home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Shareware 1 2 the Maxx
/
sw_1.zip
/
sw_1
/
VIRUS
/
TBAV503.ZIP
/
TBDISK.DOC
< prev
next >
Wrap
Text File
|
1992-12-29
|
25KB
|
781 lines
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
Table of Contents
1. INTRODUCTION...................................... 2
1.1. Purpose of TbDisk........................... 2
1.2. A Quick start............................... 2
1.3. Benefits.................................... 3
2. USAGE OF THE PROGRAM.............................. 4
2.1. System requirements......................... 4
2.2. Program invocation.......................... 4
2.2.1. Invocation in Config.Sys.............. 5
2.2.2. Invocation in network environment..... 5
2.2.3. Invocation when using MS-Windows...... 5
2.3. What is direct disk access?................. 5
2.4. Detecting direct disk accesses.............. 6
2.5. Command line options........................ 7
2.5.1. help ................................. 7
2.5.2. remove ............................... 7
2.5.3. off .................................. 7
2.5.4. on ................................... 7
2.5.5. wrprot ............................... 8
2.5.6. nowrprot ............................. 8
2.5.7. win32 ................................ 8
2.5.8. secure ............................... 8
2.5.9. notunnel ............................. 8
2.5.10. install ............................. 9
2.6. Examples:................................... 9
3. CONSIDERATIONS AND RECOMMENDATIONS............... 10
3.1. Site installation.......................... 10
3.2. How secure is TbDisk?...................... 10
3.3. Solving incompatibility problems........... 10
3.4. Reducing the memory requirements........... 11
Page i
Page 1
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
1. INTRODUCTION
1.1. Purpose of TbDisk
Many viruses try to damage the data on the disk. They accomplish
this by formatting the disk, overwriting the FAT, swapping
disk sectors, etc. Almost anything is possible.
There is a category of malicious software known as 'bootsector
virus droppers'. A bootsector virus dropper is a program that
installs a bootsector virus on the disk. The program itself is not
a virus, it just installs the virus on the system. Since the
program itself is not a virus, it is hard to detect by virus
scanners and other anti-virus software. There is only one way to
detect such programs, and that is by monitoring their behavior.
None of these viruses use DOS to perform their write attempts,
they access the BIOS of your disk directly, thereby effectively
bypassing DOS.
TbDisk monitors the system and ensures that no program will write
directly to disk without permission! This will draw attention to
any software that attempts to write directly to disk, thereby
reducing the likelihood that a virus will be able to go unnoticed.
It will also prevent viruses from damaging data on your disk, and
it will detect bootsector virus droppers.
An additional feature of TbDisk is that it can be used to write
protect the hard disks. This might be handy if you want to test a
new program.
1.2. A Quick start
Although we highly recommend a complete reading of this manual, here
are some directions for a quick run of TbDisk:
Load TbDriver first if it is not yet loaded. Type "TbDriver" and
press 'Enter'.
For a quick installation it is recommended to invoke TbDisk from
the DOS command line or from the end of the AutoExec.Bat file. For
other installations like from within the Config.Sys file you should
read the detailed program invocation chapter.
To load TbDisk type "TbDisk" and press return.
The invocation syntax is:
TBDISK [<options>]...
For fast online help type "TbDisk ?" or "TbDisk help".
Page 2
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
1.3. Benefits
TbDisk has several advantages over other disk guards:
+ TbDisk not only informs you when a program tries to write
directly to disk, it also offers you the option to abort the
program before it can cause any damage.
+ Detection of 'stealth' techniques. TbDisk will detect attempts
to single step through the BIOS handler, and it will even
monitor the use of undocumented calls that could cause disk
damage. Instead of other disk guards it will not issue an false
alarm if a program tries to use undocumented calls to read
rather than to write.
+ TbDisk is able to detect direct write attempts via Int 13h. To
do this, it has to distinguish between DOS and application
software because DOS is allowed to write to disk and an
application normally not. Other disk guards do not monitor Int
13h for direct disk access.
+ Easy maintenance. TbDisk uses the Anti-Vir.Dat records to
determine if a program is allowed to write directly to disk.
Many common disk utilities will be recognized by TbSetup.
However, if TbSetup doesn't recognize a disk utility, TbDisk
will ask your permission for the program to write directly to
disk. Permission information will be maintained in the
Anti-Vir.Dat files, to prevent TbDisk from bothering you when
an approved program is accessing the disk directly.
+ TbDisk is fully network compatible. It does not require you to
reload the program after logging on to a network. Other
resident anti-virus utilities force you to choose between
protection before the network is started, or protection after
the network is started, but not both.
