Hall of Fame/HallofFameCDROM.cdr/util2/vshld63.lzh/VSHLD63.DOC

Text File | 1990-06-02 | 24KB | 510 lines

                     VSHIELD.EXE 1.8 V63
                    Copyright McAfee Associates 1989, 1990


NOTE:  This product may not be used in a business, corporate,
organizational, government or agency environment without a
negotiated site license.  Contact McAfee Associates for
information:

        408 988 3832 - Voice phone
        408 970 9727 - FAX
        408 988 4004 - BBS System



    VSHIELD is the replacement product for SCANRES, beginning with
version 62.  It is a major re-design of the older product and it
now includes the capability to prevent boot sector infections as
well as file infections.  This boot-virus protection capability had
been requested by numerous users and now here it is.  VSHIELD has
been tested against all of the known viruses and it successfully
prevents infection in all cases.  No false alarms or undesirable
system interferences have been reported from the use of the
program.  Current license holders of the existing SCANRES product
will receive full rights to the VSHIELD program at no additional
cost.

Executable Program (VSHIELD.EXE):
    Versions 46 and above are packaged with a VALIDATE program
that will authenticate the integrity of VSHIELD.EXE.  Refer to the
VALIDATE.DOC instructions for the use of the validation program.
    The validation results for V63 should be:
                SIZE: 40,987
                DATE: 6-02-1990
    FILE AUTHENTICATION:
        Check Method 1 - CCE7
        Check Method 2 - 01FB

    You may also call the McAfee Associates bulletin board at 408
988 4004 to obtain on-line VSHIELD.EXE verification data.  The
VALIDATE program distributed with VSHIELD may be used to
authenticate all future versions of VSHIELD.


Notes on Version 63:
    Version 63 has been one of the most painful versions we have
put together.  There have been 17 new viruses and virus sub-strains
discovered in the 35 days since the release of version 62-B.
    In addition, we've been struggling with the issue of how to
count viruses in a meaningful way that does not place us in a
seemingly disadvantageous competitive position.  For example:
Numerous anti-virus programs advertise the number of viruses that
they are able to block, and these numbers range from less than 50
to over 100.  On analysis, these numbers included all of the known
sub-strains of the viruses, and their virus count by our
classification was always substantially less.  We group viruses by
major type, where possible, to make it easier to manage, both from
an identification and removal basis.  But on a sheer numbers
comparison, VSHIELD appears in a weaker light.  After careful
thought, we decided to stick with our classification scheme, but
in the VIRLIST.TXT we will list the known variants detected in
parentheses.  By the competition's counting scheme, we now block
167 viruses.  By our count, we block 97.
    The 17 new viruses and new sub-strains added for version 63
have come from a variety of sources.  Vesselin Bontchev from
Bulgaria submitted three new variants of the 512, one new variant
of the W-13 virus and two entirely new viruses that have surfaced
in Eastern Europe.  Dave Chess from IBM provided me with three new
viruses collected through the various IBM contacts.  Patricia
Hoffamn provided one new virus and two new variants submitted from
users of the FidoNet network.  The Icelandic virus researcher
Fridrik Skulason provided one new virus.  The remaining four were
submitted directly by Homebase users.  The VIRLIST.TXT document
describes the main operating characteristics of the new viruses.
To avoid duplication of effort, I am referring users to Patricia
Hoffman's most current VSUM document for a detailed description of
the new viruses.  This document may be obtained from most bulletin
boards.



Introduction:

    VSHIELD is a memory resident program that  prevents
viruses from getting into your system.  It monitors and scans
programs as they are loaded and prevents infected programs from
executing.  It also prevents boot viruses from entering the system
by trapping each warm-boot request (Ctrl-Alt-Del), and disallowing
re-boots from infected diskettes.  It also scans specific areas of
the system - the boot sector, partition table, hidden files,
Command Interpreter and itself, when it is first executed.  Thus,
if the power is turned off and then the system is booted from an
infected floppy (while VSHIELD is not running), VSHIELD will detect
any infection the next time VSHIELD is loaded.
    The memory resident module -- VSHIELD.EXE - will identify the
virus strain which has caused the infection in all cases of the
known viruses.  It remains active in your system at all times after
it is loaded.
    VSHIELD version 1.8V63 can identify and prevent infection from
97 major virus strains and 167 sub-strains.  The 167 viruses
include the ten most common viruses which account for over 95% of
all reported PC infections.  The complete list (in order of most
recent appearance) is outlined in the accompanying file:
VIRLIST.TXT.

