Chip: Shareware for Win 95/Chip-Shareware-Win95.bin/antiviry/avg41/install.dat/TRBLSHOT.TXT

Text File | 1997-04-22 | 17KB | 441 lines

Antivirus System AVG
version 4.1

File TRBLSHOT.TXT

This file describes problems connected with installation  and
usage of antivirus  system  AVG  together  with  non-standard
software or  hardware  and  some  usual  problems  and  their
solution.

We recomend taht  you  direct  your  attention  to  "Frequent
questions" in your manual.

This file is continuesly  updated,  based  upon  co-operation
with users of system AVG.  In case  that you  find a  problem
which is not  described  in  this  file,  please  inform  the
manufacturer of the system witout  delay, so the problem  can
be solved and included in this file.

List:

Running program AVG from diskette
Anti-Stealth technology is not available
Driver AVGSYS.EXE cannot be initiliased
Driver AVGSYS.EXE cannot use memory XMS
Driver AVGSYS.EXE does not control boot sector in Floppy disk
drive A:
Driver AVGSYS.EXE does not operate with files on network
Hard disk cannot be recognised after booting from floppy disk
Heuristic cure cannot be used with some viruses
Resident driver does not control all desired functions
Virus goes through resident driver
Heuristic analysys detects unknown virus in clean file
AVG detects not enough memory
Disk manager (Western Digital)
Driver's message in graphical enviroment
Memory cannot be tested in program AVGW


Problem - Running program AVG from diskette

The installation diskette does not contain system AVG in
running mode. To save space on the diskette, all files are
compressed. If you want to create functional diskette with
operational program AVG (highly recommended and this
diskette should be bootable) you have two choices:

In instalation program choose YES to "Istall AVG of Floppy
disk"

From already installed AVG 4.1 on hard disk copy most
important files (AVG.EXE, AVG.AVI, AVG.AVF, AVG.AVH)

Problem - Anti-Stealth technology is not available

Anti-Stealth technology is special function, through which
system AVG can detect active virus, which is using Stealth
technology (invisible virus). Basic of anti-Stealth
technology is direct access to disk operations - that
means ignoring operating system. This fact - ignoring
operating system and possibly any other software means
that anti-Stealth technology cannot be used under all
circumstances. Bellow you will find most frequent examples
where it is not technicaly possible to use anti-Stealth
technology so it would not colide with another software:

Software drivers disk borders

SCSI disks

If drivers for using SCSI hard disk (typicaly in
CONFIG.SYS). Most SCSI devices are capable of working
without this software support, anti-Stealth technology can
be then used.

Enhanced IDE

If EIDE software support - for example WBIDE.EXE. Concerns
mainly older types of motherboards which support only IDE
0 and IDE 1 border, and where it was neccessary to install
more then two IDE devices - for example 2x IDE HDD and 1x
IDE CD-ROM. More recent motherboards support four IDE
devices and therefore do not need software support and
anti-Stealth technology can be used.

Hard disks Western Digital with capacity over 500MB

With older ROM BIOS was neccessary to support with software
hard disks with high capacity. Frequent example is
software OnTrack Disk Manager.  Modern computers are using
technology called LBA, which is designed to operate large
hard disks and anti-Stealth technology can be used.

Mapping memory ROM to RAM

There are few known examples, where anti-Stealth technology
could not be used because memory ROM BIOS is mapped to
different address.

EMM386 and QEMM386, if these work in so called Stealth code

Operating systems, if these work in protected mode

Operating systems working in protected mode, for example
Windows 95, OS/2 etc. Often it is possible to activate
anti-Stealth technology even in these enviroments -
dependig strictly on setup of operating system.

In many cases, for example in Windows 3.11 can anti-Stealth
technology use.

Problem - Driver AVGSYS.EXE cannot be initiliased

In version 4.1 system AVG the task of driver AVGSYS.EXE is
not to employ anti-Stealth technology. That is why
function for initiliation of the driver is missing.
Resident driver AVGSYS now employs only controlling
functions.

Problem - Driver AVGSYS.EXE cannot use memory XMS

Driver AVGSYS.EXE is using XMS memory for creating its own
working areas - apporimetly 30 Kbyte. It is neccessary for
XMS memory to exist. In MS-DOS enviroment is realised by
HIMEM.SYS. If XMS memory is not available then driver
AVGSYS.EXE will use hard disk instead.

Solution - Install memory driver XMS (HIMEM.SYS)

Check that AVGSYS.EXE starts after XMS driver is loaded

Problem - Driver AVGSYS.EXE does not control boot sector in
Floppy disk drive A:

For driver AVGSYS.EXE to control boot sector of floppy disk
drive is subject to the following conditions:

XMS memory must be available

Driver cannot exercize this control if XMS memory is not
available - that means disk swaping. In that case there is
a danger of crash.

