home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Share Gallery 1
/
share_gal_1.zip
/
share_gal_1
/
UT
/
UT237.ZIP
/
VIRSTOP.DOC
< prev
next >
Wrap
Text File
|
1991-10-04
|
2KB
|
45 lines
VIRSTOP
The primary purpose of the VIRSTOP.EXE program is to prevent the execution
of programs infected with known viruses. VIRSTOP installs itself in RAM as
a standard TSR and intercepts the so-called "Load-and-execute" function.
This means that whenever an attempt is made to run a program VIRSTOP gets
a chance to examine it first.
VIRSTOP uses a simple but fast search to check for viruses, but it does
not make an accurate identification - "Full Scan" or "Secure Scan" are
necessary for that purpose.
If VIRSTOP finds a virus, it will abort the execution of the program,
display a message and return an error. For example, if you attempt to run
a program infected with the Cascade virus, with VIRSTOP active in memory,
you might see something like this:
This program is infected with the Cascade virus.
Cannot execute A:\INF-PROG.COM
VIRSTOP has a secondary function as well - it attempts to check for any
active boot sector virus when it is run.
Older versions of F-PROT (pre-2.0) contained two programs (F-DRIVER.SYS and
F-NET.EXE) which are now replaced by VIRSTOP.EXE. Using a .SYS program is
in some ways preferable to using an .EXE program, in particular as it
reduces the chances than an infected program is run before the monitoring
program (VIRSTOP or F-DRIVER). However, this caused problems on networked
machines, as network software often takes over the "Load-and-execute"
function, disabling the monitoring program.
VIRSTOP is supplied as an .EXE file, so that it can be run after the
network software is installed (in AUTOEXEC.BAT). On stand-alone machines
the program may be loaded as a device-driver, with a command such as
DEVICE=C:\F-PROT\VIRSTOP.EXE
IMPORTANT! - If HIMEM.SYS is used, it must be loaded before VIRSTOP.
VIRSTOP.EXE includes one additional feature - it is designed to be able to
detect if it has been infected by a "stealth" virus - an ability which
is rather unusual. It is also often (but not always) able to detect
attempts to run "stealth"-virus infected programs, even though the virus is
active in memory.