View source for AVK

<pre>
                 USER MANUAL for the "Ultimate Virus Killer"
                        written by Richard Karsmakers

                 Mark III (rewrite) initiated June 19th 1993
                          Last change: June 3rd 1999


                               LIST OF CONTENTS


                               LIST OF CONTENTS
                              DISCLAIMER NOTICE
                                 INTRODUCTION
                               MAKING A BACKUP
                     STARTING THE "ULTIMATE VIRUS KILLER"
                   WORKING WITH THE "ULTIMATE VIRUS KILLER"
                            SEEK'N'DESTROY VIRUSES
                                IMMUNIZE DISKS
                      REPAIR BPB (BIOS PARAMETER BLOCK)
                              BOOTSECTOR VIRUSES
                                 LINK VIRUSES
                                RESTORE DISKS
                           THE SYSTEM STATUS SCREEN
                                   FEEDBACK
                                   CREDITS
                            TROUBLE SHOOTING CHART
                THE "ULTIMATE VIRUS KILLER" CONFIGURATION FILE
                   THE "ULTIMATE VIRUS KILLER" HISTORY FILE



            The "Ultimate Virus Killer" programme and manual are 
                copyright (c) 1999 by C.R.I.M.E. Development


0         DISCLAIMER NOTICE


 We  make no warranties,  either expressed or implied,  with respect  to  this 
manual or with respect to the software described in this manual,  its quality, 
performance,  merchantability,  or  fitness for any  particular  purpose.  The 
entire  risk as to its quality and performance is with the buyer.  Should  the 
programme prove defective following its purchase, the buyer assumes the entire 
cost of all necessary servicing,  repair,  or correction and any incidental or 
consequential damages.  In no event will we be liable for direct,  indirect or 
consequential damages resulting from any defect in the software.


1         INTRODUCTION


 Congratulations on your acquisition of the "Ultimate Virus Killer"  (or,  for 
short,  UVK).  This is probably the most versatile and definitive product   in 
the  battle against computer viruses on the Atari  ST/STE/TT/Falcon;  a  full-
fledged tool that has taken many years of painstaking development already. The 
main features of this programme are:

 * Recognition of virtually all software that uses the disk's bootsector
 * Recognition of ALL known viruses - both bootsector-and link viruses
 * Option to restore previously damaged software that needs a specific
   bootsector program
 * All harmless data on your disks remains 100% intact!
 * Immunization of disks/files against many bootsector-and link viruses
 * Option to repair damaged or destroyed BIOS Parameter Blocks
 * Automatic recognition of any hard-, floppy-and RAM disks that are present
 * Automatic recognition of all known viruses already present in the computer
   system
 * Almost  40 direct on-line,  context-sensitive help screens included in  the 
   programme, accessible by pressing the [HELP] button
 * Automatic calculation of a 'Virus Probability Factor' for
   suspicious/unknown bootsectors
 * Fast scanning of a whole drive or partition for link viruses.  This allows
   you to scan a full partition or floppy disk for link viruses 'at the touch
   of a button'
 * Option to save potential viruses to disk or print them out, to have them
   analysed by the programme author
 * Extensive system check; specifies suspicious system variables, scans for
   reset-proof programmes and checks for viruses in memory - also when a hard
   disk is attached!
 * Full compatibility with MEGA ST,  MEGA STE,  ST,  STE, TT and Falcon with a    
   minimum of 512 Kb of RAM, any ROM TOS and any known hard disk driver
 * Total compatibility with "MultiTOS" and "Geneva"
 * Contains fast, compact machine code routines, harnessing the raw processing
   power of the 680x0 type of processors
 * Extensive recognition of memory-resident programmes (among
   which all known viruses...)
 * Comfortable and easy-to-use mouse/keyboard user interface
 * Programme checks itself for link virus infection on start-up
 * Metados compatibility - check up to 26 drives/partitions!
 * Fully GEMDOS compatible, using dialog boxes and easy GEM
   conventions

 With this tool handy, you need never worry about viruses on your computer any 
more: You can simply use it to de-infect your disks and programmes, destroying 
the viruses and leaving all other information and data intact.


2         MAKING A BACKUP


 Just use the GEM desktop facilities to copy the files to another disk (or  to 
hard  disk)  for  backup purposes.  For the programme  to  run  properly,  the 
"DATA.PAK"  and  "UVK_x_x.PRG" files on the original "Ultimate  Virus  Killer" 
disk  are  needed.  An  optional  configuration file may  be  handy  (see  the 
appropriate chapter). If you wish to use the programme as a desk accessory you 
may  rename  the "UVK_x_x.PRG" file to "UVK_x_x.ACC" and  copy  the  necessary 
files to the root directory of your boot drive. Usually this is partition C if 
you have a hard disk, drive A if you don't.
 If  you are not familiar with the GEM copying conventions,  please  refer  to 
your computer's user manual.

 Notes on using the "Ultimate Virus Killer" as an accessory:
 Usually an accessory is located within the root directory of your boot drive. 
However,  with use of small accessories such as "Chameleon" that can load  and 
unload  another accessory it may very well happen that you load  an  accessory 
from somewhere else.  The "Ultimate Virus Killer" has no problems with that as 
long as you make sure that the supplemental files are located in the *current* 
directory of a floppy disk or hard disk partition. This means that you have to 
open  a  window to that directory first,  *then* use "Chameleon" to  load  the 
"Ultimate  Virus  Killer".  If  you neglect this,  as a  rule  only  the  root 
directories of all your valid partitions will be checked for occurrence of the 
supplementary files.
 You can leave away the "DATA.PAK" file when using it as an accessory in order 
to save memory.
 If  you  want to use the "Ultimate Virus Killer" as an  accessory  on  colour 
monitors,  you  have to make sure that your system is switched into  a  proper 
resolution (NOT low resolution!) before any accessories are loaded.  They  may 
be achieved through AUTO folder programs such as "Superboot" and "XBoot" which 
can leave your system in medium resolution upon leaving.


3         STARTING THE "ULTIMATE VIRUS KILLER"


 Turn your computer off and on again with the "Ultimate Virus Killer" disk  in  
drive  A.   After   some  seconds,   a desktop will   appear   that   contains 
several  file names,   amongst which is one  called "UVK_x_x.PRG" (where "x_x" 
stands for whatever the current version number is).  Double-click on this file 
with the mouse pointer to load and run it.  If you do not want the  "DATA.PAK" 
restore  data file to be loaded (which is only needed if you want  to  restore 
commercial  games  or demos that have had the programs  on  their  bootsectors 
wiped out) you can keep the [CONTROL] key pressed during booting.  If you want 
to skip the start-up system status screen for whatever reason you should  keep 
the [RIGHT SHIFT] key pressed.
 In case the current system date is not valid (i.e.  if the system's  internal 
clock  is  set  to  a date before the year and  month  in  which  the  current 
"Ultimate  Virus Killer" version was finished) you will be requested to  enter 
the date and time before doing anything else. if you do not want to change the 
time,  you  may  simply  leave  the time  specification  unaltered  and  press 
[RETURN],  [ALTERNATE]-O or click on the "OK" button after having entered  the 
date.
 The "Ultimate Virus Killer" will present its start-up screen after some  more 
seconds, after which it will be ready to be used.
 It  is  advisable to boot your system with the "Ultimate Virus  Killer"  disk 
because  it contains a virus-free and immunized bootsector.  Theoretically, no 
virus  can  be present in memory this way (turning your system   off  and   on  
again assures that no possible reset-resistant  viruses survive).
 Should  you want to create another disk to regularly boot your  system  with, 
just  copy  whatever files you want on it,  then check it with  the  "Ultimate 
Virus Killer", write-protect it and keep it write-protected.
 KEEP  YOUR ORIGINAL "ULTIMATE VIRUS KILLER" DISK WRITE-PROTECTED AT ALL  (!!) 
TIMES!


