CICA 1993 August/CICA.cdr/unzipped/programr/vwpd/virus.txt

Text File | 1991-11-04 | 11.6 KB | 366 lines

VWPD.386

Virus/Trojan Detector
Runs in Protected Mode at Ring ZERO. The MOST secure of all the operating
modes, unlike old style DOS real mode virus detectors. This is the World's
First Windows Protected Mode Virus Detector. Runs constantly, but with
low overhead; minimal impact on system performance.
Includes write protect feature for disk drives(see documentation for VWPD).
Includes special feature to protect DOS commands and programs from running.


Program and documentation file included.


------------------------------------------------------------------------
Contains new features designed to provide enhanced VIRUS/TROJAN
protection.



Version 1.05 has:
Additional boot sector protection.
Protect sectors from partition sector to boot sector hard drive zero.
Fixes for INT 1Ah and CMOS, and the mouse disappearing.
Fix for access floppy disk hangs machine, requires reset.
Fix for DOS 5.0, call to PSP:5, if DOS loaded high.
Fixes for formatting of floppies.
Hardware trapping of format and reset commands at disk drive controller.
Attemps to remove system or hidden file attributes.

Modified hard drive protection, protects all hard drives
  from writes, except thru BIOS,
  and ALL formatting (even attempts direct to the controller port).

DOS "VER" command now prints Windows numbers +
  Dos version. (/W3 is highest level of warning, /W2 is next lower).

DOS "VWPD" command prints vwpd version and status message.

DOS "JOIN", "FDISK" command is disabled in Windows.
ALSO APPEND, SUBST, FORMAT, ASSIGN.

TIME & DATE must be changed from the Windows Control Panel.
They do not print out current time or date; this will be fixed.

Put in Dummy Command handler for hard disk controller(91h). Useful
for testing if hard disk controller is protected.

Removed most protection from floppy drives. Some protection to be
put back in.


Version 1.06 has:
FASTOPEN, APPEND commands is disabled.
Fix for BUG in 1.05 caused Windows to Hang, when DOS "HELP" command used.


See also WSAFE, our program to protect you from running certain DOS
programs like CHKDSK while Windows is running. Endorsed in Brian
Livingston's new book "Windows 3 Secrets", as Excellence in Windows
Shareware.

Incidently about Brian's book on Windows 3 Secrets, run, don't walk
to get a copy. It is excellent, maybe better than that. (By the way
I don't make anything from the sale of the book.)



INSTALLATION
------------------------------------------------------------------------
See instructions for VWPD.DOC


In the documentation below, references to VWPD means the new version.


TIPS: -------------------------------------------------------------------

If a DOS application tends to cause more messages than you would like,
try running it in a window. The annoying screen switches that occur
when a message is displayed, when a Windows application or a DOS full
screen application are running, WILL NOT occur. (This work around is for
a poor implementation of message box handling in windows).

In other words if the application causes a lot of messages. WINDOW it
before you start it.


GENERAL
------------------------------------------------------------------------
A warning message is displayed for the following occurances. In most
cases the message will allow for OK/CANCEL. OK allows the operation
to proceed as normal. Cancel stops the operation from succeding and
where necessary forces the application to abort.



Mild warnings------------------------------------------

Attempts to terminate and stay resident.

Attempting to change the memory allocation strategy.

Attempts to read the hard disk partition table.

Attempting to reboot the system.

Attempting to get the DOS data segment.

Attempting to get the DOS list of lists

Attempting to create a Program Segment Prefix

Attempting to use int 40h, alternate disk handler

Attempting to change an interrupt vector

Some other obscure kinds of activity.



Intermediat warnings ----------------------------------

Attempt's to write sector one, head ZERO, track ZERO
any floppy disk. This is the boot sector.

Attempting to get/set the disk handler.


SEVERE errors -----------------------------------------

Attempts to clobber the CMOS RAM area.

Attempt's to write sector one, head ZERO, track ZERO
hard drive. This is the partition sector.
Also the boot sector, and on hard drive zero, all
the sectors between the partition and the boot.

Attempts to use FCB's to DELETE ALL file entries.

Attempts to Write to .COM, .EXE or .SYS files.




These measures prevent a virus from Terminating without warning,
or modifying the disk partition table or adding itself to the boot
sector on the floppy or HARD disk. (Hard disk boot sector protection
is a recent addition). Or, modify executable files.


This protection ONLY applies when Windows is running in enhanced mode.



LIST OF Interrupts protected:-------------------------------------------

There is protection from calls to PSP:5.
INT 13h, 19h, 1Ah, 21h, 26h, 27h, 2Fh, 40h.


WARNING MESSAGES--------------------------------------------------------
If VWPD puts up a warning message this DOES NOT MEAN that a virus
is at work. In most cases, the application that is running is doing
something PERFECTLY HARMLESS. However, if you want the operation to FAIL
use the CANCEL button, else select OK.


There are 2 message levels of severity in VWPD. Most warnings will allow
the operation, if you select OK. In a couple of cases the operation will
NOT be allowed as it would cause severe damage.

