VirusCheck 3.0

User's Manual

Copyright 1991-1993, Jon Freivald

All Rights Reserved

Overview:

Richard's Laws of Data Security:

1. Don't buy a computer.

2. If you do buy a computer, don't turn it on.

VirusCheck was designed for those of us who cannot adhere to Richard's laws.

What is VirusCheck?

VirusCheck is a watchdog, or security shell for McAfee Associates ViruScan anti-virus software. VirusCheck relieves users from needing to know the intricacies of their hardware and from having to sit and watch while ViruScan searches their system for the presence of viruses. It also allows Local Area Network (LAN) managers to enforce corporate anti-virus policies in a fully automated manner.

VirusCheck was originally designed to satisfy US Marine Corps security regulations, but has proved flexible enough to satisfy the requirements of many organizations and thousands of users worldwide. This manual is not intended to be taken as a statement of policy either by or for the US Marine Corps.

Who should use VirusCheck?

Anyone who uses an IBM PC or compatible computer system with MS or PC-DOS version 3.1 or higher as the operating system.

LAN managers who desire anti-virus security for their network or an automated method of enforcing corporate anti-virus policies.

What does VirusCheck do?

VirusCheck interrogates the system it is run on to determine its hardware configuration. After determining the proper configuration, VirusCheck executes McAfee's ViruScan in such a manner that the entire system gets checked for the presence of viruses. If ViruScan detects the presence of a virus, VirusCheck will lock the system and warn the user, thereby preventing the inadvertent spread of the virus from using an infected system.

System Requirements:

-	An IBM PC, XT, AT, PS/2 or 100% compatible computer.

-	MS or PC-DOS version 3.1 or higher.

-	400K free memory. (This requirement is primarily driven by McAfee's ViruScan and may change without notice!)

-	McAfee Associates ViruScan, minimum version 7.8V82. (While this is the minimum version, it is in no way current! As of this writing, version 9.17V106 is current.)

VirusCheck will detect and take advantage of:

-	A hard disk drive with one or more DOS partitions.

-	Extended, Expanded or XMS memory.

VirusCheck will detect:

-	Any DOS compatible Local Area Network file services that appear to the workstation as a block device (disk drive).

-	CD-ROM drives.

Features:

Although specifically tailored to the US Marine Corps security regulations, VirusCheck is being used by many individuals and civilian corporations worldwide. Numerous features have been added at the request of these users as well as the Marine Corps using community. All requests for new features will be considered as long as they do not contradict the security regulations that caused the birth of this program. A short list of features include:

-	Scanning can occur daily, weekly, or at an arbitrary interval of days.

-	The "warning" screen is both optional and customizable.

-	The "alert" screen is customizable.

-	High memory (extended or XMS) is automatically scanned on systems that have it.

-	Additional parameters can be passed to ViruScan as you see fit.

Distribution, License and Warranty:

Beginning with version 3.0, VirusCheck is now Shareware. Simply stated, this means that you are free to distribute VirusCheck as long as no fee is charged, and you are free to use VirusCheck for the purpose of evaluation prior to paying me for it. Any entity that is "in the business" of distributing software either electronically or on disk must obtain written permission from me prior to distributing VirusCheck. Electronic Bulletin Board Systems (BBS's) and File Transfer Protocol (FTP) sites are exempt from this restriction as long as there are no fees associated with downloading this program.

License is hereby granted for any person, corporation or other entity to use VirusCheck for an evaluation period not to exceed 90 days. Use of VirusCheck beyond this period will require registration. Registration is accomplished by printing and filling out the file register.doc included with the VirusCheck package and returning it with the appropriate fees to the address provided. Upon registration, you will receive a license to use VirusCheck on a permanent basis. Registration will also entitle you to technical support. Registering VirusCheck does not register McAfee's ViruScan - this must be done via the mechanisms established by McAfee Associates.

There are absolutely no warranties, either expressed or implied associated with the VirusCheck software package. It is entirely the user's responsibility to evaluate this product and determine suitability and fitness for use. I do not accept any liabilities that may stem from the use (or misuse) of this product. If you cannot agree to this warranty statement, you may not use my program.

Installation:

Installation of VirusCheck is quite simple, however, these instructions will assume some rudimentary DOS knowledge. If you do not understand these instructions, refer to your DOS manual, or ask a friend who is more knowledgeable about these things to help you. These instructions cover minimal installation. Additional instructions will be given as each optional feature is discussed.

-	Obtain the latest copy of McAfee Associates ViruScan. (The source you got VirusCheck from would be a good place to look.)