4         WORKING WITH THE "ULTIMATE VIRUS KILLER"


 On start-up,  a GEM dialog box will appear on the screen. This kind of dialog 
box  will be used throughout the programme and offers some interesting  extras 
when  compared  to  the standard GEM dialog boxes you  may  be  used  to.  For 
example,  it is  not only possible to select your option by clicking the  left 
mouse  button on its button,   but your selection may also be made by  keeping 
the  [ALTERNATE]  key  pressed  and then pressing  the  alphanumeral  that  is 
underlined  within  the  button you want to select.  The  option  that  has  a 
thickened frame is the 'default' button, which may be selected additionally by 
pressing [RETURN] or [ENTER].  Buttons that cannot be selected are represented 
with a 'greyed out' text and border.
 Help options, when available, are accessible by clicking on the "HELP" button 
at  the  left bottom of a dialog box,  or by pressing the [HELP] key  on  your 
keyboard.  Any  button  containing  a  "(U)" in its  text  (usually  a  button 
containing "NO",  "CANCEL" or "QUIT") may additionally be selected by pressing 
the [UNDO] key on your keyboard.
 Each dialog is displayed within a window.  Although it cannot be resized, you 
can  use  the  window title bar at its top to drag the window  all  over  your 
desktop and put it anywhere you want,  including partly off the actual screen. 
This can be done by clicking the left mouse button on it,  keeping it pressed, 
and moving the mouse in a dragging movement.

 Five options are available to you from the main menu dialog box:

                      Seek'n'Destroy Viruses
                      Restore Disks
                      Information about UVK x.x
                      System Status
                      Quit to the Desktop

 These options, where necessary, will be explained in further chapters.

 Note on using the "Ultimate Virus Killer" as a .TTP file:
 The  "Ultimate  Virus  Killer"  may  be used as  .TTP  file  (for  which  the 
"UVK_x_x.PRG"  needs  to be renamed to "UVK_x_x.TTP"),  or  similarly  from  a 
command  line interpreter.  This allows for it to receive  certain  parameters 
from you or from other programs before it gets started.
 Although  the  options  offered here are not as extensive  as  those  of  the 
programme in regular mode,  they may still be useful. All the options that are 
on offer here are purely diagnostic - no viruses can be killed, for example!

 SYNTAX:                  DESCRIPTION:

 B X                      Checks drive "X" for bootsector viruses.

 L X:                     Checks the entire partition "X" for link viruses.

 L E X:                   Checks  the entire partition "X" for  link  viruses, 
                          but only checks executable files. The ":" at the end 
                          is important!

 L X:\PATH\               Checks all files and all files in any folders within 
                          the  folder "\PATH\" of drive "X" for link  viruses. 
                          The "\" at the end is important!

 L X:\PATH\NAME.EXT       Checks file "NAME.EXT" in path "\PATH\" of drive "X" 
                          for link viruses.  "\PATH\" can consist of more than 
                          one folder name,  divided by "\",  to go into deeper 
                          subdirectories.

 X:\PATH\NAME.EXT or
 NAME.EXT or
 \PATH\NAME.EXT           Alternatively  you can feed just a valid file  name. 
                          It  will  then be checked  for  link  viruses,  with 
                          packer  info  mode  on and waiting for  a  key  once 
                          finished.  In combination with e.g.  "NeoDesk"  this 
                          allows  you  to  check a file for  link  viruses  by 
                          dragging  its  icon on top of  the  "Ultimate  Virus 
                          Killer"  icon  with having to rename  the  "Ultimate 
                          Virus Killer" program file at all.
                          In this mode, none of the parameters specified below 
                          may be added.

 After  the  initial  "L"  or "B" a "-" may be added  (like  for  example  "L- 
X:\NAME\NAME.EXT")  to  suppress you having to press a key  when  leaving  the 
programme and to prevent the screen from being cleared at start.
 Likewise,  a  "+" may be added when doing a link virus scan - to  supply  you 
with additional information about whether executable files are packed and,  if 
so,  with which packer.  A combination of "+" and "-" (to get both suppression 
of 'waiting for a key' AND extra packer information) is also permitted.

 In   a   command   line   interpreter  you   could   enter   "UVK_x_x.PRG   L 
E:\1ST_WORD\WORDPLUS.PRG"  for example.  For this to work in the standard  GEM 
desktop you would have to enter "L E:\1ST_WORD\WORDPLUS.PRG"  in the box  that 
appears  on  the screen after you have renamed the file to  "UVK_x_x.TTP"  and 
double-clicked  on the file.  In combination with an extended desktop such  as 
"NeoDesk"  you  can  just drag the "WORDPLUS.PRG" icon  across  (it  won't  be 
copied, only the name will be fed to the command line).


5         SEEK'N'DESTROY VIRUSES


  Following  the selection of this option,  another dialog box is put  on  the 
screen,   allowing   you   to   select   the   drive   on   which   to   start 
seeking'n'destroying viruses.  The programme automatically detects any  drives 
that  are attached to your system and displays their identifiers in  selection 
buttons.  Up  to 26 drives/partitions may be selected,  with  the  unavailable 
drives/partitions being represented in 'greyed-out' text.
 Please  note  that bootsector viruses can only  be  searched (and  destroyed)  
on floppy disk drives - A  and  B.  Selecting drive B is not possible when  it 
is  not actually attached.  Link viruses can be searched on  either  floppy-or 
hard disk (up to and including partition Z).
 You  may  select a drive or partition by clicking on its  appropriate  button 
with  the  mouse  button  or by entering  the  appropriate  keyboard  shortcut 
[ALTERNATE]-key.

 Once  the  drive to use is selected,   you can decide whether   you  want  to 
examine your media for bootsector-or link viruses.  If you selected bootsector 
viruses, you will get a prompt to insert the disk you want to check.
 In case you selected the option to check for the presence of link viruses you 
will  enter  some further dialog boxes where you can specify which  files  you 
want to check and in what way you want them to be checked.
 In the first dialog box you will be able to specify whether you want to  scan 
an  entire  drive  or  partition (ALL files on a  floppy  disk  or  hard  disk 
partition,  including  those  present  in all the  folders,  will  be  scanned 
recursively),  single files or folders,  or whether you want to exit.  If  you 
opted for the option to scan single files or folders you can either specify  a 
full  filename in the item selector box (in which case only that file will  be 
scanned)  or you can specify a folder you want to tree-scan  without  actually 
specifying  a  file  (in which case all the files in that  specific  folder  - 
including all files and further folders present in it - will be  scanned).  It 
is  important  not  to  select a file name  in  the  latter;  just  enter  the 
appropriate folder and then click on the item selector box' "OK" button.

 If  you decide to check an entire floppy disk for link viruses the  "Ultimate 
Virus Killer" will also automatically check that disk's bootsector (note: this 
is for floppy only!).
 Checking  for  link  viruses on a whole partition or  entire  folder  may  be 
aborted by pressing [ESCAPE] or [UNDO].  When there are many infected files or 
when you have set "warnings on" and there are many packed files,  you may have 
to press the [ESCAPE] or [UNDO] key a few times.

 There is  one rather important note  that applies to bootsector  viruses:  IT  
IS  POSSIBLE  THAT A PERFECTLY HARMLESS DISK IS SUSPECTED OF BEING   A  VIRUS!  
This   means that either the bootsector of the  harmless programme is not  yet 
recognized and not yet implemented in the "Ultimate Virus Killer",  or that it 
is  indeed a  new  virus!   Whenever  the "Ultimate Virus  Killer"  encounters 
such   a disk,  you will be given the possibility to either REPAIR  the  disk, 
PRINT its contents, WRITE A BOOTFILE or LOOK AT IT.
 In the second and third cases,  we would very much like  to receive  the boot 
file,   that  the  "Ultimate Virus Killer" can write on a  disk   with  enough  
space on it (at least 512 bytes free). When you do not have a disk nearby with 
sufficient space free,  you may want to use the FORMAT option that will format 
a  disk  (single sided).   If you send  that disk  (or the  print-out)  to  us 
(together  with some written info about the disk it  came from and  your  name 
and  address),   we  will check it out and send it back as  soon  as  possible 
provided you have supplied sufficient International Reply Coupons (!).
 Please  make sure the bootfiles are accompanied by sufficient explanation  as 
to what sofware they belong to,  for it's usually impossible to determine this 
information from the bootsector contents and the bootfile file name only.

 It is likely that the directories of disks that have auto-booting bootsectors 
on them will appear to be 'empty' or that they seem to have 'corrupted files'. 
This need not be (and most probably isn't) due to virus infection but to  some 
software protection schemes' exotic disk formats,  some of which include there 
not being any files on the disk at all.