+ TbDisk can display its messages in your local language.
+ TbDisk uses less than 600 bytes of memory, and it can be loaded
into upper memory.
Page 3
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
2. USAGE OF THE PROGRAM
2.1. System requirements
TbDisk runs perfectly on standard machines, in line with our
philosophy that there should be a limit to limitations.
+ TbDisk can be executed under DOS version 3.00 (and all later
versions). However, Dos 5.0 or higher is recommended, since
TbDisk has been optimized and designed primarily for use with
these DOS versions.
+ TbDisk requires about 4 Kb of free memory to be invoked.
After termination it requires only 600 bytes of memory.
2.2. Program invocation
It is recommended to invoke TbDisk automatically from within your
Config.Sys or Autoexec.Bat file.
TbDisk requires TbDriver to be loaded first!
TbDisk is easy to use. The syntax is as follows:
TbDisk [<options>]...
Improper installation can cause excessive amounts of false alarms!
If you want to install TbDisk in your Config.Sys or AutoExec.Bat
file, it is highly recommended to use the 'install' option of
TbDisk first. If the system continues to behave normally and TbDisk
does not give a false alarms when you copy files on your hard
disk, TbDisk is installed correctly and you can remove option
'install'.
TbDisk Install
Failure to use option 'install' when you install TbDisk in your
Config.Sys or AutoExec.Bat file may cause loss of data! Option
'install' causes TbDisk to allow all disk accesses, it will however
pop-up a message like it would do in normal mode. If no false
alarms occur when you copy files on your hard disk, TbDisk is
installed correctly and option 'install' can be removed.
If TbDisk causes false alarms you should load TbDisk at a later
place in you Config.Sys or AutoExec.Bat file, until it works as it
should be.
UNLIKE THE OTHER TBAV UTILITIES IT IS RECOMMENDED TO LOAD TBDISK
AFTER OTHER RESIDENT SOFTWARE! Failure to do so can cause excessive
amounts of false alarm!
There are three possible ways to invoke TbDisk:
Page 4
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
To invoke TbDisk from the DOS prompt or within the Autoexec.Bat
file:
<path>TbDisk
To invoke TbDisk from the Config.Sys as a TSR (Dos 4+):
Install=<path>TbDisk.Exe
To invoke TbDisk from the Config.Sys as a device driver:
Device=<path>TbDisk.Exe
TbDisk should always work correctly after being started from
within the Autoexec.Bat. The "Install=" Config.Sys command is
NOT available in DOS 3.xx.
In addition to the three invocation possibilities DOS 5+ users can
"highload" TbDisk into an UMB (upper memory block) if it is
available:
LoadHigh <path>TbDisk.Exe
Within the Config.Sys file TbDisk can also be loaded high:
DeviceHigh=<path>TbDisk.Exe
2.2.1. Invocation in Config.Sys
-> Invoking TbDisk as a device driver does not work in all OEM
versions of DOS. You have to try it, if it doesn't work use the
"Install=" command or load TbDisk from within the Autoexec.Bat.
2.2.2. Invocation in network environment
-> Unlike other anti-virus products, the Thunderbyte anti-virus
utlities can be loaded before the network is started without
losing the protection after the network has been started.
2.2.3. Invocation when using MS-Windows
-> Windows users should invoke TbDisk BEFORE starting Windows.
If you do that there is only one copy of TbDisk in memory, but
every DOS-window will nevertheless have a fully functional
TbDisk in it. TbDisk detects if Windows is starting up, and
will switch itself into multitasking mode if necessary. You can
even disable TbDisk in one window without affecting the
functionality in another window.
If you configured Windows to use fast 32-bit disk access you
might need TbDisk option 'win32' if Windows displays an error
message.
2.3. What is direct disk access?
Programs often access files on a disk. The operating system (DOS)
takes care of all disk access. If a program for instance wants to
Page 5
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
update a file, the program asks DOS to write the data to disk.
There are however also possibilities to write to disk without using
DOS. This is called 'direct disk access'.
Normal programs do not write to disk directly. However, there are
some programs that need to write to disk directly. Programs in this
category are:
- Format utilities. A disk can only be formatted by direct disk
access.
- Disk diagnosis utilities (such as the NORTON disk doctor, DOS
chkdsk, etc.)
- Disk optimizers.
Most viruses perform direct disk access too, and that is why disk
access should be controlled in some way, preferably by TbDisk.
2.4. Detecting direct disk accesses
If TbDisk detects that a program tries to access the disk directly,
a pop-up window will appear with a message, informing you about
this in your own language. You can either choose to continue, or to
abort the disk operation.
