home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Mega CD-ROM 1
/
megacd_rom_1.zip
/
megacd_rom_1
/
VIRUS
/
FIND1701.ZIP
/
FIND1701.DOC
< prev
next >
Wrap
Text File
|
1989-05-20
|
3KB
|
60 lines
==============================================================================
FIND1701
==============================================================================
This is a single purpose program, than will search out the unique signature
of a virus that we have named "1701" because it increases the size of the
infected file 1,701 bytes after it infects it.
Usage: FIND1701 [ /switch ... [d:]] ...
where you list the drives you want to find viruses on.
Switch can be H to heal infected COM files, Q to quarantine
them, C to only look in current directory.
The default is to heal the file.
Examples:
FIND1701 A: Finds and heals all viruses on Drive A:
FIND1701 /Q A: Quarantines viruses on Drive A:
FIND1701 /Q /C Quarantines viruses in current directory.
FIND1701 /Q A: /H B: C: D:
Quarantines viruses in drive A, heals the
ones in drive B, C, and D.
The program will search the requested drive for all .COM files larger than
1701 bytes, and check then check for a unique signature. If it finds the
correct signature 141$FLu at the correct offset, and if the "Q" switch is
used it will rename the file to *.VIR and indicate that the file is infected.
At the end of the program it will tally up all of the infected files, if any,
and if there are any we suggest you re-boot your computer from a fresh DOS
Master, re-install the system files, and COMMAND.COM and replace the files
that have been renamed *.VIR.
If you do not supply any switches and just specify the drive, the program
will find all occurances of the virus, "heal" the infected files, and your
programs will be left in the same working state before they were infected.
The scrolling is continuous, so you might want to re-direct the output to
a file by: FIND1701 C: /Q > VIRUS.TXT, and then examine the file to see
which, if any files were infected. The listing has the filename, and the
directory, so you should be able to locate them pretty easily. Just erase
all the *.VIR files and replace them with know good copies. Or you can run
the program again without the /Q switch and "heal" the infected programs.
This program was written by Thomas Tuerke, SysOp of Gravesend BBS in
Novato California (415-897-1301). If you use this program to help you
stamp out this virus you might want to give Thomas a call and let him
know that it was of value.