 IF  YOU KNOW THAT THE SUSPECTED DISK CONTAINS NO VIRUS,  WE WOULD  VERY  MUCH 
LIKE  TO RECEIVE IT ANYWAY,  BECAUSE OTHER PEOPLE MAY NOT BE AWARE OF  IT  AND 
MIGHT ACCIDENTALLY DESTROY THEIR PRECIOUS SOFTWARE!!

  Please send any disks in a good quality envelope that can also be  used  for 
return mailing,   and write "CONTAINS MAGNETIC MEDIA - PLEASE DO NOT X-RAY" on 
it in clear,   large characters (to minimize loss of data).  Do NOT FORGET  TO 
ADD sufficient International Reply Coupons! Disks without these cannot be sent 
back!
 Just before you can select whether to write a boot file or simply to  repair,  
a  dialog  box  will be displayed that tells   you   the  "Virus   Probability 
Factor" (or VPF for short) - the probability  factor that the disk that is  on 
the current bootsector is indeed a virus.   The reliability of this factor  is 
quite high.

 The  VPF is produced by scanning the code present in the bootsector for  some 
vital virus characteristics:

Factor 1: The  presence of machine code that is to be found in a routine  that 
          writes a sector to disk.
Factor 2: The  presence  of  machine code that creates  the  checksum  for  an 
          executable bootsector.
Factor 3: The presence of magic checksums or memory locations that are  needed 
          to make a programme reset-resistant.
Factor 4: The  presence of the addresses of system variables that viruses  can 
          link themselves to.

 In certain cases,  an additional dialog box is produced; this happens when an 
unknown disk is found to be largely filled with the same value. The larger the 
percentage  mentioned  in this dialog box,  the less the likelihood  of  virus 
infection (quite on the contrary,  one might add,  to the percentage mentioned 
with the "Virus Probability Factor" calculation)!

 Note on executable file extensions:  When you want to check a whole partition 
or  folder  for link viruses it is possible to select whether  you  only  want 
executable  files  to  be checked or whether you want this to  happen  to  all 
files.  Executable  files are files that can be run from  the  desktop;  other 
files include text files, picture files, source code files and the like.
 When selecting to check executable files only,  the programme will only check 
files with extensions ".PRG",  ".TOS",  ".APP",  ".ACC", and ".TTP" (including 
their  disabled  counterparts  ".PRX" and  ".ACX").  These  are  normally  the 
extensions  for  executable programmes.  Some alternative  desktop  programmes 
(such as "NeoDesk") allow other file extensions to be executable,  e.g. ".NPG" 
and ".NTP".  To check these as well, you would have to opt for ALL files to be 
treated,  or you will have to configure the UVK.CFG file accordingly (see  the 
appropriate chapter).

 Note  for users of "MultiTOS": This Operating System uses a  'unified  drive' 
(identifier  "U:") in which certain folders will cause a crash  when  checking 
for link viruses.  You should refrain from checking the following directories: 
"U:\DEV", "U:\PROC", "U:\PIPE" and "U:\SHM".


6         IMMUNIZE DISKS


 Most of your disks,  including those with valuable working material,  can  be 
immunized  so  that  they  will no more be infected   by  many  of  the  known 
bootsector viruses and all anti-viruses.
 The principle used  by the "Ultimate Virus Killer" immunization algorithm  is 
the fact that many known bootsector viruses, when resident in memory, check if 
they are present on a disk already before they bother copying themselves  onto 
it.  If they find themselves present,  they do not copy across that particular 
disk. When the "Ultimate Virus Killer" writes only those few recognition bytes 
to the bootsector that does the trick:  The virus thinks it is present on  the 
disk already and does not copy itself onto it.

- Disk immunization will not help against ALL viruses.
- Programmes that use the bootsector themselves (like the ones included in the 
  'RESTORE'  list in a text file on the "Ultimate Virus  Killer"  distribution 
  disk)  cannot  and should not be immunized as the few  bytes  necessary  for 
  writing  the  immunization will destroy the boot code program they  need  to 
  perform properly.
- In  the text file "VIRUSES.TXT" on your programme disk you will be  able  to 
  find  the  specifications of which virus can be immunized with  which  code. 
  Since  certain different viruses use the same bytes on the  bootsector  with 
  different values to check if they are already present,  this means that some 
  viruses  can  not be immunized against  without  sacrificing  another.  Some 
  viruses  cannot be immunized against at all as they simply  copy  themselves 
  across  any  bootsector without bothering to check their presence  prior  to 
  copying.  The  only way to protect yourself from these types of virus is  to 
  keep your disks write-protected. If this is not possible, you will just have 
  to check those disks regularly using the "Ultimate Virus Killer".
- On your search for viruses you will undoubtedly come across what the program 
  calls "MS-DOS disks".  These are standard disks that, however, have specific 
  values written in their bootsectors so that they may be interchanged between 
  Atari  and MS-DOS (i.e.  IBM PC and compatible) computers.  These disks  are 
  formatted  automatically  when  formatting  with TOS  version  1.04  or  up. 
  Whenever you immunize such a disk this so-called 'MS-DOS compatibility' will 
  be  lost!  It  may  be best to reserve only a limited  amount  of  disks  to 
  exchange  files  between  these two system standards,  and  to  check  these 
  regularly for virus infection.


7         REPAIR BIOS PARAMETER BLOCK


7.1       INTRODUCTION

 Some mutant viruses cause the BIOS Parameter Block (or BPB) to be  corrupted. 
This  means  that  there is no longer any information on  the  disk's  format, 
stored into the BIOS Parameter Block segment of a disk  bootsector,  available 
to  the Atari's Operating System.  It will no longer be able to determine  how 
many tracks and sectors a disk has, as well as several other vital parameters. 
Trying  to display a directory from such a disk will most likely result  in  a 
system hang-up,  bomb crash or the appearance of a disk filled with  corrupted 
files and filenames.
 The  "Ultimate  Virus Killer" incorporates a semi-intelligent  routine   that  
automatically  recognizes  known mutant virus versions and allows the user  to 
repair the BIOS Parameter Block again in case of it having been damaged  after 
the actual mutant virus has been removed.
 PLEASE NOTE  THAT  YOU SHOULD READ THIS SECTION OF THE MANUAL VERY THOROUGHLY 
BEFORE YOU EVER ATTEMPT TO REPAIR A BIOS PARAMETER BLOCK!!

 Repairing a BIOS Parameter Block is quite difficult;  after all,  this  small 
segment  of  the bootsector determines whether or not your computer  can  read 
from or write to individual disks.
 First,  let's supply you with a table that specifies how the BIOS   Parameter 
Block is built up.  OFFSET means  the  value  that  should be added  from  the 
start of the bootsector, starting at zero. The values are in decimal.

------------------------------------------------------------------------------
    OFFSET:   NAME:           EXPLANATION:
------------------------------------------------------------------------------
    11-12     BPS             Bytes per sector
     13       SPC             Sectors per cluster
    14-15     RES             Number of reserved sectors
     16       FAT             Number of FATs on the disk
    17-18     DIR             Number of directory entries
    19-20     SEC             Total number of sectors
     21      MEDIA            Media descriptor byte
    22-23     SPF             Sectors per FAT entry
    24-25     SPT             Sectors per track
    26-27    SIDES            Number of sides
    28-29     HID             Number of hidden sectors
------------------------------------------------------------------------------

 It is not necessary for you to know the above table by heart. It was supplied 
here  with  the intention to give you some idea of what  the  BIOS   Parameter 
Block  means to the Operating System.   Whenever a BPB   is  destroyed,  these 
essential pieces of information are no longer present (which,  as said before, 
will  most  likely result in various disk error messages,  system crash  or  a 
garbage disk directory).

  First of all,  you should know that you should preferably not try out   this 
'BPB  repair'  option on original game  software,   as   current-day  software 
protection  techniques involve the craziest disk  formats that would  probably 
drive the "Ultimate Virus Killer" algorithms nuts! Apart from that, attempting 
a  'BPB repair' on such a disk may also lead to instant software  malfunction. 
The  only  option  you should ever use in order to  restore  the  contents  of 
original  (game  or  demo-) software disk is the  main  menu  'restore  disks' 
option.
 Second,   you should  also realize  that the 'BPB repair' option may not work 
correctly   on  disks   that  have  been  formatted  using  'larger'   formats 
previously.  This would for example be the case with a disk that you formatted 
with  82  tracks  some time ago and later decided to  reformat  with  only  80 
tracks.  Some  remnants of the old format still left intact (in this case  the 
tracks above track 80) may be found, disturbing the algorithm.

