Copyright: Copyright (c) Michal Kovacic, 1993-95.
Citation: Copyright (c) Michal Kovacic, 1993-95. All rights reserved.


Index
 Lguard for Windows

Lguard for Windows is one program of the software package by ALWIL Software. Its primary purpose is to check your PC for presence of viruses. The program can either test selected areas of your system or to carry out periodic checks of all system areas.

Lguard belongs to that class of programs that can decide as to the presence or absence of viral infection on basis of prior knowledge of individual viruses. Thus an adequate protection of your valuable data is provided.

Basic information

•	Program installation

•	How does it work?

•	Program parameters

•	Program control

•	Virus definition files

•	Report files

History

•	Program versions

•	Origin of the program

Appendices

•	Removal of viruses

•	System requirements

•	Messages, warnings, errors and queries


 Program installation

Program is installed as the part of the program package AVAST! It is impossible to install Lguard as an individual program since the whole software package is supplied on distribution diskettes in a packed format.

The installation itself takes place in two separate steps. The first stage of the installation procedure install that part on AVAST! software package which runs under DOS environment. Then the user is prompted if the installation of the part of software that runs under Windows is desired. If the answer is affirmative the files necessary to operate the system in the Windows environment are unpacked to a hard disk as well.

The installation of the programs within Windows environment is accomplished by activating installation program SETUP.EXE, which is the standard part of the delivery and which is made ready by running the standard installation of AVAST! for DOS.

During this part of the installation procedure the program Lguard for Windows will be placed within Windows into a program group AVAST! created automatically by the installation software.


 How does it work?

Purpose of the program

The primary purpose of the program Lguard for Windows is to continuously monitor the system for the presence of viral infection. The program can be also used for the regular check-ups of the system or for the testing of the system upon explicit request by a user, without keeping the program active all the time.

The program itself is the modification of the original program Lguard for DOS implemented to run under the Windows environment. This implementation made possible to exploit all the advantages and improvements that Windows environment offers. On the other hand, the strict compatibility of the two programs (i. e. for DOS and for Windows) as to the number and kinds of viruses found when the two programs are run with identical parameters is maintained. The testing procedure is essentially the same, but the Lguard for Windows was implemented to make the maximum of the advantages offered by 80386 and better processors.

Operational procedure

Program Lguard for Windows after being activated reads the setup information left over from the last run and if this information commands the program to start automatic testing of the pre-selected system areas it will do so and it will assume the form of active icon to stay off the user's working area and not to interfere with whatever else is being done within the enviroment of Windows.

If the last run information reads anything else, the program will display its main window and waits for the instruction which areas of the system to test.

Influence on the system

The program is written in such a way as to reduce in a maximum possible way its interference with other activities of the computer. Only in the second plan were taken the considerations relative to the amount of memory taken and the size of the program itself. The program continuously monitors the activity of the mouse and that of the system. The idle periods detected by the program are exploited for the implementation of the program's action proper. Thus, the user remains practically unaware of the active antiviral program being present in the system and the slowing down of other applications run simultaneously is just negligible.


 Program parameters

The program Lguard for Windows, version 7.00 does not recognize any DOS command line parameters. If there are any parameters stated, it simply ignores them without any warning.

All the run parameters which the program needs to keep between its individual run sessions are recorded in the configuration file. Lguard for Windows uses only some of the parameters written in the configuration file. They are all written in the groups [LGUARD] and [LGW-Param].

Description of program parameters in individual groups

•	[LGUARD] group

•	[LGW-Param] group


 [LGUARD] group

[LGUARD] group of parameters comprises of the basic operational parameters that do not influence its configuration as such. They are mainly the parameters necessary for the communication of two consecutive instances of the same program and the information on where the last testing and of which type has been terminated.

The following parameters can be found in [LGUARD] group:

LastFile

The 'LastFile' variable contains the full specification of the file which was the last one tested. On repeated activation of the program the initial parameters will by set according to this information (drive and path for testing).

Continue

The 'Continue' variable can be set either to 0 or 1. If set to 1 the program will continue testing after finishing the test of a single system area (directory, memory, BOOT sector, etc.). If set to 0 the program will, after finishing the test of one individual system area, stop all further testing and the window of the program will close.

TestType

The 'TestType' variable brings the information on which area of the system was tested during the last run. The value of this parameter is integer from 0 to 3. 0 means the memory, 1 means the DPT (disk partition table), 2 means the BOOT sector of the disk specified by the variable 'LastFile' and 3 means directory specified in variable LastFile

Temp

The temporary variable 'Temp' enables to transfer the control to the first instance of the program if a multiple running of the program is attempted. This variable cannot be set from within the setup dialogue box.


 [LGW-Param] group

[LGW-Param] group contains the parameters important for preservation of information on the program setup during its two consecutive runs. It is not recommended to edit manually the parameters contained therein since this method does not rule out the possible introduction of confusing or contradictory set of parameters that could cause the loss of data.

The [LGW-Param] group contains the following parameters:

IdleTime

The 'IdleTime' sets the time interval in milliseconds during which the program will not operate after the last movement of mouse. During this period of time either the window or the icon will be supplemented by a message 'Waiting....'

ReportFileName

The ReportFileName variable determines the name of the REPORT file. The report file will be created in the directory which is determined by this variable an the name used will be the one, created automatically from the first three letters of the name stated in this variable and from five digits.

VirusFoundMessage

This variable contains the message which will be displayed on the screen when the virus is detected in the memory or when the first virus is found in a file. The message can be up to 1024 bytes long and the line feeds are substituted by '&&' characters.

FreeIdleTicks

The 'FreeIdleTicks' variable contains the number of unused clock-ticks (units of time of the Windows system) when Windows system stays in idle and waits for new command. Program Lguard will test one data block per each 'FreeIdleTicks'.

BlockSize

The 'BlockSize' variable represents the size of the block of data in bytes that must be tested without interruption. If set to 0 the tests will run on blocks of default size equal to 8192 bytes. If the size is set to more than 8192 bytes, the size will be set to the default size 8192 since to operate on larger blocks of data does not make any technical sense at present. During the testing of one individual block the Windows system is completely engaged and does not respond to any external or internal event. If the processor available belongs to the class of lower performance processors the size of the block tested at a single go must be reduced down to the values of about 16 to 32 bytes in order to prevent the testing procedures performed in the background becoming 'felt' and 'visible'. The values of block size set under 16 bytes will, on the other hand, put an excessive load of preparatory and service tasks on the system.

Editor

The 'Editor' variable contains the full name of the editor program with no name of the file to be edited appended. The name of the file is appended automatically by the program.

Viewer

The 'Viewer' variable contains the full name of the viewer program with no name of the file to be viewed appended. The name of the file is appended automatically by the program.

Flags

The 'Flags' variable contains the number representing the bit mask of individual program status variables. The setup of majority of these bits is of significance and therefore the manual editing of the variable contents may cause the program malfunction.

DefinitionFilename

This variable contains the full name of the file containing the user's definitions of individual viruses. The description of this file is to be found in a separate chapter of this manual.


 Program control

To control the program Lguard for Windows does not represent any potential difficulties since it is very similar to the standard manner of control of all other applications written for Windows environment. The program can be controlled by either mouse or keyboard. The procedures and control elements of the program correspond to the Windows standards.

