ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/SWVSAF11.ZIP/UPDATES.ASC

Text File | 1990-11-21 | 15.0 KB | 354 lines

The  following text will deal with the major changes  that  have
been implemented in this release of SafeWord Virus-Safe. Users
of previous versions can read this section to learn how this
release differs from the previous version and from the previous
documentation.


*************
*  SWVINST  *
*************

The install program is now also an update program.   That is, if
Virus-Safe  is  found in the directory specified  by  the  user,
SWVINST   will   perform  an  UPDATE  instead  of   a   complete
installation.  This way, the user does not have to remember what
cipher  phrase was used for the initial installation.    SWVINST
will also maintain the user's registration number and registered
user text from the version being updated,  if present.   If this
information   is  NOT  present  in  the  version  about  to   be
overwritten,   SWVINST  will compute a registration  number  for
inclusion.     The  registration  number  is  derived  from  the
registered user's name, the cipher phrase,  and the current date
/ time of the PC.

The installation has been altered switch from drive A:  to drive
B:  if the SafeWord Virus-Safe programs are not found.   Failing
both of these drives will then result in an error message asking
the user to place the Virus-Safe diskette back into drive A:.

The  following  are  the  command  line  options  available  for
SWVINST:

        /CASEON
        /CASEOFF
        /CO
        /COLOR
        /NOEDITOR
        /ADDFILES=
        /DEF=
        /DEFAULTS=


/CASEON  tells the installation that when the user keys  in  the
cipher phrase, SWVINST is to be sensitive to whether the letters
(A - Z,  a  - z) are uppercase or lowercase.   SWVINST will then
leave lowercase as lowercase.

/CASEOFF  tells the installation that when the user keys in  the
cipher  phrase,  SWVINST is to treat all letters  as  uppercase.
This is the default mode.

/CO  and  /COLOR  say to use color output when the screen  is  a
color monitor.  The default is to use black and white.

The /NOEDITOR option indicates the SWVEDIT program is NOT to  be
copied to the Virus-Safe directory at installation time.    This
will  allow  the  installer to put Virus-Safe  onto  the  user's
machine  without  providing that user with the  Editor  program.
Please see the part about the Editor below for more info.   This
was originally a special request from one of our clients.

The  /ADDFILES=   option allows the installation program to  add
files  from the specified drives.   The files that can be  added
have the following extensions:  .COM, .EXE, .SYS, .OV*, &  .APP.
The  list of drives must immediately follow the = in /ADDFILES=.
The drive letters must also be placed back-to-back, or separated
by commas.  A space character will terminate the list of drives.
For  example:   /ADDFILES=C,DE  will add the above  listed  file
extensions from drives C:, D:, & E:.

/DEF=   and /DEFAULTS=  specifies what values will be used  when
adding files,  including the SWVSAFE program,  to the Checklist.
Since  this option is actually passed to the Editor  for  adding
files to the Checklist, the format of this option is the same as
for the Editor.  The first value is the algorithm to use (T,  C,
I,  A).  This is followed by the percentage value.   The time at
which the file is to be checked (L,  A) is third.  The frequency
is last.  Refer to page 3-7 of the manual for more information.


*************
*  SWVEDIT  *
*************

The filename field has had wildcard (* and ?)  capability added.
Support  for subdirectory searching has also been added.    This
means the user can have all .COM files, for example,  from drive
C: added to the Checklist.  This is accomplished by typing *.COM
in the filename field, C:\ in the pathname field, and specifying
YES  to  subdirectory  searching.   Then,   pressing  the  ALT-A
sequence  will add every .COM file to the Checklist.    However,
this  capability  is not limited to only the ADD function.    It
works with each of the other functions as well.

When changing values for an entry, the Editor will now show what
the  current values are so the user can decide whether or not to
change them.

The  Editor  now  has  the ability to PURGE an  entry  from  the
Checklist.    This  is especially useful  for  developers,   who
routinely  have programs come and go.   It also comes  in  handy
when  a user has grown tired of a product and decides to  remove
that product from their machine.

The  encryption keys used for generating the signatures will now
be derived from the device driver.  For this to work, the driver
(SWVSAFE.COM)   must be placed in the Virus-Safe directory  with
the  Checklist  file.    This allows the  installer  to  specify
/NOEDITOR  on the command line of SWVINST.   The installer  also
does  not  have to create a diskette with the Editor on  it  for
each  PC.   Previously,  each copy of Virus-Safe had to  have  a
matching   Editor   because  the  encryption   keys   from   one
installation  of  Virus-Safe to the next  were  different.    An
Editor  with the wrong encryption keys would produce  signatures
that  would  not match the signatures generated by  the  driver.
Now,  by having the Editor get the keys from the driver, all the
users  can  have  their Checklists updated using  only  the  ONE
editor.

