[comp.binaries.amiga] v91i179: VirusMemoryKill 1.00 - tool for detecting new viruses, Part01/01

amiga-request@ab20.larc.nasa.gov (Amiga Sources/Binaries Moderator) (06/15/91)

Submitted-by: ins760z@monu4.cc.monash.edu.au (mr  c.r. hames)
Posting-number: Volume 91, Issue 179
Archive-name: utilities/vmk-1.00/part01

This virus detector does complete checks of all system libraries
devices and resources as well as the regular checks to make it
the best new virus detection program available.

	This utility is different to the previous versions in that it no
longer directly detects any virus.  Instead it is now the most powerful
tool for detecting new viruses.  It checks a heap of things that viruses
use and tells you when they have changed.

	Firstly it checks CoolCapture, ColdCapture, WarmCapture, KickTagPtr
and the KeyboardReset to find anything that is trying to survive reset.  If
any of these are abnormal it will alert you including a display of the area
of memory that they are pointing to.  You can look for words describing was
the thing is and then decide whether to do nothing or do a cold reset(note
this is much more that just a normal reset) which should clear memory of the
virus.

	Secondly it checks the jump tables of all resident libraries, devices
and resources and warns you if any are not pointing to ROM.  It will give
you a message describing what isn't pointing to rom and where it is actually
pointing.  Most systems will get at least a few of these warnings.  Setpatch
causes a few and other legit programs do as well.



