From: ether@bencd.gedlab.allied.com (219)
Newsgroups: comp.virus
Subject: Re: Protection from Boot Sector Viruses (PC)
Date: 11 Apr 92 18:03:45 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

> ... I only didn't like that the program (as far as I
> understood) "corrects" the boot sector if it thinks it's wrong.

I agree with your concern. Was that what R. Riordan
was suggesting?  Maybe P. Stuckey could post a clarification.

> This must be done only when the user explicitely requests it, and the
> original contents of the corrected boot sector must be saved in a
> file. I hate the "I know better what programs you must be running"
> approach.

Yes, agreed.

>> How do you find the Int13 entry point?  Simple, really.  Use
>> DEBUG to search system ROM for typical int13 code, and try it:
>
>> C:>DEBUG
>
>> - - s f000:0 l FFFF 80 FA 80
>
> Good guess... But totally wrong. :-) On my XT the INT 13h handler for
> the hard disk is on the hard disk controllers's EPROM and is at
> address 0C800:0000h.

Well, not totally wrong. It works for all the 286 and 386 machines
I've tried it on so far (I used to have an XT around here somewhere:-)
And if you don't find the code as suggested above, that should be a clue
that there may be a ROM BIOS extension, in which case the second
method I suggested should work.

>> look at the first offset reported, and back up a byte (or two) if
>> the preceeding bytes are FB (or FC).  That will be your entry
>> point.  Un-assemble the code to make sure it looks like an
>> int13 service routine, then try it.

> Are you serious is proposing the average user to perform the above
> operation, in order to install the anti-virus program? The same user
> who can't make the difference between a boot sector and a partition
> table and between a virus and a spreadsheet?

No, certainly not! :-) It was my understanding that R. Riordan
was personally installing this, not user-installed.
You are correct in pointing out that this must only be done
by someone who understands what they're doing.  BTW, another check
you can do before trying to run the code is to search the BIOS
for the code "MOV AX, ####", where #### is the offset of the
start of what you think is the INT13 entry point.  (The BIOS
has to load the vector into low memory, and this code snippet
seems to be fairly universal on the machines I've looked at -
with the exception of some Compaq's.  But, all revs of Compaq
system BIOS I've seen so far always have INT13 entry at 02E12H;
does anyone know of an exception?  Compaq BIOS can be identified
by the string COMPAQ at F000:FFEA).

>> Another (sure-fire) way is to write a small machine-code program
>> to replace the boot sector of a diskette.  This program just
>> grabs the Int13 vector (before DOS or any virus can change it)
>> and displays it on the screen.

> This sounds much better...

Yes, this is preferred approach.  This should also work for your XT :-)
( It works for our machines with Hard-Cards installed, which have
ROM BIOS extensions for INT13 ).

> ... Another idea is to trace INT 13h (like some
> viruses do).

Interesting... I had considered that, but there seemed to be too many
pitfalls to implement it reliably.

Ether   (ether@enc.gedlab.allied.com)