The command line options available for SWVEDIT are as follows:

        /CO
        /COLOR
        /TO
        /TIMEOUT
        /DEF
        /DEFAULTS
        /UD
        /USEDEFAULTS
        /SP
        /SWVPATH


As  in SWVINST,  /CO and /COLOR specify to use color output when
the screen is a color monitor.  Again,  the default is black and
white.

/TO  and  /TIMEOUT specifies how long the Editor will  wait  for
keyboard input,  in seconds, before taking default values.  This
is described on page 3-7 of the manual.

To have the Editor use the same values each time a file is added
to the Checklist, the user should specify /DEF= or /DEFAULTS= on
the  command line.   This option is described in some detail  on
page 3-7 of the manual.

/UD and /USEDEFAULTS correlates with the /DEFAULTS=  option.  If
specified,  without /DEF=,  the Editor will not ask the user for
any  values  when adding files to the Checklist,  or changing  a
program's  entry.    The Editor will use default values of  CRC,
100%,   verify  the program when it is invoked,  and  check  the
program every time it is executed.

/SP=  and /SWVPATH=  can be used to specify the drive:  \   path
where the Editor is to locate the Virus-Safe files.  These files
are:  SWVSAFE.COM,  SWVCHECK.LST, &  SWVAUDIT.TRL.   The default
drive:   \  path is the path specified at installation time,  or
\SWVSAFE  on  the  current  drive if the  Editor  has  NOT  been
installed yet.


*************
*  SWVSAFE  *
*************

The  following  are  the  command  line  options  available  for
SWVSAFE:

        /CO
        /COLOR
        /TO
        /TIMEOUT
        /DEF
        /DEFAULTS
        /UD
        /USEDEFAULTS
        /SP
        /SWVPATH
        /TK
        /TAKEKBD
        /NL
        /NOLEARN
        /B
        /BATCH
        /DA
        /DISALLOW
        /NV
        /NOVISUAL
        /NM
        /NOMISSINGFILEALARMS


As  in SWVINST,  /CO and /COLOR specify to use color output when
the screen is a color monitor.  Again,  the default is black and
white.

/TO  and  /TIMEOUT specifies how long Virus-Safe will  wait  for
keyboard input,  in seconds, before taking default values.  This
is described on page 3-7 of the manual.

To  have  Virus-Safe  use the same values each time  a  file  is
added,   the  user should specify /DEF=  or /DEFAULTS=   on  the
command line.   This option is described in some detail on  page
3-7 of the manual.

/UD and /USEDEFAULTS correlates with the /DEFAULTS=  option.  If
specified,  without /DEF=,  Virus-Safe will not ask the user for
any  values when learning about new programs.   Virus-Safe  will
use default values of CRC,  100%,  verify the program when it is
invoked, and check the program every time it is executed.

/SP=  and /SWVPATH= can be used to specify the drive:\path where
Virus-Safe is to keep its Checklist and Audit trail files.   The
default  drive:   \  path is the path specified at  installation
time,   or  \SWVSAFE on the current drive if Virus-Safe has  NOT
been installed yet.

If  the  user  is having problems getting  keyboard  input  into
Virus-Safe,   the user can specify /TK or /TAKEKBD on the Virus-
Safe  command  line.    This tells Virus-Safe to take  over  the
keyboard  interrupt  and  process the  keyboard  input  directly
instead of getting input from the BIOS.  Some programs,  such as
QuickC from Microsoft, require this option.

Should  the  user decide that Virus-Safe should no longer  learn
about new programs,  the /NL or /NOLEARN option can be placed on
the  command line for Virus-Safe.   If certain drives are to  be
ignored, as far as new programs are concerned, the user can also
list the drives to be ignored.  For example: /NL=A,BFG,HI.  This
says to ignore drives A:,  B:,  F:, G:,  H:,  and I:.   The only
valid separator between drive letters is the comma.   Any  other
value between drive letters acts as the end of option character.

Specifying  a  drive letter after /NOLEARN=  does not  stop  new
programs  from executing from those drives.   Virus-Safe  simply
does  not  add  anything to the Checklist for each  new  program
encountered from those drives.

If  the user wishes to have Virus-Safe only scan the  Checklist,
the  option /BATCH can be specified on the command line.   /B is
the equivalent abbreviation.  With this option, after Virus-Safe
has  finished scanning the Checklist,  it will exit back to  DOS
without staying resident in memory.

