****************************************************************************** * * * RESSCAN 3.1A * * * ****************************************************************************** RESSCAN 3.1A has two new features: * When RESSCAN or WIN-RS are resident, doing a scan by RESSCAN, WIN-RS, or VirHUNT will not cause the resident program to pop-up its warning box. Note, however, that this bypass of the resident program ONLY ocurrs during the scan itself. For example, if RESSCAN is resident and you use VirHUNT to scan the A: drive, if the boot record of the floppy is infected RESSCAN will pop-up its warning when VirHUNT tries to identify the disk. This is deliberate, not an oversight, as some boot viruses make a disk un-readable to DOS, so that VirHUNT (or RESSCAN) cannot determine that there is a floppy in the drive and will not scan it. Having RESSCAN "tag-along" with the disk check prevents missing the virus on the "unreadable" disk. * There is a new ERRORLEVEL for user abort of scan before any viruses were found, level 7. The complete list of errorlevel returns are: 0 = no viruses found 1 = signature change detected 2 = Virus detected 3 = Virus and siganture change detected 4 = Unable to open program for self-check (probably network busy) 5 = 6 = Program unable to self-repair. Program needs replacement 7 = User aborted scan before any viruses were found Note that if any signature changes or viruses were found, they would take precedence in ERRORLEVEL, even if the scan was aborted. New Command line parameter: -N Tells RESSCAN and WIN-RS to NOT process the VIRHUNT.CFG file(s). This is useful in setting up batch files. Thus, you can have a batch file that scans your A: floppy without scanning the C: and D: drives as specified in your VIRHUNT.CFG file. EXAMPLE: RESSCAN -R -N A: SWBF Have RESSCAN scan the boot record and the files on the A: floppy without checking the contents of the VIRHUNT.CFG file(s) or staying resident. This would be useful in a BATCH file. ****************************************************************************** * * * VIRHUNT 3.1A * * * ****************************************************************************** There has been a substantial change in the way VirHUNT detects virus infections. Previously, VirHUNT identified a virus enough to know that it could safely perform a virus removal, at which point it knew that it had a "Variation of" a know virus, then it performed additional checks on areas of the virus that were subject to change. If these additional checks succeeded, then it knew that it had the actual virus. However, this strictness in virus checking lead to missing close relatives, and to having a seperate option for removal of virus variations, even though they were identified to the point of safe removal. In order to catch more relatives, and do away with the additional virus variation parameters, this has changed. Now, if VirHUNT can match the first signature for a virus (essentially equivalent to the check made by RESSCAN), it notes that it has a "Relative of" a virus. If all checks needed to be sure that it can remove a virus succeed, VirHUNT knows that it has the virus. Additional checks for virus "variations" are not done. No removal attempt is made on a "Relative of" virus, since at least one check needed to insure proper removal has failed. The most obvious place that this change will be noticed is in boot viruses. Many boot viruses are divided into two parts, the boot record itself and the rest of the virus, kept in other sectors on the disk. Previously, VirHUNT wanted to identify both the boot record and the additional code before it detected a virus. However, if the boot record was in place but the additional code was missing, VirHUNT did not report anything. Now, if the boot record is in place, VirHUNT will report a "Relative of" the virus, and if the additional code is in place VirHUNT will report finding the virus. With this change, Variations Option has been removed from the VirHUNT options menu. The VO (and even older RV) command line parameter is still supported for old batch files, but it does nothing. Note on setting up dated run with VirHUNT: There are 3 things necessary to use dated runs with VirHUNT: 1) A VIRHUNT.CFG file with a date line in it, such as DATE:06/09/92 07 to run VirHUNT every 7 days. 2) Do NOT put a SCAN command (AUTORUN from the configuration menu) in the VIRHUNT.CFG file. The SCAN command (AUTORUN) tells VirHUNT to automatically perform a scan without stopping at the main menu despite lack of command line parameters. If you use SCAN (AUTORUN) when trying to set up a dated run, VIRHUNT will ALWAYS execute. 