Sophos InterCheck Release Notes ------------------------------- Version 4.05, 9 November 1998 Contents -------- 1. Installation and upgrade 2. Modifications from version 4.04 3. New features in version 4 4. Known Problems 5. Compatibility issues 6. Acknowledgments 1. Installation and upgrade --------------------------- Version 4.05 of InterCheck requires: Sweep version 3.16 or above. Please consult the appropriate SWEEP manual for instructions on installing InterCheck. 2. Modifications from version 4.04 ---------------------------------- i. NEC PC-98 support enhanced ----------------------------- InterCheck 4.04 could not support NEC PC-98 machines properly because SWEEP for DOS 3.15 was not properly compatible with these machines. InterCheck 4.05 automatically inserts a command line qualifier when running SWEEP for DOS 3.16 in order to make SWEEP work properly with such machines. ii. Fatal error in ICSUPP95 resolved ------------------------------------ InterCheck 4.05 no longer causes illegal operation errors in ICSUPP95 when updating. This applies to upgrades TO InterCheck 4.05 and also to downgrades FROM InterCheck 4.05 to earlier versions. iii. New internal communications path ------------------------------------- The communications path between SWEEP for DOS and the InterCheck loader has been changed to eliminate a source of system lock up while doing the initial sweep. See section 5.i. 3. New features in version 4 ---------------------------- i. 'On-the-fly' disinfection ---------------------------- This version of InterCheck supports 'on-the-fly' disinfection for stand-alone Windows and Windows 95 InterCheck clients. This option is disabled by default. It can be enabled using the following configuration file options IN THE SWEEP VXD SECTIONS (see below): DisinfectDocuments=YES|NO When this option is enabled the Sweep VxD will try to disinfect Word/Excel viruses. DisinfectDisks=YES|NO When this option is enabled the Sweep VxD will try to disinfect boot sector viruses. For example, to enable both forms of disinfection for all users running Windows 95, use the following in INTERCHK.CFG: [SweepVxDW95Global] DisinfectDocuments=YES DisinfectDisks=YES These configuration options are only valid in the Sweep VxD configuration sections of the InterCheck configuration file. The Sweep VxD section identifiers are described later. All documents reported as having been disinfected should be reviewed to ensure that the virus made no changes to the content. Disinfection of boot sector viruses is not supported for NEC PC-9800 series machines. ii. New user Interface for Windows 95/98 InterCheck clients ----------------------------------------------------------- Windows 95/98 InterCheck clients have a new user interface. This is fully described in the manual supplement "Windows 95/98 InterCheck GUI" which is available in PDF format. iii. Novell IntraNetWare/Client32 support ----------------------------------------- InterCheck is now fully compatible with the Novell IntraNetWare client and the Novell NetWare Client32 network drivers for DOS, Windows and Windows 95. iv. Support for the NEC PC-9800 series computers ------------------------------------------------ The InterCheck for Windows 95/98 client has been modified to operate correctly on NEC PC-9800 series computers. However, not all the standard InterCheck functions are available; requesting authorisation messages are not displayed in full screen DOS boxes and InterCheck does not prevent a restart when an infected floppy disk has been left in the floppy drive. Disinfection of boot sector viruses is not supported for NEC PC-9800 series machines. At present, InterCheck 4.05 has been tested only on the following PC-9800 models: PC9821 La13 laptop with Windows 95 version 4.00.950B PC9821 Xa13 desktop with Windows 95 version 4.00.950A As more PC-9800 models are tested, they will be added to this list. For more information, contact Sophos or your local distributor. v. Automatic installation ------------------------- The iclogin program can now be used from a login script to automatically install the stand-alone Windows 95 InterCheck client on a workstation. This option is enabled using the '-9' command line option. For a description of how to use this feature please refer to the description of the iclogin '-a' option in the appropriate SWEEP manual. The '-a' option automatically installs the stand-alone Windows 3.x InterCheck client on a workstation. vi. Removing the networked Windows 95 InterCheck client ------------------------------------------------------- The networked Windows 95 InterCheck client installs an additional VxD (icstatic.vxd) on the workstation the first time the client is activated. Simply removing the central InterCheck installation from the server will not remove the locally installed VxD. The following command must be used to remove the VxD from the workstation: ICLOAD95 -remove Note: The VxD must be loaded very early in the computer’s boot sequence to ensure that the InterCheck client can correctly intercept all file activity. Therefore it cannot be started from the network. vii. Sweep VxD configuration file sections ------------------------------------------ The following section headers may be used in the InterCheck configuration file to pass information to the SWEEP VxD. [SweepVxDGlobal] [SweepVxDDOSGlobal] [SweepVxDW95Global] [SweepVxDWorkStation] [SweepVxDDOSWorkStation] [SweepVxDW95WorkStation] The distinctions between global and workstation specific sections, and between general, DOS specific, and Windows 95 specific sections are the same as for the InterCheck configuration section headers. viii. New configuration file options ------------------------------------ The following new InterCheck configuration options have been introduced: AllowRestartLater=YES|NO (Windows 95 ONLY) The first time that the Windows 95 InterCheck client is used on a workstation the computer must be restarted before InterCheck can provide protection from viruses. By default the computer is automatically restarted after a short delay. However, if AllowRestartLater is YES, InterCheck allows the user to restart the computer at a later time. AltCommsDir= This option is now supported by the Windows 95 InterCheck client. Please refer to the appropriate SWEEP manual for more information. CheckFloppyOnShutdown=YES|NO (Windows 95 ONLY) InterCheck normally checks the floppy disk in drive A: before allowing the computer to be shut down. This feature can be disabled by setting CheckFloppyOnShutDown to NO. PurgeChecksumsNow (Windows 95 ONLY) This option instructs the InterCheck loader to purge the checksums every time InterCheck is started. The option is designed to be used for a limited period after a virus incident in order to force InterCheck to re-sweep all files for viruses. RestartTimeout=