# This is a shell archive.
# Remove anything above and including the cut line.
# Then run the rest of the file through 'sh'.
# Unpacked files will be owned by you and have default permissions.
#----cut here-----cut here-----cut here-----cut here----#
#!/bin/sh
# shar: SHell ARchive
# Run the following text through 'sh' to create:
#	vmk100.zuu01
# This archive created: Fri Jun 14 18:02:29 1991
echo "extracting vmk100.zuu01"
sed 's/^X//' << \SHAR_EOF > vmk100.zuu01
Xbegin 644 vmk100.zoo
XM6D]/(#(N,#`@07)C:&EV92X:``#<I\3]*@```-;___\"``$J```````!W*?$X
XM_0(!TP4``'$```#+%F83`/'T!0``8@4```$```````````!V;6L`````````#
XM````"@`0$Z\`````M@%`````0"DC*````0`8,$^@08$##AH4(#``&X4-$:9K?
XMR(8/`#\`,C';U(P%'@`$AN@CX$4$(A)(2`"8E,R)*W_:3`!1L@H`*S,<@JP#H
XMP,6E/T`Z>?IDQ`)`D)$TX````0@,BRD"WJ"0H(%!@*5GZ%D%T,*,.P@2$``"'
XM4("!P"%G!OHR:]2,-@3'!(*A)K+`"*4N^V%3,1-06@"\C@Z`%V:@#Q0N`+@P\
XM`P$Q`!5F%"`68,(,`<<RSN``D5C%&02"Y14&X(RSXL^""0L$9CHS:'T#W(V6!
XMQ9DR:MCL1I,*XBZ`%Y$$2OEDI\2O$Q)`&*@!H)*"&0,@5`0@`8:!<@`A`#BWV
XM$1T`/>1G7"B1=$9%=PEG2(!(CNF%`A))&#/`A&`B`3,(&$`"(`)!BC,&"+9)N
XM&$B`(($9SA06@`Y*&!*>"`R<(0$+3<A!ADO_Z``AAMQX!!)+/FF#G!*JV!09`
XMAGR(8(1/AH#0@`A-G$&`3V+@58>"\)RAPQ/O_`.("$\$DP0$V9C!SQ2(0,`//
XM`#W(`8*"L`@!`0A/*.C,&11069@`'B!P@$#/,0`!5V<($(8!/`(`B!-U(''.>
XM/_[()-(`&TB`C9@`*"`&/A(L"0(#$2AFACU*(0`,``S($0"&.I@`P!E6B`#$L
XM40*88R>>_YB!SR5+#L0`'17(48$0&?0)P`(2!`-'$Q)L\]P$%KGPSS]1(/,/T
XM/:2:&@`4@42AS#_>")'"K"0,00(/!B4H@0A#%'HH`QBZP,0W?_S#IE)S7I$75
XM-L6=X0$+0("@A%(B"("A*2J)X(2',[XDAA*"F`%``+"P28(;`;!@X!DLJ(&`Z
XM6`!\@!P8\F"AB$P0K(`H6P.<89U`"`#(5@)F8`/"&@`X$`8!8$##IIO_P&,"/
XM$KP%H(<(2PR'`@`XE5Q2RB^QL[(9#I0,!<HJ/XH&"43`H`(`$)P!!B7`U$(,D
XM&5HPH(43^0QJ0E6#`-#C/V/D%_6L5),#`@%<``*)(H`L:0`P8O/H(Y5*<B4'M
XM`V&PD#8**!-II)01()M"$.^0%08/GU$)P@"%^2-$FDV),NT#UM;Q@@!9!)$V\
XM"2J)HXH`##U@`$,P,,"0#F4(X(4`$`C3N!KFD/#!Q^<``@Y*(.@`@#YGF"`I?
XM&`A(D0B@2^VI1`1G6(`["&(08#O!XH8!@1GD3'O`HG7`$8#RS+L)##`29``!E
XM!I%M!3P!2H%!@"R/LC/M``.P&88I9U`!LCP4DH"`'?](,8@2V.L#H1DCGP,/I
XM,`WBAR$Q*``"&"1PE`#\H3_'0H@[,"2.`([O`1"2$(:@`:&C`&`1[K/#HESQ+
XM#VA,ZPF)8]<,^`$$@7P#'IJ0@@L"8`(AN((R+GQ,#%T00QD8P0T"4,$-`2`%`
XM!KB!.=IIPXS<T0\5+$$?`#```X.0CZL()!+H^`<[0(`&D%0!$4Z`@Q.@<9!-5
XMS&`&;;!"&N10ASDTH0QM6$(:V,`&$%@A!BZ``0Q`D`H0#`$-<DC#'$"`A#"T.
