🚀 go-pugleaf

Karel wrote:

> I got affected by a virus that's slowly invading my entire disk.
>
> Symptoms: [...]

> Well,since I had no virusscanner running in the background my
> antivirusprogram(TBAV,'Thunderbite')might already be affected also.So I
> didn't find a way to get rid of the virus(yet?);

Run ThunderByte. If it's infected (or if the checksums don't match anymore),
it will tell you. If it still works, you have a weapon. ThunderByte has some
advantages over other scanners, but I wouldn't rely on it to detect known
viruses. It isn't bad in this field, but other scanners are simply better.

> If this is all about
> some virus anyway...I'll might have to try to run Norton or McaFee
> virusutilities from the CD-rom and not yet install it...worth giving it
> a try...

And these are Windows AV, I suppose. They are pretty useless once your
computer is infected, if you ask me.

> So if anyone of you has any other suggestions(rather not telling me to
> go and buy better antivirussoftware;I want to find out what's really
> happening first before going to pay for it.

Who said you need to pay for a good anti-virus program? F-Prot
(http://www.complex.is) is free for non-commercial use.

On a clean computer, download ftp://ftp.complex.is/pub/fp-305b.zip and unzip
the file in an empty folder. You must have 2 empty diskettes handy. Start a
DOS box in Windows and insert the first disk. Type the following and confirm
by pressing Enter.

format a: /s

On the diskette, create a plain text file called config.sys and write the
following lines to it:

device=a:\himem.sys
device=a:\emm386.exe noems
dos=high,umb

Now, copy the files himem.sys and emm386.exe to the diskette. They are both
located in your Windows folder.
This is now your boot disk.

Insert the second diskette and copy the following files from the directory
in which you unzipped F-Prot to the diskette:

f-prot.exe
sign.def
macro.def
english.tx0

Write-protect both diskettes, and boot your "infected" computer from the
boot disk. Wait for the string A:\> to appear, insert the diskette with
F-Prot, type "f-prot" without the quotes and confirm by pressing Enter. A
user interface appears through which you can navigate by using the cursor
keys on your keyboard. Scan your hard disk.

If F-Prot finds a virus, tell it to remove it (it will ask you), and
everything should be fine again. Don't forget to update it regularly.

In the future, you can also use it to scan new software or perform routine
checks of your hard disks. It's a DOS program, thus small and efficient, and
free.

> C:\>Rem TShoot: C:\UNZIPPED\SHS17\SHSMOD.EXE B H
> C:\>C:\WINDOWS\SHS17\SHSMOD.EXE B H
> shsmod V1.7a(29-AUGUST-1998)
> SMC37C669 at 03f0h detected
> PORT1(03f8h) Serial Speed Mode:HIGH
> PORT2(02f8h) Serial Speed Mode:HIGH

> --> Someone knows a bit more about MSDOS then I do and can explain this
> in normal language?

The first line starting with "Rem" is just a comment. It doesn't do
anything. I have no idea what "SMC37 C669 at 03f0h detected" means. The last
two lines mean that the speed of the two serial ports COM1 and COM2 is (set
to) "HIGH" - whatever that means to the program.