Program control and individual element program functions:

•	Menu

•	Toolbar

•	Status bar

•	Dialogues

•	Mouse buttons

•	Windows


 Program menu

The pull-down menu of the Lguard program groups together all the supported functions into a single standard shape common to a great majority of all the applications operated in Windows environment. To control the menu from keyboard or by a mouse does not constitute any problem whatsoever.

The disabled items of the menu are displayed in grey colour. Accessibility of the individual items of the menu depends on the current status of the program.

The top level of the menu contains the following items:

•	File - used to open and close individual windows or to open setup dialog box.

•	View - turns on and off individual bars.

•	Window - allows operations with the displayed windows

•	Help - access to the help system


 File menu

The File menu contains the following items:

Open

This command displays the further embedded level of the menu and it is used to create one of several possible windows of the program. The number of windows created is limited only by the amount of available memory. The Report Window and the DEF Window use the external files and thus the number of simultaneously opened windows of this kind is determined by the rules valid for these external programs. As to the other windows, only one of each kind can be opened simultaneously.

Close

This command is used to close any active window opened by Lguard for Windows program. The windows controlled by the external editor or viewer cannot be closed in this manner.

Setup

This command is used to call the setup dialog box where the operating parameters of the program can be set.

Exit

This command is used to exit the current Lguard for Windows session. To do the same one can also use the Close command of the Windows system menu.


 View menu

Program Lguard for Windows is provided because of easier handling with a permanent display of two bars to give certain important information to the user. The bars are situated in parallel position with horizontal edges of the main window of the program. The toolbar may be located at the top edge of the window while the status bar is near the bottom edge.

The View menu contains the following items:

Toolbar

Status bar

By means of the view menu one can switch on and off the display of the two bars in question. If the item is marked, the item is displayed and vice versa.


 Window menu

Window menu item is not always necessarily displayed in the main menu. It becomes visible only in case the Lguard program contains at least one active window (except any external windows).

The Window menu contains the following items:

Cascade

This command displays the open windows in the cascaded manner, i. e.  one overlapping the other with just their top titles being visible.

Arrange icons

The command will arrange the minimized windows along the bottom edge of the main program window.

Window 1,2, ...

Activates the window selected.


 Help menu

The Help menu contains the following items:

Index

Offers the basic list of help items provided with the accessible help text (help table of contents)

About

Will display the brief information on authors of the program package, the copyright and the current version of the package.


 Toolbar

The toolbar is displayed at the top edge of the main window of the application just under the application's pull-down menu. The toolbar offers fast and comfortable access to the main functions of the program. All the functions accessible by means of the buttons of the toolbar can be also called by using the program pull-down menu but not all the functions accessible via the pull-down menu are implemented on the toolbar.

To switch the display of the toolbar on and off use the command View (Alt V, T). The toolbar can be displayed in two sizes. The program decides automatically which size to display depending on set resolution of the screen. For the greater ease of operation the larger buttons are used from the resolution 800 by 600 points.

The brief information on individual elements of the toolbar can be accessed by moving the mouse cursor to the element of interest and by clicking the right  button of the mouse. While the button is being held down the "bubble" help is displayed showing a brief explanation of the function of the element selected.

The individual buttons of the toolbar have the following functions::

 	Opening of new work window. Lguard for Windows will display the dialog box for the setting-up of parameters of this new window

 	Opening of the REPORT window

 	Opening of the DEF window

 	Opening of the window with the list of viruses found

 	Opening of the virus-list window

 	Setting-up of the program. Lguard for Windows displays the dialog box for setting-up of all the parameters of the program

 	Opening the box with Copyright information and the version of the definition file

 	The replacement of the cursor by another one, making possible the access to the context sensitive help related to the individual elements of the program


 Status bar

The program status bar of the Lguard for Windows program is displayed at the bottom edge of the main program window. It displays several important aspects of the program's execution under progress.

To switch the display of the status bar on and off use the command View (ALT V, S).

The left side of the status bar briefly describes the function of the menu item or of the tool bar button currently being selected. If browsing through the system of menu, this information is being continuously updated.

The brief information on the individual elements of the status bar can be gained by placing the mouse cursor on the element desired and to press the right button of the mouse. While the button is being held down the bubble help is being displayed showing a brief explanation of the function of the element selected.

Status bar displays the following parameters of the program:

1.	Number of files tested in all work windows

2.	Number of infected files found in all work windows

3.	Number of kinds of viruses detected in all work windows

4.	The percentage of the selected medium already tested in an active work window


 Program dialogues

The program dialogues of Lguard for Windows represent the independent windows displaying or prompting for the selection of a certain information. The purpose of the dialogues is different from item to item and therefore the corresponding window form also differs from case to case.

The program offers the following dialogues:

•	Area selection

•	Virus in file

•	Rename infected file

•	Setup

•	***Virus Found***

•	Copyright

•	Message, warning or error

•	Query


 Area selection

This dialogue is activated whenever the user requires to open new work window. The purpose of the dialog is to set-up basic parameters for the window in question. Only if this dialog is successfully completed the permission to open new window is granted and the selected area can undergo the test for the presence of a viral infection.

The dialog box offers the following control elements:

Test button

By pressing the button Test all the set-up parameters of the newly created window are transferred to internal data of the program. The dialog box is then deleted from the screen.

Cancel button

By pressing the button Cancel causes the cancellation of all the data created for the new window so far and the process of new active window creation is cancelled. The dialog box is then deleted from the screen.

Help button

The pressing of help button causes the activation of this page of help.

The dialog box offers the selection of the following parameters:

Begin with memory

Begin with DPT

Begin with BOOT Sector

Begin with files

These buttons enable the user to tell the program where to start testing in the first place when new window is activated. The items Begin with BOOT Sector and Begin with files obtain the more specific information on the area to be tested from the currently selected drive and directory.

The default value is Begin with files

Continue the cyclic tests

By marking this button the user tells the program that the tests should expand into other parts of the system as well, beginning, of course, with the area just selected. The order of repetitive testing sequence is following:

Memory - DPT - BOOT Sector of the drive C - files of the drive C - BOOT Sector of the drive D - files of the drive D - ......

and so on and so on. If the user selects the test of the specific directory, the disk contents will be tested from this directory onward and all the directories located in front of this selected directory will remain omitted without any message informing the user to this effect.

If this button remains unmarked, the active window will test just the selected area of the system and on completion of the tests the window will close automatically. The automatic closing of unused windows makes the program to work faster and it also makes more free memory available to those windows that remain active.

The default value is Unmarked

Test subdirectories only

This button makes possible to test just the part of the directory tree from the selected point downwards. After completion of the tests in the selected area the window will close down in a same way as in case of tests of an entire single area selected.


 Virus in file

The dialogue Virus in File is activated by pressing the left button of the mouse in the window containing the list of found viruses provided that the cursor of the mouse points on a file being really infected. The dialogue box then shows the name of the file together with the name of the virus it contains.

The Dialogue Box offers the following control elements

OK button

Pressing the button OK means immediate closing down of the dialogue box

Delete button

Pressing the Delete button means the immediate deleting of the file infected. This deletion is undoable and permanent. There is no "undo" in this case. Before the deletion takes place the program prompts for confirmation of the operation.

Rename button

Pressing the Rename button activates the dialogue box for renaming the file.

Help button

Pressing of the Help button causes the activation of this help page.


 Rename infected file

Dialogue box Rename infected file is activated by pressing the button Rename in the dialogue box Virus in file. The dialogue box facilitates the renaming or move the infected file to any currently accessible place.  The file is not deleted at its original location until the copy at the place of destination is created.

