GEMini Atari/GEMini_Atari_CD-ROM_Walnut_Creek_December_1993.iso/zip/virus/vkiller.lzh/VKILLER/VKILLER.DOC

Text File | 1991-05-22 | 25KB | 465 lines

VKILLER                    Version 3.84                 April, 1991

This Archive contains the most recent version of VKILLER, the virus
detect-and-kill utility for the Atari ST.

The program works in medium or high resolution, and is completely
mouse/icon driven. The program may also be controlled by the keyboard.
In this document, all the keyboard commands are indicated as capital
letters, but that is not mandatory. Lower case letters will provide the
same functions. In most cases, the first letter of the label under an
icon is the key that will accomplish the same function of as a click on
the icon.

        **** To Check Disks for Viruses ****

Click on the FLOPPY A icon, or press the "A" key, to check the disk in
drive A for a virus. Click on the FLOPPY B icon, or press the "B" key,
to check the disk in drive B for a virus. When you access a disk, the
program reads in the boot sector, both copies of the File Allocation
Table (FAT), the disk's root directory, and the first few data sectors.

The disk's boot sector will be checked to see if it is executable, and
if it matches any known patterns. If it is executable, a warning
message will be posted in the display window. If it matches the
patterns of some known boot sector utility, such as a resolution
setter, that fact will be illustrated by a box in the lower right
corner. If it matches the pattern of any known virus, that fact will be
indicated by a box in the lower right corner. To see more information
on any recognized virus, click on the box in the lower right corner, or
press the 'D' key for details.

        **** Capturing Disk Data ****

Once you have accessed a disk to check it for a virus, you can write the
data from the disk into a file, print it, or show it on the screen.

To write the disk data into a file, click on the "FILE" icon, or press
the "F" key. A file selector will appear. Use it to designate the file
you wish to write. The resulting file is not executable, even if the
boot sector of the floppy was an executable one. It is a data file with
an image of the significant portions of the disk. It can be treated
like any data file, compressed by an archiving utility such as ARC or
LZH, copied, transmitted via electronic mail systems, printed, or
examined.

To print the data, click on the PRINT icon, or press the "P" key. An
alert box will appear. You may choose to print either the same data
that is available in the "SHOW" window, or only the data from the boot
sector. The amount of data captured from the disk varies, depending
upon the disk's configuration. For a typical ST disk, it will usually
be about 20 sectors, or slightly over 20,000 bytes. The boot sector
only is 512 bytes.

To show the data on the screen, click on the SHOW icon, or press the
"S" key. The window will expand to nearly the full screen, and display
all the data read from the disk. Use the window's scroll bar to move
back and forth through the data. Close the data window, by clicking on
the close box, to return to the main screen. Pressing any of the active
keyboard keys will also close the data window and return to the main
screen.

        **** Disk Basics ****

The boot sector of a normal ST disk is 512 bytes. Only a small portion
of this, about 30 bytes, are required to provide data to the ST. Those
initial data bytes contain the disk's formatting characteristics,
telling the ST's operating system how many tracks the disk has, how
many sides are used, how many sectors are on each track, and how much
of the disk is being used for the directory and the File Allocation
Table. The rest of the boot sector is not used unless the disk is "self
booting". In this case, normally found only on games, the boot sector
is "executable", and the normally unused portion of the boot sector
contains a small program. This program will be executed automatically
when the ST is powered on, or reset, and the disk with the executable
boot sector is in drive A. This is true even if your ST is configured
to automatically boot up from a hard disk. The boot sector of a disk in
drive A will still be checked to see if it is executable, and will be
executed if it is. Executable boot sectors, therefore, are the primary
method used by viruses to spread, and be run by unsuspecting ST owners.

If the boot sector is not executable, the space after the configuration
data is unused. While whatever is there is not normally important,
there is one virus which utilizes an obscure system characteristic to
hide in the boot sector, and not make the disk "executable". To be
safe,  the unused portions of the boot sector of any non executable
disk should be set to zeroes. Some formatting programs do this, while
others do not. The ST desktop, for example, does not set the unused
portion of the boot sector to zero.

