Resident 2

home *** CD-ROM | disk | FTP | other *** search

/ Resident 2 / Resident - Issue 2 (19xx)(Angelica - SHI).adf / Data / 074 < prev next >

Wrap

Text File | 1993-04-02 | 12.5 KB | 375 lines

¶3SOFTWARE PROBLEMS ¶2----------------- ¶1It is well recognised that a number of virus killer programs can set vectors , or they can be residual, (that is to say, the program survives a "warm reset" Ctrl-A(miga)-A(miga)),in your RAM. One example is the virus killer program "System Z". A little number of utility programs , demos and intros and so on can give the same problems and ought therefore be completely avoided. The problem with these programs is that they can trick the virus killer into believing that there is a new virus in the machine. In individual cases, I have experienced a virus killer mistakenly taking a disk as being infected by a virus (with the name of the virus), despite the fact that it was an innocent bootloader, which was in the boot. This can happen sometimes, and can be explained by the fact that the virus killer's recognition code is on rather few bits for every individual virus. This code can then, in a few situations , coincide with an innocent program. Disk failure can also cause suspicion as to whether the diskette is infected with a virus . One common fault is that you get the message: "Error validating disk", "Please insert volume Lazarus", or a read/write error message. These messages are disk failure not viruses, but in many caseses you will get these disk errors , after your disks have been infected by a virus. Another irritating thing is that certain disks can ask you to remove the write protect in a systems message during the startup-sequence. One must be particularly alert here. Normally the reason is that a type of virus can be in the memory which is programmed to lure you into a trap, but it can in some cases be pretty harmless. If you have the slightest doubt, you should try to infect another disk, to ascertain whether it really was a virus. ¶3VIRUS PROBLEMS IN GENERAL ¶2------------------------- ¶1The simplest virus types are the bootblock viruses, because they are easy to remove by overwriting them with "install". Individual disks use a special "loader system" and will be destroyed if they are overwritten. It is very likely that the disk was already destroyed when the virus infected it, so that you will never be able to destroy a disk which is infected beforehand. On the other hand one must advise against indiscriminate use of "Install" on unknown bootblocks, one can easily destroy a disk; if in any doubt, always copy the disk first. If you have kickstart 1.3 in your Amiga you can find the disks infected with virus starting up with a guru or like, and the card crashing not long afterwards. This can be because the disk is infected with a virus which can only work on Kickstart 1.2. In such a case a lot of diskettes can be saved, which you would otherwise have hought were faulty, by "Install"ing them. There is a special type of "virus" named "Bombs" which is characterised by the fact that they cannot infect other media such as diskettes, harddisks or the like. They can cause serious damage by acting as destructive programmes which, for example, can re-format a whole harddisk. These viruses ("hacks") can appear in the boot (like normal bootviruses), or as an individual file (like a normal file virus) together with a link, that is to say, a file which has hooked itself to another programme (ie. the two files' size in bytes has increased, which we know from regular link viruses). If you have got a new unknown type of one of these viruses, which your virus killer doesn't know, it is impossible for even the newest and best virus killers to find them. The best virus killers today have analysis functions, which check up on all "occupied" vectors and check the Amiga's memory for residual programs, which can survive a "warm reset". This doesn't much help against the bomb * viruses mentioned above, so the only way you can prevent them is if your virus killer knows the type. There is therefore good ground for being watchful, especially if you have a harddisk. One of the newest bomb * viruses "Challenger Bomb" is to be found at FRED FISH 622, be careful * please, but it is relative harmless ¶3ABOUT CLOCK VIRUS ¶2----------------- ¶1Rumours of the clock virus has several times caused even experienced Amiga users to tremble with fear. Just think, if a virus got into the clock in our Amigas, and could just hide there, undiscovered, for months..dreadful! No, you can all relax. It's only a rumour, it's a physical impossibility, there are only few bytes free in the clock, but definitely not enough for even the minutest program. On the contrary, the rumours about various types of viruses making your clock run amok are true. I have heard from several sources that there are supposed to be two types of virus or "hacks"(?), in Germany and the USA at least. One of them is supposed to make the clock run backwards, the other makes it go 10 to 20 times faster. I'm very interested in these viruses and of course, in other NEW viruses, and to say thank you for one, I will send you a disk I make which is called "The New Superkillers", where the newest and best Public Domain virus killers can be found , together with an amount of valuable documentation from virus killer programmers which I cooperate on. We can only make good virus killers, if we get help from you! ¶3ABOUT FILE VIRUSES ¶2------------------ ¶1I have been contacted by several people who have had various problems in removing the link and file virus from both diskettes and harddisks. A recurrent problem is probably the "BGS-9" file virus, which causes several problems, maybe because it is not one of the most difficult to remove, but more likely because it is one of the most widespread. A contributory cause to the stubborn problems with the BGS-9 virus is cause by bad coding of the virus killers KDV III and