Virus Detection Utilities
by Glynn Clements

Running Virus opens a directory viewer containing three virus detection utilities.

AVDetect installs a module which detects attempts by the ArchieVirus to install itself. The module indicates to the virus that it is already installed, so that it doesn't install itself, and then generates an 'Attempted ArchieVirus initialisation' error. The module can be removed with '*RMKill VirusDetect'. The source code is saved as !AVDetect.AVDSrc.

EVDetect is a Wimp program which detects Extend virus initialisation. When run, the program adds an icon to the icon bar. Clicking Menu over this icon displays a menu containing a Quit option. The program detects the initialisation of a nameless Wimp task (a hallmark of the Extend virus), and notifies the user via a 'Possible Extend virus initialisation' error.

VScan scans a particular directory for Absolute (type &ff8) files that have been infected by the ArchieVirus. When run, the program prompts for the full pathname of the directory to scan, and whether to inoculate files against infection. For instance, to scan an ADFS hard disc, enter 'adfs::4.$'. Any files suspected of containing the virus will be reported with 'Suspected infection in <pathname>'. If inoculation is selected, any Absolute files will have the bytes 'Hypo1210' added to them. This fools the ArchieVirus into thinking that the file is already infected, while indicating to other inoculation programs that the file has been inoculated.
