The ST's virus - next part

With a battle cry go forth
Which is give the people what they want
And what the people want
Can only be the senseless slaughter
Of the gutterslime that litters this nation
For cash and prizes
Yes, this is the show where people bet their lives
To win something big
'Cause when your life is shit
Then you haven't got much to loose
On
Slaughterama!
"Heeeeeeeyyy!"
This next pig is guilty of the following
A grimfull about life in which he's been wallowing
Tried to tell us "Give peace a chance"
Make an act to God and you shit in your pants
It's not your imagination
It's not a bad trippie
Yes that's it
It's a very smelly hippy
Oh Mr. Hippy
Nice to meet ya
Hey you got a little shit between your toes
So how are things at the old manure factory
"Hihihihihi"
How's the old .....?
What, she grew another head?
Well, you gotta lay off that LSD ya know
Kinda makes your offspring goofy-looking
So
How do you hide money from a hippy?
Put it under the soap!
I'm sorry but that answer wasn't in time
You're gonna have to put your mouth on this
"Aaaaahh!"
Oh, I blew your head clean off!
Good thing I was such an expert shot
With the national guard
Back in Kent state
I beg for that day
There's nothing like Hippy Hunting
My dad always used to take me along with Lee Harvey Oswald
"Heeeyyyy!"

Alright, we're rocking now
World's biggest hair
World's tightest pants
You have no circulation
But you still can't dance
Fashion is a statement
Sometimes a risk
Every fashion has its fault
But yours is the pits
Always in black
Looks like he's dead
He's the odd fag lying on his death bed
No it's not that
Come out here
Say, what a hairdo
Why it's awfully big
As big as the...the...the Hindenburg
And it will probably go up just as fast
If I put this lighter to it
But no, I'm gonna hold out
And ask you this question:
Whatever happened to Eddie Monster?
I'm looking at him!
Oh Oderus
Help the boy with his hairdo here
Oh!
It's been ripped off!
"Ow!"
You know that's gotta hurt!
Hey
What's all that shit (?) on his face?
Is that a face lift?
"Yaaaarrrgghhhh"
Wow!
He's pulled that face clean off!
"Aaaaaarrrggghhhh!!"
"Yeeeaaahhhhh!"
Help that sod out of here

Gave up pussy
Stopped doing toot
Now you can't wait
To give someone the boot
Elbows and knuckles
All your know-how
Follow the herd
Just another cow
Brain full of shit
Boots full of lead
Straight from Hitler's ass
It's a nazi skinhead!
"Siegheil!"
Oh, Mr. nazi skinhead
How ya doin'
How's the ?? nose?
Still broken?
"Hehehehehe"
Well, it's good to see you're still on the job
You know when you're mugging
Top-show commentators in bathrooms
Always remember to draw those Swastika's
Turning to the right, not to the left
Always to the right
Hey, who do nazi skinheads wear red suspenders anyways?
He doesn't have to tell you!
Time to give this nazi skinhead one more haircut
Real close to the shoulders
Like
Wo!
His head's been decapitated!
Look at all that PSI in his a-word arteries
Wo!
Isn't that fashion or what?
Hahahahahahahaaaaaaa
"Hoooraaaay!"

Well, ladies and gentlemen
That's all for this week
We've killed everybody that's worth killing
Hope you do the same
We'll be back next week with another edition of
Slaughterama
Slaughterama
Slaughterama
It's that show
Slaughterama
Slaughterama
Slaughterama
It's that time again
Slaughterama
Slaughterama
Slaughterama
It's that show
It's gonna make you stand and stare
Slaughterama
Slaughterama
Slaughterama
It's that time again
It's full of people who just don't care
Slaughterama
Slaughterama
Slaughterama
It's that show
I don't feel sorry for them
Slaughterama
Slaughterama
Slaughterama
It's that time again
They chose their own peril in life
Slaughterama
Slaughterama
Slaughterama
It's that show
Slaughterama
Slaughterama
Slaughterama
It's that time again
It's that time again
It's that time again

"Slaughterama" Gwar song lyrics analysed
with considerable assistance of Spaz

THE FOREVER AND EVER CONTINUING STORY OF VIRUSES ON THE ATARI ST
by Richard Karsmakers

Though almost three years have now passed since the first virus
on the Atari ST was actually discovered, the world of viruses on
the ST (and of killing 'em) has been very much alive in recent
times. And yet another milestone was reached in the battle
against them, with the launch of the "Atari ST Virus Killer"
version 4.1, which has been grotesquely rewritten and absurdly
enhanced (so to say).

The version 4.0 screw-up

In the previous issue of ST NEWS (the last one made during its
life), I seem to recall having written something about version
3.9 of the "Atari ST Virus Killer", finished in August of 1989.
Well...quite some things have happened to the program, and one
of those things was that I rewrote most of it, and that I
converted the whole program to GfA Basic version 3.0 rather than
2.0 - with the compiler available and all.
Unlike what GfA Systemtechnik claims, there are a fair couple of
incompatibilities between these two versions, and the bulk of
them is not mentioned in the 'non-compatibility' chapter of the
version 3.0 manual. Many times I would have loved to slam the
whole thing back to the old interpreter version, but this usually
happened at stages when I had just added quite some 3.0-specific
commands and structures.
Cor blimey.
What an annoying thing it was.
So I spent about half a year converting it, and in the end there
were not supposed to be any bugs in it any more. I had added
quite some extra routines (primarily an entirely new and extended
System Status Check Screen), and they all worked fine.
But not on all computers - which I was even more annoyed to find
out as copy after copy of version 4.0 (which it happened to be)
was being returned to my address.
Bombed crashes all the time.
Quite a bad thing, thus. Version 4.0 was just too grotesquely
changed to be without bugs, obviously. Was I lucky that I hadn't
sent it off to England yet, and the complaints came from people
that I had sent it to personally!
Thus endeth the story of version 4.0. It should never have been,
but it was. And now it's no longer.

