German Virus Woes! HELP I don't speak German!
Soylent Sprite
I have downloaded/extracted and run VirusZ II/pre-III 1.44 (6.9.98) and
it reports no problems.
But due to the positive comments about VT, i decided to try it. It's all
in German and I can't understand German. But I thought I'd try it anyway.
I do think I recognize a warning message, even if I don't know exactly
what it's saying.
When VT starts it opens a requestor every time that says:
POLISHPOWER-Virus
im Mem suchen?
l.A+v= Ja l.A+b= Nein
No matter which button i click, nothing seems to change.
(VirusZ didn't complain about any POLISHPOWER infection.)
Immediately afterward, another window popped open saying:
PP-Lib (N)
ist im Speicher
l.A+v= KReset l.A+b= Weiter
I'm guessing this has to do with a PowerPacker patch? But I don't run any
PowerPacker patches to my OS.
I know what reset does so I click Weiter (whatever that does), and then I
have the main VT menu (I guess).
From it's FileTest menu I choose DEVS and select my HD's boot partition
(MH0:). Nothing much happens so I click on the region to the right near
the ENDE button and file checking seems to start-- it says:
Teste jetzt auf File-, Link-, BBS-Viren, Trojans und Cruncher Angebot:
loeschen, ausbauen oder ersetzen
When it gets to MH0:MUI/ (there's no filename visible!), white text
appear to the right saying 3F1-Hunk and a window opens saying:
3F1-HEADDBGV-Hunk
ist im File
l.A+v= Weiter l.A+b= Weiter
I have NO idea what it's saying!
It turns out that there is a file whose name appears to be only spaces
and it is 8204 bytes long. It has a smileyface icon and I'm pretty sure
it came with the MUI package. Anyway...
I click on Weiter (I'm guessing that neither makes any difference). As
the file-check proceed it reports:
MH0:MUI/Libs/mui/NewString.mcc 3F1-Hunk
and the same requestor opens:
3F1-HEADDBGV-Hunk
ist im File
l.A+v= Weiter l.A+b= Weiter
So i click on the right Weiter. To continue with the file checking...
and VT balks also on these executeables:
MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
Judging from it's behavior, am I correct that VT does not decompress
PowerPacked executables and check them? If so then about 30% of my
executebale can't be checked with VT since they're powerpacked or
otherwise crunched.
The process appeared to stop, the screen flashed a couple times, and VT
said:
Verzeichnisse : 267 Dateien : 2683
I'm guessing this means 267 executeables and 2683 data files checked?
And the upper right corner of thw window said:
Zeit 0 Std. 10 M. 0 S.
When checking another partition it reported:
MH2:DPaint 3F1-Hunk
And a window opened saying:
3F1-Hunk am Anfang
ist im File
l.A+v= Weiter l.A+b= Weiter
Later I selected BlockKette (whatever that is) and it to stopped and
reported this:
MH0:MUI/
3F1-HEADDBGV-Hunk
FileHeaderBlock : 11638
FileListBlock :
BlockAnzahl : 17
FileLaenge : 8204
FileDataBlock : 11639
And then opened a requestor saying:
__
Bitte ueberpruefen
vgl.VTkennt
l.A+v= Weiter l.A+b= Weiter
--
The same requestor appeared for these files:
MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
Then I ran BlockITest-- and curiously enough, it said, in English "For
LinkVirus FIRST use FileTest !!!!!!!". After it got done scanning my Mh0:
boot partition, a requestor opened saying:
Block zeigen ? Weiter
dann mit Leert.
l.A+v= Ja l.A+b= Nein
I know Ja is Yes and Nein is No, but I have no idea what the question
says!
I selected Ja and it showed me a sector, I think.
HELP
When I selected the Tools menu and tried clicked SystemTest, a requestor
said:
ALLE nicht-ROM-Vektoren
Ja Nein
Suffice it to say I'm confused. I have no idea what these German words
mean or what the requestor were trying to tell me. Am I infected?
Regards,
Bennu
PS People are telling me that VT is a GREAT program and it even works
with OS1.3. It's sad that only German speakers can use it. Is there any
work underway to translate it's files and create an English version?
