Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!cs.utexas.edu!usc!srhqla!quad1!ttidca!woodside
From: woodside@ttidca.TTI.COM (George Woodside)
Newsgroups: comp.sys.atari.st
Subject: Re: Key virus NOT harmless
Message-ID: <9989@ttidca.TTI.COM>
Date: 16 Feb 90 12:32:19 GMT
References: <3117@caesar.cs.montana.edu> <2059@mrsvr.UUCP>
Reply-To: woodside@ttidcb.tti.com (George Woodside)
Organization: Citicorp/TTI, Santa Monica
Lines: 36

In article <2059@mrsvr.UUCP> krieg@jupiter.UUCP (Andrew Krieg) writes:
>I have been infected by a virus.  Using VKILLER 2.2 I have learned that I
>have the 'Key' virus that everyone is talking about.  It is waiting for a 
>certain disk to be inserted before it does its damage.  Thankfully, I never 
>inserted that disk.  By the spread of the virus (about 25 of my disks) I have
>determined that I have had the virus for about 3 weeks.  Now, I probably still 
>have the program that generated the virus in the first place.  Is there any 
>way to test for that?  I'd like to determine where I picked it up from.

I know of no programs which spawn the "KEY", or any other virus (on the ST)
as of this date. The only way to get infected is to boot your system from
an infected disk.

As for testing for a "spawn" program, I'm about to submit the new VKILLER
to the binaries group. It will provide a means of installing a tiny
monitoring program which will check all passing floppies for executable
boot sectors. If you run a program which installs a virus on a disk,
the next access to that disk will cause an alarm to be triggered.

The new version has been beaten to death by some of my long suffering
friends (to whom I express my gratitude for their patience and efforts)
and is heading for the net, Compuserve, and GEnie this weekend (Feb 17).

It still does not deal with hard disks, because I have no concrete
information about any virus which is hard disk specific. It does not
deal with link viruses, for the same reason. 

I have developed some new software to deal with link viruses, or 
program alteration in general, but it is a bit too large to install
into the working version of VKILLER. I'll be submitting a separate
program to deal with those, in the near future. Please be patient.

-- 
* George R. Woodside - Citicorp/TTI - Santa Monica, CA *
* Path:       woodside@ttidca                          *
*   or:       ..!{philabs|csun|psivax}!ttidca!woodside *