CU Amiga Super CD-ROM 27/CU Amiga Magazine's Super CD-ROM 27 (1998)(EMAP Images)(GB)[!][issue 1998-10].iso/GoodBye/JohnKennedy/February96.lha/FEATURES/VIRUS.LHA/virus.doc

Text File | 1996-02-16 | 11.3 KB | 312 lines

** Hi. Here is the Amiga Virus thing. I'm waiting for some
more feedback from various people, but this is all I have on
Friday morning. If there is any more, I'll forward it as
soon as possible!

Sadly I can't work out a way to get 20-30 Mb of data over to
the office, so it looks as though my computer graphic epic
"Diary of a Freelance CUAmiga Writer" won't be able to go
onto the CDROM. I can't find anyone to lend me a Zip or
Syquest drive :-((( **


Amiga Virus



A Virus can be a big problem. In a worst case scenario, it
can destroy your software collection, re-format your
harddrive and even potentially damage a video monitor.
Plenty of scare stories abound, and newspapers love to run
half-fact half-myth stories and this high tech scourge.

Even Bill Gate's new operating system was soon at risk,
through word processing documents that could apparently act
independantly. It's a crazy, scarey world out there -- are
you prepared for the worst?


What is a virus?

Don't panic, a virus is not alive, it's only a computer
program. However, that's not to say it's not dangerous -- or
even that it doesn't exhibit life-like symptoms. For
example, like a real life virus, a virus computer program
replicates itself at every opportunity, writing copies of
itself to every disk it comes into contact with. Each of
these copies is the same as the original, and will continue
to try spreading.

Some viruses hide in the boot sectors of floppy disks. The
boot sectors are special because when the Amiga is reset and
a floppy disk present, it loads in the boot sectors and runs
the data they contain them as a program. Normally this
program triggers the loading of the Workbench or loads a
Game, but if a virus is stored there, it will be loaded into
memory and executes. As the Amiga is an excellent
multitasking system it can lurk for ages, waiting for a new
disk to be inserted so it can copy itself to the
bootsectors.

If the newly inserted disk is a game with a custom
bootblock, the virus can overwrite it and therefore make the
game useless. Unfortunately a virus can do even more damage:
some are program to perform various nasty acts after a
certain amount of time. Some viruses will corrupt or format
a hard disk for example, some will put up irritating
messages on the screen or make the mouse pointer vanish.

Other strains of virus don't require to be booted, and can
sneak into your system in various other ways. Some disguise
themselves as normal programs in your c: directory, some
misuse the operating systems disk validation system.

The most common way in which viruses spread was through
pirated games and demo disks -- disks which needed to be
booted. Often, users would perform a warm reset
(Control-Amiga-Amiga) after loading a demo or game, and then
pop in a disk to do something else: instant infection. It
has also been known for a virus to pop up on magazine
coverdisks: I was caught out once with the Saddam virus when
compiling a disk for an Amiga magazine (not this title, of
course) about four years ago. It was an unpleasant
experience, I can promise you.

With the rise and rise of comms in general and the Internet
in particular, the opportunities for viruses to spread is
ever greater. The Aminet is the definitive Amiga software
site on the Internet -- if you upload a program there, it
can be used by thousands of users all over the world in
hours. Needless to say that the keepers of Aminet make
stringent anti-virus tests. Bulletn Boards are an excellent
source of software, but can also be potential risks. Many
boards cater for a variety of machines, and many are run on
a PC. The PC sysops may not have the tools at his disposal
to check Amiga format uploads for nasty extras, so be extra
careful when using download programs. DMS files are risky,
as they contain a snapshot of an entire disk, including the
bootblock data.

The good news is that clearly, the virus threat has
diminished from a few years ago, when every magazine Q&A
postbag was full of distraught users asking why their disks
had been re-named "Lazarus" (a perfect example of how a
non-existant virus got the blame). Raising the awareness of
users and good anti-virus tools have made a difference and
virus related disasters are relatively uncommon today.

In a perverse way the lack of new Amiga viruses can actually
be seen to be a bad sign about the state of the Amiga.
No-one is praising virus programmers, but the fact that most
have turned their attentions to the PC is indicative that
the Amiga is not as "hip" as it once was. Amiga innovation
is at an all time low, but let's just hope that when things
start rolling again we will leave virus writers behind.

However, don't get complacent: the threat is still there
lurking on old disks and untested programs from BBS systems.
It can only take one virus on a disk you forgot to test to
infect your entire collection, and potentially wipe out
years of work. Be vigilent!



* What can be done to prevent virus attacks?

The best cure is not to catch a virus in the first place,
and the only way to be completeluy safe is to leave you
Amiga switched off. If you do turn it on, make sure you
never put a floppy disk in the drive or use a modem. Sadly,
most people want to use disks and modems, so here are some
handy hits for safer hex.

    * Don't touch pirated software. Not only is Pirating
    software illegal and damaging to the Amiga market as a
    whole, but it is the prime way in which viruses are
    spread.

