[Back to MISC SWAG index] [Back to Main SWAG index] [Original]

    (*
    >        I have a big problem here. It's just, I want to make a simple
    >anti-virus, but I don't know how to locate, remove a virus. Anybody know
    >how to can you please teach me...or a source code would be better
    >Thankx...Bye!
    Here's a small program to find & eradicate the Taipan virus, but first the DOC file:

                      Written on 26-11-94 by R. Loerakker

                            (C) 1994 by R. Loerakker
                                    and the
                         Virus Research Centre Holland

    DISCLAIMER
    ==========

            Warning. This product comes as is. The author, nor the VRCH can
            be held responsible for any damage done to your system,
            accidental or implied. However, this program should be safe and
            worked correct on our systems.

    PURPOSE
    =======

            These source codes are provided to the public to show how a
            scanner engine could work. I provided them in two different
            languages to show that it doesn't really matter which one you
            use. The programs will, if compiled, search for the Tai-Pan
            (Whisper) virus on the current drive. They will not repair the
            file, they only report the infections.

    LANGUAGE
    ========

            The languages I used to create these programs are both from
            Borland, named Borland Pascal 7.0 and Borland C++ 3.1 (with
            Application Frameworks). I used the normal Pascal syntax,
            without any object oriented code in it. The C version is also
            made without any object oriented code (C++ extensions). The
            object oriented programming style can be adapted if your scanner
            has to cope with more viruses. You can make a OOP database of
            the viruses.

    DRAWBACKS
    =========

            These programs have some drawbacks and I will give them here :
            * they don't scan in archives
            * they don't scan inside packed executables
            * they won't disinfect an infected file
            * they don't use anti-stealth techniques (not needed for
              Tai-Pan)
            * Some other (dumb) scanners can give a false alarm, identifying
              the compiled source as Tai-Pan. These scanners do scan the
              whole file, not just the entrypoint (as I do). They can find
              a piece of Tai-Pan (the signature) in the data segment of the
              program.

    LEGAL RIGHTS
    ============

            You may use these sourcecodes to make your own scanner for a
            certain virus, without any restrictions. I would like it if you
            leave my name in it, because I also spent some time in it,
            escpecially learning C, which is not my best language (yet). The
            source code may be copied freely, as long as the three files are
            included (FINDTAI.CPP, FINDTAI.PAS and this FINDTAI.DOC). There
            are no objections for adding BBS advertisements in the archive
            and the archive may be converted to another type. Publishing on
            a CD-ROM is also no problem. If you make your own scanner for a
            virus with these source codes, I would like a copy of the
            program (also the sourcecode if you want to).

    VRCH (Virus Research Centre Holland)
    ====================================

            The VRCH is an independed organisation that helps people and
            companies with getting rid of viruses. We also hope to give a
            certain education and making people more virus-aware. We produce
            a wide range of antivirus software, from individual cleaners to
            source code like this. Most of these programs are freeware,
            unless otherwise stated, but money is always welcome to cover
            the expenses. If you have any problems with viruses, please
            contact us and we might be able to help you.

    THE AUTHOR
    ==========

            Richard Loerakker
            Albert Schweitzerstraat 3
            2851 CC  HAASTRECHT
            Tel. 01821-3050

            Note :  This address will be invalid from 17th of December,
                    because I am moving. I will give the new address when I
                    am settled at my new place. Meanwhile, you still can
                    send to the above address and I will receive it anyway.

    GREETINGS
    =========

            First I want to thank Rob Vlaardingerbroek, former president of
            the Virus Research Centre Holland, for helping me with these
            projects. Also thanks for the other members for supporting me
            with keeping VRCH alive after Rob has thanked for his position
            in VRCH. Also thanks to Righard Zwienenberg (CSE) for pointing
            out a flaw in the C code. Further thanks go to :

            My parents (ofcourse)
            Industrial Man of Intertia
                    Thanks for putting up a seperate VRCH area on your BBS
                    for uploading my newest programs.
            Rob Greuter (F-PROT Nederland)
                    The professional version is very good, indeed. I hope to
                    see it in the "SLB diensten" soon.
            Fernando Cassia
                    The cards were beautiful, and would love to see a video
                    of your country (and maybe you?)
            Hans-G�ran Andersson
                    Thanks for the letter, I appreciate it.
            Hans Janson
                    Thanks for mentioning the bug in K-JUNKIE (1.0)
            Jan Hekking
                    Also thanks for pointing out the bug in K-JUNKIE (1.0)

            Also greetings to all other authors of antivirus software!