If you answer 'NO' to the question 'Cancel disk access?' the
program will continue undisturbed, and TbDisk places a mark in the
Anti-Vir.Dat file about this program. Next time you invoke the same
program, TbDisk will not disturb you again.
There are some programs which normally access the disk directly,
such as disk diagnosis utilities, format utilities, disk
optimizers, etc. How does TbDisk distinguish between these
programs and viruses?
TbDisk uses the Anti-Vir.Dat records generated by TbSetup to keep
track of which files are allowed to access the disk directly. Most
common disk utilities will be marked as such by TbSetup, so you
don't have to worry about these files.
If TbDisk pops up with the message that a program tries to write to
disk directly, you have to consider the purpose of the program
mentioned. Is the program supposed to format or edit disk sectors?
The answer is obviously yes if the program mentioned is a format
utility or a disk optimizer.
However, if the message appears while you are performing a text
processing job or running a database or spreadsheet application,
something is definitely wrong! You had better terminate the program
Page 6
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
and use a virus scanner to check the system.
The same applies when software that operates normally without
accessing the disk directly suddenly changes its behavior
and tries to write to disk directly.
2.5. Command line options
It is possible to specify options on the command line. The upper
four options are always available, the other options are only
available if TbDisk is not already resident in memory.
optionword parameter short explanation
---------- --------- ----- ----------------------------
help ? =display this helpscreen
remove r =remove TbDisk from memory
off d =disable checking
on e =enable checking
wrprot p =make hard disk write protected
nowrprot n =allow writes to hard disk
win32 w =allow Windows 32bit disk access
secure s =deny access without asking
notunnel t =do not detect tunneling
install i =installation test mode
2.5.1. help (?)
If you specify this option TbDisk will show you the brief help as
shown above. Once TbDisk has been loaded the help option will not
show all options anymore.
2.5.2. remove (r)
This option can be used to remove the resident part of TbDisk from
your system's memory. All memory used by TbDisk will be released.
Unfortunately, the removal of a TSR (like TbDisk) is not always
possible. TbDisk checks whether it is safe to remove the resident
part from memory. If it is not safe it just disables TbDisk. A TSR
can not be removed if another TSR has been started after it. If
this happens with TbDisk it will completely disable itself.
2.5.3. off (d)
If you specify this option TbDisk will be disabled, but it will
remain in memory.
2.5.4. on (e)
If you use this option TbDisk will be activated again after you
Page 7
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
disabled it with the 'off' option.
2.5.5. wrprot (p)
You can easily protect diskettes with a simple sticker or flipping
a tab, but that is impossible with hard disks. This of course adds
considerably to the risks involved when, for instance, testing new
software in order to find out what it will do to your hard disk and
how this would affect your valuable data eventually.
Option 'wrprot' can be used to write protect your hard disk.
Whenever a program wishes to write to a protected disk you will
receive a message like:
"Write protect error writing drive C: A)bort, R)etry, I)gnore?"
You may then take appropriate action.
NOTE: A software write protection like this is not for 100%
reliable. Although there are nearly no viruses that are able to
do so, it IS possible to bypass a software write protection!
However, it is a valuable protection against most malicious
software.
2.5.6. nowrprot (n)
You can use this option to undo the option 'wrprot'.
2.5.7. win32 (w)
Windows 386 enhanced mode uses some undocumented DOS calls to
retrieve the original BIOS disk handler if 32 bit disk access has
been enabled. Since TbDisk guards these calls, 32 bit disk access
is no longer possible. If you want to use Windows 32 bit disk
access you have to specify option 'win32' at TbDisk invocation. The
security is slightly reduced in this case.
USE THIS OPTION ONLY IF YOU USE WINDOWS 386 ENHANCED MODE WITH FAST
32-BIT DISK ACCESS ENABLED!
2.5.8. secure (s)
TbDisk normally asks the user to continue or to cancel when a
program tries to perform direct disk access. In some business
environments however this choice should not be made by employees.
By using option 'secure' it is no longer possible to give direct
disk access permission to new or unknown software.
2.5.9. notunnel (t)
TbDisk normally detects tunneling attempts of viruses.
'Tunneling' is a technique used by viruses to determine the
location of the BIOS system code in memory, and to use that address
to communicate with the BIOS directly. This will inactivate all TSR
Page 8
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
programs, including resident anti-virus software. TbDisk is able
to detect 'tunneling' attempts, and informs you about this. Some
other anti-virus products also make use of tunneling techniques to
bypass resident viruses, causing an false alarm. If you make use of
such other anti-virus products, you may use option 'notunnel' to
disable the tunneling-detection.