 There are two ways to get access to the 'BPB REPAIR' option. The first is the 
most  obvious:   Whenever a damaged BIOS Parameter Block  is   detected   (and 
this  does  not even need to be the  result  of  a virus)  the  programme  ask 
whether you want to attempt a BPB repair or not.
 The second one is also quite obvious:  Whenever   the 'Seek'n'Destroy' option 
recognizes   a  mutant  virus  on  the disk,  or whatever remains  of  it,  it  
will initially remove the virus and then ask you  whether you want to  attempt 
a 'BPB repair' or not.
 Upon your confirmation the 'BPB repair' option will be entered.  You need not 
be  worried  about  inadvertently entering it -  after  having  specified  all 
parameters  you  can always cancel the whole thing at  the  end,  leaving  the 
current BIOS Parameter Block unaltered.

 As was stated already,   repairing the BIOS Parameter is not  only a slightly 
complicated  matter,  but  it  may  also  prove  dangerous  insofar  that  the 
specification  of  the wrong parameters it can make whatever is on  your  disk 
totally inaccessible.  Common symptoms of a disk with inaccessible material on 
it are the aforementioned crashes, disk errors and disk directories containing 
only garbage information (huge file sizes, weird file names, invalid dates and 
times). Therefore you should take care using the 'BPB repair' option.
 Even  if you have already attempted a BIOS Parameter Block repair with  wrong 
parameters there is a way to attempt it again - despite the fact that the disk 
will  now,  obviously,  have  a  valid BPB and the 'BPB  repair'  option  will 
normally no longer be entered.
 What  you would need to do in this case is check the disk's bootsector  again 
and keep the [RIGHT SHIFT] key pressed until the screen flashes  briefly.  The 
program  will  now have forced the BIOS Parameter Block to be  invalid  again, 
enabling you to enter the 'BPB repair' option again.  The most common mistakes 
made  while repairing a BIOS Parameter block involve the specification of  the 
number  of  tracks per side and sectors per track,  as well as the  number  of 
actual sides on a disk.
 Should you find yourself unable to fix it regardless (or if you simply do not  
dare to attempt a BPB repair yourself),  you can send  the disk to the address 
mentioned  in the "FEEDBACK" chapter of this manual.  Please add an amount  of 
money that equals the price of an "Ultimate Virus Killer" update and twice the 
amount of IRCs required. You will receive your disk(s) back after a short time 
(hopefully).  In  case  of my not being able to repair  it  either,  you  will 
receive your money back (not the IRCs though).

 Some important notes:

- It  is important that you do not try to delete files from or write files  to 
  disk that have a damaged BIOS Parameter Block.
- If  you send in disks with BIOS Parameter Blocks that need to  be  repaired, 
  please  clearly  state that you want your disk repaired and that  you  don't 
  want an update!
- Whenever you repair the BIOS Parameter Block of a disk it will automatically 
  be immunized.
- Attempting  a 'BPB repair' on a disk is no cheap way of increasing a  disk's 
  storage capacity.  Specifying more sides,  sectors per tracks or tracks  per 
  side than are actually present will cause whatever is on the disk to  remain 
  inaccessible.

 During the 'BPB repair' option some dialog boxes requesting input will be put 
on  the screen.   You have to use these to specify  BPB values,   but  do  not 
worry if you do not know anything about  this.  This part of the manual can be 
of some help, and you can also use the built-in context-sensitive on-line help 
options by pressing the [HELP] key.

 During  the 'BPB repair' option you will be requested to specify a number  of 
parameters needed by the "Ultimate Virus Killer" algorithms to write back what 
was previously the correct BIOS Parameter block for the current disk.

7.2       HOW MANY BYTES PER SECTOR

 Claus Brod,   Atari mass storage media expert and author of probably the best 
book  in  this field (called  "Scheibenkleister",  unfortunately  in  German),  
claims  that  only 512  bytes per sector are possible as  TOS  (the  Operating 
System  within  your computer) does not allow for 128,   256 or  1024  BPS  on 
floppy disks. For  the sake of compatibility with future TOS versions  as well 
as for the pure sake of completion it is possible to select any of the  values 
here.
 Unnecessary to say,  you will almost certainly have to specify 512 bytes  per 
sector here.

7.3       HOW MANY TRACKS PER SIDE

  This  can vary quite a lot,   due to formatting programmes  available   that 
allow up to 90(?!?!) tracks per side  to  be formatted (whether  or not  these 
programmes should  be  used and whether these tracks are safe for data storage 
will not be discussed here).
 When  requested to specify the number of tracks per side it will be handy  to 
remember if you formatted the disk in the drive using the standard GEM DESKTOP 
format option or not.  If you did, you should select 80.  If you did not,  you 
should  select   'Examine' unless you are certain yourself of  the  amount  of 
tracks  present  on  the  disk  (some  people  write  the  three  vital   disk 
characteristics - tracks per disk,  sectors per track and number of sides - on 
the label of a disk; this may be a good idea for you too).
 The   'examine'  option reads  the first sector from  ever  increasing  track 
numbers  and  calculates   the   number  of  tracks  present  on  a  disk   by 
substracting  1 from  the first track number that cannot be read (usually  due 
to  it  never having been formatted).  This  means that disks that  have  been 
formatted  using   more tracks earlier and that were  reformatted  using  less 
tracks later will cause the "Ultimate Virus Killer" to find the old amount  of 
tracks.
 As said earlier,  this may sound like a quick method to increase your  disk's 
amount of tracks, but really isn't: The 'BPB repair' option algorithms will in 
that case not work correctly!

7.4       HOW MANY SECTORS PER TRACK

 Much like the amount of tracks per side,  the amount of sectors per track can 
very  a lot.  When a standard ST disk was formatted using the   standard   GEM 
DESKTOP format option,   this value is 9.  In other cases it can be any  value 
from 1 to 11 (although 12 has been included,  for which there is no space on a 
track,  at  least  theoretically).  Standard Falcon (and post-1992  TT)  disks 
support higher amounts of sectors per track;  they are High Density (HD) disks 
as opposed to the regular Double Density (DS). High Density disks can write 18 
(on  3.5"  disks) or 15 sectors per track (on 5.25" disks).  Even  Extra  High 
Density (ED) disk drives exist,  allowing the use of a massive 26 sectors  per 
track, but these are quite rare.
 All kinds of disk drives,  including DD, HD and ED ones, are supported by the 
internal 'BPB repair' algorithms.
 Try  to  remember the right number of sectors per track yourself  (and  write 
this  information  on disk labels as of now),  since otherwise  the  'examine' 
option will perhaps find the remains of previously formatted extra sectors per 
track.  Normally  this should not happen,  but certain 'fast format'  programs 
neglect to fully initialise a track which may leave some old information  more 
or less intact.
 Analogous to the calculation of tracks per disk that was explained above, the  
'examine' option  here reads sectors from the first track and  calculates  the 
number  of sectors per track by substracting one from  the  first sector  that  
it cannot read due to it not being present (not formatted) in the first place.

7.5       HOW MANY SIDES

 Due to one of the more ancient Atari cock-ups the ST community is stuck  with 
the  phenomenon of the single-sided disk drive (SF  354).  Although  virtually 
nobody  has these drives any more,  some software is still supplied on  single 
sided  disks - or sometimes a disk may just be formatted single-sided  because 
it's quicker, who knows?
 Anyway,  even though the chances of a disk being double-sided are bigger  for 
certain,  there is no way to be sure whether a disk has one side or two unless 
you just happen to know (again,  it may be useful to write down the amount  of 
sides on your disk labels).
 In general most older original software is single-sided,  and all other disks 
are double-sided.  If you are  not sure,   you can use the  'Examine'   option 
here again,   but it has the  obvious drawback mentioned several times  above: 
If  a  disk is single-sided but has been formatted double-sided prior  to  the 
latest format,  the "Ultimate Virus Killer" will assume it's double-sided. The 
'examine' option just tries to read a sector from the second side and  assumes 
a disk is double-sided when this process happens without an error occurring.
 Disks  that have only been used on the Falcon or a TT will  almost  certainly 
have two sides.