Solution - install memory XMS driver

Function /BOOT+ must be switched on

Parameter /BOOT+ instructs driver to control Boot sector on
diskette in floppy drive A:

Solution - use parameter /BOOT+

Problem - Driver AVGSYS.EXE does not operate with files on
network

In most cases is driver AVGSYS.EXE started before network
is initialised. In practice it means that important system
services (INT21) get fully under control of network and
driver AVGSYS.EXE will not know that action which it
should control is currently happening.

Solution - After initialisation of network call AVGSYS.EXE
driver again with parameter /NETW+. That allows AVGSYS.EXE
to take control of the system services (INT21) again.

Problem - Hard disk cannot be recognised after booting from
floppy disk

This problem can be caused by following:

Non-standard software is used to organise hard disk

Some programs, for example DoubleSpace, Stacker or Disk
Manager creates totaly different way of storing data or
system areas then is usual with operating system MS-DOS
without using these utilities.

If you then boot from floppy disk with containing standard
operating system files, system either cannot see hard disk
at all or cannot read information written to it.

Solution of this problem lies in creating boot diskette
which contains system files (IO.SYS, MSDOS.SYS and
COMMAND.COM) and also programs neccessary for accessing
hard disk. For example operating system MS-DOS 6.+
automaticaly writes on system diskettes program for
reading of disks controlled by DoubleSpace.

Study carefuly documentation which you use to organise data
on your hard disk and find way how to get access to your
hard disk after booting from floppy disk.

System files are damaged

System files became damaged - crash or virus. Start program
AVG from diskette and check physical equipment.

If you have backup of your system files, try to use it to
restore your system files to original condition.

If you have any doubts about source of this problem, we
recomend that you contact manufacturer os system AVG.

Problem - Heuristic cure cannot be used with some viruses

Despite the fact that heuristic cure is truly revolutionary
technology and thanks to existence of this function number
of cured viruses has encreased, there is still number of
viruses which cannot be cured by this method.

To better understand this problem we explain principal of
heuristic cure. Most todays viruses will let its host to
start. Heuristic cure takes advantage of this fact - if
analysys finds mark {B}, which in practice means, that in
virus was found "Return to entry point", it can use this
fact for restoring attacked file to original condition.

Unfortunnetly mark {B} cannot be reached in all current
viruses - depending on type of virus rather then its
complexity. It can be generaly said, that if one of the
found marks is mark {B} then heuristic cure is possible.
Otherwise not.

Problem - Resident driver does not control all desired
functions

Resident driver allows control of number of system
functions - for example opening files EXE or COM for
writing. This control can be very useful because it can
detect spreading of the virus.

But number of users are complaing that driver did not
detect their trial operations. In that case it is
important to realise writing to file can be executed
through several technics - real opening file is only one
of them. Number of utility programs (for example Norton
Commander) is using different way - that means that
writing to EXE file is not detected by driver.

Significant information is, that computer viruses use
almost only standard functions - because they are
simpliest and easiest to reach. And these functions are
checked by driver.

Problem - Virus goes through resident driver

Virus can get through resident driver in case, when it is
non standard virus or it is using non standard technique
of spreading. For example we will show how can go around
some parameters.:

/FWRI - virus went around this control by non standard
technique of writing to file.

/DWRI - virus went around this control by for example
writing directly to ports

/SCAN - it is heavily plymorfic virus. As driver AVGSYS is
written in assembler and its size is restricted, it is not
capable to execute heuristic analysys - it executes only
antivirus test. It is not therefore capable of detecting
polymorfic viruses.

Problem of its own is enviroment of Windows 95 , where
number of system functions is not anymore used and they
are substituted by WINDOWS 95's own functions - driver is
not therefore capable of detecting such operation - more
about this in file ADDITIONS.TXT.

From the above facts it is possible to come to this
conclusion - resident driver is very useful utility.
Despite that it is a supporting program and main weight of
securing virus cleanliness should be left to program
AVG.SYS.

Problem - Heuristic analysys detects unknown virus in clean
file

As it is stated in the documentation, heuristic analysys is
based on principal of detection of instructions, which are
from point of view of operating system incorrect.

Unfortunetly there are many programs which are for some
reason using incorrect technique and are virus free. It is
possible that heuristic analysys marks these files as
attacked by unknown virus.

If the user is hundred percent sure that the file is
absolutely correct - for exmple it has been used without
any difficulties for long period of time, then the file
can be "validated". In practice it means that the file
will be ignored by heuristic analysys in future tests -
providing there is no change to its size or contents.

The basic validation is done by manufaturer of system AVG -
respective information are deposited in the file AVG.AVF,
which is updated once a month. User can make his own
valdation file called EXTERN.AVF with help of supporting
program MANAVF.EXE (see manual).

