O NAN AN AtNAxNAhNA|NA킀NA NAlNApNA0NANA킌Np~ANFN" m NZp mN"HA(N`gx m0(HU mN"mN^A("mN$m$$m S mN"m N"m N^ m0(H/$m RD mN"mN^`P/- p mNN??<NN6N "_N"m N^ m0(HU mN"mN^ m0(J@f m "mN^ m NZp mN"HA(N`gx m0(HU mN"mN^A("mN$m$$m S mN"m N"m N^ m0(H/$m RD mN"mN^`P/- p mNN??<NN6N "_N"m N^ m0(HU mN"mN^ m0(J@f m "mN^$m,f`pN"mN$m$pr$mҒ mNTN N6$mh4$mh0g$mh0@ oN$m S mN/$mh0N"_N/ m0(H$mU mN"_N"mN^`P$m S mN/$mh0N"_N/ m0(H$mS mN"_N"mN^``pN"mNJfp ~A톘N:p ~A톞N:p*~AN@$mQ$mtQ`$mRp|N"mN$mh4$mh0f mx$m"mN mNZ`x m  H`. m $mВ @p0(`x m  H`Z Y&g`P m $mВ @ (`$x m  H`,x m  H]m2` NNg NNg NMg` m $mВ @p0(`x m  H` 4Vg` rg g g g g vg 4g Vxg *g .g g 1Ag ?NN,"_N"HA(N/0<5N/Hx/-apJ-YgpF/NfRN6FgA.CRNfgHmRNg JBgBARrN$mQpN0x$m"mN"N`$mRp$m cpNx "mN"/tN,"_N`/pJ-_gpFgNx "mNpЭNFNx"mNx"mN"pN"HAXN/x"mN"pN"_Nx"mN-_gtN,x"mN`Nx"mNx"mN"N /??$m|0N8:&NHN,x"mNx"mN"N /??0-@N8:&NHN,x"mNx"mN"N /??0-:N8:&NHN,x"mNx"mN"N NN,x"mNx"mN"N /?? -xN 8:&NHN,x"mNtN,x"mNARrN$mQpN0x$m"mN"N$mRp$m cpN`8ARrNpN0tN,NpN0tN,NpN0 -xN N,NpN0 <r4<N,NpN00-:NN,NpN00-@NN,NpN0$m|0NN,N-_gpN0tN,N`pN0NNpЭNFN"mN^pN0p mN"HAXN/p mN"_NN-_gpN0tN,N`pN0NNpN$m0g0-B^HH/pJ-`gpJWHHgLP[0<6N/0<N/Hy/-aP[0<7N/0<8N/Hy/-af-YgDP[0<N"HA(N"HA^N"HA(N/0<N/Hy/-aA톤NN쭸NANpJ-agpF"pJ-\gpgN-bgN3`N@-afjP[0<9N0<jN/0<kN/Hy/-a$m UfP]$m Sf$`` pJ-agp/$m SVHHg\N쭸N mNCdN^HmdHy(NN6N "_NJgHmdHy)NN6N "_N/HmdHy*NN6N "_NHmdHy+NN6N "_Ng.P[0<N0<N/0<N/Hy/-a-`gPHmdHy,NN6N "_NJg.P[0<N0<N/0<N/Hy/-aft m  @p0z8->H m؅!H m  @ (0z8->H m؅!H m  @ (z8->H m؅!HRm>`z$mQpm>N` m  @p0/zx$m m؅ 0HWHH/ m  @/(0zx$m m؅ 0HgB m  @/(zx$m m؅ 0HWHHg:Pf$m@(zx$m m؅ 0HSfpJ-fgpVg$mR$m+c$Y-ff~ m  @p0z8->H m؅!H m  @ (0z8->H m؅!H m  @ (z8->H m؅!HRm> md>o;|>N쭸NAN /-Ng JBgPhNQhSm8`Ap /0-tHП @p(`0-tHSApNCpN^ApNNNrA@)p-)??<NMXJo0-tHSApNNCpN^ApNp`NVjPhp-)rAЁN/HyNN6N "_N"m N^A|CvN^A|C탂N^N*N00-8NHyNN6N N`N0HyNN6N N|-kf"N0HyzNN6N N|Np`ApNNNrA@)p-)??<NMXJo0-tHSApNNCpN^ApNp`NVjPhp-)rAЁNp4N/p\NCpN/0-tNN/??p\NCpNN 8:&NN6"ApNT"_N"m N^A|CvN^A|C탂N^N*N00-8NHyNN6N N`N0HyNN6N N|-kf"N0HyzNN6N N|Np`Ap"mN^A."mNf//-Ng N6g PhN`HyNN6N N|-kf8N0HyzNN6N N|Np`v:gv\g`tArNZ`-lgPapApNNNrA@)p-)Ula m$NzA탎C탈N^ m$N`hHyNN6N C탈N^`hHyNN6N C탈N^`JA:C탈N^`؊ m؅!H-gg\0<N/0<N/Hy/-aLP[0<N/0<N/Hy/-a&$m SfNb`0<N0<NCN^0<ANF$m -qg|'NR$m YfN$m Yg$m Sf Nb`n$m Uff m +@HyNN6N CN^+|N-bf@RmBzxp4m>؊ m؅!H-`fa`$m Wf ?<N`-dgF0<mN0<NCN^0<ANF$mNR$m UfNb` m  @p(U^HH/ m  @p(Jgp. m  @p(Jfp. m  @p( Yop. m  @p( Jfp. m  @p( Jfp. m  @p(Jfp. m  @p(Uop. m  @p(JWHHg0<N0<NCN^0<ANF$m-qg|'NR$m `-Yga`:N-bfxP[0<%N0<N/0<N/Hy/-av`j m +@HyNN6N CN^+|N-bf0RmB-`f&a` ?<N`vg\vgvg`-qg|'$m P[0<mN0<N/0<N/Hy/-a$m YfN$m Yg$m SfNb`^$m UfJ m +@HyNN6N CN^+|N-bfRmB-`fa,` ?<NN쭸N m  @p1@N$N쭸NENHxHyNN6N /N$N N,"_N/HxHyNN6N ""_$N$mNN쭸NQqNpNN /??AN 8:&N(/NpNN /??AN &<:<N28:&N\gNprNTN /??AN 8:&N(/NpNN /??AN N8:&N(g`$m&P[0<N"HA(N"HAN"HA(N0<N/0<N0<N/Hy/-aŒPqN쭸NAHNALN-Zg;mJH`;mLHNpNN /??AN 8:&N\/NpNN /??AN &<:<N28:&N(g?-HNN`^E=CN`RE7N`FEgN`:E? N`.E?>N`"E?gN`EAN` EAN`EAN`zvg8vgvgFvg2vgHQt`,$mX m  @0(H_$mВx m!H m$0(H`p m$NNx m!H`p m$N"mPN^ m$  @p(+@$mQ mP r$mЁ/ mP r$mЁ @p/p$mV"-VHHП _$mRp$mc mPNx m!H`vgBvgXQt`"$mB m  @0(H_x m!Hx m 0HJl x mBH m$0(H`p m$NNx m!H`p m$N"mPN^ m$  @p(+@$mQ mP r$mЁ/ mP r$mЁ @p/p$mV"-VHHП _$mRp$mc mPNx m!H`vgBvgXQt`p$m$$mTx mBH m  @p0x m!HBm`Jgv5gv3gv2gv7gv4g v1gv6gv8g&vvg0vjg8v@gBvqgv*gvhgvfgvngvugvagvgv!gvzgvxgvygvwgpJ-tgp`( m$Nz m$0(H` m$Nx m!Hp$m$`p m$N"mPN^ m$  @p+@$mQ mP r$mЁ/ mP r$mЁ @p/p$mV"-VHHП _$mRp$mc mPNx m!Hp$m$` m$Nx m!H`4p m$N"mPN^ m$  @p+@$mQ mP r$mЁ/ mP r$mЁ @p/p$mV"-VHHП _$mRp$mc mPNx m!H` m$  @p`Hx m!4VH`xx m! H`fx m!F'H`Tx m!`H`Bvggvhgvigvjg`(vgvg0vgvgvgjQt`tg m$Nz$m/NvegvtgFvog`VpJ-rgp`bpJ-ngp`N}Pu`Qu`tg`A탔NzA탎NzA.C탎N`g AC탎N^A.C탔N`/x m 0HJWHHgAC탔N^`0-H`zA탔  @prA$m$$m `lEZN`REN`FEvbgvcgF``Jgd``-sfx m 0H`xx mBH`r m$  @p/ m$0(J@^HH"NJnD``*` m$Nz`v@gvwmvzo` m$Nz`A탔NzA탎Nz`v~g`` tg`^`^N쭸NQvQwN-bfpNpJ-Ygp/0-:^HHgaz`D?< m /Bp-)?HxHyNflJBgaƀaRp$mUfRm:`NN쭸NEN mTNzA|"mTN`fD m NZp mTN/p!Np!N"_N`g mT0(HU mTN"mTN^A("m N"m N^p!Np!N"mTN+@pЭ mTN"m N"HA(N"m N^ mT0(H/pЭD mTN"mTN^`p mTNN N6N"m N"m N^ m 0<NXgh-Yg2A("m N"HAN"HA(N0<N"m N^`0A("m N"HAN"HA(N0<N"m N^ mT0(HW mTN"mTN^ mT0(J@f m "mTN^ m NZpJ-ZgpJWHH/0<N"mTNJVHHFg\A("mTN/p mTN0<N^g/-T0<*N/Hx/-a`/-T0<*N/Hy/-a$m Sf $m SgN쭸NA킌Np~ANNJp ~ATNJp~AZNJp~AHNJp~AfNJp~AlNJp~ArNJp~AxNJp ~A~NJp~A툄NJp~A툊NJpd~A톪N:p~AN@p~AN@p~A N@p~A툐NJp~A툖NJp~A톰N:p~A톶N:p~ANVprd~ANV`N @p(r`VHNNuHyNN6N C:N^aN6FV``N @ ($JWHNNu`jNA키N>A킠N>A킜N>A킘N>A킔N>ANANA킐N>p$m?p$m?p$m?p$m?p$m?$m/$m/p$m?NNON N쭸`NAXN Bg mX /?<NNAPR^HNN쭸`NA큠NA큜Npr$m4RҊ@N~$m2HN2-HNJjrN N쭸`>NA큔NA큐N$m?$m8H m/0H mN\N NzHy NMXWHVx|,Nxal|,Nx/ <:Эto|,p-,`hHxHyNN6N /A:r"_$N$mP]`@HxHyNN6N /A:r"_$N$mQx` vgvgBmT;|V;|X;|Z;|\;|^;| `;| b;|d;|f;|h;| j;|!l;|"n;|#p;|$r;|%t;|&v;|'x;|(z;|)|x mT؄1FH0-fHx mT؄1H0-hHx mT؄1H0-jHx mT؄1H0-lHx mT؄1H0-nHx mT؄1H0-pHx mT؄1H0-rHx mT؄1H0-tHx mT؄1H0-vHx mT؄1H0-xHx mT؄1H0-zHx mT؄1H0-|Hx mT؄1H$mQp$mr+Ёx$m mN؄1H$mRp$mc;|H~;|$mQp$mTx$m mf؄1H$mRp$mc;| ;|x mZ؄1Hx mZ؄1Hx mZ؄1 Hx mZ؄1Hx mZ؄1Hx mZ؄1Hx mZ؄1Hx mZ؄1H;|;|;| ;|;|;|;|;|;|;|;|F;|;|;|R;|J;|L;|N;|P;|D$mQp$mXx$m mH؄1H$mRp$mc;|;|;|;|;| ;|,;| ";|$;|&;|(;|;|;|.  b..  zbAPPLICATTXT %aC}"HISTORY TXT ^C(MANUAL TXT F]C_&RESTORE TXT `CgCSEX TXT ^C STATS TXT ^C* IRUSES TXT ^C  LIST OF SPECIAL APPLICATIONS THAT ARE RECOGNIZED The system check status screen figures between brackets comprise the following: 1: Safe (nothing special, standard Atari TOS values) 2: Super Accessory III (Extended accessory) 3: Vreport (Resident virus warning program by C. Frischkorn) 4: Viral (Resident virus warning program by C. Frischkorn) 5: Track Display (display drive/track/time program) 6: Update (resident utility program) 7: Turbo ST (Software blitter, accessory or program) 8: UIS II/III (Alternative 'Universal Item Selector' program) 9: DC Showit (PD demo program version of 'DC DESKTOP') 10: Atari HD Driver (the standard Atari harddisk driver) 11: Vortex HD driver (the standard Vortex harddisk driver) 12: Haboo (Harddisk booster program) 13: RAMdisk (a small resident RAMdisk program from Holland) 14: Mortimer (resident desktop extension program) 15: Turbodos (French Atari hard disk speeder program) 16: Medium Emulator (a Shareware program by Nick West) 17: Epson Printer Adapter (German program on GfA Basic 2.0 disk) 18: N_System 203 (Multi-accessory by Noud v. Kruysbergen) 19: Poolfix 4 (correct version by Claus Brod, orig. by A. Pratt) 20: Sysmon V1.02 (shareware monitor program by K. Isakovic) 21: 5 in 1 RAMdisk (flexible RAMdisk program by Maarten de Rijk) 22: Butler James (alternative Control Panel accessory) 23: Fileselector (alternative fileselector by Martin Patzel) 24: Gemini Shell (shareware desktop alternative) 25: Vdisk (3.4 only?) (PD reset resistant RAMdisk accessory) 26: GfA Immun (GfA Club program) 27: Goodview (PD zoom program by Alexander Beller, big version) 28: Goodlook (PD zoom program by Alexander Beller, small version) 29: Umlaut (PD printer adaption accessory by Henrik Alt) 30: Protect (PD software write protect accessory by Henrik Alt) 31: Anti Virus System (little program by Markus Wicki) 32: Hermes (accessory by Computerware Software) 33: Newbell (gag program by Dan Wilga, Gribnif Software) 34: Luftschlo Winzram-disk (RAMdisk program by Claus Brod) 35: Multi Function accessory (enhanced 'PROTECT'+more, see above) 36: START File Selector (program by Charles F. Johnson) 37: Intersector RAMBaby (RAMdisk accessory by Intersect) 38: STE Fix (STE TOS 1.6 bug fixer program by Atari) 39: Hard Reset (software hard reset program) 40: Pinhead (program by Charles F. Johnson) 41: Protos (maxi-screen program by Application Syst. Heidelberg) 42: Maxidisk (RAMdisk program by Max Bhm) 43: Quick ST (Software blitter program) 44: Automon Switch 45: MCache (Commercial memory cache program by Michtron) 46: NeoDesk 3 (Alternative Desktop by Gribnif Software) 47: Fontloader (Font loader AUTOfolder program by Gribnif Soft) 48: Maccel III (Mouse speeder/screen saver program by Atari) 49: KAOS (inofficial alternative TOS 1.4 version) 50: Chameleon (Accessory-load accessory) 51: Multidesk by Charles F. Johnson (Accessory-load accessory) 52: SI Ramdisk/Printer Spooler (from ST Informer) 53: Little Green File Selector (Alternative fileselector program) 54: ST Lock (Harddisk password/lock program by STRIKE-a-LIGHT) 55: DMC Laserbrain (Laserprinter Epson emulator accessory) 56: NVDI (German Software Blitter Program) 57: MDisk (Flexible RAMdisk accessory by Christoph Strunk) 58: EDisk (RAMdisk program by Volker A. Brandt) 59: ICD Harddisk driver (Harddisk driver of ICD harddisks) 60: Digital Keyklick (Shareware keyclick prg by David Baggett) 61: Mike's Ramdisk (Ramdisk accessory by Michael Vederman) 62: Accent + (PD 1st Word Plus help program by Markus The) 63: Cold Hard Cache (Shareware cache program by Robert Owens III) 64: Hybri-Switch (Reset resistant RAMdisk by J. Eidsvoog et al) 65: Quick Screen (Turbo blitter accessory by Martin Haubner) 66: Hotwire (Program-load-on-key-press program by J. Eidsvoog...) 67: G+Plus (GDOS alternative by J. Eidsvoog & Charles F. Johnson) 68: FormDoIt (Dialog box patch by Dan Wilga) The Bios and Xbios traps are recognised as Fontloader (47) 69: DC Flight (Drive A light indicator thingy by DC Software) 70: FMC (Resident Force Media Change program by Larry McConnell) 71: Sysbeep (Sample-on-ping-sound program by David Thomson) 72: Arcdrive (Space saver/real time ARCer by Phil Stubbington) 73: SysMon (System monitor program by Dan Wilga) 74: Confix 75: Protect 6 (Resident PD protect program by Lars-Erik sterud) 76: Accent (Program by Markus The) 77: ICD Harddisk Driver/Kuma's K-RAM RAMdisk 78: Drive B Simulator (Public Domain program by George Greve) 79: Let 'Em Fly (Shareware alert box enhance prog by O. Scheele) The alternative item selector "Selectric" is also recognized like this 80: Sector Display (Resident program by Red Egg Software) 81: Standard ST Book built-in ROM drive utilities by Atari 82: Mousetricks (Mouse button etc. prog by Jonathan Lawrence) 83: Multi GEM (Software multi-tasking thing by Maxon) 84: VRam (Virtual RAM Driver) 85: Resident ATOM data file depacker routine (by Altair) 86: SD Driver (hard disk driver for the Digital Works Turbofile HD) 87: Data Diet (compression system from Double Click software) 88: Alman HP Desk Jet Screendump Routines 2.0 89: Warp 9 (screen speeder program by Codehead software) 90: Protar hard disk driver 91: Bigmonitor (program for big screens) 92: TOS Fix (various TOS fix programs for TOS 1.04, "Rainbow TOS") 93: Check Open Files 94: Star Struck (screen saver accessory by Tony Sanson) 95: Resident Keyboard Patcher 96: Multi Dialog (program by Helmut Neukirchen) 97: NEC P6 Driver 98: Eickmann Hard Disk Plus Driver 99: Definite File Selector (alternative file selector program) 100: TSB Resident Virus Protector 101: Hisoft File Selector (alternative file selector program by Hisoft) 102: Rubriks Screen Saver (ST Format Coverdisk #42) 103: Auto-Capture (program by Stuart Coates) 104: DC Right DC (program by Double Click Software) 105: Gribnif Sysmon Configuration Program 106: Drive Divertor (program by Stuart Coates) 107: SM Auto Backup (program for ST Plus Magazine, Germany) 108: Hotmouse (program) 109: Turbo RAM Disk 110: Ultra Fast RAM Disk (program by Charles Smeton) 111: Intersector RAM Disk (RAMdisk accessory by Intersect) 112: TOS RAM Disk 113: Qwikdisk (RAMdisk accessory by Link Tomlin) 114: Guardian (resident virus killer program) 115: Norprint (resident program to allow printing of Norwegian chars) 116: N_System Commands (system accessory by Noud van Kruysbergen) 117: Genlock (program for picture on desktop, ST Format cover disk #42) 118: GEM Plus 119: Force Media Change (program by Living software) 120: Harlekin (program by HiSoft) 121: Datalight (resident compression/decompression utility) 122: Regacc (program by Doug Harrison) 123: Codekeys (keyboard shortcut program by Codehead software) 124: ICD Time (time set program by ICD) 125: Trashbak (program by Markus The) 126: Barrel (printer output utility by Moshe Braner) 127: Ivory Dragon Resident Depacker (Public Domain program) 128: DC No Alert (program by Double Click Software) 129: RS232 Enhancement (modem/serial printer enhancement program) 130: Turbo Cache (shareware hard disk speeder by Ralf Biedermann) 131: Metados (program by Atari) 132: MiNT (MiNT Is Now TOS, Multi-tasking kernel by Eric Smith) 133: Crazy Sounds (keyboard bleep redefine program by Maxon) 134: Led Panel (drive indicator program by Christoph Zwerschke) 135: Unsquish TSR (resident "Squish II" decompressor by Trace Tech) 136: Data Rescue (undelete utility by Trace Technologies) 137: Sentry TRS (resident decompressor for the "Sentry" packer) Please also note that the following VIRUSES are identical when recognized in memory: 2 and 17; 8 and 15; 18 and 20; 6 and 11; 12 and 27 and 40 and 46; 31 and 32 and 33; 30 and 34 and 36; Antivirus #4 is recognized as virus 12; Antivirus #6 is recognized as virus 45. Virus 53 is recognized as Antivirus #1. All viruses that only differ in their name due to the added characters (e.g. Mad A and Mad B) are recognized the same. The Claus Brod Harddisk Driver (CBHD, off his "Kleisterscheibe") is recognized as a Standard Atari Harddisk Driver. Certain system variables in standard Atari systems can be indicated to be "KAOS". This is unavoidable due to high similarity. Note to all authors of programs that bend any of the system vectors present in the 'Extensive System Check Screen': Please send me a copy of your program, stating whether it is Public Domain or not, how it should be run, what system requirements there are, as well as a short description. Thanks!  "ULTIMATE VIRUS KILLER" HISTORY AND VERSION NOTES - VERSION 6.0 Remark: All version 2.x UVK versions are Public Domain. Versions 3.x and higher are commercial (i.e. NO PUBLIC DOMAIN!) and may not be copied except for personal backup use. - Version 2.0PRE (December 12th 1987) This version was called "Virus Destruction Utility". This was the first ever version to appear. It was only slightly spread on a meeting of ST Club Eindhoven (Holland), on December 12th 1987. It basically only recognized the "Signum" virus, and did not yet recognize any harmless bootsectors. - Version 2.0GB (December 19th 1987) The first version to strike a larger audience - through Volume 2 Issue 8 of the PD disk magazine "ST NEWS". - Version 2.0NL (January 18th 1988) This version was even more rudimentary than 2.0PRE, and was in fact a very short version of 2.0GB, programmed to be a type-in listing for a Dutch magazine called "Atari ST Nieuws" (Issue 1). It was only meant for very basic 'first aid' conditions!! - Version 2.2GB (January 20th 1988) The first update. Some harmless bootsectors were now also recognized. It was published on the "ST NEWS" Volume 2 Compendium disk. - Version 2.3GB (February 15th 1988) A version that was published along with the disk magazine "ST Info" (Issue 3). Later that day (after sending the program off to the editor of the mag) I received some more bootsectors so that I had to make version 2.4GB one day later. - Version 2.4GB (February 16th 1988) Published on the "ST NEWS" Volume 3 issue 1 disk. Recognized 2 bootsector viruses (Signum and Mad). This version's source was also published, and this resulted in at least three other virus killer versions to be made (one with a basic disk monitor included - by Herman de Vrees - and one with graphics and digitized sound effects - by someone called An Cool of The Carebears). - Version 2.5GB (March 27th 1988) Never commercially available The first version with a largely re-programmed boot sector recognize algorithm. This was never published and remained on my work disk. It was in fact a fore-runner of the first commercial virus killer, but only recognized bootsector viruses (no link-viruses). - Version 3.0GB (April 10th 1988) The first commercial version. It was largely worked over and the major part of its code entirely re-written. This version could now also REPAIR damaged bootsector data disks.  