[comp.virus] Checksums/reboots

padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson) (11/16/90)

Herbert Lin writes
>I'm looking for a virus checker for an IBM PC that has the following
>characteristics:
>- -- Not memory resident, and so does not check for infections in real
:time
>- -- runs any program I call after first checking a checksum or CRC
>against a pre-stored library (and warning me if a difference is
>found).
>- -- user-adjusted formula for checksumming
>- -- will calculate
>checksums for me.

Some time ago I wrote a .COM file to do this. 1100 bytes & took about
2 hours using MASM (I'm slow). You give it a file name & it generates
a checksum. You give it a filename & checksum and it checks the file.
Runs at about 50k/second on a 4.77 mhz machine. Generates an
errorlevel of 0 if passes and 1 if fails. Put it in a batch file & it
will check files (or itself) then run the executable. Write it
yourself and you can use your own seed/ algorithm. Use interrupt 21 fn
3d, 3e, 3f, & 4c. For speed, read in 2k chunks.

As an option, you could use fn 4B to launch the program if it verifies
& you gave it a signature (or be really cute and use Int 2E).

Good for things like the Jerusalem/Sunday but it will not detect 4096,
Whale, or other "stealth" infections when they are resident.

Incidently, re reboots: do remember seeing some original PCs exhibit
this behaviour when an undersized power supply warmed up. The 5v
supply dropped below what the unit could run on and they would reboot.
Just a possibility.