    AT LAST
    =======

            You hope that you can use these sourcecodes and that you might
            have learned more about fighting viral infections.

            Regards,

            Richard Loerakker
            Technical President of the Virus Research Centre Holland

    ***

    *** C:\T\T\FINDTAI.PAS
    (*=========================================================================

    Source      : FINDTAI.PAS
    Version     : 1.0
    Compiler    : Borland Turbo Pascal 7.0
    Date        : 26-11-1994
    Author      : R. W. Loerakker
    Purpose     : Short course on scanning viruses
    Description : This program is just made as a demonstration program on how
                  you can make a program to scan for a certain virus. This
                  doesn't mean this is perfect. It's just an example of how
                  a scanner engine might work. This detects the TAI-PAN virus
                  in infected files on the current drive.

    =========================================================================*)
    Uses Crt, DOS;

    Const
      Sig : Array[0..9] of Byte = ($e8,$00,$00,$5e,$83,$ee,$03,$b8,$ce,$7b);

    Var F : File;
      Buf1 : Array [0..$1C] Of Byte;
      Buf2 : Array [0..30] Of Byte;
      Nr, Hp, Cs, Ip : Word;
      Ep: LongInt;
      Infected : Integer;
      Attrib : Word;

    Function Up (S : String) : String;
    Var I : Integer;
    Begin
      For I := 1 To Length (S) Do
        S [I] := UpCase (S [I] );
      Up := S;
    End;

    Function Rep (Times : Integer; What : String) : String;
    Var Tmp : String;
      I : Integer;
    Begin
      Tmp := '';
      For I := 1 To Times Do
        Tmp := Tmp + What;
      Rep := Tmp;
    End;

    Function Compare ( B : Array Of Byte) : Boolean;
    Var
      C : Byte;
      IsIt : Boolean;
    Begin
      IsIt := True;
      C := 0;
      While (C <= 9) And (IsIt) Do
      Begin
        If B[C] <> Sig[C] Then IsIt := False;
        Inc(C);
      End;
      Compare := IsIt;
    End;

    Procedure FExe (N : String);
    Begin
      FileMode := 0;
      If Pos ('.EXE', N) <> 0 Then Begin
      Assign (F, N);
      GetFAttr (F, Attrib);
      SetFAttr (F, 0);
      FileMode := 2;
      Reset (F, 1);
      BlockRead (F, Buf1, SizeOf (Buf1), Nr);
      Ep := 0;
        If Buf1[0]+(Buf1[1] * 256) = $5a4d Then Begin
          Hp := Buf1 [8] + Buf1 [9] * 256;
          Ip := Buf1 [$14] + Buf1 [$15] * 256;
          Cs := Buf1 [$16] + Buf1 [$17] * 256;
          Ep := Cs + Hp;
          Ep := (Ep * 16 + Ip) And $FFFFF;
        End;
        Seek (F, Ep);
        BlockRead (F, Buf2, SizeOf (Buf2), Nr);
        Write (N);
        If Compare ( Buf2) Then Begin
          WriteLn (Rep (60 - Length (N), ' '), 'Infected. ');
          Inc (Infected);
        End
        Else Write (Rep (60 - Length (N), ' '), 'Clean.'#13);
      Close (F);
      SetFAttr (F, Attrib);
      End;
    End;

    Procedure SDir ( SPath : String);
    Var S : SearchRec;
    Begin
      FindFirst (SPath + '*.*', AnyFile Xor VolumeID, S);
      If S. Name = '.' Then
      Begin
        FindNext (S);
        FindNext (S);
      End;
      If (DosError = 0) And (S. Attr And Directory <> Directory) Then
      Begin
        FExe (SPath + S. Name);
        FindNext (S);
      End;
      While DosError = 0 Do
      Begin
        If (S. Attr And Directory = Directory) Then
        Begin
          SDir (SPath + S. Name + '\');
        End
        Else
          FExe (SPath + S. Name);
        FindNext (S);
      End;
    End;

    Begin
      WriteLn ('F-TAIPAN V1.0 (C) 1994 by R. Loerakker');
      WriteLn;
      WriteLn ('Searching for TAI-PAN...');
      WriteLn;
      Infected := 0;
      SDir (Copy (Up (ParamStr (0) ) , 0, 2) + '\');
      ClrEol;
      WriteLn (Infected, ' infected files found.');
    End.
    ***

[Back to MISC SWAG index] [Back to Main SWAG index] [Original]