Its main statistics: 46 recognized bootsectors, 2 recognized bootsector viruses, 1 recognized link virus, 33 boot sectors could be repaired. - Version 3.1GB (May 30th 1988) The BPB repair option was included, some bugs removed, code optimized. Its main statistics: 65 recognized bootsectors, 3 recognized bootsector viruses, 1 recognized link virus, 46 boot sectors could be repaired. - Version 3.2GB (September 11th 1988) The first version that was to set the standard. The 'write anti-virus' option was included, and a second linkvirus could now be recognized. Its main statistics: 106 recognized bootsectors, 10 recognized bootsector viruses, 2 recognized link viruses, 71 boot sectors could be repaired. - Version 3.3GB (March 1st 1989) After massive feedback on the 3.2GB version, many more viruses and innocent bootsector could be recognized. This feedback also resulted in some coding improvements such as: Partition scan, help option, and much more. Its main statistics: 176 recognized bootsectors, 18 recognized bootsector viruses, 4 recognized link viruses, 121 boot sectors can be repaired. - Version 3.4GB (April 13th 1989) * There were some bugs left in 3.3, especially in the routine that scanned a whole partition for link-viruses. All known bugs have been removed (quite a lot, it were!). * ALL folders are now scanned, no GfA errors occur anymore. * The whole program is now also 'legally programmed' and does not use those obsolete absolute addresses anymore! * A buffer for unknown bootsectors during one session is also implemented. Its main statistics: 193 recognized bootsectors, 19 recognized bootsector viruses, 5 recognized linkviruses, 136 bootsectors can be repaired. - Version 3.5GB (April 28th 1989) * The final small bugs/inconveniences have been removed. * The check for link-viruses has been completely reprogrammed and viciously optimized so that checking of link-viruses is now 48.1% faster with a Cache- program/FAT optimizer installed and 55.2% faster without one of these in your system. The "UVK" linkvirus checker is now the fastest ever conceived on the ST: Each filecheck takes approximately 0.057 seconds (this value was 0.111 seconds in "UVK" v.3.4, and is 0.075 seconds in the fastest competing viruskiller, programmed in C!)... * The bootsector virus checker is also completely redesigned and reprogrammed, and is now considerably faster as well. * All this reprogramming made sure that the program actually decreased in size for the first time since its first creation... Its main statistics: 204 recognized bootsectors, 20 recognized bootsector viruses, 5 recognized linkviruses, 139 bootsectors can be repaired. - Version 3.6GB (May 28th 1989) Name changed from "Virus Destruction Utility" to "Atari ST Virus Killer", copyright proprietor CRL Plc., England. * Code even more optimized. * Different title graphics. * Heavy anti-virus facilities discarded. * The main program is now also compressed (the original code is 122,271 bytes in length). Its main statistics: 223 recognized bootsectors, 24 recognized bootsector viruses, 5 recognized linkviruses, 151 bootsectors can be repaired. - Version 3.7GB (June 1st 1989) Never commercially available Just some minor code enhancements and increased statistics. * The problems with the software blitter "Turbo ST" in combination with color monitor and the busted screen layout have been solved. * Again, the main code has been compressed. Its main statistics: 227 recognized bootsectors, 26 recognized bootsector viruses, 5 recognized linkviruses, 151 bootsectors can be repaired. - Version 3.8GB (June 14th 1989) Never commercially available Again, the program code has been enhanced and optimized, whereas the statistics have also increased. * The program now also works excellently together with TOS 1.4. * Decompressed program file length is over 135 Kb. Also, some specific changes requested by CRL have been performed. Its main statistics: 235 recognized bootsectors, 26 recognized bootsector viruses, 5 recognized linkviruses, 157 bootsectors can be repaired. - Version 3.9GB (August 31st 1989) * General code and statistics enhancements. * Decompressed program length almost 136 Kb - 42% compressed off. * An unsuspected quantity of little bugs and inconveniences have disappeared. Its main statistics: 265 recognized bootsectors, 27 recognized bootsector viruses, 5 recognized linkviruses, 184 bootsectors can be repaired. - Version 4.0GB (May 24th 1990) Never commercially available It has taken a very long time for this version to be finished, but each and every one of the almost 40 weeks involved have been spent well! * Some last small errors are dismissed. * DTA address determination better. * Compatibility with FAT speeders and cache programs increased. * STE (TOS 1.6) and TOS 1.4 compatibility assured. * Program fully re-written and optimised in GfA Basic 3.07 (including cross- referencing). * Error handling routine included. * Program checks itself for link-virus infection on startup. * Disk immunization method enhanced. * System status check now also includes recognition of vector-bending programs (incl. XBRA structure). * Picture on disk is now compressed and only ONE for both resolutions. * New AntiVirus version writable. * Some useless repairable bootsectors removed (including some by other virus killers). * New bootsector virus type recognised. * Memory management redone (UVK now works on machines with a bit more than 200 Kb free instead of the previous 400 Kb). * System status now gives proper TOS version number (as well as GEMDOS version number). * Manual enhanced and Appendix A fully rewritten (I daresay the clearest and most comprehensive virus recognition-and 'NO PANIC!'-guide yet). * Decompressed program size almost 170 Kb - packed almost 45% off. Its main statistics: 451 recognized bootsectors, 42 recognized bootsector viruses, 5 recognized linkviruses and 262 bootsectors can be repaired. The uncompressed program is over 160 Kb in size. PLEASE NOTE that there has been a 'version 4.0' of this program which was still called "Virus Destruction Utility", and which was programmed at the beginning of 1988 (TWO years before!). This version is extremely OLD, mindstaggeringly BAD, in ONE FILE, was PUBLIC DOMAIN (of some sort) and it is a blatant DEMO! - Version 4.1GB (June 28th 1990) Never commercially available * Manual and program somewhat improved. * Bugs have been repaired (some stupid typos, actually, and a bug involving floppy media change, causing read errors at the link virus check for every second disk), e.g. the ones that caused a crash in System Status Check Screen when no valid application was found on Hdv_bpb or Hdv_rw vectors. * Better Rob Northen Copylock Protection bootsector recognition. * Formatting a disk before writing an bootsector image file to disk is now also possible. * The 'repair' list can now be gone through at steps of ten titles as well. * Program now compressed with new packer (49% of original size left!); data file also packed (47% of original size left!). Its main statistics: 533 recognized bootsectors (YEAH! More than 500!), 42 recognized bootsector viruses, 5 recognized linkviruses, 27 recognized anti- viruses, 45 recognized special applications and 304 (YEAH! More than 300!) bootsectors can be repaired. PLEASE NOTE that there has been a previous version 4.1, which was a blatantly BAD, very OLD demo in ONE part! Thrash it! Throw it away! Do never use it again! It was written somewhere around the summer of 1988. - Version 4.2GB (January 8th 1991) Never commercially available * Wrong recognition of "Dragon's Lair" and "Dragon's Breath" corrected, as well as that of the "MAD" Virus. * Partitions up to 'Z' inclusive can now be checked - which means Atari Metados compatibility. * Text output in the alert boxes has also been tidied up (actual alert box routine made a bit better in an optical way, too), and the alert box options can now also be selected using the cursor arrow keys. * The program is now TT compatible and detects Bigscreens and the KAOSDESK alternative Operating System. * The reset-resistant application check of the system status screen is now written in machine code and thus much faster (no time to make coffee anymore when you happen to have more than 1 Mb of memory). Thanks to Michael Bittner of Thalion Software here. * The Rob Northen Copy Lock recognition is improved. * The VPF calculation is made more accurate and faster. * Picture loading can be skipped by pressing the 'Control' key during booting (until the first alert box occurs). Its main statistics: 666 recognized bootsectors, 45 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses, 50 recognized special applications and 378 bootsectors can be repaired. - Version 4.3GB-4.9GB were never produced. - Version 5.0GB (April 7th 1991) Never commercially available Version number jump to mark a significant change: CRL went broke so copyright proprietor is now Douglas Communications in England - who are, off the record, likely to make a much better job of it than CRL did! The name of the program has not been changed. * Crash at bootup in case of non-presence of data file on disk now alleviated. * Program now only works in DEMO mode when running on an ST emulator called "Medusa" on the Amiga. * One of the new viruses to be included was previously recognised as Antivirus #4 - thus, this antivirus' recognition had to be improved as well. * "Manual linkvirus search"-and "Save .IMG file"-fileselectors now remember the previously used paths. * Startup picture dismissed (thanks for allowing this, Niall!). * Unexecutable/busted BPB bootsectors better recognised. * System Status Screen now also indicates whether GDOS is installed or not. * In the bootsector 'repair' list, a standard immunized disk is now also contained. When written, this will leave the current disk's BPB intact, thus allowing you to forcibly repair bootsectors you don't want (virus free- and MS-DOS bootsectors for example). * Better compression routine used for data file (Pack Ice 2.20). * Main program compressed with other packer since Pack Ice couldn't do it successfully any more. * Many on-their-own bootsectors (bootsector demos and stuff like that, over 20 of them) have been removed from 'repair' and replaced by new game bootsectors and such. * A date/time will be requested upon program start-up in case the date is not valid. Date and time are now also permanently displayed in each alert box. * After the startup 'system status screen', the program refuses to run (and, in fact, resets the system) when a virus is noticed in the system. * Unfortunately, due to increased program size, the program will not be able to load in the data file on 512 Kb machines. To run 100% (including the data file), the program needs about 470 Kb FREE memory (which is impossible on 512 Kb machines...)! Its main statistics: 731 recognized bootsectors (some of the existing ones have been improved), 47 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses, 58 recognized special applications (some existing ones have also been improved) and 392 bootsectors can be repaired. - Version 5.0NL (April 7th 1991) Identical to version 5.0GB apart from the name (which now is "ACN Final Virus Killer") and some texts (which were translated into Dutch). - Version 5.1GB (June 27th 1991) Name changed from "Atari ST Virus Killer" to "Ultimate Virus Killer" for marketing reasons. * The fill factor routine has been fully reprogrammed and now actually indicates something proper. * Extra parameters have been included in the internal program code so that you can now also get rid of MS-DOS/virus free/boot demo/etc. disks. * Fifth Rob Northen Copylock bootsector protection analyser included. * The repair option screen has been entirely replaced by a better version (written by Stefan Posthuma). * TOS version is status display is now in the new, correct Atari format (e.g. 1.04 instead of 1.4). * Non-executable bootsector virus offset included for MEGA STE TOS and TT TOS. * Virus names have been revised. * New Pack Ice routines used on data-and program-file. * Permanent help mode can be toggled on/off by pressing the HELP key to exit a help screen. * Drive B is no longer selectable if not present. * Alert box optics enhanced by means of a reversable line. Its main statistics: 829 recognized bootsectors (some of the existing ones have been improved), 52 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses, 74 recognized special applications (some existing ones have also been improved) and 430 bootsectors can be repaired. - Version 5.1NL (June 27th 1991) Identical to version 5.1GB apart from the name (which now is "ACN Final Virus Killer") and some texts (which were translated into Dutch). - Version 5.0D GB (July 1st 1991) Principally identical to version 5.1GB, but lots of less useful routines were discarded for it to take up less space on the disk for which it was intended: The "ST Format" September 1991 issue cover disk. A pure demo, which is very much limited when compared with the what what the real version can do. Also, this demo version is Public Domain - i.e. you're allowed to spread it as much as possible, and include it on Bulletin Boards and PD Libraries. The version number was decreased for marketing reasons. - Version 5.0D NL (July 1st 1991) Identical to version 5.0 D GB apart from the name (which now is "ACN Final Virus Killer") and some texts (which were translated into Dutch). The version number was decreased for marketing reasons. - Version 5.2GB (August 18th 1991) This version was originally planned for an October release, but due to the expected sales boom in the middle of August (due to the "ST Format" Cover Disk project) it turned out to be handier to have an earlier release. And it's quite a major improvement on the previous one if I may say so. * Due to space problems, the manual has been compressed, for which a separate decompressor is also supplied (this is called "MANUAL.PRG", which decompresses the file "MANUAL.DAT" into another disk file called "MANUAL.TXT"). * Also, a separate program that allows for half meg users to repair bootsectors (doing this from the main program would need 1 meg at the least) has been included. It is called "REPAIR.PRG" (go ahead, praise me on my originality). This was already mentioned in the 5.1 manual, but now it's also actually present. The "UVK" program needs about 545 Kb to run with the data file included - the "REPAIR.PRG" program needs 320 Kb. * Crash when UVK.PAK file not found has been eliminated. * The "Populous Extra Data disk" has been taken out, as this turned out to be a small and harmless part of a Ghost virus (only the first bit, so it could not copy - but booting with the disk may cause a crash), resulting in all new mutant Ghost viruses to be wrongly recognised as a Populous Extra Data disk. This is now totally corrected. The Populous Extra Data disk (as