160 lines
5.8 KiB
Plaintext
160 lines
5.8 KiB
Plaintext
From: Chip Welch (chipw@pro-newfrontier.UUCP)
|
|
Subject: Virus Detection Program
|
|
Newsgroups: comp.sys.apple
|
|
Date: 1988-07-28 17:34:43 PST
|
|
|
|
Here is a Virus detection program that just appeared on GEnie. It will scan
|
|
all SYS programs on a disk and check for the CyberAIDS/Festering Hate virus.
|
|
|
|
------------Applesoft Program follows:-----------------
|
|
|
|
100 REM This program detects ProDOS 8 SYS files
|
|
101 REM that have been infected with the
|
|
102 REM viruses known as:
|
|
105 REM * CyberAIDS
|
|
106 REM * Festering Hate
|
|
120 REM
|
|
121 REM If you find an infected program in your
|
|
122 REM library, the safest thing to do is to
|
|
123 REM delete it and replace it with an
|
|
124 REM uninfected back up.
|
|
130 REM
|
|
131 REM Written by Tom Weishaar, July 1988
|
|
132 REM Inspiration by Dennis Doms and Eric Mueller
|
|
133 REM
|
|
900 D$ = CHR$ (4)
|
|
910 DIM F$(300,1)
|
|
1000 TEXT : HOME : PRINT CHR$ (21)
|
|
1001 INVRSE
|
|
1002 PRINT ": APPLE II VIRUS SCANNER: V 1.0 :"
|
|
1003 NORMAL
|
|
1004 PRINT
|
|
1005 PRINT " COPYRIGHT 1988 BY"
|
|
1006 PRINT " TOM WEISHAAR, OPEN-APPLE/GENIE"
|
|
1007 PRINT
|
|
1008 PRINT "FOR THE LATEST VERSION OF THIS PROGRAM,"
|
|
1009 PRINT "CHECK OUT CAT 40 IN GENIE'S A2 LIBRARY."
|
|
1010 PRINT
|
|
1011 PRINT "FREEWARE: MAY BE COPIED AND DISTRIBUTED"
|
|
1012 PRINT " AS LONG AS NO MODIFICATIONS ARE MADE."
|
|
1013 PRINT
|
|
1014 PRINT " PRESS <RETURN> ALONE TO QUIT."
|
|
1015 PRINT : PRINT : PRINT
|
|
1020 REM get slot
|
|
1021 PRINT "SCAN DISK DEVICE IN WHICH SLOT? ";
|
|
1022 INPUT "";S$: IF S$ = "" THEN PRINT D$;"BYE"
|
|
1023 S = VAL (S$):
|
|
1024 IF S < 1 OR S > 7 THEN PRINT CHR$ (7): GOTO 1020
|
|
1040 REM get drive
|
|
1041 PRINT " IN WHICH DRIVE? ";
|
|
1042 INPUT "";DR$: IF DR$ = "" THEN 1020
|
|
1043 D = VAL (DR$):
|
|
1044 IF D < 1 OR D > 2 THEN PRINT CHR$ (7): GOTO 1040
|
|
1100 REM start disk scan
|
|
1110 ONERR GOTO 1190
|
|
1120 PRINT D$;"PREFIX,S";S;",D";D
|
|
1121 PRINT D$;"PREFIX"
|
|
1122 INPUT F$: GOSUB 4000:F$(0,0) = F$:F$(0,1) = "DIR"
|
|
1123 POKE 216,0
|
|
1130 PRINT : PRINT "CHECKING ";F$(0,0)
|
|
1131 PRINT "THIS MAY TAKE AWHILE....": PRINT
|
|
1140 PRINT D$;"BLOAD ";F$(0,0);",TDIR,A$300,B511,L1"
|
|
1141 IF PEEK (768) = 0 THEN 1150
|
|
1142 PRINT "CAUTION: VIRUS COUNTER ON THIS DISK="; PEEK (768)
|
|
1150 REM clear F$(x,x) array
|
|
1151 FPNT = 1
|
|
1152 IF F$(FPNT,1) = "" THEN GOTO 1154
|
|
1153 F$(FPNT,1) = "":FPNT = FPNT + 1: GOTO 1152
|
|
1154 FPNT = 0:DIRPNT = 1:NSYS = 0: GOTO 1200
|
|
1190 REM handle no device connected error
|
|
1191 IF PEEK (222) < > 3 AND PEEK (222) < > 8 THEN 9900
|
|
1192 CALL - 3288
|
|
1193 PRINT CHR$ (7)
|
|
1194 IF PEEK (222) = 3 THEN PRINT "NO DEVICE AT SLOT ";S;", DRIVE ";D
|
|
1195 IF PEEK (222) = 8 THEN PRINT "I/O ERROR AT SLOT ";S;", DRIVE ";D
|
|
1196 PRINT
|
|
1197 POKE 216,0: GOTO 1020
|
|
1200 REM main loop
|
|
1210 IF F$(FPNT,1) = "DIR" THEN GOSUB 2000:FPNT = FPNT + 1: GOTO 1210
|
|