    These viruses infect one of the following areas:  The hard
disk partition table; the DOS boot sector of hard disks or
floppies; or one or more executable files within the system.  The
executable files may be operating system programs, system device
drivers, .COM files, .EXE files, overlay files or any other file
which can be loaded into memory and executed.  VSHIELD identifies
the area or file that has become infected and indicates the name
of the virus that has infected each area.
    When an infection is identified, the VIRUSCAN non-resident
system scanner should be used to scan the entire system and
determine the extent of the infection.  If you do not have the
VIRUSCAN non-resident program, it may be downloaded from the
HomeBase BBS at 408 988 4004.


Operation:

IMPORTANT: First place VSHIELD on a write protected floppy prior
to installing it.  This will ensure a valid copy in the event that
the program becomes infected.

    To install VSHIELD, place the following line as the first
    entry in your AUTOEXEC.BAT file:

            VSHIELD  [/NB]

            /NB is an optional parameter that tells VSHIELD
             not to check the boot sector of floppies for
             viruses on a re-boot.  This option should only
             be used if the re-boot check confilcts with
             other memory resident programs.

    Then copy the file VSHIELD.EXE to the root directory of your
    bootable hard drive (usually C:).

    VSHIELD will then become active each time the system is
powered-on or re-booted.  It will check the critical areas of the
system for viruses, including itself, and then monitor all program
loads.  As programs are loaded, VSHIELD will scan the programs
looking for viruses.  If a virus is found, VSHIELD will display a
warning message and name the infection.  The infected program will
then be terminated.  If a re-boot is attempted while an infected
diskette is in the bootable floppy drive, VSHIELD will disallow the
boot attempt and will display a warning message.
    Unlike many memory resident virus filter programs, VSHIELD
will not cause false alarms.  If a warning message is issued by
VSHIELD, you can be assured the identified program or diskette is
infected.  Also, since it does not attempt to monitor file I/O or
normal disk accesses, it will not conflict with other memory
resident programs.

**************************
MEMORY RESIDENT CONFLICTS:
**************************

    VSHIELD should normally be loaded as the first entry in the
AUTOEXEC file.  However, disk cache programs that allow cache
writes as well as reads, such as PC Tools' PC-Cache, will not work,
and may cause severe damage to the disk data, unless they are
loaded before any other memory resident programs.  If you are
running a disk cache routine that caches reads AND writes to the
disk, then place VSHIELD at the end of the AUTOEXEC file.
    If you place VSHIELD at the end of the AUTOEXEC file, then the
Write Delay paramaters for the cache program must be set to zero.
If the Write Delay for the cache program is set to any value other
than zero, then data loss can occur if a re-boot is attempted in
the middle of a write to the disk.  Refer to your cache program's
user manual to determine how to set the write delay.

ERROR LEVELS:
    VSHIELD sets the DOS error level after it becomes resident.
If it finds a virus in the boot sector, operating system, or itself
prior to going resident, it sets the error level thus:

        No viruses found  - 0
        One or more found - 1
        System Error      - 2

REMOVING VSHIELD:
    VSHIELD may be removed from memory by issuing the following
command:

               VSHIELD  /REMOVE

    This will de-install the program and remove it from memory.
If there are other memory resident programs that have hooked the
same interrupts as VSHIELD and which have been loaded after
VSHIELD, it may not be safe to remove the program and VSHIELD will
not de-install.  An error message will be displayed in this
instance.

SYSTEM OVERHEAD:
    VSHIELD requires 22K of system memory.  It will add an average
of 4 seconds to each program load, and 6 seconds to each re-boot.
After a program has loaded and begun execution, however, VSHIELD
will not degrade the performance or speed of the system in any way.

Registration:

    A registration fee of $25 is required for the use of VSHIELD
by individual home users.  Please send registrations to the address
below.  This registration covers the copy currently in use and
future versions for one year, providing they are obtained from the
McAfee Associates bulletin board or other public or private board.
Diskettes will not be mailed unless specifically requested.  Add
$9 for diskette mailings.  The McAfee Associates board number is
- 408 988 4004 - 1200/2400, N,8,1; 5 lines.

