home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
FishMarket 1.0
/
FishMarket v1.0.iso
/
fishies
/
201-225
/
disk_211
/
viruscontrol
/
readme
< prev
next >
Wrap
Text File
|
1992-05-06
|
13KB
|
288 lines
VIRUS-CONTROL V1.3 - a powerful ANTI-VIRUS-program !!
-----------------------------------------------------
Herewith I declare VIRUS-CONTROL V1.3 as PUBLIC-DOMAIN !!
---------------------------------------------------------
Hallo Amiga-friends,
First of all, sorry for my poor school-English (I'm a German).
There are a lot of Anti-Virus-Programs. But none of these programs
could satisfy me. Therefore I programed my own Anti-Virus-Program,
very compact, very easy to use, but lots of useful functions.
Now the operating instructions for VIRUS-CONTROL V1.3
- runs on any Amiga
- 100 % assembler
- survives reset
- dangerless Boot from Virus-Disks because of Boot-Simulation
- you can switch off FastRam during reset
- Disks are checked during insertion
- Protection from Link-Viruses by File-Protection-mark
- show Bootblock on screen
- save Bootblock to a file
- overwrite Bootblock with a file
- write Original-Commodore-Bootblock,
- write NoFastMemory-Bootblock
- Inactivate(NoBoot) and reactivate(Boot) of (Virus)disks
- an extra task checks system-vectors every second
- kill system-virus by system-vectors-restoration
- you can change write-access to bootblock to harmless read-access
- a suspected Bootblock can be catalogued as dangerless
- a suspected Bootblock can be catalogued with a name
- the access to files can be controlled by an requester
- you can start VIRUS-CONTROL with additional characters
-f do not search S:NoWarning, S:VirusName
-c no green color-signal during disk-insertion
-t do not check already inserted disks
-o control File-access
I have added the well documentated source-code.
VIRUS-CONTROL is carefully thought out and compactly programmed.
Nevertheless there is a filelength of nearly 13 KB.
In spite of economical Intuition-programming, there are needed
5 KB only for the Intuition-structures.
You can start VIRUS-CONTROL in CLI or in startup-sequence with
or without 'run'.
If you try to start VIRUS-CONTROL, DOIO- and COOL-Vector are
checked. If these vectors are changed, you are told, that
your Amiga seems to be infected, and best you switch off your
Amiga. Then switch on your Amiga again and start VIRUS-CONTROL
early. Now no more virus can infect your Amiga in an unrecognized
manner.
If VIRUS-CONTROL is installed already, you are told about this.
If VIRUS-CONTROL finds a changed KICK-vector or a changed BeginIO-
vector, there will be an information only, because also serious
programs change these vectors (FACC changes Begin-IO, RAD: changes
KICK-vectors).
The reset-routine jumps to VIRUS-CONTROL by the COOL-vector.
VIRUS-CONTROL now checks, if left mouse-button is pressed.
In this case VIRUS-CONTROL will be removed. Otherwise a green
color-signal indicates, that further VIRUS-CONTROL is controlling
the system.
Now DOIO-vector is set to VIRUS-CONTROL. From now on each DOIO
is checked if it is a DOIO to disk track 0.
The following boot-routine, the insertion of a disk or 'loadwb'
does a DOIO to disk track 0. If you start VIRUS-CONTROL without
-t, there also is a DOIO to disk track 0.
Your Amiga only boots from disk, if it is a DOS-disk and if the
bootblock-checksum is correct.
If this is fulfilled, the disk-bootcode is checked. If the bootcode
differs from Standard-bootcode, this bootcode could be a bootblock-
virus. But also it could be a harmless Intro or autoboot-game.
Such a disk is considered as a 'suspected disk', because it could
be a Bootblock-Virus-disk.
If your Amiga wants to boot from disk, VIRUS-CONTROL checks if the
inserted disk is a 'suspected disk'.
In this case there will be a requester, which offers a dangerless
Boot-simulation or the real disk-boot-routine. If you select the
real disk-boot-routine, there will be another requester, which
will inform you about the danger of activating a bootblock-Virus
by the real disk-boot-routine.
You are working with your Amiga. If you now insert a 'suspected
disk', a powerful Warn-Window will appear.
If you press right ALT-key and insert a 'suspected disk',
VIRUS-CONTROL will not check the disk. No Warn-Window will appear.