XMH0QSV$0;\C2$-["!#$,(`QSH4`<YE`$`A31D(A?9R$=>(0QR:,,D&>E(`*AQ9
XM#&N@0AC.``4ZR,&39<B#%`!9!CH(1`$*L$(3E@`",[RA#FX@`PAVR<M>^O*7-
XMP`RF,(?YR\1<I0!EZ,&\'H,,*#AR#GMD0A&,0`40M.&6<R@#\.I`!SJ\P0T@J
XM\*8=G\`$(H!`"D680A&H@((AL*$,F$R!"W8IA20<`0G5%"<1G@`")SQ!?4EP3
XMPA&,&;\@7$$',8#!"V2@4!K00*$QJ(%"9;D$`*PAE6)X`R;)X`(RE,$.:1C#^
XM(\GPACFX@`UI$(,<,)D'`*3!#8Q,`QW2\,V3IG2E<FBI008@#X2H`R(\1<A.T
XM(C(0>00$W*?$_0(!_@T``!H&``#+%C6*)']`#```Y`<```$```````````!6H
XM34LN9&]C````````"@`0;:D`````M@%`````0"DC*```%21(8"6-G#IS0#0I0
XMT^:-G#P@EJ1APP:$E1@N8(!(!6((&CEI$B()TZ;,'!<@0,2`00<-""5UW)0!5
XMD0.C`H$HI!1ILE-($2DA0+AY`\*.080@QH1QD_0-'(AIZ,PIP\8,"#I$PX"XC
XM`Y).F19PY+SQ.L8K&1!D0JYQD>)F`BIH0H*H0V=B5*@)TYHQ4T9.&3=TKA)M,
XM.3-L&:-OD-KI.R?-&S<)TS!M&29P5*%O%+!Y?*8O6H-ERK*!2*8,6:D@ED(T8
XM>O!DRB20O88Y>UGNT#M7T<QL."<PG#=W^IJIPT8!UC<5S3A$:SIT73=GA);!O
XMS1JA290@D@0>HWO,FH1:=8>!`^*-U9:2SR2D'+CZU#D*K*=V<]8KQ81Y$F_58
XM/5DW1#1A+)84@-"5088+;AEA4&^C@7`9=Z%]U]$;R`TQ'AUU^,7"A&R082$<R
XM&&H(PA5AR-'&AR&6L:%$WE$1QAE0T"&'`DO5IUM$9>0AQALEDB&%2:8)!H(9%
XMDIVE&GK0Y5:9@^L]E)Z0<V1HE(!^344'=DF80:,;$)F7&Y"I^96:&$.9&$9%,
XME]TQ445G]A58?G4XZ,88;-215I):I34''&R$T>5Y-Y981A@*>%E20P\I&1AAB
XM$`D*PF^2/1<=5MAEH9]23&WVQAI#+G>'0V3D9=(8((GQY!UAP$=8;D_*5>.7%
XM3)4V1AJE[6>:;G((20910R$9W7*[IM94AR!4:1H*O99A7%R1)=1&'=R!@.A,;
XM[(&@!D*!:55F&V<6"R0=*>R71K1SH)$8L70.FNNA#OWYI0+N(2C0%*$]1D:#,
XM#W8GX:K7MD$>'6&(P89)Y5EU9D55TOI78&RD(88<):9ATH:E&36&25N>565B=
XM<EP,'GU;E0@9"'`Z:#"78<[4ZZ-O1/HD5B!(\4036`:F)D4@G)'&8@J4K%5);
XM<\SQXDRES4&JPZ<":-D<;IS@6\N`O4R46&W,=]8=N,Y4&WAEU7%P'@I`&C5T?
XMV#7Q1F\@S)%';PPE='-%G67+\*!H:\47;EX2-E7(<KB1GFL@T$L'')5QIX!2A
XMUH$WY'16ET=8K@/K[)M89T#<1EY9N4T5&_(J8,034H``11%/0,%$$2,B\00(%
XM1#SAQ`E4@%"%$T3\-`450=`.0A`C@DY$=KLW$7@0623AQ!$ZM.`67'*%]4;EK
XM)#%95%\0D86&WTI5E$1JE9<QDQAT"=N93!!79%VNF%J+K0(`"EA;?V48E#;`7
XM<F`(1PM3Q5''7Q<WWNNXU+H1T(36F<@$1F>+`5R6EI6C`2VE,XTK6?O^XC0'>
XM%N@L<,J5VMA6M;A]"01]\@K:Q&"2P!2D-0J0"$7Z@H(GR$11`XH0?CCVF3E(Z
XMZ%5$&M@<PO6J@S#E,C"#D'?*$[X,*F"#7FE#YX)P.BE080H@H`(2@A"[(.BDV
XM(T&HPA2*\#LA9`$$ISM"$F('!9D=00I!:,(4W`*%@:5*96.9R1S>4!(0ED%RW
XMCZ*<Y=RVIJ2$03YMJM])W"(X*!3.);E"P14<L@82SLDE&)E!4]K`+9`I)U<Q<
XM>($,I'7'`:6!/(G;2E1<@D8BM"4!*4FE*E/BD0<2;%5C0`X9E`*B#)4!00DHA
XMI04+&)%QK<%%,)+1310P!:S``0Y/"L+`!/D"$O7M;S!T%.*F<A8Q0"1REW$>8
