Listing 1: Virus_Scout.p

{ ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

• MODULE ..... Virus Scout

• DATE ....... June 1990

• AUTHOR ..... David T. Craig

• ADDRESS .... 9939 Locust # 4013, Kansas City, MO 64131

• LANGUAGE ... Apple MPW Pascal 3.0

• COMPUTER ... Apple Macintosh

••••••••••••••••••••••••••••••••••••••••••••••••••••• }

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••••

•

• FILE INFORMATION:

•

• This file contains a very simple virus detection routine. This

routine attempts to detect the following viri:

•

• Scores nVIR Hpat AIDS MEV# INIT29 ANTI MacMag JUDE

•

• If one of these viri is found, then a flag is set in the output

parameter for the particular virus.

•

• Refer to the superb Disinfectant program and its documentation

for the details behind Macintosh viri.

•

• Note: Viri ANTI and MacMag are not detected since I don't have

any technical information on how to detect them.

•

•••••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

UNIT Virus_Scout;

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

INTERFACE

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

USES

MemTypes, QuickDraw, OSIntf, OSUtils, ToolIntf, PackIntf, Traps,

Printing, Picker, Perf, PasLibIntf;

{$S SgVirusScout}

TYPE

gt_VirusTypes = PACKED RECORD

virus_Scores : BOOLEAN;

virus_nVir : BOOLEAN;

virus_Hpat : BOOLEAN;

virus_AIDS : BOOLEAN;

virus_MEV : BOOLEAN;

virus_INIT29 : BOOLEAN;

virus_ANTI : BOOLEAN;

virus_MacMag : BOOLEAN;

virus_JUDE : BOOLEAN;

END;

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••••

• Routine : Virus_Found

• Purpose : Test if any viri exist within the program or system

file

• Input : (none)

• Output : Virus_Found - True --> virus was found in program or

system

• vTypes - types of found viri

• Notes : Reference: Disinfectant 1.1 documentation (April 16,

1989)

•••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

FUNCTION Virus_Found (VAR vTypes : gt_VirusTypes) : BOOLEAN;

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

IMPLEMENTATION

{ •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

{$R+ } { enable range checking }

{$D+ } { place debugger symbols in object code }

{$MC68020-} { always produce plain 68000 code here }

{ ••••••••••••••••••••••••••••••••••••••••••••••••••••••

• Routine : Virus_Found

•••••••••••••••••••••••••••••••••••••••••••••••••••••••• }

FUNCTION Virus_Found (VAR vTypes : gt_VirusTypes) : BOOLEAN;

VAR

sob_virus : BOOLEAN; { virus found flag }

res_count : INTEGER; { resource type count }

res_handle : Handle; { resource data handle }

machine_info : SysEnvRec; { machine low-level info }

finder_info : FInfo; { Finder info for a file }

vf_error : gt_Error; { error result }

BEGIN { ------ Virus_Found ------ }

{ fetch the volume refnum for the Macintosh System Folder }

vf_error := SysEnvirons(1,machine_info);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ Scores virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find file "Scores" or "Desktop " in System Folder] }

vf_error := GetFInfo('Scores',machine_info.SysVRefNum, finder_info);

vTypes.virus_Scores := (vf_error = NoErr);

IF vTypes.virus_Scores = FALSE THEN

BEGIN

vf_error := GetFInfo('Desktop

',machine_info.SysVRefNum, finder_info);

vTypes.virus_Scores := (vf_error = NoErr);

END;

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ nVir virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "nVIR" resource in app or System File] }

res_count := CountResources('nVIR');

vTypes.virus_nVir := (res_count > 0);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ JUDE virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "JUDE" resource in app or System File] }

res_count := CountResources('JUDE');

vTypes.virus_JUDE := (res_count > 0);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ Hpat virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "Hpat" resource] }

res_count := CountResources('Hpat');

vTypes.virus_Hpat := (res_count > 0);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ AIDS virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "AIDS" resource] }

res_count := CountResources('AIDS');

vTypes.virus_AIDS := (res_count > 0);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ MEV# virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "MEV#" resource] }

res_count := CountResources('MEV#');

vTypes.virus_MEV := (res_count > 0);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ INIT29 virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: find "INIT" 29 resource] }

res_handle := GetResource('INIT',29);

vTypes.virus_INIT29 := (res_handle <> NIL);

IF res_handle <> NIL THEN ReleaseResource(res_ handle);

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ ANTI virus +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: ?????????????????????????] }

vTypes.virus_ANTI := FALSE; { ??? NEED TO ADD TEST ??? }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ MacMag vir +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ [method: ?????????????????????????] }

vTypes.virus_MacMag := FALSE; { ??? NEED TO ADD TEST ??? }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

{ +++++ result of the virus hunt to caller +++++ }

{ +++++++++++++++++++++++++++++++++++++++++++++++++++++++ }

sob_virus := FALSE; { assume no viri were found }

WITH vTypes DO

BEGIN

IF virus_Scores THEN sob_virus := TRUE;

IF virus_nVir THEN sob_virus := TRUE;

IF virus_Hpat THEN sob_virus := TRUE;

IF virus_AIDS THEN sob_virus := TRUE;

IF virus_MEV THEN sob_virus := TRUE;

IF virus_INIT29 THEN sob_virus := TRUE;

IF virus_ANTI THEN sob_virus := TRUE;

IF virus_MacMag THEN sob_virus := TRUE;

IF virus_JUDE THEN sob_virus := TRUE;

END; { WITH vTypes }

Virus_Found := sob_virus;

END; { ------ Virus_Found ------ }

END.