It is necessary at the present time to use your own judgement in deciding
what is and what is not a virus, in those cases where there is no obvious
damage being done.

THINGS to Watch out for. Programs attempting to terminate and go resident
especially if there is an attempt to change the memory allocation STRATEGY.







CAUTIONS: --------------------------------------------------------------
VWPD has been fixed to trap the backdoor into DOS thru CP/M call at PSP:5 if
DOS 5.0 has been loaded high.

But, There may be a similar problem with other DOS extender systems. If the
A20 line is enabled and wrap at 1 megabyte is disabled.

Formatting of floppies should only be done using a Windows application
such as File Manager. Using DOS format is NOT recommended.


TESTED WITH: -----------------------------------------------------------

This latest version has only been tested on DOS 3.30, 5.00,
under Windows 3.0a. It has been tested with Win3.1-2.

DISK system, using 32 megabyte or smaller logical drives.

It should not be capable of causing or contributing to disk corruption.
VWPD is basically a filter, that watches for certain kinds of activity.
It does nothing which should cause you any continuing problems.



DOS 4.x, 5.x -----------------------------------------------------------
I think VWPD is safe to use with DOS 5.0, it has been tested with it.
If you use it with 5.0 suggest you NOT use it if you have logical drives
larger than 32 megabytes.

If you try it with over 32 megabyte logical drives, it should not be
capable of causing any damage, but it is possible that you might get
warning messages that I have not considered.



DISK Drives: -----------------------------------------------------------

(NOT included in this release!!).
A program for testing your disk drive is included. It is called TESTDISK.

It will display a report on your screen, and will indicate if VWPD
will work properly with your disk drive.


2 HARD DISKS: VWPD has not been tested with a system with 2 hard drives.
It may not provide as complete protection for drive 2 as drive 1.



VIRUS DETECTOR PROGRAMS ------------------------------------------------
You may if you want try installing Central Point Software's Virus Detector
or other such program in conjunction with VWPD. The other detector may
be installed before Windows is started in which case it will protect all
activity or it may be installed after a DOS session is started in which
case it will protect only that DOS session.

Using a second detector like this has not been tested.

Suggest you DO NOT run other detectors at the same time, as they will
affect performance.





PERFORMANCE: -----------------------------------------------------------
VWPD has been written to minimize it's impact on the overall system
performance. I believe you will find it is much less of a drag than
ANY other virus detector available.



SPECIAL OPTIONS:--------------------------------------------------------
The option VWPDWarn3 can be placed in the [386enh] section of system.ini.
The default is TRUE. Setting it equal to false or zero (0), will turn
off certain warning messages. But you will have less protection.
(Get List of Lists, Go TSR, Create PSP are presently the only warnings
turned off).

VWPDWarn3=False    ; default is TRUE.


A future version of VWPD will allow turning off more warnings, but
will use a smart system to detect a virus attack.

If Warn3 is off, then Warning level 2 is on. When you type the
DOS "VER" command, the message displayed will tell you whether the
warning level is /W3 or /W2. The "VER" command can be used whenever
you are in a DOS box and at the command line prompt.


TESTING: ---------------------------------------------------------------
A program to test and demonstrate the functionality of VWPD will be
included in a future release.



In the meantime, here are some suggested tests that YOU can perform.

Format a floppy disk. Should work ok. Use Windows Format in File Manager.

Copy some files to and from the floppy disk. Should work ok.

Attempt to change the time. Time or Date will display. Cannot change.
     Use Control Panel, to change.

Run Debug. Should give a warning.
Use the Mem command in DOS 5.0. Should give a warning.


Try the DOS commands that have been disabled or modified under
Windows 386 enhanced mode. Such as: DATE, TIME, JOIN, FDISK, FORMAT, etc.


Try the new DOS box command: VWPD.

Use the Norton or PC Tools utilities to change a byte on the disk.
DON'T try this unless you know what you are doing.




WARNINGS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

FORMATTING of floppies should ONLY be done by File Manager.
DOS formatters run from a DOS BOX will not work correctly.
DOS Format is disabled.

DO NOT use VWPD with the high performance file system (HPFS)!
Has not been tested for the HPFS and it may not work correctly.

An attempt to do so is supposed to result in an explicit warning
message and Windows will return to the DOS prompt.




ISSUES not properly addressed in this version --------------------------

1. Protected mode versus real mode operations have not been completely
resolved.

2. Consistent information messages appropriate to the level of protection
needed.

3. How much more checking to do and what impact it will have on performance.

4. NMI masking on port 70hex.

5. DOS commands changed or disabled, do not check for options (CHKDSK /f).


PC Magazine AnitVirus Software Review, Oct 29, 1991 p.199
-------------------------------------------------------------------------

Features Provided by VWPD:

Monitors DOS interrupts
Protects COMMAND.COM & other .COM files
Protect Boot Sectors
Protects Hidden System files
Protects Partition Table
Protects .SYS & .EXE files
Protects CMOS
Detects on demand
Uses write traps
Uses read traps



FEEDBACK: --------------------------------------------------------------

Feedback and comments are welcome.

Mike Maurice

503-355-2281
CIS 71171,47