Date: Mon, 9 Oct 1995 15:26:36 -0500 (CDT) From: Wolfgang McKeown To: InfoMac Archives Subject: hyper-gatekeeper-125 HyperGatekeeper is an anti-viral stack for all known HyperCard script viruses. It attempts to detect unknown viruses as well, but whether that will work or not depends on the individual viruses. All documentation has been included in the stack itself. This stack has been tested with all the viruses I had on hand (for some reason, HyperCard viruses are hard to find; I had to write most of them myself). I have tried to make this stack the best it can be, but then no security is perfect. Any suggestions or complaints are welcome. (Please give a reason for your complaint, not just "I hate this thing; I'm not using it.") This version (1.2.5) will detect viruses that overwrite existing scripts instead of just appending themselves to scripts. To date, I don't know of any HyperCard virus in the wild which actually does this. Because the new version uses a different verification formula, all your previous checksums will have to be updated (which means modification dialogs when stacks are first used again!). Wolfgang McKeown 8-) (This file must be converted with BinHex 4.0) :'8KjF'9b4f&dC@YPCA"PFL!a,M)Z05jMF(3!8%&$9%033e3!!!!!&SX!!!!!@iB "!FpZ!!!@*S"%D@C@CfGhCTL*#BPAN!#BPP"j!("`#B"R@BQCF)"jLBKiLC!!PhH *HBD!HB#B#3#3!!H*Q!Cj#!PjF'#(J*!!H3Q3!!GhF!!*!!N!#!F)!)#B!*!!#C! !!!!!B*!!#3!!!!#!LC!!!!PJ!!#3!!!!!!!!N!!!N!#*!!#CF!!!N!!!!*!!N!" J!*!!LA!!J)84!!)c-d9P@'D(J!F)!!Kj!*!!$a0%999PCfH(J!F!!)!!#)3L!Q* i)3V!*$ZCN!$4f+1'I,KTk1$-KdIaTrYlrDQkI0biCGk&r*bYAM6D2chV[Bd2Kl0 hj,Yd#T[5YmQhkXe)2IGkI1pY!h8dY2fDPHMGhUF0hHaE`#bIKqrDqf%-rli3Vl% f2[mq0r(c*XA9cTV(Hq#PCPj9[kSje[k)mLhFpEfZpT69U9r*iqVfk9kYJYp[kkA &Kd0hdidXr@fSmI2erArc8TA[r"QD[[eFb5rj2-YIRSE(rGr3qA$r'[r@T'eE$R% [j28lfG`I(XdTF0(mhHM4#%RShrZZpL(&V#p)`X`M`@X&A$24ijFhEmAJcB3m%m) 5N!"