ThunderBYTE
Anti-Virus Utilities
USER MANUAL
The ThunderBYTE Anti-Virus Utilities are a product of:
ESaSS B.V.
P.O. Box 1380
6501 BJ NIJMEGEN
The Netherlands
COPYRIGHT (c) 1996 by: ThunderBYTE B.V.,
Wijchen, The Netherlands.
All rights reserved. No part of this manual may be reproduced, stored in
a retrieval system, or transmitted in any form, by print, microfilm, or
by any other means without written permission from ThunderBYTE B.V.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page i
Table of Contents
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
A Word (or Two) of Thanks . . . . . . . . . . . . . . . . . . . 1
What Are the TBAV Utilities? . . . . . . . . . . . . . . . . . . 1
The TBAV Utilities User Interface . . . . . . . . . . . . . . . 5
Conventions Used in This Manual . . . . . . . . . . . . . . . . 6
How To Use This Manual . . . . . . . . . . . . . . . . . . . . . 6
1 TBAV QuickStart . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.1 Installing the TBAV Utilities . . . . . . . . . . . . . . . 8
1.1.1 Understanding System requirements . . . . . . . . . . 8
1.1.2 Running INSTALL . . . . . . . . . . . . . . . . . . . 8
1.1.3 Installation on a network . . . . . . . . . . . . . 11
1.1.4 Starting And Ending TBAV . . . . . . . . . . . . . 11
1.1.5 Using TBAV Commands . . . . . . . . . . . . . . . . 14
1.1.6 Getting Help . . . . . . . . . . . . . . . . . . . 15
1.1.7 Configuring TBAV . . . . . . . . . . . . . . . . . 16
1.2 Understanding TbSetup . . . . . . . . . . . . . . . . . . 18
1.3 Understanding TbDriver . . . . . . . . . . . . . . . . . . 19
1.4 Maintaining the System . . . . . . . . . . . . . . . . . . 20
1.4.1 Maintaining ANTI-VIR.DAT Files . . . . . . . . . . 20
1.4.2 Creating a New Recovery Diskette . . . . . . . . . 20
1.4.3 Getting Updates . . . . . . . . . . . . . . . . . . 20
1.4.4 Maintaining a Network . . . . . . . . . . . . . . . 21
1.4.5 Using the PKUNZIP Utility . . . . . . . . . . . . . 22
2 Defining Your Anti-Virus Strategy . . . . . . . . . . . . . . . . 24
2.1 Protecting Yourself Against Virus Infection . . . . . . . 24
2.2 Recovering from Virus Infection . . . . . . . . . . . . . 29
3 Using the TBAV utilities . . . . . . . . . . . . . . . . . . . . 33
3.1 Using TbSetup . . . . . . . . . . . . . . . . . . . . . . 33
3.1.1 Understanding TbSetup . . . . . . . . . . . . . . . 33
3.1.2 Working with the TbSetup Menu . . . . . . . . . . . 34
3.1.3 Maximizing TbSetup . . . . . . . . . . . . . . . . 40
3.1.4 Understanding TbSetup's Operation . . . . . . . . . 44
3.1.5 Understanding TBSETUP.DAT Files . . . . . . . . . . 45
3.2 Using TbScan . . . . . . . . . . . . . . . . . . . . . . . 47
3.2.1 Understanding TbScan . . . . . . . . . . . . . . . 47
3.2.2 Working with the TbScan Menus . . . . . . . . . . . 48
3.2.3 Maximizing TbScan . . . . . . . . . . . . . . . . . 62
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page ii
3.2.4 Understanding the Scanning Process . . . . . . . . 72
3.2.5 Understanding Heuristic Flags . . . . . . . . . . . 76
3.3 Using TbDriver . . . . . . . . . . . . . . . . . . . . . . 78
3.3.1 Understanding TbDriver . . . . . . . . . . . . . . 78
3.3.2 Working with TbDriver . . . . . . . . . . . . . . . 78
3.3.3 Maximizing TbDriver . . . . . . . . . . . . . . . . 79
3.4 Using TbScanX . . . . . . . . . . . . . . . . . . . . . . 84
3.4.1 Understanding TbScanX . . . . . . . . . . . . . . . 84
3.4.2 Working with TbScanX . . . . . . . . . . . . . . . 84
3.4.3 Maximizing TbScanX . . . . . . . . . . . . . . . . 86
3.4.4 Understanding the Scanning Process . . . . . . . . 90
3.5 Using TbCheck . . . . . . . . . . . . . . . . . . . . . . 92
3.5.1 Understanding TbCheck . . . . . . . . . . . . . . . 92
3.5.2 Working with TbCheck . . . . . . . . . . . . . . . 92
3.5.3 Maximizing TbCheck . . . . . . . . . . . . . . . . 94
3.5.4 Understanding the Scanning Process . . . . . . . . 96
3.5.5 Testing TbCheck . . . . . . . . . . . . . . . . . . 96
3.6 Using TbClean . . . . . . . . . . . . . . . . . . . . . . 98
3.6.1 Understanding TbClean . . . . . . . . . . . . . . . 98
3.6.2 Working with the TbClean Menus . . . . . . . . . . 99
3.6.3 Using TbClean Command Line Options . . . . . . . . 101
3.6.4 Understanding the Cleaning Process . . . . . . . . 104
3.6.5 Understanding Cleaning Limitations . . . . . . . . 106
3.7 Using TbMem . . . . . . . . . . . . . . . . . . . . . . . 108
3.7.1 Introducing the TbMem, TbFile & TbDisk Utilities . 108
3.7.2 Loading TbMem, TbFile and TbDisk . . . . . . . . . 108
3.7.3 Using Command Line Options . . . . . . . . . . . . 110
3.7.4 Understanding TbMem . . . . . . . . . . . . . . . . 110
3.7.5 Working with TbMem . . . . . . . . . . . . . . . . 111
3.7.6 Maximizing TbMem . . . . . . . . . . . . . . . . . 112
3.7.7 Understanding TbMem's Operation . . . . . . . . . . 114
3.8 Using TbFile . . . . . . . . . . . . . . . . . . . . . . . 116
3.8.1 Understanding TbFile . . . . . . . . . . . . . . . 116
3.8.2 Working with TbFile . . . . . . . . . . . . . . . . 117
3.8.3 Maximizing TbFile . . . . . . . . . . . . . . . . . 117
3.9 Using TbDisk . . . . . . . . . . . . . . . . . . . . . . . 120
3.9.1 Understanding TbDisk . . . . . . . . . . . . . . . 120
3.9.2 Working with TbDisk . . . . . . . . . . . . . . . . 121
3.9.3 Maximizing TbDisk . . . . . . . . . . . . . . . . . 122
3.9.4 Understanding TbDisk's Operation . . . . . . . . . 125
3.10 Using TbUtil . . . . . . . . . . . . . . . . . . . . . . 126
3.10.1 Understanding and using TbUtil . . . . . . . . . . 126
3.10.2 Working with the TbUtil Menu . . . . . . . . . . . 127
3.10.3 Maximizing TbUtil . . . . . . . . . . . . . . . . 131
3.10.4 Using the Anti-Virus Partition . . . . . . . . . . 137
3.10.5 Using the TbUtil diskette . . . . . . . . . . . . 137
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page iii
3.11 Using TbLog . . . . . . . . . . . . . . . . . . . . . . . 139
3.11.1 Understanding and using TbLog . . . . . . . . . . 139
3.11.2 Working with TbLog . . . . . . . . . . . . . . . . 139
3.11.3 Maximizing TbLog . . . . . . . . . . . . . . . . . 141
3.12 Using TbNet . . . . . . . . . . . . . . . . . . . . . . . 143
3.12.1 Understanding TbNet . . . . . . . . . . . . . . . 143
3.12.2 Working with TbNet . . . . . . . . . . . . . . . . 143
3.12.3 Maximizing TbNet . . . . . . . . . . . . . . . . . 144
4 Understanding Advanced User Information . . . . . . . . . . . . . 147
4.1 Understanding Memory Considerations . . . . . . . . . . . 147
4.1.1 Understanding Memory Requirements . . . . . . . . . 147
4.1.2 Reducing Memory Requirements . . . . . . . . . . . 148
4.2 Understanding TbSetup . . . . . . . . . . . . . . . . . . 150
