home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Magnum One
/
Magnum One (Mid-American Digital) (Disc Manufacturing).iso
/
d23
/
tbscnx21.arc
/
TBSCANX.DOC
< prev
next >
Wrap
Text File
|
1991-03-02
|
33KB
|
766 lines
DOCUMENTATION FOR TBSCANX V2.1
REGULATIONS WITH REGARD TO USE AND DISTRIBUTION OF TBSCANX
----------------------------------------------------------
Both TbScanX and the accompanying documentation are SHAREWARE. This
simply means the program is covered by the copyrights of ESaSS, but
can be used and distributed freely as long as the following
regulations are observed.
+ Concerning the distribution of the TbScanX program no
administration and/or shipping costs exceeding the amount of
$5,- may be charged.
+ Distribution of TbScanX may only take place when both the
program and the documentation are left unmodified and only when
the complete program is supplied.
+ So it is not allowed to distribute the program apart from the
documentation.
+ ESaSS accepts no responsibility in case the program
malfunctions or does not function at all.
+ ESaSS can never be held responsible for damage, directly or
indirectly resulting from the use of TbScanX.
+ Using TbScanX means that you agree on these regulations.
DESCRIPTION TBSCANX
-------------------
TbScanX is a program that was developed to trace viruses, Trojan
Horses and other threats to your valuable data. It is a so-called
virus scanner.
A virus scanner is a program that is able to search a signature
that has been determined beforehand. Most viruses consist of a
unique signature, so by means of checking for the appearance of
this signature we can see whether or not a program has been
infected.
By searching all your program files for the signatures of all
viruses already identified you can easily find whether your system
has been infected and, if that is the case, with which virus.
By now already many virus scanners have been developed. The problem
with all these scanners is that you have to execute them. Suppose
you have the virusscanner automatically invoked in your
autoexec.bat file. If no viruses are found, your system is supposed
to be uninfected. But, to be sure that no virus can infect your
system, you have to run the scanner every time before you copy a
file to your harddisk, after downloading a file from your BBS, or
after unarchiving an archive such as a ZIP file. Be honest, do YOU
actually invoke your scanner every time?
TbScanX has a unique feature to overcome this drawback, it will
remain resident in memory, and AUTOMATICALLY scan all files you
copy, download, modify, or unarchive!
Probably you think that a resident virus scanner consumes much
memory, makes your system slow, and is a source of many problems.
But, if you already know our free-ware scanner TBSCAN, you know
that this scanner can scan your files ten times faster compared
with other scanners. Also TbScanX achieves this lightning fast
speed. Actually, TbScanX is a lot faster, since it will not access
your disk to scan the files, because all files to be created or
modified reside already in memory!
Besides this, TbScanX consumes only 5Kb of memory, including the
signatures to scan for! If there is expanded memory available,
TbScanX uses only about 1Kb of memory!
TbScanX carries the same feature of its transient brother TBSCAN:
+ TbScanX is fully programmable by means of a data file.
Most of the time viruses spread quickly. After a new virus has
been found there is often no time to adapt your virus checker
in order to make it capable of recognizing this new virus. That
is why TbScanX uses a data file in which the signatures of the
viruses occur. This file can quickly be adapted, possibly by
yourself, for example when you are informed of a new virus
through the media. TbScanX supports among other things the
format which is used in the file "virscan.dat". This file is
regularly adapted and can be obtained at a lot of data banks.
+ TbScanX supports wildcards in the signature.
A lot of viruses encrypt themselves after each infection, so
the signatures always look different. There is one part of the
virus however that cannot be modified: the routine that has to
"unpack" the modified part of the virus.
But it is a misunderstanding that this part of the virus always
should look the same. The fact is there are viruses that pepper
their unpack-routine with useless instructions which have no
effect and which are continuously replaced by other nonsensical
instructions. Although the unpack-routine always functions the
same, it looks different every time because of these changing
fake instructions!
By inserting wildcards on places where the fake instructions
occur in the signatures of the data file, such a virus can
still be traced and identified. This is the case because any
character may be used on the place of a wildcard.
