Copyright: Copyright (c) Michal Kovacic, 1994-94.
Citation: Copyright (c) Michal Kovacic, 1994-95. All rights reserved.


Index
 Sguard for Windows

Sguard for Windows is program used for fast file-checking. It is generally used for fast control of the most used (mainly system) files, e.g. IO.SYS, MSDOS.SYS, COMMAND.COM or WIN.COM. Program is not limited for use only with files listed above and you could include any file.

Basic information

•	Program installation

•	How does it work?

•	Program parameters

•	Program control

History

•	Version 7.70

•	Version 7.50

•	Version 7.0

•	Origin of the program

Appendices

•	Removal of viruses

•	System requirements

•	Messages, warnings, errors and queries


 Program installation

Program is installed as the part of the program package AVAST! It is impossible to install Sguard as an individual program since the whole software package is supplied on distribution diskettes in a packed format.

The installation itself takes place in two separate steps. The first stage of the installation procedure install that part on AVAST! software package which runs under DOS environment. Then the user is prompted if the installation of the part of software that runs under Windows is desired. If the answer is affirmative the files necessary to operate the system in the Windows environment are unpacked to a hard disk as well.

The installation of the programs within Windows environment is accomplished by activating installation program SETUP.EXE, which is the standard part of the delivery and which is made ready by running the standard installation of AVAST! for DOS.

During this part of the installation procedure the program Sguard for Windows will be placed within Windows into a program group AVAST! created automatically by the installation software and in the Startup group.


 How does it work?

Principle of work is very easy. Program reads in files listed at command line or in configuration file, computes their checksums and compares them with pre-computed values listed in configuration file or on command line.

Program is able to work in command line mode or in interactive mode, where you could enter names of checked files in a dialogue box.


 Program parameters

Sguard for Windows is able to work with several parameters on command-line and one special parameter. Unknown parameters are ignored without any error message. Missing files are ignored too.

Parameters

•	Command-line parameters

•	Special parameters

•	Configuration file


 Program control

To control the program Sguard for Windows does not represent any potential difficulties since it is very similar to the standard manner of control of all other applications written for Windows environment. The program can be controlled by either mouse or keyboard. The procedures and control elements of the program correspond to the Windows standards.

The program offers the following dialogues:

•	FileOpen dialogue

•	Error dialogue

•	Query dialogue


 Removal of viruses

According to many explorations, there are millions of computer users around the whole world who have already faced themselves with viruses, and so, unfortunately the likelihood is rather high that it can happen even to you, in spite of all preventive measures.

In this very moment, it is vital not to surrender to a panic, and to keep calm. Since you are certainly a user with a dislike for risks, you have surely backed up all important data and programs, so neither a complete destruction of your disk would mean any serious shock to you. Furthermore, you seem to be attentive and careful user, and so you have already disclosed the virus pretty timely, or, let us say, earlier than such a virus could have caused any significant damages. A virus can be revealed e.g. from unusual behaviour of the system (graphic or audio effects, unusual error messages, unknown activity of the disk, errors of programs having faultlessly operated until now, etc.), or through regular and careful application of the AVAST! anti-virus system.

Therefore, if you find any particularities that cannot be explained in any reasonable way (spontaneous changes in length and contents of a file, illegal manipulation with file, peculiar disk operations, changes in the main memory, etc.), the Lguard and Vguard programs have to be applied with the goal to find out the possible presence of a known virus within the system, the one these programs can cope with. The Lguard program ought to cope with prevailing majority of existing viruses. If any of these programs fail to find a virus, then try the Aguard program capable of catching all modifications on the disk since its last start-up. The program Aguard incorporates in itself even the capability of polling the updated file for viruses, and of removing them from the files. On removing them, no information about the type of the virus is required, and therefore it is very effective even against the new or the so far unknown viruses.

On removing the consequences of such an intrusion, insert a working floppy to the diskette unit of the computer, the one which has been created simultaneously with the AVAST! system installation, and which ought to be write protected. Then start the Lguard program, e.g.:

  A:

  LGUARD C:

The Lguard program is, at first, searching through the main memory for the presence of an active virus. If such a virus is found, it has to be eliminated from the memory and prevented from any further functioning. After the virus has been removed from the memory, there is no threat of its additional activity. The program will further check a system section of the disk, and thereafter the files as well. Eventually the program will generate and display an easy-to-view table with the outcomes of its activities.

Before removing a virus of an unknown type, the system has to be reloaded from a clean system diskette (if possible from the one that had been created during the installation of the AVAST! software). Through the Aguard program, all files having been illegally modified by a virus can be easily detected. The list of them can be printed out by the Print Screen command, or written to the disk through the "/O" parameter.

The programs of the AVAST! anti-virus file contain an intrinsic mechanism, allowing to find out their potential modification by a virus. On being started they are primarily testing if they themselves have not been modified, and if so, they will announce this fact to the user, for example like this:

  VGUARD.EXE

  WARNING: This program was modified (maybe by some virus ??) !!

  Press any key to continue...