The boot sector also contains a serial number. That number is used by
the ST's operating system to determine when one disk has been removed,
and a different disk inserted. If a change is made between two disks
which have the same serial number, however, the ST does not believe
that there has been a disk change made. That usually results in the
destruction of the second disk, when the data written to it aligns with
the file structure of the removed disk. There are viruses which write
the same serial number to different disks, resulting in such
destruction. There is a similar problem using disks formatted by an
MS-DOS system. The serial number is not used by MS-DOS. Instead, MS-DOS
writes the version number in the space used for the serial number. This
results in all disks formatted on MS-DOS systems appearing to have the
same serial number, and becoming corrupted when they are used in an ST.
To warn of this possibility, VKILLER checks the serial number field. It
always displays the disk's serial number in the data window. If the
field contains printable characters, they are posted after the serial
number, in parenthesis. If you find the same serial number on more than
one disk, you can use VKILLER's Repair facility to renumber the disk,
without altering the disks contents in any other way.

The directory contains the names of any sub-directories (or "folders")
which are accessible from the main directory. Those sub-directories may
contain more subdirectories, and files. There may also be files in the
main directory. The directory size is specified when the disk is
formatted. The standard size for an ST directory is seven disk sectors,
large enough to hold 112 files or sub-directories. Few disks contain
that many files or folders in the main directory, so there is usually
some amount of unused space beyond the last entry in the directory.
There are viruses that will attempt to hide themselves in the end of
the directory. There is one that will place itself in the last two
sectors of the directory, whether that portion of the directory
contained entries or not. If that virus infects a disk which was using
the last two sectors of the dirctory, any file or directory which was
there will be lost.

All files, and sub-directories, rely upon the File Allocation Table to
be accessible. The File Allocation Table, or FAT, is a map of where
each file and sub-directory is recorded on the disk. The ST's operating
system relies upon the FAT to locate the proper portions of the disk in
order to read and write the sub-directories and files. The FAT,
therefore, is absolutely critical in using the disk. So critical, in
fact, that the ST's operating system normally writes two copies of the
FAT on the disk. That way, in case of an error in reading or writing
the first copy, the second copy may allow the data on the disk to be
recovered. The critical nature of the FAT also makes it a prime target
for virus attacks. Erasing the FAT usually results in the loss of all
files on a disk.

The size of the Directory and FATs may vary from disk to disk. The size
of the FAT must be large enough to record the layout of every portion
of the disk. The normal size of one copy of the FAT on an ST disk is
five sectors. This is more space than is necessary to record the disk's
layout. There are viruses that take advantage of this fact, and attempt
to hide themselves in the unused portion of the FATs.

This means that there are currently three places that viruses can hide
on a disk - in the unused portion of the boot sector, in the portion of
the reserved FAT space not needed for a particular disk, or beyond the
last entry in the directory. VKILLER checks disks for all these
possibilities. If it notes that there is something other than zeroes in
the unused portion of the boot sector, it displays a message reading
"Boot sector not zeroed". If the unused portions of the FAT or
directory are not zeroed, it displays a message reading "Extra sectors
not zeroed". These messages warn of the condition, but do not
necessarily mean that there is a problem.

One other value stored in the boot sector configuration data is
checked. There is a provision made for reserving additional disk
sectors, for some special use. These sectors are referred to as
"Hidden", since they are not accessible to any normal disk function.
There is no current use for hidden sectors on an ST disk, so the
presence of them is a condition which should cause concern. If VKILLER
detects hidden sectors on a disk, a warning message will appear in the
disk data window.

        **** Cleaning up Disks ****

If the disk contains a virus, or garbage in the boot sector, you can
clean it up by clicking on the KILL icon, or pressing the "K" key. When
the program executes a "KILL", it writes zeroes into all the non
critical bytes in the boot sector. Whether the remaining unused
portions of the disk are altered depends upon an option set from the
"Options" menu, or by pressing the 'Z' key. The "Extra Zeroing" option
is on when the program begins executing. If this option remains on,
then executing a Kill on a disk will also cause the unused portions of
the FAT, and the unused portion of the directory, to be set to zero. If
the "Extra Zeroing" option is off, only the unused portion of the boot
sector is set to zero. When "Extra Zeroing" is selected from the menu,
or the 'Z' key is pressed, a map of the current disk is displayed,
showing the status and use of each sector in the boot, FAT, and
directory portions of the disk.