It is also possible to skip a variable amount of garbage bytes
in the signature.
+ TbScanX supports normal text as the signature.
Most signatures are inserted in ASCII-HEX. But when desired you
can also specify a normal text as the signature. In this case
you put the text between double quotation marks.
+ TbScanX offers other software an universal hook to scan data
for viruses. If you are a programmer, you can instruct your
programs to scan information read from disk for viruses before
using the data.
USAGE OF THE PROGRAM
--------------------
TbScanX is easy to use. Simply type TBSCANX. The program can also
be invoked from within your config.sys file by inserting the line
"device=TBSCANX.COM". The advantage of the last method is that
TbScanX will get a better position in the memory and is able to
protect the system before other programs are executed. TbScanX uses
also less memory in device driver mode. (NOTE: If you invoke
TbScanX from within your config.sys you have to specify the
extension .COM)
If you use MS-Windows you should load TbScanX BEFORE starting
Windows. If you do that there is only one copy of TbScanX in
memory, but every DOS-window will nevertheless have a fully
functional TbScanX in it. TbScanX detects if Windows is starting
up, and will switch itself in multitasking mode if neccesary.
Options available:
-f <filename> = Use the specified file as signature file.
-d = Disable TbScanX.
-e = Enable TbScanX.
-o = Optimize signatures.
-me = Use Expanded memory.
-mu = Use Upper memory.
-mh = Use Hercules-half memory.
-mf = Use Hercules-full memory.
-mc = Use CGA/EGA/VGA memory.
-u = Unauthorized signatures allowed.
-r = Remove TbScanX from memory.
-F This option tells TbScanX which file should be used as
signature file. Use this option if you use TbScanX as a device
driver, or if the signature file can not be found in the
current or home directory.
-D If you specify this option TbScanX will be disabled, but it
will remain in memory.
-E If you use this option TbScanX will be activated again after
you disabled it with the -D option.
-O If you specify this option TbScanX will optimize the signatures
by merging signatures that are more than 75% equal. Look at the
next two signatures:
Signature 1: CD2145A689BF452F1E77CBCD21
Signature 2: CD2111A689BF4A3F1E77CBCD21
TbScanX will replace the differences between the two signatures
by wildcards and removes the second signature. The resulting
signature of the example above is:
Signature 3: CD21??A689BF????1E77CBCD21
It is clear that this option can save some memory and increases
the scanning speed somewhat. This option has never the result
that some viruses go by undetected, but instead, the chance for
false alarms increases somewhat.
-M TbScanX offsers you some possibilities to minimize the usage of
conventional memory. The -M option requires a parameter that
tells TbScanX which memory should be used. All parameters
except "U" reduce the usage of conventional memory to less than
one Kilobyte. The rest will be stored in the specified memory.
The "U" parameter can even reduce the usage of conventional
memeory to zero bytes! It is also the only parameter that can
be used in combination with other memory parameters.
X If you specify this parameter TbScanX will use expAnded
memory to store the signatures and a part of its
program code. Expanded memory is allocated in 16Kb
blocks, so the minimum amount of expanded memory you
loose is 16Kb. However, conventional memory is more
valuable to your programs than expanded memory, so
using this option is recommended.
H If you specify this parameter TbScanX will use some
part of the Hercules videomemory to store the
signatures. As long as the videocard remains in the
text mode it uses only a little part of its
videomemory. The rest can be used by... TbScanX.
Videomemory is very slow, so also TbScanX will slowdown
somewhat. If you execute a program that switches the
card into the graphics mode TbScanX will disable
itself.
F This parameter does the same as the H parameter, but
it will switch the Hercules card in the so called full
mode. TbScanX then uses videomemory that will not be
used by even most of the graphics software. You can run
a graphics program while TbScanX remains active at the
same time! But watch out! If you have two videocards in
your machine at the same time, DO NOT USE this option!
C This parameter does the same as the H parameter, but
it will now use CGA/EGA/VGA videomemory.
