home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
FishMarket 1.0
/
FishMarket v1.0.iso
/
fishies
/
326-350
/
disk_328
/
hames
/
vmk.doc
< prev
next >
Wrap
Text File
|
1992-05-06
|
6KB
|
174 lines
Virus Memory Kill V27 © Chris Hames. 4th Feb 90.
(REMEMBER! no virus can copy itself to a write-protected disk.)
This utility is perfect to put in the startup-sequences of your
important disks being only 2392 bytes. It will detect and remove from memory
the viruses listed but more importantly detect new viruses. You will know
when you have an outbreak of a virus and can then disinfect your disks with
an appropriate disk virus killer. The version number of VMK refers to the
amount of viruses it knows.
VMK will detect nearly all new viruses that stay resident(survive reboot)
because it checks if CoolCapture, ColdCapture, WarmCapture or the KickTagPtr
is not zero. It also checks the jump addresses of routines commonly used by
viruses:- AddTask, DoIO, OldOpenLibrary, RemTask, SumKickData, Open, Close,
LoadSeg, Lock, Write, VerticalBlank, TrackDiskDoIO, and KeyReset. When VMK
finds that any of the above are abnormal it alerts you telling you what is
not normal, gives you the value that is not normal and displays the memory
around the location, which is indicated by a = on left hand side of the
actual location. You can look for text indicating what is causing the
problem in the memory display. eg "ByteBimboVirus".
When VMK finds a virus or something that looks like it is being caused by a
virus you have an option of cold reseting or doing nothing. If you think or
know the alert was caused by a virus select cold reset(kills everything in
memory) then boot off a clean disk and use a disk virus killer check your
disks.
VMK recognizes most of the non-virus programs that use one of the checked
values and with not alert you. If it finds the SystemZ Anti virus in memory
it will print a message telling you of its presence but not alert you. If
you find a program that is not a virus and is causing alerts just tell me and
I will get around the problem in the next version.
Usage: VMK tkc?
c will cold reset(if you want a virus safe reset)
t will stop KickTagPtr checking
k will stop KeyReset checking
? will show information about VMK and then run it
If you find a new virus, or want to make a donation for the many
hours of work that have gone into this program, of money or anything I might
find of use. I can be contacted:-
C Hames
6 Pamela Crt
Blackburn South
VIC 3130
Australia (The land with practically no Amiga Software Companies)
OR contact me on the BBS's(Hotline Phoenix AmigaLinkII) or at AUG meet
or Wake me up at a Monash Uni Lecture.
This program may be copied for any purpose as long as it is unaltered and
accompanied by this doc file unaltered. I take no responsibility for any
problems that occur using this program. It performed fine when tested.
----------------------------------------------------------------------------
Viruses Known by this version
BootBlock Viruses:-
AustralianParasite
Australian idiot! Turns screen upside down after time.
BackFlash
Another typical boot block virus
16BitCrew
Another typical boot block virus
ByteBandit
Infects bootable disks inserted. Starts interrupt that will blank
screen after certain time. To recover:- Press these keys in order
and keep holding down as you press the others. Left-Alt, Left-Amiga,
Space, Right-Amiga, Right-Alt. Look for "Byte Bandit" in boot block.
ByteWarrior(DASA)
Infects inserted disks. Plays tune and flashes power led if Cool
or Cold Capture are not zero at boot(eg detects SCA). Works with
Kick 1.2 only. Look for "DASA.2" in boot block.
DiskDok
Infects inserted disks. Eventually starts formatting every 5th disk
inserted from block 880. Works with Kick1.2 only. Look for
"Disk-Dok" in boot block.
Gadaffi
Infects evry disk inserted. Works with Kick1.2 only.
Look for "GADAFFI" in bootblock.
Graffiti
Does 3D graphics. Infects disks booted off.
HCS4220
Infects disks booted off. Starts interrupt power led flashs with
drive step and also every sec. So called detector.
HCS II
LamerExterminator
Infects disks inserted. When in memory will return a normal boot
block when it is actually the virus. Writes random blocks filled
with "Lamer!". Boot block changes each time except for some start
and end bytes.
Microsystems
Infects inserted disks. Eventually puts up screen "..MICROSYSTEMS".
Works with Kickstart1.2 only. Look for "MICROSYSTEMS" in boot block.
Northstar & OldNorthStar
Infects disks booted of that have $43fa0012 at $12 in bootblock
(normal bootblocks). Look for "NorthStar" in boot block.
So called Detector.
Obelisk
Infects only if you have no fast ram and only disks you boot off that
have $4eaeffa0(jsr FindResident(a6)) which cuts out most non dos
loader disks. Puts up screen when booting "Obelisk..".
Pentagon
Another so called detector.
Phantasmumble
Another typical boot block virus
Revenge
Changes pointer to a male part of the body a minute after boot up.
Look for "Revenge" in boot block.
SCA & LSD & AEK
Infects booted disks that don't have $37fcbb02 CheckSum. Every 16th
recreation, screen comes up with a message.
Look for SCA or LSD or AEK in boot block.
UltraFox
After approx 16 copies puts up message "..Ultrafox..".
Some Australian idiot.
WarHawk
Boring.
File Type Viruses:-
Devs2608
NOT A BOOTBLOCK VIRUS. Ocassionally puts up message
"A COMPUTER VIRUS IS A DISEASE
TERRORISM IS A TRANSGRESSION
SOFTWARE PIRACY IS A CRIME
THIS IS THE CURE".
BUNDESGRENZSCHUTZ SEKTION 9
BSG9
SONDEKOMMANDO "EDV"
It looks for the first file in your startup-sequence renames
it "devs: " then renames itself(2608 bytes) your program
name so it gets executed each time you boot a disk. So look in
your devs directory for a file called " " which is your
old file & the virus named after your program and 2608bytes size.
IRQ
NOT A BOOTBLOCK VIRUS. Attaches itself to the first file in
startup-sequence or c:dir. Every disk that is inserted that is write
protected will cause a requestor("Volume is write protected").
Changes window to "...IRQ virus".
LamerRevenge
This is a file type version of the Lamer.
Xeno
Attaches itself to files. Spreads fast.
----------------------------------------------------------------------------
Bye,
Chris Hames (Available for any Amiga work)