7.6       HOW MANY SECTORS PER CLUSTER

 The amount of sectors per cluster (also called the allocation unit) is always 
2, except when the disk you're trying to repair is a single-sided disk with 40 
tracks (these are created and used by rather ancient MS-DOS-type machines).
 It is supposed to be impossible to use other values here, but for the sake of 
future compatibility it has been included anyway.
 In short, you should most likely specify 2 here,  as Atari ST/TT/Falcon disks 
always use 2 sectors (1 Kb) for one cluster.

7.7       HOW MANY FATS ON THE DISK

 The  FAT (short for File Allocation Table) is the space on  disk  where   the 
Operating System stores and gets information about which clusters on the  disk 
are  used  by  files  (and which are not) and  in  which  particular  sequence 
clusters  have  to  be put together in order to load a file  bigger  than  one 
cluster that is not stored contiguously (i.e. a fragmented file).
 TOS   maintains two FATs on a disk - one of these is  always  present  as   a 
temporary backup. It is not certain whether or not it is possible to use disks 
with  only one FAT - some formatting programs seem to allow for  it,  but  the 
aforementioned Claus Brod denies it categorically.
 You should usually specify 2 here.

7.8       HOW MANY DIRECTORY ENTRIES

 The  directory  is  list on a disk where  the   names,   lengths  and   other 
characteristics of individual files and folders on that  disk are stored.  The 
particular parameter discussed here pertains to the root directory,  i.e.  the 
directory  that  appears  first when you display the  contents  ("Open...")  a 
floppy disk drive or hard disk partition.
 The  longer the directory,  the less space is left on the disk.  Usually  the 
directory takes up the entire second track of a disk.
 Most disks have 112 directory entries,  but single-sided disks with 40 tracks 
(the  ones we also encountered above,  that are used by rather ancient  MS-DOS 
systems) have only 64 of them.  Again,  it is not possible to easily  increase 
your disk's storage capacity by specifying a lower amount of directory entries 
here. This will lead to whatever is on the disk to remain inaccessible.

7.9       HOW MANY SECTORS PER FAT ENTRY

 The FAT table is built up of several hundreds of entries,  and it is possible  
to  specify  how many sectors ('allocation units') are included in  one  entry 
here.  There  is  a 100%  full-proof way to have it checked by  the  "Ultimate 
Virus Killer" itself,  so you should specify 'Examine' here unless,  for  some 
reason  or other,  you are sure about selecting either '1',  '2',  '3' or  '5' 
(which is rather unlikely to say the least).

7.10      A NOTE ON DISKS WITH BUSTED BIOS PARAMETER BLOCKS

 In by far most of all cases disks with damaged BIOS Parameter Blocks are  not 
infected  by a virus,  nor do they suffer from any remaining parts  of  mutant 
viruses.  It is quite usual for game data disks (any disk belonging to a  game 
that you don't actually have to start up with - i.e. game disks labelled 2, 3, 
B,  C,  whatever)  to use some sort of exotic disk format,  whereas many  also 
don't  really bother about writing a BIOS Parameter Block at all  and  instead 
use even the bootsector to store graphics or map data.
 'Repairing'  the BPB of one of these disks will most likely prove lethal  for 
that piece of software!  In any case you should write a bootfile prior to  any 
attempt at repairing them.


8         RESTORE DISKS


 If  you find that you have accidentally destroyed a suspected but  apparently  
completely   innocent disk that needs a specific bootsector (this  destruction 
could  have  happened inadvertently by other or earlier  virus  killers,   for 
example),  or  when  you discover that a virus has copied  itself  across  the 
necessary  boot  program present in the bootsector of a commercial game  or  a 
demo,  the 'restore disks' option allows you to  restore a multitude of  these 
cases.
 Should you,  for example, find the bootsector of the popular game "Lemmings 2 
- The Tribes" destroyed by a virus or a rash 'repair' action,  it is  possible 
to install its proper bootsector on the original disk again, thus restoring it 
and saving yourself and the software company involved a lot of time and money.

 Selecting this option causes another dialog box to be displayed.  This  gives 
access  to a list of all restorable bootsectors,  identified by a game's  name 
(or a demo's,  whatever).  You can scroll up and down this list and select the 
title of the bootsector you would want to restore.
 You can use the arrow buttons at the right to scroll up and down through  the 
list.  A single-arrow button will scroll one entry; a double-arrow button will 
scroll one page (15 entries).
 Click the mouse pointer on an entry to select it.  After confirmation you can 
have it written to a disk.

 'T' BUTTON                   Go to top of list
 'B' BUTTON                   Go to bottom of list
 'CANCEL' BUTTON              Exit the screen, back to the menu
 'HELP' BUTTON                Access the help option
 A-Z/1/5 BUTTONS              Jump to first title with it
 [UNDO] KEY                   Exit the screen, back to the menu
 [HELP] KEY                   Access the help option
 [ALT]-[A-Z/1/5] KEYS         Jump to first title with it                

 When the bootsector of the game you want to restore should not be present  in 
the list yet,   you can order an "Ultimate Virus Killer" update and hope  that 
the  bootsector  you  wanted to restore is included in  the  new  version.  No 
promises  can be made with regard to this,  however,  so you had better   also 
supply the address and telephone number of the company that  made the software 
to  which  the  bootsector  belonged,  as well as the name  of  the  piece  of 
software.  That  company  can  then be contacted by us so that  some  kind  of 
agreement may be made.
  Most companies are very co-operative with regard to this,  as they  covertly 
recognize  the  virus problem and all know about the "Ultimate  Virus  Killer" 
(which has become more or less the de-facto industry standard).

- Are you not sure whether or not a bootsector belongs to a particular game of 
  a specific company?
  Just  'restore'  the  bootsector onto an empty TEST disk (which  has  to  be 
  formatted,  though) and then check it with the "Ultimate Virus Killer".  The 
  alert box stating which bootsector it is will also give the company name, if 
  one is known.


9         THE SYSTEM STATUS SCREEN


9.1       INTRODUCTION

 To  assist you in determining whether your computer system itself is  already 
infected  by a virus or not,  the "Ultimate Virus Killer" always  checks  your 
computer's  most important system variables and memory contents  on  start-up. 
These  specific  system  variables are pointers to various  routines  in  your 
Operating  System,  for example pointing to a routine to read or write a  disk 
sector,  a routine to 'open' a file and so forth.  Generally, viruses cling to 
these system variable in order to work.
 This  way all known bootsector viruses can be recognized in  the  system,  as 
well  as  resident types of link virus and a large number  of  harmless  other 
programs  that  also  cling to these vectors  (i.e.  'bend  them')  for  valid 
purposes.
 Of  course unknown viruses cannot be recognized yet.  That is the reason  why 
this  screen has been included.  On startup,  or after selecting  the  "System 
Status  check"  option from the main menu,  the "Ultimate Virus  Killer"  will 
check  all these important system vectors and try to establish which  programs 
are  hooked  to them.  It will notify you of unknown programs that  have  bent 
these vectors, signified by an inverted display of the memory address to which 
the  vector  points which indicates that there is a chance that you  might  be 
dealing with a new and unknown virus. This chance is increased dramatically if 
the program additionally displays "ALERT" behind a memory address displayed in 
inverted text style.  In this case it has calculated something not unlike  the 
regular  "Virus Probability Factor" for a small cluster of memory  located  at 
that memory address, and the programme code present there was found to contain 
one or several characteristics commonly found in viruses.

 Whenever  a specific program that bends a system vector is recognized by  the 
"Ultimate  Virus  Killer" it will display a figure between  brackets  directly 
after the actual memory address. This can have one of the following formats:

 (x)           The number of a recognized application
               (Number corresponds with the APPLICAT.TXT file list)
 (?)           An unknown application is recognized
               (This MIGHT be a virus, or a harmless program)
 (#x)          Anti-virus recognized. Reboot without it!
               (Number corresponds with VIRUSES.TXT file list)
 (-x)          Virus recognized. Turn off system and reboot!!
               (Number corresponds with VIRUSES.TXT file list)

 Sometimes the program does not display a number but instead displays a  four-
letter code (like "FrmD" of "CBHD",  or whatever). This is the so-called 'XBRA 
identification', which is a protocol devised in the early nineties (one of the 
few good things to come out of Germany) to allow for easier recognition of the 
multitude  of  files that can hook themselves to the various  computer  system 
variables.  These  XBRA  identifiers are displayed by default  when  they  are 
found;  should  you  want to see numbers only (as these  correspond  with  the 
APPLICAT.TXT file list) you need to keep the [ALTERNATE] key pressed while the 
addresses are put on the screen.  Pressing [CONTROL] will slow down the output 
-  in case you want to see what bends the vector and you are not content  with 
seeing that nothing is suspiciously inverted.
 An additional advantage of the XBRA protocol is that it is possible to  check 
if several programs have hooked themselves to the same vector. These will then 
form what is referred to as an 'XBRA chain',  a sequence of programs that  all 
use  the  XBRA  protocol.  This  chain of programs will  be  examined  by  the 
"Ultimate  Virus  Killer" as deep as it can go - which is until  it  finds  an 
unknown program that uses the XBRA protocol, a program (known or unknown) that 
does  not  use  the XBRA protocol,  or when it hits  on  the  actual  standard 
Operating System values.

