home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Shareware 1 2 the Maxx
/
sw_1.zip
/
sw_1
/
VIRUS
/
TBAV503.ZIP
/
TBSCAN.DOC
< prev
next >
Wrap
Text File
|
1992-12-29
|
117KB
|
2,821 lines
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
Table of Contents
1. INTRODUCTION...................................... 2
1.1. Purpose of TbScan........................... 2
1.2. A Quick start............................... 2
1.3. Historical overview......................... 2
1.4. Benefits.................................... 3
1.4.1. Speed................................. 3
1.4.2. Reliability........................... 4
1.4.3. Flexibility........................... 5
1.4.4. Smart scanning........................ 6
1.5. Limitations of scanners..................... 7
2. USAGE OF THE PROGRAM.............................. 8
2.1. System requirements......................... 8
2.2. Program invocation.......................... 8
2.3. While scanning.............................. 9
2.4. Detecting viruses........................... 9
2.5. Integrity checking......................... 10
2.6. Heuristic scanning......................... 11
2.6.1. False positives...................... 13
2.6.2. C - File has been changed............ 14
2.6.3. c - No integrity check............... 14
2.6.4. F - Suspicious file access........... 14
2.6.5. R - Suspicious relocator............. 14
2.6.6. A - Suspicious Memory Allocation..... 14
2.6.7. N - Wrong name extension............. 14
2.6.8. S - Search for executables........... 15
2.6.9. ..................................... 15
2.6.10. V - Validated program............... 15
2.6.11. E - Flexible Entry-point............ 15
2.6.12. L - program Load trap............... 16
2.6.13. D - Direct disk access.............. 16
2.6.14. M - Memory resident code............ 16
2.6.15. .................................... 16
2.6.16. T - Invalid timestamp............... 17
2.6.17. J - Suspicious jump construct....... 17
2.6.18. ? - Inconsistent header............. 17
2.6.19. G - Garbage instructions............ 17
2.6.20. U - Undocumented system call........ 17
2.6.21. Y - Invalid bootsector.............. 18
2.6.22. Z - EXE/COM determinator............ 18
2.6.23. O - code Overwrite.................. 18
2.6.24. B - Back to entry................... 18
2.6.25. K - Unusual stack................... 18
2.6.26. p - Packed or compressed file....... 18
2.6.27. w - Windows or OS/2 header.......... 19
2.6.28. h - Hidden or System file........... 19
2.6.29. i - Internal overlay................ 19
2.7. Program validation......................... 19
2.8. Command line options....................... 20
Page i
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
2.8.1. help ................................ 21
2.8.2. pause ............................... 21
2.8.3. mono ................................ 21
2.8.4. quick ............................... 21
2.8.5. allfiles ............................ 21
2.8.6. mutant .............................. 22
2.8.7. heuristic ........................... 22
2.8.8. direct .............................. 22
2.8.9. extract ............................. 23
2.8.10. valid .............................. 23
2.8.11. once ............................... 23
2.8.12. secure ............................. 24
2.8.13. compat ............................. 24
2.8.14. ignofile ........................... 24
2.8.15. noboot ............................. 24
2.8.16. sector ............................. 24
2.8.17. nomem .............................. 24
2.8.18. hma ................................ 24
2.8.19. nohmem ............................. 25
2.8.20. nosub .............................. 25
2.8.21. noavr .............................. 25
2.8.22. delete ............................. 25
2.8.23. rename ............................. 25
2.8.24. move ............................... 25
2.8.25. path ............................... 26
2.8.26. batch .............................. 26
2.8.27. repeat ............................. 26
2.8.28. log ................................ 26
2.8.29. session ............................ 27
2.8.30. loglevel ........................... 27
2.8.31. expertlog .......................... 27
2.8.32. sigfile ............................ 27
2.9. Examples:.................................. 28
2.10. The configuration file.................... 28
2.11. The TbScan.Msg file....................... 29
2.12. Residence of the signature files.......... 30
2.13. Residence of the AVR-modules.............. 30
2.14. Error messages............................ 30
2.15. Exit codes................................ 31
3. FORMAT OF THE DATA FILE.......................... 32
3.1. Format of a signature entry................ 32
3.2. Wildcards.................................. 32
3.3. Limitations................................ 33
3.4. Defining new signatures.................... 34
4. CONSIDERATIONS AND RECOMMENDATIONS............... 36
4.1. What should be scanned?.................... 36
4.2. The internals of TbScan.................... 37
4.2.1. How is that blazing speed achieved?.. 37
4.2.2. The code interpreter................. 38
4.2.3. The algorithms....................... 39
Page ii
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
4.2.3.1. Looking........................ 39
4.2.3.2. Checking....................... 39
4.2.3.3. Tracing........................ 40
4.2.3.4. Scanning....................... 40
4.2.3.5. Browsing....................... 40
4.2.3.6. Skipping....................... 40
4.2.4. Option 'compat'...................... 41
4.3. The Sanity check........................... 41
4.4. How many viruses does it detect?........... 42
4.5. Testing the scanner........................ 42
4.6. Scan scheduling............................ 42
4.7. Extensions to the format of the data file.. 43
4.8. Compressed files........................... 43
Page iii
Page 1
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
1. INTRODUCTION
1.1. Purpose of TbScan
TbScan is a virus scanner: it has been specifically developed to
detect viruses, Trojan Horses and other such threats to your
valuable data.
A virus scanner is a program that is able to detect given virus
signatures in given environments. Most viruses consist of a unique
sequence of instructions, called a signature. Hence through
checking for the appearance of such signatures in a file we can
find out whether or not a program has been infected.
Scanning all your program files for the signatures of all known
viruses helps you to find out quickly whether or not your system
has been infected and, if so, by what virus.
Every PC owner should use a virus scanner frequently. It is the
least he or she should do to avoid damage caused by a virus.
1.2. A Quick start
Although we highly recommend a complete reading of this manual, we
offer you some directions for a quick run of TbScan here:
Type 'TbScan C:\' at the DOS prompt. This will be sufficient for a
standard scan session. It is allowed to specify more drives:
'TbScan C:\ D:\'.
The invocation syntax is:
TBSCAN [@][<path>][<filename>]... [<options>]...
If your system does not allow TbScan to run properly, set the
'compat' option: TBSCAN C:\ compat
For fast online help type 'TbScan ?' or 'TbScan help'. The latter
will provide for a more detailed description of the command line
options.
1.3. Historical overview
Some years ago the PC community was confronted by a new phenomenon:
Computer viruses. In the early days of computer viruses one had to
examine each file separately for a single viral code pattern. It
didn't take long before programmers created small programs that
were able to tell whether or not a specified program had been
infected.
Page 2
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
Enhanced versions of these programs were able to search all files
automatically, still checking for a single viral code. In a short
period of time many such scanners were written, each capable of
detecting a specified virus signature.
As the number of viruses kept on increasing, programmers started to
combine several scan programs into one: the multi-string scanner
was born. These early scanners worked properly, but could not last.
As the amount of viruses was rapidly growing, a scanner was
outdated soon. Simultaneously the number of multi-string scanning
programs also increased, and scanning programs began detecting each
other's internal search patterns (signatures), wrongly informing
the user of a virus infection. Naturally a lot of people got
confused by these false alarms.
A solution to these problems was to separate the search engine from
the signatures it would search for. The separate signature data
files that were the result could be updated and distributed much
faster through text media. Secondly, by separating the search
patterns from the executable file, a scanner would no longer
trigger false alarms.
TbScan uses the signature file VIRSCAN.DAT, originally created for
a program called VIRSCAN.EXE. When VIRSCAN.EXE was developed, the
number of viruses was relatively small. However, when the number of
viruses increased, the Virscan program slowed down considerably as
a result of signature additions.
At that time we developed the Thunderbyte add-on card, a universal
anti-virus device. Since the Thunderbyte card recognizes virus
activities rather than signatures, it will establish whether or not
a system has been infected, but it will not identify the virus
itself. To provide for such identification we decided to supply a
virus scanner along with our anti-virus hardware product, and we
developed TbScan.
We introduced many very sophisticated ideas in the first version of
TbScan, such as: the use of wildcards in the signature, scanning
the memory of your PC, scanning only specific parts of a file
rather than the complete file, etc. Today, many competitive
products have adopted some of these new ideas.
1.4. Benefits
By now many different virus scanners have been developed. However,
TbScan has a number of important and unique advantages over other
scanners. These are:
1.4.1. Speed
Most virus scanners do not operate very fast, which means that
Page 3
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
scanning your PC for viruses can be a tedious, time-consuming
affair. Not many people will enjoy staring at their display for
a quarter of an hour or more while their system is being
scanned. Consequently many people do not run their virus
scanners as often as they should. Under those circumstances
even the best virus scanner will become obsolete, simply
because it is not being used properly.
Hence it was our goal to create a scanner fast enough to invite
users to invoke it from within their AUTOEXEC.BAT file every
morning.
The speed depends on many system characteristics, so we will
not tell you how many times faster TbScan performs, but you
will easily find out yourself. The speed of our program has
been increased with almost every new release, and the current
version is faster than any other scanner known to us. Try it
yourself!
TbScan is designed to scan for a large amount of virus
signatures. The current version of TbScan is able to scan for
over 2500 signatures (without additional memory requirements).
Because of its design, TbScan will not slow down if the number
of signatures increases. It doesn't matter whether you scan an
item for 10 or 1000 signatures.
TbScan has a special mode to check a stack of diskettes at a
high speed. You don't have to signal TbScan through keyboard
input that a diskette has been changed: The program determines
this completely automatically.
1.4.2. Reliability
TbScan checks itself on invocation. If it detects that it has
been infected it aborts with an error. This minimizes the risk
that the TbScan program itself will transfer a virus and so
infect your system.
TbScan can bypass viruses that are already active in memory.
This is possible through a built-in interrupt debugger!
TbScan can also detect yet unknown viruses, because the
built-in disassembler is able to detect suspicious instruction
sequences and abnormal program lay-outs. This feature is
called 'heuristic scanning' and it is partially enabled by
default. Heuristic scanning is performed on files and
bootsectors, so for both items TbScan is able to find new and
yet unknown viruses.
