ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/SECUR235.ZIP/SECURE.DOC

Text File | 1992-02-19 | 16.7 KB | 463 lines

SECURE v2.35  Copyright 1990-1992 by Mark A. Washburn.  ALL RIGHTS RESERVED.
-----------------------------------------------------------------------------

Mark A. Washburn
4656 Polk Street N.E.
Columbia Heights, MN  55421

SECURE.COM Validation Data:
PKUNZIP (CRC-32): 575dd4c6
McAfee's VALIDATE:
Program Size: 12,935
Creation Date: 2-29-1992
M1: 1B51
M2: 0F01






ii.    Distribution, Licensing, Disclaimer.
-----------------------------------------------------------------------------

    Noncommercial copying of this software and this documentation is
encouraged.  Not for Commercial Distribution.  Distribution of this software,
or the enclosed documentation, for more than your cost of distribution,
is considered Commercial Distribution and is strictly prohibited without
written permission by the copyright holder.

    By your using this software, you agree to the terms herein.
Specifically, that you do not have the right to copy this software except
as outlined above, and that you are granted a license to use this software
only by registering this software as mentioned elsewhere in this document.

    You also agree, and signify that agreement by using this software,
that Mark A. Washburn, his company, or corporation will not be held liable
for any reason for any cost you may incur, or any potential income you might
lose as a result of using this software.  In addition, this software and
accompanying documentation are provided "as is" and without warranty,
expressed or implied, as to performance or merchantability.

    Mark A. Washburn can be reached by the following means:

    Terrapin Data Systems BBS:  612-623-0152
    Compuserve:  [76050, 2130]
    Homebase BBS:  408-988-4004




i.    Introduction.
-----------------------------------------------------------------------------

    SECURE is a memory resident program that prevents viruses
from infecting your system. It has the extraordinary power to block
all of the known viruses that exist today, stop future (new) viruses,
and even viruses that are undetectable by other security programs.
Also, SECURE will protect your system from known Trojan programs.

     SECURE will stop a virus before it damages your data. It knows
what a virus is.  SECURE is a small TSR (about 4.5k) that intelligently
monitors your computer system for virus-like behavior.

    SECURE works by stopping the virus infection process.
In brief, SECURE prevents unauthorized writing to executable files.
If a virus enters your system and attempts to spread, you are
immediately notified and the virus is easily terminated.  Ordinarily,
SECURE will be unnoticed and your programs will function normally.


    To install SECURE quickly, unpack the files from the ZIP archive
    into any directory.  Change to the directory and type:

        SECURE

    This batch file loads SECURE with configuration and command
    mode options enabled.  Detailed installation is discussed below.


NOTE:    SECURE requires some programs to be configured.  Therefore,
after installing SECURE, you should take care to 'test run' your
favorite/most used programs and, if required, configure SECURE as
suggested below.  Read command mode options section below.


   Registration is required for the use of the SECURE program in a
   home environment.  Send registration fee of $20 to address below.
   Diskettes are not mailed to registered users unless specifically
   requested.  For such mailings, please add $5.

            Mark A. Washburn
            4656 Polk Street N.E.
            Columbia Heights, MN  55421

   This program may not be used in a business, corporation, organization,
   government or agency environment without a negotiated site license.





I.    Installation.
-----------------------------------------------------------------------------

Copy SECURE.COM to the root directory of your bootable hard drive
or floppy disk.  If required, copy a configuration file.   The files
may be renamed or moved to a subdirectory for additional security.

Include SECURE in your AUTOEXEC.BAT file including its configuration
options.

Thereafter, SECURE will activate each time the system is powered-on or
rebooted.


WARNING:  If you boot a hard drive equipped system from a floppy disk infected
with a boot sector virus, the virus can be transmitted to your hard drive.
The next time SECURE is activated, SECURE will attempt to warn you of the
condition unless the 'B' switch is used.




II.    Software notes.
-----------------------------------------------------------------------------

SECURE is compatible with most software.  To perform it's extensive
security checking, SECURE must make some assumptions about viruses
and the executing environment.  Therefore, some software is
incompatible with SECURE.

1) It may not work with software based debuggers.  (debug)
2) COMMAND.COM must be resident before 4DOS.  4DOS is not specifically
supported in this version.  (4DOS)
3) DESQview is not supported.
4) If a program halts with a high pitched tone and/or visual message,
the command keys are still available.  (You may not hear the tone if
you are using the quiet ('-Q') option.)
5) SECURE can not be loaded into high ram.
6) Windows users must add the line 'UniqueDOSPSP=True' to SYSTEM.INI.

*Caution*  DO NOT USE disk cache programs with write buffering enabled
WITH THE '-C' COMMAND MODE OPTION or THE CONTROL-H COMMAND.

** If you experience a problem using SECURE with a certain software package,
send a message to one of the BBS's below.  Include your CONFIG.SYS and
AUTOEXEC.BAT files.  If available, use Quarterdeck's MANIFEST to file option.




III.    Command mode options.
-----------------------------------------------------------------------------

If you encounter a message like:

    'SECURE: err=??  file=????????.??? System Halted.  Y/F/A/H/P ?'

  Your command mode options are:

       Control-Y to approve and continue.
       Control-F to fail and continue.
       Control-A to abort the program.
       Control-H to enter security halt state.
       Control-P to approve all program operations.

    * All commands do not apply to some errors:
      'Abort' applies only for 3x errors.
      'Abort' and 'Fail' do not apply to errors 9 or less.


     Be careful about the approve and continue (Control-Y)
     command.  The command will help you figure out configuration
    options, but if a virus is in control, it will give you the
    power to let a virus really screw up ANY or ALL your programs
    and data.  Not advised during regular use.

     Use the Control-P cautiously.  It will approve all the
     program's operations for the remainder of its execution.
    * NOTE: If you use Control-P to approve a TSR then it will
    retain *full* priviliges until it is removed or the system is
    rebooted.

    * May be used by technicians during a 'test-run' setup.
       Keep the error code and command mode command list
       nearby.




IV.    Special Notes.
-----------------------------------------------------------------------------

    SECURE is designed to stop all viruses from infecting
your virus-free system.  If SECURE won't install (read technical
notes), a virus may be preventing it from installing correctly.

    Usually installation is simple, but occasionally SECURE may
conclude that a particular program is not behaving like a
'normal' DOS program should.  However rare, this unwanted system
halt could be annoying.  Therefore, after installing SECURE,
you should take care to 'test run' your favorite/most used programs.
If the system halts then you will want to read the technical
notes on how to modify the SECURE configuration file.
If your software continues to malfunction, it's possible you may
already be infected by a virus.


    All programs that write to a protected suffix or
directly use the BIOS disk write routines will require configuration
if you intend to use SECURE and them concurrently.


     Load essential TSRs before loading SECURE.  (example: network
driver, cache program, ect.)  This will allow the TSR programs to
operate with full privileges (and maximum speed) without the need of
being mentioned within the SECURE configuration file.  Any privileged
TSR loaded after SECURE must be defined within the configuration file.
A maximum of three (3) *priviliged* TSRs may be loaded after SECURE.
The TSR removal program should not require privilege.


    Use privileges wisely.  Don't give a file a privilege it
doesn't need.  This will keep you system as secure as possible.




V.    Switches and Installation Messages.
-----------------------------------------------------------------------------

Program switches:

SECURE -Q -R -B -C -Lfname.ext

  Q  Turn off audible alarm.
    - Useful during initial 'test run'.  Not advised during
     regular use since the visual warning may be hidden.

  R  Turn off run away code trap.
    - May be incompatible with some (strange) software. Some
    software may not Speed up processing on slow PC's.  Not
    advised during regular use because some viruses do not use
    RAM normally.

  B  Turn off boot virus test.
     - Skip boot sector virus pretest.  Not advised unless you
     experience configuration conflicts or never boot from a
     floppy disk. If this switch is used, a boot sector virus
     can infect your hard drive after a floppy boot AND NOT BE
     DETECTED BY THE SECURE SYSTEM.

  C  Turn command mode off.
    - A way to automatically halt the system upon virus
     detection.

  L  Load privileges from new filename.
    - Allows the user to hide the privilege file's filename.
     Examine the configuration file examples.


Installation messages are:

'Program already loaded.'
  - Program should only be loaded once.

'Program requires DOS 3.0 or greater.'
  - The program requires features of DOS 3.0 or greater.

'Program audible alarm switched off.'
  - Alarm switch off.  (not suggested)

'Program run away code trap switched off.'
  - Run away code trap off.  (not suggested)

'Program boot virus test switched off.'
  - Skip boot virus check.  (not suggested)

'Program command mode switched off.'
  - The command mode options (section III) are disabled.
    If a system privilige violation is detected, this option
     will force an immediate system HALT.

'Program privilege options loaded.'
  - Program privilege options have been loaded.

'Error in loading privilege file.'
  - SECURE.DAT or the filename specified with the '-L' switch
    was not found.

'COMSPEC= not in environment.  Program install aborted.'
  - Program requires the COMSPEC= parameter in the dos environment.
    See DOS documentation.

'Program enhanced security switched on.'
  - The SECURE enhanced security code is enabled.

'Boot sector virus detected.  Program install aborted.'
  - If you have used SECURE before without this message, then
    you are may be infected with a boot sector virus.  Contact help
    if required.  Otherwise, if this message appears during the initial
    SECURE installation, try removing device drivers from your CONFIG.SYS
    file, reboot and attempt to reinstall SECURE.  If you are absolutely
    sure you are not infected by a boot sector virus, then the '-B' switch
    may be used to bypass the conflict.  Read important information above.

'Suffix table full.  Extra data ignored.'
  - SECURE allows a maximum of 10 protected suffixes.  The 'COM' and
    'EXE' protected suffixes may not be overridden.  This message may
    also indicate a formatting problem within the configuration file.

'Privilige table full.  Extra data ignored.'
  - SECURE allows a maximum of 40 priviliged files




VI.    Configuration Information and Examples.
-----------------------------------------------------------------------------

The error code you receive while installing SECURE will give you the
information you require to figure out the corresponding configuration
bit that needs to be set.  Keep trying the program until no more
configuration bits need to be set.  Error code 6 and below suggest
serious problems and cannot be turned off.  (See Support Information)


The following code allows additional filename extensions to be protected:
00000000  Adds a suffix (filename extension) to be protected.  (up to 10)
          EXE and COM cannot be changed.
The following bits allow (unmask) a corresponding privilege:
00000001  Write direct using INT 13h, 26h, or 40h.
00000010  Format direct using INT 13h or 40h.
00000100  Write, Rename, or Delete a system file (privileged suffix).
00001000  Uses IOCTL call to Format or Write.
00010000  Unusual memory use or does not free memory to state before EXEC.
        May be required if programs frees a previously loaded TSR.
00100000  Allow program to operate as a TSR and retain its priviliges.
          Use only if a TSR requires other priviliges. Not used by itself.
01000000  Allow subsequently executed programs to inherit priviliges

Example configuration line:

00101101 R2D2.COM
  - the above line would allow the program R2D2.COM to 1) use IOCTL format
    or write commands, 2) to Write, Rename, or Delete a system file,
    3) Write directly using Int 13h or Int 26h, and 4) perform any of its
    privileged operations as a TSR with SECURE's blessing.



Example ASCII configuration file file:  (TYPE SECURE.DAT)
00000000 SYS ; protect SYS suffixed files
00000000 BIN ; protect BIN suffixed files
00000100 LINK.EXE ; allow write to protected files
00000100 EXE2BIN.EXE ; allow write to protected files
00001111 FORMAT.COM ; DOS format command
00000100 PKUNZIP.EXE ; ZIP utility
00000100 PKZIP.EXE ; ZIP utility
00000100 PKXARC.COM ; ARC utility
00000100 PKARC.COM ; ARC utility
00000100 EDLIN.COM ; DOS line editor (SYS files)
00000100 TURBO.EXE ; Borland Turbo PASCAL
01000100 BC.EXE ; Borland Turbo C++
00000100 TLINK.EXE ; Borland Turbo LINK
00000100 LUE.EXE ; LBR utility
00000100 DMOVE.COM ; Daniel Doman's copy utility
00000100 MV.EXE ; Metafile's Metaview
00010000 MLAN.EXE ; Metaview LAN access software
00010000 SYSUIDRV.EXE ; Metaview control scan/print control
00010000 BUTIL.EXE ; Btrieve utility program
00010001 SERVER.EXE ; LANtastic server software
00001100 SSVOL.EXE ; Storage Dimension's Tahiti optical drive lock program
00000100 SP.EXE ; Sprint text editor (SYS files)
00010000 SPMERGE.COM ; Sprint merge software


You may have up to 40 privileged files.

The default privileged files of EXE2BIN.COM, LINK.COM, & FORMAT.COM
are used in case of a privilege file load error.

The default protected suffixes are: EXE, COM.
EXE and COM defaults cannot be changed.

The following options are not required and cannot be overridden.
00000000 EXE
00000000 COM
00000100 COMMAND.COM

Here is some information that may help you derive your configuration file:

1) If you receive the DOS 'memory allocation' error or
   'unable to load COMMAND.COM' -  This problem can generally be fixed
   by giving a program the 'unusual memory use' privilege. ('00100000')
   Start by giving the COM and EXE files in the program's directory
   this privilege, then experiment by deleting one program at a time
   to try duplicate the error.

2) Error number 6, may indicate unusual memory use. (ref. above)

3) Incorrectly formatting the configuration file may cause an error to
   be reported.




VII.    SECURE Error Codes.
-----------------------------------------------------------------------------

Error codes are as follows:


4 and below is internal system corruption.  (should be HALTed)

5 is trace/break vector alteration.  (should be HALTed)

6 is run away code error.  (cannot be overridden by command keys)
A few programs require the 00010000 privilege mask to override the error.

11 - illegal INT 26h.
12 - illegal INT 13h or 40h write.
The corresponding privilege mask is 00000001.

21 - illegal INT 13h or 40h format.
The corresponding privilege mask is 00000010.

31 - illegal DOS create.
32 - illegal DOS open.
33 - illegal DOS write.
34 - illegal DOS delete.
35 - illegal DOS rename.
36 - illegal DOS extended create/open call.
The corresponding privilege mask is 00000100.

41 - illegal IOCTL write.
42 - illegal IOCTL format.
The corresponding privilege mask is 00001000.

51 is free memory allocation error.
The corresponding privilege mask is 00010000.



VIII. Support Information.
-----------------------------------------------------------------------------

For HELP with virus removal you can call Homebase BBS, or

Mark A. Washburn can be reached by the following means:

    Terrapin Data Systems BBS:  612-623-0152
    Compuserve:  [76050, 2130]
    Homebase BBS:  408-988-4004

or by writing to the following address:

    Mark A. Washburn
    4656    Polk Street N.E.
    Columbia Heights, MN 55421