English Amiga Board


Go Back   English Amiga Board > Other Projects > project.TOSEC (amiga only)

 
 
Thread Tools
Old 20 October 2009, 17:45   #1
andreas
Zone Friend
 
Join Date: Jun 2001
Location: Germany
Age: 44
Posts: 5,857
Send a message via ICQ to andreas Send a message via AIM to andreas
Roll eyes (sarcastic) False virus alerts...?

Hi there renamers,

if one has his own tool to check things, he prefers to not believe in already renamed ones - same with me.

I tried to scan a handful of images with THREE different Amiga tools and could not find a SADDAM virus.
Neither did I with my own tool.

Lo' and behold: the only tool that did alert a SADDAM infection was T. W.'s ADFscan running on Win32. I'm beginning to believe that these are false alarms, since not even VT-Schutz, VirusX, VirusZ (et al) seem able to detect a SADDAM in there.

Could anyone please recheck the following images whether they really contain a SADDAM or not?

Star Wars - The Empire Strikes Back (1988)(Domark)[cr QTX][v Saddam 1] 189FB896

Ancient Battles (1990)(CCS)[cr CLS - RZR][v Saddam 1] FF48FE04

Ancient Battles (1990)(CCS)[cr CLS - RZR][v Saddam 1][a] 252A2F17

Ancient Battles (1990)(CCS)[cr CLS - RZR][v Saddam 1][a2] 38173314

Ancient Battles (1990)(CCS)[cr CLS - RZR][v Saddam 1][a3] FC501FFB

Monster Business (1992)(Eclipse)[cr VF][v Saddam 1] 68B319FF

Monster Business (1992)(Eclipse)[cr VF][v Saddam 1][a] 9A8A05EA

Last edited by andreas; 13 November 2009 at 21:41.
andreas is offline  
Old 20 October 2009, 17:52   #2
cosmicfrog
The 1 who ribbits
cosmicfrog's Avatar
 
Join Date: Apr 2006
Location: leek, Staffs, UK
Age: 51
Posts: 3,555
Send a message via MSN to cosmicfrog
did`t saddam hide its self Disk-Validator ?? so if thats not on the disk then saddam cant be there, been a long time can you confirm this ???
cosmicfrog is offline  
Old 20 October 2009, 18:49   #3
andreas
Zone Friend
 
Join Date: Jun 2001
Location: Germany
Age: 44
Posts: 5,857
Send a message via ICQ to andreas Send a message via AIM to andreas
Not 100%, since there are too many variants. But both VirusX and VirusZ ought to know all variants by now. That aside...yes: the most known type uses a bogus disk validator and modifies data blocks by replacing the data longword $00000008 (on the block header) by "IRAK" *AND* encoding the rest of it using a certain algorithm.

Last edited by andreas; 20 October 2009 at 20:28.
andreas is offline  
Old 08 November 2009, 21:24   #4
mai
Moderator
mai's Avatar
 
Join Date: Feb 2008
Location: Stendal/Germany
Age: 50
Posts: 4,776
I have just checked:
Star Wars - The Empire Strikes Back (1988)(Domark)[cr QTX][v Saddam 1] 189FB896
on my real A1200 with three different Antivirus tools. (VT-Schutz, VirusZ III, Virusexecutor)
None of these programs was able to detect any virus.
mai is offline  
Old 08 November 2009, 22:16   #5
formater
Registered User
formater's Avatar
 
Join Date: May 2007
Location: Alicante/Spain
Posts: 192
Saddam Virus is hidden in Disk-Validator. If the disks aren't this file, the Saddam are dead, but perhaps some of the effects of the virus are in these disks.
One form of test if the virus infect some disk is insert the souspicious disk in diskdrive, and then insert a normal workbench disk WITHOUT Disk-validator, wait a bit and then, if the file appear in the disk, you have a Saddam.
formater is offline  
 


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Similar Threads
Thread Thread Starter Forum Replies Last Post
virus (or false positive) on CARE site! BuckoA51 project.CARE 7 21 September 2011 00:08
ASM: false int vector ($60) Asman Coders. General 2 13 September 2010 10:22
False weblinks for CyberRace Another World HOL data problems 0 22 August 2008 20:49
False entry ? Another World HOL data problems 1 21 August 2008 23:12

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 06:17.


Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2018, vBulletin Solutions Inc.
Page generated in 0.06181 seconds with 13 queries