VirusX by Steve Tibbett - The Complete Virus Removal System! - VirusX - Fourth in a growing line of "X-Utilities". Version Notes: -------------- V1.01: V1.01 is just 1.0 with a bug fixed. Also cleaned up the source a tad (one less Goto). V1.2: V1.2 is the same as 1.01 but also adds detection of the Byte Bandit virus both in RAM and on Disk. V1.21: V1.21 is just 1.2 cleaned up a little bit, V1.2 shouldn't have been released the way it was (Just one printf where it shouldn't have been). V1.3: V1.3 is V1.21 but cleaned up a bunch, and is now less than 7K! Even more reason to make it resident. V1.4: New version, to handle the REVENGE virus. V1.5: Done specifically for the Byte Warrior virus. Somewhere along the way, I rigged VirusX so it would notice any of the 4 current viruses in RAM and remove it. Thus, if you've got VirusX in your startup sequence, there's NO way a virus can be around (unless it's one I haven't seen yet). NOTE! TO RUN VIRUSX IN YOUR STARTUP SEQUENCE, YOU MUST USE "RUNBACK VIRUSX" AND NOT "RUN VIRUSX" OR THE INITIAL CLI WILL NEVER CLOSE. A LOT of people asked me about this- Runback is in this archive - Copy it onto your boot disk and use it to run VirusX (Arp users can use ARun). The SCA Virus is something that's been following us around for a couple of months now, and I think it's about time we got rid of it for good.There are a number of CLI-based Virus Checkers out there, which do their job just fine, but if you're not into using CLI, what do you do? You use VirusX! Please, I encourage you to give this program to anybody who might have the virus.Including your local dealer - some of the dealers in this area have the virus all over their disks, which they allow customers to copy, and they don't do anything about it because they don't know how.VirusX makes it extremely simple. You can put VirusX in your Startup-Sequence. When run, it will open a small window so you know it's there (and it will display the occasional message in it). Whenever a disk is inserted into any of the 3.5" drives,that disk is automagically checked for the SCA virus, and also checked to see if it's boot sector is "Standard". If the disk has a nonstandard boot sector, it is either a new form of virus which I don't know about yet, or it is a commercial program which uses the boot block for something constructive (like booting their game). If VirusX finds a boot block it is suspicious about, it will present the user with a requester either warning him that the disk has the SCA virus, or telling him that the boot code is nonstandard. In either case, he is given the option to either ignore it, or to Remove it. If the user selects Remove, after he says he's SURE he wants to rewrite the disk's boot sector (Remember: Never rewrite the boot sector of a commercial program unless you KNOW that program doesn't use it for something else.If the program gives you the AmigaDOS window before running, you know it is safe to repair that disk.). The boot code written back to the disk by VirusX is the same boot code that the AmigaDOS INSTALLcommand (and it's compatible counterpart on one of the fish disks) uses. If you run across a strain of the virus, or any other virus that VirusX doesn't specifically warn of, PLEASE send me a copy of a disk with that virus on it! I want to keep VirusX current, and to do so, I need the viruses. I have heard tell of two other viruses besides SCA, but I don't know much about them - yet. Of course, there are those of you who are thinking that I am some nut case trying to spread my own virus hidden under the guise of a virus checker.I just want to see the virus out of all of our lives.I want feedback on this! Send me a letter! This program is Copyrighted, but is freely redistributable (It's NOTShareware).Do what you want with it, but Please don't use it for evil purposes. That's what I'm trying to prevent. My address: Steve Tibbett 2710 Saratoga Pl. #1108 Gloucester, Ontario K1T 1Z2 My BBS:OMX BBS, 613-731-3419. I can be reached on BIX as "s.tibbett" and on People/Link as "SteveX". One final note: If you click in VirusX's window, the screen's title bar will show information on how many disks VirusX has looked at, and how many it has found the virus on. Note: - When VirusX finds and removes the Byte Bandit Virus in RAM on a German A2000, the machine will sometimes crash. I don't know why this happens, but it works perfectly on the B2000 and the 500 and 1000... BYTE BANDIT VIRUS: The Byte Bandit virus is the main reason for this release of VirusX. What the Byte Bandit virus does is once it's in memory, it copies itself to just above the high memory pointer on the first hunk of RAM it can find (Which means it's not always in the same place), wedges itself into the Interrupt Server chain, into the Trackdisk.device's vectors, and creates itself a Resident structure so it can hang around after reboot. It watches EVERY disk inserted, and will write itself to ANY bootable disk that is inserted! This one can spread like wildfire - every disk you insert into your external drive during a session with this Virus loaded will result in all those disks being infected. Ouch. Also, if you Install a disk while this virus is going, it will just copy itself back to the disk - which is why I had to wipe it from memory in VirusX 1.2... When VirusX finds this virus on a disk, it will also display a "Copy Count" which is the number of disks that have been infected by that "Branch" on the "Tree" that the virus is on - If you infect a disk with your copy, and your copy is number 300, then that copy will be #301. If he infects somebody, that will be #302, but on YOUR copy, two infectations down the line, there will be another #302... Anyways, the copy count on MY Byte Bandit virus is #879... Note that VirusX will check RAM for this virus as well as the disk. This was necessary as you can tell from the description above. Special thanks must go here to Dave Hewett, who, 2 days after I gave him a copy of the virus, gave me a printed, commented disassembly of the virus with meaningful labels and everything I needed to stomp it - Thanks Dave! Thanks must also go to Bruce Dawson of CygnusSoft Software, who went to the trouble of being the First person to send me this Virus. (As of yet, he's also the ONLY person - Geez, folks, I need YOUR help to do this too, eh?) - VirusX 1.4 Notes: - New to this version of VirusX: 1: Seek-out-and-destroy the new 'Revenge' virus. 2: Allow viewing of the ASCII stuff in the boot block 3: Notify the user and remove the SCA virus from RAM. "The Revenge Virus" ---------------------- This version of VirusX was released mainly to deal with the "Revenge" Virus. This virus is not yet common in North America (I think I'm the first person here to have a copy of it), but it is apparently making the rounds in Sweden and Germany, so that's who this version of VirusX is more or less directed to (I'm sure we'll get that virus over here soon enough!) What this virus does, is everything that the Byte Bandit virus does, PLUS, after infecting a disk, it will wait one minute after every reboot, and change your mouse pointer into an image of a certain part of the Male anatomy. 8-) I think the reason this virus is called the "Revenge" virus is because it looks specifically for the Byte Bandit and for the SCA Virus. If it finds either of these, it Rigs THAT virus so that it will CRASH the machine unless THIS virus is loaded first. Note that I might be wrong about this - that's the way it looks from the disassembly, but I don't have an SCA virus here to test it with. I tried it with the Byte Bandit, and it didn't seem to do anything like this - but be warned,in case it pops up later or something. End - PLEASE WRITE TO STEVE AND GIVE HIM YOUR OWN VIEWS.