4.2.1 Understanding ANTI-VIR.DAT File Design . . . . . . 150
4.2.2 Editing the TBSETUP.DAT File . . . . . . . . . . . 150
4.2.3 Simplifying Installation on Several Machines . . . 152
4.3 Understanding TbScan . . . . . . . . . . . . . . . . . . . 153
4.3.1 Understanding Heuristic Scanning . . . . . . . . . 153
4.3.2 Understanding How Heuristic Scanning Works . . . . 155
4.3.3 Understanding Integrity Checking . . . . . . . . . 156
4.3.4 Understanding the Scan Algorithms . . . . . . . . . 157
4.3.5 Understanding the TBSCAN.LNG File . . . . . . . . . 159
4.3.6 Understanding the TBAV.MSG File . . . . . . . . . . 160
4.4 Understanding TbClean . . . . . . . . . . . . . . . . . . 161
4.4.1 Understanding how a Virus infects a file . . . . . 161
4.4.2 Understanding Conventional Cleaners . . . . . . . . 161
4.4.3 Understanding Generic Cleaners . . . . . . . . . . 163
4.5 Using TbGenSig . . . . . . . . . . . . . . . . . . . . . . 165
4.5.1 Understanding and using TbGenSig . . . . . . . . . 165
4.5.2 Working with TbGenSig . . . . . . . . . . . . . . . 165
4.5.3 Defining a Signature with TbScan . . . . . . . . . 166
4.5.4 Understanding Keywords . . . . . . . . . . . . . . 168
4.5.5 Understanding a Sample Signature: Haifa.Mozkin . . 173
Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Appendix A: TBAV messages . . . . . . . . . . . . . . . . . . 175
A.1 TbClean . . . . . . . . . . . . . . . . . . . . . . . 175
A.2 TbDriver . . . . . . . . . . . . . . . . . . . . . . 177
A.3 TbScan . . . . . . . . . . . . . . . . . . . . . . . 178
A.4 TbScanX . . . . . . . . . . . . . . . . . . . . . . . 179
Appendix B: TbScan Heuristic Flag Descriptions . . . . . . . . 180
Appendix C: Solving Incompatibility Problems . . . . . . . . . 186
Appendix D: TBAV Exit Codes and Batch Files . . . . . . . . . 189
D.1 TbScan Exit Codes . . . . . . . . . . . . . . . . . . 189
D.2 TbUtil Exit Codes . . . . . . . . . . . . . . . . . . 189
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page iv
D.3 General Exit Codes . . . . . . . . . . . . . . . . . 189
D.4 Program Installation Check . . . . . . . . . . . . . 189
Appendix E: Virus Detection and Naming . . . . . . . . . . . . 191
E.1 How Many Viruses Does TbScan Detect? . . . . . . . . 191
E.2 The Virus Naming Convention . . . . . . . . . . . . . 191
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 1
Introduction
A Word (or Two) of Thanks
Congratulations! By purchasing the ThunderBYTE Anti-Virus utilities you
have taken the basic step in building a massive anti-viral safety wall
around your precious computer system. Setting up the appropriate defense
using the TBAV utilities is a personal matter. Therefore, we recommend
to read this manual thoroughly, so you are well aware of the different
kinds of security measures you can take.
What Are the TBAV Utilities?
ThunderBYTE Anti-Virus (TBAV) is a comprehensive tool kit designed to
protect against, and recover from, computer viruses. While TBAV focuses
heavily on numerous ways to prevent a virus infection, the package would
not be complete without various cleaner programs to purge a system, in
the unlikely event that a virus manages to slip through. The package,
therefore, consists of several programs, each of which helps you to
prevent viruses from accomplishing their destructive purposes. Here is a
quick overview.