XM]"Z7/+=8*D[IZXU3A!5(.KP`5<],DC5SMK.7W6@X.)OF3/(6J&7202!8&Y=+0
XMY$)"M"F,4`KH9$I:0`(8Q*`(*(`>'.(RAI,T[&$ERD,*>D`"&UCTHA8-:'12#
XMPJ)?OBA&<J#H#49*TI%Z\U)+F=\XM5+.<XKL2>M$H#MG`L^*R%.4+4G,HG0C@
XMD,THI2Z/*=@'RRFN:,EE*K$$63\M4QJ`"A0$!#4H0A7*4(<Z#&(/:8M`ONE',
XMIHB3/"RUITO3&9V8MC-)UT+;JHIV-!`YABGT5%8"XIH:>Q9UG^NYT:?DX,^F=
XMWN2I'04F2#6:2A2L(4<[ZI$+*@9`K=ZD"@0L@PXLTH0E0%4I=743?`32@C&(6
XM,IZR]):54(">A)3K7&=90Q]54Y2C),0,5.,DHB3*6:V\35IA."P(KQK1%S#6[
XM8R_86(8\QC>_02<R@,F*/>&#RI2HJ26R;5<-^>2GSA4!#R3A$\&\9)UN*L`*4
XME;WL0'80LV_-,$.XY8YDY!@&OHPF!"$02`+(BX(IF(LXJ>UC[K[HGB'%EEU9<
XMO0EX+1O8C\IHOH$S)GB6.R:=?K#`P4SD%/QD,I+I1SX0(X-6!]S+%ADXI`6%7
XM@8AA<`,1([B83LFK'.$0FC00R;-$75)I0?B&G[Y5ON,%02>S%+,@_.Y,J%I;2
XM:@(CM#KZM#)OG<O>HB+@\*)@5U:%:%9/;,RZ5@2=QE7/"\H)GAV%;ZUGVZV4W
XMP?9=)T/9!0_%JD2A6M"#)A1B"QU7E-6<`@0/!2UA-@&.!V)GHD3UH#F#<U4S[
XM*\AA*H#')2,2R+3%N/Y.!61`?(-WBP`23C'A#8NA3QC04)PIN&$\!#I,&=2@Q
XM$A@H@`8WD(%&H,#7>Q+A+]R2PQH,+80\J$@@'@&)2$A",!0$P0YAF$C`!M:IE
XM7+$V"&U(PQELRTBM)@`V7NF;:720`&MZ)0]`6.@;_I(&/+@`#G40@POJ4`<7J
XMO$$/+O@CCB4SAQO8``9Z`$)#W%`'&KA@#&-PP;Q3A087&*C<?P0!"F*0@YJ4]
XMQPVC<;:"=N6$:2=@!CJPP0QF\((9U&`&"@@(W*?$_0(!&A```$X.``#*%DVH3
XMPRF?`@``S`$```$```````````!634LN:6YF````````$P`0/>D)`%9-2RYI+
XM;F9O````M@%`````0"DC*```QT$`$`"`08,A`$@`T`1`!P`%``P@>`#1``H'9
XM,VK<F'&`OP.%T,')".A@28XH,S;D`$!`RUDX)F8T4#)`(`'_X!D\@$VBP0`X:
XM)8(#X"%CP7PZ.03H>3"`/G!\?C(%P"^`/'Q-L?W;^J\?SI,!_`T(Y@^`5V`&<
XM_?#\!X@?F#``MCX*,`P;OZ8>R@8+UP\;&`A0W.00$"P>-X,]/6`-]N<?6H-?&
XM^,%`]Z>3#GPZ#\3#ALQ+#WR#@/T;@'88-PYX/A`<4!(8`@Y\=&%!!">=`+0,@
XM_*##D/$F@QY#`6#`DXT4DG!_'AOD;?!/L(T80/!#6\%E1A[!"5H'P`-'=%X1.
XM^H5PR>.A<*,Z'IP4#L0@C`'9#6;@B@]H2@`/`,!(N6``?7\/_#,.5P"LA])-N
XM&B1P"!!1P`,('C3<E]$#_F'EAT;^_8./8QL=L&$XX@"@`TL'?1#/,?_XP-$!J
XM__P`"!@IC7%,61N-\`@_.-S%0S\]Q#,4.!ORD]Q&`7"E(CR!5(#/73_\T]@\Z
XM*#4)B(O\]&/E70=,B4]955YIT(;_W+415UL!PT\PQ2P9%YG*'<35,?``T64_J
XM=_WS##\8<*C1/P@<E(`.8[R0Q!AON($%``$!W*?$_0(`````````````````X
XF````````````````````````````````````````````````_(,`_
X``
Xend
Xsize 4178
SHAR_EOF
echo "End of archive"
exit
-- 
Mail submissions (sources or binaries) to <amiga@uunet.uu.net>.
Mail comments to the moderator at <amiga-request@uunet.uu.net>.
Post requests for sources, and general discussion to comp.sys.amiga.misc.