3) Use -D on the command line. This tells VirHUNT to use the date information to perform its scan. Without this, VirHUNT assumes that you want to run the program for some other reason, such as removing a "found" virus or scanning a floppy. VirHUNT 3.1A has several new features: * When RESSCAN or WIN-RS are resident, doing a scan by RESSCAN, WIN-RS, or VirHUNT will not cause the resident program to pop-up its warning box. Note, however, that this bypass of the resident program ONLY ocurrs during the scan itself. For example, if RESSCAN is resident and you use VirHUNT to scan the A: drive, if the boot record of the floppy is infected RESSCAN will pop-up its warning when VirHUNT tries to identify the disk. This is deliberate, not an oversight, as some boot viruses make a disk un-readable to DOS, so that VirHUNT (or RESSCAN) cannot determine that there is a floppy in the drive and will not scan it. Having RESSCAN "tag-along" with the disk check prevents missing the virus on the "unreadable" disk. * There is a new ERRORLEVEL for user abort of scan before any viruses were found, level 7. The complete list of errorlevel returns are: 0 = no viruses found 1 = signature change detected 2 = Virus detected 3 = Virus and siganture change detected 4 = Unable to open program for self-check (probably network busy) 5 = 6 = Program unable to self-repair. Program needs replacement 7 = User aborted scan before any viruses were found Note that if any signature changes or viruses were found, they would take precedence in ERRORLEVEL, even if the scan was aborted. * If the NOAB (noabort) parameter from VIRHUNT.CFG is in effect and remove viruses is specified (either from VIRHUNT.CFG or the command line), the remove warning message is not displayed since you cannot break out of the scan anyway. * When the About Viruses list is displayed, typing a letter or digit moves to the start of viruses starting with that letter or digit. New Command line parameter: -N Tells VirHUNT to NOT process the VIRHUNT.CFG file(s) except for color information. This is useful in setting up batch files. Thus, you can have a batch file that scans your A: floppy without scanning the C: and D: drives as specified in your VIRHUNT.CFG file. EXAMPLE: VIRHUNT -N A: SWBF QU Have VIRHUNT scan the boot record and the files on the A: floppy without using the contents of the VIRHUNT.CFG file(s) except for screen colors, and quit to DOS after the scan. This would be useful in a BATCH file. ****************************************************************************** * * * VIRUS LIST * * * ****************************************************************************** NOTE: The names of some viruses have been changed to the commonly known name, or have been changed to include a virus in the proper family. The viruses currently recognized by VirHUNT and RESSCAN are: File viruses: 12 Tricks 488 Turbo 7th Son Agiplan Aids AIDS II Alabama Ambulance (Red Cross) Amilia Amstrad Anarkia Anthrax AntiChrist Anti-Pascal 400 Anti-Pascal 440 Anti-Pascal 480 Anti-Pascal 529 Anti-Pascal 605 Attention Australian Bad Boy Bad Taste Bebe Best Wishes Best Wishes 2 Big Joke Black Monday Blinker Blood Boojum Boys Brothers Burger Burger 536 Burger 1542 Cadkill Cancer CARA Carioca Cascade (1701) Cascade-B (1704) Casino Casper Cemetery Christmas/April 1st (XMASAPR1) CHV 2.1 Cinderella Color Cookie Crazy Eddie Crew 2480 CSFR 1000 CSSR-528 Dark Avenger (Eddie Lives) Damage Damage-B Darth Vader Datacrime #1, version 1 Datacrime #1, version 2 Datacrime #2 Datacrime IIB Datalock Dbase (DBF) Dec. 24th. Deicide Demon Destruct Devil's Dance Diabolik DIR 2 DIR 2-B DIR 2-C DIRVIR Discom DM 400 Do Nothing DoNothing 2 DOOM II Dot Eater Einstein Erasmus Europe/92 Evil Evil EXE header Faggot Father Christmas Fellowship Finland Fish Flash Flip #1 Flip #2 Frere Jacques Friday13 Frog's Alley Fu Manchu Gergana Gergana II Gergana III Gergana IV Gergana V Ghost Gosia Gotcha 9 Gotcha A Gotcha B GP1 Greek (Armagedon) Greemlin Grither Grither Header Groen Links Growing Block GS/02 Guppy Haifa Hallo Happy Day Haryanto Headcrash Hero Hero 394 HIV Holokausto Horse Horse 2 Hybryd Hymn Iceland #2 INCOM INT 13 Invader Invader 2 Invader 3 Israeli (Jerusalem, 1813) Israeli April 1st COM (sURIV 2.01) Israeli April 1st EXE (sURIV) Israeli Tuesday-the-13th Italian virus Japanese Christmas Jeff Jocker JOJO JOJO 2 Joker-01 July 13th June 16th (ZAPPED) Justice Kamasya Kamikaze Kemerovo Kemerovo B Kewl Dewdz! Keypress Keypress B Kiev Kiev V1.1 Klaeren Kukac Kukac 9.9 Kuku 448 Kylie Lazy Leech Lehigh University (COMMAND.COM) Leprosy Leprosy-B Leprosy C Leprosy D Liberty Liberty 1186 Lisbon Lisbon 2 Little Brother Little Pieces Love Child Lowercase Lozinsky Maltese Amoeba MANOWAR Marauder MG-1 MG-2 MG-2A MG-3 MG-4 MGTU Micro 128 Migram MIR Mirror Mix1 Mix1B MIX2 MLTI Monxla Mosquito MPS-OPC v3.1 MPS-OPC v3.2 MPS-OPC v4.01 MSTU 531 Multi 2 Murphy-1 Murphy-2 Mutant Mutation Engine Mystic Nepolim New BadGuy Nina Nina 2 Nobock Nomenklatura Number One NV71 Ontario Oropax Parity PC-FLU PC-FLU B PC-FLU II PcVrsDs Peach Perfume Pest Phoenix Phoenix (EXE header) Pirate Piter Pixel 897 Pixel 899 Pixel 905 Plague Plastique Plastique 2576 Plastique 2900 Plastique 3088 Plastique 4.51 Plastique Cobol Plovdiv Possessed A Possessed B Possessed C Proud Prudents PSQR Rat Reverse REQ Sadam Saratoga 1 Saratoga 2 (Iceland #1) Saturday 14th Screaming Fist II Self 457 Self 550 Shadowbyte Shadowbyte B Shake Simulation Slay Slow Slow 2131 Socha Solano Something 1.1 Sorry South African 2 SOV1 SOV2 SPANZ Sparse Spyer STAF Stardot 600 Stardot 789 Stardot 801 Stealth (4096, Frodo Lives) Subliminal Sunday Sunday 2 Suomi Suriv3 SVC 1740 SVC 4.0 SVC 5.0 SVC 6.0 Sverdlov Svir Sylvia Sylvia B Syslock (3551) Taiwan Taiwan 2 Talentless Jerk Telecom Ten Bytes Ten Bytes 2 Tequila Terror TESTVIRUS B Thursday the 12th Timid Tiny Tiny 133 Tiny 134 Tiny 138 Tiny 143 Tiny 154 Tiny 156 Tiny 158 Tiny 159 Tiny 160 Tiny 167 Tiny 198 Tony Tokyo Topo TP #04 TP #05 TP #06 TP #16 TP #23 TP #24 TP #25 TP #33 TP #34 TP #38 TP #39 TP #41 TP #42 TP #44 TP #44 hack TP #45 TP #46 TP ?? EXE infection Traceback Traceback II Traveller Twin V101 V1024 V1024-B V1049 V1075 V123 V1253 V1260 V1381 V1392 V144 V1591 V1600 V1605 V191 V1963 V1971 V2000 (Carry me, Travel) V2048 V2100 V2144 V217 V23693 V2560 V277 V299 V2P2 V2P6 V2P6 Trash V333 (Dead Kennedys) V3445 V345 V348 V353 V367 V370 V382 V405 V417 V435 V453 V492 V496 V512 V512-B V512-C V512-D V512-E V512-F V512-X V5120 V516 V528 V537 V539 V541 V542 V555 V600 V623 V627 V644 V651 V696 V699 V707 V709 V733 V757 V765 Revenge Attacker (777) V7808 V789 V800 V847 V852 V867 (fumble, mistake) V90 V905 V928 V948 VCOMM (637) VCS Victor Vienna Vienna 2 Vienna 2A Vienna 3 Vienna-535 Vienna 547 Vienna 634 Vienna 645 Vienna 645B Vienna-646 Vienna 656 Vienna 726 Vienna 757 Vienna 776 Vienna-Iraq Violator Violator-B Violator-B2 Violator-B3 Violator-B4 Virdem Virdem 2 Virus-B (South African 1) VP Vriest W13-A W13-B WD 1069 WD 1085 Westwood Whale/Whale-B Wisconsin Wolfman Wonderful Yankee 1 Yankee 2 Yankee 1150 Yaunch Xabaras Zero Bug Zero Hunt Zero Hunt B ZK-900 Boot viruses: Aircop Alameda Anthrax Boot Ashar Azusa Bloody Bloody-B Botany Brunswick Campana Campana B Canadian Catman Crazy Eddie Boot Den Zuk Disk Killer EDV Evil Empire Evil Empire B Evil Empire B4 Evil Empire C Evil Empire D Falling Letters Filler Flip #1 Boot Flip #2 boot Form Ghost Boot Hybryd Boot Invader Boot Invader 2 Boot Invader 3 Boot Joshi Keydrop Kitty Laodoung LBC Liberty Boot Marijuana (Stoned) Marijuana Hack Michelangelo Microbe MS-PC-AT Multi 2 Boot Musicbug Mystic Boot NOINT Non-Canadian Ohio Ohio 0 Pakistani Brain Pentagon Ping-Pong PingPong 286 Plastique Boot PrtSc Sexual Revolution 1 Sexual Revolution 2 Shoe Smiley Worm Stoned 2 Stoned-Alberta Stoned-Alberta 2 SVC 6.0 Boot Swedish Disaster 1 Tequila Boot Tony Boot Tony Boot (file version) Track Swap Typo UA UofA V1253 Boot Zapper ****************************************************************************** ********************* Upgrade notes on previous