Computer Shopper 87

home *** CD-ROM | disk | FTP | other *** search

/ Computer Shopper 87 / Issue 087 - May 1995 - 0595.iso / virus / technic.doc < prev next >

Wrap

Text File | 1994-11-09 | 36.4 KB | 985 lines

░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ┌─░ │ ░────┐ ┌─────░ │ ░─┐ ░░-░-░░▓▓▓▓▓│ ░ TECHNICAL DOC │▓▓▓▓▓░░░-░-░░ └─░ │ ░────┘ └─────░ │ ░─┘ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1. ░░░ INTERPRETATION OF SCANNER CODES ░░ Heuristic names ░ Heuristic flags 2. ░░ Program TECHNICAL data and error returns 3. ░░ The Program WORKING parts 4. ░░ The Program ERROR messages ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░ 1 ░ Scan Code INTERPRETATIONS │▓▓▓▓▓░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ If interested in a description of how Virus ALERT's Heuristic scanner and cleaner works, see the Advanced Readers doc, option (R) in the Help menu. HEURISTIC SCANNING ALGORITHM NAMES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ When Virus ALERT is scanning, it will display the terms 'Looking', 'Checking', 'Tracing', 'Scanning' or 'Skipping' to the right of the filenames it lists as it runs. These terms are the different heuristic algorithms VaScan, (the Virus ALERT scanning engine) uses. VaScan will automatically choose the most appropriate algorithm for each particular file checked. ▓░░ ░░░░░░░░░░░░░░▓ THE NAMES name brief explanation ════════════════════════════════════════════════════════════ checking checking around the program entry point decrypting decrypting encrypted coding looking the program entry point has been found scanning entire file is been scanned skipping file has been scanned, no reason to continue tracing chain of jumps is been followed ░ DETAILED EXPLANATIONS ░░░░░░░░░░░░░░░░░░░░░░░░ `CHECKING' 'Checking' indicates that the scanner has successfully located the entry point of the program, and is scanning a frame of about 4Kb around the entry point. If the file is infected, the virus' signature will be located in this area. 'Checking' is a very fast and reliable scan algorithm. Checking will be used on most unknown software. `DECRYPTING' 'DECRYPTING' indicates that VaScan has detected encrypted coding in the file and has engaged a real-time code emulator to determine if the coding permutes. A permuting code is the indication of a polymorphic virus, and if found, VaScan analyses the code to determine the nature (and name if known) of the virus. `LOOKING' 'Looking' indicates that VaScan has successfully located the entry point of the program in one step. The program code has been identified so VaScan knows where to search without the need of additional analysis. 'Looking' will be used on most known software. `SCANNING' `Scanning' means that the scanner is scanning the entire file (except for the exe-header which cannot contain any viral code). This algorithm is automatically used when 'Looking', 'Checking' or 'Tracing' can't be used safely. This is the case when the entry-point of the program contains other jumps and calls to codes located outside the scanning frame, or when the heuristic analyzer found something that should be investigated more thoroughly. `Scanning' is a slower algorithm. Also, since it processes almost the entire file including data areas, false alarms are more likely to occur. The `Scanning' algorithm is used while scanning boot sectors, SYS and BIN files. `SKIPPING' 'Skipping' is used for SYS and OVL files only. It simply means that the file was scanned. As there are many SYS files containing no code at all (like CONFIG.SYS), it makes absolutely no sense to waste time scanning these files for viruses. The same applies to .OV? files. Many overlay files do not deserve to be so called since they lack an exe-header. Such files cannot be loaded through DOS, which makes them just as invulnerable to direct virus attacks as .TXT files are. If an .OV? file is of a type that the scanner determines is worthy of scanning, and the scanner reports a virus has infected it, then it would have had to involve one of the relatively few overlay files which do contain an exe-header. In that case the infection was the result of the virus monitoring the DOS exec-call (function 4Bh), which infects any program being invoked that way including 'real' overlay files. `TRACING' 'Tracing' is a fast and reliable scan algorithm used primarily for TSR-type COM files or Turbo Pascal-compiled programs, and means that the scanner has successfully traced a chain of jumps or calls while locating the entry-point of the program and is scanning a frame of about 4Kb around this location. Most viruses will force the scanner to use 'Tracing'. If the file has been infected, the signature of the virus will be located in this area. HEURISTIC SCANNING FLAG SYMBOLS ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ VaScan has 25 different heuristic scanning flags. Heuristic flags are the simple characters which appear beside some of the files being scanned during a scan run. There are two kinds of flags: the simple informative ones appear in Lower-case, the more serious flags appear in Upper-case. The lower-case flags are indicative of special characteristics of the file being processed, whereas the upper-case warnings may indicate a virus. The less important lower-case flags can be considered to be for your information only. They provide you with file information you might find interesting. The more serious warning flags printed in upper-case MIGHT point toward a virus. It is quite normal that you have some files in your system which can trigger an upper-case flag. ░░ Flags will turn red if there is a possible virus. ▓░░ ░░░░░░░░░░░░░░▓ THE FLAG DESCRIPTIONS Name / brief explanation ════════════════════════════════════════════════════════════ # - Decryptor code found F - Suspicious file access ! - Invalid program G - Garbage instructions ? - Inconsistent header K - Unusual stack L - Program load trap h - Hidden or System file M - Memory resident code i - Internal overlay N - Wrong name extension J - Suspicious jump construct O - Code overwrite p - Packed or compressed file R - Suspicious relocator w - Windows or OS/2 header S - Search for executables T - Invalid timestamp A - Suspicious Memory Allocation U - Undocumented system call B - Back to entry w - Windows or OS/2 header D - Direct disk access Y - Invalid bootsector E - Flexible Entry-point Z - EXE/COM determinator ░ DETAILED EXPLANATIONS ░░░░░░░░░░░░░░░░░░░░░░░░ # - Decryptor code found The file possibly contains a self-decryption routine. Some copy protected software is encrypted so this warning may appear for some of your files. If, however, this warning appears in combination with, for example, the 'T' warning, there could be a virus involved and VaScan assumes the file is contaminated. Many viruses encrypt themselves and cause this warning to be displayed. ! - Invalid program Invalid opcode (non-8088 instructions) or out of range branch. The program either has an entry point that has been located outside the body of the file, or reveals a chain of 'jumps' that can be traced to a location outside the program file. Another possibility is that the program contains invalid processor instructions. The program being checked is probably damaged, and cannot be executed in most cases. Anyway, VaScan does not take any risks and uses the 'scan' method to scan the file. ? - Inconsistent header The program being processed has an exe-header that does not reflect the actual program lay-out. The DOS SORT.EXE program will cause this warning to be displayed, because the actual size of the program file is less than reported in the 'size-of-load module' field in the exe-header. Many viruses do not update the exe-header of an EXE file correctly after they have infected the file, so if this warning pops up frequently, it seems you have a problem. This warning for the DOS SORT.EXE program is a known false positive. (Hopefully MicroSoft will correct the problem before the next release of DOS.) A - Suspicious Memory Allocation The program uses a non-standard way to search for, and/or to allocate, memory. A lot of viruses try to hide themselves in memory so they use a non-standard way to allocate this memory. Some programs (high-loaders or diagnostic software) also use non-standard ways to search or allocate memory. B - Back to entry The program seems to execute some code, and after that it jumps back to the entry-point of the program. Normally this would result in an endless loop, except when the program has also modified some of its instructions. This is quite common behaviour for computer viruses. In combination with any other flag VaScan will report a virus. D - Direct disk access This flag is displayed if the program being processed has instructions near the entry-point to write to a disk directly. It is quite normal that some disk related utilities cause this flag to be displayed. If a number of your files, none of which have any business writing directly to a disk, cause this flag to be displayed, your system is probably infected by an unknown virus. Note that a program that accesses the disk directly does not always have to be marked by the 'D' flag. Only when the direct disk instructions are near the program entry point will it be reported by VaScan. If a virus is involved, the harmful instructions are always near the entry point, which is the place where VaScan looks for them. E - Flexible Entry-point The program starts with a routine that determines its own location within the program file. This is rather suspicious because sound programs have a fixed entry point so