� >MoViKill
%� Recursive 'Module Virus' killer
"� by John Kortink, 18 Nov 1991
(,� Whoever wrote this virus : SCREW YOU !
2� FDat% 4096,Dum% 1024
<G�'"This program recursively scans for and kills the 'Module Virus'"
FH�"Previously infected modules' filenames are spooled to a log file"'
P@�"Enter root of path to scan (press RETURN for '$') ? "root$
Z�root$="" � root$="$"
d6�"Enter log file (press RETURN for 'VLog') ? "log$
n�log$="" � log$="VLog"
x�
�found%=0
�
Log=�log$
��recurse_dir(root$)
�	�#Log
��'
���found%=0 � �"I did not find any viri ..." � �"!!! I found and killed ";found%;" viri, in (see ";log$;") : ":ș "OS_CLI","Type "+log$
��''"Finished ..."
��
�
���recurse_dir(dir$)
�*� Recurses directory performing action
�
� off%,n$
�off%=0:�"Directory ";dir$

�� ș "OS_GBPB",10,dir$,FDat%,1,off%,256,"*" � ,,p%,,off%:�off%=-1 � n$=�string(p%+20):�(p%!16)=2 � �recurse_dir(dir$+"."+n$) � �do_one(dir$+"."+n$)


� off%=-1

�

"

,��do_one(path$)

6�;"File ";path$

@load%=!FDat%

J:�(load%>>>20)=&FFF � type%=(load%>>>8)�&FFF � type%=-1

T�type%=&FFA � �check(path$)

^�

h

rݤstring(a%)

|%a$="":ȕ ?a%>=32:a$+=�?a%:a%+=1:�

�=a$

�

���check(path$)

�F=�path$

�-l%=�#F:ș "OS_GBPB",3,F,Dum%,4,4:i%=!Dum%

��l%-i%<>&3BC � �#F:�

�"ș "OS_GBPB",3,F,Dum%,20,l%-16

��#F

��7:found%+=1

�
�"***"

�/�"Module virus found ! Generation ";Dum%!12

�)�#Log,path$+" Generation "+�(Dum%!12)

�,fini%=!Dum%:�fini%<>0:fini%=i%+&F0-fini%
)ini%=Dum%!4:�ini%<>0:ini%=i%+&C0-ini%
.serv%=Dum%!8:�serv%<>0:serv%=i%+&144-serv%
(!Dum%=ini%:Dum%!4=fini%:Dum%!8=serv%
&F=�path$
0ș "OS_GBPB",1,F,Dum%,12,4
:ș "OS_Args",3,F,i%
D�#F
N exec%=FDat%!4:attr%=FDat%!12
X+ș "OS_File",1,path$,load%,exec%,,attr%
b"�"Virus succesfully removed !"
l
�"***"
v�
�

00000000  0d 00 0a 0f f4 20 3e 4d  6f 56 69 4b 69 6c 6c 0d  |..... >MoViKill.|
00000010  00 14 25 f4 20 52 65 63  75 72 73 69 76 65 20 27  |..%. Recursive '|
00000020  4d 6f 64 75 6c 65 20 56  69 72 75 73 27 20 6b 69  |Module Virus' ki|
00000030  6c 6c 65 72 0d 00 1e 22  f4 20 62 79 20 4a 6f 68  |ller...". by Joh|
00000040  6e 20 4b 6f 72 74 69 6e  6b 2c 20 31 38 20 4e 6f  |n Kortink, 18 No|
00000050  76 20 31 39 39 31 0d 00  28 2c f4 20 57 68 6f 65  |v 1991..(,. Whoe|
00000060  76 65 72 20 77 72 6f 74  65 20 74 68 69 73 20 76  |ver wrote this v|
00000070  69 72 75 73 20 3a 20 53  43 52 45 57 20 59 4f 55  |irus : SCREW YOU|
00000080  20 21 0d 00 32 1a de 20  46 44 61 74 25 20 34 30  | !..2.. FDat% 40|
00000090  39 36 2c 44 75 6d 25 20  31 30 32 34 0d 00 3c 47  |96,Dum% 1024..<G|
000000a0  f1 27 22 54 68 69 73 20  70 72 6f 67 72 61 6d 20  |.'"This program |
000000b0  72 65 63 75 72 73 69 76  65 6c 79 20 73 63 61 6e  |recursively scan|
000000c0  73 20 66 6f 72 20 61 6e  64 20 6b 69 6c 6c 73 20  |s for and kills |
000000d0  74 68 65 20 27 4d 6f 64  75 6c 65 20 56 69 72 75  |the 'Module Viru|
000000e0  73 27 22 0d 00 46 48 f1  22 50 72 65 76 69 6f 75  |s'"..FH."Previou|
000000f0  73 6c 79 20 69 6e 66 65  63 74 65 64 20 6d 6f 64  |sly infected mod|
00000100  75 6c 65 73 27 20 66 69  6c 65 6e 61 6d 65 73 20  |ules' filenames |
00000110  61 72 65 20 73 70 6f 6f  6c 65 64 20 74 6f 20 61  |are spooled to a|
00000120  20 6c 6f 67 20 66 69 6c  65 22 27 0d 00 50 40 e8  | log file"'..P@.|
00000130  22 45 6e 74 65 72 20 72  6f 6f 74 20 6f 66 20 70  |"Enter root of p|
00000140  61 74 68 20 74 6f 20 73  63 61 6e 20 28 70 72 65  |ath to scan (pre|
00000150  73 73 20 52 45 54 55 52  4e 20 66 6f 72 20 27 24  |ss RETURN for '$|
00000160  27 29 20 3f 20 22 72 6f  6f 74 24 0d 00 5a 19 e7  |') ? "root$..Z..|
00000170  72 6f 6f 74 24 3d 22 22  20 8c 20 72 6f 6f 74 24  |root$="" . root$|
00000180  3d 22 24 22 0d 00 64 36  e8 22 45 6e 74 65 72 20  |="$"..d6."Enter |
00000190  6c 6f 67 20 66 69 6c 65  20 28 70 72 65 73 73 20  |log file (press |
000001a0  52 45 54 55 52 4e 20 66  6f 72 20 27 56 4c 6f 67  |RETURN for 'VLog|
000001b0  27 29 20 3f 20 22 6c 6f  67 24 0d 00 6e 1a e7 6c  |') ? "log$..n..l|
000001c0  6f 67 24 3d 22 22 20 8c  20 6c 6f 67 24 3d 22 56  |og$="" . log$="V|
000001d0  4c 6f 67 22 0d 00 78 05  f1 0d 00 82 0c 66 6f 75  |Log"..x......fou|
000001e0  6e 64 25 3d 30 0d 00 8c  0d 4c 6f 67 3d ae 6c 6f  |nd%=0....Log=.lo|
000001f0  67 24 0d 00 96 17 f2 72  65 63 75 72 73 65 5f 64  |g$.....recurse_d|
00000200  69 72 28 72 6f 6f 74 24  29 0d 00 a0 09 d9 23 4c  |ir(root$).....#L|
00000210  6f 67 0d 00 aa 06 f1 27  0d 00 b4 89 e7 66 6f 75  |og.....'.....fou|
00000220  6e 64 25 3d 30 20 8c 20  f1 22 49 20 64 69 64 20  |nd%=0 . ."I did |
00000230  6e 6f 74 20 66 69 6e 64  20 61 6e 79 20 76 69 72  |not find any vir|
00000240  69 20 2e 2e 2e 22 20 8b  20 f1 22 21 21 21 20 49  |i ..." . ."!!! I|
00000250  20 66 6f 75 6e 64 20 61  6e 64 20 6b 69 6c 6c 65  | found and kille|
