Frostbyte's 1980s DOS Shareware Collection/floppyshareware.zip/floppyshareware/GLEN/CHKUP11.ZIP/CHECKUP.DOC

Text File | 1988-04-02 | 8KB | 184 lines

Checkup (tm) v.1.1
Copyright (c) 1988 Richard B. Levin
All Rights Reserved

 Program:  Checkup
 Version:  1.1
Released:  April 2, 1988
Function:  Detects file size and incremental checksum changes
  Editor:  Norton Editor v.1.3C
Compiler:  Microsoft QuickBASIC v.4.0
  Author:  Richard B. Levin
 Contact:  BBSoft
 Address:  P.O. Box 14546, Phila., PA, 19115
     Lab:  215-677-9782
     BBS:  215-969-8379 (300/1200/2400)

Important note:

    Please read this document in it's entirety before using CHECKUP.

This archive contains three files:

     CHECKUP.DOC - This file
     CHECKUP.EXE - Checkup standalone executable
    CHECKUPS.EXE - CheckupS(mall) - Requires BRUN40.EXE

    Owners of Microsoft QuickBASIC v.4.0 may use CHECKUPS.EXE instead of
the larger CHECKUP.EXE.  To do so, BRUN40.EXE must be accessable to
CHECKUPS.EXE.

    BRUN40.EXE is not provided in this archive.

The problem defined:

    Computer programs which appear to be normal applications but, after
one or more uses, destroy data stored on the host system are popularly called
"trojan horse" programs.

    Trojan horse programs are usually distributed by unsuspecting bulletin
board system operators (BBS SysOps) and attack users who do not know or care
to follow the proper precautions for evaluating BBS downloads.

    Once a trojan horse program completes it's deadly mission, it has
obliterated itself as well as the host system's data.  The affected user can
and generally will warn other users to beware of the suspect program.  Thus,
the useful life of a trojan horse program is limited.

    The latest form of computer terrorism to surface is the "computer
virus".  A computer virus differs from a trojan horse program in that it is
capable of secretly spreading and infecting other computer systems in order to
extend it's useful life.

    The well written computer virus is difficult to detect using current
file management and anti-trojan techniques.  This ingenious bit of code
infects programs by inserting itself into a benign program's executable file.
An expertly crafted virus will not change the host file's date or time stamps
nor will it alter the host file's size.

    Converting the attributes of potential virus targets (such as
COMMAND.COM, IBMBIO.COM, or IBMDOS.COM) to "read only" might prevent some
virus infections.  However, the intelligently designed virus will first check
the host file's attribute, reset it if neccessary, infect, then return the
attribute to it's original state.

     When an infected program is innocently copied and distributed, a
hidden virus has another opportunity to spread to another system.  A computer
virus may remain dormant for months and then suddenly emerge to do it's
dastardly deed.  By the time a virus has revealed itself, numerous offspring
may have been spawned.

How CHECKUP works:

    CHECKUP detects potential viral infections by first comparing a target
file's size and then comparing it's checksum on an incremental basis.

    CHECKUP consumes significantly less disk space than using DOS's or
other file comparison utility(s) or vaccines which require a mirror-image
duplicate of every compared file.

    Using a randomly generated block size with each pass, CHECKUP scans
and compares every byte of the target filespec.  If any one of the block
checksum comparisons do not match, or if the recorded file sizes do not match,
CHECKUP alerts the user that the target file is suspect.

    CHECKUP uses a random block size and compare to defeat any future
virus which may be intelligent enough to maintain a file's total checksum
integrity.  It is, in our opinion, impossible for a virus to maintain a
correct file checksum when the checked block size may vary from 1 byte to near
total file size.

Program invocation:

    Install CHECKUP in your AUTOEXEC.BAT file.  This insures that
important files are checked once per system boot.

    Launch CHECKUP for each file you wish to check.  CHECKUP may be
launched as many times as neccessary.

    Launch syntax is CHECKUP [ TARGET_FILE_NAME.EXT ].  For example, to
check COMMAND.COM, the launch syntax would be [ CHECKUP COMMAND.COM ].

    The first time a file is checked, CHECKUP will create a .XUP file in
the same directory as the target file.  DO NOT DELETE .XUP FILES.  CHECKUP
requires access to each .XUP file with each future file check.

    CHECKUP will also create and maintain a CHECKUP.LOG file on the root
directory of the disk it is mounted on.  You may view the CHECKUP.LOG file
with any ASCII editor.  You may delete the CHECKUP.LOG file at any time.

    It is suggested that COMMAND.COM, IBMBIO.COM, and IBMDOS.COM be
checked on a daily basis.  These files are the most likely targets of an
active virus.

Precautions:

    IBMBIO.COM and IBMDOS.COM are hidden system files.  Before CHECKUP can
access them, they must be converted to non-hidden, non-system files.  After
CHECKUP has checked IBMBIO.COM and IBMDOS.COM, they must be converted back to
hidden system files.

    FAILURE TO CONVERT IBMBIO.COM AND IBMDOS.COM BACK TO HIDDEN SYSTEM
FILES MAY EVENTUALLY RESULT IN SYSTEM FAILURE.  THIS IS ESPECIALLY TRUE WITH
SYSTEMS USING A HARD DISK OPTIMIZER WHILE THE FILES ARE SET TO NON-HIDDEN,
NON-SYSTEM.

    DO NOT ATTEMPT TO ALTER FILE ATTRIBUTES IF YOU ARE UNFAMILIAR WITH
SETTING AND RESETTING SAME.

    There are many public domain utilities which can be used to set and
reset a file's attributes.  Popular utilities include ALTER.COM, a public
domain tool available for downloading from the BBSoft BBS (215-969-8379),
ATTR.COM, also available via the BBSoft BBS (see 1COM.ARC) and from the
PC-Magazine IRS (212-696-0360 or 415-598-9100).  If you own the Norton
Utilities, you may use Norton's FA.EXE to change a file's attributes.

    CHECKUP creates one .XUP for each checked file.  The .XUP file is only
created once; the first time a target file is checked.

    If your .XUP file(s) are ever mysteriously deleted or altered, it is a
good indication that a "CHECKUP-aware" virus has landed on your system.

    To prevent a CHECKUP-aware virus from gaining control of .XUP files,
keep a back up copy of .XUP files as they are created.  The suggested back up
method is to have a batch file copy .XUP files from another directory to the
root and then run CHECKUP.  This assures the integrity of all .XUP files.

Example of suggested CHECKUP portion of AUTOEXEC.BAT file:

    rem make sure we're on the root directory
        cd \
    rem log the current attributes to a disk file to check for changes
        fa >> fa.log
    rem clear hidden and system attributes
        fa ibmbio.com /h- /sys-
        fa ibmdos.com /h- /sys-
    rem copy .xup files from another directory to root directory
        copy \dirname1\dirname2\*.xup \
    rem run checkup
        checkup ibmbio.com
        checkup ibmdos.com
        checkup command.com
    rem reset file attributes to hidden/system
        fa ibmbio.com /h+ /sys+
        fa ibmdos.com /h+ /sys+

    As an additional precaution, you should change all files to read only.
This does not have to be done in a batch file.  Once should be sufficient:

        fa ibmbio.com /r+
        fa ibmdos.com /r+
        fa command.com /r+

==============================================================================
Notice:

This program must be distributed AS IS without alterations of any kind.

This DOC file must be included with CHECKUP(S).EXE in the CHKUP10.ARC file.

Released And Distributed Through BBS's All Across America.
==============================================================================

- End of CHECKUP.DOC -
a