[comp.binaries.atari.st] v15i007: protect6 -- Virus detect/kill program

koreth@twitterpater.eng.sun.com (Steven Grimm) (06/06/91)

Submitted-by: larserio@ifi.uio.no (LarsErikOsterud)
Posting-number: Volume 15, Issue 7
Archive-name: protect6

Protect6 - The resident bootsector/linkvirus detect/kill program
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
OK, so the first version of Protect6 didn't stop all the link-
viruses :-(   Because of some strange features in the GEMDOS
it is possible to WRITE data to a file that i OPENed as READ ONLY.
This should give an error from GEMDOS, but it doesn't.  Some link-
viruses opens the program file from READ ONLY and then use WRITE.
(does Atari Corp have a comment on why this is possible !!!????)
As the first version of Protect6 checked for OPENing of a program
file for READ & WRITE or WRITE ONLY these viruses get passed it.

Well, this new version of Protect6 (check your date) uses a 
completly different way of checking things.  I also removed
the XBRA stuff.  Why?  Well, any virus could use the XBRA stuff
to un-hook Protect6 from the OS-vectors and disable Protect6 !

 Lars-Erik  /  ABK-BBS +47 2132659  /   ____ ______ ________________________
  Osterud  /  larserio@ifi.uio.no  /   /___    /            The norwegian ST
__________/ ______________________/   ____/   /   Klubben,  user association