they do not have to determine this location. For viruses, however, this is quite common - about 50% of the known viruses cause this flag to be displayed. F - Suspicious file access VaScan has found instruction sequences common to infection schemes used by viruses. This flag will appear with those programs that are able to create or modify existing files. G - Garbage instructions The program contains code that seems to have no purpose other than encryption or avoiding recognition by virus scanners. In most cases there will not be any other flags since the file is encrypted and the instructions are hidden. In a few cases this flag will appear for 'normal' files. These files, however, are badly designed, which is the reason the 'garbage' flag appears. h - Hidden or System file The file has the 'Hidden' or the 'System' file attribute set. This means that the file is not visible in a DOS directory display but VaScan will scan it anyway. If you don't know the origin and/or purpose of this file, you might be dealing with a 'Trojan Horse' or a 'joke' virus program. Copy such a file onto a diskette; then remove it from its program environment and check if the program concerned is missing the file. If a program does not miss it, you will have freed some disk space, and maybe you have saved your system from a future disaster in the process. i - Internal overlay The program being processed has additional data or code behind the load-module as specified in the exe-header of the file. The program might have internal overlay(s), or configuration or debug information appended behind the load-module of the EXE file. J - Suspicious jump construct The program did not start at the program entry point. The code has jumped at least two times before reaching the final start-up code, or the program jumped using an indirect operand. Sound programs should not display this kind of strange behaviour. If many files cause this warning to be displayed, you should investigate your system thoroughly. K - Unusual stack The EXE file being processed has an odd (instead of even) stack offset or a suspicious stack segment. Many viruses are quite 'buggy' by setting up an illegal stack value. L - Program load trap The program might trap the execution of other software. If the file also causes flag M (memory resident code) to be displayed, it is very likely that the file is a resident program that determines when another program is executed. A lot of viruses trap the program load and use it to infect the program. But some antivirus utilities also trap the program load. M - Memory resident code VaScan has found instruction sequences which could cause the program to hook into important interrupts. A lot of TSR (Terminate and Stay Resident) programs will trigger this flag, because hooking into interrupts is part of their usual behaviour. If, however, a lot of non-TSR programs cause this warning flag to appear, you should be very suspicious. It is likely that your files have been infected by a virus that remains resident in memory. Note that this warning does not appear with all true TSR programs. Nor can TSR detection in non TSR programs always be relied upon. N - Wrong name extension Name conflict. The program carries the extension .EXE but appears to be an ordinary .COM file, or it has the extension .COM but the internal layout of an .EXE file. A wrong name extension might in some cases indicate a virus, but in most cases it does not. O - Code overwrite This flag will be displayed if VaScan detects that the program overwrites some of its own instructions. However, it does not seem to have a complete (de)cryptor routine. p - Packed or compressed file The program has been packed or compressed. There are some utilities that are able to compress a program file, like EXEPACK or PKLITE. If the file was infected after the file had been compressed, VaScan will be able to detect the virus. However, if the file had already been infected before it was compressed, the virus has also been compressed in the process, and a virus scanner might not be able to recognize the virus anymore. Fortunately, this does not happen very often, but you should beware. A new program might look clean, but can turn out to be the carrier of a compressed virus. Other files in your system will then be infected too, and it is these infections that will be clearly visible to virus scanners. R - Suspicious relocator Flag 'R' refers to a suspicious relocator. A relocator is a sequence of instructions that changes the proportion of CS:IP. It is often used by viruses. Those viruses have to relocate the CS:IP proportion because they have been compiled for a specific location in the executable file; a virus that infects another program can hardly ever use its original location in the file as it is appended to this file. Sound programs 'know' their location in the executable file, so they don't have to relocate themselves. On systems that operate normally, only a small percentage of the programs should therefore cause this flag to be displayed. S - Search for executables The program searches for *.COM or *.EXE files. This by itself does not indicate a virus, but it is an ingredient of most viruses anyway (they have to search for suitable files to spread themselves). If accompanied by other flags, VaScan will assume the file is infected by a virus. T - Invalid timestamp The timestamp of the program is invalid: e.g. the number of seconds in the timestamp is illegal, or the date is illegal or later than the year 2000. This is suspicious because many viruses set the timestamp to an illegal value (like 62 seconds) to mark that they have already infected the file, preventing themselves from infecting a file for a second time around. It is possible that the program being checked is contaminated with a virus that is still unknown, especially if many files on your system have an invalid timestamp. If only a very few programs have an invalid timestamp, you'd better correct it and scan frequently to check that the timestamp of the files remains valid. U - Undocumented system call The program uses unknown DOS calls or interrupts. These unknown calls can be issued to invoke undocumented DOS features, or to communicate with an unknown driver in memory. Since a lot of viruses use undocumented DOS features, or communicate with memory resident parts of a previously loaded instance of the virus, it is suspicious if a program performs unknown or undocumented communications. Nevertheless, it does not necessarily indicate a virus, since some 'tricky' programs use undocumented features also. w - Windows or OS/2 header The program can be or is intended to be used in a Windows (or OS/2) environment. As yet VaScan does not offer a specialized scanning method for these files. Of course that will change as soon as Windows or OS/2 specific viruses start occurring. Y - Invalid bootsector The bootsector is not completely in accordance with the IBM defined bootsector format. It is possible that the bootsector contains a virus or has been corrupted. Z - EXE/COM determinator The program seems to check whether a file is a COM or EXE type program. Infecting a COM file is a process that is not similar to infecting an EXE file, which implies that viruses able to infect both program types should also be able to distinguish between them. There are of course also innocent programs that need to find out whether a file is a COM or EXE file. Executable file compressors, EXE2COM converters, debuggers, and high-loaders are examples of programs that may contain a routine to distinguish between EXE and COM files. ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░ 2 ░ Program TECHNICAL Data │▓▓▓▓▓░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ SYSTEM REQUIREMENTS ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░── Virus ALERT can be executed on any IBM or compatible PC. Virus ALERT needs 250 K free memory to run, and requires DOS 3 or higher. However, DOS 5 or higher is recommended. Virus ALERT is compatible with networks, Windows, DR-DOS, etc. MEMORY REQUIREMENTS ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ Free memory needed for the executable modules: VaScan 300 Kb OnGuard 32 Kb VaClean 96 Kb VaUtil 64 Kb Alert menus 50 Kb Alert's 'Own' faster scanning file management system needs an additional 128 Kb, (if not available, management reverts to 'Dos'). Free memory needed for the TSRs: minimum minimum to initialize: left after set in place: OnGUARD 31 Kb 1.2 Kb (if put OnGUARD in upper memory) VaDriver 5 Kb 3 Kb The Installation proceedure using option (i) in the ALERT menu requires about 500 KB, because the scanner is used and because of the linkage of menus involved. Typing: INSTALL at dos instead, saves about 50 KB. EXIT CODES ░▒▒▒▒▒▒▒▒░ VaScan terminates with one of the following exit codes: Errorlevel 0 No viruses found / No error occurred 1 No files found 2 Error occurred 3 Files have been changed 4 Virus found by heuristic analysis 5 Virus found by signature scanning 255 Self check failed VaUtil terminates with one of the following exit codes: Errorlevel 0 No error occurred 1 When option 'compare' fails or an error occurs All other utilities exit with one of the following exit codes: Errorlevel 0 No error occurred 1 Error occurred ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░ 3 ░ The Program WORKING Parts │▓▓▓▓▓░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ Virus ALERT executable modules: VaScan.exe - virus scanning module OnGuard.exe - TSR floppy disk checking module VaClean.exe - file virus cleaning module VaUtil.exe - boot virus cleaning module VaDriver.exe - control module for OnGUARD Support Virus ALERT modules: VaScan.lng - message module for OnGUARD.exe VaScan.sig - virus signatures package for VaScan.exe and OnGUARD.exe VaDriver.lng - message module for VaDriver.exe Virus ALERT menus: ALERT.exe - main ALERT menu system Install.exe - installation menu Index.exe - the hyper-text index Utility.exe - utilities menu Net.exe - networks menu Note - For a list of all the document and support files, see option (L) in the (second) Help menu screen. ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░ 4 ░ The Program ERROR messages │▓▓▓▓▓░░░░░░ ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ VaScan VIRUS DETECTION MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ When VaScan detects a virus, a large red window giving details about the virus is posted to the middle of your screen. ░ The different detail messages are: Infected by [name of virus] virus - meaning that the file is infected by the virus mentioned. Is Joke named [name of Joke] - meaning that there are some programs which simulate that the system is infected by a virus. A joke is completely harmless. Is Trojan named [name of Trojan] - meaning that the file is a Trojan Horse. Do not execute the program but DELETE it immediately using the DELETE prompt. Damaged by [name of virus] - meaning that (unlike an infected file) a damaged file contains not the virus itself, but has been DAMAGED by the virus. Dropper of [name of virus] - meaning that the file is acting as a DROPPER program in that it has not been infected itself, but it does contain a bootsector virus and is able to install it in your bootsector when you try and load the program. Overwritten by [name of virus] - meaning that (unlike an infected file) some viruses OVERWRITE files. An overwritten file does not contain the virus itself, but has been overwritten with garbage. 'Probably' - It is also possible that Virus ALERT may encounter a file that seems to be infected by a virus, although a signature could not be found. In this case the prefix 'PROBABLY' is displayed before the message. VaScan SCANNING ERROR MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ Cannot create logfile. The specified log file path is illegal, the disk is full or write protected, or the file already exists and cannot be overwritten. [Cannot read datafile] VaScan needs access to its data file to be able to tell you the name of the virus. If it cannot access the data file it displays this message instead of the virus. Command line error. An invalid or illegal command line option has been specified. No matching executable The specified path does not exist, files found. is empty, or is not an executable file. Sanity check failed! VaScan detected that its internal checksum does not match anymore. VaScan is possibly contaminated by a virus. Obtain a clean copy of VaScan, copy the program onto a write protected boot diskette, boot from that diskette and try again. VaClean PROMPTS AND MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ VaClean.exe - for File viruses Attempt to violate The cleaner will not disassemble this license agreements. program for obvious reasons. Encountered keyboard The emulated program tries to read the input request. keyboard. This is very unusual for viruses, so the file is probably not infected at all. Encountered an invalid The emulator encountered an unknown instruction. instruction. For some reason the emulation failed. The program can probably not be disinfected. DOS program-terminate The emulated program requests DOS to stop request. execution. The program is not infected at all, or infected by an overwriting virus that does not pass control to its host program. The program cannot be disinfected. Jumped to original The program jumped back to the start program entry point. position. It is very likely it is infected. The program can probably be disinfected. Undocumented DOS call This is very common for viruses that add with pointers to relocated themselves in front of the COM type program code. The program can probably be disinfected. Encountered an endless The cleaner encountered a situation in which loop. the program is executing the same instruction sequences over and over again for hundreds of thousands of times. It is unlikely that the program will ever escape from this loop, so the emulation will be terminated. Ctrl-break pressed. The user pressed (Ctrl-Break) so the clean attempt is aborted. Emulation aborted for If this message is shown, please send a unknown reason. copy of the file being emulated to LOOK Software. Sorry, the collected The heuristic cleaning mode of the cleaner information is not is aborted and has not been successful. The sufficient to clean only option left is to restore the file the file... from a backup or