Netware Super Library/Netware Super Library.iso/virus/virex/readme.vpc

Text File | 1995-04-29 | 9.6 KB | 222 lines

                README.VPC for Virex for the PC Version 2.96
                --------------------------------------------

This file contains important information that is not in the manual or that
has changed since the manual was printed. Please take a moment to read it
to help you fully utilize Virex for the PC.

Virex for the PC 2.96 detects well over 5,000 viruses.


PRODUCT REGISTRATION:

VPCSCAN searches for a valid registration file and will notify you if it
does not exist.  This file contains a registration number that you must
provide to Datawatch in order to receive technical support.  You have been
provided with a generic registration file that will allow VPCSCAN to run
without generating an "unregistered copy" message.  You will see the generic
registration number displayed every time that you run VPCSCAN. You should
send in your registration card immediately so that Datawatch can provide
you with a personalized registration number.  Other than help with the
initial installation, technical support is not provided unless you have a
personal registration number.  Future updates of VPCSCAN will recognize
this registration file, thus, it only needs to be created one time.
Datawatch will provide you with instructions for creating a personalized
registration file upon receipt of your registration card.

UPDATES:

Virex for the PC updates will be available, free of charge for registered
users, through various BBSs (Bulletin Board Services), including our own
DataGate.  You can download Virex for the PC updates from it by using any
communications program on your PC and a modem.  Set up your communications
program for 8 data bits, no parity, 1 stop bit and ANSI or TTY emulation.
DataGate supports speeds from 1200 to 14,400 bps.

  The DataGate number is: 508-988-6373.

Individual upgrades are also available, for a small fee, by mail from
Datawatch. You may also subscribe to an update service to receive all updates
by mail for a one-year period.


BBS SUPPORT:

Datawatch is pleased to offer you access to our BBS, DataGate.

DataGate's primary purpose is to support YOU. As soon as you enter the
board you can find answers to your technical questions in our Questions
and Answers Bulletin area, download product updates and new programs, and
much more.

In addition to Datawatch customer support, DataGate also has many DOS,
Windows and other utility files available for download. To download the
latest version of Virex for the PC, type the following at the Main Menu:

                        d VIRX*.ZIP <Enter>

Select your download protocol and the download process will begin.
Help is always available by typing:  H <Enter> where ever you get
stuck and need assistance.

Your comments and suggestions on the service that this BBS provides
are always welcome, and we look forward to reading your suggestions.
You may leave us a message by typing

                        C <Enter>

at the Main Menu, outlining your ideas.


CONTACT INFORMATION:

Datawatch Corporation
234 Ballardvale St.
Wilmington, MA 01887

Telephone: [phone]
Fax:       [phone] (General & Sales)
Fax:       [phone] (Tech Support, Virus incident reports)
DataGate:  [phone]

You can contact Datawatch on the following services:
AppleLink         DATAWATCH
America Online    VIREX
INTERNET          [e-mail]

Please indicate a daytime telephone number where you can be reached.
For technical assistance, or if you find a new virus, please contact us.
Technical support requires a valid registration number.


VPCSHELL:

VPCShell is a menu driven interface for VPCSCAN, that allows VPCSCAN to be run
from pull down menus.  It can be easily accessed from Windows by clicking on
its icon.  VPCSHELL must be on the same drive as VPCSCAN.  VPCSHELL can be
run from the original 3.5 diskette. See VPCSHELL.DOC file for more detailed
information on VPCShell. Installation of VPCShell is optional and has a
separate install program, SINSTALL, to install it for DOS and/or Windows use.

OTHER FEATURES:

VPCSCAN additional command line options:

-E   this switch will direct VPCSCAN to return an errorlevel of 0 if and only
if the system was completely tested and no viruses were detected. Otherwise, a
non-zero error level will return.  An error condition will return a non-zero
error level as well.

-T   turns ON an optional warning message that alerts you when your version
of VPCSCAN is more than 6 months old.

-!N  turns off the virus warning messages that are sent to the Novell console
whenever a virus is found.


Novell Netware Features:
If you are using Virex.COM  with a Novell Network, the network protection
files for each server volume should be flagged as Shareable/Read-Write.