-	Create a directory named \SECURITY on your boot drive. (If you boot from a floppy, insure this is your working boot floppy. If you boot from your hard disk, this is usually drive C:.)

-	Copy both VirusCheck and ViruScan into the \SECURITY directory you just created. At an absolute minimum, VIRUSCHK.EXE and SCAN.EXE are required, although some features do require additional files.

-	Execute VIRUSCHK.EXE. This needs to be done to insure that your system is currently virus-free and that there are no unforeseen compatibility issues between VirusCheck, ViruScan, and your system.

-	Edit your AUTOEXEC.BAT file and add the line:

{boot drive}:\SECURITY\VIRUSCHK

to the beginning. This line should go before any other programs are run to insure the greatest degree of protection.

At this point, the basic installation is complete.

Note:	If you are upgrading from a prior version, you must manually delete C:\SECURITY\VIRUSCHK.COM or the new version will never run!

Configuring Optional Features:

Setting the Scan Interval

After performing the basic installation covered above, if you desire your system to be scanned on a daily basis, you are done. Optionally, if you boot from your hard disk, you can set the scan interval to any given weekday, or to an arbitrary period of days. (This feature does not work if you boot from a floppy or network drive, because VirusCheck will not date-stamp these devices.)

To set the interval to a specific weekday, edit your AUTOEXEC.BAT and give VirusCheck an argument of what day of the week you want the scan to occur. While these arguments are not case sensitive, they must be abbreviated exactly as in the following list: Mon Tue Wed Thu Fri Sat Sun.

To set the interval to an arbitrary period of days, edit your AUTOEXEC.BAT and give VirusCheck an argument of the number of days you want between scans. 0 (zero) is an invalid argument, and 7 (seven) is equivalent to weekly, but is not tied to any specific day of the week.

Examples:	\SECURITY\VIRUSCHK MON

\SECURITY\VIRUSCHK 30

Notes:	If the system is not booted on the day it is due for a scan, the scan will occur the next time the system is booted.

If your system does not have an internal clock/calendar, you should put the DOS "date" command in your AUTOEXEC.BAT prior to the line containing the VirusCheck command.

Post-run "warning" screen

Before exiting, VirusCheck will look for \SECURITY\WARNING. If this file exists, VirusCheck will display it's contents for 30 seconds or until a key is pressed. If it does not exist, VirusCheck will simply quit.

If used, WARNING should be an ASCII or ANSI file consisting of 24 or less lines of text. Although named WARNING, it can be a welcome screen, a help screen, or anything else you desire.

Customizing the "alert" screen

Any time that VirusCheck locks the system, an alert screen is displayed. VirusCheck has a generic built-in screen, but will also look for \SECURITY\ALERT, and if found, will display it instead of the built-in screen.

If used, ALERT should be an ASCII or ANSI text file containing 25 lines of text or less. I personally use it to give instructions on getting help -- i.e., my home system basically says "Turn off the computer and call Dad **NOW**!!", while the ALERT screen used on my LAN at work basically says "Call GySgt Freivald @ (516) 228-5635 **NOW**!". Use your imagination and it can be an effective tool.

To see either the built-in screen, or the current contents of ALERT as they will be displayed by VirusCheck, use the command:

viruschk display

You will need to press a key to be returned to DOS.

Passing additional parameters to ViruScan

Additional parameters may be passed to ViruScan by VirusCheck by including them in the file \SECURITY\VIRUSCHK.CFG. Prior to executing ViruScan, VirusCheck will check for the existence of this file, and if it exists, will pass the additional parameters contained in it to ViruScan. This feature allows you to modify the behavior of ViruScan as needed for your system, and also to take advantage of any new features that may be incorporated into ViruScan without waiting for me to produce a new version of VirusCheck.

The format of VIRUSCHK.CFG is a simple one line ASCII file containing arguments to ViruScan exactly as you would type them on the ViruScan command line. Additional lines can be used for comments, as only the first line is used by VirusCheck. As an example, the contents of my own VIRUSCHK.CFG is:

/a /fast /report c:\security\scan.rpt

/a = scan all files

/fast = no filenames printed for faster console i/o

/report = report results of scan to specified file

VirusCheck passes the first line to ViruScan, and the 2nd through 4th lines are my comments to myself so I remember why I used these options. You can pass ViruScan up to 80 characters of options via this file.

For an explanations of the command line passed to ViruScan by default, refer to the Technical Information section of this manual.

The ScanDate utility:

Included with the VirusCheck package is SCANDATE.EXE. The purpose of this utility is to decode the date-stamp left by VirusCheck and tell you when the last time the system was successfully scanned. This program does not need to be located in the \SECURITY directory, and you may prefer to put it in a directory that is in your DOS path.