to re-install the program. Collected enough material The emulation of the virus provided VaClean to attempt a reliable with all information to disinfect the file. clean operation. Some DOS error occurred. Some DOS error occurred while trying to VaClean aborted! clean the file. Check that no files are read-only or located on a write protected disk, and make sure there is a reasonable amount of free disk space. The clean attempt seems It seems that VaClean removed the virus to be successful. Test from the file. No doubt about the virus: the file carefully! it is gone. However, take care and test the file carefully to see if it works as expected. Reconstruction failed. The cleaner is going to emulate the file Program might be over to try to clean the file heuristically. written. Trying an emulation. Emulation terminate: The emulation process has been terminated (reason) for the reason specified. The cleaner will where (reason) can be now consult the collected information to one of the following: see if it can disinfect the file. 1. Jump to BIOS code. The virus tried to perform a call or jump directly into BIOS code. This process can not be emulated so it will be aborted. The program can probably not be disinfected. 2. Approached stack crash. The emulated program is approaching a crash. Something went wrong while emulating the program so it will be aborted. The program can probably not be disinfected. VaUtil PROMPTS AND MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ VaUtil.exe - for Boot Sector virus VaUtil.exe has no error messages. ONGUARD - THE TSR MONITOR ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░── Technical name - OnGuard.exe Associate driver's name - VaDriver.exe ONGUARD ERROR PROMPTS AND MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ Data file not found. OnGuard has not been able to locate the VaScan.sig data file. Not enough memory There is not enough free memory to when ONGUARD is process the data file. Try to enable already loaded and in swapping upper memory, or if you running are already doing so, try another swapping mode. VaDriver ERROR PROMPTS AND MESSAGES ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ These messages also relate to the use of ONGUARD. Another version of You started a VaDriver.exe with another VaDriver is already version number or processor type than resident! the VaDriver already in memory. Cannot remove VaDriver. You tried to remove VaDriver from memory, Unload other TSRs first! but other resident software was loaded after VaDriver. Resident softwares can be removed from memory only by unloading them in reverse order. LAN support was already You tried to use the option 'net' for a installed. second time, or VaDriver already enabled network support automatically. VaDriver not active. ONGUARD needs VaDriver, so you have Load VaDriver first! to load VaDriver first. VaDriver is not The version of VaDriver found in <version x.xx>. memory does not match the version number of ONGUARD. Make sure you do not mix version numbers! This version of You are using a processor optimized VaDriver requires version of VaDriver which cannot be a <typeID> processor. executed by the current processor. GENERAL PROBLEMS AND SOLUTIONS ░▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒░ ░ MEMORY OPTIMIZERS Problem: Some memory optimizers, such as MemMax, MemMaker and Optimize, may not work properly if a resident Virus ALERT utility such as VaDriver is on board. This is because the resident utility can act as a device driver as well as a normal executable, depending on the way it is loaded, and this confuses some memory optimizers. Also a utility may hook itself into DOS for better virus protection, and they can not be moved in memory once loaded. Any attempt to do so by the memory optimizer simply hangs the machine. Solution: Remove the Virus ALERT utilities from the AutoExec.Bat file and/or Config.Sys file and run the memory optimizer. When finished add the utilities back to the AutoExec.Bat and Config.Sys file, and highload them if desired. ░ DOS APPEND Problem: The /X switch of the DOS APPEND command needs close watching for the following reason: APPEND is able to 'fool' programs by accessing another file than the file requested, if a file with the same name exists in another directory. For example, if you APPEND a directory with /X and then try to delete *.BAK files in another directory when no such files exist in the directory, then the .BAK files in the APPENDed directory will be deleted instead. Solution: VaScan switches off APPEND automatically if they detect that it has been loaded, but the resident Virus ALERT utilities don't. Therefore be very careful if you need to use the APPEND /X option and switch it off again as soon as you don't need it anymore. FINISHED press ESC to exit