This message serves as a notification that the program was modified. Its main significance rests in the timely warning of a user. Upon depressing any key, the program will continue its normal activity, but it is however likely, that the virus has already been activated in this moment.

On contracting the system areas of the hard disks with a virus, in the case of MS DOS from the version 5.0 on, the FDISK system program with the parameter "/MBR" can be used because it will regenerate the state of system areas without any impact on data that might have been stored on the disk. But to do this, the computer has to be necessarily started up from the clean system disk, as otherwise the cure would be ineffective.

For protection of the BOOT sector, the program Bguard can be preferably used, by which the state of the BOOT sectors on the hard disks can be restored.

We wish you to be widely avoided by computer viruses. But if they really do come up, then let our software help you overcome all problems associated with them.

If not absolutely sure how to cope, entrust the removal of viruses to professionals!!!


 System requirements

For operating the program Sguard for Windows the following is required:

1.	Microsoft Windows 3.xx, Microsoft Windows for Workgroups 3.xx.

2.	A computer with the 80386sx processor or better.


 Messages, warnings, errors and queries

The program Sguard for Windows is capable of displaying several warnings and error messages of various types in a range of different forms. Find below the list of them along with the details on their various alternative forms.

•	Bad file checksum

•	Delete file 'ANYFILE' from configuration file?

•

•	Not enough memory

•	File open error

•	Can not find some files

•	Incorrect command line parameters


WARNING 1
Bad file checksum. File 'ANYFILE' has the checksum of 1111. Actual  file checksum value in INI file is 1112. Accept new checksum?

This warning is displayed when computed checksum doesn't match with pre-computed value (on command-line or in configuration file.).

Warning has two formats:

1)	Using a command-line, it will be displayed as a warning.

2)	Using values from configuration file you will be asked whether the change is legal or not. After affirmative answer, new value will be written to configuration file.


WARNING 2
Delete file 'ANYFILE' from configuration file? Deleting file permanently disables its checking. Press YES to delete file from configuration file.

This warning is displayed when a delete request is encountered. You'll be prompted if you really want to delete file from configuration file. After affirmative answer, file will be deleted from configuration file.


ERROR 1
Not enough memory. I am so sorry, but program has not enough memory. Request cancelled.

This error is displayed when there is no available memory on your system. Sguard for Windows needs only 10 KB of memory which should be available on all systems. When confronted with this error, contact your vendor or directly ALWIL SOFTWARE and inform them about this situation.


ERROR 2
File open error. Program can not open file ANYFILE. File will be deleted from configuration file.

Sguard for Wingows needs to open all tested files. All files are opened only for reading. When tested file is opened exclusively or operational system can't open this file for any reason, this error is displayed. It is recommended to check if the file really exists and/or it is not used by other application.


ERROR 3
Can not find some files. AVAST!.INI parameters are bad. Correct the configuration file?

Program displays this error when variable NumberFiles contains greater number than the actual number of files in configuration file. This error is displayed as an query if you want to correct the configuration file. There could be relatively long pause because of extensive searching for missing files in configuration file before displaying this query.


ERROR 4
Incorrect command line parameters. Command line can not contain parameters '/A' and '/D' together. Command line will be ignored.

This error is displayed when bad format of command-line is encountered.


 Version 7.70

The program Sguard for Windows in its version 7.70 contains only minor changes against version 7.50.


 Version 7.50

The program Sguard for Windows in its version 7.50 contains only minor changes against version 7.0.


Version 7.00
 Version 7.0

The program Sguard for Windows in its version 7.00 is the first implementation for the Windows system. Since the version 7.00 on it has been the part of the AVAST! system, with which it is also sharing the allocation of version numbers.


 Origin of the program

The program Sguard for Windows derives its origin from the Sguard for DOS which has been the part of the AVAST! system since the Version 3.00. During its processing it makes use of the same internal algorithms of detecting the modifications of files, and thus the results that can be seen during the work with the program itself or with its working files are the same like those produced by the Sguard for DOS.

The program has nearly the same features as its DOS oriented counterpart except of several modifications.

1.	The program operates solely under the Windows system.

2.	The program includes interactive setting of the files tested.

3.	The program does not include testing of memory, because this function is obsolete in Windows.

4.	The program does not include testing of system areas of disks.


 Configuration file

Sguard for Windows uses file AVAST!.INI for saving the run parameters which the program needs to keep between its individual runs. Sguard for Windows uses only some of the parameters written in the configuration file. They are all written in the group [SGUARD].

The following parameters can be found in [SGUARD] group:

Parameter FileXXX

Parameter FileXXX is used for saving name of tested file and its checksum. Characters XXX are just substituted for numbers, e.g.:

File1=c:\command.com,12345

From this example it is clear that substituted number has no leading zeros or other characters. Checksum is following the filename and is separated by comma.

Order of FileXXX parameters is not important. If you use interactive mode of work, Sguard for Windows automatically numbers these parameters.

If you are manully changing the configuration file you must follow the format correctly. Program does not work any format different from the above one. Bad parameters are ignored.