%%G@@H2f5cb55cbaPRkS%EQ3"'Y,2hHl,2V%)#$@#M)h!SK+8%C!!MP`KY@S 4`eF&A"($D!lkB3YBB3Ui"K'SbImfLMK))`3qb$rS(`jDSS`eD+-%D"IfhiQjr9, 694G4@9%9J)UPV*4%JEJd"eNa"$UJ$&$J9a`'-Dd@hGlL1%YhHma`Br6'1BDXf5a 6N!#3!+5JN!#f)f5G8B+U-0A$0bG)'V[5kQ`["lBP(d,2'UAU`3r(EL"rRVZeA(E [!T@ZKC,&F`,M2l1VjSG0cq8SL3#+Llr)4L+),Ij#-G4&94(%9`A5*%2,!M%!M)8 K1Ak+PH@D"bQ&QK*`BJmE&aR$#b$Y&R#8iN)5Bilr-B9"Y#ASP)3P)'FF`N,B2TU 03JBXLV##MfN#Mh%!#0S#'[T!K&iJC3#S'UI@'V5l+J1YAPj[GrR[!mP$)+C@5#0 C@2"jjF3E@*FJZZciVM)3mh2fZAYq1pBcj1GrHKQkIcA2$Fm0cpGQaHXA[2jHeCi 2)h#3!'hib#-%-%FhK*!!(r9V&8i@Bq`99,hkIME2J$T1kmc6dQT"1P@b!JMJaXC )R'QS%IZ*5$8kAcGUQP$P@"&NqY*KhF2+i'(f)1bML3h5R%LbJQq"6T!!JP*L&k` B)+(Pk*1Th8(65@&*#A5!8([P!c[rcKHpcTCAqJ9j`'90,f1Mk!'FRVpEAj3%F`# 28!MSGIVE*'2H!JM(a!34MBr6mN`'BL%6r)%'9+cSC9aQaR5G$+h6)B!!!!#!4@K iL(QCGTH*USZBQCU3!+TC@DU,H)TiHhL*#BQDJ!ZkGiL)PjLTL)Q*KhLAQV#l!,9 fGACPPfCPD99QGSH3!,QlH)U+N!#,X+UVQTZkX)!!UT!!J*U3!!!!F!UlUl#lZkU TS*LTN!#lX*U`N!!,QjQi#U!,#JZT#J#JU3N!N!!,Z`U`QUX*"b!!!M0%4&9@CQL (KiGjLTLTUEX+UTU3!+N!QJ#3!!#J#E#h3$0%499QCQCfGRGSKhKRKhGfH(H)L(L CL*Q+L*LULBL*HCL)QC!!N!#TUJ#l#UUVZC!!QJLDUD#CN!#DX*Qk#VZTUjX*K$& KRk'EiQedHPL3!1MdYcfF)CR@)+p(TBd8)GRhS%3"(DHl#'2e3&Hffm)HF!4m@YZ YL"!43)rHpVr2H!-EIkF1Y&qDYeJ#m5YHffB!4X%"!"0rAp#%-E9LmHXb&Dq`D"` Ke)5%")G6U55%"1TXbE*!6f0R[L!QclqckC!!%fIIp2drI)#EATl4!3J*Y%"0MG9 SiXA-a!T1,e*1T)3%lD6Mp3J*rPXBeVM9X[HrfCHfq0q2m'0p2CKX`)#G56RJ6!# Fq6RN"-2j-2j#!K)cZGRRl22)#EETq(PieD+,TFIjR(k888A8hFQEe-f6Gl'aQrZ BZ,Zrc5BRdVmQmkZkp6BkQ,lf,e0MjAVm,q66q6b[2p(kqEkQrr$ZrH*aq)(,l'C (#YLBS1q`&Tf)E@`$,Lph*kZa&@a0VBf0MDaFA&q#r*RIcEb6bZ[$VpIlBF(YIaq Tqrk1EX3rAqRpIkHYcHYc@@k3!!MJF#2SAHK0GUdY+AL4jHAPm(`1rm(`H#i&(Ne SF[0cp"-*IMrd##hp2Z`Lq(9K@VHK#,pAQ3KcHV#'KkMJFI0f19bFr36$[FL)JSQ -5+(6K@K($EIJK@lJiS1MdYaZ[8-%FV&KcFh1j%)!)