home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Experimental BBS Explossion 3
/
Experimental BBS Explossion III.iso
/
virus
/
killmnk3.zip
/
KILLMNK3.DOC
< prev
next >
Wrap
Text File
|
1993-10-31
|
12KB
|
257 lines
KILLMNK3.DOC Instruction file for the KillMonk.exe program
Version 3.0 October, 1993
/-- Monkey and Int_10 Virus Detector and Remover --\
| Version 3.0 |
| By Tim Martin |
| |
| 1993 all rights reserved |
| |
| Department of Soil Science |
| 4-42 Earth Sciences Building |
| University of Alberta |
| Edmonton, Alberta |
| Canada T6G 2E3 |
| |
| martin@ulysses.sis.ualberta.ca |
| * Please let me know if this program is useful * |
\--------------------------------------------------/
Note that this program removes ONLY the Monkey and Int_10 viruses.
Use a good general scanner, to detect other viruses.
New in Version 2.0
------------------
1. KillMonk now cleans Monkey from a second hard drive.
2. KillMonk properly recognizes whether MS Windows is running, and
refuses to run if it is. (The virus search and cleaning process
doesn't work if Windows is running.)
New in Version 3.0
------------------
1. KillMonk now cleans the Int_10 viruses as well.
2. Earlier versions of KillMonk failed when users first tried to
clean Monkey-infected computers using FDISK /MBR or general
disk repair tools. KillMonk now should be able to clean such
computers successfully.
3. KillMonk should now properly clean computers that have less
than 640k conventional memory. I haven't been able to test
this, though.
Introduction
------------
KillMonk is a program for finding and removing the Monkey and Int_10
viruses from hard disks and diskettes. I wrote the first version of
KillMonk because the Monkey viruses are atypically tricky to remove
from a hard disk, and few (at that time none) of the popular anti-viral
software packages did the job well. I had hoped that by now KillMonk
would be obsolete, but instead the virus has spread worldwide, and
most anti-virals still can't properly deal with the virus. I'm getting
regular electronic mail messages from people frustrated by the
limitations of the original KillMonk program. Meantime, the Int_10
viruses have been seen on computers in my neighborhood, and they
are (as far as I know) undetected by popular anti-viral software.
They have their own quirks to make things difficult for the general
anti-viral software writers. So it seemed time to redo KillMonk.
Contents
--------
The KILLMNK3.ZIP package should contain four files:
KILLMONK.EXE - the executable program, version 3.0.
KILLMNK3.DOC - this file.
MONKEY.NOT - a text file (somewhat technical) on the Monkey viruses.
INT_10.NOT - a text file on the Int_10 viruses. Partially plagiarized
and slightly edited from a note by Padgett Peterson.
To Use KillMonk
---------------
For any virus testing, it is best if you can start the computer from
a clean diskette. KillMonk should work ok without this precaution,
if Monkey or Int_10 is present, but if any other virus is present,
the consequences are unpredictable. If KillMonk doesn't work when
you boot from a clean diskette, try again, booting from the hard disk.
Steps:
1. Boot from a clean system diskette, if you have one.
2. Check your system using an up-to-date, general virus scanner,
such as F-prot.
3. If the computer passes the general scan (or the scanner finds
Monkey or Int_10 but can't clean them) then run KillMonk.
Carefully read anything KillMonk reports to the screen.
KillMonk will prompt you for any decisions it wants you
to make. KillMonk only needs single key responses, such
as "y" for yes, or "n" for no. The RETURN or ENTER key
is not required: you should only need to use "y", "n", "a"
to specify drive A:, "b" for drive B:, "q" for quit, and
the elusive "ANY" key, as in "Press any key to continue..."
4. If Monkey or Int_10 is found on your hard disk, you will be asked
whether you want to clean the disk. If you respond by pressing
the "y" key, KillMonk will try to remove the virus from the
hard disk. If it is successful, the computer will be restarted
to ensure that the virus is not still running in memory. I
recommend you then re-run KillMonk, to ensure that the hard
disk was cleaned, and to check ALL your diskettes.
5. On a system with two physical hard drives, the second drive is
checked and cleaned before the first drive. The computer does
not reboot between cleaning the second and first hard drives.
Note that I'm not talking about "partitions" on a single hard
drive, but actual separate drives. Monkey and Int_10 will
infect a hard drive only once, no matter how many partitions
it might have.
The technically-minded might point out that a virus infecting
a second drive's Master Boot Record cannot spread. Unfortunately
when Monkey infects a second hard drive, it makes the partition
table unreadable, rendering the second drive "unusable" until
the virus is removed.
6. If KillMonk does not find the viruses in memory or on your hard disk,
you will be given the option of scanning diskettes for Monkey and
Int_10. You can choose to scan drive A:, scan drive B:, or quit.
