Preparing for the epidemic

Press, 11 October 1988, Page 28

Preparing for the epidemic

A commercial software vaccine has been produced in Christchurch as the incidence of microcomputer viruses continues to grow in Christchurch.

Mr Trevor Turner, a hardware specialist and software writer, is about to launch on the market VaccineB, which will check files in MS-DOS microcomputers to see if a virus has infected the system. Viruses are self-repro-ducing programs, concealed in other software, which spread to other programs on a user’s machine and disks.

They are rife in the world of Amiga home computers, and a competition on these pages two weeks ago to find the

first Atari ST virus has been won. Several cases of the MS-DOS virus, Type One, the “marijuana virus” (because it carries a message calling for the legalisation of the habit) were found in an earlier competition run on these pages. Trevor Turner wrote his vaccine program in response to uneasiness in the MS-DOS world. Many institutions and businesses have introduced strict rules to keep viruses out such as banning the use of outside floppy disks.

Most of the viruses are introduced by enthusiastic with swapped public domain (free) software or pirated programs. The viruses can enter from disks or through modem links with bulletin boards

— amateur on-line databases catering mainly for hobbyists. Mr Turner’s program, written in Turbo C, will sell for $l5O before GST. Installed in a computer, and accessed by the autoexec.bat (the file the computer looks to when booted up, as switching on is called) it will use check-sum techniques to detect if a sleeping virus in the computer has changed files. If so, the computer can be discontaminated at an early stage by unloading data files, reformatting disks and reinstalling programs before the virus can cause the system to collapse.

When the machine is switched on, VaccineB tells the user all files that

have been changed since the last switch-on. If there are changes not made by the user, the chances are there is a virus in the system.

Mr Turner wrote his program because other anti-virus software he knows is readily available seems very slow, checking a file at a time. Some also need a largish chunk of disk space to perform their checks. He says his technique overcomes these drawbacks. In the world of Atari microcomputers, Neil Gardner, of Avonhead, has won the 50 blank floppy disks offered by Software Supplies, of Christchurch, for the first Atari virus to be verified. Neil Gardner believes he has the only copy of the virus in the country. It was written in West Germany. It lives in the boot sector of the ST disk and gives no indication of its presence. When loaded it replicates on to each disk put in the disk drive that has its directory read by the “escape key” method. It does not infect write-pro-tected disks.

(Write protection is usually provided by putting a tab over a notch on a floppy disk. This tells the disk drive not to put any material on the disk or wipe out anything on it. There are rumours of viruses that will overcome a write-protection by commands to the disk drive. At present these are still only rumours, so using write-protect tabs is still highly recommended.) “At first glance, this virus does not appear to be harmful,” Neil Gardner said. “It only reproduces and does not immediately corrupt a disk. This program is worse than that. It copies itself on to as many of your disks as possible, and when it finds a disk with a special ‘key value’ it does its dirty work.” He has not yet established what the key value is but expects it is in formating or erasing the directory sectors of a disk. “It will not install itself more than once. It checks each disk to see if it is already present before deciding whether to infect that disk.” Alex Davidson, of Software Supplies, Colombo Street, the New Zealand distributor for Atari, said the fact that the prize offered on these pages two weeks ago drew only one example indicated virus programs were not widespread in Atari ST computers in New Zealand — “unlike some other popular brands.” He has analysed a disk from Neil Gardner and pronounces the virus not particularly virulent. “It will copy itself to a disk only under certain conditions, and on the Atari ST it is impossible for any virus program to infect a write-protected disk. Also, simply inserting the disk into the disk drive will not copy the virus to the disk, unlike on some other computers.” The Atari ST has its operating system entirely in ROM (machine memory), and does not need a boot disk to start. The design of the ST made it particularly easy to detect the presence of a virus, Mr Davidson added. His firm has a public domain program available which will detect and remove a virus. He says the ultimate protection is to avoid pirating, copying, swapping, and borrowing software. In the New Zealand Amiga community, at least two viruses are about. These are the SCA, named for its creators, the Swiss Crackers Association, and the Byte Bandit, of which, according to one user, SCA is a mutant. Both write over the boot blocks of a disk. These are the files which start up the machine. It is believed that vaccines for both of these

viruses are being swapped in the Amiga community, and that both vaccines were developed by the hackers who produced the viruses and have since repented.

Apple Macintosh viruses have “broken out” in various parts of the world, but local distributors say they are not evident outside amateur use. They have not appeared in business machines. Christchurch distributors have vaccine programs ready to give out, but say there has been no call for them yet.

In one twist to the spread of viruses, the Pervert program which popped up on screens at Christchurch Polytechnic is making news overseas. Mr Derham McAven, head of the polytechnic’s computer centre, has been quoted in wire-ser-vice reports about Pervert, which he describes as a mutation of an overseas sex-on-screen program.

Pervert, which does not wipe out files, has led to stringent measures against full-blown viruses

at the Polytechnic, which is heavily microcomputer oriented, with many networks.