!,Br9MK%#pfRZrPmITm2Hf H*bISH$p(p@$3hGEPHAh2Cr%j1C*q,mZ2Br4JlRkecpRq(Up$aZ*pA+l(l[rAXr8 qrmld2$lIpMFCRN3a[NarBrDrhpMfI9rdq(LrBiN[qh$qclh4p['lhqIihGIGUk2 hZjYG,THMPr5iRjrcqPZrBkhjr@kI*qVlIk2rIZ5DrGGDUercNH4j(rRFI4bHpdI pF'JmQkFK"l"bcQFAa-lMR-EdHPMTQ@-'r(bIi10Qmi"X63"EZem`!EY3[4"k[$( K$Hmf!QafrhiEf%9EE`lZ(F3qh%3X$MGY$'l)04bEZT36PYYl8+d8)Xb(cS[(Kr8 Pf%-B!6GF@h4BeCUBqE64CTPZ3K4GMUQ[aL([KkpkDR1P[cDXd`"9F"2ajUDT`)Z $PF,+lq[2U4hT30FMJlk1HU1l4IMNUX8chVmNGqe0G!HUU)R9jVG8eI5"(Mi9H@l 9K"aNdFhRFcNmc1lc[*)pl(60I`8h9JQ2HqYANcBl8Yh6YJ@!ZbhlmebpIRZfBlp %GbM6Re0H1@0"[bSip#d",BS`@p125QMP"8)Kkdp-YZ1HlU6@,i6J#MMd4kp'#2$ ,G[N5Ep-Yi*BBmZA!Eik+BjEGZM$(1&'-LJ6NT2cC)m-pqe(*iY-pQHlPC@9)3YN jS$L!9S!Qb%bdpmNcD&*-HYHY#e-bEb%JG,TK*q)l-@"p(IPTXKl$eD[40H59Qh2 UJ@84dAJm!K`KSSk04#cdDANKM!TRV9d+GmqC+IFbKT2$#jTX!S4)`968mUE@QYa rYapqJ0@EG'N(2S-AK6hG22[dKm15J)k0ULh0Sd8kGHpJ+*QB13RZK'h)`-3AkF% c3IB(dfQ%6D8C6'('Y'Tb[2#3!&XdJ[d84P!%%aNH9"ib&bidYfa0ENVc"hmqSYk a3)*L5L6A#ac"e)dBDK!KHFY`%bK'Bk3)d[cNF6Ym5223X%YLa-4312M6QZccDH8 XkN"`Ai3VASEB8(a3lb,H3rikff,AFA3MbEY9m5JaTSC1K'j3(rFqpAR3(%KXbLS 0e`*h!I+f2B`8e%bP!Qb[f,4[VBHCTB,pm$L4a5+Q&&j!13VEJG@U,LBAN!!T)M$ Cj$!2%dGfr+%8MN4F8+CfUp,BQha24G48'fB&L(@ljjcq'I3YGM9&&G-dZRVX%)8 TKGddmj-K[*[8996k9X8iABjTDEFi*1XQST-L5@#&-20Yc5L(p-ebM@#ahd%25Qe ++5A)h4#A8S,p!SSA$dbUT*UfcHX8@T*$,DNPlKc$GbbPk6%c+94)JF*+m"ahDQ# fhMNESR#'fq[!BQ)Si54F1(BF4hmj#d251j!!`E[(Dh$c[(BQ"lT@Hc9@Lh[2C'S 2JT3hlrNG49h1XBLb5iLkj-GL@lf!@jTVK*,U#k#e$`'8`Ha'mU%MKL93M)@hF&c 5!l#8#*@DSL*BY5dam%l`QTU"I-KD)j,#Ali5eT9e+J'XC%AJ[XAC%dV5Ee$MFRe Ul4QGM*j&I6QYcAjM"U$X48-0YaSl53&M-eeDcG-e@#fLUaqY6-DUNflfNcjSaEM A&T5m4!l"Z'4)mQ4$a'5Y&TBV')pD@h18MC!!JX)QH,%cc2&d#$VbX"3E8%#r5,D PN4E1d+N6U2kY4(1B$Hq0TeXBS3bSENEARq!Y&Hb,5CGLB@QpY$iJ"[F+NBjNYbB JcP3a5&N@*$fDcN@$DC*ReLh%rYKf3$(BKj-2KKjmB-(c2kblPVIEe2FJDSc*DbJ PV6P9M-5i@*DG-6@6$,"N(P3Y88hilS-j"ki8me!P0+dHqikDT8K$qk(D%Q89b(` aI@FTNYB(K-hK-h#CpRT`(+812Rj8@mLr'lBb9*fp-C5JilibeL"pFCLfUH-CTk[ eLh490a48ACTS`AG2*-)Cj91C0@#SD)aYKJ'T-PLe0BeDM(4fi&RS1HZ9$@3[65h dE,-id$(6Rha8L[5m2N#rf@FNBJaUi6Qpic!Z`BZbZ0RB'jd%DGCZA8[KLeS'VDD IFiTbP[`FMSd*H9DQC4X@jDJHL['!K,&KGa")-9h%%1)IE-%4Je+#e$#iV8jLUR1 BXFI*`mHfC08C,LV41CN#+iVB1Dc,26k)@@1CcCX5q&K4,KFT#@8A*r,Qb'dPfqB hVh$*NmTCP!L3!1mE9qKhjF(Eh[!LXqK'9rM#f!qQI&VJpE#[8PRYZGrKbZPI8`A 6V5BA9+4TQRVbeDXFR)ZNU-XH#l2j3iS-)iN)mLJBXk,Y[AbBla[B1kI1-,GmZC3 -bKp+MCf"bZ(**JZ)ahL`G2%QlmQ%QK2HiNHG1)865f,3MF[DjmMb9(#*$$GU68J k+2449-mJ,Kp5!`aXb&3#J01EDcIBj+D3!2Bj!qdk-)fBU)q#411Edl3+$J`8KC+ Fp$3LDY$THXFAP&rJppN6M03id"Tb'S'"52UK5ilrih%Kb&QQL@E1)0IeI[fjh91 d4R2EC*c2L*BEeX+jN!#(kC-RT5C,1l'ccCS&aaRj(IF,`1(i'q%&C0qH!Pdh#q, RalpA6%f%44c,%AV044[)9P81S9MC#G5HZ!I&cppmXbFf5-e"dZ4d,e,UYhUbC*K erjDXpmeU)42j@S#YmeUchXY96i,9XL$$c@T+)T!!FF6DVH,9)U#C(IQk&r*XC)Z 4@e8N&U-Tl9PM*)3-kKrPc8MbKP)3jPa2"+4(9MD+Fa(L!"$DNM5N,3A*#fNG+HC !K(dMNfI2cq4c14S4f0HpD&4Kf95k9M6Qe,0UIbG@hFZdA[+TU[i0E$d0Ibdf1Tm Y0Y![E#*X2&C6+01E6HYQEXr8dKE8Y%%LDF"eCqAN#6Lq3jPX-mP3Y2Lr0#4ZA-Z )IZiFQeVMF)[`l1Yp''K$YSZlLcBcr8NILmq@q-RZY(q$`b*#H&'fmrlZUe[8KA, 6G&mQ,KaILHZQjeh8dC'A`h8R!II(6MDXMF5H0,caTHBd[,l+$jDAfq`HmDB(M6! bA81&hTkCaY3M*&aLb'jq#j9)qQQbA6(QS'6Pq02Vml)$kmakj%-Eq+(DPqP-AM4 H2&rHfr5Pc`X(*i)kUlKPM+j"JT0A(#!mKBIijZ4+4"FK4C02K`IS5%#"C$3$b(c A&Jp5!f%4q0GS)N4(!hI6ebP(B*RVr,4qZb[5@MJ!B[rZ89Ed4b(4*)iNpm+LQi0 @&&k+hTmc"FAhN@`K)JjI4kAC))%R!i#EdqR4J(EDimY9SNTB"aFC%RTF5-#G'Ja 0VjakMY,9XSSR4fc(`%62BQHKNhXHAm[,3L2&cfCGAXFL&,LAGMdY[m8GKj6ZSk" %qUMjlj+1Nj%+AUSlhFHTURph5A4-FNEL4$8ERUF-'PRcTpTlZQDPHH$hNMDM)DM E15HkP(Z68P&m,*-$*NQem&jAZPZf-MeGp(pT('AhbM`DFT8XaNIIJi*"*Z20Pd( K(T+'-$cK0$aR`R5M5DH[%!iI!BAqZ9*D[BGNiZEa[%cZGi[2jR(5SD"`VU!828, @4$D(ZIS!I2FF'GA8ERprMXIJ36",2XD!ZD)DHk`1ME@8lbA"d'0e*)K!J(F"@(e PKjmR"IqdA@LiUX49$(Sbdh4dGXCFNqJSqBJFjT4D),j!R"d$M%"B,0dMc+$[%Um +qNAb9(qGF&3kYj!!L(b5m534RaI%Mb*mUE+2N!!