supplied with an issue of "The One" magazine) actually does NOT have an executable bootsector at all. * Many of the internal variables have been optimised and most user input is now done with a neat routine. * Pressing CONTROL while loading causes the UVK.PAK file not to be loaded. * All code transferred to "GfA Basic" 3.6TT. * When a suspected bootsector is found, one can now also have a look at its contents by means of an extra option in the warning alert box, "Look at it". * The bug in the slider of the 'repair' selector (you could not drag it all the way down) is also corrected. * In case you have an Overscan screen, Bigscreen or TT, you might want to test the fact that the program should now support ANY resolution that has at least 640 pixels horizontally. Previously, TT users would have to use ST medium or high resolutions, but they should now be able to use 640*200, 640*400, 640*480 and even 1280*960! Any other big screen resolution should also be catered for, so all screen output should be perfect there. I have not tested it on ANY of these machines, though, so please write if errors occur (there's bound to be a lot). I can take no responsibility for people who bought this version of the virus killer only because they thought it worked on higher resolutions! It should work, but just as well may not as I have NOT tested anything! If you are a reviewer, please refrain from mentioning this higher resolution compatibility (yet)! Its main statistics: 899 recognized bootsectors, 56 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses, 75 recognized special applications and 462 bootsectors can be repaired. - Version 5.2BRD (August 18th 1991) Identical to version 5.2GB apart from some very minor things. This version, however, is marketed in Germany by IPV GmbH. It comes supplied with a printed German manual. - Version 5.3GB (November 17th 1991) There will still some bugs present in version 5.2, even though I originally believed the program would be about full-proof by know. Hardly so, not even after a total of four years of constant development! * So all bugs that were discovered (thanks to many people, especially Douglas Comms customers!) have been removed. * Screen layout on big screens has been improved, and TT compatibility should now be as good as it can possibly get. * Some suggestions have been built in: Automatic bootvirus check when scanning a whole floppy for link viruses, for example. * Better recognition of damaged Bios Parameter Blocks is now assured as well. This version came out about a month too early due to December being an awfully busy month with regard to University and stuff. Hope you don't mind. Its main statistics: 917 recognized bootsectors, 57 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses and 75 recognized special applications. Up to 466 bootsectors can be repaired. - Version 5.3NL (November 17th 1991) Identical to version 5.3GB apart from the name (which now is "ACN Final Virus Killer") and some texts (which were translated into Dutch). Launched first at the HCC Days in Utrecht, The Netherlands. - Version 5.4GB (March 29th 1992) As the previous version was finished ahead of schedule, longer time was available for this version. I'd like to believe it shows. * Some last little bugs (mostly cosmetic ones with screen redraw and alert box handling) were corrected. * The bootsector scan code was optimised to gain yet another speed percentage. * A possible 85% speed gain in the link virus partition scan department through the possibility of selecting 'scan executable files only' (as link virus practically never spread to non-executable files). * 'Now checking for bootsector viruses' message included during bootsector scan that's automatically performed before scanning a floppy disk for link viruses. * 'Repair BPB' routine now supports High Density (HD) and Extra High Density (ED) disks. * Inverted values in system status screen are more extensively checked - "ALERT!!" will appear if a significant chance at virus infection exists whereas all other (most probably harmless) cases will remain like they were before (i.e. just inverted). * All text put together in clusters so as to enable instant and quick translation of the program into any language (contact the feedback address for translation requests). * On the system status screen, suspicious system variables can be checked deeper (the values of which should then be written down and sent to us instead of the actual AUTO folder programs and accessories that bend them - please mention which program did it). This can be done by clicking the mouse pointer on the system variable name or the address behind it. * Link viruses 'entire partition' check may now be interrupted with UNDO and ESCAPE instead of only ESCAPE. * Program now fully ST Book (ST in notebook form) compatible with full recognition of the ST Book's internal ROM-disk software. * C'T Virus recognition improved. Its main statistics: 1045 recognized bootsectors, 62 recognized bootsector viruses, 5 recognized linkviruses, 32 recognized anti-viruses and 81 recognized special applications. Up to 506 bootsectors can be repaired. On March 16th, two somewhat different cut-down demo versions of this were made: 5.4GB D STA for "ST Applications" and 5.4GB D STU for "Atari ST User". - Version 5.4NL (March 29th 1992) Identical to version 5.4GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is now in Dutch. - Version 5.4BRD (March 29th 1992) Identical to version 5.4GB, with the exception of all text output, which is now in German (translations by Egbert Meier of IPV GmbH). - Version 5.5GB (July 4th 1992) The manual was fully rewritten. Lots of inconsequential stuff taken out, revised spelling, new layout, more clear and detailed descriptions of everything (including the antiviruses higher than 9 which I had previously forgot to include). * It can now be used as .TTP file or run with parameters from a command line interpreter (refer to the "WORKING WITH THE ULTIMATE VIRUS KILLER" chapter for details). * Crash while repairing 'general' bootsectors absolved. * Repair screen can now also jump to titles starting with "1" through "9". * Status screen details can now be dumped on screen (by RIGHT mouse button) and on printer (by keeping CONTROL pressed); additional pressing of ALTERNATE will send form feed to printer afterwards. * In any extended alert box, pressing the RIGHT mouse button will activate a pull-down menu for access to desk accessories. This menu is left again by pressing the same RIGHT mouse button. * An ENORMOUS lot of bootsectors have been added, thanks to Mike Mee (cheers man!) * The system status screen now checks XBRA chains as far as possible; keeping CONTROL pressed during analysis will display the XBRA identifier instead of the application number. * Better packer (Altair's "Atom Packer") used on most files and manual (manual decompression programme updated accordingly). Its main statistics: 1205 recognized bootsectors, 66 recognized bootsector viruses, 5 recognized linkviruses, 36 recognized anti-viruses and 89 recognized special applications. Up to 604 bootsectors can be repaired. - Version 5.5NL (July 4th 1992) Identical to version 5.5GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is in Dutch. - Version 5.5BRD (July 4th 1992) Identical to version 5.5GB, with the exception of all text output, which is in German. - Version 5.6BRD (August 19th 1992) This version was specially made for IPV GmbH. It's a German demo version made for the Dsseldorf Atari Messe. It was a cut-down version of version 5.6BRD as it was at that moment. Not to be confused with the REAL version 5.6BRD (see below). - Version 5.6GB (September 29th 1992) The file structure on disk has changed, mainly due to the fact that the "Ultimate Virus Killer" disk is now double-sided, allowing twice as much space. Manual is no longer compressed, and the appendices have been put into separate files: "HISTORY" for the version notes, "APPLICAT" for the resident applications that are recognised, "VIRUSES" for the complete list of all viruses and anti-viruses, and "REPAIR" for the list of bootsectors contained in the internal library that can be repaired. * The link virus scan now also recognizes compressed files if you want to, and can warn when these are found. An option has been added to the Command Line Syntax to allow this to be used from that as well: Parallel to the "-", a "+" may be used to switch on packer information. Do note that, with the packer information switched on, the link virus scan becomes a LOT slower! The extended packer information is always switched on when checking link- viruses manually! * An alert box after disk write accesses has been included, suggesting you to write-protect the disk to minimize the chances of virus infection. * Internal program structure has been optimized so that I can now compile it within about 1 minute - that's 75% faster! * Due to the fact that, on some machines out there, the system status screen tends to crash (totally disabling the use of the "Ultimate Virus Killer"), the initial appearance of this screen can be suppressed by keeping the RIGHT SHIFT key pressed during booting until the first regular alert box appears. * Internal recognition struction optimized (idea by Kai Holst!). * The system status screen now displays XBRA codes by default, if any are found. Pressing CONTROL will only display the usual numbers. * The program no longer hogs all memory (i.e. it does not take up ALL available memory). * Executable MS-DOS disks are now analysed, disabling virus programmers from evading the Virus Probability Factor algorithm by merely giving their virus code certain MS-DOS bootcode characteristics. Normal MS-DOS-compatible disks, such as can be formatted when you have TOS 1.04 or higher, should NOT be executable! * Crash with TOS 1.04 TOS Fixers is corrected (these programs locate themselves in privileged memory; the virus killer tried to access that, which caused bombs). Its main statistics: 1227 recognized bootsectors, 67 recognized bootsector viruses, 5 recognized linkviruses, 37 recognized anti-viruses, 94 recognized resident applications and 31 recognized packer formats. Up to 612 bootsectors can be repaired. PLEASE NOTE: The programs on the "Ultimate Virus Killer" disk are also compressed - so when extended packer info is switched on during link virus scan, these files will trigger 'packer used' warnings as well. Needless to say, there is no need for alarm whatsoever in the cases of these "Ultimate Virus Killer" files when you have legally obtained them, as they have been checked for link virus infection before having been packed. - Version 5.6USA (September 29th 1992) Identical to version 5.6GB, with the exception of the main menu address, the date entry format and selected text changes. Made for distribution by Oregon Research Associates. - Version 5.6NL (September 29th 1992) Identical to version 5.6GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is in Dutch. - Version 5.6BRD (September 29th 1992) Identical to version 5.6GB, with the exception of all text output, which is in German. - Version 5.7GB (January 7th 1993) Some files were added to the disk: * "VKILLER.CPX" is a module for the Atari Control Panel eXtended. Please refer to the separate "CPX.TXT" file for full explanation and all details with regard to this exciting new addition to all English versions of the "Ultimate Virus Killer" package - at no extra cost! All those German reviewers kept on complaining about the fact that the program didn't work as an accessory. Well, so now finally it's here. Well, sortof. The Atari Extended Control Panel is a new version of the old Control Panel accessory. * "YEAH.NIC" is a file containing an icon compatible with Gribnif's "NeoDesk" version 3.x that you can use to designate the "Ultimate Virus Killer" program file with. And finally, ladies and gentlemen, these are the enhancements: * Instead of just allowing you to check entire partitions or single files for link viruses, you can now also opt for an in-between thing that allows a separate folder to be tree-scanned (i.e. with all folders in it). Just select "file or folder" instead of "entire partition" and select the folder you desire to be scanned without actually clicking on a file. Press "OK" in the item selector to start checking, "Cancel" to abort. * Bootsector virus scan speed optimized by 85%, resulting in it being 6.5 times faster, so that the diagnostic routines as such now take up an average of as little as about 0.27 seconds per bootsector (this used to be 1.77 seconds). * On top of that, the recognition data line format is now up to 20% more compact. * Virus Probability Factor calculation is now a whoppin' 17 times faster (!). * Program works on half megabyte machines again (version 5.6, due to a painfully obvious memory RESERVE error, only worked on 1 megabyte or more). * Bug with perpetual loop if 'suspect executable MS-DOS disk found' alleviated. * Zorro Virus recognition improved to include all possible different versions of it (theoretically there can be thousands of different varieties!). * Many internal routines ruthlessly optimized, resulting in about 10% less program size (bringing it back to the approximate size of the version 5.4 program). * Linkvirus check with warnings (the ones that detect compressed programs) now up to 42% faster. * DESKTOP.INF file on disk now switches blitter on (if present, that is). * The repair bootsector selector now has different and more flexible keyboard input - it will scan for the first title matching all the characters you type in sequence, only going back to the usual mode when a nonvalid character is found. If you type "STAND" it will go to the entries starting with "STAND". If you type "STANZ" it will find entries starting with "S", then "ST, then "STA", then "STAN" and then "Z" (as there is no title starting with "STANZ", it will then assume the old search mode and display the first item starting with the first non-valid character - in this case a "Z"). Pressing "Backspace" will cause the buffer to be emptied, so "Backspace"+"G", for example, will at any time jump to the first title starting with a "G" as was the case with previous versions. Note that this has NOT been implemented in the REPAIR.PRG selector in order to preserve memory space. * The system status screen remembers its result values - second and further activations of this screen will be lightning fast. * A large amount of resident applications have been added in the system status screen recognition - and others have been made better. Thanks to Kai Holst there. * This "HISTORY.TXT" file's layout has been enhanced - requested by Kai Holst, the person whose name is mentioned more than mine in this file! * The keys you can press in the system status screen have been changed (again), for the last time. Keeping CONTROL pressed speeds up the output. Keeping ALTERNATE pressed shows only the application ID numbers instead of XBRA codes when found. * System Status Screen speed (with CONTROL pressed) 3 times faster. * The manual was updated - especially the trouble shooting chart and the chapters "SYSTEM STATUS SCREEN" and "WORKING WITH THE UVK". * Check out the end of this file. All speed increases calculated above were performed on a bog-standard ST running at the usual 8 Mhz. Lots of thanks need to go