U This parameter can be used to load TbScanX into upper
memory. Upper memory is available on many 80386 based
machines which run memory managers like QEMM. TbScanX
will load itself in upper memory, do don't use
special highload programs. If you use this parameter in
combination with other parameters it will load the
remaining part of TbScanX in conventional memory to
upper memory. So TbScanX can use Expanded memory and
high memory at the same time. The result is that also
the amount of upper memory required is minimized.
-U TbScanX checks the signature file for modifications. If you
change the contents of that file TbScanX will issue a warning.
If you don't want the warning to be displayed, use the -U
option.
-R This option can be used to remove the resident part of TbScanX
from your memory. All memory used by TbScanX will be freed.
Unfortunately, the removing of a TSR is not always possible.
TbScanX checks whether it is safe to remove the resident part
from memory, if it is not safe it just disables TbScanX. A TSR
can not be removed if some other TSR is started after TbScanX.
The -R option can not be used if TbScanX is invoked as a device
driver.
NOTE:
When using TbScanX as device driver you should always specify the
name of the signature file with the -f option!
TbScanX looks for the data file in the way mentioned hereunder:
1) It uses the file specified with the -f option.
2) It searches in the active directory for a file with the
name TBSCAN.DAT.
3) It searches for TBSCAN.DAT in the same directory as the
program file TBSCAN.COM itself is located.
4) It searches in the active directory for a file with the
name VIRSCAN.DAT.
Example:
c:\utils\tbscanx -f c:\tb\tbscan.dat -x
or:
device=c:\utils\tbscanx.com -f c:\tb\tbscan.dat -x -o
Whenever a program tries to write to an executable file (files with
the extensions .COM and .EXE), you will shortly see the text
"Scanning..." in the upper left corner of your screen. As long as
TbScanX is scanning this text will appear. Since TbScanX takes not
much time to scan the file, the message will only appear shortly.
When TbScanX has detected a virus, it will display the the message
WARNING, <filename> is infected with <virus name>!
Abort? (Y/n)
Press "N" to continue, press any other key to abort.
To display the name of the virus, TbScanX needs the signature file
again. It will automatically use the signature file that was used
when you invoked the program. If the signature file is missing
(because you deleted it, or because you removed the floppy with
it), or no file handles are left, TbScanX will still detect
viruses, but it is no longer able to display the name of the virus.
It will display [Name unknown] instead.
When TbScanX has been started from within the config.sys file (as a
device driver) it has added a character device with the name
"SCANX". When you sent data to this device the data will be scanned
for signatures. Try this:
copy testvir.com scanx /b
No file will be created with the name "scanx" but the input (the
contents of the file "testvir.com") will be scanned for viruses.
This way you can easy inspect any file (also the non-executables)
for the existence of virus signatures without the need to invoke a
special program. When the device "scanx" detects a signature in the
input it will simulate a DOS "write protect error".
Note that you have to specify the "/b" option. Otherwise DOS will
sent the characters to the device one by one. This consumes a lot
of time and of course, no signatures will be found in one byte
sequences!
REGISTERING
-----------
The unregistered version of TbScanX will prompt you to press a key
while starting up, except when you have a Thunderbyte add-on card
installed. To register TbScanX, see the register.doc file.
Only the registered version of TbScanX is able to make use of
expanded memory
Once registered, you can use all future versions of TbScanX for
free!
--> YOU DON'T HAVE TO REGISTER TBSCANX IF YOU USE IT IN A PC WITH A
THUNDERBYTE ADD-ON CARD INSTALLED!
FORMAT OF THE DATA FILE
-----------------------
The data file (called TBSCAN.DAT or VIRSCAN.DAT) can be read and/or
modified with every ASCII editor.
All lines beginning with ";" are comment lines. TbScanX ignores
these lines completely. When the ";" character is followed by a
percent-sign the remaining part of the line will be displayed on
the screen. A maximum of 15 lines can be printed on the screen.
Nice for "HOT NEWS"...
In the first line the name of a virus is expected. The second line
contains one or more of the next words:
BOOT SYS EXE COM HIGH LOW
These words may be separated by spaces, tabs or commas.