Corporate and organizational use:

    Corporate site licenses are required for corporate, agency and
organizational use.  For site license information contact:
            McAfee Associates
            4423 Cheeney Street
            Santa Clara, CA  95054
            408 988 3832 voice
            408 970 9727 fax

Virus Removal:

    What do you do if a virus is found?  Well, if you are a
registered VIRUSCAN or VSHIELD user, you may contact McAfee
Associates for free assistance in manually removing the virus.  We
strongly recommend that you get experienced help in dealing with
many of the viruses, particularly partition table and boot sector
infections.  If you are not a registered user, the following steps
should be followed:

    Boot sector infections:
    Power down the system.  Power up and boot from an uninfected,
     write protected floppy.  Execute the DOS SYS command to
     attempt an overwrite of the boot sector.  This works in many
     cases.  If this does not work, backup all data files and
     perform a low level format of the disk.

    Executable file infections:
    Remove all infected files.  Replace from the original
     distribution diskettes.

    Partition table infections:
    Without a removal utility, the only option is to low level
     format the media.

    Disinfecting utilities are available from McAfee Associates
     for the majority of the common viruses.  If you are not a
     registered user of VIRUSCAN, you may purchase these utilities
     from:

        McAfee Associates
        4423 Cheeney Street
        Santa Clara, CA 95054
        408 988 3832

        BBS: 408 988 4004


                Version Notes

Notes on Version 62-B:
    Version 62-B fixes a bug in version 62 that caused VSHIELD to
work incorrectly in systems that were infected prior to installing
VSHIELD.  An option was also added to allow skipping the floppy
boot sector check at re-boot time.  This option should only be used
if the re-boot check conflicts with other memory resident programs.

Version 62:
    Version 62 identifies four new viruses.  The first is a COM
and EXE infector called the Eight Tunes virus (also called the 1971
virus).  This virus is memory resident and randomly plays one of
eight German folk songs on the system speaker.  It appears to have
no destructive code within it.  The virus adds approximately 1975
bytes to infected files.  A second musical that appeared in the
past two weeks is the Yankee Doodle-2 virus.  This virus is similar
to the first Yankee Doodle, except that it plays the Yankee Doodle
tune as soon as an infected program is executed.  It infects EXE
files only.
    The third virus reported is a small non-memory resident COM
infector called the Kennedy virus.  It appears to have no
destructive or disruptive code but it does contain a reference to
the Kennedy family inside the virus code.  The fourth virus is a
destructive virus called the June 16th virus.  It is a non-resident
virus that infects COM files, including the Command Interpreter
(COMMAND.COM).  On every June 16th, the virus activates and
replaces all FAT entries with the word "ZAPPED".

Version 61:
    Version 61 is able to detect five new viruses reported since
March 1, 1990.  The first virus was submitted by Dave Chess of IBM.
It is a destructive COM and EXE infector called the Saturday the
14th virus.  The virus activates every Saturday that falls on the
14th of any month and causes the first 100 sectors of the A, B, and
C drives to be overwritten.  The net result is loss of all of the
control information for the media assigned to those drives.  The
Partition table, Boot Sector and FAT will be destroyed.  The virus
is 685 bytes long and is memory resident.
    The second new virus is the 1392 virus which was also
submitted by Dave Chess of IBM.  The virus does little damage,
other than corruption of the infected programs, but it does display
the following message:  "SMA KHETAPUNK - Nouvel Band A.M.O.E.B.A."
No idea what this means.  The virus changes the date of infected
files to the date of infection; it is memory resident; it infects
both COM and EXE files, including COMMAND.COM and is 1392 bytes
long.
    The third new virus is the XA1, or Christmas Tree virus.  It
was submitted by Christoff Fischer of West Germany.  It is an
encrypted virus that only infects COM files.  It activates on April
the 1st and destroys the partition table of the hard disk.  From
December 24th till January 1st it will draw a full screen picture
of a christmas tree when an infected program is executed.  It is
not memory resident.
    The fourth and fifth new viruses were discovered in Spain and
are called the 1720 and 1210 viruses.  The 1720 infects both COM
and EXE files, while the 1210 only infects EXE files.  Little is
know of these viruses at this point other than that the 1720
appears to be destructive.  The viruses were named after their
respective lengths.
    In addition to the above new viruses, version 61 fixes a bug
which caused it to mis-identify the Korea Virus.

