Computer Shopper 87/Issue 087 - May 1995 - 0595.iso/virus/scan.doc

Text File | 1994-11-30 | 11.9 KB | 289 lines

              ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
               ┌░░░┌───────────────────────┐░░░┐
               │░░░│    S C A N N I N G    │░░░│
               │░░░│          Doc          │░░░│
               └▓▓▓╘═══════════════════════╛▓▓▓┘
             ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                ═══════════════════════════════

          ▒scanner▒seeks▒em▒▒   ▒▒cleaner▒seeks▒em▒

   Note - see Command.doc for a list of the scanner command line
   switches. The Command.doc is option (L) in the 'Utilities
   and Networks' menu, option (O) in the main ALERT menu.

       THE VIRUS SCANNING DETECTOR
   ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

  HOW MANY VIRUSES DOES THIS VERSION OF ALERT DETECT?

      In actuality the number of viruses  Virus ALERT  detects is
      more or less irrelevant, since ALERT will get an extremely high
      proportion of all viruses out there, known or unknown.


      This is because Virus ALERT's scanner 'VaScan.exe'
      combines both a generic signature code based detector
      (for known viruses), plus a heuristic based detector
      (for unknown viruses), plus a generic decryptor for
      detecting polymorphic and encrypted viruses.

      Because of the generic signature scanner, instead of relying
      on a strictly specific signature code for every variation of
      a particular family of viruses, Virus ALERT will find all the
      variations and mutants within the family by one signature.

      And so, instead of detecting an average of (say) 30 or
      40 different types of the Jerusalem virus that a typical
      signature code based scanner finds, Virus ALERT will
      find all 100+ current varieties and mutants.

      Likewise, whenever an all original virus comes along (new
      family), ALERT's heuristic component usually finds it.

      Likewise, ALERT is now able to detect polymorphic and
      encrypted viruses no matter what they try or do to avoid
      detection, whether they are already known or not.


      There are more than 6,000 known viruses out there, and between
      100 and 200 new viruses being reported every month. Virus
      ALERT can detect most of them. Therefore,the question about
      the number of viruses a fully generic type of scanner like
      Virus ALERT's VaScan can detect at any given time can never
      be answered with finality.


   SCREEN REPORT
  ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      Every time a scan is run from the menu, the resulting
      screen report is saved to a file called 'ALERT.LOG' in
      the C: Drive.

      The saved screen report is only to let you look back at
      a scan result later, using option (R) in the scan menu.

      The screen reports are one-time only. Each new report overwrites
      the previous report. If you want to keep an accumulating report,
      see option (L) in the 'Utilities and Other Options' menu, in the
      main ALERT menu, about how to run ALERT from a Command Line.


      Otherwise, if you simply want the regular screen report
      to be saved elsewhere, or your C: drive has a 'no write'
      feature so it will not accept the screen report, you will
      need to use option (3) in the scanning menu.


   USER DEFINED SCANS
  ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      Option (3) in the scanning menu is the option which lets you
      designate a drive to scan which is not already in the menu,
      or will let you scan a specific path of files, or lets you
      state where you want the screen report saved after a scan
      if the C: drive where it normally goes is not suitable.

      The only thing to remember when using option (3) is that you
      must always use a backslash \ when designating a drive/path.
      In other words, for example, use  E:\  and not just E: .

      When using option (3), both the path/drive to be scanned, and
      a path/drive for the screen report, must be designated at the
      same time, even if you still want the report to go to the C: Drive.


      In other words, you will first put in the scan path and press the
      (Enter) key, then put in the report location.

      You can also use option (3) for doing impromptu scans
      of select paths and file groups. But if you really need
      to do some serious user defined scans, including extension
      groups, the Utility menus, option (U) in the 'Utilities and
      Other Options' menu, offers a choice for doing fully
      customized path runs from a Dos dialogue box.

      Of course, you can also run Virus ALERT from a
      command line as described in option (L) of the
      'Utilities and Other Options' menu.


     WHAT APPEARS ON SCREEN WHILE SCANNING
   ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      While the scanner is running, the lower right window of the
      screen will display the names of the files being scanned, the
      algorithms in use for each file, and a final OK statement
      beside each file if the file is OK.


      Virus ALERT uses different types of algorithms in the heuristic
      component of the scanner to deal with different types of files.
      So for each different file being scanned, a different algorithm
      may be shown. For example, you may see  'looking',  'checking',
     'tracing',  'scanning'  or  'skipping'  following each file.

      These refer to each particular distinct algorithm
      which was used to scan each particular file.

      An explanation of these different algorithms is under the
      title `Interpretation of Scanner Codes' in the 'TECHNICAL DOC',
      option  (T)  in the Help menu.

      Likewise, one or more small characters may appear at right of each
      file as it is scanned. These are 'flags' put up by the Heuristic
      scanner, identifying various file characteristics noted by the scanner.