TbScanX will only scan for viruses with the keywords COM or EXE.
The other keywords will be ignored, and are only used by the
non-resident version: TBSCAN. Also note that TbScanX will not
distinguish between COM and EXE files. All executable files will be
scanned for both EXE and COM viruses. This saves some memory.
BOOT means that the virus is a bootsector virus. SYS, EXE and COM
indicate the virus can occur in files with these extensions. Also
overlay files (with the extension OV?) will be searched for EXE
viruses. HIGH shows that the virus can occur in the memory of your
PC, namely in the memory located above the TBSCAN program itself.
LOW means that the virus can occur in the memory of your PC, namely
in the memory located under the TBSCAN program itself.
In the third line the signature is expected in ASCII-HEX. Every
virus character is described by means of two characters. Instead
of two HEX characters, two question marks (the wild- card) may also
occur. The latter means that every byte on that position matches
the signature. Below you will find an example of a signature:
A5E623CB??CD21??83FF3E
You can also use the asterisk followed by an ASCII-HEX character to
skip a variable amount of bytes in the signature. The ASCII-HEX
character specifies the amount of bytes that should be skipped. The
signature could be:
A5E623CB*3CD2155??83FF3E
The next sequence of bytes will be recognised as a virus:
A5E623CB142434CD21554583FF3E
Instead of a signature in ASCII-HEX you can also specify a normal
text. This should be put between double quotation marks. A correct
signature is for example:
"I have got you!"
This series of three lines should be repeated for every virus.
Between all lines comment lines may occur.
LIMITATIONS
-----------
+ 128 Kb of free memory is needed to start the program.
(5 Kb of memory once installed in memory)
+ DOS version 3.0 or later is needed.
+ The size of the data file has a maximum of 64 Kb.
+ The name of a virus may consist of maximally 30 characters.
+ The ASCII-HEX signature can consist of maximally 80 characters.
+ Up to 500 different signatures may be given.
ERRORMESSAGES
-------------
Errormessages that can be displayed:
+ Not enough memory
There is not enough free memory.
+ Error in data line at line <number>.
There is an error in the specified line of the data file.
+ Limit exceeded.
The data file was too long or too many virus signatures
occur in it.
+ Data file not found.
TbScanX has not been able to find the data file.
SPECIAL VERSIONS
----------------
The file TBSCANX.COM is fully functional. However, we supplied two
special versions of TbScanX to be used with certain processor types. If
you use the special 286 or 386 version of TbScanX you will get the best
out of your processor concerning memory usage and speed. If you want to
use the 286 version of TbScanX, just rename the file TBSCANX.286 to
TBSCANX.COM. The same applies to the file TbScanX.386.
TBSCANX.COM: Universal version. Runs on all processor types.
Supports Windows 386-enhanced-mode.
Uses more memory and is somewhat slower compared to the
other versions.
TBSCANX.286: Runs on machines with a NEC-V20, NEC-V30, 80286, 80386
and 80486 processor.
Does NOT support Windows 386-enhanced-mode.
This version uses almost 100 bytes less compared to the
other versions and is somewhat faster.
TBSCANX.386: Runs on machines with a 80386 or 80486 type processor.
Supports Windows 386-enhanced-mode.
Uses less memory compared to the standard version, but
more than the 286 version due to the Windows support.
It is the fastest version available.
Programmers
-----------
If you are a software developer you can use TbScanX to check data for
viruses. A program can perform a self check as soon as it is invoked by
sending its code to TbScanX. A program that processes other programs or
parts of it (by example scramblers or executable file compressors)
should check the data for viruses before processing it.
High-level control
This method is most usefull for the so-called high level programming
languages and languages that lack the ability to generate interrupts.
Try to open the file "SCANX". If this file exists TBSCANX has been
invoked from within the config.sys and is active in the machine. Open
the file in the binairy mode. Write the data to be scanned to the
opened file. If the data contains a signature of a virus TbScanX
simulates a DOS "write protect error". If nothing happens and the data
is accepted no signature could be found in it.
