILE VIRUS
¶2---------------------------
¶1The   Saddam   Hussein   is  the  most
spreaden  viruses  today, and is named
in  *  more than 70 % of the feed-back
rapports  from  all  over  the  world:
E.g.   6  *  well-known BBS hard disks
have  been  corrupted in the "States"!
*

Please  be  very  careful , if you are
working  with the new "Saddam Hussein"
file/link  virus .  Note that there is
a boot virus with the same name, don't
be confused.

Here  you  have  some facts about this
virus:

¶31¶2.   The  virus  is  a  "multi-headed"
file- and link virus.  Always infected
in  L/Dir,if  there is not an L/Dir on
the disk,it will make one by itself.

¶32¶1.   The  Saddam  file  virus  part is
always  to  find in L/disk-validator ,
with  the  same file length (1848) and
of    course....the    same   name   a
diabolical thing oh...boy..!

¶33¶2.   The  Saddam  link virus part is a
VERY   ,  VERY......   easy  spreading
virus,  it  will  link  to all files ,
e.g.   to  all  executed  , written or
copied  files , but it does not change
the  file length,it only writes "IRAK"
in  the  start  of  the files.  Please
remark, that all theses infected files
will  cause  Read /Write" errors!  The
original  "Saddam"  infects hard disks
too.   I have several reliable reports
from  Australia (1), and USA (5), (the
last  five  reports  from USA were all
concerning  BBS  damages,  where  more
than 500 program files were damaged.

¶34¶1.   It  is  impossible  to delete the
virus  or the link infected files with
a  file  editor  like "Diskmaster", or
from CLI.

¶35¶2.  Attention the Saddam Hussein don't
infects  ANY  disk,  IF copyed from an
other  disk, and IF your disk is error
free!

¶1Please   note,   that   BootX  is  the
ULTIMATE   "Saddam"   killer   ,   but
ONLY......    use   "Check  files"  to
FIND.......the   "Saddam"  virus,  you
must then use the * "Repair disk" menu
to   salv  the  Irak  infected  files.
BootX  will  find the * "Saddam" virus
and  make  it  passive  and repair the
infected  files very * near 100 %, but
can't  remove  the  virus  itself, you
have  to  re-install  *  the  original
Disk-vaildator.

If  you  have  virus infected disks, I
recommmend  to try to use several dif-
*  ferent  killers,  in some cases the
killer  may just break-down by meeting
* the virus, if you try to repair your
disks,  or  don't find the virus you *
have  got.  A good advise:  ALWAYS use
a backup of your disk, when you have *
to  repair  your  virus  problems, and
especially...with  the  "Saddam" virus
or * other link or file viruses!

Many people have contacted me saying ,
that they have found a "SPECIAL" virus
an "Australian Parasite" virus , which
cannot  be  killed  with  VirusX 4.01,
(the   LAST   official  release...)  I
understand  this  problem  quite well,
because by a stroke of luck VirusX, is
accidental  able  to  find the "Saddam
Hussein"  Disk-validator  virus .  The
problem  here  is, that the Australian
Parasite  virus,  is  a virus you will
find  in the boot block, and the nasty
"Saddam"  virus  is to be found in the
L/Dir.

After  repair,  always.......   use  a
program   like  Quarterback  Tools  to
check  the  disk  to  see  if the disk
structure is all right.

¶3HARDDISK AND VIRUS
¶2------------------
¶1Many  harddisk  owners  know that they
should  be  particularly  careful with
all "non-boot viruses" and don't think
twice  about boot viruses.  Watch out!
A  lot  of  boot  viruses can also get
into   a  autoboot  harddisk.   PLEASE
ATENTION,......that   a   boot   virus
infection  on  your harddisdisk is the
MOST  SERIOUS  thing,  that can happen
your harddisk!  I know, unfortunately,
several  experienced Amiga owners, who
have   spent   weeks  to  bring  their
infected  harddisks back to life.  The
boot  virus write itselves onto sector
0 and 1 of cylinder 0 on your autoboot
harddisk,  and  you  will get a system
message  which  says:  "Not a Dos disk
in  unit  0".   If  the  accident  has
happened,  try to revive your harddisk
by    starting    up   your   harddisk
installations  disk,  then format your
cylinder  0,  and  prep  your harddisk
again.

If it is a file virus which has jammed
your  harddisk , remember that most of
these  are in the first command in the
startup-sequence  ,  note  the name in
the  startup-sequence, delete the file
which  has that name in your C/Dir and
reestablish  the  original  c  command
from  ,  for  example,  your workbench
disk.

Xeno  virus, and similar link viruses,
can create other problems because they
can   attack  several  of  the  files.
Because  these  files still have their
original names, it can be hard to find
them,  if  you  don't  have  the exact
viruskiller which knows this virus.  A
piece  of  good  advice  here - make a
list  of  the  harddisk  and  note the
date,  look  for  the most recent, and
delete all these files.

Remember to regularly take a backup of
both  your  hard  disk  and your disks
which   have   important   data;   but
remember  also  if you do it too often
you  can  risk  also  getting virus on
your backup.

Remember  Murphy's law:  "If something
can go wrong, it will go wrong".


¶3VISION FOR THE FUTURE
¶2---------------------
¶1I  think  the  only  way to stop virus
spreading is to catch the man, who had
made  the  virus and tell others about
the   consequences.   Many  young  one
think,   that  virus  making  is  like
making  graffiti or like.  The fact is
that  the  laws  punish  VERY HARD for
data  terrorism,  in  Denmark  up to 4
years  jail,  and  e.g.  in Gemany you
can get up to 6 years jail.