2.5.10. install (i)
If TbDisk is installed incorrectly, it may cause a lot of false
alarms. To prevent you from cancelling a valid disk write operation
when such a false alarm occurs, you should use option 'install'
when you install TbDisk in the Config.Sys or AutoExec.Bat file.
2.6. Examples:
C:\utils\TbDisk
or:
Device=C:\utils\TbDisk.Exe
Page 9
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
3. CONSIDERATIONS AND RECOMMENDATIONS
3.1. Site installation.
If you have to install TbDisk on a lot of machines in one company,
it would be tedious to invoke a frequently used disk utility on
each machine in order to 'teach' TbDisk which programs are valid
disk utilities and which are not. Fortunately, this is not
necessary. If a resident utility named DISKUTIL.EXE is used
throuhgout the company, use TbSetup to determine the length and CRC
of the program. Now put the name of this program along with the
other information in the file TbSetup.Dat and assign the value
'0020' to it. Example:
DISKUTIL.EXE 01286 E387AB21 0020 ;Our DISK utility
Also consult the TbSetup documentation.
If you now run TbSetup on every machine (you have to do this
anyway) it will recognize this utility and it will set the
disk access permission flag for TbDisk automatically.
3.2. How secure is TbDisk?
No disk guard can prevent all suspicious disk writes if it is
implemented in software. Only a hardware disk guard (as implemented
in the Thunderbyte PC Immnunizer) can detect and prevent all direct
disk writes. TbDisk however succeeds in trapping almost every disk
write, and it is able to prevent software from locating the BIOS
entry address. TbDisk is probably the best software disk guard
available!
3.3. Solving incompatibility problems.
Although TbDisk has been designed to cooperate with other resident
software, other software may not have been, causing system errors or
worse.
The problems most often incurred:
Problem:
When I invoke TbDisk from the DOS command prompt everything
works OK. However, when I install TbDisk from within the
Condig.Sys or AutoExec.Bat file it keeps on warning that
programs write to disk directly.
Solution:
Load TbDisk at the end of your AutoExec.Bat file.
Page 10
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
Problem:
I formatted the hard disk using DOS FORMAT.COM, but TbDisk did
not say anything until the process was almost finished.
Solution:
This is not a problem. A high level format program like DOS
FORMAT.COM does actually not format the disk, but it reads all
tracks to locate possible bad spots, and finally it clears the
FAT and directory structure. Only this last step implies a disk
write, so only this last step is detected by TbDisk.
Problem:
After I have given permission for a program to perform direct
disk access, TbDisk asks the same question next time.
Solution:
1) The 'secure' option of TbDriver is specified. Remove this
option, reboot and try again.
2) The program mentioned does not appear in the Anti-Vir.Dat
file and therefore TbDisk can not permanently store the
permission flag. Use TbSetup to generate the Anti-Vir.Dat
record of this program!
Problem:
If I try to use Windows fast 32 bit disk access, Windows comes
up with an error message.
Solution:
Use option 'win32' on the TbDisk command line.
Problem:
If TbDisk tries to display a message, the text 'message file
<filename> could not be opened' appears.
Solution:
Specify the FULL path and filename of the file that you will
use as message file after the TbDriver invocation. The default
filename is TbDriver.Lng.
Problem:
The system sometimes hangs when you answer 'NO' (do NOT abort
program) to a TbDisk message.
Solution:
Try using StackMan. StackMan is supplied in the TBAV package.
3.4. Reducing the memory requirements.
Most PC users try to maintain as much free DOS memory as possible.
TbDisk is designed to use a very small amount of DOS memory. To
decrease the memory requirements of TbDisk even further do the
Page 11
Thunderbyte disk guard. (C) Copyright 1992 Thunderbyte B.V.
following:
- Load TbDisk from within the Config.Sys file. If loaded as a
device driver TbDisk has no Program Segment Prefix (PSP),
and that will save 256 bytes. On many systems however it is not
possible to install TbDisk from within the Config.Sys file.
- If you invoke TbDisk from within the Autoexec.Bat file do this
before establishing environment variables. DOS maintains a list
of environment variables for every resident program, so keep
this list small while installing TSRs. Once all TSRs have been
installed you can define all environment variables without
affecting the memory requirements of the TSRs.
- If you have DOS 5.0 or higher try to load TbDisk into an upper
memory block using the "loadhigh" or "devicehigh" commands.
- Use one of the processor specific versions of TbDisk. They all
consume less memory than the generic version of TbDisk.
Processor optimized versions are available on any Thunderbyte
support BBS.
Page 12