TbSetup: Collecting Software Information
TbSetup is a program that collects information from all software it
finds on your system. It places this information in files named
ANTI-VIR.DAT and uses it for integrity checking, program validation,
and cleaning infected files.
TbDriver: Enable Memory Resident TBAV Utilities
While TbDriver provides little protection against viruses by itself,
you must load it in advance to enable the memory resident
ThunderBYTE Anti-Virus utilities to perform properly. These
utilities include: TbScanX, TbCheck, TbMem, TbFile, and TbDisk.
TbDriver also provides basic protection against ANSI bombs and
stealth viruses.
TbScan: Scanning for Viruses
TbScan is both a fast signature scanner and a so-called heuristic
scanner. Besides its blazing speed, it has many configuration
options. It can detect mutants of viruses, bypass stealth type
viruses, etc. The signature file TbScan uses is a coded TBSCAN.SIG
file, which you can update yourself in case of emergency.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 2
TbScan will disassemble files. This makes it possible to detect
suspicious instruction sequences and detect yet unknown viruses. As
pointed out earlier, this generic detection, named heuristic
analysis, is a technique that makes it possible to detect about 90%
of all viruses by searching for suspicious instruction sequences
rather than relying on any signature. For that purpose TbScan has a
built-in disassembler and code analyzer.
Another feature of TbScan is the integrity checking it performs when
it finds the ANTI-VIR.DAT files generated by TbSetup. Integrity
checking means that TbScan verifies that every file it scans
matches the information which was captured when the file was first
analyzed by TbSetup and is maintained in the ANTI-VIR.DAT files. If
a virus infects a file, the information in the ANTI-VIR.DAT file
will indicate that the file has been changed, and TbScan will inform
you of this. TbScan performs an integrity check automatically, and
it does not have the false alarm rate other integrity checkers have.
The goal is to detect viruses and NOT to detect configuration
changes!
TbScanX: Automatic Scanning
TbScanX is the memory resident version of TbScan. This signature
scanner remains resident in memory and automatically scans those
files that are being executed, copied, de-archived, downloaded, etc.
TbScanX does not require much memory. It can swap itself into
expanded, XMS, or high memory, using only one kilobyte of
conventional memory.
TbCheck: Check While Loading
TbCheck is a memory resident integrity checker that remains resident
in memory and automatically checks every file just before it
executes. TbCheck uses a fast integrity checking method, which
consumes only 400 bytes of memory. You can configure it to reject
files with incorrect checksums, and/or reject files that do not have
a corresponding ANTI-VIR.DAT record.
TbUtil: Restoring Infected Boot-Sector, CMOS and Partition Tables
Some viruses copy themselves into the hard disk's partition table,
which makes them far more difficult to remove than boot sector
viruses. Performing a low-level format is an effective, but rather
drastic measure.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 3
TbUtil offers a more convenient alternative by making a
precautionary backup of uninfected partition tables and the boot
sector. If an infection occurs, you can use the TbUtil backup as a
verifying tool and as a means to restore the original (uninfected)
partition table and boot sector, without the need for a destructive
disk format. TbUtil can also restore the CMOS configuration for you.
If a backup of your partition table is not available, TbUtil tries
to create a new partition table anyway, again avoiding the need for
a low-level format.
Another important feature of TbUtil is the option to replace the
partition table code with new code offering greater resistance to
viruses. TbUtil executes the partition code BEFORE the boot sector
gains control, enabling it to check this sector in a clean
environment. The TbUtil partition code performs a CRC calculation on
the master boot sector just before the boot sector code activates
and issues a warning if the boot sector has been modified. The
TbUtil partition code also checks and reports changes in the RAM
layout. It performs these checks whenever the computer boots from
the hard disk.