to Stefan Posthuma (mentioned earlier already) and Kai Holst (programmer of the "Antidote" virus killer) who both helped me considerably with ideas for speed increase and further program optimization. Its main statistics: 1326 recognized bootsectors, 68 recognized bootsector viruses, 5 recognized linkviruses, 38 recognized anti-viruses, 119 recognized resident applications and 33 recognized packer formats. Up to 653 bootsectors can be repaired. - Version 5.7D GB Various demo versions have been released as of November 5th 1992, as internal program re-structuring basically allows <100 Kb demo versions to be made within a matter of minutes. A brief date history follows below. November 5th 1992: Merlin PD Library. November 25th 1992: ST Review Coverdisk Demo. - Version 5.7USA (January 7th 1993) Identical to version 5.7GB, with the exception of the main menu address, the date entry format and selected text changes. Made for distribution by Oregon Research Associates. - Version 5.7NL (January 7th 1993) Identical to version 5.7GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is in Dutch. - Version 5.7BRD (January 7th 1993) Identical to version 5.7GB, with the exception of all text output, which is in German. - Version 5.8GB (March 28th 1993) I had never guessed there were things left to be done. As I had a period of heavy University exams prior to the program's release, however, I got sudden amounts of unexpected coding inspiration (this happens often before exams, at least with me). Hence the following additions and bug eliminations. * There were one or two bugs in the previous version. The RIGHT shift key didn't actually skip the system status screen but the LEFT one did. Now this is truly the RIGHT one. The DAY belonging to the current date was wrong. Now it's OK again. * Linkvirus scan is even faster. In version 5.7 there was a small 'bug' in the routine that didn't succeed in speeding up things much. Compared to version 5.6, link virus scan is now over 3 times faster (as opposed to the previous version only being almost 2 times faster). * The program is now finally Falcon compatible. Memory Configuration specification in the system status screen only works on ST, however, as TT and Falcon configurations seem never to have been documented by Atari. Information would be welcome! * Disks that get the '99% safe' message can now also be 'looked at'. If they're almost completely filled with zeroes or another value they need not be sent in for analysis - they're 100% safe then. * Form feed added after bootsector file output to printer. * When the "Ultimate Virus Killer" is used from hard disk, it will keep track of its activities (like total number of sessions, total number of disks checked and viruses killed, that sort of thing). It will store these values in a file called "UKV.HST". The new program file on the disk, "HISTORY.PRG", displays this history file's contents. Make sure the "HISTORY.PRG" file is in the same directory as the "Ultimate Virus Killer" and the "UVK.HST" file! Your display needs to have 80 columns for this program to display things properly. More columns will work too. !! WHENEVER YOU SEND IN (A) DISK(S), PLEASE ADD A COPY OF YOUR "UVK.HST" FILE, CHEERS !! * An optional file has been added, "UVK.CNF". This file may be used to determine which file extensions executable files are allowed to have, which the "Ultimate Virus Killer" needs to know when checking an entire partition (or an entire folder) for link viruses. Please refer to the appropriate part of the manual for further explanation. * Data line format optimized even further! * The Atari Extended Control Panel modules (.CPX files) are executable files that have another structure than other, ordinary program files. Basically they are like regular program files with the different that they have a 512 byte header. When files with a .CPX or .CPZ (disabled .CPX) extension are checked, this header is automatically skipped so that analysis proceeds as usual. The Atari Extended Control Panel is a new version of the old Control Panel accessory. * The program file can be renamed to "UVK_5_8.ACC" in order to be used as an accessory. Some differences: You will have no possibility to vieuw the system status screen and the options with the configuration-and history- files (explained above) are skipped. The options 'look at it' (to look at a bootsector) and 'help' can be selected but have no effect. Make sure the "UVK.PAK" file and the "UVK_5_8.ACC" file are both in the root directory of your boot drive. The boot drive will usually be "C" if you have a hard disk, or "A" if you have none. With bootsector data file loaded, the accessory will take up a bit more than 700 Kb of memory, so it won't work on half meg machines and will barely be useful even on 1 meg. With the bootsector data file not present in the same directory as the accessory, memory consumption will be slightly less than 400 Kb. * The "WACOM" graphics pad is supported now. All mouse input will be replaced by the graphics pad import provided that the "TABLETT.PRG" driver program is found in the same directory as the "Ultimate Virus Killer" program. Do note that the regular mouse is not reacted to then! * Due to something or other, the "Signum D" virus was wrongly recognized. This is now fixed. * Version 1.1 of the "Ultimate Virus Killer" CPX module replaced the old version 1.0. Please refer to the CPX manual for details on the changes. * The English versions now also contain a special half-megabyte version of the virus killer. Its main statistics: 1359 recognized bootsectors, 72 recognized bootsector viruses, 5 recognized linkviruses, 38 recognized anti-viruses, 126 recognized resident applications and 34 recognized packer formats. Up to 658 bootsectors can be repaired. - Version 5.8D GB Demo version creation is still a doddle. Date history follows below. February 26th 1993. - Version 5.8USA (March 28th 1993) Identical to version 5.8GB, with the exception of the main menu address, the date entry format and selected text changes. Made for distribution by Oregon Research Associates. - Version 5.8NL (March 28th 1993) Identical to version 5.8GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is in Dutch. - Version 5.8BRD (March 28th 1993) Identical to version 5.8GB, with the exception of all text output, which is in German. - Version 5.9GB (June 6th 1993) In the previous version there were many things left to be done. Well, it turned out that I had done some things rather improperly. So this version, apart from some new things and improved statistics, basically turned out to be a bug fix. This is also the reason (apart from the sheer pending presence of the summer season) for the earlier release date. * Program can now REALLY be used as an accessory. It worked fine on my system previously, for some reason or other, but usually caused weird messages and sometimes bombed with other people. Accessory operation has a small disadvantage I would like to point out to you: The internal GEM 'out of memory' error (which is a bug inside GEM) normally causes the program to crash and exit, but in accessory mode this locks up the entire system. Only a cold reset will help you then. Depending on the size of your machine's disk cache this will happen when lots of files are being checked for link viruses. * If you had to enter the date and time on medium resolution, the text size was too big which looked sloppy and could hardly be read. This has been fixed. * There was a rather very serious bug (causing bomb crashing) when encountering specific MS-DOS compatible disks that did NOT have a virus on them. The ironic thing was that you could be sure not to have a virus on a disk of which the bootsector caused a crash! Anyway, this bug, which got 'built in' along with the advanced "Beilstein" virus recognition, is fixed now. * A rather rare and subtlely different version of the "Uluru" link virus was discovered. This is now also recognized. Credit for this goes to my dear colleague Chris Brookes. This virus is merely regarded as a different version of the same virus because either version seems to be able to generate the other. * The half megabyte version is now even smaller, with all repair selector routines removed (these were in the separate REPAIR.PRG program for these users anyway). * While formatting a disk, "formatting..." appears on the screen. * The "REPAIR.PRG" program for owners of machines with half a megabyte of memory now no longer supports keyboard control in the alert boxes. The routines had to be removed in order for the ever increasing bootsector data file to fit in half a megabyte. Its main statistics: 1390 recognized bootsectors, 72 recognized bootsector viruses, 5 recognized linkviruses, 38 recognized anti-viruses, 130 recognized resident applications and 36 recognized packer formats. A total of 669 different bootsectors can be repaired. - Version 5.9USA (June 6th 1993) Identical to version 5.9GB, with the exception of the main menu address, the date entry format and selected text changes. Made for distribution by Oregon Research Associates. - Version 5.9NL (June 6th 1993) Identical to version 5.9GB, with the exception of the name ("ACN Final Virus Killer") and all text output, which is in Dutch. - Version 5.9BRD (June 6th 1993) Identical to version 5.9GB, with the exception of all text output, which is in German. - Version 6.0GB (October 3rd 1993) Finally I have spent a lot of time on the program so now it is entirely compatible with GEM. It should work in any resolution as long as it has at least 640 by 200 pixels, with any Operating System (including "MultiTOS"), on any machine, now and in the future. I don't think the program has ever been through so many enhancements and changes from one version to another. Finally, the "Ultimate Virus Killer" is ready for a new era of computing. * All non-GEM routines have been replaced by GEM routines, based on Gregor Duchalski's "Flydials" library (which is a collection of shareware source code routines that I'd advise every serious "GfA Basic" programmer to use). The address to obtain these routines at (they have a shareware registration fee of DM 30,-) is Baueracker 15a, W-44627 Herne, Germany. * The manual has been revamped, mainly adapted to the new GEM things and rephrasing of stuff like "Search'n'Destroy" to "Seek'n'Destroy" and "Repair disks" to "Restore disks". There are many more little changes though, and as a whole it should be easier to understand now. * There was a bug in the BPB repair routine, causing a damaged BPB to be written even after it having been repaired. Now gone. Thanks to Kai "Antidote" Holst for finding this one. * Extended file selector calls are used now when a TOS version of 1.04 or higher is found. * Due to the ultra-comfortable [HELP] key support in the new GEM environment, the so-called permanent help mode has been discontinued. * A new help screen has been added for the system status screen. * The meaning of the [CONTROL] key during system status screen analysis has changed again (and for the absolutely final time): Pressing it will now slow down analysis, and default display speed will be fast. * Thanks to an optimization of the internal algorithms, the extensive system status screen analysis speed has now been increased by 61%, of which 10% are thanks to Martijn Wiedijk. * Function-and cursor-key support exchanged for [ALTERNATE] key shortcuts. * AES (Application Environment Services) version number now also displayed in extensive system check screen. * Link virus scan now up to 74% faster. Thanks to my good friend Kai for the golden tip that took off 55%: Never use any "GfA Basic" commands such as SEEK, OPEN, CLOSE and BGET, but instead use the direct GEMDOS equivalents. One also has to use the DTA buffer instead of LOF(#x). The other 19% were caused by some optimizing of my own. * Bootsector virus scan is now a massive 63% faster. Of these, 15% are due to another tip by Kai: Never use single-character RIGHT$ and LEFT$ but instead use BYTE{} (beware for zero length strings though!). Another 7% are due to the fact that the program no longer uses byte-length compares. The remaining 41% are the result of two rainy days filled with heavy coding and my converting the recognition data line format. The dataline format got 10% smaller, the actual bootsector scan suddenly almost ridiculously fast. For the technically minded among you: All regular string expressions are now stored as CVI and CVL strings of the same (this gave some problems with values of 0, 4, 10, 13 and 34, but I worked a way around not being allowed to use them). It is interesting to note that during one year of development (from version 5.6 to 6.0) the bootsector virus scan speed has decreased from an average of 1.77 to 0.12 seconds of analysis needed per sector, which is a speed increase of over 90%! * The command line syntax didn't support the separate link virus folder scan apart from the single file or whole partition scan. Now it does. * Additionally, you can now also just feed a regular program name (including proper path and such) to the program. If the entire command line as such is found as a file somewhere, all other routines will be bypassed and the program will check that particular file for link viruses. No additional parameters can be passed on. By default the program will wait for a key once finished and will also check for packed file information. This works especially excellently if you have extended desktops such as "NeoDesk". You can then even drag the icon/filename of the file to be checked on the "Ultimate Virus Killer" program icon if you want to. * In certain circumstances the accessory version could crash due to a bug in the internal "GfA Basic" MENU_REGISTER command. This has now been replaced by an own menu register routine. * Although the internal bootsector restore data file depacker routine is still the same (Altair's "Atom" packer version 3.5), the actual program file is now no longer compressed. This uses up some more disk space, of course, but increases compatibility with various configurations, Operating Systems and accessory operation. Please refer to the separate "PACKERS.TXT" file for details of possible packers you can use yourself. * The "Chameleon" accessory is now supported, finally. This is an accessory that can load and unload other accessories - such as the "Ultimate Virus Killer" when it is used as such. "Chameleon" allows for accessories to be loaded from other directories rather than the root directory of your boot drive, which causes problems with most accessories that have to load supplemental files such as a resource file. The "Ultimate Virus Killer", when started as an accessory, will scan all current directories of all valid partitions until it finds the "Ultimate Virus Killer" resource file. Do note that these are all root directories, too, unless you have opened a window to another directory previously! As a rule you should use the GEM desktop to open the window in which all the "Ultimate Virus Killer" files are and after that use "Chameleon" to load the accessory. * In the system status check, both ST and TT RAM types are now supported and recognized, as well as previously wrongly recognized regular ST-type memory configurations (yes, Frank, this is for you!). What can I say? Amazingly, there isn't a *single* book that