- Please  note that,  with but a few exceptions,  installed RAM disks are  not 
  recognized  and will most likely result in "(?) Unknown Application  Found". 
  To get rid of this,  get rid of the RAM disks in memory.  Note that a lot of 
  the  modern  RAM disks are reset-proof,  so you will have to turn  off  your 
  system to get rid of them.
- When the Physical Top of RAM is inverted,  this usually due to some kind  of 
  (resident) RAM disk,  too.  Again, get rid of it and run the "Ultimate Virus 
  Killer" again.
- Alternative (and unofficial) versions of (beta STE) TOS 1.06 that go  around 
  (reference  to the TOS '1.07' by TEX,  TNT Crew and Level 16 is meant  here) 
  are  mostly recognized as a standard TOS 1.06.  This is because  the  people 
  behind  that  adapted  TOS wanted to have maximum  compatibility  and  could 
  therefore  not change the date and version number.  When specific  TOS  1.07 
  versions  are recognized,  they are thus stated in the  status  screen,  and 
  their release date will be stated at 'TOS date' (which normally displays the 
  date  contained is the TOS header,  which represents the date at which  that 
  particular TOS version has been released).
- Something similar is the case for the alternative Operating System "KaosTOS" 
  (an  adapted TOS 1.04).  When this is recognized,  the TOS version  displays 
  'KAOS'  and  the  TOS date specified is the release date  of  the  "KAOSTOS" 
  version currently in use.
- The  system screen will also check for reset-proof programmes and warns  you 
  when non-recognized resistant programmes are found.

9.2       WHEN SUSPICIOUS

 What  to do when one or several of these variables happen to be displayed  in 
inverted text style,  in other words when there is something 'suspicious' that 
isn't yet recognized?

 In that case you should turn off your system and turn it on again after about 
30  seconds,  with the "Ultimate Virus Killer" disk (or another disk  that  is 
guaranteed to be free of viruses) in the drive. If you're using an AUTO folder 
on your boot disk or boot partition,  disable all programmes in there, as well 
as all accessories. Do this prior to booting up your system anew.
 Disabling  AUTO folder programs can be done by changing the  extensions  from 
.PRG or .ACC into e.g.  .PRX and .ACX respectively.  The Operating System will 
only  load .PRG files from the AUTO folder and will only recognize .ACC  files 
as  accessories.  If these aren't present the system will assume  they're  not 
there and won't load any of them.
 You will now have a totally empty system.  All values displayed by the System 
Screen Status should be in regular text. In case of inverted display this does 
not  necessarily point to virus infection - perhaps your hard disk  driver  or 
particular  Operating System version is not yet recognized (hard disk  drivers 
typically  use  memory  slightly above the  bottom  of  memory,  whereas  your 
Operating System is typically located on addresses $E0xxxx or $FCxxxx).
 Now, enable one AUTO folder program, reset your system and load the "Ultimate 
Virus Killer". Continue like this until either all files are loaded or until a 
system  variable is displayed in inverted text style.  The file to  have  been 
enabled  last  before the system variables are 'suspicious' again is  the  one 
that changes them.
 Do not delete a programme that bends any system vectors, as it is usually not 
at  all likely to be of viral nature unless the word "ALERT!"  appears  behind 
the inverted address displayed. Please just send the appropriate program file, 
whether "ALERTed" or not, to the feedback address, if possible with additional 
files belonging to it and any documentation (on disk, or photocopied). It will 
be implemented into the forthcoming version of the "Ultimate Virus Killer"  so 
that it will be recognized and will no longer cause any memory addresses to be 
displayed in inverted text style. Do not forget to supply enough International 
Reply Coupons (!no stamps!) if you expect your disks to be returned.
 The same goes for the accessories, but do note that you have to check out all 
AUTO folder programs before you start enabling any accessories, as accessories 
will  be  loaded 'on top' of any AUTO folder programs and  might  disable  the 
"Ultimate  Virus Killer" from following the chain right down to possible  AUTO 
folder programs.

 In  case  you  are  reluctant to send the programme(s)  in  question  to  the 
feedback address,  you can move the mouse cursor on top of the inverted system 
variable  contents and click on it with the left mouse button.  An  additional 
dialog  box will be displayed,  containing some vital information that we  can 
work  with to some extent.  Please write down the contents of the  dialog  box 
together with the name,  version number and origin of the file that caused the 
vectors  to  be  inverted,  and  send it to us so  that  inclusion  in  future 
"Ultimate Virus Killer" versions may be possible after all.
 If you have a printer attached, you can keep [CONTROL] pressed while pressing 
the left mouse button;  the programme will then also output the information on 
your printer.  If you additionally keep [ALTERNATE] pressed,  a Form Feed will 
be sent after printing has finished,  causing the paper to be moved up to  the 
start of the next page (tractor feed) or to be ejected (sheet feed).
 Press  any  key or mouse button to cause the information lines  to  disappear 
from the screen.

 Pressing  the  "OK" button or pressing the associated keyboard  shortcut  (in 
this  case  [ALTERNATE]-O  or [RETURN]) will leave the  screen  system  status 
screen altogether, back to the main menu.

- If  system variables are suspicious even without any AUTO folder  programmes 
  and accessories having been installed,  and you have no hard disk,  it could 
  be a virus or RAM based version of TOS.
- If  the above occurs if you have a hard disk,  it is very likely to be  your 
  hard disk driver. This is normal.
- If the programme to bend the system vector uses the XBRA protocol,  the next 
  in line will be checked.  The deepest XBRA found will be displayed. This may 
  be helpful to determine which programme actually bent the vector. The deeper 
  down  the  XBRA vector,  the earlier it was loaded and installed  (with  the 
  "Warp 9" accessory being a known exception).

9.3       THE PROBLEM

 As  you could have gathered from the above,  it is no exception that  several 
programmes hook onto the same system variable.  It will not be hard to imagine 
that a dozen or more resident programs can be installed,  all bending  various 
system  vectors to their heart's content.  This sort of thing tends to  happen 
when you have a hard disk cache programme installed,  a screen speeder ("Turbo 
ST",  "Quick  ST",  "NVDI",  "Warp 9",  etc.),  an alternative  file  selector 
("FSelect",   "UIS",  "Selectric",  etc.),  a  resident  multi-tool  programme 
("Update",  "Mortimer"),  an alert box enhancement programme ("Let 'Em Fly" or 
"FormDoIt") and an alternative desktop ("Gemini", "Teradesk" or "NeoDesk") for 
example. It's easy to have even more programmes bending these vectors.

 To  check  which application (i.e.  which programme) has  bent  a  particular 
system  variable,  the  "Ultimate Virus Killer" examines the piece  of  memory 
where the vector points to.  It will (or won't) recognize the program  present 
there and display the appropriate message in the system status screen for  you 
to look at.
 Whenever  multiple programmes bend the same vector it becomes  difficult  (if 
not  impossible) to check which programmes bent the system vectors before  the 
last one did.  Usually the address that the last application found sitting  on 
the vector is stored somewhere within itself so that it can be called after it 
has served its own purpose,  and there is no way to tell precisely where.  You 
can compare a series of programmes bending one system vector with a chain. The 
program  that was loaded last (let's call it programme "A") is most  'on  top' 
and  will  be executed first whenever the system variable is accessed  by  the 
Operating System.  Once programme "A"  is finished doing what it was  intended 
for  it  will  pass on the address it found sitting on the  vector  before  it 
installed  itself,  i.e.  the address at which the programme is  located  that 
installed itself prior to that last programme.  Let's call that programme "B". 
Once  programme  "B"  has finished what it wanted to do it will  pass  on  the 
address that it found on the system variable, that of programme "C". And so on 
and  so forth,  until eventually the last programme in the chain will  execute 
the actual Operating System routine that needed to be called.
 The  addresses  that  each of these programmes found sitting  on  the  system 
vector are stored in themselves somewhere, internally. The location where they 
are stored vary from programme to programme,  even between different  versions 
of the same application.

