home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Atari Forever 4
/
Atari Forever 4.zip
/
Atari Forever 4.iso
/
PD_THEMA
/
ANTIVIR
/
HOSPITAL
/
HOSPITAL.DOC
< prev
next >
Wrap
Text File
|
1998-03-14
|
9KB
|
281 lines
06601020306800
1HOSPITALST Virus ProtectionHOSPITAL
219/5/89Page #19/5/89
F0000000
R [.....................................................................................]211
9[................................................]011
Ç
üHOSPITAL
9[....................................................]011
ÇAsuiteofviruspreventionanddetection
programsfortheAtariST
NeilForsyth
DepartmentofComputerScience
Heriot-WattUniversity
79Grassmarket
Edinburgh
neil@uk.ac.hw.cs
9[................................................]011
ëIntroduction
Ç
Thissuiteofprogramshasbeendevelopedtodetectand
preventthespreadofvirusesontheAtariSTcomputer.The
programsapplyprimarilytofloppydiskbootsectorviruses
butsomedohaveawiderapplication.
ëContents
Ç
Thecompletecontentsofthispackageisasfollows:-
HOSPITAL.DOC Documentationin1stWordformat
HOSPITAL.TXT SamebutinpureASCIIformat
STVIRUS.DOC Discussiononvirusesin1stWordformat
STVIRUS.TXT SamebutinpureASCIIformat
BOOTCMP.PRG Theprograms
DT.TTP
GOODBOOT.TOS
MEDICAL.TOS
RESET2.ACC
SKULL.PRG
VACCINE.PRG
VECHECK.PRG
WATCHER.PRG
ëCreatinga100%virusfreebootdisk
Ç
Beforeusingtheseprogramsyoumustensurethatyouhavea
safedisktobootfrominthefirstplace.Thefollowingsteps
willensurethatyouhaveaknown'clean'disk:
9[.............................................]011
Switchonyourcomputerwithnofloppydiskinany
diskdriveandwithyourharddriveswitchedoff.
Thiswilltakesometimetobootup(aboutaminute)
butitisworthitbecausewecanbesurethereisno
virusinthecomputer.
Next,insertablankfloppyinthefloppydiskand
formatitusingthenormaldesktopformatter.Iknow
thereareplentyofotherformattersavailable,my
ownincluded,butifsomeonehadmodifiedthemwe'd
bebacktosquareone.
9[................................................]011
ëRecommendedSetup
Ç
Aftercreatingyourknowncleandiskitisrecommendedthat
youplacetheprogramsinanAUTOfolderonthis'bootdisk'
♪①inthefollowingorderÉ⑧01,1⑧Ç:
VECHECK.PRG
SKULL.PRG
(otherthingslikeharddiskdrivers,GDOSetc)
VACCINE.PRG
WATCHER.PRG
BOOTCMP.PRG
andontherootofthedrivethefollowingfileswillbe
createdbytwooftheaboveprograms:
VECHECK.DAT
BOOTCMP.DAT
Youneednotusealltheprograms.Somemaynotsuityour
particularsetup.
Alwaysbootupyourmachinewiththisdisk,oronepreparedin
asimilarway,andalwayskeepitwriteprotectedifyou
can.Thiswillgiveyouthemaximumamountofprotection.
ëBOOTCMP.PRG
Ç
Thisprogramshouldberunfrombootup.
Thisprogramcomparesthefloppydiskbootsectorwithafile.
(BOOTCMP.DAT)
Whenfirstrunitwillinformyouthatitcouldnotfindthe
fileforcomparisonandwillaskyouifyouwouldliketomake
one.Sayyestothisandallowittosavetothedisk.
Ifthebootsectoriseverchangedthentheprogramwillstop
andtellyou.Itwillthenaskyouifyouwanttoupdatethe
comparisonfile.Beabsolutelysurethatthediskdoesnot
haveavirusbeforeyoudecidetoupdatethefile.
N001:002200750001
ÇTheordercanbechangedlaterwiththeutilityDT.TTP
E
ëDT.TTP
Ç
Thisisagenerallyusefuldisktoolbox.
Thefullinstructionsforitcanbeobtainedbydoubleclicking
onitandpressingreturn.
Thetwocommandsrelevanttothismanualare:-
Reversablychangetheexecutabilityofabootsector
-esha:
ChangetheorderofexecutionofAUTOfolderprograms
-asha:
ëGOODBOOT.TOS
ÇThisprogramallowsyoutocreatecustomexecutableboot
sectors.Whatthebootsectordoesisuptoyou.
Thefollowingoptionsareavailable:
9[............................................]011
°Changetomediumresolutiononcolourdisplays
°Changethecolourpalettetowhiteonblackuntil
thedesktopappears
°RunaprogramcalledCOMMAND.PRGinsteadofthe
desktop
°Printupamessageonscreen
9[................................................]011
Ifyouenableoneormoreoftheseoptionsonyourbootsector
thenifiteverceasestobehaveasitshouldthenyoucan
suspectfoulplayandexamineitforavirus.