VirusX. These virus killers don't look for the viruses themselves, but for an empty file in the Devs Directory. To put things a little in place, I will go through how one removes these and similar viruses: ¶31¶2. Look in the disk's startup-sequence and find the name of the first command, note the name down on a piece of paper. ¶32¶2. Look for this name in C/Dir...if the BGS-9 virus has taken over this name (BGS-9 on 2608 Bytes) the file will have been deleted. ¶33¶1. Go into Devs and find the nameless file, give it the name from point one, and move it back to its original position in the C Directory. ¶2NB. Please attention always to remove the emty file in the devs directory otherwise VirusX and KDVIII will give a requester saying: "infected by a virus like BGS-9, but not the viruses itself". ¶3ABOUT THE SADDAM FILE VIRUS ¶2--------------------------- ¶1The Saddam Hussein is the most spreaden viruses today, and is named in * more than 70 % of the feed-back rapports from all over the world: E.g. 6 * well-known BBS hard disks have been corrupted in the "States"! * Please be very careful , if you are working with the new "Saddam Hussein" file/link virus . Note that there is a boot virus with the same name, don't be confused. Here you have some facts about this virus: ¶31¶2. The virus is a "multi-headed" file- and link virus. Always infected in L/Dir,if there is not an L/Dir on the disk,it will make one by itself. ¶32¶1. The Saddam file virus part is always to find in L/disk-validator , with the same file length (1848) and of course....the same name a diabolical thing oh...boy..! ¶33¶2. The Saddam link virus part is a VERY , VERY...... easy spreading virus, it will link to all files , e.g. to all executed , written or copied files , but it does not change the file length,it only writes "IRAK" in the start of the files. Please remark, that all theses infected files will cause Read /Write" errors! The original "Saddam" infects hard disks too. I have several reliable reports from Australia (1), and USA (5), (the last five reports from USA were all concerning BBS damages, where more than 500 program files were damaged. ¶34¶1. It is impossible to delete the virus or the link infected files with a file editor like "Diskmaster", or from CLI. ¶35¶2. Attention the Saddam Hussein don't infects ANY disk, IF copyed from an other disk, and IF your disk is error free! ¶1Please note, that BootX is the ULTIMATE "Saddam" killer , but ONLY...... use "Check files" to FIND.......the "Saddam" virus, you must then use the * "Repair disk" menu to salv the Irak infected files. BootX will find the * "Saddam" virus and make it passive and repair the infected files very * near 100 %, but can't remove the virus itself, you have to re-install * the original Disk-vaildator. If you have virus infected disks, I recommmend to try to use several dif- * ferent killers, in some cases the killer may just break-down by meeting * the virus, if you try to repair your disks, or don't find the virus you * have got. A good advise: ALWAYS use a backup of your disk, when you have * to repair your virus problems, and especially...with the "Saddam" virus or * other link or file viruses! Many people have contacted me saying , that they have found a "SPECIAL" virus an "Australian Parasite" virus , which cannot be killed with VirusX 4.01, (the LAST official release...) I understand this problem quite well, because by a stroke of luck VirusX, is accidental able to find the "Saddam Hussein" Disk-validator virus . The problem here is, that the Australian Parasite virus, is a virus you will find in the boot block, and the nasty "Saddam" virus is to be found in the L/Dir. After repair, always....... use a program like Quarterback Tools to check the disk to see if the disk structure is all right. ¶3HARDDISK AND VIRUS ¶2------------------ ¶1Many harddisk owners know that they should be particularly careful with all "non-boot viruses" and don't think twice about boot viruses. Watch out! A lot of boot viruses can also get into a autoboot harddisk. PLEASE ATENTION,......that a boot virus infection on your harddisdisk is the MOST SERIOUS thing, that can happen your harddisk! I know, unfortunately, several experienced Amiga owners, who have spent weeks to bring their infected harddisks back to life. The boot virus write itselves onto sector 0 and 1 of cylinder 0 on your autoboot harddisk, and you will get a system message which says: "Not a Dos disk in unit 0". If the accident has happened, try to revive your harddisk by starting up your harddisk installations disk, then format your cylinder 0, and prep your harddisk again. If it is a file virus which has jammed your harddisk , remember that most of these are in the first command in the startup-sequence , note the name in the startup-sequence, delete the file which has that name in your C/Dir and reestablish the original c command from , for example, your workbench disk. Xeno virus, and similar link viruses, can create other problems because they can attack several of the files. Because these files still have their original names, it can be hard to find them, if you don't have the exact viruskiller which knows this virus. A piece of good advice here - make a list of the harddisk and note the date, look for the most recent, and delete all these files. Remember to regularly take a backup of both your hard disk and your disks which have important data; but remember also if you do it too often you can risk also getting virus on your backup. Remember Murphy's law: "If something can go wrong, it will go wrong". ¶3VISION FOR THE FUTURE ¶2--------------------- ¶1I think the only way to stop virus spreading is to catch the man, who had made the virus and tell others about the consequences. Many young one think, that virus making is like making graffiti or like. The fact is that the laws punish VERY HARD for data terrorism, in Denmark up to 4 years jail, and e.g. in Gemany you can get up to 6 years jail.