 The problem for a programme such as the "Ultimate Virus Killer" that tries to 
determine  which  other  applications  are hooked  to  any  particular  system 
variable  is that it is normally only possible to tell which application  bent 
that system vector last.  There is no way it can be determined what the  other 
applications  before  it are,  as those programmes'  addresses  are  contained 
somewhere in the programme that later patched that vector (I hope you're still 
with me - this bit of the manual actually took longest to rewrite).

 Only  when  the  last  programme  ("A") used the  XBRA  protocol  can  it  be 
determined  where  the programme before that application ("B") is  located  in 
memory  - and when that uses the XBRA protocol again it is possible to go  one 
step  deeper (to "C") until one encounters the first programme that  does  not 
use XBRA.
 You  see  that  it is thus normally only possible  to  check  the  programmes 
bending the vectors until a certain 'depth',  i.e.  up to the first  programme 
that is foolish enough not to use the exalted XBRA protocol.
 Anything  that's  any 'deeper' can only be guessed at.  So in case  you're  a 
programmer  writing utilities that bend system vectors,  do abide by the  XBRA 
rules! They are available in any recent programmer's guide or in the "Ultimate 
Virus Killer" book (:-)).

 As was said before,  the "Ultimate Virus Killer" checks the system  variables 
as  extensive as possible - up to the first programme that bends the  variable 
without  using  XBRA,  up to the first programme using XBRA that  is  not  yet 
recognized,  or,  ideally, up to the dark and mystic depths of your computer's 
Operating  System.  You will see the system status screen display the  various 
addresses  with  the application numbers associated with them as  it  proceeds 
along the chain of XBRA programmes.

 So  far  mention  has  been made only of problems  for  the  "Ultimate  Virus 
Killer". But what about a problem for you? Well, unfortunately there is one.
 Just suppose a virus installs itself in your system. It hooks itself to a few 
system  variables and would be plainly visible for any extensive system  check 
screen you'd care to throw at it.  However,  now just suppose a bunch of  AUTO 
folder programs and desk accessories are loaded right afterwards.  Unless  all 
of  these are using the XBRA protocol,  they will effectively hide  the  virus 
from  view  (and,  what's  most important,  they will also hide  it  from  the 
"Ultimate Virus Killer" check algorithms and all will appear to be OK).
 For you to be sure that all is safe you will have to do pretty much the  same 
as  was  described  above,  where the isolation of  unrecognized  AUTO  folder 
programmes and desk accessories was concerned.  Disable all of these and  boot 
your system anew.  Enable one AUTO folder program at a time, each time run the 
"Ultimate  Virus Killer",  then do the same with the desk accessories.  If  no 
memory  addresses  are  displayed  in inverted text  style  you  can  consider 
yourself  safe  even if the programme will not be able to check  to  the  most 
extreme depths each time.
 Do note that you will have to check each newly acquired AUTO folder programme 
and desk accessory afterwards if you want to continue feeling safe!


10        FEEDBACK


 Feedback,  suggestions, comments and non-recognized boot files (on disk or as 
printout) can be sent to:

 Richard Karsmakers
 P.O. Box 67
 NL-3500 AB  Utrecht
 The Netherlands

 Please  do  not forget to add sufficient International Reply Coupons  if  you 
want some sort of reply,  or if you want to receive disks back! Do not add any 
stamps unless they're Dutch!!
 You may direct important questions to my electronic postbox at email account 
cronos@atari.org.
 If possible limit any electronic mail to the explanation of  problems,  bugs, 
and  other  questions  of technical  nature.  Inquiries  about  subscriptions, 
administration, orders, pricing, replacement copies, disks with bootfiles that 
you sent,  etc., should be sent to the above regular address. Please make sure 
your message subject is appropriate.


11        CREDITS


All resource and Flydial routines, as well as help using them
                                                              Gregor Duchalski

System Status Screen memory check
                                                    H.W.A.M. de Beer (SysInfo)

Insurmountably invaluable GEM programming assistance
                                                                    Mark Matts

Scan Partition Code and various small but important bits
                                                               Stefan Posthuma

AntiVirus
                                                             Helmut Neukirchen

Additional ideas and miscellaneous help
                                                      Claus Brod (ST Computer)
                                                Volker S”hnitz (Virendetektor)
                                   Chris Brookes (Professional Virus Killer 3)
                                               Martijn Wiedijk (Lucifer Eksod)
                                           Mike Watson (Sinister Developments)
                                                                Filipe Martins

'Fame' acknowledgements
                                      Niall McKiernon (Douglas Communications)
                                            Tarik Ahmia (TOS Magazine Germany)
                                               Willem Hartog (Atari ST Nieuws)
                                         Les Ellingham (New Atari User/Page 6)

Special thanks
                                                          Kai Holst (Antidote)

All other coding (what's left of it), research,  programming, resource design, 
text, manual, development, program collection and layout
                                                            Richard Karsmakers


12        TROUBLE SHOOTING CHART


 In  this  chapter  you will find some of the problems that  may  occur  while 
running  the "Ultimate Virus Killer" - and suggestions on how to prevent  them 
from appearing again.

* A 'NOT ENOUGH MEMORY' ALERT BOX APPEARS.
 Disable  all  desk accessories,  RAM disks and AUTO  folder  programmes  that 
occupy  memory  space.  Please note that cache programmes (such as  hard  disk 
speeders,  "Turbodos" and printer spoolers) also occupy a lot of  memory.  The 
"Ultimate Virus Killer" should also work on a machine with half a megabyte  of 
memory (it will not be able to restore any bootsectors then, though).

* AN  ERROR  MESSAGE OCCURS DURING PROGRAMME EXECUTION AND IT RETURNS  TO  THE 
DESKTOP UNWANTED.
 This  means  that  you've done something awkward  that  the  "Ultimate  Virus 
Killer" couldn't handle!  Please try to re-create this error message and write 
down  EXACTLY what you did to do it,  as well as some of your  system  details 
(TOS version,  amount of memory,  monitor mode,  etc.).  The bug will then  be 
avoided in future versions (hopefully).
 If  the error in question was an error '33' during the link  virus  partition 
scan,  this is due to a bug in GEM. The older the TOS version, the more likely 
it is that this error will occur. Nothing much can be done about it, as GEM is 
faulty  in  this  case.  You may try to use  the  "FOLDRxxx.PRG"  AUTO  folder 
programme, which serves to increase the GEMDOS internal memory pool. This will 
delay the occurrence of the error, but will not fix it.

* VERY MANY SYSTEM VARIABLES ARE PRINTED IN REVERSE WHEN DISPLAYING THE SYSTEM 
STATUS CHECK.
 You are probably using (a beta version of) a disk based TOS.  Reboot  without 
this.  The "Ultimate Virus Killer" works smoothly with all known TOS  versions 
on ROM.  Basically,  these inconveniences should only occur with a RAM version 
of any of the TOS versions.
 You  might also be using lots of unknown resident programmes,  e.g.  in  your 
(hard  disk)  AUTO  folder.  Please  send those to us  so  we  can  include  a 
recognition!  Send accessories as well,  and never forget to explain WHAT does 
WHAT and WHO made it!

* DISKS THAT YOU HAVE IMMUNIZED WITH VERSIONS 3.X ARE FOUND TO BE IMMUNIZED IN 
THE 'OLD' WAY, WHEREAS 3.X VERSIONS STATED THAT THEY WERE IMMUNIZED PROPERLY.
 Quite a while ago the immunization logics have been redesigned to fit some of 
the  later viruses,  and are therefore 'new' as of version 4.0 (this  was  the 
first  time  this was changed since version 3.3) and up.  It is  advisable  to 
immunize  your  disks anew with the current "Ultimate Virus  Killer"  version. 
Please  refer  to the VIRUSES.TXT file to check out against which  viruses  it 
protects  you.  Other  viruses can only be protected against by  keeping  your 
disks write-protected!

