home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
High Voltage Shareware
/
high1.zip
/
high1
/
DIR14
/
FIXUTIL6.ZIP
/
CHK.DOC
next >
Wrap
Text File
|
1993-10-10
|
6KB
|
116 lines
CHKMEM, CHKBOOT, & CHKCMOS
The CHK programs are part of a suite of programs
which I have developed as personal tools for the investigation of
viruses. For some reason (possibly laziness) I have become something
of a specialist in Master Boot Record, DOS Boot Record, and other low
level infections.
Each carries its own documentation internally. To read, for CHKMEM
simply TYPE the progran (e.g. TYPE CHKBOOT.COM), for CHKBOOT, invocation
without a drive letter (e.g. CHKBOOT) will provide help. CHKCMOS has no
options & therefore has no internal documentation.
With the current rise in number and prevalence of such infections - in
particular the destructive MICHELANGELO, I am releasing these programs,
as FREEWARE to the general public so long as they are not changed in any
way, and in particular so long as the ASCII notices remain intact and are
displayed.
Like any personal tool, I can make no guarentee as to the fitness for
any use but they have proven effective for me. They are not 100% effective
against any and all viruses but CHKMEM will find all of the MBR infectors
and quite a few of the file infectors that go resident in the "upper 640".
MICHELANGELO in particular will return a total memory value that is 2k
lower than expected (most 640k machines should return A000 seg 640k 655,360
bytes when clean) when resident as will STONED and most of its varients.
If DOS 4.x is in use, this return may be 1k lower - 9FC0 seg - and certain
COMPAQ and other machines with dedicated mouse buffers may do so also as
will most BIOS-beginning security program such as my DiskSecure program.
Be aware that such a memory loss may be normal but any should be
investigated to determine what the cause is. If you have a low value and
are in doubt, one test would be to boot from a known, clean, write-protected
floppy with the same OS version and see if the values are the same. Note
that the lower two values will change depending on what TSRs are loaded but
their sum should remain the same. Mismatches of over 10h bytes should
always be considered suspect. (10h mismatch will result in warning line
but no "Infection" message. To see the message, simply enter CHKMEM 0."
The best use of CHKMEM is before a virus strikes to record "clean" values.
This way any differences will be redily noticable.
CHKBOOT simply checks the boot record of floppy and fixed disks for
adherance to certain rules. Note that STONED and MICHELANGELO will not
be detectable on fixed disks this way since they are MBR not DOS Boot
Record infectors., however Boot Record infectors such as MUSICBUG and
FORM will be detected both on floppy and hard disk. CHKBOOT will detect
all these infections (and others) very effectively on floppies. Also please
note that it may not detect certain viruses that "play by the rules" on
floppy disks but I have seen VERY few of these and none are "common".
Again be aware that some security products maintenance disks
(e.g. my original DiskSecure) may also violate these rules so if a disk is
flagged as infected, be aware that there is a small chance that it may
be a valid disk. It is also possible that some disk formatting routines
may legitemately violate my somewhat arbritrary rules. If so, I would
like to know about it.
Known "false positives" are with disks formatted to DOS version 1.x and
COMPAQ v3.1, or any 5 1/4" floppy formatted to 160k (8 spt/single sided)
However, unless a disk is really needed to be bootable with these older
OS, use of FIXFBR2 will remove the flag when checked.
Since some "stealth" viruses may return correct values to CHKBOOT, it
is recommended that CHKMEM be run first unless the system is known to
be clean. Those "stealth" MBR infections that I have observed are detectable
with CHKMEM when resident.
Just to make things a bit more difficult for would-be virus-writers, the
rules these publicly-released versions use are slightly different than
those in my personal toolkit but are designed to be just as effective
at finding viruses.
Note: while these programs are designed to provide indication that a virus
such as STONED or MICHELANGELO is present, they do nothing to remove such
viruses, the proper treatment will depend on the virus encountered. For
protection, please see my FREEWARE programs SafeMBR and NoFBoot.
CHKCMOS is a new program written in response to the EXEBUG virus. It is
not very smart, just returning the information contained in the lower
configuration bytes of the CMOS, those referring to floppy disks, fixed
disks, and memory size. Since the CMOS checksum must agree with its
contentent to work properly, a checksum mismatch is more likely due
to a failing CMOS battery than to any other reason.
CHKCMOS is based on the original IBM-AT CMOS specification and has not
been sufficiently tested to expect proper results with any other CMOS
(though it has worked properly on all I have come across). As a
consequence it must be considered very much a "beta". The good news is
that it only reads the CMOS so it is very unlikely that it can do any
harm. Note that it is for use with AT class PCs and above, operation on
8088 class PCs is unpredictable.
Further, IBM PS/2 machines use a "different" structure as do certain
early (XT class) AMSTRADS. CHKCMOS will attempt to identify the BIOS
present and use the appropriate algorithms but again no guarantee can be
made though CHKCMOS will tell you what algorithm it is using.
RETURNS: While these programs were originally designed for manual use,
errorlevel returns have been added for use in batch files (CHKBOOT
should only be used this way on fixed disks) or from Network
servers. Returns will be 0 for valid termination and 1 or 2 for
suspect termination. CHKCMOS does not provide errorlevel returns.
Weasel-Words: Use entirely at your own risk. No garentees of any kind are
made or implied. Just because I cannot think of any problems that
might occur does not mean that none exist (though all three programs
are passive in nature). False positives may occur.
Padgett Peterson
POB 1203
Windermere, Florida, USA, 34786
10 October, 1993
Internet: padgett%tccslr.dnet@mmc.com