A lot of viruses are memory resident, which means that they
lodge themselves in the memory of your computer. There they can
comfortably affect all active programs. There are even 'smart'
Page 4
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
viruses that temporarily 'disinfect' a program file, as soon as
they notice that attempts are made to read the program file as
is the case during a scanning operation. Most virus scanners
will then find that this program file has not been infected
(which is true at the time of scanning !). But after the
scanner has completed its scan the virus becomes operant, again
ridiculing the scanner report that no virus has been found.
TbScan offers a unique solution to this problem: it contains an
automatic debugger that works its way through the chain of
interrupts 'single stepping' until it reaches the DOS program
code. It saves the address which is then found and uses it for
communication with DOS. In this way most viruses will not
notice the operation of TbScan.
TbScan is able to scan Upper Memory, Video Memory and the HMA.
Many of the other scanners (still) don't recognize this memory.
TbScan scans the video memory of your PC. Most anti-virus
products are not aware of the fact that it is possible to
install TSR programs (including viruses) in unused parts of
your video memory. TbScan scans all memory, including the video
memory, just to make sure.
TbScan is able to search a complete disk at sector level. This
procedure will not allow any virus to remain undetected. Even
viruses that have already been eliminated can be detected this
way.
TbScan is able to detect mutants of a virus. A mutant is a
virus that has been modified slightly and therefore does not
match the original signature anymore. TbScan is able to detect
such a mutant, even if no wildcards are used in the virus
signature.
TbScan is able to detect droppers of bootsector viruses. The
dropper program itself has not been infected, but it is there
to install the bootsector virus in your system.
TbScan also checks for file changes if you have used TbSetup to
generate the Anti-Vir.Dat files. When a virus infects a file,
the file changes and therefore the checksum does not match
anymore. TbScan informs you about such an unexpected file
change.
1.4.3. Flexibility
TbScan offers the flexibility of a data file that can be edited
quickly.
As new viruses spread quickly there is often no time available
to continually adapt your own virus checker in order to make it
Page 5
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
capable of recognizing each new virus as it appears. That is
why TbScan uses a separate data file listing the signatures of
all known viruses. This file can be adapted quickly, possibly
by yourself. TbScan supports, among others, the format which is
used in the file VIRSCAN.DAT. This file is regularly updated
and can be obtained through a lot of data banks.
TbScan supports wildcards in the signature. Many viruses are
adapted and converted versions of existing viruses. Such a
modified virus - a mutant - is similar to the original virus,
but that part of the virus program which contains the signature
has often been changed. Most scanners will fail to recognize
the mutant unless the new signature has been incorporated into
the scanning program. TbScan has been designed to approach this
problem differently: by replacing the modified parts of the
signature by wildcards TbScan can still recognize mutant virus
activities. Hence all mutant versions of, for instance, the
Jerusalem/PLO virus can be discovered by TbScan through just
one signature instead of the, say, 25 that several other virus
scanners require. This also explains why TbScan uses 'only' 500
signatures but still detects all 1200 viruses known.
There are viruses that are so completely encrypted that it is
no longer possible to define any signature for them, even when
using wildcards. The Dark Avenger Mutation Engine viruses are
such viruses. The only way to detect these viruses is by making
use of algorithmic routines. TbScan is the first scanner that
implemented the use of AVR (Algorithmic Virus Recognition)
modules, which contain the routines to detect such viruses. An
AVR-module is extremely flexible, it can perform almost any
operation necessary to detect an encrypted virus.
TbScan offers registered users the possibility to define their
own signatures through the 'extract' option. You don't have to
be an assembler programmer anymore, if a signature has to be
defined in an emergency situation!
1.4.4. Smart scanning
TbScan is not just a scanner, it is a disassembling scanner.
This means that TbScan not only scans the file but also
interprets the contents and adjusts the scanning algorithm to
gain the highest reliability and speed. By reliability we do
not only mean a low 'false negative' ratio, but a low 'false
positive' ratio as well. No one needs a scanner that yells
'virus!' all the time. A good scanner should only yell 'virus!'
if there really IS a virus to be found in a file.
Apart from the capability of adjusting the scanning algorithm,
TbScan also displays additional information about the file
itself. It can detect instruction sequences that are intended
to cause direct disk writes, to make program code resident, to
Page 6
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
decrypt code, etc. TbScan even flags files as being infected by
an unknown virus if the disassembly shows that the file must
contain a virus even though a matching signature cannot be
found. All this information is displayed while a scan is being
performed!
1.5. Limitations of scanners
Although TbScan is a very sophisticated scanner, it shares some of
the limitations that all other scanners have:
+ It cannot prevent infection.
Virus scanners can only tell you whether or not your system has
been infected and if so, whether any damage has already been
done. By that time only a non-infected backup or a recovery pro-
gram such as TbClean will properly counter a virus infection.
+ It cannot execute itself.
You will have to be active in taking measures to protect your
system from virus infection. You should boot from a clean and
write-protected diskette and then execute the scanner at least
once every week, since some viruses can perfectly hide
themselves once resident in memory. Unfortunately it is an
illusion to think that employees will perform this task
correctly at all times. For company use we recommend additional
protection, in the shape of a permanently active immunizer such
as the Thunderbyte add-on card.
Page 7
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
2. USAGE OF THE PROGRAM
2.1. System requirements
TbScan runs perfectly on standard machines, in line with our
philosophy that there should be a limit to limitations.
+ TbScan requires 224 Kb of free memory. If you decide to use a
log file TbScan will need an additional 16 Kb of memory for the
log file buffer. TbScan also allocates memory to keep all AVR
modules in memory. If there is still memory left, TbScan will
use it to set up cache buffers in order to increase the
scanning speed. Note that the memory requirements are
independent of the number of signatures. The current memory
requirements suffice to manage at least 2500 signatures.
+ TbScan can be executed under DOS version 3.00 (and all later
versions). However, Dos 3.3 or higher is recommended, since
TbScan has been optimized and designed primarily for use with
these DOS versions.
+ The sum total of all AVR-modules should not exceed 64Kb.
2.2. Program invocation
TbScan is easy to use. The syntax is as follows:
TBSCAN [@][<path>][<filename>]... [<options>]...
Drive and path tell TbScan where it should perform its scanning
operation. To search disks C: and D: you should enter:
TBSCAN C:\ D:\
When no filename has been specified but a drive and/or path
instead, the specified path will be used as top-level path. All
its subdirectories will be processed too.
When a filename has been specified only the specified path will be
searched. Subdirectories will not be processed.
Wildcards in the filename are allowed. You may even specify '*.*'
which will result in all files being processed.
You can also tell TbScan to use a list file. A list file is a file
that contains a list of paths/filenames to be scanned. Have the
filename preceded by the character '@' on the TbScan command line:
TBSCAN @TBSCAN.LST
Page 8
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
2.3. While scanning
TbScan divides the screen into three windows: an information
window, a scanning window and a status window. The upper window is
the information window and it initially displays the comments found
in the data file.
If TbScan detects infected files the names of the file and the
virus will be displayed in the upper window. The information will
stack up and scroll off the screen if it doesn't fit anymore.
The lower left window displays the names of the files being
processed, the algorithm in use, info and heuristic flags,
and finally an OK statement or the name of the virus
detected.
Example:
TEST.EXE <Scanning...> FR OK
| | | |
| | | result of scan
| | heuristic flags
| algorithm being used to process file
name of file in process
You will see comments following each file name:
'Looking', 'Checking', 'Tracing', 'Browsing', 'Scanning' or
'Skipping'. These refer to the various algorithms being used to
scan files.
Other comments that TbScan can display here are the heuristic
flags. Consult the 'Heuristic flags' chapter (3.5) for more
information on these warning characters.
The lower right window is the status window. It displays the number
of files and directories encountered, the amount of viruses found,
etc.
The cache hit indicator displays the percentage of FAT or directory
information that has been retrieved from the cache buffers, or in
other words, the percentage of disk access saved. Note that the
cache hit only applies to the FAT and directory sectors. The
contents of files will never be cached and will not be reflected in
the cache hit indicator.
The process can be aborted by pressing Ctrl-Break.
2.4. Detecting viruses
As soon as an infected program is found, the name of the virus will
be displayed. If you did not specify one of the options 'batch',
'rename', 'delete' or 'move', TbScan will prompt you to delete,
Page 9
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
rename or move the infected file, or to continue without action. If
you choose to rename the file, the first character of the extension
will be replaced by the character 'V'. This prevents the file from
being executed accidentally before it has been investigated more
thoroughly. If you choose to move the file, the file will be moved
to the TbScan directory or to the directory specified by option
'path'.
In some situations TbScan will offer you an additional menu option:
V)alidate program. For more information about this menu option
consult option 'Program validation'.
When TbScan detects an infected file it will display a message like:
Infected by [name of virus]
It is also possible that TbScan detects a bootsector virus dropper.
A dropper is a program that has not been infected itself, but which
does contain a bootsector virus and is able to install it in your
bootsector. If TbScan detects a bootsector virus in a file it
displays the message:
Dropper of [name of virus]
It is also possible that TbScan encounters a file that seems to be
infected by a virus, although a signature could not be found. In
this case TbScan displays the prefix 'Probably' before the message.
If you have specified option 'heuristic' or 'mutant' or both, it is
likely that TbScan will find some files which looks like a virus,
and in this case TbScan uses the prefix 'Might be' to inform you
about it. So, if TbScan displays
Might be infected by [name of virus]
it does not mean that the file is infected, but just that the file
might be infected by a virus. There are a lot of files that look
like a virus but they aren't.
TbScan needs access to its data file to be able to tell you the
name of a virus. If it cannot access the data file it displays the
message [Cannot read datafile] instead of a virus name.
2.5. Integrity checking
TbScan will also perform integrity checking while scanning. You
have to use TbSetup to generate the Anti-Vir.Dat files. Once these
files exist on your system TbScan will check that every file being
scanned matches the information maintained in the Anti-Vir.Dat
files. If a virus infects a file, the maintained information will
not match anymore with the now changed file, and TbScan will inform
you about this. There are no command line options to enable this
Page 10
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
feature: TbScan will perform integrity checking automatically
if it detects the Anti-Vir.Dat files. Note that TbScan only reports
file changes that could indicate a virus. Internal configuration
areas of program files may also change, but TbScan does normally
not report this. However, if a file gets infected with any virus -
known or unknown - the vital information will change and TbScan
will indeed report it to you!