versions ********************* ****************************************************************************** ****************************************************************************** * * * RESSCAN 3.0D * * * ****************************************************************************** RESSCAN Version 3.0D has added some new features: * The DATE parameter from the configuration file is now recognized by RESSCAN. This allows RESSCAN to scan only at a specified interval, although it will still stay resident even if this is NOT the scan date. The -D command line parameter (do not scan/quit if not target date) is now supported by RESSCAN to use with the DATE paramter. Note that -D does NOT have to be specified for the date in the VIRHUNT.CFG file to be updated. * RESSCAN will now identify and scan your local (non-network) hard drives automatically by using the HD command line parameter. This allows the same command line/configuration file to be used without modification on different systems. * RESSCAN will no longer allow a drive or directory to be specified multiple times on the command line or in a configuation file. If a drive/directory is specified more than once, the additional copies are ignored. Note that this does NOT forbid files being scanned more than once, as the parameters: C:\ C:\DOS are taken to be two different things, the first of which will scan the C: drive, and the second will scan the C:\DOS directory again. * For OS/2 and some networks, RESSCAN can now make better identification between physical/logical drives for scanning boot records, and will warn you if it cannot find the boot record to scan. New Command line parameters: -D If not at or beyond the date specified in the VIRHUNT.CFG file, do not scan memory/boot/files. Using -D does NOT change whether or not RESSCAN remains resident, that is controlled by the -R parameter. If there is no VIRHUNT.CFG file, or the CFG file does not contain a DATE line, this parameter does nothing. HD Find and scan all local (non-network) hard drives. This takes the place of a string of specified drives (such as C: D: E: etc.) and allows the same command line and/or configuration file to be used on different hardware setups. Examples: RESSCAN -D If a date is specified in VIRHUNT.CFG, then one of two things will occur: 1) It is at or after the target date, RESSCAN will scan memory, boot record(s), and files, then become a resident program. 2) It is before the target date, RESSCAN will not scan anything but will become a resident program. If there is no VIRHUNT.CFG or is no DATE in the CFG file, then RESSCAN will behave as 1) above. RESSCAN -D -R If a date is specified in VIRHUNT.CFG, then one of two things will occur: 1) It is at or after the target date, RESSCAN will scan memory, boot record(s) files. 2) It is before the target date, RESSCAN will not scan anything. In neither case will RESSCAN become a resident program RESSCAN HD Find all local (non-network) hard drives, then scan memory, the boot record(s) of the local hard drives, and executable files on the local hard drives. Remain resident after the scan. ****************************************************************************** * * * VIRHUNT 3.0D * * * ****************************************************************************** VIRHUNT V3.0D has several new features: * VirHUNT can now save and restore disaster recovery information (the CMOS values, Master Boot Records and parition boot records for your hard drives) to a floppy disk and restore them later. This ability is shared with INSTALL, and is discussed seperately below. * VirHUNT will now identify and scan your local (non-network) hard drives automatically by using the HD command line parameter. This allows the same command line/configuration file to be used without modification on different systems. * VirHUNT will no longer allow a drive or directory to be specified multiple times on the command line or in a configuation file. If a drive/directory is specified more than once, the additional copies are ignored. Note that this does NOT forbid files being scanned more than once, as the parameters: C:\ C:\DOS are taken to be two different things, the first of which will scan the C: drive, and the