U.S. Department of Energy Computer Incident 
          Advisory Capability

MS-DOS Tools


NOTE: We obtain many of these tools from the SimTel archive, so if the pointer to an item appears to be bad, it is likely that a newer version of the tool has been placed there. If such is the case, you can connect directly to SimTel to find and download the file. Please let us know if a pointer no longer points to a valid file.

NOTE: The oak.oakland.edu site has discontinued their mirroring of the SimTel archive. The links are being updated to reflect this change.

Anti-virus Tools

AAVIRUS
ALERT!
ANSICHEK
Anti Virus Practice Lab
Antiviral Toolkit Pro
AUTOSCAN
Bomb Squad
BootChek
BOOTCOMP
CatchMtE
CheckMate
CheckOut
CHECKUP
CRC Check
CRCSET
CVIRPROT
Deform
DISKSECURE II
DLCHECK.BAT
DSII
EARLY Bird
ESDScan
File Defender Plus
Fix BSI
FileSafe
F-PROT
FixUtils
HTSCAN
Integrity Master
InVircible
KillMonk
Microsoft Macro Virus Tool >
NETShield (Netware)
NetZ Utilities
Overseer
ScanDay
The Scanner
SENTRY
THD ProScan
THE BRIDGE TERMINUS
THE DETECTIVE
THE VIRUS TERMINUS
ThunderBYTE Anti-Virus
Trojan Trap
VIRBAIT
Virex
Virus Detection System (VDS)
Virus Information Summary List (VSUM)
ViruSafe VDOC
VIRUSCAN
Viruschk
VirusNet PC
VirusNet LAN
VRU AV Testing
VSTE Scanner
WebScan

AAVIRUS

The AAVIRUS program checks the integrity of the DOS bootstrap system on a bootable disk against a checksum file created by the program at installation. The program is able to restore these bootstrap records should the disk become infected.

[Download]


ALERT!

The ALERT! software maintains a table of checksum and file information for sensitive files on the system and will alert the user whenever these files are modified.

[Download]


ANSICHEK

The ANSICHEK package is a set of programs designed to find hidden ANSI codes which could redefine the keyboard.

[Download]


Antiviral Toolkit Pro

The Antiviral Toolkit Pro (AVP) is an integrated antiviral package combining a scanner, a heuristic code analyzer, file extraction engines, and an antiviral TSR monitor.

[Download]


AUTOSCAN

AUTOSCAN will automatically search for viruses in archived files (ZIP, ARC, ICE, LZH, PAK or ARJ) using McAfee's SCAN program.

[Download]


Bomb Squad

The Bomb Squad package attempts to detect Trojan Horses in executable code by scanning for suspicious strings and intercepting calls to BIOS code.

[Download]


BootChek

The BootCheck package will detect changes to the boot sector of a disk.

[Download]


BOOTCOMP

BOOTCOMP compares the boot sector and partition table information on a disk with previously saved copies and will alert the user to any changes. When installed, the original BIOS interrupts are used to read the boot sector and partition table, defeating any virus which may be present.

[Download]


CatchMtE

CatchMtE is designed to recognize viral code based on the Mutation Engine distributed by Dark Avenger from Bulgaria.

[Download]


CheckMate

CheckMate is a detection tool for new and known file, boot, and partition table viruses. It is designed to augment the use of a good quality virus scanner.

[Download]


CheckOut

CheckOut is a virus protection program that is intended for use in environments in which many programs reside in archives such as ZIP or LZH. It breaks open each archive and calls ViruScan by McAfee Associates to check the components for infection. If desired, it can then repackage the archive in a different format.

[Download]


CHECKUP

CHECKUP detects viral infections by comparing target file sizes and incremental and cumulative cyclic redundancy checks (CRC's) to previously recorded baseline values, optionally stored on removable media. CHECKUP examines files first by separating them into randomly sized blocks of data, using dynamic block size allocation techniques that allow files as small as one byte to be accurately checked. CHECKUP then scans and compares every byte of the targe files on a block-by-block basis. If the recorded file sizes or any of the incremental or cumulative CRC comparisons do no match, CHECKUP alerts users that the target files have been modified.

[Download]


CRC Check

Generates and validates 32 bit checksums

[Download].


CRCSET

CRCSET is a package of Pascal and C routines that allow programs to verify their own integrity before execution and stop should a virus be detected.

[Download]


CVIRPROT

The CVIRPROT package consists of several programs designed to make C programs virus resistant. The programs do not actually prevent virus infection, but will alert the user that such an event has occurred. The technique works by embedding checksum values into the executable file. When the program is started, it checks itself against the values embedded when the file was first compiled.

[Download]


Deform

Deform is a free tool to remove the Form virus from infected systems.

[Download]


DISKSECURE II

DISKSECURE II replaces the Master Boot Record on a hard disk with its own code. The necessary elements of the original partition table are stored on an unused part of the disk and presented to the authenticated operating system as required. Unauthorized boot programs (such as the BRAIN, STONED, or AZUSA viruses) will not be able to access the partition table as expected.

[Download]


DLCHECK.BAT

DLCHECK.BAT is a batch file intended to automate the process of checking downloaded files for computer viruses.

[Download]


DSII

BIOS-level anti-virus with access control

[Download].


EARLY Bird

EARLY Bird will scan program files for OUT instructions or occurrences of the BIOS or DOS disk interrupts in an attempt to detect Trojan code.

[Download]


ESDScan

ESDScan will search files for appearances of user specified ASCII and HEX signatures.

[Download]


File Defender Plus

File protection driver

[Download].


Fix BSI

BIOS detection & recovery from BSI viruses

[Download].


FileSafe

Computer virus detection system

[Download].


F-PROT

The F-PROT anti-virus package consists of programs designed to detect virus signatures and stop viruses from infecting the system.

[Download]


FixUtils

FixUtils are a set of utility programs to repair the Master Boot Record, fix boot sectors, prevent floppy boots, andcheck for suspicious memory usage.

[Download]


HTSCAN

HTSCAN is a user programmable virus-scanner. It is designed to detect and identify known viruses within files, boot-sectors, master boot records, and memory. HTSCAN can scan floppy-disks, hard-disks, and network-drives.

[Download]


Integrity Master

Integrity Master is a high performance program offering virus protection, data integrity, security, CMOS protection, and change management all in one easy to use package. It detects hardware glitches, software bugs, and deliberate sabotage to data. If a virus strikes, Integrity Master identifies it by name and also identifies any damage caused by the virus. It will even detect new and unknown viruses.

[Download]


InVircible

InVircible is a virus detection and eradication system based on a rule-based expert system, integrity checker, and real-time memory monitor

[Download].


KillMonk

KillMonk will find and remove the Monkey and Int_10 viruses from hard disks and diskettes.

[Download]


Microsoft Macro Virus Detector

The macro virus detector is a macro detector for Microsoft Word version 6 or later. The detector scans for the Concept virus and installs a macro that scans every document you open with the File-Open command and displays a dialog box if the document contains a macro.

[Download]Download from CIAC

Microsoft's Macrovirus Information Pages (includes scanner download)

Macintosh versions of the tools


NETShield (NetWare)

McAfee's NETShield antivirus NLM for Novell NetWare.

[Download] NetShield v. 2.3.2 1/4 [Download] NetShield v. 2.3.2 2/4 [Download] NetShield v. 2.3.2 3/4 [Download] NetShield v. 2.3.2 4/4 [Download] Version 1.60 for NetWare 3.x
[Download] Version 1.60 for NetWare 4.x

McAfee Web Site


NetZ Utilities

NetZ's anti-virus utilities

[Download].


Overseer

Resident virus guardian system

[Download].


ScanDay

The ScanDay utility will automatically run the McAfee Associates' VIRUSCAN software on the first boot on selected days of the week.

[Download]


The Scanner

The Scanner anti-virus newsletter

[Download]Jan., 1995 issue
[Download]Mar., 1995 issue
[Download]Apr., 1995 issue


SENTRY

SENTRY detects virus infections by maintaining a set of checksums of executable files. SENTRY only checksums the beginnings of such files, allowing for significantly smaller scan times when run.

[Download]


THD ProScan

File/upload processor/convertor

[Download]DOS Version. [Download]OS/2 Version


THE BRIDGE TERMINUS

THE BRIDGE TERMINUS is a shell utility for ARC, LHARC, PAK, and PKZIP archivers. It will automatically perform virus detection during compression and extraction using McAfee's VIRUSCAN tool.

[Download]


THE DETECTIVE

THE DETECTIVE is a program for verifying the integrity of files on a system.

[Download]


THE VIRUS TERMINUS

THE VIRUS TERMINUS is a shell menu utility program for McAfee Associates anti-virus programs VIRUSCAN, CLEAN, and VALIDATE. VIRUS TERMINUS is menu driven and may be used with a mouse or keyboard. Program options may be toggled, reports may be viewed, printed, and merged, and virus fact sheets may be examined to obtain information on specific viruses.

[Download]


ThunderBYTE Anti-Virus

ThunderBYTE Anti-Virus (TBAV) is a toolkit designed to protect against and recover from computer viruses. It focuses on several methods to prevent a virus infection, but also includes programs to remove viruses that have managed to infect the system.

Thunderbyte Web Site


Trojan Trap

Trojan activity detector/protector

[Download].


VIRBAIT

This program notifies the user if it has been modified, presumably by a virus infection. Run periodically, it may alert the user to an infection before damage is done.

[Download]


Virex

The Virex package, by Datawatch Corporation, consists of the VPCScan and Virex programs. VPCScan will identify known viruses in memory and on disk and will repair infected files. VPCScan can also maintain a database of file checksums and detect changes to files. Virex is a TSR program that provides continuous virus protection against running infected or untested software.

[Download]


Virus Detection System (VDS)

VDS is an anti-virus package for IBM PC compatible computer running MSDOS 3.0 and higher. It contains a set of tools that offer detection and removal of PC viruses. Features include "decoy launching," active stealth boot sector virus detection, self-recovery, and real-time anti-virus monitoring to deal with both old and new viruses in an effective manner.

[Download]


VRU AV Testing

Virus Research Unit's antivirus scanner analysis

[Download].


VSTE Scanner

FreeWare Novell virus scanning and reporting

[Download].


Virus Information Summary List (VSUM)

Patricia Hoffman's Virus Information Summary. VSUM is a hypertext database of virus information.

[Download]


ViruSafe VDOC

ViruSafe VDOC by EliaShim is a shareware scanner to detect and remove all known word macro viruses. This version supports Office 97 and detects the first Office 97 Macro virus called "Bubba".

[Download]


VIRUSCAN

VIRUSCAN, from McAfee Associates, scans and removes viruses in the Master Boot Record, the DOS Boot Sector, and executable files on the system.

[Download] VIRUSCAN for DOS (manual install)
[Download] VIRUSCAN for DOS (self installing)
[Download] BootShield
[Download] Virus Shield TSR
[Download] VIRUSCAN for NT (command line)
[Download] VIRUSCAN for NT (GUI interface)
[Download] VIRUSCAN for Windows 3.1 1/2
[Download] VIRUSCAN for Windows 3.1 2/2
[Download] VIRUSCAN for Windows 95
[Download] VIRUSCAN for OS/2 (manual install)
[Download] VIRUSCAN for OS/2 (self installing)

McAfee Web Site


Viruschk

Viruschk is a "shell" or "watchdog" for McAfee's SCAN.EXE. If a virus condition is found, it will lock up the system and alert the user with loud tone and unmistakable screen.

[Download]


VirusNet PC

VirusNet provides virus protection and disaster recovery for PCs. This is an evaluation version.

[Download]
[Download]


VirusNet LAN

Provides fully automatic virus protection for several or hundreds of workstations. This is an evaluation version.

[Download]
[Download]


WebScan

McAfee's Virus protection for Web browser downloads and e-mail attached files. This is an evaluation version.

[Download] McAfee's WebScan 1/5
[Download] McAfee's WebScan 2/5
[Download] McAfee's WebScan 3/5
[Download] McAfee's WebScan 4/5
[Download] McAfee's WebScan 5/5

McAfee Web Site


[CIAC Home Page] [Disclaimer]
Last modified: Tuesday, 01-Apr-97 15:37:03 PST
CIAC / webmaster@ciac.llnl.gov