It is however possible that the checked file changes itself or
changes frequently due to another cause. In this case you might
want to exclude the program from integrity checking to avoid future
false alarms. TbScan will offer you an additional menu option:
'V)alidate program'. For more information about this menu option
consult option 'Program validation'.
2.6. Heuristic scanning
TbScan is not just a signature scanner. It also disassembles the
file being processed. This serves three purposes:
1) By disassembling the file the scanner can restrict itself to the
area of the file where the virus might reside, reducing false
alarms and speeding up the process.
2) It makes it possible to use the algorithmic detection method on
encrypted viruses whose signatures would otherwise remain
invisible to the scanner.
3) And it makes it possible to detect suspicious instruction
sequences.
The detection of suspicious instruction sequences is named
'heuristic scanning'. It is a very powerful feature that enables
you to detect new or modified viruses and to verify the results of
the signature scan. You no longer have to rely on the vendor of the
scanner having the same virus as you might have. In normal cases a
scanner can only find a virus if the developer of the scanner has
had a sample of that virus, to be able to make a suitable
signature. With heuristic scanning a signature is no longer
required, so the scanner can detect viruses that are not known to
the developer of the scanner. You should not underestimate the
importance of heuristic scanning, as every month there appear at
least 50 new viruses. It is very unlikely that the developer of a
scanner is the first one that gets those new viruses...
How does heuristic scanning actually work? Every program contains
instructions for the processor of the PC. By looking into the file
contents and by interpreting the instructions TbScan is able to
detect the purpose of these instructions. If the purpose seems to
be to format a disk, or to infect a file, TbScan issues a
warning. There are a lot of instruction sequences which are very
common for viruses, but very unlikely for normal programs. Every
suspicious instruction sequence is assigned to a character: a
Page 11
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
heuristic flag. Every heuristic flag has a score. If the total
score exceeds a predefined limit, TbScan assumes the file contains
a virus.
There are actually two predefined limits: the first one is quite
sensitive and can be reached by some normal innocent programs. If
this limit is reached, TbScan highlights the heuristic flags that
are displayed on the screen and increases the 'suspected items'
counter, but TbScan does not indicate there is a virus, unless you
have specified option 'heuristic'. If you have specified option
'heuristic', TbScan tells you that the file 'Might be infected by
an unknown virus'. The second heuristic-limit will be triggered by
a lot of viruses, but not by normal programs. If this limit is
reached TbScan tells you that the file is 'Probably infected by an
unknown virus.'
Heuristic level 1 Heuristic level 2
-------------------------------- ----------------------------
Always enabled Only with option 'heuristic'
Detects 50% of the unknown viruses Detects 90% of the viruses
Almost never causes false alarms Causes a few false alarms
Displays 'Probably infected' Displays 'Might be infected'
TEST.EXE <scanning...> OK (no flags)
TEST.EXE <scanning...> R OK (nothing serious)
TEST.EXE <scanning...> FRM
might be infected by an unknown virus (reached level 2)
TEST.EXE <scanning...> FRALM#
probably infected by an unknown virus (reached level 1)
Note that unlike other scanners, TbScan has heuristic scanning
always enabled. Whether TbScan decides to inform the user of
a possible virus depends on the heuristic score, unless option
'heuristic' has been specified.
Heuristic flags consist of single characters that are printed behind
the name of the file that has been processed. There are two kinds
of flags: the informative ones are printed in lower-case
characters, and the more serious flags are printed in upper-case
characters. The lower-case flags are indicative of special
characteristics of the file being processed, whereas the upper-case
warnings may indicate a virus. If the 'loglevel' is 3 or above, the
important warnings will not only appear as a warning character, but
there will also be a description printed in the log file.
How should you treat the flags? The less important lower-case
flags can be considered to be for your information only. They
provide you with file information you might find interesting. The
more serious warning flags printed in upper-case MIGHT point
Page 12
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
towards a virus. It is quite normal that you have some files in
your system which trigger an upper-case flag.
Anyway, if TbScan does not highlight a combination of warnings you
should not pay too much attention to these flags. For more than 90%
of the viruses TbScan will highlight the flags (or even indicates
the file as infected if option 'heuristic' is specified), so it is
unlikely that a file which only has some flags set really contains
a virus.
Note!
TbScan performs heuristic analysis only nearby the entry-point of a
file, so it is normal that TbScan does not detect that some disk
utilities write to disk directly, and it is normal that TbScan does
not detect that some programs are TSR programs. This is just the
result of one approach to minimize false alarms. In case of a
virus, the offending instructions are always nearby the entry-point
(except when the virus is over 10Kb in size) so TbScan will detect
the suspicious facts in these situations anyway.
2.6.1. False positives.
Important!
False alarms are part of the nature of heuristic scanning. In
default mode it is very unlikely that TbScan issues a false alarm.
However, if you have specified option 'heuristic' some false alarms
might occur. How to deal with these false alarms? If TbScan thinks
it has found a virus it tells you the reason for this suspicion. In
most cases you will be able to evaluate these reasons when you
consider the purpose of the suspected file.
Note that viruses infect other programs. It is highly unlikely that
you will find only a few infected files on a hard disk used
frequently. You should ignore a the result of a heuristic scan if
only a few programs on your hard disk trigger it. But, if your
system behaves in a 'strange' manner and many programs cause TbScan
to issue an alarm with the same serious flags, your system could
very well be infected by a (yet unknown) virus.
If TbScan finds a file to be very suspicious and pops up with the
virus alert window, you can avoid future false alarms by pressing
'V' (Validate program). Note that this only works if there is an
Anti-Vir.Dat record of the file available. Once a program is
validated it will no longer be subject to heuristic analyzis,
unless the program changes and does not match the Anti-Vir.Dat
record anymore. This will be the case if such a file gets infected
afterwards, so TbScan will still report infections on these files.
Note that a validated program is still subject to the conventional
signature scanning.
Page 13
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
2.6.2. C - File has been changed.
This warning can only appear if you used TbSetup to generate the
Anti-Vir.Dat files. If this warning appears this means that the
file has been changed. If you did not upgrade the software it is
very likely that a virus infected the file! Note that TbScan does
not display this warning if only some internal configuration area
of the file changes. This warning means that code at the program
entry point, the entry-point itself and/or the file size have been
changed.
2.6.3. c - No integrity check.
This warning indicates that no checksum/recovery information has
been found about the indicated file. It is highly recommended to
use TbSetup in this case to store information of the mentioned
file. This info can later be used for integrity checking and to
recover from virus infections.
2.6.4. F - Suspicious file access.
TbScan has found instruction sequences common to infection schemes
used by viruses. This flag will appear with those programs that
are able to create or modify existing files.
2.6.5. R - Suspicious relocator.
Flag 'R' refers to a suspicious relocator. A relocator is a
sequence of instructions that changes the proportion of CS:IP. It
is often used by viruses, especially COM type infectors. Tests on a
large collection of viruses show that TbScan issues this flag for
about 65% of all viruses. Those viruses have to relocate the CS:IP
proportion because they have been compiled for a specific location
in the executable file; a virus that infects another program can
hardly ever use its original location in the file as it is appended
to this file. Sound programs 'know' their location in the
executable file, so they don't have to relocate themselves. On
systems that operate normally only a small percentage of the
programs should therefore cause this flag to be displayed.
2.6.6. A - Suspicious Memory Allocation.
The program uses a non-standard way to search for, and/or allocate
memory. A lot of viruses try to hide themselves in memory so they use
a non-standard way to allocate this memory. Some programs
(high-loaders or diagnostic software) also use non-standard ways
to search or allocate memory.
2.6.7. N - Wrong name extension.
Name conflict. The program carries the extension .EXE but appears
to be an ordinary .COM file, or it has the extension .COM but the
Page 14
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
internal layout of an .EXE file. TbScan does not take any risk in
this situation, but scans the file for both EXE and COM type
signatures. A wrong name extension might in some cases indicate a
virus, but in most cases it doesn't.
2.6.8. S - Search for executables.
The program searches for *.COM or *.EXE files. This by itself does
not indicate a virus, but it is an ingredient of most viruses anyway
(they have to search for suitable files to spread themselves). If
accompanied by other flags, TbScan will assume the file is infected
by a virus.
2.6.9. # - Decryptor code found.
The file possibly contains a self-decryption routine. Some
copy-protected software is encrypted so this warning may appear for
some of your files. But if this warning appears in combination
with, for example, the 'T' warning, there could be a virus involved
and TbScan assumes the file is contaminated! Many viruses encrypt
themselves and cause this warning to be displayed.
2.6.10. V - Validated program
The program has been validated to avoid false alarms.
- The design of this program would normally cause a false alarm
by the heuristic scan mode of TbScan.
or:
- This program might change frequently, and the file is excluded
from integrity checking.
These exclusions are stored in the Anti-Vir.Dat file by either
TbSetup (automatically) or by TbScan (manually).
2.6.11. E - Flexible Entry-point
The program starts with a routine that determines the location of
itself within the program file. This is rather suspicious because
sound programs have a fixed entry-point so they do not have to
determine this location. For viruses however this is quite common:
about 50% of the available viruses cause this flag to be displayed.
The DOS FORMAT.COM program is an instance where this flag will be
displayed by TbScan. This cannot be avoided because Microsoft did
some strange things to this program. It appears that the file was
originally an .EXE file which has been converted into a .COM file
by adding a shell-like structure to it. (What is actually the
difference between infecting a file and converting it this way?)
Anyway, you should ignore this warning as to the DOS FORMAT
Page 15
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
program.
2.6.12. L - program Load trap.
The program might trap the execution of other software. If the
file also causes flag M (memory resident code) to be displayed, it
is very likely that the file is a resident program that determines
when another program is executed. A lot of viruses trap the program
load and use it to infect the program. Some anti-virus utilities
also trap the program load.