table
 !"#$%&'()*+,-./0123456789:;<=>?
@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_
begin 644 protect6.lzh
M(LXM;&@Q+<4$  "+!@  8X"^%B  #%!23U1%0U0V+E!21[ 4]FFQF'DO)@FPz
M!C<%V+=A9KK?N[(?*[':KJ.<7%<OD4O><9[NLC0[5U5B#9$LN@1RG:HNV]QTy
M%O'[QF7#FW:F./Y.Y\S:D7 D1 C^#:;#NJU>]\ I&*C:O9A%Q<H.=5[VJ8Y[x
M$$"[_=4@)AOFS6/4?4M%=>)K-;R24*9>56*?FN2YY6V,J]<:>AVQ7%& J!FLw
M$^52F_5'MX= DRY+\,1_5/P5NGM!!K- &:$ >==G]9S(X'LI$%Q_70 \J_S-v
M"P> >710'F<.>OOXD5B:<KT%1NR \ NL6+Z2Q$5X!EG28YE1,'ND7W 3_F[^u
MDJKHY[>Q&+=/#QZ"8PB!.R_H*?[OE[@%]^;T"L/QPX\)E_S$TY#(X>=Y"$K;t
MVZA5@OIVID;X27V$]@^L!_-HKI4UA#_!,2Q+S5@7\88WP33?QAUC1-SW+',Ds
M=[49U1QZY"KGF61[L&0/M4B?B ,)!R&F&79*B,.BTQ<(IE\L&PFM[AZNY0'Ar
M^\K[)M1/TG/5QU-CK29"$DFF:O=\7TR2/5':1/GGFEL*#5-D?GM61U+09_E"q
MVX;[@6S^*,EHX/G3469K@8FY;RTW+^)/Y#W3U[F[;<"U,,KX)95^HWC!(0W[p
M#*-OM;KL%EW9H^"1Z;,D;_ K:+@XL[9LY^JDZ)"FPQ7.\R0_Q+E2@[7XE7N%o
MCID-K5^; ]P%9NM-!/(&B%:_(O'55U'II+[R(]3_5G$")"OICU:.,1XD\S0Gn
MP-KJFG/Y._IFS. HU*3GD('OH@6\S\V(%L\'78QFLQ=7&X-&S- Y]%K;Y=9^m
M^-]@BMZ/4O^_"!2!-8[>:]EV,0CT[@<O[91$NQ!%>3WP(XNL?VC ?_4BH#1\l
M$[D3- )W=#<Z=W$P3RV]/APJ0A#N7,?:$@#3 _&5U:X"H(> 7:2?/SC7^EK$k
MD=Y*@N=;W<H@Z\FB^_W>NI [86['LMG<7^6;PW<%UKPOOFA0P+AB^&%[=8:Hj
MZ!;\:(@Q8IV8DT#+@VDV7O3K=*'NY"TY3&^CO12WF+&J.4J-PSK-69_C.X^<i
M/?G.=G:O7L.K\US?WI:G2X?_NJFMYB<X5SD_-VT,Q0EW/R<(>+X8$&:B=23:h
M# C[9AAE'O=L'79\%>TOT4UB3=\@6X1GO+5[/),N"74L1"M1#T7K(Q 4MCA@g
M0@$MG.G([76K__657;'*7;)\9=6GPY9<3-JOLCC\@PN-PTH;H@K V=#085=?f
MKP\\ CPC]0=SP]J.*]0H:%L$]]!/B.^9/Z3!IBHX*$F\U/XDSBF(((M%45G\e
MU]/M0/M0N.8!%EC^T8/?M3E.YWD'$VTO8.\%+IE41&9W@"'>;>X#FE^PT"\(d
M>I'62H"Q[J#_3ZH^V,$*$''T/_$!-LUA^%VFO06&6@WNX"VG_\,/XM6'<<P/c
ME ;0_TF:-?QK<?[%RD0E]*UC3*]N[7LH>V\1SMYEK*4WI[SC?Z=3Z/OW8#XGb
M"L9Z'-^59F_D!KJ'^4EMW.%AB?8A^39WOZ9#DQ,,DR=[DW3XW>LMR;4^."-/a
MZR]AHL_'U^]4KF<)\ENRJC';\ V'4(2CI9R+3385Q8:,"9"(9@^I@VWRH*ETz
M3#8?[HD=9/F-[O$%TP?^N /Q5!-<@?',\'/M?!*\$42[#\780'[YB\K0(L8My
M;&@Q+;L'  #1#P  HXV=%@  #%!23U1%0U0V+E185!,^\'T^O_UG\_W[^=_[x
M?S@Q@*[^)>7/CX[H![BO8_7PLX?RI!;X!I [%> 52]"K"I\"'2N3(7=M"N@@w
M]+A6Q?B<FII_&S.6W/@ %M $M*V\."6^]WD9#M==B&TD?UD\^7AL(W@VD.AVv
M=]' JMF=&9^I6KJCW[H[U!6^<(+M;4_=6'[U8HN2,:Y9UETKD;!=5&S3$3%[u
M5!*&!,\4']]'01"O39PRX7$X"*[1A,XGM7F<I+^?L"10*M"TP"D /+KI'_C7t
M+=S ^W&WX^B/]V/<W/7?7I5TA!_L#KC%KRL7D;^>$!L.JD?RR 0YO?FN+F&$s
MKVDK-1,RL+5I[WN]ZR 7"LJ7NU1^7J44-/1GOEUXQ7Q0E^?PK]$UGOXKC3O"r