Version 60:
    Version 60 identifies four new viruses that have been reported
from widely dispersed parts of the world.  The first virus, the
Solano 2000, or Dyslexia virus, was widely and suddenly reported
in Solano County California in late February and Early March 1990.
The first person to isolate and submit the virus was Edward
Winters.  The virus is 2000 bytes long, but bears no resemblance
to the V2000 virus from Bulgaria.  The virus infects only COM
files, is memory resident, and infects each file as it is executed.
The virus randomly reverses contiguous numeric data in the video
buffer.  No other damage has been observed.
    The second virus, ItaVir, was submitted by Andrea Salvia and
Emilio Caravaglia of Milan Polytechnic in Milan, Italy.  The virus
is 3,880 bytes long, infects only EXE files and is not memory
resident.  The virus is activated based on the amount of time it
has been in the system (apparently a random time greater than 24
hours) and when activated, it sequentially writes all values
(between 0 and 255) to all I/O ports in the system.  The result is
a dramatic confusion of all peripherals.  The video monitor will
flicker and if the monitor is VGA, will also hiss.  The boot sector
is also wiped out and the system will be non-bootable on power-up.
    The third virus, Vcomm, was submitted by Yuval Tal from
Rehovot, Israel.  It is a non-memory resident EXE infector and is
1074 bytes long.  After the virus is first executed, it infects one
other EXE file and then modifies the in-memory Command Interpreter
so that the DOS COPY command no longer works.  No other disruptions
have been reported from this virus.
    The fourth virus is a boot sector infector submitted from
Korea.  Limited analysis has been done so far on this virus other
than developing an identifier.  The virus has been named the Korea
Virus.

Version 59:
    Version 59 now catches a number of new variations of the
Vienna, Yankee Doodle and Vacsina.  These variations were submitted
by researchers in Eastern Europe.  The variations of the Yankee
Doodle and Vacsina appear to be earlier trial versions of these
viruses.  They don't appear to be harmful, other than corrupting
the programs that are infected and there have been no reported
incidents of infection in the U.S. or Western Europe.  The
variations of Vienna are likewise apparently harmless.
    A completely new virus has also been added to the scan
list.  Called the V2000 virus, it works as follows:
    It installs resident in memory and then searches for and
infects the Command Interpreter (COMMAND.COM).  It will then infect
any COM or EXE file whenever the file is opened.  Thus, the
executable files are infected whenever they are executed, copied
or manipulated in any way.  The virus hides the length increase of
infected files, much like the 4096, so the user will not see the
increased file lengths in the listing displayed by the DIR command.
    The virus is very virulent and has caused system crashes and
lost data, as well as causing some systems to become non-bootable
after infection.

Version 58:
    Version 58 includes tests for three new viruses:  EDV, 512 and
1559 viruses.  These viruses are listed in the accompanying
VIRLIST.TXT document.

Version 57:
    SCANRS57 has been substantially modified to prevent infection
by viruses that use variable encryption techniques.  Two such
viruses surfaced for the first time in January.  These viruses
cannot be accurately identified with simple I.D. strings. The
changes to VSHIELD now allow these two viruses to be positively
blocked, and blocking future viruses that use similar techniques
has been simplified.
    Both of these encrypted viruses were written as "experimental"
viruses.  One surfaced on a number of bulletin boards in Minnesota
under the name of COM_AIDS.ZIP.  I have named it the 1260 virus,
although it is based in part on the original Vienna virus.  The
other was written by Patrick Toulme in Washington D.C. (author of
Virus-90).  He has called the new virus Virus-101.  Neither of
these viruses was designed to be destructive - they just attach
themselves to other programs.  However, there is no such thing as
a "harmless" virus.  All viruses corrupt the code of the host
programs, and none enter your system under invitation.  And none
have yet successfully been contained.  Even the most well designed
and coded "harmless" virus will cause problems in some mix of
hardware/BIOS/DOS-Version/Memory-resident-programs etc.  The
Pakistani Brain is a prime example of this.  For this reason we
oppose the public distribution of any kind of virus.  Once
released, they cannot be controlled.  In addition, many lazier
hackers can easily modify "harmless" viruses to become destructive,
and many instances of such modification exist.  Thus, V57 of
VSHIELD includes prevention for both of these viruses.
    In addition to the above two viruses, V57 blocks the Joker
and Perfume viruses from Poland, the Icelandic-3 found by
Fridrik Skulason in Iceland and the Halloechen virus reported by
Christoff Fischer at the University of Karlsruhe in West Germany.
These are detailed in VIRLIST.TXT.

