[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference hydra::amiga_v1

Title:AMIGA NOTES
Notice:Join us in the *NEW* conference - HYDRA::AMIGA_V2
Moderator:HYDRA::MOORE
Created:Sat Apr 26 1986
Last Modified:Wed Feb 05 1992
Last Successful Update:Fri Jun 06 1997
Number of topics:5378
Total number of notes:38326

3444.0. "Help! Cure is worse than Virus" by CADSE::TERELLA (Mike Terella (DTN)287-3083 CTC2-1/C14) Tue Feb 06 1990 08:55


	Well, I did it again. As my wife says, "couldn't leave well enough 
	alone". (I hate it when she does that!)

	The other day I picked up in one of the more recent notes that a 
	newer version (than I had) of VirusX was available [Virusx4].  
	Liking to keep things current I downloaded and installed it on the
	HD last night.  VirusX immediately informed me that I had run
	an application which had been infected with the new Xeno (sp?)
	virus.   Great! Just what I needed at 11:30 p.m.  The "last 
	minute" documentation recommends that if this Virus shows up, you
	should run the KV application against any executable you might have 
	used recently (like everything in C:), as it spreads "like wildfire".

	So I gave KV a shot. KV indicated that it "found and disabled" the
	virus in about 99.5% of the ARP commands in my C directory, and in 
    	about 75% of all the other executables on my hard disk!

	At this point (about 12:30) I thankfully though I had rid my Ami of
	this virus, but wanted to check things out just to be sure.  No such
	luck!  Guru's on bootup every time. Warm or cold.  Breaking into the 
	startup, and probing around for about another hour didn't yield any
	positive results. 

	I haven't isolated the call that leads to the error, but before I 
	spend the enire evening hunting and replacing things, does anyone 
    	have any suggestions on where do start?  Has anyone else seen this 
    	problem.  Any help will be greatly appreciated!

						thanks,	Mike
T.RTitleUserPersonal
Name
DateLines
3444.1Not big help, but ....EEMELI::LINDENTue Feb 06 1990 11:5815
    re: .0
    
    To me it looks like you have some programs (possible in C: directory)
    being corrupted by that XENO so that even KV nor VIRUSX4.0 can't cure
    it's data back to normal. And every time you run the program it starts
    normally but then crashes and causes GURU.
    
    Another reason might be that some of your devices or libraries are
    corrupted. If one of your devices or libraries is corrupted the result
    is more likely an GURU.
    
    I haven't heard/seen that Virus could have spread to those, but on the 
    otherhand it could be possible (those are programs too!).
    
    -Kari-
3444.2no help at all, but . . .LEVERS::MEYERDave MeyerTue Feb 06 1990 20:255
    Given the course of events my first suspicion would be that Virusx4
    was the cause of the problem. No, I don't mean that it wasn't able
    to fix infected files, I mean that it IS the infection. If you can
    get up and running again you might want to do some testing on "known
    good" files and see what it says - and does. Then pass the word.
3444.3System's up, but...CADSE::TERELLAMike Terella (DTN)287-3083 CTC2-1/C14Wed Feb 07 1990 09:0327
    
    The good news is the system's up and running.  I didn't take the time
    to isolate the specific command that wasn't working, I just booted of
    the floppy and then replaced all the commands in the HD's C: .  I also 
    ran KV against everything else and it "appears" I,ve "disabled" Xeno.
    (KV can't remove it yet).  I will try to install ARP again, though I'm 
    going to dump it into a temporary directory and check it out first.
    
    The BAD news is that I started going through my backup floppies. These
    haven't been on my system since I initially loaded them. Running KV 
    indicated many of the applications were infected.  We're talking things like
    Arc, Lharc, Zoo, Warp, SID, Handshake, IconMaster, ARP etc.  As mine is a
    fairly new machine, I know exactly where everything came from, and if
    it wasn't commercial SW, it was from a download. It turns out that VirusX 
    was also infected, though that doesn't mean it was the source. Just 
    running it on an infected system would spread the infection.  
    
    Has anyone else run into this, or looked?  I'd be willing to bet there 
    are a LOT of systems out there that are also infected, assuming others 
    download software acquired from the enet.  
    
    Does anyone know if this is really a problem?  It's certainly not clear
    to me what the purpose or intent of Xeno is, although it's hard for me
    tobelieve it's "perfectly" harmless.  Has anyone read anything about this 
    on any BBS?
    
    
3444.4Where's KVENOVAX::BARRETTThe optical mouse that roaredWed Feb 07 1990 09:576
    If I'm being dumb bear with me, but where does one get KV? I don't
    remember it being "bundled" in with VirusX4.0? I assume that VirusX
    can't check a program unless you execute it and I'm not crazy about
    running everything I own.
    
    							Thanks
3444.5Location of KVCADSE::TERELLAMike Terella (DTN)287-3083 CTC2-1/C14Wed Feb 07 1990 10:556
    
    re .4
    
    	Sorry I didn't specify.  the KV ececutable and documentation are
    	in KV.LZH, which is inside VirusX4.LZH (i.e. an archive within
    	an archive). 
3444.6BOMBE::MOOREBaN CaSe_sEnSiTiVe iDeNtIfIeRs!Wed Feb 07 1990 23:266
    There was some discussion of this virus in the current(?) issue of
    Amazing Computing/Amiga magazine.  Seems their companion disks for
    the last couple of issues (w/code & programs featured in the mag)
    were shipped with a Xeno virus infection.  They mentioned another
    virus killer program in addition to VirusX/KV, sorry I don't remember
    what it was called...
3444.7check every now and againUBEAUT::MANDERSONMonday oneday, Tuesday the nextThu Feb 08 1990 18:3427
    Hi,
    
    Last week my amiga was playing up and not power up booting properly. I
    suspected the gvp setup and checked the plugs etc etc. (Quarter)Backed
    up , reformat and restores (most but not all) of the files. Runs fine.
    With the recent talk (here) of virus's and there effect on booting
    (hmmmm - similar to what I had happening...) I decided to check around.
    I have Virusx4 in startup-sequence so its always there - I figured I
    had no virus's. So last night I ran KV, Zerovirus and xenozap on a heap
    of my disks (HD included). ICONX had the LAMER II virus and I can't
    remember ever running that exe... I suspect it had to come via the fish
    disks. Virusx4 caught LAMER II on a graphics demo disk I once inserted
    - so installed and killed that one. 

    Neither caused any problems - more interest at how they got there.
    Maybe last weeks HD boot problems were the LAMER II virus (although
    knowing how the hardware sounds on power on I still suspect the gvp..).
    Who knows, its apparently not on my system now so no problem.

    I figure before I do backups from now on I will run all the virus
    checkers I can so I know I have good backups. I am going to make a
    bootable quarterback and antivirus disks and do backups from that. 

have a good weekend.
regards
k
    
3444.8off to find zerovirus and xenozapNAC::BRANNONvalue addedFri Feb 09 1990 14:595
    hmm... I too was just having virusx4 in my startup.  Sounds like I need
    to do a bit of virus hunting this weekend.
    
    thanks,
    dennis