2.6.13. D - Direct disk access.
This flag is displayed if the program being processed has
instructions near the entry-point to write to a disk directly. It
is quite normal that some disk-related utilities cause this flag
to be displayed. As usual, if many of your files (which have no
business writing directly to the disk) cause this flag to be
displayed, your system might be infected by an unknown virus.
Note that a program that accesses the disk directly does not always
have to be marked by the 'D' flag. Only when the direct disk
instructions are near the program entry point it will be reported
by TbScan. If a virus is involved the harmful instructions are
always near the entry point and that is the place where TbScan
looks for them.
2.6.14. M - Memory resident code.
TbScan has found instruction sequences which could cause the
program to hook into important interrupts. A lot of TSR (Terminate
and Stay Resident) programs will trigger this flag, because
hooking into interrupts is part of their usual behavior. However,
if a lot of non-TSR programs cause this warning flag to appear, you
should be suspicious. It is then likely that your files have been
infected by a virus that remains resident in memory.
Note that this warning does not appear with all true TSR programs.
Nor can TSR detection in non-TSR programs always be relied upon.
2.6.15. ! - Invalid program.
Invalid opcode (non-8088 instructions) or out-of-range branche.
The program has either an entry point that has been located outside
the body of the file, or reveals a chain of 'jumps' that can be
traced to a location outside the program file.
Another possibility is that the program contains invalid processor
instructions.
The program being checked is probably damaged, and cannot be
Page 16
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
executed in most cases. Anyway, TbScan does not take any risk and
uses the 'scan' or 'browse' method to scan the file.
2.6.16. T - Invalid timestamp.
The timestamp of the program is invalid: e.g. the number of seconds
in the timestamp is illegal, or the date is illegal or later than
the year 2000. This is suspicious because many viruses set the
timestamp to an illegal value (like 62 seconds) to mark that they
already infected the file, preventing themselves from infecting a
file for a second time round. It is possible that the program being
checked is contaminated with a virus that is still unknown,
especially if many files on your system have an invalid timestamp.
If only a very few programs have an invalid timestamp you'd better
correct it and scan frequently to check that the timestamp of the
files remain valid.
2.6.17. J - Suspicious jump construct.
The program did not start at the program entry point. The code has
jumped at least two times before reaching the final start-up code,
or the program jumped using an indirect operand. Sound programs
should not display this kind of strange behavior. If many files
cause this warning to be displayed, you should investigate your
system thoroughly.
2.6.18. ? - Inconsistent header.
The program being processed has an exe-header that does not reflect
the actual program lay-out. The DOS SORT.EXE program will cause
this warning to be displayed, because the actual size of the
program file is less than reported in the 'size-of-load module'
field in the exe-header! Many viruses do not update the exe-header
of an EXE file correctly after they have infected the file, so if
this warning appears a lot it seems you have a problem. You should
ignore this warning for the DOS SORT.EXE program. (Hopefully
MicroSoft will correct the problem before the next release of DOS).
2.6.19. G - Garbage instructions.
The program contains code that seems to have no purpose other than
encryption or avoiding recognition by virus scanners. This flag is
very important, in fact it is the only flag that will cause TbScan
to report an infection without the presence of any other flags. In
most cases there will not be any other flags since the file is
encrypted and the instructions are hidden from the scanner. In a
few cases this flag will appear for 'normal' files. These files
however are badly designed and that is the reason the 'garbage'
flag appears.
2.6.20. U - Undocumented system call.
Page 17
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
The program uses unknown DOS calls or interrupts. These unknown
calls can be issued to invoke undocumented DOS features, or to
communicate with an unknown driver in memory. Since a lot of
viruses use undocumented DOS features, or communicate with memory
resident parts of a previously loaded instance of the virus, it is
suspicious if a program performs unknown or undocumented
communications. However, it does not necessarily indicate a virus
because some 'tricky' programs use undocumented features too.
2.6.21. Y - Invalid bootsector.
The bootsector is not completely according to the IBM defined
bootsector format. It is likely that the bootsector contains a
virus or has been corrupted.
2.6.22. Z - EXE/COM determinator.
The program seems to check whether a file is a COM or EXE type
program. Infecting a COM file is a process that is not similar to
infecting an EXE file, so viruses that are able to infect both
program types should be able to distinguish between them.
There are of course also innocent programs that need to find out
whether a file is a COM or EXE file. Executable file compressors,
EXE2COM converters, debuggers, and high-loaders are examples of
programs that may contain a routine to distinguish between EXE and
COM files.
2.6.23. O - code Overwrite.
This flag will be displayed if TbScan detects that the program
overwrites some of its own instructions. However, it does not seem
to have a complete (de)cryptor routine.
2.6.24. B - Back to entry.
The program seems to execute some code, and after that it jumps
back to the entry-point of the program. Normally this would result
in an endless loop, except when the program has also modified some
of its instructions. This is quite common behavior for computer
viruses. In combination with any other flag TbScan will report a
virus.
2.6.25. K - Unusual stack.
The EXE file being processed has an odd (instead of even) stack
offset or a suspicious stack segment. Many viruses are quite buggy
by setting up an illegal stack value.
2.6.26. p - Packed or compressed file.
The program has been packed or compressed. There are some utilities
Page 18
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
that are able to compress a program file, like EXEPACK or PKLITE.
If the file was infected after the file had been compressed, TbScan
will be able to detect the virus. However, if the file had already
been infected before it was compressed, the virus has also been
compressed in the process, and a virus scanner might not be able to
recognize the virus anymore.
Fortunately, this does not happen a lot, but you should beware! A
new program might look clean, but can turn out to be the carrier of
a compressed virus. Other files in your system will then be
infected too, and it is these infections that will be clearly
visible to virus scanners.
2.6.27. w - Windows or OS/2 header.
The program can be or is intended to be used in a Windows (or OS/2)
environment. As yet TbScan does not offer a specialized scanning
method for these files. Of course that will change as soon as
Windows- or OS/2-specific viruses start occurring.
2.6.28. h - Hidden or System file.
The file has the 'Hidden' or the 'System' file attribute set. This
means that the file is not visible in a DOS directory display but
TbScan will scan it anyway. If you don't know the origin and/or
purpose of this file, you might be dealing with a 'Trojan Horse' or
a 'joke' virus program. Copy such a file onto a diskette; then
remove it from it's program environment and check if the program
concerned is missing the file. If a program does not miss it, you
will have freed some disk space, and maybe you have saved your
system from future disaster in the process.
2.6.29. i - Internal overlay.
The program being processed has additional data or code behind the
load-module as specified in the exe-header of the file. The program
might have internal overlay(s), or configuration or debug
information appended behind the load-module of the EXE file.
2.7. Program validation.
This chapter only applies if you use TbSetup to generate the
Anti-Vir.Dat records. Without these records program validation is
not an option.
TbScan will perform as intended on most programs. However, there
are some programs that require special attention, in order to avoid
false alarms. Most of these programs are recognized automatically
by the TbSetup program. However, it is certainly possible that you
have a few files on your system that meet the following criteria:
Page 19
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
1) Programs that trigger the heuristic alarm of TbScan.
2) Programs that change frequently.
If an 'infection' has been found with the heuristic analyzis or
integrity checking only and if there is a Anti-Vir.Dat record
available, TbScan offers an additional option in its virus-alert
window: 'V)alidate program'. If you are convinced that the
indicated program does NOT contain a virus, you can press 'V' to
set a flag in the program's record. This makes it possible to
avoid future false alarms.
There are two validation modes: if the TbScan virus alarm is due
to a file change, the validation applies to future file changes
only, if the virus alarm is due to heuristic analysis, the
validation only applies to heuristic results. When the file is
exluded from heuristic analysis the file will still be checksummed,
if the file is excluded from integrity checking TbScan will still
perform heuristic analysis on that file.
Note: if you replaced a file (software upgrade) and you did not use
TbSetup, TbScan will pop-up its virus alert window to inform you
about the file change. Do NOT select the validation option in this
case, because this would exclude the file for future integrity
checking. You had better abort TbScan and run TbSetup on the
changed file(s).
2.8. Command line options
It is possible to specify options on the command line. Tbscan
recognizes option short-keys and option words. The words are easier
to memorize, and they will be used in this manual for convenience.
optionword parameter short explanation
---------- --------- ----- -------------------------------------
help he =help (-? = short help)
pause pa =enable 'Pause' prompt
mono mo =force monochrome
quick qs =quick scan (uses Anti-Vir.Dat)
allfiles af =scan non-executable files too
mutant mu =enable fuzzy search
heuristic hr =enable heuristic alerts
direct dd =direct calls into DOS/BIOS
extract ex =extract signature (registered only)
valid va =force signature file authorization
once oo =only once a day
secure se =user abort now allowed (reg. only)
compat co =maximum-compatibility mode
ignofile in =ignore no-file-error
noboot nb =skip bootsector check
sector ss =scan all disk sectors
Page 20
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
nomem nm =skip memory check
hma hm =force HMA scan
nohmem nh =skip UMB/HMA scan
nosub ns =skip sub-directories
noavr na =do not use AVR-modules
repeat rp =scan multiple diskettes
batch ba =batch mode. No user input
delete de =delete infected files
move mv =move infected files
expertlog el =no heuristic descriptions in log
log [=<filename>] lo =append log file
session [=<filename>] sl =create session log file
loglevel =<0..4> ll =set log level
path =<move-path> mp =set move-path
rename [=<ext-mask>] rn =rename infected files
sigfile [=<filename>] sf =signature file to be used
2.8.1. help (he)
If you specify this option TbScan displays the contents of the
TBSCAN.HLP file if it is available in the home directory of TbScan.
If you specify the '?' option you will get the summarized help info
as listed above.
2.8.2. pause (pa)
When you enter option 'pause' TbScan will stop after it has checked
the contents of one window. This gives you the possibility to
examine the results without having to consult a log file
afterwards.
2.8.3. mono (mo)
This option forces TbScan to refrain from using colors in the
screen output. This might enhance the screen output on some LCD
screens or color-emulating monochrome systems.