documents this stuff correctly. Here, thanks go to H.W.A.M. de Beer, author of the most excellent Public Domain "SysInfo" program - he supplied the information and source code necessary for the proper implementation of all this. When running the "Ultimate Virus Killer" with "MultiTOS", due to memory protection stuff the memory amount found may not be correct as Mr. de Beer's routine can then not be used. * The birthday date format has been optimized. Also, 100% of all possible dates have one or several birthdays now. The birthday lister, by the way, will be disabled if you haven't got enough free memory (i.e. on 512 Kb machines). * The "DATA.PAK" datafile is no longer totally decompressed upon loading. Only when a specific bootsector is restored, the appropriate (tiny) part of the data file is decompressed and used. In the current version this saves over 140 Kb of memory, i.e. you now need over 140 Kb less to be able to use the data file than before. * Additionally, it is now possible to use the whole program on half megabyte machines again. You can even restore bootsectors, but this now requires you to locate the "DATA.PAK" on disk so that the program can load and decompress the appropriate part needed. After that you are requested to insert the actual disk so that the program can write the bootsector to disk. You no longer need to have the data file in memory to be able to restore bootsectors, even though having it in memory will prove to be easier, especially when restoring more than one bootsector. * Due to the overall space savings, the accessory version of the "Ultimate Virus Killer" will now use 520 Kb or 340 Kb of RAM, with and without the data file loaded respectively. * The "Ultimate Virus Killer" CPX module has been updated to version 1.3. All speed increases are dedicated to Kai Holst, who has been ruthlessly irritating me for at least a year now with regard to his virus killer being faster than mine. Although he has been driving me out of my mind in the process, if it hadn't been for him the "Ultimate Virus Killer" would still be the ponderous dinosaur it was in the olden days. At least the only thing I could compare, the link virus scan, is now 30% faster than his. This version's main statistics: 1486 recognized bootsectors, 73 recognized bootsector viruses, 5 recognized linkviruses, 40 recognized anti-viruses, 137 recognized resident applications and 43 recognized packer formats. A total of 710 different bootsectors can be repaired. - Version 6.1GB (Approximately January 1994) Or: What may occur in future updates. * When running the "Ultimate Virus Killer" as a desk accessory while using Gribnif's "NeoDesk" (version 3, anyway), the mouse background is buffered incorrectly. This is due to an as yet unexplained anomaly connected with "NeoDesk", and I haven't got a clue as to how to fix this. * When using the "Ultimate Virus Killer" with "MultiTOS", you cannot yet switch between tasks. This may be alleviated soon. Then again, maybe not. * The general statistics will be enhanced as much as they can, and possible bugs will be discarded. Do note: Your suggestions and bug reports WILL be read and ARE taken into consideration! * THIS QUARTER'S MUSICAL SUGGESTIONS * My most spectacular musical discovery of the third quarter of the year is, without a doubt, Rage Against The Machine. Dig it. Also give a listen to Mercyful Fate's "In the Shadows" (their reunion album), Gorefest's "The Eindhoven Insanity" (live), Dream Theater's "Live at the Marquee" and Paradise Lost's "Icon". Some oldies? What about Jimi Hendrix' "Jimi Play Monterey" and Deep Purple's "Made in Japan" (the latter being THE best live album of all times)? And that's it for this version's history bit. B USER MANUAL for the "Ultimate Virus Killer" written by Richard Karsmakers Mark III (rewrite) initiated June 19th 1993 Last change: October 2nd 1993 LIST OF CONTENTS LIST OF CONTENTS DISCLAIMER NOTICE !INTRODUCTION MAKING A BACKUP STARTING THE "ULTIMATE VIRUS KILLER" WORKING WITH THE "ULTIMATE VIRUS KILLER" SEEK'N'DESTROY VIRUSES IMMUNIZE DISKS REPAIR BPB (BIOS PARAMETER BLOCK) BOOTSECTOR VIRUSES !LINK VIRUSES RESTORE DISKS THE SYSTEM STATUS SCREEN #FEEDBACK #CREDITS TROUBLE SHOOTING CHART THE "ULTIMATE VIRUS KILLER" CONFIGURATION FILE THE "ULTIMATE VIRUS KILLER" HISTORY FILE The "Ultimate Virus Killer" programme and manual are copyright (c) 1993 by Douglas Communications 0 DISCLAIMER NOTICE We make no warranties, either expressed or implied, with respect to this manual or with respect to the software described in this manual, its quality, performance, merchantability, or fitness for any particular purpose. The entire risk as to its quality and performance is with the buyer. Should the programme prove defective following its purchase, the buyer assumes the entire cost of all necessary servicing, repair, or correction and any incidental or consequential damages. In no event will we be liable for direct, indirect or consequential damages resulting from any defect in the software. 1 INTRODUCTION Congratulations on your acquisition of the "Ultimate Virus Killer" (or, for short, UVK). This is probably the most versatile and definitive product in the battle against computer viruses on the Atari ST/STE/TT/Falcon; a full- fledged tool that has taken many years of painstaking development already. The main features of this programme are: * Recognition of virtually all software that uses the disk's bootsector * Recognition of ALL known viruses - both bootsector-and link viruses * Option to restore previously damaged software that needs a specific bootsector program * All harmless data on your disks remains 100% intact! * Immunization of disks/files against many bootsector-and link viruses * Option to repair damaged or destroyed BIOS Parameter Blocks * Automatic recognition of any hard-, floppy-and RAM disks that are present * Automatic recognition of all known viruses already present in the computer system * Almost 40 direct on-line, context-sensitive help screens included in the programme, accessible by pressing the [HELP] button * Automatic calculation of a 'Virus Probability Factor' for suspicious/unknown bootsectors * Fast scanning of a whole drive or partition for link viruses. This allows you to scan a full partition or floppy disk for link viruses 'at the touch of a button' * Option to save potential viruses to disk or print them out, to have them analysed by the programme author * Extensive system check; specifies suspicious system variables, scans for reset-proof programmes and checks for viruses in memory - also when a hard disk is attached! * Full compatibility with MEGA ST, MEGA STE, ST, STE and Falcon with a minimum of 512 Kb of RAM, any ROM TOS and any known hard disk driver * Total compatibility with any multi-tasking OS * TT compatibility * Contains fast, compact machine code routines, harnessing the raw processing power of the 680x0 type of processors * Extensive recognition of memory-resident programmes (among which all known viruses...) * Comfortable and easy-to-use mouse/keyboard user interface * Programme checks itself for link virus infection on start-up * Metados compatibility - check up to 26 drives/partitions! * Fully GEMDOS compatible, using dialog boxes and easy GEM conventions With this tool handy, you need never worry about viruses on your computer any more: You can simply use it to de-infect your disks and programmes, destroying the viruses and leaving all other information and data intact. 2 MAKING A BACKUP The "Ultimate Virus Killer" contains no copy-protection, as it is our firm belief that copy protection decreases the userfriendliness of programmes - especially when the programme in question happens to be a utility program such as the "Ultimate Virus Killer". Copying it to others, however, is illegal and depriving me and others from a modest income made by the sales of this product. A UNIQUE LICENCE NUMBER IS CONTAINED IN THE PROGRAMME, SO THAT ILLEGAL COPIES CAN BE TRACED BACK TO THE OFFENDER! THIS IS NOT VISIBLE TO THE USER AND HIDDEN IN THE PROGRAMME CODE! Just use the GEM desktop facilities to copy the files to another disk (or to hard disk) for backup purposes. For the programme to run properly, the "DATA.PAK", "640_200.RSC" (for medium resolution), "640_400.RSC" (for any other resolution) and "UVK_x_x.PRG" files on the original "Ultimate Virus Killer" disk are needed. An optional configuration file may be handy (see the appropriate chapter). If you wish to use the programme as a desk accessory you may rename the "UVK_x_x.PRG" file to "UVK_x_x.ACC" and copy the necessary files to the root directory of your boot drive. Usually this is partition C if you have a hard disk, drive A if you don't. If you are not familiar with the GEM copying conventions, please refer to your computer's user manual. Notes on using the "Ultimate Virus Killer" as an accessory: Usually an accessory is located within the root directory of your boot drive. However, with use of small accessories such as "Chameleon" that can load and unload another accessory it may very well happen that you load an accessory from somewhere else. The "Ultimate Virus Killer" has no problems with that as long as you make sure that the supplemental files are located in the *current* directory of a floppy disk or hard disk partition. This means that you have to open a window to that directory first, *then* use "Chameleon" to load the "Ultimate Virus Killer". If you neglect this, as a rule only the root directories of all your valid partitions will be checked for occurrence of the supplementary files. You can leave away the "DATA.PAK" file when using it as an accessory in order to save memory. If you want to use the "Ultimate Virus Killer" as an accessory on colour monitors, you have to make sure that your system is switched into a proper resolution (NOT low resolution!) before any accessories are loaded. They may be achieved through AUTO folder programs such as "Superboot" and "XBoot" which can leave your system in medium resolution upon leaving. 3 STARTING THE "ULTIMATE VIRUS KILLER" Turn your computer off and on again with the "Ultimate Virus Killer" disk in drive A. After some seconds, a desktop will appear that contains several file names, amongst which is one called "UVK_x_x.PRG" (where "x_x" stands for whatever the current version number is). Double-click on this file with the mouse pointer to load and run it. If you do not want the "DATA.PAK" restore data file to be loaded (which is only needed if you want to restore commercial games or demos that have had the programs on their bootsectors wiped out) you can keep the [CONTROL] key pressed during booting. If you want to skip the start-up system status screen for whatever reason you should keep the [RIGHT SHIFT] key pressed. In case the current system date is not valid (i.e. if the system's internal clock is set to a date before the year and month in which the current "Ultimate Virus Killer" version was finished) you will be requested to enter the date and time before doing anything else. if you do not want to change the time, you may simply leave the time specification unaltered and press [RETURN], [ALTERNATE]-O or click on the "OK" button after having entered the date. The "Ultimate Virus Killer" will present its start-up screen after some more seconds, after which it will be ready to be used. It is advisable to boot your system with the "Ultimate Virus Killer" disk because it contains a virus-free and immunized bootsector. Theoretically, no virus can be present in memory this way (turning your system off and on again assures that no possible reset-resistant viruses survive). Should you want to create another disk to regularly boot your system with, just copy whatever files you want on it, then check it with the "Ultimate Virus Killer", write-protect it and keep it write-protected. KEEP YOUR ORIGINAL "ULTIMATE VIRUS KILLER" DISK WRITE-PROTECTED AT ALL (!!) TIMES! 4 WORKING WITH THE "ULTIMATE VIRUS KILLER" On start-up, a GEM dialog box will appear on the screen. This kind of dialog box will be used throughout the programme and offers some interesting extras when compared to the standard GEM dialog boxes you may be used to. For example, it is not only possible to select your option by clicking the left mouse button on its button, but your selection may also be made by keeping the [ALTERNATE] key pressed and then pressing the alphanumeral that is underlined within the button you want to select. The option that has a thickened frame is the 'default' button, which may be selected additionally by pressing [RETURN] or [ENTER]. Buttons that cannot be selected are represented with a 'greyed out' text and border. Help options, when available, are accessible by clicking on the "HELP" button at the left bottom of a dialog box, or by pressing the [HELP] key on your keyboard. Any button containing a check mark (usually a button containing "NO", "CANCEL" or "QUIT") may additionally be selected by pressing the [UNDO] key on your keyboard. On the right top corner of most dialog boxes you will find a special box (resembling a dog-ear) by means of which it is possible to move the dialog boxes around the screen, providing your screen size allows for this. Moving the dialog boxes around may be done by clicking on the move box, keeping the mouse button pressed, and then dragging the dialog box to wherever you want. These screen positions will be remembered for later occurrences of the dialog box. If your computer doesn't have enough memory (for example if you have only 512 Kb) it may happen that only the smaller dialog boxes have move corners. The bigger ones will then be too big to be moved within your memory limits. Five options are available to you from the main menu dialog box: Seek'n'Destroy Viruses Restore Disks Information about UVK x.x System Status Quit to the Desktop These options, where necessary, will be explained in further chapters. Note on using the "Ultimate Virus Killer" as a .TTP file: The "Ultimate Virus Killer" may be used as .TTP file (for which the "UVK_x_x.PRG" needs to be renamed to "UVK_x_x.TTP"), or similarly from a command line interpreter. This allows for it to receive certain parameters from you or from other programs before it gets started. Although the options offered here are not as extensive as those of the programme in regular mode, they may still be useful. All the options that are on offer here are purely diagnostic - no viruses can be killed, for example! SYNTAX: DESCRIPTION: B X Checks drive "X" for bootsector viruses. L X: Checks the entire partition "X" for link viruses. L E X: Checks the entire partition "X" for link viruses, but only checks executable files. The ":" at the end is important! L X:\PATH\ Checks all files and all files in any folders within the folder "\PATH\" of drive "X" for link viruses. The "\" at the end is important! L X:\PATH\NAME.EXT Checks file "NAME.EXT" in path "\PATH\" of drive "X" for link viruses. "\PATH\" can consist of more than one folder name, divided by "\", to go into deeper subdirectories. X:\PATH\NAME.EXT or NAME.EXT or \PATH\NAME.EXT Alternatively you can feed just a valid file name. It will then be checked for link viruses, with packer info mode on and waiting for a key once finished. In combination with e.g. "NeoDesk" this allows you to check a file for link viruses by dragging its icon on top of the "Ultimate Virus Killer" icon with having to rename the "Ultimate Virus Killer" program file at all. In this mode, none of the parameters specified below may be added. After the initial "L" or "B" a "-" may be added (like for example "L- X:\NAME\NAME.EXT") to suppress you having to press a key when leaving the programme and to prevent the screen from being cleared at start. Likewise, a "+" may be added when doing a link virus scan - to supply you with additional information about whether executable files are packed and, if so, with which packer. A combination of "+" and "-" (to get both suppression of 'waiting for a key' AND extra packer information) is also permitted. In a command line interpreter you could enter "UVK_x_x.PRG L E:\1ST_WORD\WORDPLUS.PRG" for example. For this to work in the standard GEM desktop you would have to enter "L E:\1ST_WORD\WORDPLUS.PRG" in the box that appears on the screen after you have renamed the file to "UVK_x_x.TTP" and double-clicked on the file. In combination with an extended desktop such as "NeoDesk" you can just drag the "WORDPLUS.PRG" icon across (it won't be copied, only the name will be fed to the command line). 