At 11:11 AM -0800 on 1/22/00, Alain Farmer wrote:
>Alain: Semantics .. semantics .. either way, we have
>to get rid of the damned thing. It has infected
>hundreds of my stacks, on both my servers.
ALain, the following will protect against most HC viruses. It is what
notified me of the thing in that stack. Note that I wrote this a long
time ago, and it hasn't been edited since [explains the grammar and
spelling]. Also, somewhere I have an installer for this. But anyway,
put this in the script of the home stack:
on set
-- set protector
if param(1)="script" then
if param(3) contains "Home" then
if param(5) contains "set the"&&"script of" then
answer "WARNING!!! HIGH CHANCE THIS IS A VIRUS SPREADING TO"�
&& "YOUR HOME STACK!"&return&return�
& "It is also possible that your are already infected with"�
& "something, and are running an innocent installer"�
with "Explain" or "Allow" or "Block!!!"
if it="Explain" then
answer "A script is trying to set the Home stack's script to set"�
&& "the script of another stack." with "Allow" or "BLOCK!"
end if
if it="Allow" then
answer "Realy Allow This?" with "Yes" or "NO!"
if it="Yes" then pass set
end if
else
answer "Caution!! POSSIBLE VIRUS INFECTION HAPPENING"&return&return�
&"It is probrubly just an inncocent installer however. Or it"�
&&"could be a not-so-innocent trojan horse"�
with "Explain" or "Allow" or "Block"
if it="Explain" then
answer "A script is trying to set the Home stack's script, but it"�
&& "does not appear to contain a 'set_the script of' command"�
&& "NOTE: THE COMMAND COULD BE HIDDEN." with "Allow" or "Block"
end if
if it="Allow" then
answer "Realy Allow This?" with "Yes" or "NO"
if it="Yes" then pass set
end if
end if
else if param(3) contains stack then
answer "A script is trying to set_the script of a stack other"�
&& "than your home stack. This is probrubly just some scripter"�
&& "showing off his ability to do a no-no by setting his own"�
&& "scripts. There may are a few stacks out there who do this"�
&& "for reason, too." with "Explain" or "Allow" or "Block"
if it="Explain" then
answer "A set_the script of command has been detected having no
effect"�
&& "on your Home Stack. Some stacks, like the Audio Tools stack,"�
&& "do this with perfect reason." with "Allow" or "Block"
end if
if it="Allow" then
pass set
end if
else pass set
Answer "You are no being show where this came from..."
edit script of the target
exit to hypercard
end if
-- end set protector
pass set
end set
You'll not the nice logic with param(5), which is the new script. I
think I used param() because it got around some HC bug/limitation.
>My
>FreeCard backups on CDROM shall be considered tainted
>from now on.
CD-R is fairly cheap (oh...wait...nevermind. You have to pay an
outrageous tax in Canada now because everyone knows you're making
unauthorized copies of music cd's <wink>, don't you?) but you should
make new, up-to-date backups without the infection.
And make sure to take a marker and mark those old backups as 'possibly
tainted'.