There  is  a  new option in the  Virus-Safe  driver  program  to
disable  the execution of programs that are not in the Checklist
file.   Also,  programs will not be allowed to execute if one of
the following conditions arise:

1.  the signature does not match the entry in the Checklist,
2.  the Checklist's entry is marked for no verification,
3.  the Checklist does not exist,
4.  or the Checklist is corrupted.

This  option  is  called  /DISALLOW or  /DA,   to  disallow  the
execution  of  unknown  or  suspect  programs.    From  a  virus
detection standpoint,  if a virus-contaminated program cannot be
executed, the virus will not infect the PC.  With this option, a
corporate   PC   administrator  can  be  assured  only   company
purchased, virus-free programs are run on the company's PCs.

One of our clients asked us to not display anything when  Virus-
Safe is loaded into memory.   He did not wish to let others know
he was using Virus-Safe,  as long as no changes were encountered
in  his  files.   The /NV and /NOVISUAL options  do  just  this.
Virus-Safe  will  not  give any visual indication  it  is  doing
something,  or that it is loaded into memory.  That is, until an
error  condition  occurs requiring the  user's  acknowledgement.
These conditions are:

1.  the  signature  for a file does  not match its entry in  the
    Checklist,
2.  a  file  was not  found  at the  time it  should  have  been
    verified,
3.  a  new file is being allowed  to execute which is not in the
    Checklist.

If a file is not found when the time comes to verify it,  Virus-
Safe will alert the user to the fact thru a missing-file screen.
To  disable the display of this screen,  the user should specify
/NM or /NOMISSINGFILEALARMS on the command line.

The Virus-Safe device driver has been modified to allow the user
to  enter at the DOS prompt:  TYPE SWVSVERS.   If the driver  is
loaded  by  the  CONFIG.SYS,  it will produce a  block  of  text
indicating the version,  the registration #,  and the registered
user's  name.    This will work even if /NV is specified on  the
Virus-Safe  command  line.   The installation program will  also
produce a file by the name SWVSVERS in the Virus-Safe  directory
that will have the exact same information.   Having this ability
in  the driver,  and having the same data in a text file,   will
allow the user to determine what version is on their machine.


*************************
*  SWVSAFE and SWVEDIT  *
*************************

In both Virus-Safe and the Editor,  the follow changes have been
made.

When checking the DOS control areas,  through the reserved entry
DOS.FILES,   the  signature for DOS.FILES will now  reflect  the
following additional information:

1.  the number of "bad" clusters in the FAT,
2.  the  contents of any  sectors between  the  partition  table
    record and the start of the closest partition,
3.  the contents of the  partition table records for all logical
    drives on physical drive 0 (C:);  #1 &  #2  above apply here
    also.

When calculating the signature for DOS.FILES,  SWVSAFE & SWVEDIT
do not assume the system files are present.  That is because the
disk may be set up to force a boot from diskette.  Instead, they
search  the DOS loader record for an indication of which DOS  is
on the disk.   Finding IO.SYS says that MS-DOS is the  operating
system.   If IBMBIO.COM is found,  this says IBM's PC-DOS is the
operating  system.   Finding DRBIOS.SYS indicates this is  DRI's
DR-DOS, this being a PC-DOS compatible operating system,  a.k.a.
Compaq  DOS 3.31.   After determining which operating system  to
look  for,  SWVSAFE & SWVEDIT search for the appropriate  system
files anywhere in  the  root directory.   If these two files are
found,   their signatures are then added into the signature  for
DOS.FILES.

To sum up what DOS.FILES now encompasses, the various areas are:

1.  the boot sector,
2.  hidden sectors between partitions,
3.  the partition table records,
4.  the DOS loader records,
5.  the FATs,
6.  plus, the DOS system files IO.SYS and MSDOS.SYS.


There is a new mode for checking files,  called Turbo.  This new
mode  checks only the first 512  and last 512  bytes of  a  file
using CRC, and adds to that the length of the file.  Most viruii
are classified as appenders.   That is,  they add themselves  to
the end of a target program.  For the virus to activate, it must
alter  instructions  somewhere in the program to  point  to  the
virus  code.    This  usally happens at  the  beginning  of  the
program.    Therefore,   to  speed up the process  of  checking,
especially large programs, we have created Turbo mode.

Virus-Safe  and  the Editor both now keep track of the  size  of
each  file  in  the Checklist.   Whenever there is  a  signature
difference,   among other information written to the Audit trail
are  the  old  and  new file sizes.   This will  help  the  user
determine  which virus has struck the PC,  since many viruii are
known simply by their individual length.