5 SEEK'N'DESTROY VIRUSES Following the selection of this option, another dialog box is put on the screen, allowing you to select the drive on which to start seeking'n'destroying viruses. The programme automatically detects any drives that are attached to your system and displays their identifiers in selection buttons. Up to 26 drives/partitions may be selected, with the unavailable drives/partitions being represented in 'greyed-out' text. Please note that bootsector viruses can only be searched (and destroyed) on floppy disk drives - A and B. Selecting drive B is not possible when it is not actually attached. Link viruses can be searched on either floppy-or hard disk (up to and including partition Z). You may select a drive or partition by clicking on its appropriate button with the mouse button or by entering the appropriate keyboard shortcut [ALTERNATE]-key. Once the drive to use is selected, you can decide whether you want to examine your media for bootsector-or link viruses. If you selected bootsector viruses, you will get a prompt to insert the disk you want to check. In case you selected the option to check for the presence of link viruses you will enter some further dialog boxes where you can specify which files you want to check and in what way you want them to be checked. In the first dialog box you will be able to specify whether you want to scan an entire drive or partition (ALL files on a floppy disk or hard disk partition, including those present in all the folders, will be scanned recursively), single files or folders, or whether you want to exit. If you opted for the option to scan single files or folders you can either specify a full filename in the item selector box (in which case only that file will be scanned) or you can specify a folder you want to tree-scan without actually specifying a file (in which case all the files in that specific folder - including all files and further folders present in it - will be scanned). It is important not to select a file name in the latter; just enter the appropriate folder and then click on the item selector box' "OK" button. If you decide to check an entire floppy disk for link viruses the "Ultimate Virus Killer" will also automatically check that disk's bootsector (note: this if for floppy only!). Checking for link viruses on a whole partition or entire folder may be aborted by pressing [ESCAPE] or [UNDO]. When there are many infected files or when you have set "warnings on" and there are many packed files, you may have to press the [ESCAPE] or [UNDO] key a few times. There is one rather important note that applies to bootsector viruses: IT IS POSSIBLE THAT A PERFECTLY HARMLESS DISK IS SUSPECTED OF BEING A VIRUS! This means that either the bootsector of the harmless programme is not yet recognized and not yet implemented in the "Ultimate Virus Killer", or that it is indeed a new virus! Whenever the "Ultimate Virus Killer" encounters such a disk, you will be given the possibility to either REPAIR the disk, PRINT its contents, WRITE A BOOTFILE or LOOK AT IT. In the second and third cases, we would very much like to receive the boot file, that the "Ultimate Virus Killer" can write on a disk with enough space on it (at least 512 bytes free). When you do not have a disk nearby with sufficient space free, you may want to use the FORMAT option that will format a disk (single sided). If you send that disk (or the print-out) to us (together with some written info about the disk it came from and your name and address), we will check it out and send it back as soon as possible provided you have supplied sufficient International Reply Coupons (!). Please make sure the bootfiles are accompanied by sufficient explanation as to what sofware they belong to, for it's usually impossible to determine this information from the bootsector contents and the bootfile file name only. It is likely that the directories of disks that have auto-booting bootsectors on them will appear to be 'empty' or that they seem to have 'corrupted files'. This need not be (and most probably isn't) due to virus infection but to some software protection schemes' exotic disk formats, some of which include there not being any files on the disk at all. IF YOU KNOW THAT THE SUSPECTED DISK CONTAINS NO VIRUS, WE WOULD VERY MUCH LIKE TO RECEIVE IT ANYWAY, BECAUSE OTHER PEOPLE MAY NOT BE AWARE OF IT AND MIGHT ACCIDENTALLY DESTROY THEIR PRECIOUS SOFTWARE!! Please send any disks in a good quality envelope that can also be used for return mailing, and write "CONTAINS MAGNETIC MEDIA - PLEASE DO NOT X-RAY" on it in clear, large characters (to minimize loss of data). Do NOT FORGET TO ADD sufficient International Reply Coupons! Disks without these cannot be sent back! Just before you can select whether to write a boot file or simply to repair, a dialog box will be displayed that tells you the "Virus Probability Factor" (or VPF for short) - the probability factor that the disk that is on the current bootsector is indeed a virus. The reliability of this factor is quite high. The VPF is produced by scanning the code present in the bootsector for some vital virus characteristics: Factor 1: The presence of machine code that is to be found in a routine that writes a sector to disk. Factor 2: The presence of machine code that creates the checksum for an executable bootsector. Factor 3: The presence of magic checksums or memory locations that are needed to make a programme reset-resistant. Factor 4: The presence of the addresses of system variables that viruses can link themselves to. In certain cases, an additional dialog box is produced; this happens when an unknown disk is found to be largely filled with the same value. The larger the percentage mentioned in this dialog box, the less the likelihood of virus infection (quite on the contrary, one might add, to the percentage mentioned with the "Virus Probability Factor" calculation)! Note on executable file extensions: When you want to check a whole partition or folder for link viruses it is possible to select whether you only want executable files to be checked or whether you want this to happen to all files. Executable files are files that can be run from the desktop; other files include text files, picture files, source code files and the like. When selecting to check executable files only, the programme will only check files with extensions ".PRG", ".TOS", ".APP", ".ACC", and ".TTP" (including their disabled counterparts ".PRX" and ".ACX"). These are normally the extensions for executable programmes. Some alternative desktop programmes (such as "NeoDesk") allow other file extensions to be executable, e.g. ".NPG" and ".NTP". To check these as well, you would have to opt for ALL files to be treated, or you will have to configure the UVK.CFG file accordingly (see the appropriate chapter). Note for users of "MultiTOS": This Operating System uses a 'unified drive' (identifier "U:") in which certain folders will cause a crash when checking for link viruses. You should refrain from checking the following directories: "U:\DEV", "U:\PROC", "U:\PIPE" and "U:\SHM". 6 IMMUNIZE DISKS Most of your disks, including those with valuable working material, can be immunized so that they will no more be infected by many of the known bootsector viruses and all anti-viruses. The principle used by the "Ultimate Virus Killer" immunization algorithm is the fact that many known bootsector viruses, when resident in memory, check if they are present on a disk already before they bother copying themselves onto it. If they find themselves present, they do not copy across that particular disk. When the "Ultimate Virus Killer" writes only those few recognition bytes to the bootsector that does the trick: The virus thinks it is present on the disk already and does not copy itself onto it. - Disk immunization will not help against ALL viruses. - Programmes that use the bootsector themselves (like the ones included in the 'RESTORE' list in a text file on the "Ultimate Virus Killer" distribution disk) cannot and should not be immunized as the few bytes necessary for writing the immunization will destroy the boot code program they need to perform properly. - In the text file "VIRUSES.TXT" on your programme disk you will be able to find the specifications of which virus can be immunized with which code. Since certain different viruses use the same bytes on the bootsector with different values to check if they are already present, this means that some viruses can not be immunized against without sacrificing another. Some viruses cannot be immunized against at all as they simply copy themselves across any bootsector without bothering to check their presence prior to  copying. The only way to protect yourself from these types of virus is to keep your disks write-protected. If this is not possible, you will just have to check those disks regularly using the "Ultimate Virus Killer". - On your search for viruses you will undoubtedly come across what the program calls "MS-DOS disks". These are standard disks that, however, have specific values written in their bootsectors so that they may be interchanged between Atari and MS-DOS (i.e. IBM PC and compatible) computers. These disks are formatted automatically when formatting with TOS version 1.04 or up. Whenever you immunize such a disk this so-called 'MS-DOS compatibility' will be lost! It may be best to reserve only a limited amount of disks to exchange files between these two system standards, and to check these regularly for virus infection. 7 REPAIR BIOS PARAMETER BLOCK 7.1 INTRODUCTION Some mutant viruses cause the BIOS Parameter Block (or BPB) to be corrupted. This means that there is no longer any information on the disk's format, stored into the BIOS Parameter Block segment of a disk bootsector, available to the Atari's Operating System. It will no longer be able to determine how many tracks and sectors a disk has, as well as several other vital parameters. Trying to display a directory from such a disk will most likely result in a system hang-up, bomb crash or the appearance of a disk filled with corrupted files and filenames. The "Ultimate Virus Killer" incorporates a semi-intelligent routine that automatically recognizes known mutant virus versions and allows the user to repair the BIOS Parameter Block again in case of it having been damaged after the actual mutant virus has been removed. PLEASE NOTE THAT YOU SHOULD READ THIS SECTION OF THE MANUAL VERY THOROUGHLY BEFORE YOU EVER ATTEMPT TO REPAIR A BIOS PARAMETER BLOCK!! Repairing a BIOS Parameter Block is quite difficult; after all, this small segment of the bootsector determines whether or not your computer can read from or write to individual disks. First, let's supply you with a table that specifies how the BIOS Parameter Block is built up. OFFSET means the value that should be added from the start of the bootsector, starting at zero. The values are in decimal. -N OFFSET: NAME: EXPLANATION: -N 11-12 BPS Bytes per sector 13 SPC Sectors per cluster 14-15 RES Number of reserved sectors 16 FAT Number of FATs on the disk 17-18 DIR Number of directory entries 19-20 SEC Total number of sectors 21 MEDIA Media descriptor byte 22-23 SPF Sectors per FAT entry 24-25 SPT Sectors per track 26-27 SIDES Number of sides 28-29 HID Number of hidden sectors -N It is not necessary for you to know the above table by heart. It was supplied here with the intention to give you some idea of what the BIOS Parameter Block means to the Operating System. Whenever a BPB is destroyed, these essential pieces of information are no longer present (which, as said before, will most likely result in various disk error messages, system crash or a garbage disk directory). First of all, you should know that you should preferably not try out this 'BPB repair' option on original game software, as current-day software protection techniques involve the craziest disk formats that would probably drive the "Ultimate Virus Killer" algorithms nuts! Apart from that, attempting a 'BPB repair' on such a disk may also lead to instant software malfunction. The only option you should ever use in order to restore the contents of original (game or demo-) software disk is the main menu 'restore disks' option. Second, you should also realize that the 'BPB repair' option may not work correctly on disks that have been formatted using 'larger' formats previously. This would for example be the case with a disk that you formatted with 82 tracks some time ago and later decided to reformat with only 80 tracks. Some remnants of the old format still left intact (in this case the tracks above track 80) may be found, disturbing the algorithm. There are two ways to get access to the 'BPB REPAIR' option. The first is the most obvious: Whenever a damaged BIOS Parameter Block is detected (and this does not even need to be the result of a virus) the programme ask whether you want to attempt a BPB repair or not. The second one is also quite obvious: Whenever the 'Seek'n'Destroy' option recognizes a mutant virus on the disk, or whatever remains of it, it will initially remove the virus and then ask you whether you want to attempt a 'BPB repair' or not. Upon your confirmation the 'BPB repair' option will be entered. You need not be worried about inadvertently entering it - after having specified all parameters you can always cancel the whole thing at the end, leaving the current BIOS Parameter Block unaltered. As was stated already, repairing the BIOS Parameter is not only a slightly complicated matter, but it may also prove dangerous insofar that the specification of the wrong parameters it can make whatever is on your disk totally inaccessible. Common symptoms of a disk with inaccessible material on it are the aforementioned crashes, disk errors and disk directories containing only garbage information (huge file sizes, weird file names, invalid dates and times). Therefore you should take care using the 'BPB repair' option. Even if you have already attempted a BIOS Parameter Block repair with wrong parameters there is a way to attempt it again - despite the fact that the disk will now, obviously, have a valid BPB and the 'BPB