The dialogue box offers the following control elements:

OK button

Pressing the OK button results in change of the file's name. The user is not prompted to confirm the operation Rename. The Dialogue box is then deleted from the screen.

Cancel button

Pressing the button Cancel causes the cancellation of the dialogue box and the file remains at its original location under its original name.

Help button

Pressing of the Help button activates this page of help.


 Setup

This dialogue box serves the purpose of the setup of parameters for the Lguard for Windows program. The setup parameters are divided into several topical groups and this division is reflected by the individual parts of this setup dialogue box. The wrong setting-up of program parameters may devalue the performance of the whole program and therefore the setup procedure should be carried out very carefully.

The dialogue box offers the following control elements:

OK button

Pressing of the OK button causes the writing of all the parameters into the setting-up dialogue box and immediate setting-up of those parameters that can be setup at the moment. The dialogue box is then deleted from the screen.

Cancel button

Clicking the Cancel button invalidates all parameter changes in all parts of the setting-up dialogue box. The dialogue box is then deleted from the screen.

Help button

Pressing of the Help button activates this page of help.

The dialogue box for setting-up of program parameters contains also the new element of the user's interface which has been slowly becoming a standard of modern software for Windows. Lguard for Windows implements this control element by means of the VBX library which is the standard part of the software package delivery.

The Dialogue box offers the following parameters:

•	Areas/Parameters

•	Message

•	Special


 Areas / Parameters

This part of setup facilitates the display and setting of individual parts of the system that either have to be tested or have not to be tested and to setup more specifically the parameters of the testing of the selected parts of the system.

The dialogue box offers the following parameters:

Test memory

Marking of this button means that the memory will be tested within the range of linear addresses 0 though 0x10FFFF, representing the memory of the real mode operation (DOS, 1 MB) and HMA. If the program receives the command to test the memory and this button is mot marked the memory will not be tested. The program automatically generates the request for memory testing whenever the testing of the drive C: is to take place. At the start of the program the memory will be tested even in the case this button is not marked.

The default value is Marked

Test DPT

Marking of this button means that the disk partition table (DPT) will be tested. Since the size of the DPT table per each drive is 512 bytes the two tables for the two drives are tested simultaneously. If the system contains only a single drive the program detects this circumstance by itself and the work is done on a single table only. If the program receives the command to test DPT and this button is not marked the table will not be tested. The program automatically generates the request to test the DPT tables whenever the memory is tested or, if the test of the memory was omitted at the time it should have been tested anyway. In case the program finds it impossible to read and test the DPT table the error message is generated by the program and the work is continued by implementing the next step.

The default value is Marked

Test BOOT sectors

Marking of this button means that the BOOT sector of each drive will be tested except RAMdisks, CD-ROMs and network drives. If the program receives the command to test the BOOT sectors and this button is not marked the testing of BOOT sectors will not take place. The program automatically generates the request to test the BOOT sectors whenever the testing of the files on the drive in question are to be tested. In case the program finds it impossible to read and test the BOOT sector the error message is generated by the program and the work is continued by implementing the next step.

The default value is Marked

Test files

Marking of this button means that the files on the corresponding drives of the system will be tested. If the program receives the command to test files and this button is not marked the files will not be tested. The program tests the files on both local and remote drives which are currently accessible by the user. The names of drives the program recognizes are C: through Z:. The program ignores the

CD-ROM drives which are bypassed without any warning or message generated to this effect.

The default value is Marked

Test network files

This button serves the purpose of fast switching of the regime of network files testing. The program automatically detects the kind of drive the tested files are written on. Marking of this button means that if the files on local drives will be tested the files on remote drives will be tested too. If this button is not marked the files on remote drives will not be tested.

The default value is Marked.

Test SYSTEM files

Marking of this button means that the files with the attribute SYSTEM will be also tested. If this button is not marked the files with SYSTEM attribute will be ignored.

The default value is Marked

Test HIDDEN files

Marking of this button means that the files with the attribute HIDDEN will be also tested. If this button is not marked the files with HIDDEN attribute will be ignored.

The default value is Marked

Test all files

Marking of this button means that all files will be tested irrespective of their extension. If this button is not marked only the binary files with extensions COM, EXE, SYS, BIN and OV? will be tested.

The default value is Unmarked

Test entire files

Marking of this button means that the files will be tested trough their entire length. If this button is not marked the testing will take place only at the beginning and ends of the files in the length of 8192 bytes (8kB). If the tested file is the program of EXE or COM type the other area of additional testing will be in the region from where the program starts (from the value CS:IP found in the file's header).

The default value is Unmarked

Ignore virus selectivness

Marking of this button means that the presence of all the viruses will be tested in all the files regardless of the type of the file and the selectivness of the virus. If this button is not marked the files of the type EXE or COM will be tested on the presence only of those viruses which are capable to infect the files of this kind. The files of other types than EXE and COM are tested for the presence of both types of viruses.

The default value is Unmarked

Write REPORT file

Marking of this button means that a certain information will be written into the REPORT file. If this is the case, the information found in the REPORT file concerns the viruses found and some other important information including the statistical review of the testing done. If this button is not marked no information is written into the REPORT file.

Default value is Unmarked

Always create new REPORT

Marking of this button means that whenever the program starts or the setup of the program has been changed the new REPORT file is created. The name of the new report file is automatically generated by the program on basis of the name of the last report file to have been written into. If this button is not marked the written data are appended to the existing REPORT file.

The default value is Unmarked

REPORT uninfected files too

If this button is marked the program will write the tested and uninfected files into the REPORT file. If this button is not marked the uninfected files are not written into the REPORT file.

The default value is Unmarked

Work in background

Marking of this button means that the program will immediately after its start change itself into an icon. If this button is not marked the program will operate in the foreground as the standard window. The marking of the button has the influence on program start. During the run-time of the program the switching from foreground to background operation can be carried out without any limitations.

The default value is Unmarked


 Message

This part of the configuration window will allow displaying and setting of the message which will appear on finding a virus in memory or on occasion of the first virus encountered in the file system.

The dialogue box will display a choice of the following parameters:

Message on finding a virus

The editing window will contain an information which is to be displayed only if a virus has been found. The message is listed out in the case that it was a virus in memory or a virus in a some other area of the system tested. The message can be edited, and eventually totally rewritten by any other text. The text is displayed within the dialogue *** Virus found *** along with the area of its detection, and the name of the virus. The text will be displayed in the same form in which it has been entered into this window.

Its default value is "Virus found!!!"


 Special

This part of the configuration dialogue will allow for special parameters to be displayed, the ones that can essentially influence the activity of the program or that of the Windows system.

The dialogue box will display a choice of the following parameters:

REPORT file name

The editing window allows the name of the REPORT file to be specified. The program is spontaneously generating a new name according to further configuration parameters. From the value entered, only generating path, the first characters of the name, and extension of the file are effective. The remaining five characters are reserved for substitution by the program.

The default value is lgw.rpt.

Viewer

The editing window allowing for specification of the name of the program to be started up when you want to list out the REPORT file. The name has to be entered together with the list of the program parameters. The name of the REPORT file is not required, the program will use the current one.

The default value is Notepad.exe.

Editor

The editing window allowing for specification of the name of the program to be started up when you want to display or edit the file of user defined viruses. The name has to be entered together with the list of the program parameters. The name of the REPORT file is not required, the program will use the current one.