Parameter NumberFiles

Parameter NumberFiles is used for saving number of files to check. Value is saved in decimal format.

If you are using Sguard for Windows for changes in configuration files, value of NumberFiles is changed automatically. If you are manually changing the configuration file you have to carefully follow these rules:

1)	Program is testing the number of files specified in NumberFiles parameter. Files are processed in ascending order. Other files are ignored.

2)	If there's greater number in NumberFiles than the number of files found, error message 'Can not find some files' is displayed.


 Command-line parameters

Format of command-line for Sguard for Windows is:

SGW [file [checksum] [file [checksum] ...] [[/|-][A|a]] [[/|-][D|d]] [[/|-][M|m]]]

where file is full filename for checking, checksum is control sum in decimal format. It is necessary to enter the checksum if you know it. Not knowing the checksum and writing this command:

SGW c:\command.com c:\io.sys c:\msdos.sys

will lead to an error message, because of lack of checksum to compare. The above command has sense only with /A or /D switches. If you know checksums you should enter this command:

SGW c:\command.com 12345 c:\io.sys 23456 c:\msdos.sys 34567

Explanation of switches:

/A	adds all files found on the command-line into the configuration file. If the sum is included it's added too.

/D	all files found on the command-line will be deleted from the configuration file.

/M	switches program into the interactive mode. Before entering this mode, everything on the command-line is processed first.

Parameters /A a /D can't be specified together. In this case error Incorrect command-line parameters. is displayed.

Using switch /A and specifying file without checksum will add file into the configuration file only. Checksums are computed automatically after next execution of Sguard for Windows.

All the switches could be preceded by '/' or '-' and could be written in both upper- or lowercase.


 Special parameters

Program accepts one parameter which is not entered from the command-line but from the icon - running in minimized mode.

If the program is run minimized, it will check files given on the command-line and then files from the configuration file. When program is run normally, without any parameter, switch /M is assumed and Sguard for Windows is run in the interactive mode.


 FileOpen dialogue

If there is /M or a special parameter found, interactive mode dialogue is invoked.

This dialogue is modified Windows standard dialogue for opening files. Its modification is based on adding list of files to test to the bottom of window and of two buttons for modifying this list.

Number of files is limited only by Windows that don't allow lists of unlimited length.


 Error dialogue

The dialogue box for displaying error will be displayed as a program response  when the program has found out a circumstance which must be communicated to the user. The dialogue box will give a brief account of this event, not omitting the reaction of the program or suggestions for the user.

The dialogue box provides the following choice of controls:

OK Button

The OK button will enable further operation of the program. This activity can take on various forms, according particular errors. The dialogue box will be erased from the screen.


 Query dialogue

The dialogue box for displaying the query will be displayed as program response to the event affecting operation of the program, the status of the entire system, or when the program has found out a circumstance which it cannot resolve within its own competence. The dialogue box will give a brief account of this event, not omitting the reaction of the program or suggestions for the user.

The operation of the program is suspended whilst this dialogue box is being displayed. Individual types of queries have various levels of urgency and differ in colour accordingly.

The dialogue box provides the following choice of controls:

Yes button

Depressing this Yes button will represent an affirmative reply to the query displayed within this dialogue box. The dialogue box will be erased from the screen.

No button

Depressing this No button will represent a negative reply to the query displayed within this dialogue box. The dialogue box will be erased from the screen.


Popup=Configuration file
The AVAST!.INI is the configuration file, used by programs of the AVAST! system for saving the program parameters that must be maintained over an idle period of any of the programs. The standard configuration file of the Windows system is in question here. It resides in the directory from where programs are started.


Popup=ALWIL Software
The ALWIL Software company and its software products are no beginners in the market. The company itself was established no sooner than in April 1992, actually by separation from the ALWIL cooperative, but its staff members have been working closely together since 1988 when the first version of the AVAST! anti-virus package came to being together with User Software Administrator SUP. In the same year the implementation of the national environment not only for IBM compatible PCs and their widely used peripheral units was created, but for the laser printers as well.

We still remain faithful to our original trend in the fields of system software, data protection, and implementation of the national environment for laser printers. The last novelties of our production are, for example, the systems for real-time encrypting of the hard disk contents, or the Lguard for Windows.

ALWIL Software

Prubezna 76

100 31  Praha 10

Tel (+42 2) 782 20 50

Fax (+42 2) 782 25 53

BBS (+42 2) 782 25 50

BBS (+42 2) 782 20 50 (6:00pm - 7:00am)

cc:Mail (+42 2) 782 25 49


Popup=PATH
PATH is a system variable which determines, where will the operating system look for executables not found in current directory.


Popup=Michal Kovacic
Michal Kovacic works at ALWIL Software as Windows software developer. You could reach him at company's BBS as 'MICHAL KOVACIC', he will answer all your questions without any hesitations.


Popup=BBS
BBS is an abbreviation of the Bulletin Board System, in other words a technique of electronic communication and data distribution. At our BBS you could obtain our latest upgrades.