No other portion of the disk is altered, and any files on the disk are
left intact. The resulting boot sector provides a disk readable by both
ST's and MS-DOS systems. It is not necessary to display a disk's data
before executing a kill on it. You can insert a disk and press "K", or
click on the Kill icon, immediately. The disk's boot sector will be
read, the critical portions preserved, and the non critical portions
zeroed out.

If you wish to install a "Guard" boot sector on a disk, click on the
guard icon, or press the "G" key. A dialog box will appear, offering a
choice of two types of guard boot sectors.

The first guard boot sector is the "Display" type. It contains a simple
program which will display the message "Virus free disk" when the
system is powered up or reset with that disk in drive A. Once the
message has been displayed, the program returns to the operating system
to continue with the power up sequence. It does not remain in memory.
If you reset the system with that disk in drive A, and the message does
not appear, you should immediately check that disk for a virus. The
only reason why the message would not appear is if the boot sector has
been altered, possibly by a spreading virus. This guard boot sector is
an adaptation of one originally written by Mark S. Powell.

The second guard boot sector is the monitoring type. This one also
displays a message at power up and reset. Unlike the display version,
however, this guard remains active in memory until the system is reset
again. Of course, if the disk in drive A at the next reset contains the
guard boot, it will be reloaded again. Otherwise, it is removed from
the system.

While the monitor is active, it checks the boot sector of every disk
that is accessed by the ST. If it detects an executable boot sector on
any disk, it will flash the screen colors, and sound a warning tone. If
the disk just accessed was not one that should have an executable boot
sector, you should become suspicious. The monitor will not issue a
warning for disks which contain copies of itself.

Vkiller now contains a feature for repairing the boot sector of a
damaged disk. Activate it by clicking on the repair icon, or pressing
the "R" key. It will not re-create executable boot sectors, such as
those required for self booting games. When a disk boot sector is
damaged, the disk will be deemed unreadable by the ST's operating
system. If only the boot sector is damaged, repairing it may allow the
data on the disk to be recovered.

When you activate the repair function, a dialog box appears. It
contains all the data that can vary in a disk's boot sector. The
individual entries are each editable. They will originally contain
whatever value was read from the disk. This may not be reasonable or
valid if the boot sector was corrupted. The actual data that is in the
boot sector is a bit more obscure than what the dialog presents, but
the needed data can be calculated from what is presented in the dialog.

    OS ID: This is an ASCII data string. It is designed to
    provide the identity of the operating system under which
    the disk was formatted. It can contain anything. It is
    not used by the ST operating system in the current version,
    but is supplied for MS-DOS compatibility.

    Serial Number: This number is used to tell disks from each
    other. The number should be different on every disk. This
    box will originally contain the number that came from the disk.
    You can enter any value you wish, if you so desire. The
    legal range of entries is from 0 - 16,777,215. It should
    be stated here that the three bytes in which this number is
    stored are also used for the operating system ID on MS-DOS
    systems, and will usually have the version number of the
    formatter. If you regularly move disks back and forth with
    MS-DOS systems, you may encounter problems using them in your
    ST, since many will appear have the same serial numbers.
    You shoud, therefore, avoid the numbers which correspond
    to the MS-DOS versions:

        1.0 - 3,223,088 through 1.9 - 3,223,097
        2.0 - 3,288,624 through 2.9 - 3,288,633
        3.0 - 3,354,160 through 3.9 - 3,354,169
        4.0 - 3,419,696 through 4.9 - 3,419,705

    If VKILLER notices that all three characters in the disk
    serial number are printable ASCII characters, it will display
    the three characters in parenthesis in the disk data window.

    Format ID - Also for MS-DOS compatibility, and not used
    by the ST. The normal ID value is F9.

    Reserved Sectors - The number of sectors at the beginning
    of the disk which are not used for the FATs, Directory,
    or data. Unless you are attempting to something very
    unusual, this should always be 1 (for the boot sector).

