PC Pro 1995 April/PCPRO_595.ISO/fprot/readme.doc

Text File | 1995-01-15 | 9.1 KB | 257 lines

README FIRST!

Before running F-PROT Professional for the first time, please verify
that your F-PROT Professional disk is write-protected. If you suspect
your computer has a virus, boot from a floppy disk that is
write-protected and then scan for viruses.

__
Notes on F-PROT Professional 2.16
January 10th, 1995

F-PROT now provides an /ARCHIVE switch, which can be used to scan .ZIP files.
Note that PKUNZIP.EXE is required in the F-PROT directory.

A TEMP environment variable with a valid drive path is also required. For
example, Windows uses C:\WINDOWS\TEMP as its temp directory, and F-PROT will
create a sub-directory there for unzipping.

__
Notes on F-PROT Professional 2.15
November 10th, 1994

VIRSTOP now provides a separate /XMS switch for swapping to XMS memory. This
gives you more control over how VIRSTOP swaps when you configure the TSR to
use the smallest amount of memory.

The /XMS switch is set as the default in VSCONFIG. This means that for most
implementations you will have to do nothing special to take advantage of the
XMS support.

Note that if you use both /DISK and /XMS in a command line, /XMS takes
priority.

If you are using the /FREEZE switch and a virus is detected, you will
be notified of the infection *before* the system locks up.




CHANGES TO F-PROT PROFESSIONAL 2.14d

When running a centrally administered VIRSTOP with the /DISK switch
from a network drive, VIRSTOP can be told where to save its data files
with /DISK:x.  The x is the drive letter where the files will be stored.
Keep in mind that the XMS function will overide the /DISK switch.

If using the SET command to assign an environment variable from a
LOGIN script, be sure to enclose the value in quotation marks "".
SET FP-DATA="C:\TODAY.DAT"

NETWORK INSTALLATIONS

F-PROT Professional supports installation from a server to a workstation.

First, copy the files from the master disks to a directory on the server.
The directory name isn't important, just make sure that all users have
access to it.

The last installation disk contains a \NETWORK sub-directory with a
special DISK.ID and INSTALL.DAT to be used for this type of
installation.  Copy these files to the sub-directory on the server
where the other F-PROT Professional files reside overwriting the
original files.  This method can also be used to install from
a single high density disk.

At this point you may now install from the server to the workstation.


CHANGES TO F-PROT PROFESSIONAL 2.14a
Fri  14-Oct-1994

F-PROT.EXE

When the /TODAY switch is set, the date marker is not updated until the
program terminates.  If you reset in the middle of a scan, it will
re-scan upon the next boot.

VIRSTOP.EXE

After notification, VIRSTOP will block ALL access to an infected
floppies, including directory commands.  Use the
/NOBOOT switch or disinfect the floppy.

VIRSTOP will prevent FILE MANAGER from accessing an infected floppy.
The floppy may appear as a non-standard format.  Use F-PROT to
disinfect.

WVIRSTOP.EXE
The WVIRSTOP "virus" icon cannot be closed from Windows Program Manager.

UPDATE.BAT
Uses both B-CHECK.COM and V-CHECK.COM to complete all functions.

BANCAST.EXE
Now defers the notification of boot sector viruses under DOS until
the next application loads.

CHECK.EXE
Now returns an exit code 22 if there is a missing or damaged check
database file.

B-CHECK.COM
Broadcast check program works for both NOVCAST and BANCAST to
ensure proper load and operation.

FIXDISK.EXE
The command line installation offers the option to save the MBR to a
data file.  In the event of infection with a boot sector virus, the
original MBR can be restored using this file.

VIRLIST.DOC
This is a list of viruses that F-PROT can detect/disinfect.  The list
has been updated to include many new viruses.  VIRLIST.DOC is
available for download on the Command Software Systems support BBS.


CHANGES TO F-PROT PROFESSIONAL 2.13
Mon  20-Jun-1994

F-PROT.EXE
Added /ACCESS switch to keep last access date from changing when doing
scans on a Novell file server.  This will maintain compatibility with
archival software that relies on the last access date.

F-PROT now incorporates generic boot sector and master boot record
disinfection.  This will be good for viruses that are not known about
yet or new variants that can't be disinfected.  Before using the
generic disinfector, it would be a good idea to use FIXDISK and save
the boot information to a file, both as a backup and to send to us
for analysis.