repair' option will normally no longer be entered. What you would need to do in this case is check the disk's bootsector again and keep the [RIGHT SHIFT] key pressed until the screen flashes briefly. The program will now have forced the BIOS Parameter Block to be invalid again, enabling you to enter the 'BPB repair' option again. The most common mistakes made while repairing a BIOS Parameter block involve the specification of the number of tracks per side and sectors per track, as well as the number of actual sides on a disk. Should you find yourself unable to fix it regardless (or if you simply do not dare to attempt a BPB repair yourself), you can send the disk to the address mentioned in the "FEEDBACK" chapter of this manual. Please add an amount of money that equals the price of an "Ultimate Virus Killer" update and twice the amount of IRCs required. You will receive your disk(s) back after a short time (hopefully). In case of my not being able to repair it either, you will receive your money back (not the IRCs though). Some important notes: - It is important that you do not try to delete files from or write files to disk that have a damaged BIOS Parameter Block. - If you send in disks with BIOS Parameter Blocks that need to be repaired, please clearly state that you want your disk repaired and that you don't want an update! - Whenever you repair the BIOS Parameter Block of a disk it will automatically be immunized. - Attempting a 'BPB repair' on a disk is no cheap way of increasing a disk's storage capacity. Specifying more sides, sectors per tracks or tracks per side than are actually present will cause whatever is on the disk to remain inaccessible. During the 'BPB repair' option some dialog boxes requesting input will be put on the screen. You have to use these to specify BPB values, but do not worry if you do not know anything about this. This part of the manual can be of some help, and you can also use the built-in context-sensitive on-line help options by pressing the [HELP] key. During the 'BPB repair' option you will be requested to specify a number of parameters needed by the "Ultimate Virus Killer" algorithms to write back what was previously the correct BIOS Parameter block for the current disk. 7.2 HOW MANY BYTES PER SECTOR Claus Brod, Atari mass storage media expert and author of probably the best book in this field (called "Scheibenkleister", unfortunately in German), claims that only 512 bytes per sector are possible as TOS (the Operating System within your computer) does not allow for 128, 256 or 1024 BPS on floppy disks. For the sake of compatibility with future TOS versions as well as for the pure sake of completion it is possible to select any of the values here. Unnecessary to say, you will almost certainly have to specify 512 bytes per sector here. 7.3 HOW MANY TRACKS PER SIDE This can vary quite a lot, due to formatting programmes available that allow up to 90(?!?!) tracks per side to be formatted (whether or not these programmes should be used and whether these tracks are safe for data storage will not be discussed here). When requested to specify the number of tracks per side it will be handy to remember if you formatted the disk in the drive using the standard GEM DESKTOP format option or not. If you did, you should select 80. If you did not, you should select 'Examine' unless you are certain yourself of the amount of tracks present on the disk (some people write the three vital disk characteristics - tracks per disk, sectors per track and number of sides - on the label of a disk; this may be a good idea for you too). The 'examine' option reads the first sector from ever increasing track numbers and calculates the number of tracks present on a disk by substracting 1 from the first track number that cannot be read (usually due to it never having been formatted). This means that disks that have been formatted using more tracks earlier and that were reformatted using less tracks later will cause the "Ultimate Virus Killer" to find the old amount of tracks. As said earlier, this may sound like a quick method to increase your disk's amount of tracks, but really isn't: The 'BPB repair' option algorithms will in that case not work correctly! 7.4 HOW MANY SECTORS PER TRACK Much like the amount of tracks per side, the amount of sectors per track can very a lot. When a standard ST disk was formatted using the standard GEM DESKTOP format option, this value is 9. In other cases it can be any value from 1 to 11 (although 12 has been included, for which there is no space on a track, at least theoretically). Standard Falcon (and post-1992 TT) disks support higher amounts of sectors per track; they are High Density (HD) disks as opposed to the regular Double Density (DS). High Density disks can write 18 (on 3.5" disks) or 15 sectors per track (on 5.25" disks). Even Extra High Density (ED) disk drives exist, allowing the use of a massive 26 sectors per track, but these are quite rare. All kinds of disk drives, including DD, HD and ED ones, are supported by the internal 'BPB repair' algorithms. Try to remember the right number of sectors per track yourself (and write this information on disk labels as of now), since otherwise the 'examine' option will perhaps find the remains of previously formatted extra sectors per track. Normally this should not happen, but certain 'fast format' programs neglect to fully initialise a track which may leave some old information more or less intact. Analogous to the calculation of tracks per disk that was explained above, the 'examine' option here reads sectors from the first track and calculates the number of sectors per track by substracting one from the first sector that it cannot read due to it not being present (not formatted) in the first place. 7.5 HOW MANY SIDES Due to one of the more ancient Atari cock-ups the ST community is stuck with the phenomenon of the single-sided disk drive (SF 354). Although virtually nobody has these drives any more, some software is still supplied on single sided disks - or sometimes a disk may just be formatted single-sided because it's quicker, who knows? Anyway, even though the chances of a disk being double-sided are bigger for certain, there is no way to be sure whether a disk has one side or two unless you just happen to know (again, it may be useful to write down the amount of sides on your disk labels). In general most older original software is single-sided, and all other disks are double-sided. If you are not sure, you can use the 'Examine' option here again, but it has the obvious drawback mentioned several times above: If a disk is single-sided but has been formatted double-sided prior to the latest format, the "Ultimate Virus Killer" will assume it's double-sided. The 'examine' option just tries to read a sector from the second side and assumes a disk is double-sided when this process happens without an error occurring. Disks that have only been used on the Falcon or a TT will almost certainly have two sides. 7.6 HOW MANY SECTORS PER CLUSTER The amount of sectors per cluster (also called the allocation unit) is always 2, except when the disk you're trying to repair is a single-sided disk with 40 tracks (these are created and used by rather ancient MS-DOS-type machines). It is supposed to be impossible to use other values here, but for the sake of future compatibility it has been included anyway. In short, you should most likely specify 2 here, as Atari ST/TT/Falcon disks always use 2 sectors (1 Kb) for one cluster. 7.7 HOW MANY FATS ON THE DISK The FAT (short for File Allocation Table) is the space on disk where the Operating System stores and gets information about which clusters on the disk are used by files (and which are not) and in which particular sequence clusters have to be put together in order to load a file bigger than one cluster that is not stored contiguously (i.e. a fragmented file). TOS maintains two FATs on a disk - one of these is always present as a temporary backup. It is not certain whether or not it is possible to use disks with only one FAT - some formatting programs seem to allow for it, but the aforementioned Claus Brod denies it categorically. You should usually specify 2 here. 7.8 HOW MANY DIRECTORY ENTRIES The directory is list on a disk where the names, lengths and other characteristics of individual files and folders on that disk are stored. The particular parameter discussed here pertains to the root directory, i.e. the directory that appears first when you display the contents ("Open...") a floppy disk drive or hard disk partition. The longer the directory, the less space is left on the disk. Usually the directory takes up the entire second track of a disk. Most disks have 112 directory entries, but single-sided disks with 40 tracks (the ones we also encountered above, that are used by rather ancient MS-DOS systems) have only 64 of them. Again, it is not possible to easily increase your disk's storage capacity by specifying a lower amount of directory entries here. This will lead to whatever is on the disk to remain inaccessible. 7.9 HOW MANY SECTORS PER FAT ENTRY The FAT table is built up of several hundreds of entries, and it is possible to specify how many sectors ('allocation units') are included in one entry here. There is a 100% full-proof way to have it checked by the "Ultimate Virus Killer" itself, so you should specify 'Examine' here unless, for some reason or other, you are sure about selecting either '1', '2', '3' or '5' (which is rather unlikely to say the least). 7.10 A NOTE ON DISKS WITH BUSTED BIOS PARAMETER BLOCKS In by far most of all cases disks with damaged BIOS Parameter Blocks are not infected by a virus, nor do they suffer from any remaining parts of mutant viruses. It is quite usual for game data disks (any disk belonging to a game that you don't actually have to start up with - i.e. game disks labelled 2, 3, B, C, whatever) to use some sort of exotic disk format, whereas many also don't really bother about writing a BIOS Parameter Block at all and instead use even the bootsector to store graphics or map data. 'Repairing' the BPB of one of these disks will most likely prove lethal for that piece of software! In any case you should write a bootfile prior to any attempt at repairing them. 8 RESTORE DISKS If you find that you have accidentally destroyed a suspected but apparently completely innocent disk that needs a specific bootsector (this destruction could have happened inadvertently by other or earlier virus killers, for example), or when you discover that a virus has copied itself across the necessary boot program present in the bootsector of a commercial game or a demo, the 'restore disks' option allows you to restore a multitude of these cases. Should you, for example, find the bootsector of the popular game "Lemmings 2 - The Tribes" destroyed by a virus or a rash 'repair' action, it is possible to install its proper bootsector on the original disk again, thus restoring it and saving yourself and the software company involved a lot of time and money. Selecting this option causes another dialog box to be displayed. This gives access to a list of all restorable bootsectors, identified by a game's name (or a demo's, whatever). You can scroll up and down this list and select the title of the bootsector you would want to restore. You can use the arrow buttons at the right to scroll up and down through the list. A single-arrow button will scroll one entry; a double-arrow button will scroll one page (15 entries). Click the mouse pointer on an entry to select it. After confirmation you can have it written to a disk. 'T' BUTTON Go to top of list 'B' BUTTON Go to bottom of list 'CANCEL' BUTTON Exit the screen, back to the menu 'HELP' BUTTON Access the help option A-Z/1/5 BUTTONS Jump to first title with it [UNDO] KEY Exit the screen, back to the menu [HELP] KEY Access the help option [ALT]-[A-Z/1/5] KEYS Jump to first title with it  When the bootsector of the game you want to restore should not be present in the list yet, you can order an "Ultimate Virus Killer" update and hope that the bootsector you wanted to restore is included in the new version. No promises can be made with regard to this, however, so you had better also supply the address and telephone number of the company that made the software to which the bootsector belonged, as well as the name of the piece of software. That company can then be contacted by us so that some kind of agreement may be made. Most companies are very co-operative with regard to this, as they covertly recognize the virus problem and all know about the "Ultimate Virus Killer" (which has become more or less the de-facto industry standard). - If you do not have enough memory in your system for the restore data file to be loaded within the main programme in the first place, you can use the separate programme "RESTORE.PRG" which is supplied on the "Ultimate Virus Killer" distribution disk. Do note that this program is not intended for use with any other systems rather than those with 512 Kb of memory (520 STFM, 520 ST, 520 STM, 260 ST)! Running it on any other systems may cause unpredictable crashes. Only ST medium and high resolution are supported. - Are you not sure whether or not a bootsector belongs to a particular game of a specific company? Just 'restore' the bootsector onto an empty TEST disk (which has to be formatted, though) and then check it with the "Ultimate Virus Killer". The alert box stating which bootsector it is will also give the company name, if one is known. 9 THE SYSTEM STATUS SCREEN 9.1 INTRODUCTION To assist you in determining whether your computer system itself is already infected by a virus or not, the "Ultimate Virus Killer" always checks your computer's most important system variables and memory contents on start-up. These specific system variables are pointers to various routines in your Operating System, for example pointing to a routine to read or write a disk sector, a routine to 'open' a file and so forth. Generally, viruses cling to these system variable in order to work. This way all known bootsector viruses can be recognized in the system, as well as resident types of link virus and a large number of harmless other programs that also cling to these vectors (i.e. 