"Give a small boy a hammer and he will find that everything he
encounters needs pounding."
Abraham Kaplan
THE ST'S VIRUS PART XVII
by Richard Karsmakers
Good day to you and welcome to the seventeenth part of this
series. For the first time in about two years, I have bothered to
actually find out just how many times before this column has
appeared, enabling me to proclaim that this is in fact the
seventeenth. Makes one feel old.
Apart from some things that have happened on the field of
viruses on the ST, I'd like to use this column to react to some
of the reviews that my "Ultimate Virus Killer" got in the press
for the last half year or so. I wanted to do this because, some
way or another, reviewers just don't seem to know their stuff
before they start writing down bits about virus killer programs.
Then again, some do, and I'd just like to show off what others
think of my proggy (brag, brag).
More about that later.
New Ultimate Virus Killer version
The latest version of my version killer is now 5.4.
As the previous version was finished ahead of schedule, longer
time was available for this version. I'd like to believe it
shows.
Some last little bugs (mostly cosmetic ones with screen redraw
and alert box handling) were corrected. The bootsector scan code
was optimised to gain yet another speed percentage. A possible
85% speed gain in the link virus partition scan department
through the possibility of selecting 'scan executable files only'
(as link virus practically never spread to non-executable files).
'Now checking for bootsector viruses' message included during
bootsector scan that's automatically performed before scanning a
floppy disk for link viruses. 'Repair BPB' routine now supports
High Density (HD) and Extra High Density (ED) disks. Inverted
values in system status screen are more extensively checked -
"ALERT!!" will appear if a significant chance at virus infection
exists whereas all other (most probably harmless) cases will
remain like they were before (i.e. just inverted). All text put
together in clusters so as to enable instant and quick
translation of the program into any language (contact the
feedback address for translation requests). On the system status
screen, suspicious system variables can be checked deeper (the
values of which should then be written down and sent to us
instead of the actual AUTO folder programs and accessories that
bend them - please mention which program did it). This can be
done by clicking the mouse pointer on the system variable name or
the address behind it. Link viruses 'entire partition' check may
now be interrupted with UNDO and ESCAPE instead of only ESCAPE.
Program now fully ST Book (ST in notebook form) compatible with
full recognition of the ST Book's internal ROM-disk software. C'T
Virus recognition improved.
The program now also recognizes more than 1000 different
bootsectors, and can repair more than 500 of them (two milestones
have been passed)!
New viruses
Yes, a couple of new ones have appeared. Needless to say,
version 5.4 can get rid of all of them without the tiniest wee
bit of sweat - reason the more to get your hands on it.
Descriptions of the new nasty thingies can be found below.
Virus #58
Name: Joe Virus
Discovery date: November 25th 1991 (ACN Software)
Virus can copy to drive(s): Current floppy drive (A or B)
Virus attaches itself to: Hdv_bpb vector
Disks can be immunized against it: Yes (0.W $4E71)
Immunizable with UVK: No
What can happen: When it finds itself with a specific value in
the fourth and fifth byte, it will execute itself again,
probably cluttering up the system
When does that happen: When it finds itself again, and then
every second time
Resetproof: No
Can copy to harddisk: No
Remark: As this virus has no particular characteristics, it was
called "Joe Virus" as I was listening to Jimi Hendrix' "Hey Joe"
when I disassembled it
Virus #59
Name: Directory Waster Virus
Discovery date: Unknown (Michael Schussler)
Virus can copy to drive(s): Current floppy drive (A or B)
Virus attaches itself to: Hdv_bpb vector, resvector; also
undocumented reset-resistant
Disks can be immunized against it: No
Immunizable with UVK: No
What can happen: First twenty tracks of your disk get destroyed
(both side 0 and side 1!)
When does that happen: After each twentieth copy it made of
itself
Resetproof: Yes
Can copy to harddisk: No
Remark: The name is quite improper, as it destroys about 25% of a
disk and not just the directory. Initially, this virus only
installs itself on the standard reset vector. After the first
reset, it bends the hdv_bpb vector and becomes reset-resistant
in the undocumented way
Virus #60
Name: Merlin's Mad Virus
Discovery date: Unknown (Mike Mee)
Virus can copy to drive(s): Not at all
Virus attaches itself to: Nowhere
Disks can be immunized against it: No need to immunize
Immunizable with UVK: Not applicable
What can happen: See the Mad Virus - it does the same things with
the screen and/or makes a sound
When does that happen: When booting with a disk containing this
'virus'
Resetproof: Not applicable (i.e. "no")
Can copy to harddisk: Not applicable
Remark: This is no virus at all, but it has been classified here
as Mike Mee sent it to me who classifies it as a virus in his
"Professional Virus Killer". It was written by Merlin the Welsh
Wizard, and it's TOTALLY HARMLESS. It can not copy itself, and
only fiddles around with the screen
Virus #61
Name: Wolf Virus
Discovery date: February 4th 1991 (Carsten Frischkorn)
Virus can copy to drive(s): Current floppy drive (A or B)
Virus attaches itself to: Bios vector
Disks can be immunized against it: Yes (0.W $EB34)
Immunizable with UVK: No
What can happen: RAM memory amount it halved (this does not imply
you actually LOSE RAM, it just means that it makes the computer
THINK it has less RAM!)