Version 4.1 - now that's more like it!

"So what," you may want to know, "has actually changed since
version 3.9? What makes 4.1 so bloody grabworthy?"
Nothing tells this better as a small summing-up of facts.

* The program is now entirely written in GfA Basic 3.0.
* The program is now FULLY legal, and should work on all ST, MEGA
ST, STE, and POSSIBLY TT (ST Mode) configurations. TT
compatibility can only fail if GfA Basic is incompatible. I
couldn't check this yet.
* New error handling routine.
* Program checks itself for link virus infection on startup.
* System status check fully re-written, enhanced and optimised.
Checking for virus infection in memory now also possible when
harddisk is attached.
* Enhanced memory management. AVK can now work on machines with
about 200 Kb free memory (though people can then not repair).
* Machine code routines implemented (e.g. for picture decrunch
and color to monochrome conversion - there's now only ONE
picture on the disk, which is also compressed).
* Repair-and recognition statistics have been significantly
increased (EXTREMELY significantly, as a matter of fact!).
* New, faster compression method used (also for picture and data
file!).
* More userfriendly.
* Totally new virustype recognised (non-executable bootsector
virus!!). This is considered to by 100% safe by almost ALL (!!)
other virus killers.
* Much better and more accurate recognition of Rob Northen copy-
protected disks.
* 'Repair Disk' list now allows faster selecting.
* Formatting a disk is now possible before writing a bootfile.

Its main statistics: 533 recognized bootsectors (YEAH! More than
500!), 42 recognized bootsector viruses, 5 recognized
linkviruses, 27 recognized anti-viruses, 45 recognized special
applications and 304 (YEAH! More than 300!) bootsectors can be
repaired.

The 'totally new virustype'

One of the most staggering things to be implemented in the new
version of the killer is the 'totally new virustype': The non-
executable bootsector virus.
To many of you this will sound like some kind of contradictio
interminus - as indeed it did to me when I first heard of it.
But, as it happens, it is possible for bootsector viruses to be
executed without the bootsector actually being executable.
Let me explain.
On startup, the Atari ST TOS loads in the bootsector of the boot
device (floppy-or harddisk) and then looks if its checksum is
$1234. If it is, the bootsector is 'executable' and a JSR (Jump
to SubRoutine) will be done on it. This results in the program
present in the bootsector to be executed (and thus, should a
virus be contained there, in it to be installed).
What happens when the bootsector is NOT executable?
Well. The system has now got the bootsector all ready in memory
at an address present in the system variable _Dskbufp, the disk
buffer. Even though it has not been executed, it is still there.
Next, the system starts to do its undocumented check for reset-
resistant programs, as explained above. And this check also
happens to include the part of memory where the disk buffer is
located - in other words, the part of memory where the bootsector
resides.
First, you should have a look at the following table:

-----------------------------------------------------------------
TOS version: _Dskbufp: Offset off $200 page boundary:
-----------------------------------------------------------------
TOS 1.0 (Old TOS) $167A -$186 off $1800
TOS 1.2 (Blitter TOS) $16DA -$126 off $1800
TOS 1.4 (Rainbow TOS) $181C -$1E4 off $1A00
TOS 1.6 (STE TOS) $181C -$1E4 off $1A00
-----------------------------------------------------------------

In the leftmost column, you will be able to see to which TOS
version the specifications in the other columns apply (other
versions do not exist yet). Next to that, you'll notice a column
called '_Dskbufp'. Here, you see the hexadecimal address of the
disk buffer pointer, as contained in the _Dskbufp system variable
at address $4C6 (longword). The rightmost column gives the result
of a simple bit of mathematics, and thus actually specifies the
offset in the bootsector the longword $12123456 must be on to be
functional for that specific TOS version (just get rid of the
minus sign for that).
Should that magic longword be followed by the appropriate values
at the appropriate offset in the bootsector, this will result in
the program in the bootsector actually being executed. This means
that the virus can be installed without actually being on an
executable bootsector. Due to lack of contiguous space in such a
bootsector, these bootsector viruses often load in some more
sectors which contain the rest of the virus program - which are
stored e.g. in the last FAT-or directory sectors.
Quite a mother f.cker.
This virus type has been designed by a chap called Richez who
lives in Paris, France. He is a free-lance journalist that has
written quite some articles on the subject of viruses - and who
obviously considered his knowledge sufficient to do a virus
himself.

Version 4.2

You guessed it. Due for release later this year is version 4.2,
which results in a version number of 42 if multiplied by 10.
Now what more do you want?
Apart from the fact that it will be the answer to Life, The
Universe, Everything, and Viruses, it will of course also be
pretty damn impressive, extensive,....you know (I'm not really in
a mood to show off my incredible talents, but I suppose you
already guessed that).

The Book

I am at this very moment in the process of writing a book that I
would like to call "The Atari ST Virus Killer Book". A good
friend of mine in England is trying to get it published, and, who
knows, you might see it in a shop near you by the end of the year
or the beginning of next year.
The book will sum up everything there is to know about viruses
on the Atari ST, but will not neglect to tell quite a lot more
that is usually never found in other books on the subject.
Written in a style similar to that found in ST NEWS, the book
should also succeed in capturing instant attention - quite to the
contrary of most other computer books that are a tad (where 'a
tad' can actually be a synonym for 'extremely awfully') boring.
There will be a healthy dose of human interest next to the most
current virus information obtainable.
In short, this book should actually knock everyone off his/her
socks/stockings.

That's it for now.
The mattress is calling faintly, and the call is getting
increasing less so. I think I'll hit the sack.