We should point out that boot sector verification is imperative
before allowing the boot sector code to execute. A virus could
easily become resident in memory during boot-up and hide its
presence. TbUtil offers total security at this stage by being active
before the boot sector executes. TbUtil is far more convenient than
the traditional strategy of booting from a clean DOS diskette for an
undisturbed inspection of the boot sector.
TbClean: Reconstructing Infected Files
TbClean is a generic file cleaning utility. It uses the ANTI-VIR.DAT
files generated by TbSetup to enhance file cleaning and/or to verify
the results. TbClean can also work without these files. It
disassembles and emulates the infected file and uses this analysis
to reconstruct the original file.
TbMem, TbFile and TbDisk: Resident Safeguards
The TBAV utilities include a set of memory resident anti-virus
utilities, consisting of TbMem, TbFile and TbDisk. Most other
resident anti-virus products offer you the choice to either invoke
them before the network loads (thereby losing the protection after
the logon procedure), or to load the anti-viral software after
logging onto the network, resulting in a partially unprotected
system. The TBAV utilities, on the other hand, recognize the network
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 4
software and utilize their auto-configuration capabilities to ensure
their continued functionality.
TbMem: Safeguarding Memory
TbMem detects attempts from programs to remain resident in memory
and ensures that no program can remain resident in memory without
permission. Since most viruses remain resident in memory, this is a
powerful weapon against all such viruses, known or unknown. TbMem
also protects your CMOS memory against unwanted modifications. The
ANTI-VIR.DAT files maintain a database of the permission
information.
TbFile: Executable File Protection
TbFile detects attempts from programs to infect other programs. It
also guards read-only attributes, detects illegal time-stamps, etc.
It ensures that no virus succeeds in infecting programs.
TbDisk: Protecting The Disk
TbDisk is a disk guard program that detects attempts from programs
to write directly to disk (that is, without using DOS), attempts to
format, etc., and makes sure that no malicious program succeeds in
destroying your data. This utility also traps tunneling and direct
calls into the BIOS code. The ANTI-VIR.DAT files maintain permission
information about those rare programs that write directly to and/or
format the disk.
TbGenSig: Define Your Own Signatures
Since TBAV includes an up-to-date, ready-to-use signature file, you
do not really need to maintain a signature file yourself. If,
however during a crisis, you need to define your own virus
signatures, then the TbGenSig utility enables you to do this. You
can use either published signatures or define your own if you are
familiar with the structure of computer code.
TbDel: Remove Infected Files
The DOS DEL or ERASE command does not actually erase a file. It
simply deletes the first filename character in the directory listing
and frees up the space by changing the disk's internal location
tables (File Allocation Tables). TbDel is a small program with a
single, yet all-important purpose: it overwrites every single byte
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 5
in a file with the zero character (0) before deleting it, thereby
obliterating all the data and making it totally unrecoverable.
TbMon: Installed Device Checker
To check for the presence of the resident TBAV utilities (TbScanX,
TbCheck, TbMem, TbFile, TbDisk or TbLog) in batch files or login
scripts, you can use the TbMon utility. TbMon returns a DOS error
level, depending on the installed ThunderBYTE resident programs.
The following list specifies the ThunderBYTE resident utilities and
their respective error levels:
+------------+-----------+
|Utility Name|Error level|
+------------+-----------+
| TbScanX | 1 |
| TbCheck | 2 |
| TbMem | 4 |
| TbFile | 8 |
| TbDisk | 16 |
| TbLog | 32 |
+------------+-----------+
The error level returned by TbMon is the cumulative sum of the error
levels of the installed devices. For example, if you have TbScanX
and TbMem installed, TbMon will return error level 5 (1+ 4 = 5).
Another example: if you have all utilities loaded, TbMon will return
error level 63 (1+2+4+8+16+32=63). If none of the resident
ThunderBYTE utilities are installed, TbMon will return error level 0
(zero).
The TBAV Utilities User Interface
The DOS version of TBAV utilizes a menu-driven interface that enables you
to execute the utilities easily. You can also execute many of the
utilities directly from the DOS prompt. One advantage to this is that you
can use the utilities in batch files.