    Hidden Sectors - Sectors at the beginning of the disk
    which should not be accessed. This should be zero.

    Sides on Disk - Either 1 or 2. If you come up with a
    three sided disk, I'd be very interested in seeing it.

    Tracks on Disk - The standard format for an ST is 80.
    Extended formatters may provide 81 or 82, if your drive
    can step in that far. Some 5.25" disk drives have 40 tracks.

    Sectors per Track - The standard for the ST (and MS-DOS)
    is 9. Some extended formatters, including "TWISTER",
    use 10, while others will go to 11. The ST's desktop
    formatter always uses 9.

    Sectors per FAT - The FAT is the File Allocation Table.
    It is a map of how the folders and files are positioned
    on the disk. The ST standard is 5. This is more than
    adequate, since the capacity of the disk only requires
    3. A disk formatted in an MS-DOS system will have 3.
    When viewed as data, a FAT looks like a bunch of garbage.
    There will always be two copies of it, at the start of a
    disk. You can use the "Show" feature of Vkiller to look
    at the disk. If sectors 1 and 4 look the same, and the
    directory starts at sector 7, the disk has a 3 sector FAT.
    If sectors 1 and 6 look the same, and the directory starts
    in sector 11, the disk has a 5 sector FAT.

    Directory Sectors - The number of disk sectors provided
    for the disk directory. The ST standard is 7.

If you accessed the repair function only to change the serial number on
the disk, click on the "Renumber" button. A random serial number will
be generated, the disk boot sector will be updated, and the program
will return to the data window. If you want to assign a  specific
serial number, move the cursor to the serial number entry, type in a
number in the range 0 - 16,777,215, and select the "Rewrite" button.

If the data in the dialog appears to be nonsense, the disk's boot
sector has been corrupted. This may be due to a wide range of reasons,
not just a virus. To set the values to the ST standards, you can enter
the appropriate values for each item, or select the "Set Defaults"
button. It will set the normal values for most of the entries, and
generate a random serial number. You should, however, insure that the
number of tracks, sectors, and sides on the disk are correct for that
particular disk. If you aren't certain, you can use the "Scan Disk"
function.

When you select the scan disk function, a dialog with a number of
selectable boxes appears. To repair a damaged disk, the program must
know the number of tracks, sectors per track, and sides on the disk. If
you know any of those facts, enter them in the dialog by clicking on
the appropriate boxes. If you don't know, leave the boxes unselected.
The program will attempt to determine the disk's configuration by
reading different areas, to establish any of the entries that you do
not provide. You can also have a set of default values inserted by
clicking on the "Default" button.

Since the number of tracks on a disk may vary, the program will attempt
to determine how many tracks were originally on the disk by stepping
the disk head in and reading data, until it reaches an unreadable area.
It will not continue stepping in past an unreadable track, but it will
continue stepping in until it does reach an unreadable track. This, of
course, will be one track further than the the disk's formatting
originally extended. While it is extremely unlikely, it is possible
that repeated execution of this stepping in operation, which could
extend beyond the range of the drive, could cause the disk's head to
become mis-aligned. It has not occurred through weeks of testing, and
would probably require thousands of such operations, but it is
possible. If you wish to prevent the head from stepping in past some
specific track, click on the last track you wish the disk to access,
and select the "Limit" box. The head will not be stepped in beyond the
track you select, even if that track does contain readable data. Of
course, if an unreadable track is detected before that limit is
reached, no further stepping will occur.

After all the physical configuration parameters have been entered or
determined, the original dialog box will re-appear. The values
determined by scanning the disk will have been updated. You may edit
them again, if you wish, before writing the disk's boot sector. After
the disk has been updated, the program returns to the familiar disk
data window.

Since this boot sector rebuilding function starts with the data
currently on the disk, it can also be used as a means of altering the
data on a non-infected disk, such as setting serial numbers.

The Menu offers two features under the "Options" title. The first
option, "Quiet", will turn off the warning siren that sounds when a
virus is detected. Clicking on "Quiet" again will turn the siren back
on.

