Carousel Volume 2 #1/carousel.iso/mactosh/virus/vcheck40.sit/readme

Text File | 1988-07-05 | 17.5 KB | 505 lines | [TEXT/TPAS]

Vcheck - Startup System Test program - Version 1.3 7/5/88
by Albert Lunde, Northwestern University
Copyright ⌐ 1988 - All Rights Reserved

See "Terms of Distribution","Use","Getting Started" below:

This is a program to detect software viruses by checking for
changes in the contents of the active system folder, the boot
blocks and all applications on connected volumes.  It does
not prevent viruses from spreading in your system, but can
alert you to their existence. It is not designed to be
specific to particular viruses, except for warning of
"dangerous" resource types when found.

        Albert Lunde
        Academic Computing
        Northwestern University
        2129 Sheridan Road
        Evanston, IL 60208



Terms of Distribution:

Non-commercial distribution is encouraged, with several
conditions:

1) You must distribute the source code if you distribute the
compiled program. (The main purpose of this is to make it
difficult for viruses to spread. Users are encouraged to
recompile from the source code, since source code cannot
carry a virus.)

2) If you modify the source code, distribute both the
original code and the modified code and include the original
comment headers with copyright notice and remarks in both
files. List a summary of your changes after the header, and
add the word "Modified" to the two Version identifiers. You
may not attach additional restrictions to distribution of the
modified code.  If I receive useful modifications, I may add
them to my versions. (Distributing the original source makes
it clearer what has been changed and may aid support.)

3) You may change a copying fee not to exceed $10 or the cost
of media whichever is greater.  (The intent is to put
distribution of the original program and/or modified versions
into non-profit channels to allow wider distribution)  Normal
communications and connect charges for downloading software
are permitted.

***********************************************************
Version 1.3

New features and changes since version 1.2

1) Checksums may change from earlier versions since the list
"safe" resources and files has been changed to work better
with system update 6.0.

2) Added automatic full checksum on applications that have
changed size - this reduces false alarms on an "Application
Scan".

3) Fixed a bug which caused named resources with trailing blanks
in the name to be treated as not equal to themselves.


New features and changes since version "1.0 Beta":

It is easier to keep your checksums file up to date. Features
have been added to do checksums of new applications and/or
replace the old checksums file with the new file.

It is possible to check other system folders than the
currently active system.

Several options that previously were available only by
recompiling the program are now specified in a dialog and the
input file.

Checksums may change from the earlier version since the list
"safe" resources has changed.

Four bugs fixed -

1) a bug affecting the results when an output file was
written after an application scan.

2) errors in  folder names on non-boot disk volumes,

3) a bug causing applications to be falsely declared as "new"
in some circumstances

4) a bug causing the program to freeze or bomb just after
checking the boot blocks.

Changes have been made in heap and stack treatment which I
hope will fix the intermittent errors in previous version (I
suspect a heap/stack collision during an interrupt handler).

***********************************************************

Hardware and Software:

Written in Turbo Pascal 1.1 for the Mac (tested on a Mac SE
and a Mac II) this should run on a Mac Plus,Mac SE or Mac II.
I am not sure if a Mac 512E has enough memory.  This assumes
you have HFS and a relatively recent system so it is not
appropriate for the 128K or 512K Macs with the old 64K ROMs.
Some versions of the program compiled and ran with Turbo 1.0
but I haven't tested this much.

Use:

The program expects to find an input file named
"OldSystemCheckSum" in either the default folder or the
system folder.  It will optionally write an output file in
the same format as the input file.  (Both are text files with
items separated by tab characters.  The output file is named
"OldSystemCheckSum" if no input file exists and
"NewSystemCheckSum" otherwise.)

The program compares the contents of your system folder with
information in the input file, and tells you about changes.
It also does a less detailed check of applications. It monitors
the existence of hidden files.

You have the option of replacing the input file with the
output file after reviewing changes on-screen.

Use of this program does not prevent a virus infecting your
system, but it may give you an indication that you are
infected, and thereby prevent infection of your backups. (Yet
another reason to keep several sets of backups.)

When the program starts you are presented with a choice of
five buttons:

"System Only" button:

  This does a complete check of the system folder, and does
  nothing with applications and hidden files elsewhere.

"Application Scan" button:

  This will start a complete check of the system folder and
  a check for changes in the sizes the resource forks of
  applications. After about 10 seconds the Mac will continue as
  if you had clicked this option. This is faster but less
  accurate than the "Full Check". Because some applications
  write preferences information to their own resource fork,
  checking the size is not an ideal check. When an application
  appears to have changed size, a full checksum is done on it.
  This reduces false alarms. However, the size check can still
  be evaded by a careful virus.