second will scan the C:\DOS directory again. * For OS/2 and some networks, VirHUNT can now make better identification between physical/logical drives for scanning boot records, and will warn you if it cannot find the boot record to scan. New Command line parameter: HD Find and scan all local (non-network) hard drives. This takes the place of a string of specified drives (such as C: D: E: etc.) and allows the same command line and/or configuration file to be used on different hardware setups. Example: RESSCAN HD QU Find all local (non-network) hard drives, then scan memory, the boot record(s) of the local hard drives, and executable files on the local hard drives. Quit to DOS after the scan, unless a virus was found. ****************************************************************************** * * * INSTALL 3.0D * * * ****************************************************************************** INSTALL V3.0D has a new feature: * INSTALL can now save and restore disaster recovery information (the CMOS values, Master Boot Records and parition boot records for your hard drives) to a floppy disk and restore them later. This ability is shared with VirHUNT, and is discussed seperately below. ****************************************************************************** * * * RECOVERY FILES * * * ****************************************************************************** Both VirHUNT and INSTALL can now save and restore the following critical system information in a file on a floppy disk as disaster recovery insurance, and restore it later if the need arises: * CMOS values, which tell your system what floppy drives you have and what hard drives you have, among other things. * Master Boot Records (MBR) for your hard drives, which include the partition table. This is vital to your hard drive. * Partition boot records for your hard drives; they contain the instructions for booting DOS. This recovery file must be saved to a floppy, and the default name is A:\RECOVER.DDI although this can be changed. This file also contains a system signature, identifying your machine so that an incorrect recovery file is not accidently used on your system, causing furthur problems. While unique system signatures cannot be guaranteed, it will stop most errors of using the wrong recovery file for your machine. When creating a recovery file you should remember that its normal use will be after something has destroyed system information, and you will probably be working from a bootable floppy while trying to recover your hard drives. Be warned that some memory managers, such as HIMEM.SYS, can change your system signature so that VirHUNT or INSTALL would not recognize the recovery file as belonging to this system. As a result, recovery files should be created and restored with a "naked" (minimal) CONFIG.SYS and AUTOEXEC.BAT. For the highest odds of recovery success, before creating the recovery file you should first boot from the emergency floppy you intend to boot from when a problem arises. If you make any hardware changes to your system, such as adding or removing a hard drive, or adding or removing an expansion board, you should create a new recovery file so that its contents match the current state of your system. When a recovery file is used (information restored to system), VirHUNT and INSTALL will force a system reboot. This is done to allow DOS to use the new parameters. If your system has serious problems, it may be necessary to restore the CMOS values only, then reboot and restore the boot records, otherwise VirHUNT/INSTALL may not be able to identify the recovery file as belonging to your system. While saving this information is a good piece of insurance, restoring it to your system is a "last-ditch" attempt to revive a dead system, and DDI cannot be responsible for any problems that arise from its use. ****************************************************************************** * * * 3.0C UPDATE * * * ****************************************************************************** Version 3.0C is a bugfix for 3.0B. Sorry about that, but a new bug crept into RESSCAN (and Win-RS) 3.0B: If signature checking was left resident, any file that was NOT in the signature list was reported as