Since some viruses check system data, such as ROM dates, to determine
if they can execute, a second "Option" is provided. Clicking on "System
Info" will cause the data window to display information about the
system parameters.

Exit the program by clicking on the "QUIT" icon, or pressing the "Q"
key.

When the program detects a virus present on a disk, it will sound a
warning tone, and place a new button on the desktop. To see the details
about the particular virus located, click on the new "Known Virus" box,
or press the "D" key. If you find a lot of disks infected by a virus,
and want to stop the warning tone from sounding on each disk,  select
the "QUIET" item from the "OPTIONS" menu.

If the disk contains an executable boot sector, but one that is
recognized as a standard system boot, it will be identified as a
"System Disk".

        **** General Hints ****

There are two real problems to keep in mind when dealing with viruses,
and disk boot sectors. The first is that not all executable boot
sectors are viruses. There are times when a boot sector is supposed to
be executable. Executing a KILL on such a boot sector will destroy
whatever code was in the boot sector, and may render the software on
the disk useless. In order to determine if the software on a disk
requires an executable boot sector, you may execute a "Test Kill" from
the "Options" menu, or pressing the 'T' key. This will render the disk
boot sector un-executable, but in a manner that may be restored back to
the original executable status. A dialog box will appear, explaining
the test kill procedure, and offering the buttons "Test Kill",
"Cancel", and "Restore Boot". Select "Test Kill" to determine if a disk
which bears an executable boot sector will function normally without an
executable boot sector. The disk will be altered to non-executable
status. Exit VKILLER, and attempt to use the disk as you had
previously. If it still works properly, it did not need the executable
boot sector. You should rerun VKILLER, and do a  normal "Kill" to erase
whatever was in the boot sector. If the disk will not function properly
after the test kill, rerun VKILLER immediately and execute the "Restore
Boot" function. This will return the boot sector to the prior status.
You should record the fact that that particular disk must contain an
executable boot sector, to avoid acidentally removing it at a later
time.

Generally speaking, if the proper use of the software on the disk
required you to reset your ST, or power it off and on to start the
program, then the boot sector was supposed to be executable, and you
should not execute a virus kill on it. Any program which can be
executed by clicking on it does not require an executable boot sector.
Consequently, disks used to store such programs should not contain
executable boot sectors.

The second problem is attempting to use VKILLER in a system which has
been infected by a virus, and the virus is executing (attempting to
spread) while VKILLER is attempting to clean it off disks. With all
known ST viruses as of this release (January, 1991), VKILLER will
detect this situation. It will provide instructions on the screen,
informing you that there is an active virus in the system at the time,
the exact steps on how to get rid of it, and how to start cleaning up
your disks.

This version of VKILLER can recognize and eliminate over 30 different
ST viruses. This is possible only because people who have encountered
viruses that earlier versions of the program did not recognize sent me
copies of the new viruses. If you encounter a virus that the program
does recognize, there is no need to contact me. Just eliminate the
virus, and let anyone else you have given a disk to know that their
system may be infected. Give them a copy of this program if you wish,
it is free to anyone who would like it.

If, however, you encounter executable boot sectors spreading through
your library, and this version of VKILLER can't identify it, please
contact me at any of the addresses below. Keep one infected disk, and
either send me the disk, or the file generated by VKILLER's file
function. Use the Kill function to clean up the rest of the disks in
your library.

As of this writing, I am investigating about 40 disks each month for
new viruses. If you mail me a disk, or a request for a disk copy of the
latest version, please include a stamped, self addressed return mailer.
Please be patient in expecting a response.

VKILLER does not require any "license", "registration", or "shareware"
contributions. Of course, all such contributions are gratefully
accepted, but none are solicited. Circulate the program in any manner
you wish. It may be copied, and distributed freely, but it may not be
sold. Reasonable (and hopefully modest) charges for media, copying, or
downloading are acceptable.



George R. Woodside

Voice:         [phone]
Compuserve:    76537,1342
GEnie:         G.WOODSIDE
USENET:        [e-mail]
    or:        ..!{philabs|csun|psivax}!ttidca!woodside
US MAIL:       5219 San Felicaino Drive
               Woodland Hills, CA  91364  USA