The default value is Notepad.exe.

Mouse button press idle

The editing window will allow for specification of how long the program is to be waiting after each move with a mouse. The program is monitoring the working performance of the user and will adapt its own operation accordingly, so that the user would be disturbed to a minimum extent. The length of the pause is given in milliseconds.

The default value is 1000.

Idle ticks

The editing window will allow to enter the rate of generating the message for testing in the event when the system is waiting for a user entry. If the Windows system is waiting for a user response and does not carry out any operations (inc. its own administration), the system event is called out periodically with ever its increasing number. If the Window system processes an event in an instant of time, this numbering is again generated form the value of 0 on. The number being entered on this occasion represents the count of event calls to be ignored. If the number of 0 is entered, the program will generate the message for testing each time when the Windows system becomes idle.

The default value is 3.

Block size

The editing window will allow for specifying the size of the block to be tested without any interrupt. The value is entered in bytes. This parameter is to eliminate the problems with pauses when the computer does not respond to any input of the user. The values around 16 should suit even the slowest systems, whereas the values over 512 are convenient for the systems controlled by the 486/66 processors or better. Decreasing the value of this parameter will result in slowing down the testing performance. The value of 0 implies that the entire block is tested simultaneously as it has been read in. Any non-zero value implies that this block will be tested part-by-part, with a maximum size specified just in this editing box.

The default value is 512.

Enable RESET

The designation of the button suggests that the user can RESET the computer. If this button remains unmarked, the user of the program has no right to RESET the computer by operating the RESET button within the *** Virus found *** dialogue, and each resetting attempt is followed by a warning. Obviously, the program cannot affect the activity of the hardware RESET or of the power switch in any way.

The default value is Unmarked.


 *** Virus found ***

The *** Virus found *** dialogue box will be displayed if the program comes upon a virus in memory or upon the first virus in files. The message that has been defined in the "Message on finding virus" dialogue will be displayed in the upper part, and in the lower part location details about the virus can be found.

The dialogue box will display a choice of the following elements:

OK button

Clicking the OK button will result in erasure of the dialogue from the screen.

Reset button

Clicking the Reset button will cause the computer reset if you are authorized to do so. In the opposite case a warning will appear reminding you of this fact and the Reset procedure will not be done. The dialogue box will be cleared from the screen.

Help button

On depressing this button a respective HELP page will be activated.


 About

The About dialogue box is designed for displaying information on copyrights, on versions of the programs, and the virus defition file.

The dialogue box provides the following choice of controls:

OK button

Depressing the OK button will result in erasure of the dialogue from the screen.

Help button

On depressing this button a respective HELP page will be activated.


 Message, warning or error

The dialogue box for displaying either message, warning, or error will be displayed as a program response to the event affecting operation of the program, the status of the entire system, or when the program has found out a circumstance which must be communicated to the user. The dialogue box will give a brief account of this event, not omitting the reaction of the program or suggestions for the user.

The operation of the program is suspended whilst this dialogue box is being displayed.

Individual types of this dialogue box differ in colour of the text as follows:

•	  Message	Black

•	  Warning	Blue

•	  Error	Dark red

•	  Fatal Error	Bright red

The dialogue box provides the following choice of controls:

OK button

The OK button will enable further operation of the program. This activity can take on various forms, according particular errors. The dialogue box will be erased from the screen.


 Query

The dialogue box for displaying the query will be displayed as program response to the event affecting operation of the program, the status of the entire system, or when the program has found out a circumstance which it cannot resolve within its own competence. The dialogue box will give a brief account of this event, not omitting the reaction of the program or suggestions for the user.

The operation of the program is suspended whilst this dialogue box is being displayed. Individual types of queries have various levels of urgency and differ in colour accordingly.

The dialogue box provides the following choice of controls:

Yes button

Depressing this Yes button will represent an affirmative reply to the query displayed within this dialogue box. The dialogue box will be erased from the screen.

No button

Depressing this No button will represent a negative reply to the query displayed within this dialogue box. The dialogue box will be erased from the screen.


 Mouse buttons

The mouse operation does not impose any special demands on the user familiar with the Window system operation, nor does it presuppose any prior knowledge of special procedures. All program components operate the same way like in any other Windows oriented programs.

The program is partially implementing a new element of the Windows system interface, i.e. the bubble help. That it could be displayed, the right button of the mouse has to be clicked whilst the cursor is pointing out to the toolbar.

Information on operation that is to be done after depressing one of the active buttons or after picking one of the menu items will be displayed on the Status bar.


 Program windows

The Lguard program for Windows will permit the other, child windows (using the MDI type interface) to be displayed in its main window. The individual windows of the program are of various types and can appear here several times or only once.

The windows of the Lguard program are of the following types:

•	Work window

•	Report window

•	DEF window

•	Found viruses window

•	Virus-list window


 Work window

The Work window of the Lguard for Windows forms the principal part of the program. It facilitates the activity itself, i.e. testing the selected parts of the system for the presence of viruses. The first working window is opened immediately upon start-up of the program and is assigned the number <1>. Each of the working windows is displaying the testing progress. The individual windows can simultaneously test both different and identical ares (although the testing of identical parts in the same moment has it sense only if you want to overload the processor).

Procedure on opening the work window:

The work window will be opened on the user requirement who will manifest it by picking the respective item from the menu or by depressing a button within the toolbar.

In generating this Work Window, the program has to set up an independent working area in its local data. It might happen that no enough memory is available to the problem in a given moment, and that the program fails to create these data. In such a case the program will advise this fact and cancel the user's requirement.

Further windows opening

On recognizing the requirement aimed at opening of the second or of any working window following in sequence the program will mark it with the first free number in sequence. The program will determine this number the way that it will search through the list of all working windows and then assign to the window the number first encountered as free. If, for example, the program makes use of three working windows, created one after the other, it will assign them the numbers 1, 2 and 3. But if the window 2 has been deleted (only windows 1 and 3 are active), the new window is then assigned the number 2.

All working windows are strictly independent on each other, although they share the same reference data for testing, the same configuration data for selection of items to be tested, and the same operating routines. The program is missing all means for intervention of one window with the internal data of the another one.

Window 1 meaning

The window 1 is generated quite spontaneously, without any user response, each time when the program is started. This is also the only moment when the working window is being constructed without any requirement for initial information from the user since these data will be taken over from the configuration file (e.g. the types of files to be tested, possible attributes, etc.).

If the program is to be closed by the window 1, the state of testing in this window will be written into the configuration file. The program will do this operation for every window numbered as 1 (even if it was at first closed and then reopened). No other window will put down its status upon its termination.

Only the window that has been created automatically during the start-up of the program is capable to continue in its work according to configuration data saved during the time of the last program termination.


 Report window

During the course of its operation, the Lguard program for Windows can record some important data about its activity into the so called REPORT file. This information can be visualized with the use of the predefined files viewer - the name of which can be set within the setup dialogue.

If you have predefined your editor as the viewer, set the command line parameters so that the file would be opened as a read only type. If you change the file during the course of testing, these modifications can lead to erroneous recording of further items or to a complete loss of information.


 DEF window

Upon processing the files with user viruses, any editor, available within the system, can be utilized, the setting of which can be carried out in one of the sections of the setup dialogue. The editor must have the capacity to record the file in the ASCII form without any formatting characters, i.e. the requirement met for example by the NOTEPAD.EXE program - included in the standard delivery of the Windows system. On raising the requirement on visualization or editing of the file with user definitions, the preset program will be activated and the preset parameter will be passed over to it along with the file with the user defined viruses, if there is any. This name will be stored in the SYSTEM.INI file residing in the Windows directory. The name of the file can be randomly chosen, provided that it satisfies the DOS standard conventions for defining the names of files.

If the file, that has been specified does not exist, it will be created without any notification of the user. If no file with user definitions has been specified, the LGUARD.DEF file will be created in the same directory as the virus definition file LGUARD.VPS - part of the standard delivery. The user will be informed on this file having been created.

The file with user definitions can contain any number of viruses definitions, if only the program NOTEPAD is capable of processing it. Its contents will be interpreted during the start-up of the Windows system, and its items, recognized by the program as applicable virus definitions will be incorporated into the database for all anti-virus programs of our provenance.


 Found viruses window

The window of the found viruses list will display all viruses that have been found since the start-up of the program, specifying also the location where the signatures of the respective virus were encountered. The number of viruses that can be displayed is limited only by the size of available memory but not by memory segmentation in the 16-bit Windows.

The click with the left button of the mouse on a line of the window where a virus is currently displayed will activate the dialogue box Virus in File providing for the inflicted file to be either renamed or deleted.

The windows visualizing the list of viruses found observe just a few simple rules:

1.	Only one window containing the list of revealed viruses can be displayed (as a normal window or as an icon).

2.	The contents of the window is continuously being updated according to how many and what kind of viruses has been detected in individual parts of the system tested. This restoring has been implemented as non-synchronous, so as far as the computer is fully used, the detected viruses need not be visualized in the window straight away.

3.	The contents of the window cannot be edited or updated in any form.


 Virus-list window

The windows will display the list of all viruses that can be detected by the Lguard program for Windows. The actual number can however be even higher because the list does not include modifications with identical names of viruses. Some statistics about the composition of the viruses database can also be found in the window.

The virus-list window observes just a few simple rules:

1.	Only one window containing the list of viruses can be displayed (as a normal window or as an icon).

2.	The contents of the window cannot be edited or updated in any form.

3.	The size of the window cannot be changed.

4.	On picking up one of the virus names, its brief account will appear at the bottom margin.


 Virus definition files

The AVAST! system is making use of the two virus definition files. The first of them, the LGUARD.VPS, is a binary file, actually a standard part of delivery. It contains definitions of all viruses known to the ALWIL Software on the program distribution day. The second is a user defined file that can be created and edited any time by any user, provided that the rules for its content are kept.

Individual files description:

•	LGUARD.VPS

•	LGUARD.DEF


VPS file
 LGUARD.VPS

The LGUARD.VPS file belongs to the standard delivery of the AVAST! system, and is any time available to the registered users of the AVS anti-virus service free of charge in the company's BBS.

It is a binary file containing the definitions of viruses known on the file distribution day. The file cannot be modified in any form, and all programs using it will check for its intactness. If the file has been modified or breached, it cannot be used for anti-virus testing.

The detailed description of the file composition is top confidential and cannot be available in any form.


DEF file
 LGUARD.DEF

For processing the file with user viruses, any editor available within the system can be used. This editor can be set in one section of the configuration dialogue. It must however produce a plain text without any formatting information. The program NOTEPAD.EXE, the part of the standard Windows delivery, is meeting the above requirements. Every time when the file with the user definitions has to be displayed or edited, the preset program will be activated and provided with preset parameters together with the virus user definitions file, if there is any. This name will be kept in the SYSTEM.INI file residing in the Windows directory. The file name can be chosen in random, but must meet the DOS naming conventions.

The file with user definitions can contain any number of viruses definitions, if only the program NOTEPAD is capable of processing them. Its contents will be interpreted during the start-up of the Windows system, and its items, recognized by the program as applicable virus definitions will be incorporated into the database shared among all anti-virus programs.

Interpretation of the user definitions file follow a few simple rules:

1.	Each definition of a virus consists of three rows, which can be separated from each other by any number of comments or invalid rows. A row is considered as a comment if its leading character is ';' (semicolon).

2.	The rows must have the following shape and must occur in the file in this order:

- Virus name (string not exceeding 29 characters in length).

- Virus symptoms (the string CERB of up to 4 characters).

C virus infects the COM type files

E virus infects the EXE type files

CE virus infects all files

R virus can be resident in memory

B virus infects the system areas of the disks

- Virus feature (the string of up to 64 characters,  each representing a hexadecimal number. Each number must have two digits, like e.g.: C646F8E98946).

3.	If a string is not valid, the program will continue its interpreting the file until a string is encountered, which could be taken as valid in the given position. Under certain circumstances, this feature might cause mixing up of several different virus definitions together. So we recommend that a proper attention should be devoted to the virus definition file.

4.	All too large number of user defined viruses or wrongly selected features might have a negative impact on program performance.


 Report files

The Lguard program for Windows is logging its step-by-step operation into the so called REPORT files. The locations of these files, as well as a base of their name can be set in the setup dialogue. It is also possible to determine whether the files with the symptoms of familiar viruses encountered by the Lguard for Windows will, or will not be logged into the REPORT file. These features can be further used when the resulting files are to be processed by additional programs.

The REPORT file is comprised of the 8-bit ASCII text without any control characters. The form of data and time expression depends on current setting of the Windows system. Each row is terminated by the end-of-line characters.

The beginning of valid records is defined by a heading, e.g. like this:

***** Lguard for Windows ver: 7.00

***** Message of: 25.12.1994

***** Actual time : 18:07:42

This heading is immediately followed by the list of files in the following form:

D:\VIRY\!4201.COM contains virus MGTU.

D:\VIRY\!4206.COM contains virus Liberty.

D:\VIRY\!4209.COM contains virus Monxla.

D:\VIRY\!4209.COM contains virus Vienna-583B.

At the conclusion of each area testing a table with comprehensive state of testing is placed. For example:

***** Number of infected files: 30

***** Number of viruses in memory: 0

***** Number of viruses in the BOOT sectors: 0

***** Number of files tested: 288

***** Number of known viruses: 3107


Version 7.00
 Program versions

The Lguard program for Windows forms in its version 7.00 a permanent component of the AVAST! system for Windows. Actually, it has been its part since the version 6.00, and the numbering of its version is the same as the numbering of the AVAST! system.

History of updates:

•	What's new in version 7.70

•	What's new in version 7.50

•	What's new in version 7.00

•	What's new in version 6.20


 What's new in version 7.70

The Lguard for Windows version 7.70 comprises the following changes against the version 7.50:

1.	Program works with different version of Virus Definition File.


 What's new in version 7.50

The Lguard for Windows version 7.50 comprises the following changes against the version 7.0:

1.	Program is able to detect polymorphic BOOT viruses.


 What's new in version 7.00

The Lguard for Windows version 7.00 comprises the following changes against the version 6.20:

1.	An program error used to be encountered during the work of the program with non-standard file names that could have been compiled via direct editing of the directory items. This is now corrected, since the program merely announces that it will not deal with it any more. This announcement is displayed in the form of a query if the testing should go on. If not, end the working window otherwise it will further run in it. The former error in accessing the wrong file has been corrected the same way.

2.	The program is implementing a time-dependent warning that the period of six months since the VPS definition file production date has already expired!!

3.	The program will process each n-th idle (see parameter setting) regardless of whether running in foreground or background.