ScanDate can also act as a trigger to VirusCheck by giving it a numerical parameter of the maximum allowable number of days between scans. As an example:

scandate 7

when run on a system that has been scanned in the last week will simply report the date of the last scan. If the same command is used on a system that has not been scanned in the last week, ScanDate will report the date of the last scan, and execute VirusCheck to perform a scan.

As a further example, my own personal AUTOEXEC.BAT file starts with the lines:

C:\UTILS\SCANDATE

C:\SECURITY\VIRUSCHK MON

In this manner, I get scanned every week on Monday, and get a report of when the last scan occurred every time I boot my system.

Lockups - VirusCheck's security mechanism:

Using a computer that is infected with a virus is a sure fire way to both spread the virus, and to allow the virus opportunity to perform whatever mischief it intends. The primary purpose of VirusCheck is to render an infected system unusable until the viral condition has been eradicated.

When VirusCheck locks a system, it first displays either the internal alert screen, or the contents of \SECURITY\ALERT, then clears interrupts and issues a processor halt. At this point, the system should be shut off until a clean, WRITE PROTECTED boot disk and appropriate anti-virus tools are on-hand to remedy the situation. As a matter of practice, the system should be turned off for a minimum of one minute before being booted from the clean boot disk (this allows all information in RAM to be lost, and your hard drive to spin down completely before being turned back on).

VirusCheck is an overly cautious program. While ideally VirusCheck will only ever lock your system due to the presence of a virus, there are a number of conditions that will cause a lockup that do not necessarily indicate the presence of a virus. These conditions include:

1.	If VirusCheck (VIRUSCHK.EXE) has been modified in any way, it will fail it's self-check. Modification indicates compression (such as pklite, lzexe, diet, etc.), tampering, a virus, or some other type of corruption.

2.	\SECURITY\SCAN.EXE could not be executed. This indicates either a corrupt ViruScan, or that something has taken over the DOS load and execute function.

3.	ViruScan found a virus (or viruses) on the system.

4.	ViruScan exited with an error code (see the Troubleshooting section below).

Any of the above conditions indicate that there may be a virus present on the system, or that the system could not be properly scanned. Again, VirusCheck will err on the side of caution and lock the system.

Troubleshooting

VirusCheck is designed to be used as painlessly as possible, and has been tested on a wide range of hardware and software configurations. This section addresses known incompatibilities and common problems.

Known Incompatibilities

1.	Central Point Anti-Virus.

Early versions of this product did not properly encrypt all of their scan strings on disk. ViruScan would detect these strings and "find" a virus, causing VirusCheck to lock the system over a false alarm. Current versions of this program seem to have corrected this situation.

Common Problems and Remedies

1.	VirusCheck gives an error message saying it is not properly configured, then reboots my system.

a.	ViruScan (SCAN.EXE) is not located in \SECURITY. ViruScan is specifically NOT executed via the path to prevent a copycat virus from planting a bogus ViruScan in the path and getting it executed instead of the legitimate ViruScan.

2.	ViruScan cannot execute - VirusCheck locks up my system - ViruScan will run when executed manually.

a.	Memory - Check the memory requirements stated in the ViruScan documentation for the version you have, then add 3K (3,072 bytes) to determine the minimum amount of free memory required to run VirusCheck. (As of ViruScan 9.17V106, the total memory requirement is 393K for both VirusCheck and ViruScan.)

b.	Version - the MINIMUM required version of ViruScan is 7.8V82. Any previous version will not operate under this version of VirusCheck.

c.	Parameters - if you utilize VIRUSCHK.CFG to pass additional parameters to ViruScan, they must be valid, as VirusCheck does absolutely no checking on the contents of this file and passes it verbatim to ViruScan. Improper parameters will confuse ViruScan, causing it to exit with an error code.

3.	My WARNING screen looks like a jumbled mess when it is displayed.

a.	You likely have an ANSI graphics screen and do not have the ANSI.SYS device driver loaded. Be sure that your CONFIG.SYS file contains a line something to the effect of "DEVICE=C:\DOS\ANSI.SYS". If not, add it (make sure you give the correct path to ANSI.SYS) and reboot your system.

Special Situations

1.	NDIS network drivers.

There is a conflict between the way ViruScan scans memory and the way NDIS network drivers load. Systems on which ViruScan has scanned memory will hang when NETBIND is executed. VirusCheck uses the presence of \LANMAN\PROTMAN.INI to determine if NDIS drivers are in use, and if so, suppresses the scanning of memory. While this is not the best answer, it is better than not being scanned at all.

2.	Mortice Kern Systems (MKS) Toolkit

The MKS Toolkit provides a number of ways to configure your system so that DOS's COMMAND.COM is not used at all as the command interpreter (Using "shell=c:\etc\init.exe" in CONFIG.SYS.). In these configurations, it is best to run VirusCheck from /etc/rc.ksh vice $HOME/profile.ksh, or it will get run every time you "login" instead of when the system is booted. The problem here is that COMSPEC is not set by the copy of the shell executing /etc/rc.ksh, so you must export it explicitly. An example from my own /etc/rc.ksh is:

export COMSPEC=c:/command.com

c:/usr/bin/scandate

c:/security/viruschk mon

Note that "COMSPEC" is upper case, while "c:/command.com" is lower case and there is no space on either side of the equal sign - it must be this way to work properly!

Technical Information

The following information is provided for those who desire to know a bit more about how the program works.

Parameters passed to ViruScan

By the very nature of the program, VirusCheck passes a number of parameters to ViruScan. There are three types of parameters: constant, variable, and configurable.

Constant parameters

The following is a list of the parameters are always passed to ViruScan with a brief explanation of their meaning:

a list of all the system drives (to include floppy drives if they contain a disk)

/M	"scan memory for all viruses" (This parameter is not passed if NDIS drivers are detected.)

/NOPAUSE	"do not pause if screen is filled with output"

Variable parameters

The following parameters are passed dependant on runtime conditions:

/CHKHI	if an 80286 or higher processor was found and extended or XMS memory was detected, but not if NDIS drivers are detected

/NOBREAK	if the VirusCheck date-stamp was either not found, or it is older than the current system date (this prevents aborting the scan if it is the first one of the day - subsequent scans on the same day can be aborted with Ctrl-C or Ctrl-Break after ViruScan starts executing)

Variable parameters

Any valid parameter can be passed to ViruScan via the VIRUSCHK.CFG file. Refer to Passing additional parameters to ViruScan above.

DOS Errorlevel Exit Codes

VirusCheck sets the DOS errorlevel upon exit. You can use the DOS batch command IF ERRORLEVEL to check these codes and take conditional action if desired. The following is a list of the codes and their meaning:

0	VirusCheck ran uninterrupted to completion, displayed \SECURITY\WARNING, and the 30 second delay was not interrupted.

1	A keystroke was pressed to terminate the 30 second delay.

2	The file \SECURITY\WARNING was not found, therefore no display or delay.

3	\SECURITY\WARNING was present, but VirusCheck was unable to display it.

100	You have errantly obtained a copy of the program that does not have the anti-virus information imbedded in it. This copy will not run.

101	Improper configuration. The most probable cause for this error is ViruScan not being found in \SECURITY.

102	Invalid COMSPEC environment variable. VirusCheck was unable to determine the boot device.

103	There was insufficient memory to perform the self-check.

104	An error (other than invalid CRC) occurred during the self-check.

255	The DOS version is less than 3.1. VirusCheck requires version 3.1 as a minimum.

Networks and the Enforcer

Being a Network Administrator myself, I am very used to users doing what they wanted on "their" PC's. This has on many occasions included disabling or removing the anti-virus software installed on their systems.

The Enforcer is a utility that works hand in hand with VirusCheck to insure that all systems that are accessing a Local Area Network have been scanned for viruses prior to being allowed access to the LAN.

Due to the many variations in Network Operating Systems (NOS), this section of the documentation must be somewhat vague. You will need to make appropriate modifications per your NOS. If you don't see your NOS listed, I would like to add support for it if you can provide me with sufficient information to do it properly and to do the testing for me.

All Versions

The Enforcer is designed to be incorporated in the login process for the users of the LAN. It will verify that VirusCheck is installed on the workstation, and that it has been run successfully within an allowed period of time. If VirusCheck is not installed, or has not been run recently enough, Enforcer will disallow access to the LAN. (Refer to the appropriate version for the specific method used to disallow access.)

Copy the Enforcer to a network file service that all users share. If within the capabilities of your NOS, set the attributes on it to read/execute access only.

Add the Enforcer to the appropriate profile, script or batch file(s) to insure that it will be executed by all users as they login to the network.

The Enforcer MUST be given one parameter. This parameter determines whether to allow weekly scanning, force daily scanning, or to set an arbitrary maximum number of days between scans. The parameters are either the letter "d" for daily scanning required, the letter "w" to allow weekly scanning, or a numeric value of the number of days to be allowed between scans.