      If the scanner finds a known virus, the flags beside a file turn red.
      If the flags turn red but the virus prompt does not come up, then this
      implies a suspicious file which might contain an unknown virus. One
      suspicious file in a hard drive is likely not to much to worry about.
      A number of red flagged files is very likely a virus.


      An explanation of these different flags is also given
      under the title `Interpretation of Scanner Codes' in
      the 'TECHNICAL DOC', option (T) in the Help menu.


   THE SCANNING 'STATUS' WINDOW
  ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      The lower right portion of the scanning screen is the
      `status' window. It displays the number of files and
      directories encountered, and the number of viruses found.

      It also displays which file accessing system is being used:
      either "DOS" or "OWN". `Own' means that the scanner reads
      the files directly from the hard drive, bypassing Dos. When
      this is the case, a scan will run much faster.

      Virus ALERT needs about 128K for it's 'Own' file managing
      system over and above the 300K needed for the scanner and
      the 50K needed for the ALERT menus. If you see 'Dos' file
      system when scanning, you might try freeing up some ordinary
      memory and trying the scan again.


      The status window also tells the all important story about
      how fast Virus ALERT is running while scanning. Compare the
      number of seconds needed to run a specific number of files,
      and the number of kilobytes per second scanned, compared to
      most other antiviruses.

      Also take a good look at how fast ALERT loads its scanner,

      See the 'TECHNICAL DOC' in the first 'Help' menu,
      for details about the scanner's (VaScan.exe) error
      returns, error messages, virus found messages, the
      different heuristic scanner algorithms, and descriptions
      of the different heuristic scanner flags.

     WHAT TO DO IF A VIRUS IS FOUND
   ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      If Virus ALERT detects a virus, a large
      red window giving details about the virus will
      suddenly appear in the middle of your screen.

      You  C A N N O T  miss it.


      The prompt will also include options for whether
      to continue the scan, or to quit, etc.

      Read the details if you wish, then press (C) to continue the
      scan until finished. If you continue to scan, then the main
      prompt will disappear and the name of the infected file and
      the virus will be displayed in the upper window of the screen.

      If you want to continue the scan without interruptions
      from the prompt, use (N)on stop continue instead. All
      viruses detected will still be listed at the top.

      When the scan is finished, return to the main ALERT menu,
      select the CLEAN option (C), and read either the 'Quick
      Preview' or the 'CLEAN.DOC' to get quick overviews of
      what to do. Don't panic `before' reading the overview.

      MOST IMPORTANTLY, remember whether the virus
      was a boot sector virus or a file infector, and
      whether it was in the hard drive or on a floppy disk.
      The cleaner is going to want this information,
      and you're the only one who can tell it.


      If you can't remember, use (R) when in the 'Scan'
      menu or the main 'Clean' menu to bring up the
      last run screen report.

      You can also deal with a file infecting virus directly
      through the virus found prompt. The choices are: (D)elete,
      (K)ill, (R)ename.

      For example, if you choose to rename the file, the first
      character of the file extension will be replaced by the
      character 'V'. This prevents the file from being executed
      by accident before it has been investigated more thoroughly.

      Virus ALERT will not bother with the virus in later scans,
      but ONGUARD will detect it if you try to use or copy the file.

      (K)ill erases the infected file by completely removing the
      it's File Allocation Table entry. (D)elete just deletes the
      file via Dos. In other words the infected file (and virus)
      are out of the picture, but are not yet history since the
      file can still be 'Undeleted'.



      We recommend you use the (K)ill for removing infections on
      the fly. Use the 'WIPE' delete option in the Cleaning menu
      to completely illiminate the infection, since 'WIPE' overwrites
      the infected file with 0s, so the file (hence the infection)
      is history.

      The problem of 'False Positive' readings, while not common,
      can occur. For ways to help you recognize a false positive,
      and what to do about one, see near the beginning of the
      'Advanced Readers Doc', option (R) in the Help menu.


   Special note
  ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      If scanning a 'read only' CDROM disk or an extra long
      directory or subdirectory, you may see Virus ALERT slow down
      more and more as the scan progresses. This is because Virus
      ALERT cannot use its own high speed file system in long
      directories and uses the normal Dos management system
      instead. And it's no secret that the Dos file management
      system inexorably slows down in large file lists.


      Since you only need to scan a read only CDROM disk once in
      its lifetime, the actual time needed to do the scan is moot.



   SCREEN A STACK OF FLOPPY DISKS
  ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░──

      The 'MULTISCAN' option in either the scan menu or through
      the 'Utilities and Other Options' menu, is a special menu
      for convenience which lets you scan through a pile of floppy
      disks without having to keep reloading the scanner.
      The menu has a 'Quick Preview' which provides
      the ins and outs for its efficient use.




                                           FINISHED    press ESC to exit