4.	The program is implementing a mouse tracking, and on the basis of its results will suspend testing for a specified interval of time. While waiting, the program is displaying a message in the heading of the window or in the desriptor of the icon.

5.	The program is implementing the playback facility for the audio files that can be activated upon displaying the dialogue *** Virus found ***. The audio file definition can be set within the standard procedure making use of the control panel. The program is checking if the Windows system has the capacity to playback the audio module, and functions properly even when the last condition is not kept.

7.	The mode of how to display the date and the time is taken over from the configuration files of the Windows system.

8.	The work window is now ready to test a single directory tree.

9.	The bit parameters are not independently saved in the configuration file any more, but are gathered in the Flags variable.

10.	The Report file can be placed in any directory.

11.	The program has been compiled only for the processor 80386 or better.

Apart from the above the program contains some changes in operation of the user interface:

1.	The program is implementing its toolbar it two sizes. From the resolution of 800 x 600 pixels on, the buttons are larger.

2.	The program is implementing the so-called tab-dialogue for setting the program parameters.


 What's new in version 6.20

The Lguard for Windows version 6.20 comprises the following changes against the version 6.00:

1.	The program operates solely in the enhanced Windows mode. The modification has arisen through the 32-bit implementation of the testing algorithm in the form of the AWANTI.386 virtual driver. Upon its start, the program is searching for the presence of testing routines in memory, and in the event of their absence will terminate its activity with an error message.

2.	The program is further listing out the currently tested file. This change has been very positively reflected in the speed of the program performance.

3.	The program is making use of the external editor and viewer to edit or visualize some information. We have done this modification, as we consider useless to implement such features into a single program that have already been implemented (perhaps even better) into other programs so many times.

4.	The errors in identifying the RAM disks, then occasionally evoking unnecessary messages of the program, have been eliminated.

5.	Now the program is capable of recognizing the disk supported by the STACKER packing program, and in such a case ignores all changes in the BOOT sector of this disk. The Stacker is writing down its internal information to this sector in regular intervals and the program was incessantly reporting the changes of its contents.

6.	The program can delete or rename the infected file.

Apart from the above, the program contains some changes in operation of the user interface:

1.	The Work window has be updated, now displaying mere brief statistics about the state of testing.

2.	The configuration dialogue has undergone a change. Its size has exceeded all

reasonable	limits, and therefore it has been broken down into four independent

sections.	We feel that this action has fostered the things.

3.	Graphic element were used within the program, simulating the third dimension. Here the standard Microsoft library CTL3DV2.DDL is used.


 Origin of the program

The program Lguard for Windows derives its origin from the Lguard program for DOS which has been the part of the AVAST! system since the version 1.00. During its processing it makes use of the same internal algorithms of detecting the modifications of files, and thus the results, that can be seen during the work with the program itself or with its working files, are the same like those produced by the Lguard program for DOS.

The program has nearly the same features as its DOS oriented counterpart, except of several modifications.

1.	The program operates solely under the Windows system.

2.	The program does not include any packed file testing.


 Removal of viruses

According to many explorations, there are millions of computer users around the whole world who have already faced themselves with viruses, and so, unfortunately the likelihood is rather high that it can happen even to you, in spite of all preventive measures.

In this very moment, it is vital not to surrender to a panic, and to keep calm. Since you are certainly a user with a dislike for risks, you have surely backed up all important data and programs, so neither a complete destruction of your disk would mean any serious shock to you. Furthermore, you seem to be attentive and careful user, and so you have already disclosed the virus pretty timely, or, let us say, earlier than such a virus could have caused any significant damages. A virus can be revealed e.g. from unusual behaviour of the system (graphic or audio effects, unusual error messages, unknown activity of the disk, errors of programs having faultlessly operated until now, etc.), or through regular and careful application of the AVAST! anti-virus system.

Therefore, if you find any particularities that cannot be explained in any reasonable way (spontaneous changes in length and contents of a file, illegal manipulation with file, peculiar disk operations, changes in the main memory, etc.), the Lguard and Vguard programs have to be applied with the goal to find out the possible presence of a known virus within the system, the one these programs can cope with. The Lguard program ought to cope with prevailing majority of existing viruses. If any of these programs fail to find a virus, then try the Aguard program capable of catching all modifications on the disk since its last start-up. The program Aguard incorporates in itself even the capability of polling the updated file for viruses, and of removing them from the files. On removing them, no information about the type of the virus is required, and therefore it is very effective even against the new or the so far unknown viruses.

On removing the consequences of such an intrusion, insert a working floppy to the diskette unit of the computer, the one which has been created simultaneously with the AVAST! system installation, and which ought to be write protected. Then start the Lguard program, e.g.:

  A:

  LGUARD C:

The Lguard program is, at first, searching through the main memory for the presence of an active virus. If such a virus is found, it has to be eliminated from the memory and prevented from any further functioning. After the virus has been removed from the memory, there is no threat of its additional activity. The program will further check a system section of the disk, and thereafter the files as well. Eventually the program will generate and display an easy-to-view table with the outcomes of its activities.

Before removing a virus of an unknown type, the system has to be reloaded from a clean system diskette (if possible from the one that had been created during the installation of the AVAST! software). Through the Aguard program, all files having been illegally modified by a virus can be easily detected. The list of them can be printed out by the Print Screen command, or written to the disk through the "/O" parameter.

The programs of the AVAST! anti-virus file contain an intrinsic mechanism, allowing to find out their potential modification by a virus. On being started they are primarily testing if they themselves have not been modified, and if so, they will announce this fact to the user, for example like this:

  VGUARD.EXE

  WARNING: This program was modified (maybe by some virus ??) !!

  Press any key to continue...

This message serves as a notification that the program was modified. Its main

significance rests in the timely warning of a user. Upon depressing any key, the

program will continue its normal activity, but it is however likely, that the virus has already been activated in this moment.

On contracting the system areas of the hard disks with a virus, in the case of MS DOS from the version 5.0 on, the FDISK system program with the parameter  "/MBR" can be used because it will regenerate the state of system areas without any impact on data that might have been stored on the disk. But to do this, the computer has to be necessarily started up from the clean system disk, as otherwise the cure would be ineffective.

For protection of the BOOT sector, the program Bguard can be preferably used, by

which the state of the BOOT sectors on the hard disks can be restored.

We wish you to be widely avoided by computer viruses. But if they really do come up, then let our software help you overcome all problems associated with them.

If not absolutely sure how to cope, entrust the removal of viruses to professionals!!!


 System requirements

The program Lguard for Windows in its version 7.00 does not support real or

standard modes of the Windows. On the other hand, it does not require any special devices or software products.

Once being started, the program is allocating a part of the main memory which will be inaccessible to any other application until its termination. The size of this allocated memory can be roughly determined by adding the value of 64 KB to the length of the LGUARD.VPS file.

For operating the program Lguard for Windows the following is required:

1.	The AVAST! system version 7.00.

2.	Microsoft Windows 3.1, or Microsoft Windows 3.1 for WorkGroups operating in the enhanced mode. The program will not operate with Microsoft Windows NT or with Windows95 (Chicago).

3.	MS-DOS 3.3, or its more advanced version, or some other fully compatible operating system.

4.	A computer with the 80386sx processor or better.

5.	A memory for running the system in the enhanced mode.


List of messages, warnings, errors & queries
 List of messages, warnings, errors, and queries

The program Lguard for Windows is capable of displaying several warnings and error messages of various types in a range of different forms. Find below the list of them along with the details on their various alternative forms.

•	Work window number [%u]closed due to program error.

•	Unauthorized attempt to RESET computer.

•	REPORT file ANYFILE does not exist.

•	Your Virus Definition File is too old.

•	Nothing to test.

•	User Definition File not used.

•

•	Configuration file not saved.

•	Rewriting the REPORT file.

•	Error writing REPORT file .

•	Testing network files only.

•	File ANYFILE already deleted.

•	Rename file error.

•

•	Program can not create internal data.

•	Not enough memory.

•	Error displaying the data.

•	REPORT file open error.

•	Timer cannot be allocated.

•	Error reading the DPT.

•	Error reading BOOT sector on disk X.

•	File ANYFILE open error.

•	File ANYFILE write error.

•	Access denied to file ANYFILE.

•	File ANYFILE read error.

•	Not enough memory for requested operation.

•	Not enough memory.

•	Error creating file ANYFILE.

•	Error running program.

•	Error reading BOOT sector on drive ANYDISK.

•	Wrong area selection.

•

•	Global memory locking failed.

•	Program cannot use global memory.

•	Program cannot use global memory.

•	Can not allocate new program timer.

•	Virus Definition File is not in memory.

•	VxD fatal error number ANYNUMBER.

•	Polymorphic viruses testing error.

•	Enhanced mode detection error.

•

•	Should the CD-ROM disk be really tested?

•	Delete file ANYFILE?

•	File ANYFILE already exists.


MESSAGE1
Work window number [X] closed due to the program error. The error was specified by the previous error window.

The Lguard program for Windows was forced to close one of its work windows for the error preventing the program from continuing in the window being tested. The cause of this error was specified in the preceding message.


MESSAGE2
Unauthorized attempt to RESET computer. If you need this right, you must set the respective button in setup.

The right to reset computer can be either granted or withdrawn by means of a button in the setup dialogue. If you have the right and click the RESET button, there is no possibility to recall such a requirement, and the system will be reset on the next depressing the key. While the system is waiting for this depression of the button, its operation is suspended, and the unsaved data of the other programs cannot be saved on the disk.


MESSAGE3
REPORT file ANYFILE does not exist. Cannot open viewer window. If the REPORT file is required, you must set respective buttons and file name in setup.

The Lguard program has found out that the requirement for displaying the REPORT file cannot be realized, as this file does not exist.


MESSAGE4
Your Virus Definition File is too old. Ask about possible upgrade at your dealer.

The Lguard program for Windows cannot do its work without the virus definition file. If your file is older than six months, it is likely that this file will not be able to find the last novelties from the world of viruses. So contact your dealer and ask for upgrade of the AVAST! system.


MESSAGE5
Nothing to test. Setup of the program indicates that there's nothing to test. If you to test something, modify the parameter setting.

The Lguard program for Windows has found out that it has nothing else to test. Under these circumstances it would lack every sense to run the program.


MESSAGE6
User Definition File not used. User definition file is specified in SYSTEM.INI file and this one is not used now. Using OTHERFILE.

During the request for displaying the user defined virus file, the Lguard program for Windows has found out that this file is not currently in use and so far, actually does not exist.


WARNING1
Configuration file not saved. The program has detected an error when trying to save the modified parameters on the disk. Your changes are lost.

The Lguard program for Windows detected an error, when trying to save configuration data on the hard disk. The error has arisen either in the operating system or on the hard disk. The most likely source of this error seems to be insufficient space on the disk.


WARNING2
Rewriting the REPORT file. If you use an editor instead of the viewer, do not rewrite the contents of the REPORT file, as otherwise this action might collide with write operations of the Lguard.

If you use an editor for monitoring the contents of the REPORT File, there is a risk that through rewriting the file and saving these updates, the whole file will get lost.


WARNING3
Error writing REPORT file. When trying to write data into the REPORT file, the program has detected an error. Report mode is off. You may turn it on again, via setting the respective button in setup.

The Lguard program for Windows has detected a REPORT file write error, and therefore terminated its recording. The error has arisen either in the operating system or on the hard disk. The most likely source of this error seems to be insufficient space on the disk.


WARNING4
Testing network files only. The files within the network form a subset of accessible files. Files on the network cannot be tested while the file testing request is off.

If you want to test network files, the option of file testing must be on.


WARNING5
File ANYFILE already deleted. You cannot work with a file that does not exist. Even if you have deleted it by mistake, we are very sorry but the file is undoable lost.

The Lguard program for Windows, the same as most other programs cannot deal with file not present on the hard disk any more. If you have erased the file by the program Lguard for Windows, we are very sorry, since the erasing operation has been implemented very profoundly, so we are sure that you will not succeed in trying to restore the program.


WARNING6
Rename file error. The file cannot be renamed to its original name. The operation lacks its sense.

Wanting to rename the file while assigning it the same name, is not very reasonable operation. So the Lguard program for Windows will ignore it and remind the user of this fact.


ERROR1
Program can not create internal data. Some additional data are required for operation and there is not enough memory to create the data. Request cancelled.

For each work window, the Lguard program for Windows needs an area of the local memory. As this memory is strictly restricted within the 16-bit Windows but rather frequently used by this program there need not be enough of it every time. If the memory is not available, the program cannot create the work window.


ERROR2
Not enough memory. Request cancelled. Close one of program's windows and try again.

There is not enough free space in the local memory for the program. The executed

operation needs this memory that cannot be allocated.


ERROR3
Error displaying the data. The program cannot display the data for unknown reason. The window that has caused this error will be closed.

For some unknown reason, the program cannot display the data in one of the opened windows. The real origin of this error is still unknown but the error is so fatal that the program must have closed the window which had caused this error.


ERROR4
REPORT file open error. File REPORTFILE does not exist or you have no access permissions. It cannot be displayed.

In its attempt to open the window with the contents of the REPORT file, the Lguard program for Windows has detected an error. The file to be displayed either does not exist, or the access to it is blocked by some other running programs.


ERROR5
Timer cannot be allocated. Stop one of the running programs and try again.

The Lguard program for Windows needs the timer to be able to operate. The timer is one of the Windows resources. The number of the system timers is not unlimited, so a moment might occur when none of them is available.


ERROR6
Error reading the DPT. You can normally read the DPT quite freely, but on network disks or CD-ROM disks this facility is missing. There is also hardware or software preventing these areas on the disks from being read. DPT will not be tested.

There are some reasons why the Lguard program for Windows could not read the

contents of the hard disk partition table. The error has not arisen in the Lguard program for Windows.


ERROR7
Error reading BOOT sector on disk ANYDISK. You can normally read the BOOT sector quite freely. There is hardware or software preventing these areas on the disks form being read. BOOT sector will not be tested.

There are some reasons why the Lguard program for Windows could not read the BOOT sector of the hard disk or of a diskette. The error has not arisen in the Lguard program for Windows.


ERROR8
File ANYFILE open error. The program has detected an error when attempting to open the file. This file will not be tested. Continue?

The Lguard program for Windows cannot open the file for testing. The error has arisen in the operating system or on the hard disk. The most likely source of this error is the fact that the file has already been opened by some other program.


ERROR9
File ANYFILE write error.

The Lguard program for Windows cannot write the data into the file. The error has arisen in the operating system or on the hard disk. The most likely cause of this error is insufficient space on the disk.


ERROR10
Access denied to file ANYFILE.

The Lguard program for Windows cannot access the file. The error has arisen in the operating system or on the hard disk.


ERROR11
File ANYFILE read error. The program has detected an error when reading from the file.

The Lguard program for Windows has opened the file but cannot read from it. The error has arisen in the operating system or on the hard disk.


ERROR12
Not enough memory for requested operation. The program has not enough memory to create new window.

The program is lacking enough space in the local memory. The executed operation

needs this memory and cannot allocate it.


ERROR13
Not enough memory. Program cannot continue its work in the given configuration. Sorry to announce you that one of the working windows has been closed.

There is not enough space available to the program in the local memory. That the

program could keep working, so one of the windows had to be closed.


ERROR14
Error creating file ANYFILE. While attempting to create the required file, the program detected an error.

The Lguard program for Windows cannot write the data into the file. The error has arisen in the operating system or on the hard disk. The most likely cause of this error is insufficient space on the disk.


ERROR15
Error running program. Program ANYFILE cannot be run. Maybe, the program does not exist or you have not rights to access it.

The Lguard for Windows run the editor or the viewer to display some data via it. If the execution is unsuccessful, the program will report this error.


ERROR16
Error reading BOOT sector on drive ANYDISK. You can normally read the BOOT sectors of the diskettes quite freely. Make sure that a floppy is inserted in the drive and try to repeat the operation once again.

There are some reasons why the Lguard program for Windows could not read the BOOT sector of the hard disk or of a diskette. The error has not arisen in the Lguard program for Windows.


ERROR17
Wrong area selection. The BOOT sector of disk ANYDISK cannot be tested. Select another area to test.

The program is not capable to test the BOOT sectors of the network or of other special drives.


FATAL1
Global memory locking failed. Allocated global memory cannot be locked for the program. This is a fatal error which may cause a collapse of the Windows system.

For prevailing part of its operation, the Lguard program for Windows is allocating the global memory by means of Windows functions. If it does not succeed in this allocation, or detects an error in accessing to internal structures, it will signal this error.


FATAL2
Program cannot use global memory. There was an error upon initializing protected mode selector. This is a fatal error able to collapse the Windows system.

For prevailing part of its operation, the Lguard program for Windows is allocating the global memory by means of Windows functions. If it allocation attempt was unsuccessful, or error was detected in accessing the internal structures, the program will signal this error.


FATAL3
Program cannot use global memory. There was an error upon initializing protected mode selector. This is a fatal error being able to collapse the Windows system.

For prevailing part of its operation, the Lguard program for Windows is allocating the global memory by means of Windows functions. If it allocation attempt was unsuccessful, or error was detected in accessing the internal structures, the program will signal this error.


FATAL4
Can not allocate new program timer. This error occurred only after the original timer had been released so that the program cannot continue. This error cannot threaten the stability of the Windows system, but even then, the program has to be terminated.

The Lguard program for Windows cannot work with the timer. This error has arisen in the internal parts of the Windows system.


FATAL5
Virus definition file is not in memory. That the program might execute its processing, the AWANTI.386 library has to be loaded into memory during the start-up phase of Windows.

The Lguard program for Windows is, in the field of anti-virus tests, fully dependent on the AWANTI.386 32-bit library which must be resident in memory. If you have the AVAST! system correctly installed and this message is displayed, it is probable that in the moment of the Windows just being started, the prevailing majority of the main memory has been already allocated by some other programs (SMARTDRV, RAM disk, etc.)


FATAL6
VxD fatal error number ANYNUMBER. An error was encountered during the data testing. Its origin can be traced in the critical area, so we recommend to shut down Windows and restart it.

The Lguard program for Windows has detected an error in the module for anti-virus testing. Contact the ALWIL Software and consult the problem with a responsible staff member.


FATAL7
Polymorphic viruses testing error. The program cannot check the ANYFILE file for presence of polymorphic viruses for some unknown reason. The file will not be tested.

The Lguard program for Windows has detected an error in the module for anti-virus testing. Contact the ALWIL Software and consult the problem with a responsible staff member.


FATAL8
Enhanced mode detection error. The program cannot be executed in another mode. Terminate Window session and use 'WIN /3' command.

The Lguard program for Windows must run in the enhanced mode of the Windows

system. Consult the User Manual.


QUEST1
Are you sure? Are you really sure that you want to test the files on the CD-ROM disk? Of course, it is possible but you certainly know that this in not any quite usual requirement. Such a testing might take a very long time.

Meeting your requirement for testing the files on the CD-ROM disk might take a very long time. Is it really necessary to test the CD-ROM disk?


QUEST2
Delete file ANYFILE? If your reply is YES, the file will be undoable deleted. Unless you are absolutely sure, avoid this operation.

The erasure of a file by the Lguard program for Windows which is not undoable in any case. During erasure the file is at first being rewritten, and then, in this rewritten state, deleted.


QUEST3
File ANYFILE already exists. If you choose the reply YES, the existing file will be undoable rewritten.

If you create the file that already exists, the original data will get undoable lost and, moreover, the program Lguard for Windows will not save any backup copy.


POPUP=Bublinová nápovìda
Bubble help serves the purpose of determining the meaning of control and informing elements of the status bar and toolbar promptly. This system of the prompt help implemented within this program can be accessed via the right button on the mouse. If you are just pointing out to a control or particular informing element on either of the bars and click the right button of the mouse, the small window will appear whilst the button is depressed, giving a short account of the meaning of this button. This window will disappear just after the right button is released.

The work of the program is suspended whilst this help is on display.


POPUP=Alwil
The ALWIL Software company and its software products are no beginners in the market. The company itself was established not sooner than in April 1992, actually by separation from the ALWIL Cooperative, but its staff members have been working closely together since 1988 when the first version of the AVAST! anti-virus package came to being together with User Software Administrator SUP. In the same year the implementation of the national environment not only for IBM compatible PCs and their widely used peripheral units was created, but for the laser printers as well.

We still remain faithful to our original trend in the field of system software, data protection, and implementation of the national environment for laser printers. The last novelties of our production are, for example, the systems for real-time encrypting of the hard disk contents, or the Lguard program for Windows.

ALWIL Software

Prubezna 76

100 31  Praha 10

Tel (+42 2) 782 20 50

Fax (+42 2) 782 25 53

BBS (+42 2) 782 25 50

BBS (+42 2) 782 20 50 (6:00pm - 7:00am)

cc:Mail (+42 2) 782 2549


POPUP=VBX
VBX is an abbreviation for the Visual Basic Extension. Nowadays it designates dynamic libraries with precisely defined interface, implementing a part of the user interface.


POPUP=HMA
HMA is an abbreviation for the High Memory Area, what designates a memory partition sized 64 KB located just over the boundary of 1 MB.


POPUP=CDROM
CD-ROM as an external high capacity memory medium, which has been recently used for software or large volumes of data distribution.


POPUP=RAM disk
RAM disk is a memory, simulating the hard disk in the main memory of the computer. It is primarily used for storing either the temporary, or the work files.


POPUP=Atributy
The attributes of a file are bit-attributes giving further details about the type of this file. For more details on these attributes see the Operating System Manual.


POPUP=CSIP
CS:IP is the designation of the Intel processor registers and this combination gives an address in the program executed.


POPUP=Segmentace
Memory segmentation is a memory access technique, applicable when, in a given moment, only a limited area - the segment is available to the processor.


POPUP=BBS
BBS is an abbreviation of the Bulletin Board System, in other words a technique of electronic communication and data distribution.