changed instead of being ignored. A standing bug in VirHUNT relating to NEC's version of MS-DOS 3.3 (and, apparently, WYSE 3.3 and Hewlett-Packard 3.3 as well--beware of other "custom" versions of DOS 3.3) has finally been located. When used with a hard disk larger than 32 Meg as a single partition, the logical sector size was changed (up to at least 1K) but the drives still reported their PHYSICAL sector size of 512 bytes. This caused a buffer overflow when the boot records were scanned, over-writing internal variables. This problem (and any similiar problem that could arise under specialty disk drivers or other DOS versions) has now been fixed. The rest of this READ.ME file describes the updates from the 3.0A to 3.0B release of the software. ****************************************************************************** * * * 3.0B UPDATE * * * ****************************************************************************** This update is coming shortly (1 month) after the last release for several reasons: * Updated virus list, including detection and removal of the DIR 2 virus which has already caused concern in the USA and hit many systems in Europe. * With the major update from 1.3D to 3.0A, the inevitable minor bugs crept in. Although most people would not encounter them, they have been fixed in this release. * INSTALL has now been enhanced with an UNINSTALL feature. * A few minor enhancements to VirHUNT, RESSCAN, and VirALERT. ****************************************************************************** * * * RESSCAN 3.0B * * * ****************************************************************************** RESSCAN Version 3.0B has a new feature: * The SC (scan subdirectories, yes or no) parameter is now recognized by RESSCAN. This allows RESSCAN to scan a directory, such as the root, without scanning all directory trees contained in that directory. New Command line parameters: SC[{Y}{N}] The legal values for SC are Y (Yes, scan subdirectories. This is the default value) and N (No, do not scan subdirectories). Examples: RESSCAN SCN Scan memory, bootrecords, and files in the Root directory only. Remain resident after the scan. ****************************************************************************** * * * VIRHUNT 3.0B * * * ****************************************************************************** VIRHUNT V3.0B has two new features: * Ability to use LPT1, LPT2, or LPT3 for printer ouput, instead of always sending printer output to LPT1. * Precedence of -D command line flag has changed slightly. Now, -D takes precedence over command line parameters, so that if it is not the date for VirHUNT to run, the presence of command line parameters will not force VirHUNT to run anyway. New Command line parameters: PR[{Y}{N}{1}{2}{3}] The PR (print scan output) command line parameter has been enhanced tp allow access to printer ports LPT1 to LPT3. The Y and N parameters (Yes, print output and NO, do not print output) are still available, and refer to LPT1, the normal printer. In addition, PR may be given the digits 1, 2, or 3 to turn on printer output to LPT1, LPT2, or LPT3 respectively. Examples: VIRHUNT PR2 Scan memory, bootrecords, and files on the current drive. Send scan output to the printer attached to LPT2. ****************************************************************************** * * * INSTALL 3.0B * * * ****************************************************************************** INSTALL V3.0B has a new feature: * UNINSTALL, which can remove programs from your disk and update AUTOEXEC.BAT and CONFIG.SYS so that the programs are no longer run. To use UNINSTALL, select it from the menu bar, and chose which program (or all programs) to uninstall. A final warning prompt is displayed to guard against accidental selection. ****************************************************************************** * * * VIRALERT 3.0B * * * ****************************************************************************** VirALERT V3.0B has a new feature: * The H command line parameter, which changes the hotkey from Alt-V to Ctrl-Alt-V. Some programs, word processors in particular, used Alt-V for their own use. The H command line parameter should move VirALERT's hotkey out of the way.