* WHENEVER  THE PROGRAMME WANTS YOUR ATTENTION (FOR EXAMPLE WHEN A  SUSPICIOUS 
BOOTSECTOR IS FOUND),  IT FLASHES THE SCREEN.  DURING THIS FLASHING,  YOU FIND 
THAT YOU REPEATEDLY HAVE TO LISTEN TO A SAMPLED SOUND OF SOME VARIETY.
 You  probably have a programme installed that changes your computer's  'bell' 
sound (chr$(7)) into a sample. A programme like this is Gribnif's "Newbell" by 
Dan Wilga. Disable this program.

* THE PROGRAMME REFUSES TO LOAD THE "DATA.PAK" FILE,  EVEN IF YOU DISABLE  ALL 
RAM DISKS AND ACCESSORIES.  YOU EVEN TURNED OFF THE MACHINE FOR 30 SECONDS AND 
YOU  BOOTED  WITH  THE ORIGINAL "ULTIMATE VIRUS KILLER" DISK  SO  THERE  CAN'T 
POSSIBLY BE SOMETHING IN MEMORY...
 Then you surely have a 512 Kb machine.  For the "DATA.PAK" file to be  loaded 
it needs more free memory than a 512 Kb machine has. Since the programme needs 
considerably less space to run WITHOUT the "DATA.PAK" file,  it decided not to 
load it.

* READING IN A BOOTSECTOR RESULTS IN A 'TRACK NOT FOUND' ERROR.
 Some games use exotic disk formats,  especially for their data disks (usually 
any  disk other than the boot disk).  Psygnosis,  for example,  is famous  for 
creating  these kind of formats.  This is NOT unusual,  and does NOT  indicate 
hardware/software failure,  nor virus infection.  If this happens with a  game 
boot disk (a disk labelled "1" or "A") this is no good news and DOES  indicate 
some  sort of disk failure (though no virus infection) - in case of  the  game 
not working either,  you should have it replaced by the company you bought  it 
from (refer to the game manual for details).

* THE PROGRAMME BOMBS OUT WHEN EXITING - USUALLY ABOUT SIX BOMBS.
 Do  you  have  the Rubrik's Screen Saver (on offer on  the  UK  magazine  "ST 
Format",  cover  disk #42) installed?  This has the problem that,  when it  is 
resident in your system,  all programmes written in "GfA Basic" versions  3.xx 
will  cause a bomb crash when exiting back to the desktop.  This even  happens 
with "GfA Basic" itself.

* THE PROGRAMME BOMBS OUT WHEN PERFORMING THE EXTENSIVE SYSTEM CHECK.
 Do  you  have Dan Wilga's (Gribnif's)  "Sysmon"  programme  installed?  Older 
versions of this program install an XBRA vector the wrong way which will  lead 
to the mentioned bomb error.  Either disable "Sysmon" from being installed  or 
skip  the  system check screen when starting the "Ultimate  Virus  Killer"  by 
keeping  [RIGHT SHIFT] pressed until the first regular dialog box  appears.  A 
special algorithm fixes this with some "Sysmon" versions.

* YOU  HAVE  FOUND  SEVERAL  DISKS  SOME TIME  AGO  AND  YOU  IMMUNIZED  THEM. 
EVERYTHING'S  OKAY  SO FAR,  BUT ONCE YOU EXIT YOUR  CURRENT  "ULTIMATE  VIRUS 
KILLER"  SESSION  YOU GET "IMMUNIZATIONS PERFORMED:  0" (OR ANY  OTHER  NUMBER 
LOWER THAN WHAT YOU THINK YOU HAVE ACTUALLY IMMUNIZED).
 The statistics apply only to the CURRENT session.  This means that this  line 
of  statistics  specifies  the  number  of  immunizations  you  have  actually 
performed  during  the current virus killer  session.  The  "HISTORY.PRG"  and 
"UVK.HST"  files  are used to maintain statistics across  sessions,  and  this 
option only works if you start the program from hard disk.

* AFTER RE-PARTITIONING YOUR HARD DISK OR INSTALLING ANOTHER HARD DISK DRIVER, 
THE  HIDDEN  HARD  DISK OPTION TELLS YOU THAT THE  HARD  DISK  BOOTSECTOR  HAS 
CHANGED AND GIVES A WARNING.
 Simply leave the programme, erase the "AVK.BUF" file in the root directory of 
hard  disk  partition "C:",  restart the "Ultimate Virus Killer" and  run  the 
hidden option again.

* YOU WANT TO CHECK DRIVE "U" BUT IT'S DISABLED.
 This is not a bug or anything. You are using "MultiTOS", which used drive "U" 
as the 'unified drive'.  This drive should never be checked for link  viruses, 
as it would irrevokably crash the system.


13        THE "ULTIMATE VIRUS KILLER" CONFIGURATION FILE


 As of version 5.8 the programme can be additionally configured with regard to 
the file extensions it handles as belonging to 'executable files' (i.e.  files 
that  you  can double-click on and execute from the desktop  directly  without 
having to 'install application').  When checking for link viruses, 'executable 
files' used to be only those with the extensions .PRG, .TOS, .APP, .TTP, .ACC, 
.PRX (disabled .PRG) and .ACX (disabled .ACC).
 It  is now possible to create a configuration file,  named "UVK.CNF",  to  be 
present in the "Ultimate Virus Killer" directory.  This configuration file can 
contain  up  to  8192 file extensions  of  executable  files.  When  selecting 
"executable files only" during link virus partition or folder scan,  only  the 
files with these specific extensions will be checked.

 If you have no configuration file in the main directory, the program will use 
the default extensions, listed above.

 The following rules apply to the "UVK.CNF" file.

1) Extension  entries  should be no longer than  4  characters,  including  an 
   obligatory "." as the leftmost character.

2) Remarks can be added on any line not containing an actual extension  entry. 
   They need to start off with ";".

3) The  file must be called "UVK.CNF" and it must be in the same directory  as 
   the "Ultimate Virus Killer" programme itself.

4) The  file  should be written in straight ASCII (i.e.  without  any  control 
   codes). This can be done with any text editor (such as "EdHak" or "Tempus") 
   or a word processor with WP mode switched off while saving.

 Below you'll find a sample configuration file:


;
; Ultimate Virus Killer configuration file
;
; These are the regular extensions
;
.PRG
.TOS
.APP
.TTP
.ACC
.CPX
;
; These are Neodesk special executable file extensions
;
.NPG
.NTP
;
; These are some common disabled versions of the above
;
.PRX
.ACX
.CPZ
;
; This is the 'GEM takes parameters' extension for TOS >2.00
;
.GTP
;
; End of file
;

 As of version 6.1,  the program supports a special extension that is used  to 
determine  the  minimum size a file must have in order to be  checked  in  the 
"check  all  files"  link  virus scan department.  You  can  use  any  of  the 
extensions you want for this (even multiple ones) but only the last one  found 
will be used so it's best the use the very last entry for this.
 The  format is ".XXX",  where "XXX" stands for the minimum size in  kilobytes 
(i.e.  the  actual  file size divided by 1024) from 0 to  999.  When  none  is 
specified,  the program uses a default minimum size of 3 Kb (i.e.  3072).  The 
larger the specified size, the quicker the link virus scan but the less safe!
 In  all  cases  fill up the value with zeroes to make sure the  length  is  3 
digits (so "123", "003" and "030" would be valid entries).


14        THE "ULTIMATE VIRUS KILLER" HISTORY FILE


 When  you are using the "Ultimate Virus Killer" from a hard disk  (!not  when 
running it from floppy disk!) it will write (or, when already present, it will 
update)  a  small  file  called "UVK.HST" that will be  located  in  the  same 
directory as that of the "Ultimate Virus Killer" programme.  Its contents  may 
be displayed on screen in any resolution offering 80 characters per line (i.e. 
80  columns) by double-clicking on the "HISTORY.PRG"  programme.  This  latter 
file  should  also  be located in the same directory as  the  "Ultimate  Virus 
Killer" programme.
 The  "UVK.HST" file will contain some statistics such as the total amount  of 
times the "Ultimate Virus Killer" was used, the total amount of time you spent 
using it, which TOS version it was last used on, how many viruses were killed, 
etc.

 You are requested for statistical purposes to supply a copy of your "UVK.HST" 
file every time you send in anything on disk to the feedback address.

</pre>
<br><br>
Back to [[Antivirus]]
[[Category:Antivirus]]