__

CHANGES TO F-PROT PROFESSIONAL 2.12a
Fri  22-Apr-1994

FIXDISK.EXE
The utility FIXDISK.EXE has been added to this version of F-PROT.
This is a general MBR or boot sector repair utility that will lay down
a clean boot record on an infected disk.  Before repairing, it will
save the first track of the hard drive or floppy drive to a file for
backup and analysis purposes.  The saved file can also be used as a
rescue file, if you have a clean system at the time of saving.
FIXDISK has three basic modes of operation, REPAIR, UNDO and SAVE.

REPAIR saves the first track to a file and attempts to repair the boot area.
UNDO   reads the file that was saved and puts it back in the boot area.
SAVE   saves the first track to a file that can be used later to disinfect.

FIXDISK is a basic command line utility.  With no options specified,
FIXDISK will display a usage screen.

Usage: FIXDISK <action> <drive>
<action> is one of REPAIR, UNDO or SAVE.  Only one can be specified
         at a time.

<drive>  is the location of the disk to work on.  <Drive> can be a
         letter, such as A:, B: or C:.  It can also be a number, to
         specify a physical hard drive in a dual drive system, 1 would
         be the first drive and 2 would be the second drive.

         If <drive> is the word FLOPPY, the next parameter would specify
         a physical floppy drive.  'FIXDISK SAVE FLOPPY 3' would mean
         to read the first track from the third physical floppy and
         save it to a file.  This is for systems with external floppy
         drives.

If you do run into a virus that F-PROT is unable to handle, please
send us the file created by FIXDISK so that we can analyze it.  FIXDISK
will not be able to repair MBRs that have had their partition information
changed.  In this case, we would need to see the saved file to update
F-PROT.


VIRSTOP.EXE
VIRSTOP now has a new switch, /REHOOK.  This allows you to load VIRSTOP
before a network redirector yet still provide the capability of scanning
the file before the network tries to execute it.  By using the /REHOOK
switch, VIRSTOP will reattach itself to INT 21h.  This can easily be
invoked from a Novell login script:

#VIRSTOP /REHOOK

So now VIRSTOP can be loaded as a device driver in CONFIG.SYS, or at the
top of AUTOEXEC.BAT.  To use /REHOOK, VIRSTOP must already be in memory.
Please note that the /REHOOK switch may be used only once.

Another new switch of VIRSTOP is /NOTRACE.  This allows compatibility with
some memory managers and machines with a Cyrix chipset.

VIRSTOP.EXE /DISK SWITCH
A change to the /DISK switch now allows you to specify the drive where the
_VIRSTOP.TMP file is stored. The format for this command is /DISK:X where X
is the drive letter. The drive letter change must be entered from the command
line.

__

CHANGES TO F-PROT PROFESSIONAL 2.11a

NETWORK-SUPPORT FOR THE /TODAY SWITCH

If you're running F-PROT Professional from the server, you can use the
FP-DATA environment variable to keep the F-PROT.DAT file on each user's
local hard disk. The format for this is as follows:

SET FP-DATA=C:\F-PROT.DAT

Note that you must provide the full drive path with a filename. Also, you
may change the filename F-PROT Professional uses simply by changing the
environment variable. For example:

SET FP-DATA=C:\TODAY.DAT

If setting from a Novell login script use quotes around the data:
SET FP-DATA="C:\TODAY.DAT"


CHANGES TO F-PROT PROFESSIONAL 2.11

A new feature to F-PROT Professional is the ability to perform only
one scan a day through the AUTOEXEC.BAT or a login script. To accomplish
this, simply add the /TODAY switch to your F-PROT Professional command
line. For example:

C:\F-PROT\F-PROT /HARD /TODAY

When you use the /TODAY switch the date of the last scan is stored in
F-PROT.DAT. On subsequent scans the date stored in the file is checked
against the current date. If the days are the same, F-PROT Professional
will return an errorlevel of 99 and abort without scanning.

You may test for this errorlevel in a batch file. For example, you may
choose to do a full scan once a day using the /TODAY switch and then a
quick scan of your DOS sub-directory on every reboot for the rest of the
day.




TECHNICAL SUPPORT

Command Software Systems has greatly expanded its technical support to
include a variety of electronic services. You may contact us at any one
of the following:

   Voice: 407/575-3200 9:00 am to 5:00 pm EST.
     Fax: [phone]
     BBS: 407/575-1281
     CIS: 75300,3645 (Type GO PCVENF at any CIS ! prompt. We're in section 9.)
MCI Mail: COMMAND
Internet: [e-mail]