MHO0W=^]FZA0+.X;?$<@?)$/YTB&L1$M_=N,6?/=+YT#YP%\'EMM(?A:V1^@$q
M0XRX)D13[C[Y<HI-TEZXR>-RY?_L &(OLI1">7T ')Q'(LL863EA=VL,B>C$p
MOA'=$E*,U%P*)UMGL$'(R8W<LLHIC)UP<&JKV9/;(*VOS=WND-YDZOG$#6_\o
MV1!S+:< %D&,K-FFT%SQH@M,LS/I*8-)S!C$!$[]((HX^57<1J2Y-R>9<" On
M8G_T0Z*&18^O40OE#>ZN3#9&Q@Y;H[S:J'LQ5":J:<?K%8TIF!D)IJ<TWLL*m
M*0U*UIU,DP%35$='<DTB:UOT42$:E!*%*!HR1TQ!^RN4<HPLX+CT"KF$U1[Cl
M9A1*)Z*X\JTRFZTQ['D=5\);"T0FN%8@=4(S!-8DAR\>P994"L'CFUCCY%OZk
MHXBQ..@]\=TS-$O3AJ'_HP:LTK897!%KQ :*MS[E8P"9:P; %3;15"AV)1XHj
MPDXA"2JG7Y:1<R:X>&B*<V,K%E7P*/GA(HP73Z8U7.OZ>*MOZG#B"*'?":6Si
MF:V;R\RHU1X@7XGM]_;XO^9A-3_3'^"<,46>.R-ALFQD4REP&>\<*LD46G]Jh
M]OMK&)E/@\/:X-=ZOGCQ!"_\>2B.LQ!\Y_VN@0.96__,^/;I.=7F@7HU8[1Tg
M;AI1=93/?17/&+7)*-4UT/E,:\4WR2O^4[/7A74_I2/AVK6#,[E37W*_%K32f
M#,N\Q\]H,3IL.UE[M]MBY;N6CUAVCPRC?LVE'9-,#2Y4*%%.?(/MV8HFV7?1e
M]R%2A]L[.#:\-ECLN%LU?!?VR]'ZT;>8BC5X:AO1TR[76S9E);E0\[=?)]C>d
M8A^7MTJ1JU[@4Y]-]Q/D<6B%J;_Z*VLJ>+/7XR>R5<T&H[U6TUP%4M?;.? [c
M1V*8K913P"NR\ ![XE%;C&GXM'7$THH<_:J%PAMP$R&'F=>//(M.O[X2[V=Wb
M9O^J7J2O)?SF5PX/]-67V,>UF\7P=OX51[$TU/X=P4^8AV!Y5M#T1;U]:_^Ka
M#T@ !"0A/ZAR=!O&4;CH-;3@V< 3?B/I4JAS,>IDNV;1Z6NW8B9I(HO_J=Q6z
MD3"X4.3F>LE&_H_/FN&DQTZ6[X?YK'MI@/ZG;Y;?B5SRNO:U8Z2C-9(+]CV'y
M_J,8\ ,%]DAK[;&&EGVU"E3I%M OM[6H\7/$-Y*'P,T4Z<X9>A+F-JD[:RO#x
MY;NS1"L->GTO7PVKK<^7[E=0;[ZBB_G 4&+1A.[^][T1H_-,Z.-?2(>ZY>3 w
MKGWC=XWF<^"^G970CZ>K*;IH0SY+KV3P_6G!,-K ALU61C>M&KM'HKHLQI\[v
M#+UL8[.(G@O<.NZ9"-<#V0KG9G[6HZZ;,SBEJM X==H^+2[K\SH,AFX7(##Lu
M_V-3-V[3@=XW,\.M/E;$[HT>:4S)@%A1;%V3Z1H(9\RXQ_UE&5,JB-G5]'9=t
M Q<"A45$XW:W'*X+Z^*-SP"DYE$)5E5UMX$K-%'A<CHBITM!-N9.8M'BJ05Vs
M-[\L6PN&X=!4G:1!\\ZK:8"5A:FN5ZG0DWU)A&C >*^WH\V%.'6KN-.J1@8Hr
MNQ7:RNAA<\F6^U-T'@WWS(K<C=S>AL/+5'*'XD-ID?)_>F5E'4=.HA'\DI^2q
M-0])A*H4^-A(+QR_&!;OUDTRA5HK AP I<-N8D"%_!U3SF9/<)3AW/=S]<[Jp
MA.YW&G$^W5\>N#5\^1C&#$<1YE#X>737]$=7/*E%K&$B!2L3+I)_E>-?&)CLo
MLBAJNH#^,ZU2R;?FD^KQPE$?9L#:31B_6;+T7!P(;\\<0>73C3$G*S)N/-<Gn
MNEZIY$1U=34W"T-/0PMUZV.XP37Z4=&<;.FSZ+0_5GF15U]IMBD53.DD\K%Mm
M3=M$$ID\2WQUL])4<@BJ6U0'E1^5?^(ERP_9%DF9OV#@MZO-FMQE(*F"]YDTl
MT\!>2ZI@J5H/<N[E%?7GHP"2<78YKA"8)8L%W4I(+.&2[=%<OM>12WZWK]B/k
M%E0MX3R\;1UV9K;7UG;,(&BL<_[Q;>3[D_[=3G>YX,US/6IP5[U*")HV7AO0j
MII>S6KZB?5O_[64\)KW1?;=LNJ6*J2O%R+/A,=^GD@%)EIPPFSBDJ.B>]7NIi
M[J6\-,52^D[?U2G<(V9\G7NO">V'>;<U$5^[K$\A3.V7?;@%$O?0?=R\Z_S+h
M;<_?8VN.(#+P5]8 @!&!MP/4, 0&^2,$,"L@./WMS*>_J26@82\7"9&-?_/^g
AJ.=7)I-17-"&:O3)_ B^73W$]]E\C\\C/KX(\T1X\0  f
 e
end