Piper's Pit BBS/FTP: ibm 0020 - 0029/ibm0020-0029/ibm0028.tar/ibm0028/AVTK-2.ZIP/README.DOC

Text File | 1991-01-02 | 8.0 KB | 190 lines

New in 4.21

Findvirus

Since 4.2 was first issued, a few more viruses have emerged, and they
have been added to 4.21.  The EXTRA virus driver feature for adding
new viruses to Findvirus has been extended.  Drivers for extra viruses
can have any name, using the syntax

FINDVIRUS /EXTRA=d:\abc\anyfile.drv


New in 4.23

You can check just one file with

FINDVIRUS /FILE=d:\abc\anyfile.com

and Findvirus will exit with an appropriate errorlevel (0 = OK, 1 -
some problem, not a virus, 2 = virus.  This can be used as part of a
batch file, so that the file is checked each time before it is run.

If you want to check all files, including overlays (we suggest you do
this if, and only if, you are cleaning out after an outbreak of a
virus, then use

FINDVIRUS /VERYSLOW /E=N

The /VERYSLOW does a search of the file, including the places where
the virus should not exist.  /E=N tells FINDVIRUS to search all files,
not just those with the extensions that would lead you to expect that
they are executable.

/ONEONLY

If you are checking diskettes, and you want Findvirus to check just
one diskette and exit, put /ONEONLY on the command line.

/MUTANTS

A "mutant" is a virus which is different from the normal virus in one
(or a few) bytes.  This can arise if there is a memory hardware error
while the virus is copying itself, or in a few other, not very likely,
ways.  If this byte-change is in a place that Findvirus is using as
part of the search area, Findvirus would then fail to detect that
"mutant".  This is unlikely, because Findvirus needs to check only a
very small sequence of bytes to find the virus, and one of those would
have to change.

But if you want to allow for this possibility, the /MUTANTS option is
provided.  This allows for Findvirus to find the virus, even if one of
the bytes in the signature that it uses, has changed.  The slight
downside of using this switch, is a very tiny increase in the
probability of a false positive.

/PAUSE

If you want Findvirus to pause after loading and before checking the
first diskette, put /PAUSE in the command line.

New in 4.24

/DRIVER=abcfile.def

You can replace the standard QFVB.DRV driver with an updated driver,
using this command.  This mean that you can use a different set of
drivers, and yet still use your original write protected Toolkit
diskette, without having to write enable it.

New detection capabilities

We've added a detector for files compressed with PKZIP and LHZ.  This
is still in the process of being tested - please report if if flags
and files as being compressed when the are not.

New in 4.25

Trojans and jokes

Since Findvirus is already scanning your disk, it might as well check
for trojans such as Twelve Tricks and the Aids Information Disk
program.  But the line between a trojan (which causes damage) and a
joke program (which does not) is difficult to draw - it is a matter of
your sense of humour.  In this version of the Toolkit, we have started
to add detection for practical joke programs as well as for
ill-intentioned trojans, because we have found some joke programs have
alarmed people.

Program omitted in version 4.25

We have left Hexdump out, as the function of Hexdump is available
in the main TOOLKIT program, under Misc Browser.

New program in version 4.25 and above
-------------------------------------

CLEANBOOT

This program replaces the boot sector on a 360, 720, 1.2 or 1.44
floppy disk with a valid, non-infected sector.  You cannot boot from a
floppy diskette that has been cleaned in this way, but any virus code
on the boot is overwritten, and the diskette can be used for the
storage of data.  You should preferably run Unvirus instead of
Cleanboot, as that does a reversal of the infection process, removing
and bad sectors that the virus has created, and repairing the diskette
to close to its original state.

The purpose of Cleanboot is to supplement Unvirus, for those boot
sector viruses that are not on Unvirus's list.  It does not reverse
the infection process, but replaces the boot sector.  This means that
the diskette is no longer infectious.

To run Cleanboot, first cold-boot from a clean Dos diskette.  Then you
need to know whether each diskette is 360, 720, 1.2 or 1.44.  Here's
how you can tell.

360 kb diskettes are 5 1/4 inches, usually have a hub ring ( a ring
that reinforces the hub).  CHKDSK reports such disks as having 362496
bytes of total disk space.  They are called "double density", "high
density", "48 tpi" or "96 tpi".

1.2 mb diskettes are 5 1/4 inches, never have a hub ring ( a ring that
reinforces the hub).  CHKDSK reports such disks as having 1213952
bytes of total disk space.  They are called "High capacity".

720 kb diskettes are 3 1/2 inches, and have a write protect slider in
one corner.  When the hole in that corner is covered by the write
protect slider, the diskette can be written to.  CHKDSK reports such
disks as having 730112 bytes of total disk space.

1.44 mb diskettes are 3 1/2 inches, and have a write protect slider in
one corner.  When the hole in that corner is covered by the write
protect slider, the diskette can be written to.  They have a second
hole in another corner of the diskette, which is sensed by most drives
as indicating a 1.44 mb diskette.  Some drives lack this sensor, or
have it disabled.  CHKDSK reports such disks as having 1457664 bytes
of total disk space.

What can go wrong?

Unfortunately, we have seen a large number of diskettes wrongly
formatted.  If you format a 360 diskette to 1.2 mb, you will sometimes
"succeed", and get some 800-900 kb of available space, and 300-400 kb
in bad sectors.  If you then use such a diskette, it will rapidly
deteriorate, and your data will become inaccessible.  The problem is
that the coating on a 1.2 mb diskette must have twice the coercivity
of the coating on a 360 in order to work correctly.

This problem is clear, obvious and easily demonstrable.  A more subtle
problem is a 1.2 mb diskette formatted to 360 kb, or a 720 kb or 1.44
mb which has been cross-formatted.  The deterioration is not so rapid,
but the practice is strongly discouraged.  Unfortunately, because
there are a number of drives that do not distinguish between 720 and
1.44 diskettes, there are a lot of cross-formatted diskettes of these
types. Many of the drives in the IBM PS/2 series do not sense the hole
in the diskettes.

If you take a cross formatted 720 or 1.44 and try to read it in a
drive that senses the number of holes, the drive will behave as if the
diskette was unformatted.  The best answer is to read the diskette in
a drive that doesn't care about the number of holes, and copy the data
onto a correctly formatted diskette.

When you clean a quantity of diskettes using CLEANBOOT, if you choose
the wrong diskette type in the menu for the way that the diskette was
originally formatted, then the diskette will appear to lose files, or
have a corrupted directory.  Because some diskettes will have
originally been cross-formatted by the user, it is not possible to
always guess correctly based on the physical appearance of the
diskette.

The simple way to fix this is to run CLEANBOOT again, but this time
choosing the correct diskette type. The only part of the diskette
that CLEANBOOT writes to is the boot sector, so you can try as
many different diskette types as you want.

If the virus makes other changes to the diskette apart from
overwriting the original boot sector, these will not be undone by
CLEANBOOT.  So if the virus created fake bad sectors to store part of
itself, those fake bad sectors will still be there.

If you want to take the cleaning process one step further, you should
copy (using COPY or XCOPY, not Diskcopy) all the files from the
infected diskette to a newly formatted diskette, and format the
original diskette.

If the virus overwrote part of the data on the diskette (which Ogre
does), then that data stays overwritten.  There is no way that it can
be reconstituted from what is on the diskette.