When does that happen: After the eighth generation is found
Resetproof: No
Can copy to harddisk: No
Remark: A rather nasty virus. For starters, it starts off with
the bytes you'd normally find on an MS-DOS disk, i.e. all virus
killers think it's an MS-DOS bootsectors. Second, it fools the
user by putting the message "Kein Virus im bootsector!" on the
screen at booting. This is the boot message of the virus-free
bootsector of the German virus killer "Sagrotan". It de-installs
itself after three infections (i.e. your computer will think
you've got 1/8th of your true RAM memory by then!)
Virus #62
Name: Ghost virus I
Discovery date: October 5th 1991 (Frank Jonkers)
Symptoms: See virus #12 (Ghost Virus), Unfortunately, there is
some corrupted code in the virus copy routine so that it can
cause a disk to be corrupted (the bootsector can be written
wrongly, not corrupting the actual data but making it
inaccessible).
The press
With the re-release of the program (after a certain other
company in England screwing things up a bit), review copies have
been sent out again and a bit of press coverage arose from that.
I am proud to say that the press has unanimously hailed the
program as the best and all that, which really helps me to remain
enthusiastic for constantly upgrading and supporting the program.
ST APPLICATIONS
In the ST Club's "ST Applications", the program got the most
extensive review so far - three full pages with 5 screen shots.
They reviewed version 5.3.
The author of said review mentioned some shortcomings of the
program that I'd like to react to here. He thinks I should work
together more closely with George Woodside and Mike Mee. I really
can't see how I can work together more closely - the only thing
we haven't done is exchanged actual source code and sleep
together! Anyway, the "Ultimate Virus Killer" lacked some
excellent aspects of these two programs, being the ability to
format a disk, the ability to display a disk's data (number of
tracks, sectors, that kind of stuff) and the ability to alter a
disk's serial number. Further, the manual was considered too long
and a quick-starters manual would have to be written for starting
users.
I will now react.
Format: This is possible, actually - be it only from within an
alert box from which you need to write something to disk.
Display a disk's data: This is nice optically, but not of any
use when killing viruses.
Alter a disk's serial number: What for?
Manual too long: It is long and rather too detailed. However, a
'quick starters' option is built in the program with the HELP
screens and all.
Otherwise, though you may think otherwise from the above, the
reviewer considered the "Ultimate Virus Killer" to live up to its
name. It should be in everyone's collection. Support is good,
it's cheap, and the statistics are staggering.
ST FORMAT
A super short review this (of version 5.2), but a good one. The
program got Format Gold, 91% ST Format rating. They consider it
to be the only virus killer you need, which I of course agree
with. They conclude "UVK: AOK 4 U". 'Nuff said.
ATARI ST USER
An entire page here, written by Andrew Wright who called me for
some additional info as well. He reviewed 5.3. Some of the
conclusions here were "a easy-to-use interface and a powerful
set of features for keeping your disk collection nice and clean",
the manual is "very interesting reading" and it's "excellent
value for money" and "The best-informed virus killing program on
the market". He did not mention any negative things so this one
made me extremely happy.
MICRO MART
This is a multi-format magazine that many of you probably
haven't heard of. Some conclusions about version 5.3 are "(the
manual) is very readable and informative - indeed it could have
been published in book form with considerable success", "the
purchaser is assured of both quality and brilliant service", and
"great value indeed". No negative bits here, either.
So far this bit of the most blatant self-ego-increasing
ramblings ever done.
The "Ultimate Virus Killer Book"
Faithful followers of this column may recall me mentioning the
process of writing a book I was in. In previous columns, I was
still searching for people to publish this "Ultimate Virus Killer
Book". With a deep sigh of relief I can proclaim that in the mean
while a publisher has been found. The details have been sorted
out and the first appearance of the book in the stores should be
within a couple of months from the release of this issue of ST
NEWS (somewhere in July, to be more precisely).
The publisher I found is Paul Glover's "ST Club" in England -
the same one that published Andreas Ramos' "Your Second Manual"
that seems to have been consequently taken over by HiSoft.
Needless to say, I am quite proud of the fact that I will
finally have some of my writings available on the market. Even
though the "Ultimate Virus Killer Book" is nothing close to the
fiction side of writing with which I would like to make a career
some day, I still think it's a pretty good read - and at least
the reader will get to know everything he wanted to know about
viruses (but never dared to ask).
The book will be available for £9.95 and will include a full
(extended) manual to the "Ultimate Virus Killer" program. The
program itself, however, needs to be purchased separately (coupon
included in book).
The German version
Previously I also mentioned the fact that I found a company in
Germany to do the "Ultimate Virus Killer" there - IPV GmbH. This
company is really getting goin' now. The program will be supplied
with a 50-page manual there, and the whole thing will be in
German. I bet all you Germans out there like that. It cost me one
helluva lot of programming...
Things seem to be going OK there. When the first money starts
flowing in I'll be even more happy.
That's about it for this time's viral column. I hope to see ya
all again in the eighteenth appearance of this, that should
appear well before the end of the year!
Disclaimer
The text of the articles is identical to the originals like they appeared
in old ST NEWS issues. Please take into consideration that the author(s)
was (were) a lot younger and less responsible back then. So bad jokes,
bad English, youthful arrogance, insults, bravura, over-crediting and
tastelessness should be taken with at least a grain of salt. Any contact
and/or payment information, as well as deadlines/release dates of any
kind should be regarded as outdated. Due to the fact that these pages are
not actually contained in an Atari executable here, references to scroll
texts, featured demo screens and hidden articles may also be irrelevant.