Files which are reported by AVG as "unknown virus" sholud
be send to manufacturer without delay. Experts will then
analyse the file and if it realy is correct it will be
addad to validation file AVG.AVF.

Problem - AVG detects not enough memory

This problem can occure when size of conventional memory is
smaller then desired 500KB. Size of free memmory, which is
available through operating system depends on current
configuration of operating system and size of resident
drivers and programs in the memory. DOS 5.0 or higher
allows placing resident programs in to high memory (HMA)
using driver HIMEM.SYS, which also allows to access the
whole operating memory as XMS. In special cases it is
possible to use memory manager (EMM386,QEMM386).

If the size of memory is smaller then demanded approximetly
500KB, situation can occure, that some functions of AVG
will not be accessible (help, list of heuristic markings),
In case of critical shortage of memory the program edns
reporting internal error.

Problem - Disk manager (Western Digital)

Manufacurer of well known hard disks, Western Digital,
supplies with their products programs called Disk Manager
(DM). This software allows organising disks larger then
500MB.

DM uses its own structure of writing system areas
describing division of hard disk to logical disks of the
following type:

In first sector (Usualy partition table) is written starter
of this program. DM is therefore started automaticaly
every time computer is booted - before operating system.

In another sectors of first track (these are usualy unused)
keeps its own information about partition of hard disk -
these are coded.

If you boot computer standard way - that is the system is
sourced from hard disk, then DM is activated. It is then
active in the memory all the time for other software it
creates illusion of standard form of partion table. In
practice most programs can be used without any problems.

Significant differnce makes then booting from floppy disk.
At that time DM is not active in the memory it is not
capable of creating illusion of partition table. Partition
table as it is written to the hard disk is not readible by
operating system and it comes to conclusion that hard disk
is not available - hard disk c: does not exist.

After booting from system diskette device c: is not
accessible.

Critical situation occures when computer equiped with DM is
attacked by any (even very primitive) virus, attacking
partition table. This virus overwrites original starter DM
with its own code and original contents will transfer to
another sectors (mostly unused) - ther are unfortunetly
tables of DM which are then unrecoverably damaged.

The result of virus attack on hard disk equiped with DM is
total unaccessibility of hard disk and information written
to it - most likely loss of all data - currently there is
not known simple way of recovering access to the hard
disk.

From the above information we conclude that Disk Manager
represents non standard software which in combination with
computer viruses represents big danger for data written to
the hard disk.

Problem - Driver's message in graphical enviroment

Resident driver writes its messages (in text regime) on
firs line of screen - red line and allows user to choose
next function from keyboard. Problem is reporting in
graphical  enviroment - driver does not report in to
graphical enviroment. This could be influenced by setiing
parameter /GRWR.

Setting parameter to /GRWR+ determine that driver can
report important messages in graphical enviroment. Because
standard concept in graphical expression does not exist,
driver uses for writing messages standard function of
BIOS, which are binding by all graphics cards. If driver
during usage of graphcal application needs to report
message, the message will be placed according to current
position of cursor and it can look different according to
enviroment. (Graphical application do not usualy adhere to
same standard). In graphical application which do not mend
their graphical exits correctly can occure partial
breaking of screen.

In the MS WINDOWS enviroment the situation is as follows.
Communication between user and driver AVGSYS is secured by
AVGSYSW.EXE.  The behaviour of the driver is then
determined by application enviroment in which the event
happened:

If the controlled event happens during WINDOWS application
standard window will appear with message and choice for
user. (Parameter /GRWR doe not influence this case).

If  the event happens in the window DOS application (under
Windows) and this application is a text application and it
is not enclosed to window ,the message will be reported in
standard way for MS-DOS enviroment - that means red line
on first line on the screen.  (Parameter /GRWR doe not
influence this case).

If  the event happens in the window DOS application (under
Windows) and this application is enclosed to window ,then
it is application using graphical exit and permission or
suppression depends on settings of parameter /GRWR.

Problem - Memory cannot be tested in program AVGW

After you start program AVGW (for Windows) it is not
possible to test operating memory RAM despite the fact
that driver ACGSYS.EXE is installed.

Presence of driver AVGSYS.EXE is not connected with testing
memory RAM in WINDOWS enviroment. The problem is absence
of program AVGSYSW.EXE. This program must be started
before WINDOWS. Program AVGSYSW.EXE has two functions:

Ensures communication between user and driver AVGSYS.EXE in
WINDOWS enviroment.

Allows program AVGW.EXE to access operating memory which
under WINDOWS cannot be tested.

Solution: before starting windows execute AVGSYSW.EXE

End of file PROBLEM.TXT