00000260  64 20 22 3b 66 6f 75 6e  64 25 3b 22 20 76 69 72  |d ";found%;" vir|
00000270  69 2c 20 69 6e 20 28 73  65 65 20 22 3b 6c 6f 67  |i, in (see ";log|
00000280  24 3b 22 29 20 3a 20 22  3a c8 99 20 22 4f 53 5f  |$;") : ":.. "OS_|
00000290  43 4c 49 22 2c 22 54 79  70 65 20 22 2b 6c 6f 67  |CLI","Type "+log|
000002a0  24 0d 00 be 15 f1 27 27  22 46 69 6e 69 73 68 65  |$.....''"Finishe|
000002b0  64 20 2e 2e 2e 22 0d 00  c8 05 e0 0d 00 d2 04 0d  |d ..."..........|
000002c0  00 dc 17 dd f2 72 65 63  75 72 73 65 5f 64 69 72  |.....recurse_dir|
000002d0  28 64 69 72 24 29 0d 00  e6 2a f4 20 52 65 63 75  |(dir$)...*. Recu|
000002e0  72 73 65 73 20 64 69 72  65 63 74 6f 72 79 20 70  |rses directory p|
000002f0  65 72 66 6f 72 6d 69 6e  67 20 61 63 74 69 6f 6e  |erforming action|
00000300  0d 00 f0 0d ea 20 6f 66  66 25 2c 6e 24 0d 00 fa  |..... off%,n$...|
00000310  1d 6f 66 66 25 3d 30 3a  f1 22 44 69 72 65 63 74  |.off%=0:."Direct|
00000320  6f 72 79 20 22 3b 64 69  72 24 0d 01 04 97 f5 20  |ory ";dir$..... |
00000330  c8 99 20 22 4f 53 5f 47  42 50 42 22 2c 31 30 2c  |.. "OS_GBPB",10,|
00000340  64 69 72 24 2c 46 44 61  74 25 2c 31 2c 6f 66 66  |dir$,FDat%,1,off|
00000350  25 2c 32 35 36 2c 22 2a  22 20 b8 20 2c 2c 70 25  |%,256,"*" . ,,p%|
00000360  2c 2c 6f 66 66 25 3a e7  6f 66 66 25 3d 2d 31 20  |,,off%:.off%=-1 |
00000370  8b 20 6e 24 3d a4 73 74  72 69 6e 67 28 70 25 2b  |. n$=.string(p%+|
00000380  32 30 29 3a e7 28 70 25  21 31 36 29 3d 32 20 8c  |20):.(p%!16)=2 .|
00000390  20 f2 72 65 63 75 72 73  65 5f 64 69 72 28 64 69  | .recurse_dir(di|
000003a0  72 24 2b 22 2e 22 2b 6e  24 29 20 8b 20 f2 64 6f  |r$+"."+n$) . .do|
000003b0  5f 6f 6e 65 28 64 69 72  24 2b 22 2e 22 2b 6e 24  |_one(dir$+"."+n$|
000003c0  29 0d 01 0e 0d fd 20 6f  66 66 25 3d 2d 31 0d 01  |)..... off%=-1..|
000003d0  18 05 e1 0d 01 22 04 0d  01 2c 13 dd f2 64 6f 5f  |....."...,...do_|
000003e0  6f 6e 65 28 70 61 74 68  24 29 0d 01 36 13 f1 3b  |one(path$)..6..;|
000003f0  22 46 69 6c 65 20 22 3b  70 61 74 68 24 0d 01 40  |"File ";path$..@|
00000400  10 6c 6f 61 64 25 3d 21  46 44 61 74 25 0d 01 4a  |.load%=!FDat%..J|
00000410  3a e7 28 6c 6f 61 64 25  3e 3e 3e 32 30 29 3d 26  |:.(load%>>>20)=&|
00000420  46 46 46 20 8c 20 74 79  70 65 25 3d 28 6c 6f 61  |FFF . type%=(loa|
00000430  64 25 3e 3e 3e 38 29 80  26 46 46 46 20 8b 20 74  |d%>>>8).&FFF . t|
00000440  79 70 65 25 3d 2d 31 0d  01 54 1f e7 74 79 70 65  |ype%=-1..T..type|
00000450  25 3d 26 46 46 41 20 8c  20 f2 63 68 65 63 6b 28  |%=&FFA . .check(|
00000460  70 61 74 68 24 29 0d 01  5e 05 e1 0d 01 68 04 0d  |path$)..^....h..|
00000470  01 72 10 dd a4 73 74 72  69 6e 67 28 61 25 29 0d  |.r...string(a%).|
00000480  01 7c 25 61 24 3d 22 22  3a c8 95 20 3f 61 25 3e  |.|%a$="":.. ?a%>|
00000490  3d 33 32 3a 61 24 2b 3d  bd 3f 61 25 3a 61 25 2b  |=32:a$+=.?a%:a%+|
000004a0  3d 31 3a ce 0d 01 86 07  3d 61 24 0d 01 90 04 0d  |=1:.....=a$.....|
000004b0  01 9a 12 dd f2 63 68 65  63 6b 28 70 61 74 68 24  |.....check(path$|