1220 IF F$(FPNT,1) = "SYS" THEN GOSUB 3000:FPNT = FPNT + 1: GOTO 1210
|
|
1230 PRINT : IF NSYS THEN M$ = "MORE "
|
|
1240 PRINT "NO ";M$;"SYS FILES ON THIS DISK. ";
|
|
1250 M$ = ""
|
|
1260 INPUT "";A$
|
|
1270 GOTO 1000
|
|
2000 REM search a directory for DIR and SYS files
|
|
2010 ONERR GOTO 2900
|
|
2011 PRINT D$;"OPEN ";F$(FPNT,0);" ,TDIR"
|
|
2012 PRINT D$;"READ ";F$(FPNT,0)
|
|
2013 INPUT F$: IF LEN (F$) < 40 THEN 2013
|
|
2014 INPUT F$
|
|
2100 REM search directory loop
|
|
2110 INPUT F$: ON F$ = "" GOTO 2910
|
|
2111 DIR$ = MID$ (F$,18,3):F$ = MID$ (F$,2,16)
|
|
2112 GOSUB 4000
|
|
2120 F$(DIRPNT,0) = F$(FPNT,0) + "/" + F$
|
|
2130 IF DIR$ = "DIR" THEN F$(DIRPNT,1) = "DIR":DIRPNT = DIRPNT + 1
|
|
2140 IF DIR$ = "SYS" THEN F$(DIRPNT,1) = "SYS":DIRPNT = DIRPNT + 1
|
|
2150 GOTO 2110
|
|
2900 REM handle end-of-file error
|
|
2901 IF PEEK (222) < > 5 THEN 9900
|
|
2902 CALL - 3288
|
|
2910 POKE 216,0
|
|
2911 PRINT D$;"CLOSE"
|
|
2912 RETURN
|
|
3000 REM do virus check on a SYS file
|
|
3005 ONERR GOTO 3900
|
|
3010 PRINT D$;"BLOAD";F$(FPNT,0);",A$300,L6,B0,TSYS"
|
|
3020 DETECT = 1:NSYS = NSYS + 1:TTL = 0
|
|
3030 FOR ADR = 771 TO 773
|
|
3031 :TTL = TTL + PEEK (ADR): IF TTL > 256 THEN TTL = TTL - 256
|
|
3032 NEXT
|
|
3040 IF TTL < > 57 THEN 3700
|
|
3050 ADR = ( PEEK (769) + ( PEEK (770) * 256)) - 8192
|
|
3060 PRINT D$;"BLOAD";F$(FPNT,0);",A$300,L4,B";ADR;",TSYS"
|
|
3070 IF PEEK (768) < > 32 THEN DETECT = 0
|
|
3071 IF PEEK (769) < > 88 THEN DETECT = 0
|
|
3072 IF PEEK (770) < > 255 THEN DETECT = 0
|
|
3073 IF PEEK (771) < > 186 THEN DETECT = 0
|
|
3690 ON DETECT GOTO 3800
|
|
3700 REM no virus in this file
|
|
3710 PRINT "OK: ";F$(FPNT,0)
|
|
3720 POKE 216,0: RETURN
|
|
3800 REM file appears infected
|
|
3810 DCNT = DCNT + 1
|
|
3820 PRINT CHR$ (7)
|
|
3822 PRINT F$(FPNT,0);" APPEARS INFECTED."
|
|
3825 PRINT " DELETE IT? (Y/N) ";
|
|
3830 GET A$: PRINT A$: PRINT
|
|
3840 IF A$ = "Y" OR A$ = "y" THEN GOSUB 3860
|
|
3850 POKE 216,0: RETURN
|
|
3860 REM delete current file
|
|
3870 PRINT D$;"UNLOCK";F$(FPNT,0)
|
|
3880 PRINT D$;"DELETE";F$(FPNT,0)
|
|
3890 RETURN
|
|
3900 REM handle end-of-file error
|
|
3901 IF PEEK (222) < > 5 THEN 9900
|
|
3902 CALL - 3288
|
|
3903 DETECT = 0: GOTO 3200
|
|
4000 REM delete trailing spaces & slash in F$
|
|
4010 FOR I = LEN (F$) TO 2 STEP - 1
|
|
4020 IF MID$ (F$,I,1) = " " OR MID$ (F$,I,1) = "/" THEN F$ = LEFT$ (F$,I
|
|
- 1)
|
|
4030 NEXT
|
|
4040 RETURN
|
|
9900 REM fatal error
|
|
9910 PRINT "ERROR #"; PEEK (222);" IN LINE "; PEEK (218) + PEEK (219) * 256
|
|
9920 END
|
|
|
|
I hope this will help to eliminate the viruses now existing. If you are
|
|
writing programs, you should consider having your finished program check it's
|
|
own End of File marker and notify the user if the length of the program has
|
|
changed. Does anyone have any other suggestions on how to prevent Viruses
|
|
when writing programs?
|
|
|
|
Apple ][ Forever!!!
|
|
UUCP: crash!pro-newfrontier!chipw
|
|
ARPA: crash!pro-newfrontier!chipw@nosc.mil
|
|
INET: chipw@pro-newfrontier.cts.com
|
|
GEnie: C.WELCH3 [Chip]
|