2.8.4. quick (qs)
If you specify this option TbScan will use the Anti-Vir.Dat files
to check for file changes since the last time only. If a file has
been changed (CRC change) or is not yet listed in Anti-Vir.Dat it
will be scanned.
2.8.5. allfiles (af)
This option causes TbScan to scan non-executable files (files
without extension COM, EXE, SYS or BIN) too. If TbScan finds out
that such a file does not contain anything that can be executed by
the processor the file will be 'skipped'. Otherwise the file will
be searched for AVR, COM, EXE and SYS signatures. TbScan however
will not perform heuristic analysis on these files.
Page 21
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
Since viruses do not infect non-executable files it is not
necessary to scan non-executable files too. We even recommend not
to use this option unless you have a good reason to scan all files.
Once again: a virus needs to be executed to perform what it is
programmed to do, and since non-executable files will not be
executed a virus in such a file can not do anything. For this
reason viruses do not even try to infect such files.
2.8.6. mutant (mu)
TbScan is able to detect mutants of viruses while performing a
regular (default) scan, since many of its signature search keys
contain wildcards. However, if you use the 'mutant' option TbScan
does not restrict itself to the wildcard specification, but allows
up to two extra changes anywhere in the signature. Needless to say,
if you use this option false alarms may occur. Therefore this
option is not recommended to be used in a regular scan session.
However, you should use this option if you suspect that your system
has been infected even though TbScan has not detected a virus
during its regular scan. If you scan again, specifying the 'mutant'
option TbScan could then report many files to be 'possibly
infected' by one particular virus. This would point to an infection
by a yet unknown variant of this virus.
If you are faced with a situation like this, we recommend you to
have one such 'possibly infected' file examined by a virus expert
before embarking on a clean-up operation.
2.8.7. heuristic (hr)
TbScan always performs a heuristic scan on the files being
processed. However, only if a file is very probably infected with a
virus TbScan will report the file as being infected. If you use
option 'heuristic' TbScan is somewhat more sensitive. In this mode
90% of the new, unknown, viruses will be detected without any
signature, but some false alarms may occur. Consult also chapter
2.5 ('Heuristic scanning').
2.8.8. direct (dd)
TbScan communicates with DOS through interrupt 21h and with the
disk BIOS via interrupt 13h. To prevent this from being
'monitored' by viruses, option 'direct' can be entered on the
command line. TbScan will use its built-in debugger to trace
through the chain of interrupts until it has reached the DOS and
BIOS entry point. These addresses are shown on the display and from
then on they will be used for the communication with DOS and the
BIOS. Resident programs, such as viruses, are then excluded from
taking part in the virus scan process.
Please note that your regular resident programs will not be aware
of TbScan's file access either. That is why we do not recommend
Page 22
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
the use of this option in a multi-tasking or network environment.
Also note that many protection software packages will be fooled by
TbScan when it uses the 'direct' option. Don't be surprised when
TbScan scans files you don't actually have any access to...
When you use this option do not pop up resident programs while
TbScan is active! This is because resident programs are not aware
of the fact that a program performs file access in the foreground
and a system crash may be the result.
When you have installed the Thunderbyte card in your PC, or if you
are using TbDriver/TbDisk, TbScan will not bypass these anti virus
products. This is necessary to avoid alarms. Viruses invoked AFTER
the anti virus utilities will still be bypassed by TbScan.
2.8.9. extract (ex)
This option is available to registered users only. See the chapter
'Defining a Signature' (4.4.) on how to use the option 'extract'.
2.8.10. valid (va)
As a standard procedure TbScan checks the signature file for
modifications. If you have changed the contents of that file,
TbScan will issue a warning to that effect. If you don't want this
warning to be displayed, use the 'valid' option.
2.8.11. once (oo)
If you specify this option TbScan will 'remember' after its scan
that is has been executed that day, and that it should not be run
again the same day with this particular option set. This option is
very useful if you incorporate it in your AUTOEXEC.BAT file in
combination with a list file:
TbScan @Everyday.Lst once rename
TbScan will now scan the list of files and/or paths specified in
the file EVERYDAY.LST during the first boot-up of the day. If the
systems boots more often that day, TbScan will then return to DOS
immediately. This option does not interfere with the regular use
of TbScan. If you invoke TbScan without the 'once' option it will
always run, regardless of a previous run with the 'once' option set.
Note that TbScan 'once' will be executed regardless of regular
TbScan sessions earlier that day.
Also note that if TbScan cannot write to TBSCAN.EXE because it has
been flagged 'read-only' or is located on a write-protected
diskette, the 'once' option will fail and the scanner will run
without it.
Page 23
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
2.8.12. secure (se)
This option is available to registered users only. If this option
is specified it is no longer possible to cancel TbScan by pressing
Ctrl-Break, or to respond to a virus alert window.
2.8.13. compat (co)
If you specify this option, TbScan attempts to be more compatible
with your system. Use this option if the program does not behave as
can be expected or even halts the system. This option will slow
down the scanning process so it should only be used when necessary.
Note that option 'compat' does not affect the results of a scan.
2.8.14. ignofile (in)
If this option is specified and no files can be found, TbScan will
not display the 'no files found' message, nor does it exit with
errorlevel 1. This option might be useful for automatic archive
contents scanning. If the archive contains no executable files,
TbScan will not return with an error condition.
2.8.15. noboot (nb)
If you specify this option TbScan will not scan the bootsector.
2.8.16. sector (ss)
This option is experimental. It enables the scanning operation of a
disk at sector level. This way you can trace those viruses that
reside outside files and bootsector and the hard-to-spot stealth
viruses.
This option might also tell you that a virus ever resided in your
system in the past. If so, this does not mean that the virus
itself is still active. Even if TbScan itself deleted an infected
file in the past, this option still enables TbScan to detect the
signature for quite a while. Hence this option is NOT recommended
for a regular scan.
Note that TbScan cannot disassemble files in this mode. False
alarms may occur frequently since everything is being searched, and
the search even covers unused disk space containing garbage.
2.8.17. nomem (nm)
If you specify this option TbScan will not scan the memory of the
PC for viruses.
2.8.18. hma (hm)
TbScan detects the presence of an XMS-driver, and scans HMA
Page 24
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
automatically. If you have an HMA-driver that is not compatible
with the XMS standard you can use the 'hma' option to force TbScan
to scan HMA.
2.8.19. nohmem (nh)
By default TbScan identifies RAM beyond the DOS limit and scans
that too. This means that video memory and the current EMS pages
are scanned by default. You can use the 'nohmem' option to disable
the scanning of non-DOS memory.
2.8.20. nosub (ns)
By default TbScan will search sub-directories for executable files,
unless a filename (wildcards allowed!) has been specified. If you
use this option, TbScan will not scan sub-directories.
2.8.21. noavr (na)
If you specify this option TbScan will not look for its AVR-modules
(Algorithmic Virus Recognition modules; .AVR files) at start-up and
will not perform any algorithmic scans on files.
2.8.22. delete (de)
If TbScan detects a virus in a file it prompts the user to delete,
move or rename the infected file, or to continue without action.
If you specify the 'delete' option, TbScan will not ask the user
what to do but will delete the infected file automatically. Use
this option if you have established that your system has been
infected. Make sure that you have a clean back-up, and that you
really want to get rid of all infected files at once.
2.8.23. rename (rn)
If TbScan detects a file virus it prompts the user to delete, move
or rename the infected file, or to continue without action. If you
specify the 'rename' option, TbScan will not ask the user what to do
but will rename the infected file automatically. By default, the
first character of the file extension will be replaced by the
character 'V'. An .EXE file will be renamed to .VXE, and a .COM
file to .VOM. This prevents the infected programs from being
executed, spreading the infection. At the same time they can be
kept for later examination and repair.
You may also add a parameter to this option specifying the target
extension. This parameter should always contain 3 characters;
question marks are allowed. The default target extension is 'V??'.
2.8.24. move (mv)
If TbScan detects a virus in a file it prompts the user to delete,
Page 25
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
move or rename the infected file, or to continue without action. If
you specify the 'move' option, TbScan will not ask the user what to
do but will move the infected file to another directory
automatically.
The file will be moved to the TbScan directory or to the directory
specified with option 'path'.
2.8.25. path (mp)
This option can be used to specify the move-path. The move path is
used to move an infected file if option -move is specified or when
the user selects the M) in the virus alert window.
2.8.26. batch (ba)
If TbScan detects a file virus it prompts the user to delete, move
or rename the infected file, or to continue without action. If you
specify the 'batch' option TbScan will always continue. This option
is designed for use in a batch file that is executed without the
user attending. We highly recommended you to use a log file in such
situations, as a scanning operation does not make much sense
without the return messages being read.
2.8.27. repeat (rp)
This option is very useful if you want to check a large amount of
diskettes. TbScan does not return to DOS after checking a disk, but
it waits until you insert another disk in the drive. You don't have
to press a key on the keyboard when ready. TbScan detects
automatically when the drive is ready to be accessed. This way you
can check a large amount of diskettes without having to touch your
keyboard.
Note that the motor of the disk drive keeps spinning, and the light
keeps burning when a diskette has been processed. You can safely
open and close the drive door to remove or insert a diskette while
the motor still runs. Many back-up programs handle the drives the
same way as TbScan does, without causing any harm.
2.8.28. log (lo)
When you use this option, TbScan creates a LOG-file. The default
filename is TBSCAN.LOG and it will be created in the current
directory. You may optionally specify a path and filename. The
LOG-file lists all infected program files, specifying upper-case
heuristic flags and complete pathnames. If the log file already
exists, it will not be overwritten. Instead the new LOG-file will
be appended to the existing one.
If you use this option often, it is recommended to delete or
truncate the log file every month to avoid unlimited growth.
Page 26
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
If you want to print the results, you can specify a printer device
name rather than a filename (log=lpt1).
2.8.29. session (sl)
This option is nearly identical to the 'log' option above. The
difference is that if a log file already exists, the 'session'
option will make sure that this will be overwritten by new log
information. Hence a log file created by the 'session' option will
only contain information obtained from a single scanning session.