&$SYj3[2M90Ee$rCE#fq*+I0 -)NlS[P@'TPmLSp1pZLM9(MZ(Lp2cdPSYCq,RLL!aFR`k(b(lAG$8%h1FE$11eSj rVd[qMJN%D$lk#dr9mrd*6mm*ZAMVP*LPFdDdLP9CJ2P$l4A(6'[PB+"P+$NQ,*I `qf[qDq@2)q[jdK6Q9"@'cLq@S)NN#$(YI$i&M#$2BR'k-VbN)5R$DR,T@4p[6'f UQR!,,d"r3YJ5%6J#&i0NmFLrJH0i-Rd6"*3GKqEk0JJCjk4e09"J3$"%BA%@AfM Hd-5rYPFFe+4,fJL*qbI8R(#3!'cBc0&,)I'UV#LIcb9M%'mE5B49,6hlHrSb)'` r9I%B%!$hIU[9@EBIPE5XIK"ZFqr5%db8"(4Y8@jY%A-891-2Q6D!FMG9fa1qXj) T`!CUE6Cq)i(A@U@-&9([BB(II)B+AG65XFXT*kfB4E42'$9i`D['$9i`DYm$4KG m-$VI!8p"BaJ0IlR)Irbm1qjmR3kkF3ilEZY$((2*[iHa&RaIrYZH4mIE`r22,$D fSUqafi-9D(E`fm0i2H4mX!M*K%kebekiT0dD,HTCP&*h,XH*-,LeHZAm&,LM2qh ii"KI$+*%rq%H'aedAl50kLDQa-@'00HCHlpYr%C9mmNm8G8p4AI`lV$39l2"EQ) 1m@JDV5DJ9hVK8'P!Lec`a)qMqF(B-H6(#Q%Ab,U@L%2NGI)(pLB8'MVjKYIUKL` 6dTlA`3l+#rT9f[rS[Af1e$@44BX0a&fN)Lp3DZRkUr4H4H&,bG+q)41dPZM)+(( 'SLiU8BRM8V`k-)SqT+mZ9Zd"B,%Fjc)Z4a'V62KCA"3d*kp)cIPrJ8$SB%cU!%4 "B0,YRfijUDD%H4ZTEab5S2)2##H@1F8$VeSDXNZ@Qe'1A%d#d*EHV(cTMp&0JC1 cqADAPUZ[dcH9JRT'YH@'4Vc#SH1&E0+Jk[@(j9)`0N$Vk)ASrq!+`K0#AX%3cXH 3!+3Li&'eqKFP+bmNk*DbGEF$95f4Vp"m8Y0LeVj9H[cTUK(U2lMU)dSE%NNU`AV `Q2(U9f[qkhAJ6recXkBm"4BDd@+-2r6lRK0VT,jaf'RDciT0f5BY2CU4%J9kX0T ND*j)BlXf&8eP5F1`%3NZPERc6RPYd@8YY4HM'YU-Q!GL+@dE[qP-8+3q!1cZ"9G mF51R3&b0EK)NK&@dLC21URZAJQYbLk@G%V)(H#YLLjF&[*-'$ZT#!)Fi5V)@USH Y)(-ihG@l4K%rBHL6GQda6V'M+l8UE@T'%@X#Ae'HFLma,PcEFZZ8bY8iMd8l)Zq !NF*d'"H%Tf!'AqaKl%"'NA`ESS%c5BedhJ&4*('*TDjp'$V'1L!c#CYaq*c,-ed #ZfSqUrIA)1UMI)IZL05-E+91'QFQ+BN6UM`c&Dk!,[&e2-Ker%SF%qqdAjZkf1, bmhQ`Kf[Q!'pP%!,Z)[(V(pf531B(h@6eqReqQ3%kr6rakITG,kQkc2Fq4arFarT lVBpcj(8pc(krQpIc5!RAmhl2Qr"dIJk*!43)3"KGpkfISFAP$kc08UhYZ!MZ5U5 )#!)iQd$f5#9Q3ML3!1i)*lCX%qc)*N2f!Rf4"2F,#HeL#Yi!VZFc`M19Id#14UI YXi1peT4A6$M$XKbfD)FlNFclAaH&`YajqGjfEpl-SqjPlMcXi%Z23cH6bM,`!Q2 c-%ImTd94e@m&rm)!!$$#1d`!!J#A5(P`CA*(BA4PDf9PF'9b)$%Z-Lie)-3!!4B J5(P`CA*(BA4PDf9PF'9b)$%Z-Lie!3!!!!K69%&,9dP-4+V@MjbXQ#GI"3S3[`T 8!!i!!!TZ!!"!S!!!!mX!!"*6dmN!!!: