PC World Komputer 1997 May

home *** CD-ROM | disk | FTP | other *** search

/ PC World Komputer 1997 May / Pcwk0597.iso / antywir / adinf / adinffaq.txt < prev next >

Wrap

Text File | 1997-02-14 | 17KB | 357 lines

▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓┌──────────────────────────────────────────────────────────────────╖▓▓▓▓▓▓ ▓▓│ ║░░▓▓▓▓ ▓▓│ ADVANCED DISKINFOSCOPE (ADinf) ║░░▓▓▓▓ ▓▓│ by ║░░▓▓▓▓ ▓▓│ (c) Dr. Dmitry Mostovoy ║░░▓▓▓▓ ▓▓│ ║░░▓▓▓▓ ▓▓│ DialogueScience, Inc. ║░░▓▓▓▓ ▓▓│ Moscow, Russia ║░░▓▓▓▓ ▓▓╘══════════════════════════════════════════════════════════════════╝░░▓▓▓▓ ▓▓▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓┌──────────────────────────────────────────────────────────────────╖▓▓▓▓▓▓ ▓▓│ A Guide to Frequently Asked Questions ║░░▓▓▓▓ ▓▓╘══════════════════════════════════════════════════════════════════╝░░▓▓▓▓ ▓▓▓▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ Here are the answers in detail to the questions which our users quite frequently ask about ADinf. All questions on a topic have been unified and arranged topicwise. The menu tree structure described below may not fully agree with that of the ADinf earlier versions as the answers specifically refer to version 8.xx and later. Can ADinf check a disk compacted with DoubleSpace, DriveSpace, SpeedStor or Stacker? Yes, it does check a compacted disk, scanning not through BIOS but via Int 25h. For scanning a SuperStor-compacted disk, you must tell ADinf not to check for new bad clusters (choosing INFO UNDER CHECK ═> BAD CLUSTERS ═> DON'T CHECK) I, being a programmer, naturally change many files on my disk everyday. How can I tell ADinf to skip these legal modifications in its report? You can hide directories from ADinf checks. For this, choose INFO UNDER CHECK ═> SKIP TREE. Then choosing a drive from the on-screen panel, pop up its directory tree, mark the directories and subdirectories where files are likely to be changed often. ADinf will not report the unharmful changes in a file under a marked directory. But if a change (in size or CRC) is suspicious, for example a file is modified but its date stamp is unaltered, you are alerted. What is ADinf Cure Module? If this is a curing module, is it better or worse than Virus Hunter and Doctor Web? Where can I buy it? ADinf Cure Module is a curing companion which enhances the capabilities of Advanced Diskinfoscope. It radically differs from scanners Virus Hunter and Doctor Web. It kills existing and as-yet-unknown viruses with equal efficacy. It maintains a small database containing necessary information about all files in your disk. When ADinf detects a virus, the curing module can be used to kill it. Database is automatically updated by ADinf when diskinfo changes in your system. The program was tested on a collection of 7000 various infectors unknown to the program and successfully removed 97 percent of them. Scanners and ADinf Cure Module cannot be compared: each deploys a different strategy to the antivirus problem: each ideally supplements the other. First, ADinf Cure Module does not kill all but about 97% viruses, particularly, admitting its capabilities to clean a computer from as-yet-unknown viruses. Second, it is helpless when you are handling someone else's diskettes since it requires the database containing diskinfo. Scanners, on the contrary, deploy the traditional tactics: to every attack they design a counterattack and can therefore kill only the viruses known to them, but are helpless against new viruses. It is therefore a good idea to have both of them in your machine. What is fast CRC that ADinf computes? When I modified a few bytes at the end of an executable file, it ignored them under fast CRC mode. Why? ADinf checks in one of the modes: FAST CRC, CRC16, CRC32 and NO CRC. FAST CRC is computed in close relation to the internal structure of an executable file. So FAST CRC is best suited for COM and EXE files as it guarantees reliable virus detection without the need for computing the CRC of the whole file. So, any change in certain file areas, unless it is virus-induced, is ignored under FAST CRC check. Why is ADinf very sluggish in checking a write-cached disk? Why does it hang on a cached disk? ADinf efficiently checks a read-cached disk, but may fail on a write-cached disk when both ADinf and the cache simultaneously address BIOS, creating conflicts. There are two ways of avoiding such conflicts: first disable the write-cache prior to starting ADinf and toggle it on when checking is complete. For instance, to hide your drives C and D from write-caching by smatrdrv.exe, use the command smartdrv C D and to switch it again the command: smartdrv C+ D+ Alternatively, tell ADinf to access all drives, except drive C:, via Int 13h. For this, go to OPTIONS ═> SETUP PARAMETERS ═> DRIVE ACCESS TYPE. Then arrow to the drive name letters and repeatedly pressing <Space>, set Int 13h as the drive access type for all drives. For the drive C:, leave the default setting as it is. Now ADinf will not conflict with your write-cache, but virus detection is somewhat less reliable. ADinf ver. 9.00 or higher is fully compatible with HyperDisk write-cache ver. 4.50 or later. No problems arise with this utility any longer. Can I put network drives under ADinf control? Unfortunately, you can't. ADinf checks a drive, reading it sector by sector. Therefore it can check local drives only. Can ADinf run under MS Windows, Windows 95, and DESQview? Yes, it does run under MS Windows, Windows 95, and DESQview, scanning the drives directly via BIOS. Can ADinf run under DR DOS, Nowell DOS, Compaq DOS? Yes, ADinf can run under DR DOS. ADinf detects its environment by the version number. If ADinf hangs up under Novell DOS later than 7.0, run it with -r option. Use this option, if your computer is running under Compaq DOS or any other OS not fully MS DOS compatible. What is the purpose of personal tables? ADinf supports two types of tables, common and personal, for storing disk information. Structurally, they don't differ much. Common tables are saved in the root directory of logical drives and personal table in the directory where ADinf is installed or in another directory. Common tables are helpful in regularly checking a limited number of program files of particular extensions. Whereas personal tables are better suited for in-depth checking. You may even choose all types of files on your disk and specify CRC32 for CRC type. Such a check is all-inclusive; time consuming, though. I feel my machine is infected, but ADinf is silent. Can a virus dodge ADinf? This is a common question, and there is only one answer to it. Unfortunately, there is no panacea against PC virus infection, nor can there be ever one. ADinf seems to be the best virus detector today. But bear in mind its capabilities and limitations. Let us examine the situations where ADinf may keep quite. First, if you have installed ADinf on an already infected machine, it will not notice any virus, because it detects viruses through the changes in file information. And in our case there are no changes in file information and so it does not alert you. If the virus is hiding its presence, i.e., you have a stealth virus in the machine; ADinf will certainly detect it, if you run under the STEALTH SEARCH mode. This is a very useful mode and run ADinf from time to time under this mode. Second, ADinf may fail to notice the viruses tailored specifically to infect a file only at the time of creation. If they are additionally hiding themselves, you may trap them, running ADinf in STEALTH SEARCH mode. If they are NOT hiding their presence, you can easily detect them with your naked eyes. For example, suppose you are copying a file from drive A: to drive C: and you notice that the source file has a different size than the target file. You can easily detect such infectors, running ADinf as follows: write a batch file (call it TRAP) which copies several executable files, say, to your RAM drive and then copies them back from the RAM drive to the source drive. Run the TRAP batch file before turning off your computer. When you start the computer next time, ADinf will report about such viruses, if any. For greater reliability, you better include files to be copied in STABLE FILES list (its menu path is OPTIONS ═> SETUP PARARAMETRS ═> INFO UNDER CHECK ═> STABLE FILES). Third, ADinf permits to toggle off many checks. If you, for example, have toggled off check of boot sector of drive C: or you have deleted EXE from extension list for control, you may not notice virus-inducted changes. Finally, because of its beneficent policy ─ aggressive strategy and ingenious tactics ─ ADinf irritates to virus designers. One fine day it is not excepted that you may find a new virus specially tailored to dodge the ADinf in your machine. Today there are several viruses which try to delete files with a name begining with "ADIN". What will these evil-mongers do further, God alone knows. What is disk access via BIOS, Int 13h, and Int 25h? In checking missions, ADinf automatically identifies the DOS file structure by reading the disk sectors one after another. Three access methods are available for reading the sectors in a drive through direct addressing to BIOS; through the use of Interrupt 13h (Int 13h); through the use of DOS Interrupt 25h (Int 25h); The drive access type is specified by choosing OPTIONS ═> SETUP PARAMETERS ═> DRIVE ACCESS TYPE. When and which drive access type should be chosen? For an IDE disk partitioned by the FDISK program, ADinf uses BIOS as the access type. Access via Int 13h must be used under the following situations. Modern high-capacity disks are manufactured with more than 1024 cylinders (limiting value for standard BIOS of IBM AT). Present-day BIOSes and hard disks support handling of such disks by redusing the number of cylinders and increasing the number of sectors or heads, accordingly (LBA mode). However, if your BIOS does not provide this facility, you may have to use special disk drivers to utilize the full capacity of such disks, for example, Disk Manager for IDE disks. ADinf identifies Disk Manager and automatically defaults to Int 13h as the disk access type. Several drivers exists for SCSI disks. If you have a high capacity SCSI disk in your machine, manually choose Int 13h from the DRIVE ACCESS TYPE box. Second case. In a machine running under QEMM set to STEALTH mode, ADinf defaults to Int 13h as the DRIVE ACCESS TYPE because access to disk via BIOS is denied to ADinf. DRIVE ACCESS TYPE must be set to Int 25h for disks managed by special drivers, for example, disk compactors. As a rule, ADinf identifies such situations and automatically defaults to Int 25h. But if the drive name letters in a compacted disk are changed, the drive access type must be set to Int 25h manually by the user. There are also other situations where the user must specify the drive access type manually, for example, if you have changed the standard sequence of drive specifiers that DOS assigns to disk partitions. DOS allots the drive name letters in the following sequence (if some partition is missing, the letters are shifted accordingly): First hard disk 1st Primary DOS Partition C: BIOS 1st Extended DOS Partition E: BIOS 2nd Extended DOS Partition F: BIOS 3rd Extended DOS Partition G: BIOS 2nd Primary DOS Partition K: BIOS 3rd Primary DOS Partition L: BIOS Second hard disk: 1st Primary DOS Partition D: BIOS 1st Extended DOS Partition H: BIOS 2nd Extended DOS Partition I: BIOS 3rd Extended DOS Partition J: BIOS 2nd Primary DOS Partition M: BIOS 3rd Primary DOS Partition N: BIOS ADinf strictly supports this standard sequence of specifiers for assigning names to drives. But, this sequence may be violated in several cases. For the logical drives of name letters up to a violation in the standard sequence, ADinf uses BIOS as the drive access type and Int 25h for the other drives. Below is an example of such a situation. Let us suppose that the second hard disk is an IDE disk with more than 1024 cylinders (without LBA) formatted by Disk Manager. In this case the partitions are allotted drive name letters as follows: First hard disk: 1st Primary DOS Partition C: BIOS 1st Extended DOS Partition D: Int 25h 2nd Extended DOS Partition E: Int 25h 3rd Extended DOS Partition F: Int 25h 2nd Primary DOS Partition G: Int 25h 3rd Primary DOS Partition H: Int 25h Second hard disk: Only one DM Partition I: Int 25h The DRIVE ACCESS TYPE is listed in the right-most column. One more example of nonconventional configuration. Let us interchange the hard disks in the above example. Let the first hard disk be a large IDE disk partitioned by Disk Manager and the second an ordinary IDE disk. In this case, the drive access type must be set as follows. First hard disk: Only one DM partition C: Int 13h Second hard disk: 1st Primary DOS Partition D: BIOS 1st Extended DOS Partition E: BIOS 2nd Extended DOS Partition F: BIOS 3rd Extended DOS Partition G: BIOS 2nd Primary DOS Partition H: BIOS 3rd Primary DOS Partition I: BIOS What is the purpose of the -76 command option, which the User's Guide does not explain? On some computers ADinf hangs up, saying "Opening the disk". What is the cause for this? Int 76h is an interrupt generated by the IDE controller upon the completion of every disk operation. There are stealth viruses that use this interrupt for hiding their presence in the machine. In fact, these viruses dodge detection at the hardware level utilizing the published potentialities of the IDE controller. In order to detect such viruses, ADinf intercepts and handles this Int 76h itself. But such an independent handling may conflict with certain BIOS systems or special drivers of 32-bit access to IDE disks. In such cases, ADinf hangs up, displaying the message "Opening the disk". In order to prevent ADinf from intercepting Int 76h, run ADinf with the -76 option, as follows: C:\ADINF\Adinf.exe -a -b -d -76 -@C:\ADINF\list -lC:\ADINF\ If, by such a command line, your system does not hang up any longer, please send the version number of your BIOS (the eight bytes at the address F000:FFF5) to DialogueScience, Inc., Moscow, Russia, for modifying the ADinf internal BIOS incompatibility table in an appropriate manner so that you may be able to run ADinf without the need for including this option in the command line. I installed ADinf version 10.06 on my network server, but I could not install ADinf Cure Module version 3.03. What is the reason? To install ADinf on a LAN along with the curing module, ADinf Cure Module must be at least 3.04 or higher. Similarly, the -home command option available in ADinf 10.06 also requires ADinf Cure Module 3.04 or higher for the joint operation of ADinf along with the Cure Module. REFERENCES DialogueScience, ADinf and Virus Hunter are registered trademarks of DialogueScience Inc., Moscow, Russia. DSAV is a trademark of DialogueScience Inc., Moscow, Russia. Sheriff is a registered trademark of FomSoft, Moscow, Russia. Other names are registered trademarks or trademarks of the respective companies. * * * DialogueScience, Inc., Computing Center of the Russian Academy of Sciences, Office No 103a, House No 40, Vavilov street, 117967, Moscow, Russia. Tel.(+7-095) 137-0150, 135-6253 Tel./Fax: 938-2970, 938-2855 FidoNet: 2:5020/69.4 (Dmitry Mostovoy) E-mail: antivir@dials.ru - Sales and Support Department dmost@dials.ru - ADinf author (Dmitry Mostovoy)