2.8.30. loglevel (ll)
The 'loglevel' option determines which files will be put in the
log file. There are five log levels:
0 Log only infected files. If there are no infected files
do not create or change the log file.
1 Put a summary and timestamp in the log file. Put only
infected files in the log file.
2 Same as loglevel=2, but now also 'suspected' files are
logged. Suspected files are files that would trigger
the heuristic alarm if option 'heuristic' had been
specified.
3 Same as loglevel=2, but all files that have a warning
character printed behind the filename will be logged
too.
4 All files being processed will be put into the log
file.
The default log level is 1.
Note: you have to combine this option with option 'log' or
'session'.
2.8.31. expertlog (el)
If you specify this option TbScan will not display the descriptions
of the heuristic flags into the log file.
2.8.32. sigfile (sf)
You can override the default path and name of the signature file by
using this option.
TbScan normally tries to locate a signature file by itself. See
chapter 3.10 for information on how TbScan searches such a data
file. If TbScan does not succeed in recognizing or locating the
default data file, or if you want to override TbScan's default data
search path, you should use the 'sigfile' option.
Note: if you specify option 'sigfile' without filename parameter,
TbScan assumes that you want to scan heuristically only, and it
Page 27
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
will scan without any signature or AVR information. Option
'heuristic' is implied in this situation.
2.9. Examples:
TbScan \ sigfile=c:\TbScan.Dat noboot
Process all executable files in the root directory and its
sub-directories. Skip the bootsector scan. Use the
signature file 'c:\TbScan.Dat'.
TbScan \*.*
Process all files in the root directory. Don't process
sub-directories.
TbScan c:\ log=c:\test.log loglevel=2
All executable files on drive C: will be checked. A
LOG file with the name c:\test.log will be created. The log
file will contain all infected and suspected files.
TbScan \ sigfile log=lpt1
TbScan will scan the root directory and its sub-directories
without signature or AVR information. Option 'heuristic' is
assumed in this case. The results are redirected to the
printer rather than to a log file.
2.10. The configuration file
Those people that are accustomed to the use of configuration files
may devise a similar file for use with TbScan. The TbScan
configuration file should be located in the same directory where
the file TBSCAN.EXE resides, and it should be called TBS.BAT
(surprise, surprise!). The format of this configuration file is as
follows:
tbscan %1 %2 %3 %4 %5 %6 %7 %8 %9 [<default options...>]
Example:
tbscan %1 %2 %3 %4 %5 %6 %7 %8 direct sigfile=c:\virus\Virscan.Dat
To execute this configuration file you should type 'TBS C:\' at the
DOS prompt. If you wish to override the default options specified
in your TBS.BAT file, just type 'TBSCAN'.
This configuration file can offer great possibilities. You may
incorporate mnemonics like 'DAILY' and 'WEEKLY' to invoke a
predefined scan session. The user may be allowed to specify
additional options on the command line. You can make sure that if
TbScan detects a virus, a file called VIRUS.TXT will be printed on
Page 28
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
the screen, offering a user important information such as the
emergency phone number of the company helpdesk and the phone number
of your security officer.
An example:
@echo off
if '%1'=='daily' goto daily
if '%1'=='weekly' goto weekly
:help
echo Type 'TBS weekly' or 'TBS daily' to start a scan event
goto end
:daily
tbscan c:\system d:\ %2 %3 %4
if errorlevel 2 goto virus
if errorlevel 1 goto help
goto end
:weekly
tbscan c:\ d:\ e:\ log=c:\logs\tbscan.log %2 %3 %4
if errorlevel 2 goto virus
if errorlevel 1 goto help
goto end
:virus
type virus.txt
:end
For more information about setting up this kind of powerful
'configuration' file please consult the chapter on batch files in
your DOS manual.
Too few people are aware of the power of the DOS batch file
features. Why learn yet another configuration file language if
a DOS batch file will suit your needs perfectly? You can predefine
scan sessions, define default options, and branch to a specific
routine if TbScan detects a virus.
Your TbScan diskette is supplied with a sample BATCH file called
TBS.BAT. You can edit it to suit your needs.
2.11. The TbScan.Msg file
TbScan prints the TBSCAN.MSG file on your screen a few seconds after
start-up. This file also appears when TbScan has finished scanning
without detecting a virus. The file TBSCAN.MSG as supplied by us
displays our address and registration info. However, you can edit
this file as you please, for instance by adding your company logo.
You may add color codes to the TbScan.MSG file. A color code is
preceeded by the character '|'. The following color codes are
available: (all numbers are in hex).
Color Foreground Highlight Background
Black 00 08 00
Page 29
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
Blue 01 09 10
Green 02 0A 20
Cyan 03 0B 30
Red 04 0C 40
Magenta 05 0D 50
Yellow/Brown 06 0E 60
White/gray 07 0F 70
Example: To make a highligted green character on a red
background the color code would be 0A+40=4A. To make the character
blink add 80h to the result.
2.12. Residence of the signature files
TbScan looks for the data file in the following order:
1) If the 'sigfile' option has been set, it will use the file
specified in the search path.
2) It searches a file with the name VIRSCAN.DAT in the active
directory.
3) It searches VIRSCAN.DAT in the same directory where the program
file TBSCAN.EXE itself resides.
4) It searches a file with the name TBSCAN.DAT in the active
directory.
5) It searches TBSCAN.DAT in the same directory where the program
file TBSCAN.EXE itself resides.
TbScan also looks for a data file containing last-minute update
signatures. The file should be named ADDNSIGS.DAT and it should be
located either in the current directory or in the TbScan home
directory.
2.13. Residence of the AVR-modules
The AVR-modules are only searched in the directory where the
program TBSCAN.EXE itself resides.
2.14. Error messages
Error messages that might be displayed:
+ Error in data file at line <number>.
There is an error in the specified line of the data file.
+ Failed to locate DOS entry point.
TbScan has not been able to locate the DOS entry point, but
continues as if option 'direct' has not been specified.
+ Limit exceeded.
The total amount of internal signature information exceeded
Page 30
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
64Kb. This message will be displayed if the number of
signatures reaches 2500. You can either reduce the number of
signatures or make them shorter.
+ Command line error.
An invalid or illegal command line option has been specified.
+ No matching executable files found.
The path specified does not exist, is empty, or the specified
file does not exist or is not an executable file.
+ Cannot create logfile.
The specified log file path is illegal, the disk is full or
write protected, or the file already exists and cannot be
overwritten.
+ Sanity check failed!
TbScan detected that its internal checksum does not match
anymore. TbScan is possibly contaminated by a virus.
Obtain a clean copy of TbScan, put it on a WRITE PROTECTED
bootable diskette, boot from that diskette, and try again!
2.15. Exit codes
TbScan terminates with one of the following exit codes:
Errorlevel 0: no viruses found, no error occurred.
Errorlevel 1: some error occurred.
Errorlevel 255: sanity check failed.
Errorlevel >1 and <128: one or more viruses detected.
When a virus is detected the errorlevel is used as a bit field:
bit 1 (02): SYS file infected.
bit 2 (04): EXE file infected.
bit 3 (08): COM file infected.
bit 4 (16): virus found in LOW memory.
bit 5 (32): virus found in BOOTsector.
bit 6 (64): virus found in HIGH memory.
An errorlevel of 26 means that a SYS, COM and LOW virus is found
(26 = 02+08+16).
Page 31
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
3. FORMAT OF THE DATA FILE
3.1. Format of a signature entry
The data file (called TBSCAN.DAT or VIRSCAN.DAT) can be read and/or
modified using any DOS text editor.
All lines starting with ';' are comment lines. TbScan ignores these
lines. When the ';' character is followed by a percentage sign the
remaining part of the line will be displayed on the screen. A
maximum of 8 lines can be printed on the screen.
In the first line the name of a virus is expected. The second line
contains one or more of the following terms:
BOOT SYS EXE COM HIGH LOW
These terms may be separated by spaces, tabs or commas.
BOOT means that the virus is a bootsector virus. the terms SYS, EXE
and COM indicate that the virus must be scanned for in files with
these extensions. Overlay files (with the extension OV?) will be
scanned for EXE viruses. BIN files will be scanned for SYS viruses.
HIGH means that the virus can occur in the memory of your PC at a
location higher than the TbScan program itself. LOW means that the
virus can occur in the memory of your PC at a location lower than
the TbScan program itself.
In the third line the signature is expected in ASCII-HEX. Each
virus character is described by means of two characters.
An entry in the signature file should look like this:
;
Test virus
EXE COM
ABCD21436587ABCD
;
It is allowed to use spaces in the ASCII-HEX signature for your own
convenience. TbScan will ignore those spaces.
The three central lines should be present in each virus
description. Between these lines comment lines may be inserted.
3.2. Wildcards
TbScan allows you to use wildcards in a signature. Wildcards can be
used to define one signature that recognizes several related
viruses.
Page 32
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
- The ? wildcard.
The question mark specifies a wildcard nibble, which means that
the corresponding half of the byte may have any value.
Example:
A5E623CB??CD21?883FF3E
- The * wildcard.
You can use the asterisk followed by an ASCII-HEX character to
skip a fixed amount of bytes in the signature. The ASCII-HEX
character specifies the amount of bytes that should be skipped.
Example:
A5E623CB*3CD2155??83FF3E?BCD
Hence the following sequence of bytes will be recognized as a
virus:
A5E623CB142434CD21554583FF3E3BCD
- The % wildcard.
A percentage sign (%) followed by an ASCII-HEX character
indicates that the remaining part of the signature could be
located a number of bytes away. The ASCII-HEX character
specifies the maximum distance at which the remaining part
should be found.
- The ** wildcard.
You can use the '**' wildcard to skip an unlimited variable
amount of bytes in the signature.
3.3. Limitations.
+ The name of a virus may contain up to 30 characters.
+ The ASCII-HEX signature may contain up to 132 characters.
+ A signature must contain at least one sequence of two
non-wildcard bytes. A sequence of four however is recommended.
+ The signature should start with a non-wildcard byte.
+ The % wildcard should not be followed by any other wildcard.
Examine the VIRSCAN.DAT file for examples of how signatures can be
Page 33
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
made to fit the format of the signature file.