'bend them') for valid purposes. Of course unknown viruses cannot be recognized yet. That is the reason why this screen has been included. On startup, or after selecting the "System Status check" option from the main menu, the "Ultimate Virus Killer" will check all these important system vectors and try to establish which programs are hooked to them. It will notify you of unknown programs that have bent these vectors, signified by an inverted display of the memory address to which the vector points which indicates that there is a chance that you might be dealing with a new and unknown virus. This chance is increased dramatically if the program additionally displays "ALERT" behind a memory address displayed in inverted text style. In this case it has calculated something not unlike the regular "Virus Probability Factor" for a small cluster of memory located at that memory address, and the programme code present there was found to contain one or several characteristics commonly found in viruses. Whenever a specific program that bends a system vector is recognized by the "Ultimate Virus Killer" it will display a figure between brackets directly after the actual memory address. This can have one of the following formats: (x) The number of a recognized application (Number corresponds with the APPLICAT.TXT file list) (?) An unknown application is recognized (This MIGHT be a virus, or a harmless program) (#x) Anti-virus recognized. Reboot without it! (Number corresponds with VIRUSES.TXT file list) (-x) Virus recognized. Turn off system and reboot!! (Number corresponds with VIRUSES.TXT file list) Sometimes the program does not display a number but instead displays a four- letter code (like "FrmD" of "CBHD", or whatever). This is the so-called 'XBRA identification', which is a protocol devised in the early nineties (one of the few good things to come out of Germany) to allow for easier recognition of the multitude of files that can hook themselves to the various computer system variables. These XBRA identifiers are displayed by default when they are found; should you want to see numbers only (as these correspond with the APPLICAT.TXT file list) you need to keep the [ALTERNATE] key pressed while the addresses are put on the screen. Pressing [CONTROL] will slow down the output - in case you want to see what bends the vector and you are not content with seeing that nothing is suspiciously inverted. An additional advantage of the XBRA protocol is that it is possible to check if several programs have hooked themselves to the same vector. These will then form what is referred to as an 'XBRA chain', a sequence of programs that all use the XBRA protocol. This chain of programs will be examined by the "Ultimate Virus Killer" as deep as it can go - which is until it finds an unknown program that uses the XBRA protocol, a program (known or unknown) that does not use the XBRA protocol, or when it hits on the actual standard Operating System values. - Please note that, with but a few exceptions, installed RAM disks are not recognized and will most likely result in "(?) Unknown Application Found". To get rid of this, get rid of the RAM disks in memory. Note that a lot of the modern RAM disks are reset-proof, so you will have to turn off your system to get rid of them. - When the Physical Top of RAM is inverted, this usually due to some kind of (resident) RAM disk, too. Again, get rid of it and run the "Ultimate Virus Killer" again. - Alternative (and unofficial) versions of (beta STE) TOS 1.06 that go around (reference to the TOS '1.07' by TEX, TNT Crew and Level 16 is meant here) are mostly recognized as a standard TOS 1.06. This is because the people behind that adapted TOS wanted to have maximum compatibility and could therefore not change the date and version number. When specific TOS 1.07 versions are recognized, they are thus stated in the status screen, and their release date will be stated at 'TOS date' (which normally displays the date contained is the TOS header, which represents the date at which that particular TOS version has been released). - Something similar is the case for the alternative Operating System "KaosTOS" (an adapted TOS 1.04). When this is recognized, the TOS version displays 'KAOS' and the TOS date specified is the release date of the "KAOSTOS" version currently in use. - The system screen will also check for reset-proof programmes and warns you when non-recognized resistant programmes are found. 9.2 WHEN SUSPICIOUS What to do when one or several of these variables happen to be displayed in inverted text style, in other words when there is something 'suspicious' that isn't yet recognized? In that case you should turn off your system and turn it on again after about 30 seconds, with the "Ultimate Virus Killer" disk (or another disk that is guaranteed to be free of viruses) in the drive. If you're using an AUTO folder on your boot disk or boot partition, disable all programmes in there, as well as all accessories. Do this prior to booting up your system anew. Disabling AUTO folder programs can be done by changing the extensions from .PRG or .ACC into e.g. .PRX and .ACX respectively. The Operating System will only load .PRG files from the AUTO folder and will only recognize .ACC files as accessories. If these aren't present the system will assume they're not there and won't load any of them. You will now have a totally empty system. All values displayed by the System Screen Status should be in regular text. In case of inverted display this does not necessarily point to virus infection - perhaps your hard disk driver or particular Operating System version is not yet recognized (hard disk drivers typically use memory slightly above the bottom of memory, whereas your Operating System is typically located on addresses $E0x or $FCx). Now, enable one AUTO folder program, reset your system and load the "Ultimate Virus Killer". Continue like this until either all files are loaded or until a system variable is displayed in inverted text style. The file to have been enabled last before the system variables are 'suspicious' again is the one that changes them. Do not delete a programme that bends any system vectors, as it is usually not at all likely to be of viral nature unless the word "ALERT!" appears behind the inverted address displayed. Please just send the appropriate program file, whether "ALERTed" or not, to the feedback address, if possible with additional files belonging to it and any documentation (on disk, or photocopied). It will be implemented into the forthcoming version of the "Ultimate Virus Killer" so that it will be recognized and will no longer cause any memory addresses to be displayed in inverted text style. Do not forget to supply enough International Reply Coupons (!no stamps!) if you expect your disks to be returned. The same goes for the accessories, but do note that you have to check out all AUTO folder programs before you start enabling any accessories, as accessories will be loaded 'on top' of any AUTO folder programs and might disable the "Ultimate Virus Killer" from following the chain right down to possible AUTO folder programs. In case you are reluctant to send the programme(s) in question to the feedback address, you can move the mouse cursor on top of the inverted system variable contents and click on it with the left mouse button. An additional dialog box will be displayed, containing some vital information that we can work with to some extent. Please write down the contents of the dialog box together with the name, version number and origin of the file that caused the vectors to be inverted, and send it to us so that inclusion in future "Ultimate Virus Killer" versions may be possible after all. If you have a printer attached, you can keep [CONTROL] pressed while pressing the left mouse button; the programme will then also output the information on your printer. If you additionally keep [ALTERNATE] pressed, a Form Feed will be sent after printing has finished, causing the paper to be moved up to the start of the next page (tractor feed) or to be ejected (sheet feed). Press any key or mouse button to cause the information lines to disappear from the screen. Pressing the "OK" button or pressing the associated keyboard shortcut (in this case [ALTERNATE]-O or [RETURN]) will leave the screen system status screen altogether, back to the main menu. - If system variables are suspicious even without any AUTO folder programmes and accessories having been installed, and you have no hard disk, it could be a virus or RAM based version of TOS. - If the above occurs if you have a hard disk, it is very likely to be your hard disk driver. This is normal. - If the programme to bend the system vector uses the XBRA protocol, the next in line will be checked. The deepest XBRA found will be displayed. This may be helpful to determine which programme actually bent the vector. The deeper down the XBRA vector, the earlier it was loaded and installed (with the "Warp 9" accessory being a known exception). 9.3 THE PROBLEM As you could have gathered from the above, it is no exception that several programmes hook onto the same system variable. It will not be hard to imagine that a dozen or more resident programs can be installed, all bending various system vectors to their heart's content. This sort of thing tends to happen when you have a hard disk cache programme installed, a screen speeder ("Turbo ST", "Quick ST", "NVDI", "Warp 9", etc.), an alternative file selector ("FSelect", "UIS", "Selectric", etc.), a resident multi-tool programme ("Update", "Mortimer"), an alert box enhancement programme ("Let 'Em Fly" or "FormDoIt") and an alternative desktop ("Gemini", "Teradesk" or "NeoDesk") for example. It's easy to have even more programmes bending these vectors. To check which application (i.e. which programme) has bent a particular system variable, the "Ultimate Virus Killer" examines the piece of memory where the vector points to. It will (or won't) recognize the program present there and display the appropriate message in the system status screen for you to look at. Whenever multiple programmes bend the same vector it becomes difficult (if not impossible) to check which programmes bent the system vectors before the last one did. Usually the address that the last application found sitting on the vector is stored somewhere within itself so that it can be called after it has served its own purpose, and there is no way to tell precisely where. You can compare a series of programmes bending one system vector with a chain. The program that was loaded last (let's call it programme "A") is most 'on top' and will be executed first whenever the system variable is accessed by the Operating System. Once programme "A" is finished doing what it was intended for it will pass on the address it found sitting on the vector before it installed itself, i.e. the address at which the programme is located that installed itself prior to that last programme. Let's call that programme "B". Once programme "B" has finished what it wanted to do it will pass on the address that it found on the system variable, that of programme "C". And so on and so forth, until eventually the last programme in the chain will execute the actual Operating System routine that needed to be called. The addresses that each of these programmes found sitting on the system vector are stored in themselves somewhere, internally. The location where they are stored vary from programme to programme, even between different versions of the same application. The problem for a programme such as the "Ultimate Virus Killer" that tries to determine which other applications are hooked to any particular system variable is that it is normally only possible to tell which application bent that system vector last. There is no way it can be determined what the other applications before it are, as those programmes' addresses are contained somewhere in the programme that later patched that vector (I hope you're still with me - this bit of the manual actually took longest to rewrite). Only when the last programme ("A") used the XBRA protocol can it be determined where the programme before that application ("B") is located in memory - and when that uses the XBRA protocol again it is possible to go one step deeper (to "C") until one encounters the first programme that does not use XBRA. You see that it is thus normally only possible to check the programmes bending the vectors until a certain 'depth', i.e. up to the first programme that is foolish enough not to use the exalted XBRA protocol. Anything that's any 'deeper' can only be guessed at. So in case you're a programmer writing utilities that bend system vectors, do abide by the XBRA rules! They are available in any recent programmer's guide or in the "Ultimate Virus Killer" book (:-)). As was said before, the "Ultimate Virus Killer" checks the system variables as extensive as possible - up to the first programme that bends the variable without using XBRA, up to the first programme using XBRA that is not yet recognized, or, ideally, up to the dark and mystic depths of your computer's Operating System. You will see the system status screen display the various addresses with the application numbers associated with them as it proceeds along the chain of XBRA programmes. So far mention has been made only of problems for the "Ultimate Virus Killer". But what about a problem for you? Well, unfortunately there is one. Just suppose a virus installs itself in your system. It hooks itself to a few system variables and would be plainly visible for any extensive system check screen you'd care to throw at it. However, now just suppose a bunch of AUTO folder programs and desk accessories are loaded right afterwards&. Unless all of these are using the XBRA protocol, they will effectively hide the virus from view (and, what's most important, they will also hide it from the "Ultimate Virus Killer" check algorithms and all will appear to be OK). For you to be sure that all is safe you will have to do pretty much the same as was described above, where the isolation of unrecognized AUTO folder programmes and desk accessories was concerned. Disable all of these and boot your system anew. Enable one AUTO folder program at a time, each time run the "Ultimate Virus Killer", then do the same with the desk accessories. If no memory addresses are displayed in inverted text style you can consider yourself safe even if the programme will not be able to check to the most extreme depths each time. Do note that you will have to check each newly acquired AUTO folder programme and desk accessory afterwards if you want to continue feeling safe! 10 FEEDBACK Feedback, suggestions, comments and non-recognized boot files (on disk or as printout) can be sent to: Richard Karsmakers Looplantsoen 50 NL-3523 GV Utrecht The Netherlands Please do not forget to add sufficient International Reply Coupons if you want some sort of reply, or if you want to receive disks back! Do not add any stamps unless they're Dutch!! You may direct important questions (no binary files though unless they're UUENCODED) to my electronic postbox at email account. The name if my email account is "R.C.Karsmakers@stud.let.ruu.nl". If possible limit any electronic mail to the explanation of problems, bugs, and other questions of technical nature. Inquiries about subscriptions, administration, orders, pricing, replacement copies, disks with bootfiles that you sent, etc., should be sent to the above regular address. Please make sure your message subject is appropriate. 11 CREDITS All resource and Flydial routines, as well as help using them >Gregor Duchalski System Status Screen memory check 4H.W.A.M. de Beer (SysInfo) Insurmountably invaluable GEM programming assistance DMark Matts Scan Partition Code and various small but important bits ?Stefan Posthuma AntiVirus =Helmut Neukirchen Additional ideas and miscellaneous help 6Claus Brod (ST Computer) 0Volker Shnitz (Virendetektor) #Chris Brookes (Professional Virus Killer 3) /Martijn Wiedijk (Lucifer Eksod) 'Fame' acknowledgements &Niall McKiernon (Douglas Communications) ,Tarik Ahmia (TOS Magazine Germany) /Willem Hartog (Atari ST Nieuws) )Les Ellingham (New Atari User/Page 6) Special thanks :Kai Holst (Antidote) All other coding (what's left of it), research, programming, resource design, text, manual, development, program collection and layout