WARNING!  If Virex has been automatically loaded prior to Novell Netware's
NETX shell, Virex protection will be disabled by the loading of NETX.
Reloading Virex with the -R command line switch after NETX is resident
will insure that Virex is again providing proper protection.
The newer VLM-based shell does not require Virex be reloaded.

If you are attached to a Novell network,  run VPCScan locally, and discover a
virus on your local computer, VPCScan will notify both you and the Novell
Netware Console.  If you wish to run VPCScan without this feature, use the
"-!N" switch from the command line (e.g. "VPCSCAN -!N")

If you are running Netware 2.x, VPCScan will display the message on the
console screen and write an entry to the file, LOG$MSG.LOG, a Netware log
file.

If you are running Netware 3.x or 4.x, VPCScan will only display the "virus
found" message to the console screen.  No permanent log of these alerts will
be kept on the server itself.


Virex.COM can be "loaded hi" into high RAM with DOS's loadhigh and memory
managers like QEMM's loadhi program.  Virex.COM may not be able to do it
initial memory scan if "loaded hi", depending on your system configuration,
but will otherwise function properly.

VPCSCAN utilizes an internal consistency check, and refuses to run if
modified.

If you are using the Intel SatisFAXtion board/Connection Co-processor with
VIREX.COM, the CASMGR.EXE program must be configured to not use EMS memory.

THE EXTERNAL VIRUS SIGNATURE FILE:

The external virus signature file is a feature meant only for expert users.
It allows new viruses to be detected, by means of their signatures,  without
having to wait for a new release of Virex for the PC.  You should be careful;
if you use the external signature file and add a virus signature that we are
already using within our internal virus signature database, Virex will inform
you that it has found a virus in memory.  You should contact Datawatch before
using this feature.

The format of the external virus signature file, which must be on
your C: drive, must be in a directory called "\VIREX" and must be called
"VIREX.VIR", is as follows:

<virus-type><space><virus-name><space><ascii-signature-representation>

The <virus-type> indicates whether the virus signature following is for
a "Program" virus or a "Boot" virus.  Use 'P' for program viruses and 'B'
for boot sector viruses.  You can also use a '#' as a comment line
indicator, if you wish; such lines will be ignored.

The <virus-name> is the name of the virus.  It may not contain any spaces or
other whitespace.  You might want to use underscores or hyphens instead of
spaces.

The <ascii-signature-representation> is the translation of the hex
signature string into an ASCII form.  Each byte is represented by a zero-
filled, right-justified two place sequence: the proper representation of
a hex "0xf" would be "0f"; to represent "0xff", use "ff".

For example, if a new virus called NewVirus, a program type virus, were
to have a signature string of "1 2 3 4 5 6 7 8 9 a b c d e f", its entry
in the external signature file (C:\VIREX\VIREX.VIR) would be:

#A comment line for the NewVirus external signature file example
P NewVirus 0102030405060708090a0b0c0d0e0f

Optionally, you could include both a checksum of these bytes and a "nasty"
indicator.  A nasty indicator tells VPCSCAN that the virus signature refers
to a virus that can infect a clean file simply by VPCSCAN examining that
clean file: if such a virus is found in memory, VPCSCAN will not scan further,
and you should reboot with a clean, write-protected DOS floppy before
scanning again.  The nasty indicator is simply an exclamation point, "!".

The checksum is a two-byte long unsigned checksum of the signature bytes.
You can use a program such as Sidekick in its hex calculator mode to
determine what this checksum should be.  If you choose to use the checksum,
and/or the nasty indicator, they should be placed following the hex signature,
using a <space> between the signature and the checksum/nasty pair. The order
of the checksum/nasty pair is unimportant.

For example:
# Example ZeroCheckSum Virus, nasty, program virus
P ZeroCheckSum 00000000000000000000 0000!
# Alternate example ZeroCheckSum Virus, nasty, program virus
P ZeroCheckSum 00000000000000000000 !0000
# NonNastyZero, program virus
P NonNastyZero 00000000000000000000 0000
# NastyVirus, no checksum, boot sector virus
B NastyVirus 1234567890aabbccdd !
# NastyVirus, checksum, boot sector virus
B NastyVirus 1234567890aabbccdd 04b2!

Please be sure not to use these examples; you might end up with a false
positive!

We only support the use of VIREX.VIR files released by Datawatch Corp.

On receiving an update to Virex for the PC, please remove any external
signature files you were previously using, to avoid possible false positives.