"Full Check" button:

  This does a complete check of the system folder and a
  check for changes in resources of applications. Only resource
  types marked as known to contain executable code are checked
  in applications and invisible files.  It is recommended that
  you use "Full Check" periodically, especially before making
  backups, as it is much more difficult than "Application Scan"
  for a virus to evade.  It is not the default, because it can
  take several minutes to run.

"Skip It" button:

  Halts the program

"ShutDown" button:

  Flush all drives and do a system shutdown. (similar to
  the item in the Finder Special Menu).

If you press the option key before or while clicking one of
these buttons, you will be presented with additional options,
including the option to write an output file and/or to check
a different system folder than the startup system. (More
about this below).

Key Commands:

     (the command key is ignored)


  "Q"- Quit after closing files

  "F"- same as "Full Check" button

  "A"- same as "System Only" Button


  "Y"- same as Yes Button

  "N"- same as No  Button

  "."- Quit immediately

  Return Key - Default button (with bold outline)

  "*"- invoke MacsBug debugger and turn on additional output.

       (don't use this command without a debugger)

  "^"- invoke MacsBug debugger
       (don't use this command without a debugger)

  "&"- turn on debugging output

  "#"- turn on debugging output for resource/application detail
       comparison routines

After the program starts, at any time you may quit the
program by clicking the "Halt" button or pressing the "Q"
key. You may shut down the system with the "Shutdown" button.

To get started:

Place the compiled program anywhere outside the system folder
and run it, clicking on "Full Check". It may be necessary to
increase the memory allowed by MultiFinder using the Get Info
dialog. (500K is reasonable).

The first time you run it, the program will not find the
input file, and will ask you if you want to specify another
input file. Click on NO. Click YES when it asks you to
specify an output file.  You will then see a standard dialog
to save a file using the name "OldSystemCheckSum". Click on
the save button.

When the program runs, the output file should contain a
summary of resources in the system file and of applications
and hidden files. This checks all connected disk drives,
optionally excluding floppies and folders on AppleShare file
servers.

Now, whenever you run the program, it will use the file
"OldSystemCheckSum" as a standard of comparison and inform
you of changes.  If you want maximum protection, make this
program your startup application with Set Startup.

When you install new software in the system folder or make
some changes in system settings you may get messages about
new or changed resources.  You will also get messages when
you add an application, or move, rename or duplicate an
application.  If an application writes setup/preferences
information into itself, it will be listed as a "Safe change
in size", provided no unsafe resource types are changed.

To see how these messages look, move some small application
into the system folder and re-run the program.

These messages reporting changes will continue to appear
until you create an new output file (default name
"NewSystemCheckSum") and rename it to  "OldSystemCheckSum".
You will be offered the option to create an output file and
later to rename it whenever changes are reported.

If you have not done a full checksum, and you choose to write
an output file the program will recompute checksums for some
applications, usually new application or applications moved
between folders. This is a feature designed to keep your
checksums file up to date. To be safe and informed of all
changes, however, you should run "FullCheck" periodically,
and only OK replacing your input file at other times when you
know the reason for changes in the system or applications.

To get a complete check and create a output file, hold down
the option key while clicking of the "FullCheck" button at
startup. Running "FullCheck" whenever you write an output
file gives you the information necessary to do a complete
comparison later.

If changes seem minor (like a moved or new application), you
can rename the output file within the program and replace the
input file, or you can compare and or print the input and
output files with a text editor after running the program,
then rename the output file with the Finder.

In the output file, new or changed resources are flagged
"new??" or "changed??". Deletions are not marked.
Applications are marked as "moved/renamed??',"new??",
"changed??" or "safe changed??". Hidden files are marked as
"(hidden)" if they are not applications.

The output file is first written, then you are asked if you
want to rename it. If you say yes, the input file is deleted
and then the output file is moved and renamed to the same
folder and filename used by the input file.

You will not be offered the option to rename the output file
if it and the input file are on different disk drives.

Since the output file is written before deleting the input,
there must be space on disk for both files. You can quit
anytime prior to telling the computer to rename the output
without affecting the input file.

Options:

Pressing the option key before or while you click on the
startup dialog buttons will cause the program to offer you a
number of options.

You are asked if you want to write an output file.

Several options that control what is checked are collected
together on a dialog screen.

"Check Floppies" is a check box that controls if floppy
diskettes are checksummed. (no by default)

"Check Non-Startup Drives" is a check box that controls if
disk volumes besides the volume containing the system folder
being checked are checked.

By default the program only looks at the top level of
AppleShare file Servers, and does not descend into folders
unless you are the owner. The "Appleshare Access" buttons
allows you to change this, and search all folders for which
you have read/write access or "everything in sight" (folders
for which you have search access). (Using these options can
place quite a load on Appleshare.)

All the options in the dialog screen are stored in the output
file and default values are read from the input file if any.

Specifying a different system to check:

If you hold down the options key, another question you are
asked is if you want to specify another system folder to
check. If you say yes, you are presented with a file dialog.
Pick a system folder and select the "System" or any other
file in the folder.

This is useful when checking a system you believe to be
infected after booting from a floppy disk.

If you want to check the system on a suspect floppy disk,
turn on "Check Floppies", turn off "Check Non-Startup Drives"
and then select the system folder on the floppy disk to
check. (DO NOT BOOT from a suspect disk or run any
applications on it).

More about the Checksums:

In order to reduce unnecessary messages and speed processing,
some resources and some parts of the boot blocks are excluded
from the checks. Resources types are classified as:

     0 "Safe"

       (Not containing executable code)
       for example:
       "STR#","FONT","ICON"

     1 "Unknown"

        (Not otherwise classified)

     2 "Unsafe"

        (Containing executable code)
        for example:"CODE","INIT"
        (or sometimes occurring in reported viruses,
        sometimes in normal use)

     3 "Dangerous"

        (Known only to occur in reported viruses)

"Safe" resources are excluded from system folder checksums.

Only "unsafe" resources are checked in application and hidden
files and only a file by file checksum is kept, not a
resource by resource checksum.

A basic list of resource types is in the program, and
"unknown" resources can be reclassified by changing the input
file.

There is also a list of key phrases which indicate a file in
the system folder may safely contain changes in "unknown"
resource types. If one of these keywords is found as a
substring in the filename both "safe" and "unknown" resources
are excluded from checksums. This is used to reduce
unnecessary warnings about changes in the Clipboard,
Scrapbook, Macro and settings files stored in the system folder.

A checksum of checksums is done across resource types.  This
will change when any contents of the checked resources change
or when the criteria for what is to be checked change.  This
will change when resources are deleted, while the resource by
resource lists of changes only indicate new or changed
resource.

No grand checksum is done for applications. The way that
applications are identified is by their 4 character creator
signature and creation date and time.

Hidden files are not checked for size on a short check and
they are only checked for "unsafe" resource type changes on a
full check. This is because the DeskTop and other normal
hidden files change size.

To make it more difficult to evade checksums, users are
encouraged to change the value of the constant
"checksumsaltinc" from $00010001 to some other longword hex
value containing mostly zeros, but some non-zero digits in
both the lower and upper half. Changing this value changes
the non-linearity of the checksums, and changes the results,
so that a change that would be undetected for one value might
not be for another.

Disclaimers:

I do not warrant that this software will alert you to all
viruses. (It won't.) I don't claim to be an expert in
eradicating software viruses and can not do long-distance
consulting on problems with them. I have designed this
program from general considerations rather than experience
with particular viruses.

I have taken reasonable care that this program do no harm,
but I cannot assure this.  My main consideration has been to
put something together quickly to help detect viruses and
reduce their spread. Getting this out the door in time to be
useful precludes exhaustive testing.

Northwestern University Apple Tech Support is assisting in
distributing this program, but they do not take
responsibility for its continued support.

Acknowledgements:

Thanks to Bob Hablutzel and John Norstad for their advice and
support during the development of the program.

This code owes a lot to a number of sources. My resources
include:

"Inside Macintosh" Volumes I to V

(A lot of use is made of the resource section and the Volume
IV parameter block file system calls}

Apple Tech Notes (in particular):

67  Finding the blessed folder
68  Searching all Directories on an HFS Volume
69  Setting ioFDirIndex in PBGetCatInfo Calls
77  HFS ruminations

"MacTutor" Magazine
"Macintosh Revealed" Vol I & II by Stephen Chernicoff
"How to Write Macintosh Software" by Scott Knaster
"Macintosh Programming Secrets" by Scott Knaster
"Programming with Macintosh Programmer's Workshop" by Joel
West
"Fundamentals of Data Structures" by Ellis Horowitz and
Sartaj Sahni
"Programming Pearls" Jon Bentley

MacNosy disassembler/debugger by Steve Jasik

Bug Reporting:

    I can be reached at:

E-Mail

        [e-mail]

        [e-mail]  (Internet)

U.S. Mail

        Albert Lunde
        Academic Computing
        Northwestern University
        2129 Sheridan Road
        Evanston, IL 60208

Related messages can also be sent to me care of Northwestern
University Apple Tech Support:

        A42 - AppleLink;

            or

        76474,154   - CompuServe

If you get system bombs, record the ID number and what was
happening prior to the error. If you have Macsbug, use "wh"
to see where you are in memory. If you have any debugger,
record the registers. Since this is a non-commercial effort,
and I am giving out the source code, whatever you can do to
localize and diagnose bugs will be appreciated.   I do not
know at this time how much time I can or will spend on
support and revisions.