Low-level control
This method is more complex, but offers more possibilities. If your
programming language supports issuing interrups you should be able to
use this method. This method also functions when TbScanX has not been
started as device driver but as a normal TSR.
The interface consist of some multiplex calls (int 2Fh). Register AH
should contain CAh. Register AL contains the function request number.
Supported function requests:
AL=0 InstallationCheck
Return value:
AL=0 TbScanX not installed
AL=FFh TbScanX installed
AL=1 GetStatus
Return value:
AL=0 TbScanX disabled
AL=1 TbScanX enabled
BX EMS_Handle. Null if no expanded memory in use.
CX Number of signatures that will be searched.
AL=2 SetStatus
AL=0 Disable TbScanX
AL=1 Enable TbScanX
Return value:
NONE
AL=3 ScanBuffer
DS:DX Address of buffer to scan.
CX Length of buffer to scan.
Return value:
No Carry flag set No signatures found in buffer.
Carry: Signature found in buffer!
DS:DX ASCIIZ-name of virus (null terminated)
Registers destroyed:
ALL, except CS,SS and SP.
The contents of the buffer remains unchanged.
Assembler example:
mov ah,0CAh ;Multiplex number
mov al,0
int 02Fh ;Installation check
cmp al,0FFh ;If AL=FFh TbScanX has been installed.
jne notinstalled ;Else TbScanX has not been installed.
lea dx,buffer ;Address of the buffer in DS:DX
mov cx,512 ;Length of our buffer
mov ah,0CAh ;Multiplex number
mov al,3
int 02Fh ;ScanBuffer
jnc notinfected ;No carry? Then no virus found!
call print ;Virus found. Print name DS:DX
notinfected:
push cs ;Restore register DS
pop ds ;TbScanX destroyed its contents
THUNDERBYTE
-----------
Virus scanners have a number of very serious disadvantages!
+ They cannot prevent infection. Virus scanners can only tell you
whether or not your system has been infected and if so, whether
any damage has already been done. By then only a good
(non-infected) backup can still save you.
+ They can only recognize viruses that have already been
identified. When a new virus has been launched it will take a
while before someone discovers it. After that it will take some
time before a reliable signature is dis- tilled from the virus
and it will also take a while for you to get hold of the newest
virscan.dat. All this means that there is a real chance that
your system is infected at a moment virus scanners have not
yet recognized "your" virus!
Viruses get more and more advanced. Among other things because of
all the attention the media is paying to the phenomenon computer
virus. It has even become a real sport for sick minds to write
computer viruses. Even viruses that have no stable signature
anymore have already been discovered. Because TBSCAN allows
wildcards in the data file it can still trace this kind of viruses
quite often. But it will not take much time anymore before viruses
will be created that have no special charac- teristics at all by
which they can be identified. And then even TBSCAN cannot help you
anymore. Even viruses that look for the DOS entry point in the same
way as TBSCAN does, avoi- ding detection by protection programs in
an effective way, already exist.
To provide programs with a checksum is neither a solution: as soon
as a file is read in, viruses can disinfect it, so every infected
program looks like one that is not.
There is however ONE solution for the abovementioned problems:
*** ThunderByte! ***
ThunderByte was developed to protect Personal Computers against
computer viruses, Trojan Horses and other threats to valuable data.
It is a hardware protection, consisting of an adapter card, an
installation and configuration program and a clear manual. The
working of ThunderByte is not based on knowledge of specific
viruses, so ThunderByte also protects against future viruses.
A hardware protection offers much more protection than a software
protection. ThunderByte is already active before the operating
system is loaded, so the computer will be totally protected right
after the starting of the PC.
Because of the many configuration possibilities and the intel-
ligent algorisms, the use of ThunderByte will never become a
burden: you will hardly notice the presence of ThunderByte in an
environment without any viruses.
Advantages of a hardware protection:
+ The protection uses very little (1Kb) RAM
+ The protection is already active before the first boot attempt
of the PC, and therefore protects also against bootsector
viruses. A software protection can not protect you against
bootsector viruses, since it has not been executed at boot
time.