3.4. Defining new signatures.
This chapter is intended for advanced users who own a TBAV.KEY
file or a Thunderbyte add-on card.
Although the VIRSCAN.DAT data file supplied with the TbScan package
is updated frequently, new viruses are created each day, outpacing
the regular upgrading service of this data file. It is therefore
possible that one day your system gets infected by a recently
created virus that has not yet been listed in the VIRSCAN.DAT file.
TbScan will not always detect the virus in such cases, not even
with the 'mutant' option set. If you are convinced that your system
must have been infected without TbScan confirming this, this
chapter will supply you with a valuable tool to detect undocumented
viruses with. We offer you step-by-step assistance here in creating
an emergency signature that can be (temporarily) added to your copy
of VIRSCAN.DAT.
- Collect some infected files and copy them into a temporary
directory.
- Boot from a clean write-protected diskette. Do NOT execute ANY
program from the infected system, even though you expect this
program to be clean.
- Execute TbScan from your write-protected TbScan diskette with
the 'extract' option set. Make sure that the temporary directory
where you put the infected files will be TbScan's target
directory. With its 'extract' option set, TbScan will NOT scan
the files but, instead, display the first instructions that are
found at the entry-point of the infected programs. Please note
that we highly recommend you to simultaneously set the
'session' option of TbScan.
- Compare the 'signatures' extracted by TbScan. You should see
something like this:
NOVIRUS1.COM 2E67BCDEAB129090909090ABCD123490CD
NOVIRUS2.COM N/A
VIRUS1.COM 1234ABCD5678EFAB909090ABCD123478FF
VIRUS2.COM 1234ABCD5678EFAB901234ABCD123478FF
VIRUS3.COM 1234ABCD5678EFAB9A5678ABCD123478FF
If the 'signatures' are completely different, the files are
probably not infected, else they have been infected by a
polymorphic virus that requires an AVR module to detect it.
- Replace all differences in the 'signatures' by question marks
Page 34
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
('?'). A signature to detect the 'virus' in the example above
could be:
1234ABCD5678EFAB9?????ABCD123478FF
- Add the signature to the data file of TbScan. Give the virus a
name in the first line of its entry. Specify the EXE and COM
keywords in the second line. Enter the signature on the third
(see 4.1.).
- Run TbScan again in the directory containing the infected
files. TbScan should now detect the virus.
- Send a couple of infected files to a recommended virus expert,
preferably to us.
Congratulations! You have defined a signature all by yourself! Now
you can scan all your machines in search of the new virus.
However, keep in mind that this method of extracting a signature
is a 'quick-and-dirty' solution to viral problems. The extracted
signature will not detect the presence of the virus in all cases. A
signature that is guaranteed to detect all instances of the virus
can be made only after complete disassembly of the new virus. For
these reasons you should NOT distribute your home-made 'signature'
to others. The signature eventually assembled by experienced
anti-virus researchers will be completely different in most cases!
Page 35
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
4. CONSIDERATIONS AND RECOMMENDATIONS
4.1. What should be scanned?
In the early days of viruses, virus scanners just scanned
everything. Today we know that this approach has serious
disadvantages: the number of false alarms is very high, the scan
speed is very, very slow, etc.
Before we proceed, let's first establish some facts about viruses.
A virus is just a program. Like any other program, it will have no
effect as long as it is not executed. Consequently, data files like
text files can never spread a virus. Of course, it is always
possible to copy a virus into a .TXT file, but since the text file
itself will never be executed, the virus can never be activated
from that location. A virus signature in a .TXT file is treated as
just any other stream of bytes to be found there. A program and a
bootsector, however, will be executed, and if they contain a
virus, the virus will gain control and do its nasty job.
We now know that it doesn't make sense to scan non-executable
files. What we therefore need to scan are files with the extensions
EXE COM OV? SYS and BIN. Note that a batch file (.BAT) is just a
text file. Though it can be 'executed' in some way, it is not
possible to program a virus in the batch file language.
What do executable programs consist of? Naturally they contain
program code, but they also contain data. The texts that will be
displayed on the screen by that program are just data. They will
never be 'executed'. We don't have to scan them.
The exe-header of an exe file does not contain any code either,
only data. The exe-header is there to assist DOS in loading the
program, and it is thrown away before DOS passes control to the
program itself. We don't have to scan it.
The same applies to the bytes following the load-module of the
file. This area of a file will not be loaded into memory at
start-up. We don't have to scan it.
Unfortunately, the code part of the executable file is mostly the
larger one. The code-data ratio differs for each program, but on an
average we can state that about two thirds of a program consist of
code. However, it is hardly possible to separate the two. Even the
operating system is not able to do this, only the program itself.
What actually happens is that when you execute a program, the
operating system passes control to the program at a fixed location
in the program file. This location, referred to as ENTRY-POINT in
this manual, is the first byte in case of a .COM file, or a
location specified in the exe-header of an .EXE file. This location
is the only location in a file of which we can be 100% sure it
contains code. As to other locations we can only guess.
Page 36
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
How does a virus work?
A virus that is about to infect a file cannot just throw its viral
code at a random location in that file, it won't work. The virus
has to be sure that its code will be executed before the host
program gains control. Why? Because if the contaminated program
finds itself altered, it will behave in an unexpected manner. If
the program accesses internal resources that have been overwritten
by the virus, the program will crash. Besides, how should the virus
know whether that random location will ever be executed?
There is only ONE location that will always be executed, and that
is the entry-point of the program. To infect a file the virus has
to attach itself to the entry-point and store the original
instructions of the program at another location. Only there and
then can the virus be certain it will gain control instead of the
host program, and that it can restore the original instructions
before it passes on control. All reports of virus infections of
program files indicate that a virus ALWAYS attaches itself to the
entry-point of a program.
This leads us to a basic principle: if we scan the location where
we can find the first instructions of the program, we can be
certain we are scanning the area where the virus would reside.
TbScan uses this knowledge when scanning a window of about 4Kb (as
it does by default) around the program-entry point. This is called
'Checking' or 'Looking'. If you wish to know more about this
procedure consult chapter 6.2.: 'The Internals of TbScan'.
Note that we do not take any risks when limiting the area where we
scan for viruses. If their signatures are assembled according to
the basic principles set out above, viruses cannot escape from
detection, simply because they have to be in the 'window' where we
scan for them. To prove our point many other competitive virus
scanners have adopted our scanning strategy.
Also note that if TbScan is not completely sure about the exact
location of the entry-point of the file, it scans ALL the program
code of the file using the 'browse' or 'scan' algorithms.
4.2. The internals of TbScan
4.2.1. How is that blazing speed achieved?
The speed of TbScan is achieved by many measures.
To avoid false alarms, TbScan scans restricted areas of the
file. Naturally this approach benefits the scanning speed.
Disk access is minimized, and not much data has to be
searched.
Page 37
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
TbScan is entirely written in assembly language. High-level
languages like Pascal and Basic have an enormous overhead which
not only affects the size of the program but also reduces the
execution speed.
The search routine has been highly optimized. Every byte to be
scanned is only accessed once, regardless of the number of
signatures. Execution time will hardly increase when it has to
scan for 3000 signatures instead of 500. The search algorithm
used can be described as 'rotating semi-double 16-bits
hashing'.
The number of DOS function calls has been minimized. DOS is
relatively slow, and access should be avoided as much as
possible. For this reason TbScan walks through a directory
just once instead of first processing the files and the
sub-directories afterwards or vice versa.
TbScan writes directly to the screen instead of calling on DOS
or BIOS to do this. Although TbScan has a scrolling window,
screen access is minimized as much as possible without
affecting the visual display of the program output.
TbScan has a built-in disk cache. Although a disk cache has
already been installed in many systems, a standard disk cache
slows down the scanning speed of a virus scanner instead of
increasing it! This slow-down is caused by the disk cache,
trying to make assumptions as to what the program will be
reading next. The standard disk cache will fail here because
it doesn't know that files will be accessed only once. Neither
is it aware of the fact that after a file has been partially
scanned, the remaining part will not be accessed by TbScan at
all. The cache wastes many clock cycles reading ahead and
maintaining megabytes of data which the scanner is not
interested in. On the other hand, the directories and the FAT
are accessed a lot, and a standard disk cache could increase
TbScan's performance a lot here, if it would just restrict
itself to those areas. Our solution is to temporarily install
one that 'knows' which data are required and which are not.
Depending on the hardware specifications of a machine, the
scanning speed will be increased by 10%.
4.2.2. The code interpreter
Viruses can only infect program files according to a fixed
strategy. There is only one single point in a program file that
a virus can be certain will be executed, namely the starting
point of the program. It cannot be sure of any other location
which explains why it will not attempt to put its first code
just anywhere in the program file that it is planning to
infect. The virus will always have to put AT LEAST one
instruction at the entry-point of the program.
Page 38
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
TbScan uses this knowledge to restrict the number of bytes that
have to be read in a file as much as possible. Just like the
loader of DOS itself, it determines where the entry point of
the program is located: right at the beginning of a COM-file or
at the address specified in the exe-header of an EXE-file.
However, this is not where TbScan will stop. As jump or other
branch instructions are being found at the entry-point of a
program file, TbScan will follow this jump - or chain of jumps
- until it does not come across a jump anymore. By then we have
located the real starting-point of the program or, in case it
has been infected, the virus itself.
There is the possibility, however, that after TbScan has
followed through a chain of jumps it then finds that there are
new significant IP-modifying instructions (calls, rets, irets,
jumps) not far from the real starting-point that it has just
established. Could this future jump point to a virus code, or
have we really reached the starting-location? TbScan does not
take any chances and will read the entire file scanning for
viruses. Only when it is 100% sure to have found the real
starting-point of a file - at least 20 bytes of continuous
(hence 'stable') code - TbScan will limit its check to the 4 Kb
surrounding this spot.
Note that very few viruses require more than 4 Kb. In those
cases TbScan will scan for the first 4 Kb of their signatures
inside its scanning window.
4.2.3. The algorithms
When TbScan processes a file it prints 'Looking', 'Checking',
'Tracing', 'Browsing', 'Scanning' or 'Skipping'.
