From: Volker_Soehnitz@ac.maus.de (Volker Soehnitz)
Newsgroups: comp.sys.atari.st
Subject: Re: Ghost Virus
Date: 5 Nov 92 00:29:00 GMT
Article-I.D.: AC.A11070
Organization: MausNet
X-Gateway: MausGate/News 1.14

Hi Chris!

>I have been foolish enough to get my ST hard disc infected with the Ghost
>virus - and lived with the symptoms for several weeks before I suddenly
>saw the light and ran a virus scan (Sagrotan). As soon as I saw the name
>"Ghost" I realised that I had found the reason not only for the disappearing
>mouse cursor that had prompted me to run the scan, but for the eponymous
>"ghost files" which had been appearing in my directories for some time.

Oooops! None of the more than 10 (!) known different versions of the "Ghost
virus" is able to infect your harddisk! Also, none of them will create "ghost
files" on your disks or harddisks.

>1. Ghost has now settled comfortably into my system. Anyone able to give
>advice on how to eliminate it?

I don't know, who or what is responsible for your harddisk trouble, but you can
believe me - it's _not_ the Ghost virus or any known mutation of the Ghost
virus. It's a really harmless bootsector-virus, some mutations can damage a
disk in drive A or B - but none of them make any trouble with your harddisk or
manipulate executable programms.

A little comment to your viruskiller: The last shareware release of "Sagrotan"
(4.17) is more than 2 years old! Using a 2 years old viruskiller is like using
_no_ viruskiller...

If you look for another shareware-viruskiller, try it with my VIRENDETEKTOR
3.1g! This Programm recognize more than 40 bootsector-viruses (and 5 link-
viruses).

But I think there would be a little disadvantage for you: VIRENDETEKTOR is
only available with a german manual (more than 160 KByte on disk) and the
programm-menu is also completely in german language.

If you understand a little bit of german, I'm sure the VIRENDETEKTOR is "just
what you need". My english ist to bad, to explain all the features of this
programm, so I tell you only the most important:

VIRENDETEKTOR works with all ATARI ST/STE/TT, with the FALCON 030 (some
problems with the IDE-Bus harddisk will be fixed soon...) and on all
graphic-cards, but the programm needs a minimum resolution of 640*400.

It is _not_ possible to use the programm on machines with less than 1 MB RAM,
but it is a "light"-Version for 512 K machines available.

Recognition of ALL known ST viruses - both link- and bootsector-viruses
(also on _not_ executable bootsektors).

_Very_ fast scanning of a whole drive or partition for link-viruses,
CRC-Checksum (50 times faster than Sagrotan) by choice.

Immunizing of disks against bootsector-viruses with three different methodes.

Automatic recognition of any hard-, floppy- and RAMdisks attached.

Automatic analysing for suspicious/unknown boot disks.

VIRENDETEKTOR give you a list of all your programms, which are packed by one
of these "online-packer" like for example the PFX-PACK, ICE-Pack, DC-Squeeze,
BA-Packer and others.

Recognition of any change in HD-rootsektor, if a virus has overwritten the
rootsektor, it is possible to restore it.

Option to save any bootsektor to a disk to have them analysed by me or to
restore it after a damage (a nice feature for game-disks). HEX-Dump to disk or
printer available.

Full compatibility with any ROM TOS and any known harddisk driver.

Comfortable and easy mouse/keyboard user interface (german language).

More than 160 KByte manual (german!) on disk, you learn everything about
viruses on the ST!

VIRENDETEKTOR is Shareware, you can get the new registered version 3.1g by
sending 35,- DM (30,- DM + 5 DM for shipping) or 25 US-Dollar to:

             Volker Soehnitz
             Beginenstr. 17
             D-5100 Aachen
             Germany

>2. Does anyone have or know of a list of known viruses and their tell-tale
>symptoms?

The registered version of VIRENDETEKTOR also contains detailed information
about the known viruses, what the do, under which condition the will do it and
how the spread.

         ciao  | /
               |/olker

PS.:  I hope you understand my horrible english...

PPS.: If you need a viruskiller with english manual and user interface, the UVK
      from Richard Karsmakers (NL) should be your first choice.
Newsgroups: comp.sys.atari.st