Version 56:
    Version 56 now does a memory scan for the Dark Avenger and
4096 viruses at the time it is loaded.  It also adds the Chaos and
Taiwan viruses to the list of identifiable viruses.

Version 54:
    Version 54 fixes a bug in V54 that caused false alarms for the
4096 virus in a few instances.  Please do not use version 53.

Version 52:
    Version 52 includes detection for the Devil's Dance virus and
the AIDS Information Trojan program.

Version 50:
    Version 50 detects the Holland Girl virus.  It infects .COM
files and increases their size by 1332 bytes.  It contains the name
and phone number of a girl named Sylvia in Holland.  Potential
damage from this virus is currently unknown.

Version 49:
    A new file - VIRLIST.TXT has been added to the VSHIELD
package.  This file lists the known viruses and describes, in table
format, their critical characteristics.
    Version 49 also checks for the following new viruses:
        -     Do-Nothing virus.  This virus was reported in
               October by Uval Tal in Israel.  It infects COM files
               but does no other damage and does not affect the
               system in any observable way.
        -    Lisbon Virus.  This virus was discovered by Jean Luz
               of Lisbon, Portugal in November.  It infects COM
               files and increases the size of infected programs
               by 648 bytes.  It destroys 1 out of 8 infected
               programs by overwriting - @AIDS over the first five
               bytes of the infected program.
        -    Sunday Virus.  This virus was discovered by multiple
               users in the Seattle, Washington area.  It activates
               on Sundays and displays the message - "Today is
               Sunday, why do you work so hard?".  Damage to the
               FAT has been reported from a number of infected
               sites.

Version 48:
    Version 48 identifies the TYPO .COM virus that has been
reported by Joe Hirst of Brighton, U.K.  The virus infects COM
files and garbles data sent to the parallel port.

Version 47:
    Version 47 identifies the DBASE virus reported by Ross
Greenburg of New York.  This virus infects COM files and will
corrupt data in any file with a DBF extension.

Version 46:
    Version 46 now includes a test for the Ghost virus.  This
virus was discovered in September by Fridrik Skulason at Icelandic
University.  The virus infects .COM files and the boot sectors of
hard disks and floppies.  The virus increases the size of infected
COM files by 2,351 bytes, and replaces the boot sector of infected
systems with a boot virus similar to Ping Pong.  Random file
corruption by this virus has been reported.  VSHIELD identifies
both the COM version and the boot version of this virus.

Version 45:
    Version 45 now checks for the New Jerusalem virus discovered
by FIDONET SysOps Jan Terpstra and Ernst Raedecker in the
Netherlands.

Version 44:
    Version 44 fixes a bug in 43.  Version 43 cannot identify the
Jerusalem-B virus (earlier versions of VSHIELD work correctly).
DO NOT USE version 43.

Version 43:
    Version 43 now identifies the Alabama Virus.  This virus was
discovered by Ysrael Radai at Hebrew University and forwarded to
us through Dave Chess at IBM.  The virus infects .EXE files and
increases their size by 1560 bytes.  It manipulates the file
allocation table and swaps file names so that files are slowly
lost.
    Additional Version 43 enhancements are:
        - Fix to include EXE file searches for DataCrime II
        - Fix for duplicate reporting when Ashar virus is
            identified

Version 42:
    Version 42 of VSHIELD includes an identifier for the Yankee
Doodle Virus.  This virus was discovered in Vienna by Alexander
Holy at the United Nation's office on Sept 30th.  The virus has
reportedly been transmitted to the U.S. through U.N. employees via
the game - 'Outrun'.  The virus plays the tune - 'Yankee Doodle
Dandy' on the system's speaker 17 hours after an infected program
is loaded.  Both COM and EXE files can be infected, and infected
files grow by 2899 bytes.  No knowledge yet of eventual damage
potential.