If you scan a diskette, the options are repeated until you choose
quit.
7. If KillMonk finds Monkey or Int_10 on a diskette, you are asked if
you want to remove the virus. If you select yes, the program will
try to remove the virus. This should work with the four common
formats of diskettes: 360k, 720k, 1.2Mb and 1.44Mb.
8. If KillMonk finds problems but can't fix them, when you have
started the computer from a clean diskette, (or if you don't own
a clean system diskette), then restart the computer from the hard
disk, and run Killmonk that way.
As a side effect, KillMonk may recognize that your system is infected
with another boot sector virus, such as Stoned. It will tell you of
the infections, but it will not remove these viruses. Instead use a
general virus disinfector to deal with these virus infections.
Known Bugs
----------
1. The Int_10 virus sometimes changes the "Total Conventional Memory"
value returned by MEM, CHKDSK, or KillMonk, in an attempt to hide
its presence. On most computers, KillMonk sees through this ploy.
However on true IBMs, and other computers that normally show only
639k memory (654336 bytes) KillMonk might not find the virus while
it is running. If you computer normally returns a value of less
than 640k of total conventional memory, when you run MEM, then be
sure to rerun KillMonk after starting the computer from a clean
diskette.
2. The Monkey virus is known to mess up OS/2 file systems that are
located on a second physical hard drive. I don't understand
what is going on in this case, because I have not studied the OS/2
file system. KillMonk will successfully remove the virus, but
OS/2 might not want to boot.
3. KillMonk will only clean up to two hard drives on a computer.
Computers with SCSI controller cards might have up to eight
devices in the SCSI chain. It should be possible to clean all
of these by changing which is "drive 2", but I don't have an
Intel box with a SCSI controller to test this, and my SCSI
drives are all formatted with UNIX file systems at the moment.
4. When KillMonk cleans the virus from a diskette, it does not
clear the last sectors of the root directory, where the virus
has hidden its pieces. Unlike the other bugs, this is an
intentional design decision: I think problems are more likely
from failed attempts to clean these sectors than from leaving
junk in them. Unfortunately it means that diskettes that have
been infected and cleaned have a reduced file capacity in the
root directory.
5. Some of the algorithms I use, for example the routine to restart
the computer after cleaning the hard disk, apparently are not
as robust as they might be, according to the true anti-virus
gurus. There's a chance things won't work quite as expected,
on your computer. Mileage may vary, so to speak. But as a
first Assembler Programming project, it's been a lot of fun.
Disclaimer
----------
Neither I nor the University of Alberta bear any responsibility
for any problems that may result from the use of the KillMonk
program. USE KILLMONK AT YOUR OWN RISK. I hope you find it
useful.
Copyright
---------
All rights to KillMonk are the property of Tim Martin.
KillMonk may only be distributed free of charge.
Request
-------
If you find this program useful, please send me a postcard, or at
least an e-mail message. If you are a representative of an Institution
of Some Repute, then please send a congratulatory and flattering note,
on Department letterhead, with hints of job offers even, to my boss.
Tim Martin
martin@ulysses.sis.ualberta.ca
-------------------------------------------------------------------------
APPENDIX 1:
The following is the screen output of a typical KillMonk 3.0 session.
In this session, the hard disk was clean, but a diskette was found
to be infected. KillMonk cleaned the diskette.
C:>killmonk
/-- Monkey and Int_10 Virus Detector and Remover --\
| Version 3.0 |
| By Tim Martin |
| |
| 1993 all rights reserved |
| |
| Department of Soil Science |
| 4-42 Earth Sciences Building |
| University of Alberta |
| Edmonton, Alberta |
| Canada T6G 2E3 |
| |
| martin@ulysses.sis.ualberta.ca |
| * Please let me know if this program is useful * |
\--------------------------------------------------/
Note that this program removes ONLY the Monkey and Int_10 viruses.
Use a good general scanner, to detect other viruses.
New in Version 2.0: KillMonk now cleans Monkey from a second hard drive.
New in Version 3.0: KillMonk now cleans the Int_10 viruses as well.
Press a key to continue.....
Checking memory ... Total Conventional Memory: 640k.
I must still check memory for Int_10 though.
Neither Monkey nor Int_10 is currently running on your computer.
Checking the first hard disk's Master Boot Record...
The Master Boot Record program seems to be in place.
Neither Monkey nor Int_10 is on your hard disk.
I didn't look very carefully for other viruses, though.
Use a general virus scanner/disinfector for that.
Would you like me to test a floppy diskette?
Press a for drive A:
Press b for drive B:
Press q to quit. a
*** The floppy is infected with the Int_10 Virus.
*** Shall I try to fix it? (y/n) y OK...
Would you like me to test a floppy diskette?
Press a for drive A:
Press b for drive B:
Press q to quit. q
C:>