Bazooka
POLISHPOWER-Virus
> im Mem suchen?
means - shall i look for POLISHPOWER-Virus in memory ?? ja -
yes nein - no
PP-Lib (N)
> ist im Speicher
>
> l.A+v= KReset l.A+b= Weiter
mean powerpacker libray is in the memory and weiter means continue
Teste jetzt auf File-, Link-, BBS-Viren, Trojans und Cruncher Angebot:
> loeschen, ausbauen oder ersetzen
That means . Ill test now for file -link and bbs viruses -
loeschen=delete
ausbauen - hmm i dont know what this should do maybe you can edit the
file or so , and ersetzen mean overwrite
BlockKette means blockchain
Bitte ueberpruefen means please test or check
vgl.VTkennt i think vgl mean vergleichen and that means it checks two
files if they are identicaly and kennt means knows so VT knows ....
35346345244 viruses or so
Block zeigen ? Weiter
> dann mit Leert.
>
means show block ?? weiter means continue dann mit leertaste means
simply - then press Space
3F1-Hunk am Anfang
> ist im File
means hunk is on the first bit from the file amd ist im file means its
in the file
ALLE nicht-ROM-Vektoren means all not Rom vectors
final words from me : i think a 3F1 - Hunk is not bad man , i think its
not a virus , is remember thats is was all the time on dpaint (maybe if
you remove it dpaint wont work anymore hehe) and in some demos too. ???
Whatever for other questions ask me !!!
bazooka
Soylent Sprite schrieb:
Ulf Diabelez Harries
> > loeschen, ausbauen oder ersetzen
>
>
> That means . Ill test now for file -link and bbs viruses -
> loeschen=delete
> ausbauen - hmm i dont know what this should do maybe you can edit the
> file or so , and ersetzen mean overwrite
Ausbauen means desinfect (out-build)
Ralph Navarro
http://babelfish.altavista.com/
It is a simple translation but one can gleam the meaning of the text.
Ralph Navarro
Patrick Breuer
> Soylent Sprite wrote:
>
> >
> > I have downloaded/extracted and run VirusZ II/pre-III 1.44 (6.9.98) and
> > it reports no problems.
> > But due to the positive comments about VT, i decided to try it. It's all
> > in German and I can't understand German. But I thought I'd try it anyway.
> > I do think I recognize a warning message, even if I don't know exactly
> > what it's saying.
> >
> > When VT starts it opens a requestor every time that says:
> >
> > POLISHPOWER-Virus
> > im Mem suchen?
> >
> > l.A+v= Ja l.A+b= Nein
"Suchen" means "search for". So, it detects the Virus in Memory and (hopefully)
disables it. It later should search for it on Disks.
> > No matter which button i click, nothing seems to change.
> > (VirusZ didn't complain about any POLISHPOWER infection.)
> >
> > Immediately afterward, another window popped open saying:
> >
> > PP-Lib (N)
> > ist im Speicher
> >
> > l.A+v= KReset l.A+b= Weiter
> >
> > I'm guessing this has to do with a PowerPacker patch? But I don't run any
> > PowerPacker patches to my OS.
Right. Some program you started was PowerPacked and used PowerPacker.library.
You can check this with any System-Monitor or Performance-Checker like AIBB.
> > I know what reset does so I click Weiter (whatever that does), and then I
> > have the main VT menu (I guess).
"Weiter" = "Continue"
> > From it's FileTest menu I choose DEVS and select my HD's boot partition
> > (MH0:). Nothing much happens so I click on the region to the right near
> > the ENDE button and file checking seems to start-- it says:
> >
> > Teste jetzt auf File-, Link-, BBS-Viren, Trojans und Cruncher Angebot:
> > loeschen, ausbauen oder ersetzen
"Checking for File-, Link- or BBS-Viruses etc. Choices: delete, remove or replace"
> > When it gets to MH0:MUI/ (there's no filename visible!), white text
> > appear to the right saying 3F1-Hunk and a window opens saying:
> >
> > 3F1-HEADDBGV-Hunk
> > ist im File
> >
> > l.A+v= Weiter l.A+b= Weiter
MUI has one File (with a Smiley-Icon) with no Filename. I'm no Progammer, but
a 3F1-Hunk is something special, that Virus-Coders seem to need. But Nothing
wrong so far. It's just an Information, thus your choice is to "Continue" or
to "Continue" :-)
> > I have NO idea what it's saying!