+ De hard disks can not be accessed directly anymore, because
ThunderByte is connected to the hard disk cable.
+ It is impossible to forget to start ThunderByte, even if the
machine is booting with a diskette.
ThunderByte offers you many kinds of protection:
+ Protection against loss of data.
ThunderByte is connected between the cable of the hard disk and
the controller. It prevents the hard disk from being accessed
directly. The only way to access the drive from now on is by
initiating an int 13h.
In addition ThunderByte detects all direct disk writes which
try to achieve a modification or damage of the data and it
checks which program orders the execution of such operations.
Only the operating system can preform these operations
unmentioned.
Standard DOS already has the possibility of protecting files
against overwriting and modification by means of the read only
attribute. However this protection can be very easily
eliminated by software. But ThunderByte pre- vents this
protection from being ruled out without this being noticed, so
now it is nevertheless possible to protect your files
effectively with a standard method.
+ Protection against infection.
ThunderByte protects programs (files with the extension EXE,
COM or SYS) against infection by judging all modifi- cations on
their intention. The functionality is not influenced by this.
Compiling, linking, etc., are not disturbed and neither are
programs that save their confi- guration internally.
Furthermore software can be protec- ted with the help of the
aforementioned read only attribute.
Attempts to modify the bootsector of the disk are detected, so
the dreaded bootsector viruses are also eliminated. Keep in
mind that the bootsector can hardly be protected by software.
Only ThunderByte already beco- mes active before the system
tries to boot!
+ Detection of viruses.
In addition to the abovementioned ways of detecting the
presence of viruses, ThunderByte can also do so because viruses
carry out a number of special operations. For example, the
marking of already infected programs in order to recognize
them, is detected by ThunderByte. So are the attempts of
viruses to reside in the memory in a suspicious way and the
abnormal manipulations with interrupt vectors.
+ Password protection.
ThunderByte has the possibility of installing a password.
There are two kinds of passwords: one that is always asked for
or one that you only have to enter when attempts are made to
start from a diskette instead of the hard disk.
+ Safety.
A lot of attention has been paid to the safety of ThunderByte
The program code of ThunderByte is located in ROM and there is
no way it can be modified.
There is not one method of eliminating ThunderByte through
software. All the important settings are realized with the help
of dipswitches on the adapter card. And despite all their
wasted intelligence, viruses will never be able to turn
switches or to influence their read outs.
Viruses that approach the controller of the hard disk directly
will have a rude awakening: ThunderByte will only pass disk
writes when the write or format command has followed the normal
(checked) course.
There are a lot of different versions of ThunderByte
(functioning identically however) that are supplied on the
basis of capriciousness. That is why knowledge of the internal
working of only one ThunderByte system is not sufficient to
damage or destroy its protective working.
ThunderByte is constantly checking upon its own variables with
a kind of control number that is different for each version.
The positions of the memory where the variables are kept are
also different for each version.
+ Extra possibilities.
ThunderByte offers you some interesting bonuses, like booting
from drive B:.
CONCLUSION
----------
Are you surprised about the relative great effect and inventiveness
of such a small virusscan program? Get Thunderbyte and keep on
amazing yourself!
If you appreciate TbScanX or if it has already been of help in a
difficult situation:
Buy Thunderbyte, or register TbScanX
For more information you can contact:
ESaSS B.V. Tel: 31 - 80 - 787 771
P.o. box 1380 Fax: 31 - 80 - 777 327
6501 BJ Nijmegen Data: 31 - 85 - 212 395
The Netherlands (2:280/200 @fidonet)
TbScanX is written by Frans Veldman.
TbScan and the signature files are available on ESaSS / Thunderbyte
support BBS, Tel: 31-85-212395 (300/1200/2400 bps).
If you are running a electronic mail system, you can also
file-request TBSCAN to get the latest version of TBSCAN.COM,
TBSCANX to get the resident automatic version of TBSCANX, and
VIRUSSIG to obtain a copy of the latest update of the signature
file.