(* > I have a big problem here. It's just, I want to make a simple >anti-virus, but I don't know how to locate, remove a virus. Anybody know >how to can you please teach me...or a source code would be better >Thankx...Bye! Here's a small program to find & eradicate the Taipan virus, but first the DOC file: Written on 26-11-94 by R. Loerakker (C) 1994 by R. Loerakker and the Virus Research Centre Holland DISCLAIMER ========== Warning. This product comes as is. The author, nor the VRCH can be held responsible for any damage done to your system, accidental or implied. However, this program should be safe and worked correct on our systems. PURPOSE ======= These source codes are provided to the public to show how a scanner engine could work. I provided them in two different languages to show that it doesn't really matter which one you use. The programs will, if compiled, search for the Tai-Pan (Whisper) virus on the current drive. They will not repair the file, they only report the infections. LANGUAGE ======== The languages I used to create these programs are both from Borland, named Borland Pascal 7.0 and Borland C++ 3.1 (with Application Frameworks). I used the normal Pascal syntax, without any object oriented code in it. The C version is also made without any object oriented code (C++ extensions). The object oriented programming style can be adapted if your scanner has to cope with more viruses. You can make a OOP database of the viruses. DRAWBACKS ========= These programs have some drawbacks and I will give them here : * they don't scan in archives * they don't scan inside packed executables * they won't disinfect an infected file * they don't use anti-stealth techniques (not needed for Tai-Pan) * Some other (dumb) scanners can give a false alarm, identifying the compiled source as Tai-Pan. These scanners do scan the whole file, not just the entrypoint (as I do). They can find a piece of Tai-Pan (the signature) in the data segment of the program. LEGAL RIGHTS ============ You may use these sourcecodes to make your own scanner for a certain virus, without any restrictions. I would like it if you leave my name in it, because I also spent some time in it, escpecially learning C, which is not my best language (yet). The source code may be copied freely, as long as the three files are included (FINDTAI.CPP, FINDTAI.PAS and this FINDTAI.DOC). There are no objections for adding BBS advertisements in the archive and the archive may be converted to another type. Publishing on a CD-ROM is also no problem. If you make your own scanner for a virus with these source codes, I would like a copy of the program (also the sourcecode if you want to). VRCH (Virus Research Centre Holland) ==================================== The VRCH is an independed organisation that helps people and companies with getting rid of viruses. We also hope to give a certain education and making people more virus-aware. We produce a wide range of antivirus software, from individual cleaners to source code like this. Most of these programs are freeware, unless otherwise stated, but money is always welcome to cover the expenses. If you have any problems with viruses, please contact us and we might be able to help you. THE AUTHOR ========== Richard Loerakker Albert Schweitzerstraat 3 2851 CC HAASTRECHT Tel. 01821-3050 Note : This address will be invalid from 17th of December, because I am moving. I will give the new address when I am settled at my new place. Meanwhile, you still can send to the above address and I will receive it anyway. GREETINGS ========= First I want to thank Rob Vlaardingerbroek, former president of the Virus Research Centre Holland, for helping me with these projects. Also thanks for the other members for supporting me with keeping VRCH alive after Rob has thanked for his position in VRCH. Also thanks to Righard Zwienenberg (CSE) for pointing out a flaw in the C code. Further thanks go to : My parents (ofcourse) Industrial Man of Intertia Thanks for putting up a seperate VRCH area on your BBS for uploading my newest programs. Rob Greuter (F-PROT Nederland) The professional version is very good, indeed. I hope to see it in the "SLB diensten" soon. Fernando Cassia The cards were beautiful, and would love to see a video of your country (and maybe you?) Hans-G”ran Andersson Thanks for the letter, I appreciate it. Hans Janson Thanks for mentioning the bug in K-JUNKIE (1.0) Jan Hekking Also thanks for pointing out the bug in K-JUNKIE (1.0) Also greetings to all other authors of antivirus software! AT LAST ======= You hope that you can use these sourcecodes and that you might have learned more about fighting viral infections. Regards, Richard Loerakker Technical President of the Virus Research Centre Holland *** *** C:\T\T\FINDTAI.PAS (*========================================================================= Source : FINDTAI.PAS Version : 1.0 Compiler : Borland Turbo Pascal 7.0 Date : 26-11-1994 Author : R. W. Loerakker Purpose : Short course on scanning viruses Description : This program is just made as a demonstration program on how you can make a program to scan for a certain virus. This doesn't mean this is perfect. It's just an example of how a scanner engine might work. This detects the TAI-PAN virus in infected files on the current drive. =========================================================================*) Uses Crt, DOS; Const Sig : Array[0..9] of Byte = ($e8,$00,$00,$5e,$83,$ee,$03,$b8,$ce,$7b); Var F : File; Buf1 : Array [0..$1C] Of Byte; Buf2 : Array [0..30] Of Byte; Nr, Hp, Cs, Ip : Word; Ep: LongInt; Infected : Integer; Attrib : Word; Function Up (S : String) : String; Var I : Integer; Begin For I := 1 To Length (S) Do S [I] := UpCase (S [I] ); Up := S; End; Function Rep (Times : Integer; What : String) : String; Var Tmp : String; I : Integer; Begin Tmp := ''; For I := 1 To Times Do Tmp := Tmp + What; Rep := Tmp; End; Function Compare ( B : Array Of Byte) : Boolean; Var C : Byte; IsIt : Boolean; Begin IsIt := True; C := 0; While (C <= 9) And (IsIt) Do Begin If B[C] <> Sig[C] Then IsIt := False; Inc(C); End; Compare := IsIt; End; Procedure FExe (N : String); Begin FileMode := 0; If Pos ('.EXE', N) <> 0 Then Begin Assign (F, N); GetFAttr (F, Attrib); SetFAttr (F, 0); FileMode := 2; Reset (F, 1); BlockRead (F, Buf1, SizeOf (Buf1), Nr); Ep := 0; If Buf1[0]+(Buf1[1] * 256) = $5a4d Then Begin Hp := Buf1 [8] + Buf1 [9] * 256; Ip := Buf1 [$14] + Buf1 [$15] * 256; Cs := Buf1 [$16] + Buf1 [$17] * 256; Ep := Cs + Hp; Ep := (Ep * 16 + Ip) And $FFFFF; End; Seek (F, Ep); BlockRead (F, Buf2, SizeOf (Buf2), Nr); Write (N); If Compare ( Buf2) Then Begin WriteLn (Rep (60 - Length (N), ' '), 'Infected. '); Inc (Infected); End Else Write (Rep (60 - Length (N), ' '), 'Clean.'#13); Close (F); SetFAttr (F, Attrib); End; End; Procedure SDir ( SPath : String); Var S : SearchRec; Begin FindFirst (SPath + '*.*', AnyFile Xor VolumeID, S); If S. Name = '.' Then Begin FindNext (S); FindNext (S); End; If (DosError = 0) And (S. Attr And Directory <> Directory) Then Begin FExe (SPath + S. Name); FindNext (S); End; While DosError = 0 Do Begin If (S. Attr And Directory = Directory) Then Begin SDir (SPath + S. Name + '\'); End Else FExe (SPath + S. Name); FindNext (S); End; End; Begin WriteLn ('F-TAIPAN V1.0 (C) 1994 by R. Loerakker'); WriteLn; WriteLn ('Searching for TAI-PAN...'); WriteLn; Infected := 0; SDir (Copy (Up (ParamStr (0) ) , 0, 2) + '\'); ClrEol; WriteLn (Infected, ' infected files found.'); End. ***