Vprotect

[Dunkinator]

Does anyone know where you can download the free Pineapple VProtect module (v 4.03) from? There website appears to be down...

[matt_nottm]

The Wayback Machine has archives of the last and many previous versions.

[Dunkinator]

Thanks I found it! Attached in case anyone else needs it!

[sbadger]

The Wayback Machine has archives of the last and many previous versions.

Direct Link
https://web.archive.org/web/20060907224 ... /instv.zip

[Trapper]

killer.arc.zip

Remove .zip after download and before transferring to RISC OS. This is an ArcFS/SparkFS ARChive not a zip file.

(809.46 KiB) Downloaded 248 times

Full version of Pineapple Virus !Killer circa 1997. You need to change your system clock to mid-1997/98 for this to run. Apart from that it is fully functional, and still the best RISC OS virus killing software out there.

[philpem]

Here's a newer version of Killer -- the label claims this is V3.100 but the installer and Killer itself are version 3.101. It's dated 11th October 1998, but all the files on the disk are from 13th October 1998.

"This application can detect and remove all 209 known virus variants."

Unlike earlier versions, it's copy-protected.
Your best bet is to load the ADF file into ADFFS, then run or install it from there. You could also write it back to an ADFS 800K floppy if you wanted.

You'll want the wrapper script from here: viewtopic.php?f=29&t=12613&p=162103#p162103
Tweak it to set the date to Tue,13 Oct 1998.

[sirbod]

I've finally got around to reverse compiling VProtect and fixing some of the issues it has. Attached is the first test release, should anyone like to test.

I don't have any sample virus' files, so if anyone has any they could throw at it and report back, that would be helpful.

Changes from 4.03:

• Page Zero compliant. It now uses RMA space, instead of &7800 to pass parameters to Modules
• Hopefully now RISC OS 5.0 compliant
• No longer uses stacked code to RMLoad/RMRun Modules
• Fixed a bug where it calls OS_Module with a corrupt R0 when trawling the Module list (reported here)

The next issue I'll look into is recoding it for ROM, so it can go into RISC OS 3.20

EDIT: Updated Module attached. I've now corrected the version that's displayed when the Wimp loads and fixed some pointers I'd missed.

[roland]

On eicar.com you can download a small and harmless test virus: Eicar (European Institute for Computer Anti-Virus Research).

[philpem]

On eicar.com you can download a small and harmless test virus: Eicar (European Institute for Computer Anti-Virus Research).

Killer / VProtect might be a tad too old to detect that.

Icon and Extend are probably the two most "harmless" ones, and were floating around in a great many disc images back in't'day.. the "Archie Game Emulation Webpage" (TAGEW) was a good one to hit up for uhh... virus test samples masquerading as games... I don't doubt that some of the TOSEC images contain similar.

There's also a way to make Killer freak out and detect Extend, involving inserting two bytes into the !Boot file of an application. Sadly I can't remember the specifics, but you can probably figure it out from the Kiwisoft Slayer source code if you /really/ want to.

[sirbod]

I've updated VProtect 5.00 in the post above to correct a few issues I spotted yesterday.

[BeebMaster]

Is it suitable for RISC OS 3.70? I can probably lay my hands on Icon or Extend virus, I had them all over the place at one point till I did a major clean-up.

[SteveBagley]

If I remember correct, you can you trigger it to think there’s a particularly nasty virus by generating a service call with the hex value &DECAF or &C0FFEE. I can’t remember which virus it throws up but its dead easy to generate (using OS_ServiceCall iirc, it’s been 25 years since I used this trick).

Used to have great fun using this in the computer room at school dropping bits of code onto machines the teacher's were using to generate messages from VProtect, and then VKiller could never find the virus. I think we got to the point at one stage where we were using Econet remote subroutine calls to drop code onto machines that would then send code out to other machines on a different network (my school had several machines using Lingenuity's SCSIShare shared hard disk — we’d reverse engineered a way to make SWI calls over that).

Steve

[sirbod]

Is it suitable for RISC OS 3.70?

It should work on anything above RISC OS 2.

there’s a particularly nasty virus by generating a service call with the hex value &DECAF or &C0FFEE

Yes, I noted those in the code when I was checking it line by line.

[Joka80]

Does anybody know what the last version of the actual Killer application was? Not the VProtect module (4.0.2)

[AndyMc1280]

Does anybody know what the last version of the actual Killer application was? Not the VProtect module (4.0.2)

No, its a bit old and you have to set your system date/time to 1998. Oh if it were that easy in real life . SirBod probably will - He's done some poking.
Also worth noting that the VProtect module has been updated to 5.00

Yes, I noted those in the code when I was checking it line by line.

[sirbod]

SirBod probably will - He's done some poking.

I've not looked at !Killer, it's not really something I've ever needed.

My "poking" was purely in VProtect to fix various fatal bugs which were affecting both ADFFS and RISC OS 5. Although the later dropped it from the OS, ADFFS is bundled with the latest version and updates the Module if it's already loaded.