000004c0  29 0d 01 a4 0c 46 3d 8e  70 61 74 68 24 0d 01 ae  |)....F=.path$...|
000004d0  2d 6c 25 3d a2 23 46 3a  c8 99 20 22 4f 53 5f 47  |-l%=.#F:.. "OS_G|
000004e0  42 50 42 22 2c 33 2c 46  2c 44 75 6d 25 2c 34 2c  |BPB",3,F,Dum%,4,|
000004f0  34 3a 69 25 3d 21 44 75  6d 25 0d 01 b8 18 e7 6c  |4:i%=!Dum%.....l|
00000500  25 2d 69 25 3c 3e 26 33  42 43 20 8c 20 d9 23 46  |%-i%<>&3BC . .#F|
00000510  3a e1 0d 01 c2 22 c8 99  20 22 4f 53 5f 47 42 50  |:....".. "OS_GBP|
00000520  42 22 2c 33 2c 46 2c 44  75 6d 25 2c 32 30 2c 6c  |B",3,F,Dum%,20,l|
00000530  25 2d 31 36 0d 01 cc 07  d9 23 46 0d 01 d6 10 ef  |%-16.....#F.....|
00000540  37 3a 66 6f 75 6e 64 25  2b 3d 31 0d 01 e0 0a f1  |7:found%+=1.....|
00000550  22 2a 2a 2a 22 0d 01 ea  2f f1 22 4d 6f 64 75 6c  |"***".../."Modul|
00000560  65 20 76 69 72 75 73 20  66 6f 75 6e 64 20 21 20  |e virus found ! |
00000570  47 65 6e 65 72 61 74 69  6f 6e 20 22 3b 44 75 6d  |Generation ";Dum|
00000580  25 21 31 32 0d 01 f4 29  d5 23 4c 6f 67 2c 70 61  |%!12...).#Log,pa|
00000590  74 68 24 2b 22 20 47 65  6e 65 72 61 74 69 6f 6e  |th$+" Generation|
000005a0  20 22 2b c3 28 44 75 6d  25 21 31 32 29 0d 01 fe  | "+.(Dum%!12)...|
000005b0  2c 66 69 6e 69 25 3d 21  44 75 6d 25 3a e7 66 69  |,fini%=!Dum%:.fi|
000005c0  6e 69 25 3c 3e 30 3a 66  69 6e 69 25 3d 69 25 2b  |ni%<>0:fini%=i%+|
000005d0  26 46 30 2d 66 69 6e 69  25 0d 02 08 29 69 6e 69  |&F0-fini%...)ini|
000005e0  25 3d 44 75 6d 25 21 34  3a e7 69 6e 69 25 3c 3e  |%=Dum%!4:.ini%<>|
000005f0  30 3a 69 6e 69 25 3d 69  25 2b 26 43 30 2d 69 6e  |0:ini%=i%+&C0-in|
00000600  69 25 0d 02 12 2e 73 65  72 76 25 3d 44 75 6d 25  |i%....serv%=Dum%|
00000610  21 38 3a e7 73 65 72 76  25 3c 3e 30 3a 73 65 72  |!8:.serv%<>0:ser|
00000620  76 25 3d 69 25 2b 26 31  34 34 2d 73 65 72 76 25  |v%=i%+&144-serv%|
00000630  0d 02 1c 28 21 44 75 6d  25 3d 69 6e 69 25 3a 44  |...(!Dum%=ini%:D|
00000640  75 6d 25 21 34 3d 66 69  6e 69 25 3a 44 75 6d 25  |um%!4=fini%:Dum%|
00000650  21 38 3d 73 65 72 76 25  0d 02 26 0c 46 3d ad 70  |!8=serv%..&.F=.p|
00000660  61 74 68 24 0d 02 30 1e  c8 99 20 22 4f 53 5f 47  |ath$..0... "OS_G|
00000670  42 50 42 22 2c 31 2c 46  2c 44 75 6d 25 2c 31 32  |BPB",1,F,Dum%,12|
00000680  2c 34 0d 02 3a 17 c8 99  20 22 4f 53 5f 41 72 67  |,4..:... "OS_Arg|
00000690  73 22 2c 33 2c 46 2c 69  25 0d 02 44 07 d9 23 46  |s",3,F,i%..D..#F|
000006a0  0d 02 4e 20 65 78 65 63  25 3d 46 44 61 74 25 21  |..N exec%=FDat%!|
000006b0  34 3a 61 74 74 72 25 3d  46 44 61 74 25 21 31 32  |4:attr%=FDat%!12|
000006c0  0d 02 58 2b c8 99 20 22  4f 53 5f 46 69 6c 65 22  |..X+.. "OS_File"|
000006d0  2c 31 2c 70 61 74 68 24  2c 6c 6f 61 64 25 2c 65  |,1,path$,load%,e|
000006e0  78 65 63 25 2c 2c 61 74  74 72 25 0d 02 62 22 f1  |xec%,,attr%..b".|
000006f0  22 56 69 72 75 73 20 73  75 63 63 65 73 66 75 6c  |"Virus succesful|
00000700  6c 79 20 72 65 6d 6f 76  65 64 20 21 22 0d 02 6c  |ly removed !"..l|
00000710  0a f1 22 2a 2a 2a 22 0d  02 76 05 e1 0d ff        |.."***"..v....|
0000071e