> > It turns out that there is a file whose name appears to be only spaces
> > and it is 8204 bytes long. It has a smileyface icon and I'm pretty sure
> > it came with the MUI package. Anyway...
Right. It's the Registration, i think
> > I click on Weiter (I'm guessing that neither makes any difference). As
> > the file-check proceed it reports:
> >
> > MH0:MUI/Libs/mui/NewString.mcc 3F1-Hunk
> > and the same requestor opens:
> >
> > 3F1-HEADDBGV-Hunk
> > ist im File
> >
> > l.A+v= Weiter l.A+b= Weiter
> >
> > So i click on the right Weiter. To continue with the file checking...
> > and VT balks also on these executeables:
> >
> > MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
> > MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
> >
> >
> > Judging from it's behavior, am I correct that VT does not decompress
> > PowerPacked executables and check them? If so then about 30% of my
> > executebale can't be checked with VT since they're powerpacked or
> > otherwise crunched.
Check the Options (I don't remember, but the German phrase is "Einstellungen")
You can select automatic decompression and alert on 3F1-Hunks!
> > The process appeared to stop, the screen flashed a couple times, and VT
> > said:
> >
> > Verzeichnisse : 267 Dateien : 2683
Directories: Files:
> > I'm guessing this means 267 executeables and 2683 data files checked?
Near...
> > And the upper right corner of thw window said:
> > Zeit 0 Std. 10 M. 0 S.
Time hrs. m. s.
> > When checking another partition it reported:
> > MH2:DPaint 3F1-Hunk
> > And a window opened saying:
> >
> > 3F1-Hunk am Anfang
> > ist im File
> >
> > l.A+v= Weiter l.A+b= Weiter
> >
> > Later I selected BlockKette (whatever that is) and it to stopped and
> > reported this:
This is the Block-Chain. VT follows the chain while checking(?)
> > MH0:MUI/
> > 3F1-HEADDBGV-Hunk
> > FileHeaderBlock : 11638
> > FileListBlock :
> > BlockAnzahl : 17
> > FileLaenge : 8204
> > FileDataBlock : 11639
> >
> > And then opened a requestor saying:
> > __
> > Bitte ueberpruefen
> > vgl.VTkennt
> >
> > l.A+v= Weiter l.A+b= Weiter
> > --
There is a File called "VTkennt" (="VTknows"...) VT says you should check the
Alerted file.
> > The same requestor appeared for these files:
> > MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
> > MH0:MUI/Libs/mui/NewString.mcp 3F1-Hunk
> >
> >
> >
> > Then I ran BlockITest-- and curiously enough, it said, in English "For
> > LinkVirus FIRST use FileTest !!!!!!!". After it got done scanning my Mh0:
> > boot partition, a requestor opened saying:
> >
> > Block zeigen ? Weiter
> > dann mit Leert.
Show Block? Cont. with Space (after every Message)
> > l.A+v= Ja l.A+b= Nein
> >
> > I know Ja is Yes and Nein is No, but I have no idea what the question
> > says!
> > I selected Ja and it showed me a sector, I think.
> >
> > HELP
> >
> > When I selected the Tools menu and tried clicked SystemTest, a requestor
> > said:
> >
> > ALLE nicht-ROM-Vektoren
> >
> > Ja Nein
I think System-Test shows all Vectors. All non-ROM-Vectors are changed by
Software.
> > Suffice it to say I'm confused. I have no idea what these German words
> > mean or what the requestor were trying to tell me. Am I infected?
Yep. PolishSomething.Virus somewhere. Does this Message appear always?
You should copy VT on a Disk and check from clean Bootdisk (no WB)
FileTest didn't show the Virus, right? Might be a false-Alert. But I would
not trust in that.
> > Regards,
> > Bennu
> > PS People are telling me that VT is a GREAT program and it even works
> > with OS1.3. It's sad that only German speakers can use it. Is there any
> > work underway to translate it's files and create an English version?
Don't know. I could do the Translation, if the Programmer would like to.
You should send him eMail...
- Patrick
--
Fionn-Fan-Footer