english documentation to program

---

---

written by

Zbigniew Trzcionkowski

Read all, please!

WatchDog is FREEWARE program
©2001-2002 by Zbigniew Trzcionkowski

[Description][Requirements][How it works][Parameters][Author]

DESCRIPTION

• checks memory for known viruses with xvs.library
• controlls memory with loads of internal routines
• keeps notification over S:startup-sequence and S:user-startup

REQUIREMENTS

HOW IT WORKS

• Harrier .A memory disabler for virus that probably was never released to the public
  
  
• Vaginitis memory detector for clones of Fungus/Vaginitis viri
  
  
• Checker with generic clean:
  
  tc_launch [seen in Beol viri...]
  
  tc_switch [seen in Beol viri...]
  
  pr_PktWait [seen in Beol viri...]
  
  mp_sigTask [seen in Smeg and penetrator viri...]
  
  overwritten $4EB9 opcode at some vital exec vectors [Illegal Access/HitchHiker4.11 infection scheme]
  
  
• Obsolete patch detector with removal:
  
  crm.library on (New)LoadSeg [can be used to hide other patches!]
  
  
• Change detector with generic clean-up or cold reboot:
  
  ColdCapture, CoolCapture, WarmCapture [rotfl, but these are tradition in virus killers...]
  
  KickTagPtr, KickMemPtr [still used by some legal tools]
  
  
• Change detector with easy restore:
  
  DoIO(), SendIO(), WaitIO() [bootblock and possibly cavity file infection...]
  
  ExitIntr(), Schedule(), Reschedule(), Dispatch(), Switch() [packet interception, core patches]
  
  PutMsg(),GetMsg(),ReplyMsg(),Wait(),WaitPort(),Signal() [packet interception]
  
  DebugEntry, DebugData, AlertData, LastAlert [classic virus selfrecog fields]
  
  execLibOpen(), execLibClose(), execLibExpunge() [new trend in virus selfrecogs]
  
  dosLibOpen(), dosLibClose(), dosLibExpunge() [these cannot be used to intercept anything but I have added them anyways...]
  
  Open(), Lock(), LoadSeg(), SetComment(), SetProtection(), Execute(), SystemTagList(), NewLoadSeg(), FilePart(), PathPart(), AddPart(), FindVar() [most popular/possible vectors in simple Open/Close based viruses like for example HappyNewYear and Elbereth series...]
  
  Close(), Read(), Write(), UnLock(), Examine() [most popular/possible vectors for 'on fly' infectors like for example NoName(212 bytes)]
  
  ExNext(), ExAll() [mass infection in BOBEK style or poor directory stealth...]
  
  
• Change detector only:
  
  ExNext call inside reqtools.library (under construction!) [BOBEK3 infection scheme!]
  
  return from Wait() pointer at volume's stack [SMEG2/HitchHiker5.00 infection scheme!]
  
  CallGV(), EndGV() and GlobalVector table [viruses for OS1.3 and older...]
  
  SysStackLower guard reports changes in last bytes of system stack. This area can be altered by very lame software including viruses (e.g. 212-bytes linkvirus) Note that this feature is rather somekind of debugger :-)
  
  

PARAMETERS

AUTHOR

Zbigniew Trzcionkowski
Astrow 7
43 250 Pawlowice
Poland