If you press left ALT-key, there always will be a Warn-Winow, also
if the inserted disk is 'not suspected'. In this way you can work
on 'not suspected' disks too.
If there is not enough memory to open the Warn-Window, a black
color-signal will indicate the 'suspected disk'.
The Warn-Window offers a lot of useful and powerful possibilities.
Clicking CLOSE-Gadget concludes working on disk.
Now you are allowed to remove disk.
Clicking 'FINISH VIRUSCONTROL' removes VIRUS-CONTROL.
Clicking 'KILL SYSTEM-VIRUS' restores system-vectors.
Clicking 'BOOTBLOCK -> SCREEN' shows the total bootblock
(1024 Bytes) as an ASCII-Dump.
Clicking 'BOOTBLOCK -> FILE' writes the total Bootblock
(1024 Bytes) to a file, which name is entered in the
string-gadget at the bootom of the window.
Clicking 'FILE -> BOOTBLOCK' writes the file, which name
is entered in the string-gadget, to the bootblock.
In this way you can easily save the bootblock of an important
disk to a file and if necessary you can restore this bootblock.
Clicking 'STANDARD-BOOTBLOCK' writes the Original-Amiga-Bootblock
to disk (like 'install')
Clicking 'NOFASTMEM-BOOTBLOCK' writes a bootblock-routine to disk,
which switches off FastMem already at the beginning of boot.
The NoFastMem-Routine is indicated by a blue color-signal.
If you press left mouse-button during reset, NoFastMem-Routine
will not be executed.
Clicking 'f.CHECKSUM -> NOBOOT' writes a false Bootblock-Checksum
to disk. Now this disk is no more a boot-disk. An eventual
bootblock-virus cannot be activated any more.
Clicking 'r.CHECKSUM -> Boot' writes a correct Bootblock-Checksum.
Now this disk is a boot-disk. A bootblock-virus can be activated.
r/f.CHECKSUM only changes the BootBlock-Checksum.
The contents of the bootblock is not changed.
Clicking 'IN S:NOWARNING-FILE' saves the 'suspected bootblock'
to the file S:NoWarning. If S:NoWarning exists, the bootblock
is appended to S:NoWarning, otherwise first S:NoWarning is
created. If the bootblock already exists in S:NOWARNING,
there will be a requester, which offers to remove the bootblock
from S:NOWARNUNG.
If you now insert a disk with a bootblock saved in S:NoWarning,
there will only be a red color-signal instead of the Warn-Window.
This is useful for harmless No-Standard-Bootblock-disks, like
some Boot-Intros or auto-boot-games.
Clicking 'IN S:VIRUSNAME-FILE' saves the 'suspected bootblock'
to the file S:VirusName. Besides a name for the bootblock is
saved. This name is entered in the string-gadget. If S:VirusName
exists, the bootblock+name is appended to S:VirusName, otherwise
first S:VirusName is created. If the bootblock already exists
in S:VirusName, there will be a requester, which offers to remove
the bootblock+name or to rename the bootblock.
If you now insert a disk with a bootblock saved in S:VirusName,
the bootblock-name will be printed into the appearing Warn-Window.
Often a bootblock-virus has an infection-counter. Therefore
1 Longword-difference is tolerated. This is printed too.
In this way you can acquaint VIRUS-CONTROL with any bootblock.
Therefore VIRUS-CONTROL cannot become out of date!
If you insert a 'suspected disk', first S:NoWarning is searched,
then S:VirusName. If you insert a disk, pressing left-ALT-key,
only S:VirusName is searched, since there always shall be a
Warn-Window.
If you start VIRUS-CONTROL with -f, S:NoWarning, S:VirusName are
not searched.
All critical functions like write to Bootblock or finish VIRUS-
CONTROL are protected by additional requesters.
Furthermore there is an requester for write-protected disks.
Also an OpenFile-Error is indicated by a requester.
You can simultaneously use df0: - df3:. Therefore all Warn-Windows
and requesters are marked.
If you insert a disk, a green color-signal indicates the correct
working of VIRUS-CONTROL. This signal can be switched off by
starting VIRUS-CONTROL with -c.
If you start VIRUS-CONTROL, all inserted disks are checked.
This checking is not done, if you add -t.
If you start VIRUS-CONTROL with -o, the OpenFile-vector will be
set to VIRUS-CONTROL. Now if there is a file-access, you will be
asked by a requester, to allow this access.
This file-access-control is very useful to recognize LINK-VIRUSES.