    * Use the most up-to-date Virus software you can find.
    Use it frequently. If you have a hard drive, keep it
    running all the time.

    * Be especially careful about using public domain or
    shareware software you have downloaded yourself. Test
    the files with a virus checker

    * When using a hard drive you may want to deactivate it
    when using software you are wary of. You can do this
    from the boot-up menu (hold down the two mouse buttons).

    * Make regular backups. Be careful to make several
    generations of backups in case you unwittingly back up
    infected files and overwrite your older (but
    un-infected) backup.

    * Keep the write protect tabs on your floppies open to
    prevent anything writing to your disks without your
    knowledge.

    * Switch your Amiga off between games, and keep the
    power off for at least 30 seconds to make sure nothing
    is left lurking in memory.

    * If you use electronic mail, beware of warning messages
    about certain viruses (for example, Good Times) asking
    you to spread the word. In this case, it's the idea of
    the warning message itself which is the virus as it is
    spread around the world by worried users keen to warn
    their friends.









Chris Wiles
Active Software


Q. Are viruses on the Amiga as great a program as they were?

Not really - the "hype" or worry that surfaced with virus
problems has died in the last two years.

Beginners and new users always worry, however. They imagine
that a virus has entered a disk when they encouter a problem
- be it a read/write error, non-dos disk or simply the fact
that a program is not installed correctly.

There is very little chance of finding a virus. Probably
about 1 in every 1000 disks you bought may have a virus,
maybe less.

Despite general opinions, major Public Domain libraries are
usually very virus-free. Simply because programs are checked
by BBS's, the Internet, submitters and then the library that
receives them.

There are two ways of preventing virii attack:

1. Always keep you write-protect tab UP on a floppy disk
2. Keep a virus checker in your WBStartup drawer on bootup


Q. Has the Internet made any difference?

There are very few virus problems on the Aminet - not sure
about the Internet in general. The guys behind the Aminet
and the Aminet CD's (and, indeed most CD's!!) check and
double-check every file for every kind of virus.

There will be problems on the Internet - but if you take the
recommended precautions - you will be safe.

Q. If there are fewer new viruses does this mean,
perversely, the Amiga is doing badly as a computer?

I think the Amiga has "had it's day" from virus makers. Most
are corrupt individuals who like to attack the masses.

They target business users, console makers etc. I believe
"they" would love to get a uncontrollable virus into a
console game, mass market PC game etc...once it has
installed to your hard drive then the destruction starts.

The Amiga is much more an enthusiasts model at the time of
writing. In the future this may change with the
"re-invention" of the OS and main CPU (RISC), but for now PC
is the target.


Q. How have CDROM compilations made the threat of viruses
better or worse?


Bizarrely a mixture of both. Better as there is generally
much more control. As stated before, the Aminet CD's (as an
example) are tested and re-tested for virii, so the chance
of finding a virus on one of those CD's will be minimal.

It has made it worse due to the fact there are SO many files
present on the CD and therefore *increases* the chance of
finding a virus.

For instance, if a company decided to throw together a games
CD in record time (i.e. started in August for October
release) they will not have time to test the CD properly,
never mind test and re-test for virii. That could be a
worry. There are many smaller companies trying to jump on
the CD bandwagon as quickly as possible - just make sure
your CD's are as free from virii as possible.


Q. What is the worst virus related incident you have heard
of/in your experience?

Truth be known - I have never encountered any more than a
weak or old virus for over 3 or four years.

We do get calls from customers who insist a virus has
"wrecked my Workbench disk" or "wiped my C drawer".
Generally these are simple problems that are not the fault
of a virus. It is not their fault - they are victims of
anti-virus publicity, therefore they *assume* that it is a
virus.

Another good idea is too make backups of your most important
data and disks. If the worst comes to the worst, at least
you have data to put back onto a re-formatted drive.







(** Here are some comments from people from Usenet, you may
want to make them into little pullquotes and scatter them
around **)



The only problem I have had with a virus was when my parents
brought back some pirated software from Singapore. It was a
sadam virus which was fairly easy to get rid of with
Virus_Checker.I tend not to rush off and get the latest
version of a software release as soon as it appears and I
also limit myself to Aminet. I know that corrupted software
has appeared on Aminet but they seem to be pretty good at
removing it when it's pointed out to them. My usage of
Aminet has dropped off since getting CDROM and Aminet Sets 1
& 2.

Ian


I have never had one from the net (in just over a year
-probably not the best thing to say!) I had one from a
(small) BBS. The only other virus I have come accross was
the Sadam one I got that from The Jolly Rodgers Cook Book -A
'friend' brought round to show me -The Virus -he thought it
was funny.

Duncan, [e-mail]



Personally I have only ever caught two viruses (viri?) and
these were both before I was on the net, however having said
that, I normally have the latest version of VirusChecker
running in the background, always infact unless I do a
minimum boot, which is usually only to run Lightwave, and
definitely no Net access, as Rexx and Amitcp are not started
either...

I think most legitimate ftp sites run careful checks on all
uploaded software, aminet certainly does...

Laurie, [e-mail]