Youcanalsosteriliseabootsector.Thiscleansoutthe
areasthatcanholdvirusesbutleavestheimportantpartsof
thesectoralone.Thiscanbeusedtokillanyvirusesyou
findorgetridofanycustombootsectors.Beverycareful
usingthisoptionbecausethecodecontentsofthebootsector
cannotberetrieved.IfyouareinanydoubtuseDT.TTPto
reversablychangethebootsectorsexecutabilityinstead.
Note:Ifyourharddriveisauto-bootingthenthefloppyboot
sectorwillnotbeexecutedafterasoftreset.
ë
MEDICAL.TOS
Ç
Thisisaprogramforthebulkcheckingofyourdisksfor
possibleinfection.Italsochecksthemachineforpossible
infection.
ë
ëRESET2.ACC
Ç
Thisdeskaccessoryallowsyoutoresetthecomputer.
Asoftresetisequivalenttopressingtheresetbuttonatthe
backandahardresetisequivalenttoswitchingthecomputer
offthenon(thereislessstressonthehardware).Some
virusescansurviveasoftresetsoifyouthinkyourcomputer
isinfecteddoahardreset.
IfyouhavetheTOS1.4ROMversioninyourcomputerthenyou
can,usually,resetthemachinebyholdingdownthefollowing
keycombinations:
Softreset:CONTROL-ALTERNATE-DELETE
Hardreset:CONTROL-ALTERNATE-RIGHTSHIFT-DELETE
ë
SKULL.PRG
Ç
Thisprogramshouldberunfrombootup.
Thisisaviruskiller.Ifyourmachineisinfectedthena
skullwillappearatthelefthandedgeofthescreenandthe
machinewillhangup.Youmustthenswitchthecomputeroff
andbootwithanuninfecteddisk.
ëVACCINE.PRG
Ç
Thisprogramshouldberunfrombootup.
Whenrun,thisprograminstallsitselfinthemachineand
attemptstopreventanyactivevirusfrominfectingadisk.It
alsochecksforviralcodeonincomingdisks.
Suspiciousbehaviourandsuspectdiskswillcausethescreen
topulsateforafewseconds.
ë
ëVECHECK.PRG
Ç
♪①ThisprogramshouldberunfrombootupÉ⑧01,2⑧Ç.
Thisprogramcomparesthevulnerableareasofmemorythat
virusesusuallychange,withafile(VECHECK.DAT)savedwhen
themachinewasinaknowncleanstate.
Whenfirstrunitwillinformyouthatitcouldnotfindthe
comparisonfileandwillaskyouifyouwishtomakeone.
Sayyestothisbutnotothe'Updatemask'prompt.
Notallofthememoryunderscrutinyconcernsdiskaccessor
virusesandsomelocationschangeconstantly.Forthisreason
thecomparisonfilecontainsamapoftheareastobechecked
aswellaswhatthoseareasofmemoryshouldcontain.
IfthecomparisongoeswellthenanOKmessagewillappearbut
ifnottheaddressesofthedifferenceswillbeprintedwith
theoptiontoupdatethefile.Besurethemachineisnot
infectedwithavirusbeforeyouallowtheprogramtoupdate
thefile.
RAMdisksandharddiskdriverprogramsusesimilartechniques
asvirusestoinstalltheirroutinesinthemachine.Ifyou
haveaharddiskdriveanditisnotauto-booting,thenmake
surethisprogramgetsrunbeforethedriverprogramis
installed.
ResetsurvivableRAMdiskswillprobablycausetheprogramto
finddifferencessincetheymakethesystembootupagain
oncetheyhaveinstalledthemselves.Don'tupdatethe
comparisonfileinthiscasebecausetherearereset
survivableviruses.Justknowwhattoexpectfromyoursystems
uniqueconfiguration.
Tounderstandwhatchangeswouldconstituteapossibleviral
threatIrecommendyoureadatechnicalbookabouttheST.
N002:003802060001
ÇFromtheGulamstartupfile'gulam.g'mightbegoodideatoo.
E
ëWATCHER.PRG
Ç
Thisprogramshouldberunfrombootup.
Whenrun,thisprograminstallsitselfinthemachineand
checksthatthebootsectorhasnotchangedduringthe
mostvulnerabletimes.
Ifthebootsectorischanged,probablybyavirus,thenthe
screenwillpulsateforafewsecondstowarnyouaboutit.
ëDisclaimer
Ç
Imakenowarrantywithrespecttotheseprograms,and
disclaimanyimplied/explicitsuggestionsofusefulnessfor
anypurpose.Usetheseprogramsonlyifyouarewillingto
assumeallrisks,anddamages,ifany,arisingasaresult,
evenifitiscausedbynegligenceorotherfault.