Link-Viruses do not spread by Bootblock, but they link themselves
to existing files. They lengthen the files and are activated, if
the file is executed. If now a Link-virus tries to link itself to
a file, this file-access can be recognized and denied.
VIRUS-CONTROL offers another protection from Link-viruses.
If you click 'FILE-PROTECTION', the file, entered in the String-
Gadget, is searched for the VIRUS-CONTROL-protection-mark.
If no mark is found, a requester appears, by which you can protect
the file (VIRUS-CONTROL-protection-mark is appended to the file).
In this protection-mark the original file-length is saved.
If you click 'FILE-PROTECTION' again, VIRUS-CONTROL recognizes,
that the file is already protected. Now the actual filelength
is compared with the original filelength. If there is a
difference, a Link-virus has linked itself to the file probably.
A requester indicates this danger.
You should act like that:
- copy your original-files
- protect the files with 'FILE-PROTECTION'
- check the files periodically with 'FILE-PROTECTION'
- if there is a length-difference, copy the original-file
'FILE-PROTECTION' works on directories too. Therefore you can
protect or check a total directory.
Especially C:directory should be protected.
The short operation instructions of VIRUS-CONTROL can be got
by starting VIRUS-CONTROL again.
Hereby you can set -c -f -t -o too.
Also you can set -c -o -f by the corresponding gadgets.
(FarbSignal, CheckOpen, searchfiles).
If VIRUS-CONTROL is active, no bootblock-virus can infect your
Amiga, because VIRUS-CONTROL suggests a harmless Boot-simulation.
But it is thinkable, that there are viruses, which pretend to be
a normal CLI-program. For instance a better 'dir'-program, which,
if executed, installs a virus. But such viruses spread slowly.
Nevertheless VIRUS-CONTROL recognizes such viruses too, because
VIRUS-CONTROL installs an extra task to control system-vectors.
Every second COOL-vector, DOIO-vector, KICK-vectors and BeginIO-
vector is checked. If a vector is changed, a requester will appear,
by which you can try to kill the virus. 'Kill virus' sets DOIO-
vector and COOL-vector to VIRUS-CONTROL again. BeginIO-vector
is set to the old adress before changed to a new address.
Furthermore COLD-vector and KICK-vectors are cleared, and 1024
bytes at the bottom of the supervisorstack are cleared, because
there are viruses which use this area.
Sometimes 'Kill virus' crashs the system, because 'Kill virus'
collides with the virus. Therefore the best and safest method
to remove a virus is to switch Amiga off.
In order to find out, if really a 'suspected disk' is a Virus-disk
you can act like that:
Install VIRUS-CONTROL and then intentionally boot from the
'suspected disk', by this an eventual bootblock-virus is activated.
All inserted disks should be write-protected, in order that an
eventual bootblock-virus is not spread.
If it is a bootblock-virus, you will notice some of the following
effects:
- Requesters appear, which indicate changed system-vectors
- Requester, because of write-access to Bootblock
- if you insert disk, no more green color-signal,
although colorsignal is set. (DOIO-vector changed by 'Virus')
- if you insert disk, pressing L-ALT-key, neither a Warn-Window
nor a black color-signal. (DOIO-vector changed by 'Virus')
- during reset no more green color-signal.
(COOL-vector changed by 'Virus')
- If you start VIRUS-CONTROL, you are told, that your Amiga
seems to be infected.
Your Amiga can be programmed in a very flexible manner.
Therefore a virus will not produce all above effects.
Sometimes a virus can collide with VIRUS-CONTROL
and crash the system.
After this test you have to switch your Amiga off, because this
is the only safe method to remove a virus.
The only reliable method, to identify a Bootblock-Virus
is also the most dangerous method.
Without installing VIRUS-CONTROL you boot from the
'suspected disk'. Now you insert a not write-protected,
and not suspected disk. After that switch your Amiga off
and boot from a clean disk. Start VIRUS-CONTROL and insert
the not write-protected disk. If this disk has become a
'suspected disk', the bootblock-virus is identified.
You should at once write a false checksum to this disk
or better overwrite the bootblock.
You see, VIRUS-CONTROL is really a very powerful instrument,
to eliminate all kinds of viruses.
Nevertheless VIRUS-CONTROL is very easy to use.
Pius Nippgen, Bergstr. 12, D-6657 Gersheim 8,
Tel. 06843/781 or 06843/1522