If the workstation has VirusCheck installed, and it has been run within the required period, Enforcer's operation will be completely transparent to the user. On a quick system, the delay while Enforcer verifies the workstation will almost be too short to notice, while on a slow machine it is not intolerable (less than 10 seconds on a 4.77mhz PC/XT on 10Base2 Ethernet).

If VirusCheck is not found, or if it has not been successfully run in the required time period, the user is given an error message and disallowed access to the network. The error messages all inform the user that using the VirusCheck/ViruScan combination is required to access the network, as well as specific messages. The error messages and their meaning are:

Improper parameters, contact your system administrator for configuration!

Most likely, the parameter given to Enforcer was not the required "w", "d", or a non-zero integer value. If this is not the case, please contact me for tech support.

VirusCheck/ViruScan combination not found!

If you don't have them installed, you can't have run them!!

Exactly what it says - using the Enforcer requires both ViruScan and VirusCheck (SCAN.EXE and VIRUSCHK.EXE) to reside in the \SECURITY directory.

VirusCheck/ViruScan have not been run in the past week!

You are allowing weekly scanning ("w" parameter), but this workstation has not been scanned in the last 7 days.

VirusCheck/ViruScan have not been run today!

You are disallowing weekly scanning ("d" parameter) and this workstation has not been scanned today.

You have exceeded the length of time for mandatory scanning!

You have set an arbitrary value (a numeric parameter) that the user has exceeded.

This program has encountered an internal error!

Contact your system administrator!

Exactly what it says - you should (fingers crossed here...) never see this error. If you do, contact me ASAP for tech support.

Upon receiving the error message, the user will be disallowed access to the network. The following sections specify the different methods used between versions.

Generic Version

(ENFALL.EXE)

This version will work with ALL networks. After showing the user the error message, it waits for a keypress. Upon receiving the keypress, the program issues a hard reset (cold boot).

This version can be run either from a network file service or from a local hard disk.

Banyan Vines Version

(ENFBAN.EXE)

The program executes Z:\LOGOUT, then gives the user the error message and waits for a keypress.

If the user has exceeded the time limit for scanning (VirusCheck is properly installed), upon receiving a keypress, VirusCheck will be executed. If VirusCheck runs successfully, all memory will be released and Z:\LOGIN will be executed, returning the user to the login screen.

Banyan Vines Remote Version

(ENFBANR.EXE)

Designed for dial-up users. In an effort to reduce the large amounts of time required to load programs across the phone line (and due to the fact that access to Z: is lost after logout is executed), ENFBANR.EXE is identical to ENFBAN.EXE with two exceptions:

1.	It is intended to be executed off the user's local hard disk.

2.	Both LOGOUT and LOGIN are executed via the path instead of explicitly from the Z: drive.

Obtaining Support

Support can be obtained via US Mail, E-Mail or by telephone. When calling, please note that this is Eastern Standard Time and Daylight Savings Time is observed.

Jon Freivald

269 Mitchel Ave

East Meadow, NY 11554

(516) 483-7968 (evenings/weekends)

or

Commanding Officer

HQ, 1st Marine Corps District

605 Stewart Avenue

Garden City, NY 11530

ATTN: GySgt Freivald

(516) 228-5635

or

BBS	D	(516) 483-5841 (8,n,1 - 300-9600V.32)

InterNet	D	jaf@jaflrn.linet.org

Prodigy	W	ktfp55a

CompuServe	W	70274,666 or >INTERNET:jaf@jaflrn.linet.org

MCDN	WD	bk1md4:gisnad05

*	Frequency checked: D = daily, WD = every weekday, W = weekly, M = monthly

and

There is an InterNet mailing list for the discussion of VirusCheck. To join, send mail to "mail-server@jaflrn.linet.org" containing the text "subscribe VCSup-L".

When requesting support, execute the command "VIRUSCHK DEBUG" and include in your report both the version and the revision number.

Bug reports and problems will be handled as quickly as possible. Requests for additional features or custom versions will be considered on a case by case basis.

Thanks are due!

As with any project of this length, it would have been much longer and more difficult without dedicated users who believed in the product, critics, mentors and beta testers. Although any attempt to thank everyone would overlook someone, I will take the space to thank a few of the people who were instrumental in the development of VirusCheck. The persons listed below offered encouragement, made suggestions, provided references or code samples, put up with the bugs in my test code, identified specific problems or bugs, been overly patient with me (this has been an 18 month project between work and other commitments), and have been an encouragement to me.

My special thanks to:

My wife Kandy (for putting up with me throughout!)

Walter Malskis

Jesse Chisolm

Trevor Wright

Steve Ritacco

Tim Millis

Ed Guzis

Aryeh Goretsky

Theresa Schroat