4.2.3.1. Looking
'Looking' means that TbScan has successfully located the entry
point of the program, and that the code has been identified as
something known. 'Looking' is the fastest and most reliable
scan algorithm, but it can only be applied on programs produced
by known software, such as known compilers, file compressors,
etc. 'Looking' is almost the same as 'Checking' but the
predefined information is used to increase the speed of
scanning.
Looking will be used on files that are produced by known
software.
4.2.3.2. Checking
'Checking' means that TbScan has successfully located the entry
point of the program, and is scanning a frame of about 4Kb
Page 39
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
around the entry point. If the file is infected the signature
of the virus will be in this area. 'Checking' is a very fast
and reliable scan algorithm.
Checking will be used on most files that are not produced by
known software.
4.2.3.3. Tracing
'Tracing' means that TbScan has successfully traced a chain of
jumps or calls while locating the entry-point of the program,
and is scanning a frame of about 4Kb around this location. If
the file has been infected, the signature of the virus will be
in this area. 'Tracing' is a fast and reliable scan algorithm.
Tracing will be primarily used for TSR-type COM files or Turbo
Pascal-compiled programs. Most viruses will force TbScan to use
'Tracing'.
4.2.3.4. Scanning
'Scanning' means that TbScan is scanning the entire file
(except for the exe-header which cannot contain any viral
code). This algorithm will be used if 'Looking', 'Checking' or
'Tracing' cannot be safely used. This is the case when the
entry-point of the program contains other jumps and calls to
code located outside the scanning frame. 'Scanning' is a slow
algorithm. Because it processes almost the entire file,
including data areas, false alarms are more likely to occur.
The 'Scanning' algorithm will be used while scanning
bootsectors, SYS and BIN files.
4.2.3.5. Browsing
'Browsing' is nearly identical to the 'Scanning' algorithm,
but it performs a little better on files containing long
sequences of low ASCII, 00 or FF bytes. On other files (like
compressed files) it performs worse. Hence TbScan decides which
is the most efficient algorithm when scanning a file.
'Browsing' is as reliable as 'Scanning' but it also shares the
tendency to cause false alarms. In fact, any dumb scan
algorithm (i.e. algorithm without intelligence) will suffer
from this kind of unreliability.
Like the 'Scanning' algorithm, 'Browse' will be used while
scanning memory, bootsectors, SYS and BIN files.
4.2.3.6. Skipping
'Skipping' will occur with SYS and OVL files only. It simply
means that the file will not be scanned. As there are many SYS
Page 40
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
files that contain no code at all (like CONFIG.SYS) it makes
absolutely no sense to scan these files for viruses.
The same applies to .OV? files. Many overlay files do not
deserve to be called as such as they lack an exe-header. Such
files cannot be invoked through DOS making them just as
invulnerable to direct virus attacks as .TXT files are. If a
virus is reported to have infected an .OV? file, it involved
one of the relatively few overlay files that does contain an
exe-header. The infection was then the result of the virus
monitoring the DOS exec-call (function 4Bh) and infecting any
program being invoked that way, including 'real' overlay files.
4.2.4. Option 'compat'
The 'compat' option is used to increase compatibility with your
system if the default behavior of TbScan causes problems. The
differences between the default and compatibility modes are:
- In default mode, TbScan installs a disk cache if
enough memory is available. In the compatibility mode
TbScan will not install the TbScan disk cache.
- While scanning memory, TbScan temporarily disables the
interrupts for each 32 Kb-block being scanned. In
compatibility mode, however, TbScan performs a
non-destructive scan and does not disable interrupts at
all. It offers the highest compatibility but memory
scanning may slow down considerably in some instances.
- If the 'compat' switch has been specified TbScan does
not use AVR-modules to scan memory. Memory-related
AVR-modules contain virus-specific function requests
that could interfere with resident software. The
compatibility mode does make use of AVR-modules,
however, when scanning files.
4.3. The Sanity check
TbScan performs a sanity check when it fires up. However, to be
honest, it is NOT possible to make software 100% virus-resistant.
If this was the case, the virus problem could be solved simply by
incorporating a self-check in every program.
Unfortunately, a sanity check does not work if a 'stealth' type of
virus is involved. A stealth virus can hide itself completely when
a self-check is being performed. Do note that we are not dealing
with a TbScan bug here. The failure to detect stealth viruses is
common to ALL software performing a sanity check. Therefore, we
recommend you to keep a clean version of TbScan on a
write-protected diskette. Use this diskette to check other machines
once you have found a virus in your own system.
Page 41
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
4.4. How many viruses does it detect?
Some people think that TbScan recognizes only 500 viruses, based
upon the fact that the signature file contains only 500 signatures.
What they do not realize is that the signatures are family
signatures, which means that each signature covers many viruses.
For instance, our PLO/Jerusalem signature detects over 25 viruses
which are all related to the 'original' Jerusalem virus! Only one
(wildcarded) signature is needed by TbScan to cover all these
mutants.
Some competitive products treat each virus mutant as a separate
virus, and so claim to detect over 1200 viruses. However, TbScan
detects even more viruses using 'only' 500 signatures.
4.5. Testing the scanner
Many people understandably wish to test the product they are using.
While it is very easy to test, for instance, a word processor, it
is very difficult to test a smart scanner like TbScan. You cannot
extract 25 bytes from an executable and insert it in the TBSCAN.DAT
or VIRSCAN.DAT data file as a bogus signature just to find out
whether or not TbScan will detect the 'signature' in the file it
was copied from. It is very likely that TbScan does NOT find it
because it only scans the entry-area of the file whereas the
'signature' you extracted might be taken from some other location
within the file.
You might ask: 'How then can I test the scanner if using a 'test
signature' does not work?' We think you can't, unless you are an
experienced assembler programmer. Sorry, but testing a
disassembling scanner should be performed by virus experts only.
Fortunately, you don't have to rely on our tests solely. There are
anti-virus magazines that regularly publish tests of all virus
scanners. At the end of this manual you will find names and
addresses of such magazines. Anyway, third parties have tested our
scanner along with several others, and they found TbScan to have a
very high hit rate. It detects even more viruses than many popular
scanners do.
4.6. Scan scheduling
It is highly advisable to devise your own schedule for a regular
scan of your system. Creation of a special TbScan boot diskette is
highly recommended in this respect.
Boot from your original DOS diskette. Use the diskcopy command to
copy the DOS diskette onto a new diskette. Delete all files from
this diskette, except for the two hidden system files and
Page 42
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
COMMAND.COM. Copy all TbScan files to the diskette. Create a new
AUTOEXEC.BAT file which should contain the line 'TbScan C:\'.
Write-protect the diskette with the write-protect tab.
The following scan sessions (listed in order of preference) are
recommended:
- Run TbScan from A WRITE-PROTECTED BOOTABLE DISKETTE once a
week. Boot from this diskette before invoking the scanner. We
agree that it may be inconvenient to boot from a diskette, but
it is the only way to make sure that no stealth virus will
become resident in memory.
- It is recommended to invoke a daily scan. You can invoke
TbScan with the 'once' option from within the autoexec.bat file
to perform the daily scan session automatically. It is not
necessary to boot from the bootable TbScan diskette to perform
the daily scan.
The 'sector' and the 'mutant' option should never be used in a
normal scan session but only when you expect the system to be
infected by a virus.
4.7. Extensions to the format of the data file
There are a number of other scanners which are compatible with the
data file format used by TbScan. Some of these scanners allow for
certain extensions to the data file which we consider absurd and
therefore refuse to implement. These extensions include special
signatures for upper memory, overlay files, and numerous (highly)
confusing filename extensions, different keywords for the same
items, and XOR-decryption directives. TbScan scans upper memory
for LOW-type viruses (since any LOW-type TSR can be loaded in upper
memory through DOS 5.0), and overlay files for EXE-type viruses
(since overlays are just a special kind of EXE file). TbScan's XOR
decryptions are performed much more efficiently through its own AVR
modules.
4.8. Compressed files
Many executable files are compressed or packed. They contain an
unpacking routine which unpacks the executable in memory to restore
the original program size. The simplest compressor is the Microsoft
ExePack program. This compressor is even included in the link
program itself (use the /E option while linking to pack the
executable).
If the program contained a virus BEFORE compression took place, the
virus has been compressed too. A scanner will not recognize the
virus because of its compressed signature. The virus will still be
Page 43
Thunderbyte virus detector. (C) Copyright 1989-1992 Thunderbyte B.V.
able to execute though.
If a virus resides inside a compressed file, it betrays its
presence by infecting other files in your system. Hence the
signature will be visible in all the newly infected files, which
the scanner will dutifully report. The compressed file that brought
the (compressed) virus into your system will probably not trigger
an alarm itself. The virus inside this program can do its worst all
over again unless you isolate this compressed file as the source of
the infection.
TbScan displays a 'p' behind each file that it finds to be
compressed by ExePack or any other compressor. TbScan does not
unpack files, since too many files are compressed nowadays.
Decompressing each one of them in your system would only be
feasible if there was a limited number of compression schemes. Even
if there were, TbScan unpacking all your compressed files would be
consuming too much time, the more so as most of the time this
action would be quite unnecessary. Once you have established that a
compressed file does not contain a virus, you can rest assured that
this file will not get internally infected at a later date. Hence
it makes no sense to have TbScan unpack these files time and time
again. If there wasn't a virus the first time you checked, there
will not be one at subsequent times.
Note that if the compressed file gets infected AFTER it has been
compressed, the virus has NOT been compressed and will be clearly
visible to a scanner. The problem we referred to above only exists
when a file has been infected first and compressed afterwards.
Fortunately, you can treat compression as a minor risk when files
have been compressed by the programmer of the product (as is often
the case). Most programmers are aware of the existence of viruses
and go about compression with great care. If the programmer did not
compress the file, well, then the file has not been compressed and
the problem does not exist at all,...that is, if you obtained the
original version of a program of course.
If you obtained your copy of the program from another copy, you
have joined ranks with those that use illegal (!) copies of
software and thereby take great risks! One of the previous owners
of the program may have compressed it, treating you (perhaps
unknowingly) to a nasty virus infection.
Page 44