The Microsoft Windows version of TBAV utilizes the standard Windows
interface, providing you a way to protect yourself from viruses while
still working in the user-friendly Windows environment. TBAV-for-Windows
is not described in this document. Please refer to the TBAV-for-Windows
documentation for more information.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 6
Conventions Used in This Manual
This manual uses several special conventions:
References to the keyboard are as they appear on the 101-key
enhanced keyboard. File names, DOS commands, emphasized words, and
information that you are to type appears in UPPERCASE letters. The
context should clearly dictate which of these is true in each case.
References to individual TBAV utilities use a combination of
uppercase and lowercase letters. For example, while TBSCAN.SIG
refers to a signature file, TbScan refers to the utility itself.
How To Use This Manual
This manual consists of six chapters.
Chapter 1 provides you with the fastest way to get started with the
TBAV utilities. It presents the major features of the program in a
step-by- step format. We recommend that you start with this chapter.
Chapter 2 contains instruction on how to prevent viruses from
infecting your computer system and directions on how to handle
viruses when they do strike. We recommend that you also read this
chapter because it contains several useful tips.
Chapter 3 contains a detailed description of both the purpose and
functionality of all the TBAV for DOS utilities.
Chapter 4 contains advanced user information for those users who
are more technically oriented.
This manual also contains five appendices. Appendix A describes TBAV
messages, Appendix B describes heuristic flags, Appendix C addresses some
incompatibility problems, Appendix D lists various exit codes for use in
batch files, and Appendix E contains information on naming viruses.
Finally, the Index provides you with the means of quickly finding any
major topic.
NOTE:
A complete reading of this manual is indispensable in order to
become familiar with the many facets of the ThunderBYTE AntiVirus
utilities; to know what steps you can, and must, take to ensure
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 7
adequate protection and be fully prepared for a complete recovery,
if and when disaster strikes.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 8
1 TBAV QuickStart
One of the problems with software manuals is they sometimes beat around
the bush and don't get to the point, namely, how to use the software
right now. This chapter presents the major features of TBAV and will get
you up and running in the minimum amount of time.
1.1 Installing the TBAV Utilities
This section provides the initial installation instructions of the TBAV
utilities for DOS. See the TBAV for Windows documentation for installing
TBAV for Windows or the TBAV for Networks documentation for installing
TBAV for Networks.
1.1.1 Understanding System requirements
The ThunderBYTE Anti-Virus utilities will run on any IBM or compatible PC
that meets the following requirements:
At least 1 megabyte of disk space
256 kilobytes of free internal memory
DOS version 3.0 (DOS 5.0 or later recommended)
A mouse is optional
NOTE:
The TBAV utilities are compatible with networks, MS-Windows,
Novell-DOS, etc.
1.1.2 Running INSTALL
You can install the TBAV utilities either by using the following instal-
lation procedure or by a fully customized procedure that you ll find in
Chapter 2. To use the fast approach, follow these steps:
1. Insert the TBAV installation diskette in the diskette drive, type
A: or B:, and press the ENTER key.
2. Type INSTALL and press ENTER. After a few seconds, the following
window appears:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 9
+-------------------------+
| Quit Installation |
| View TBAV.DOC file > |
| License TBAV > |
| Upgrade TBAV > |
| Custom Installation > |
| Express Installation > |
+-------------------------+
3. Since this is your first time to install the TBAV package you
choose the first option, which is already highlighted, so just press
ENTER. Notice also that you can always select a menu option by
pressing its first letter. Install now displays the Licensing
Agreement.
4. Press the cursor movement keys (up and down arrows and Page Up
and Page Down) to view the Agreement. When you finish reading the
agreement, press ESC. Install now asks you to acknowledge the
Agreement.
NOTE:
You can exit Install at anytime by pressing the ESC key until you
get to the Main Menu or even to the DOS prompt.
5. Select the Your Name field, type in your name, and press ENTER.
6. Select the company field and repeat the procedure to enter your
company name.
7. Press I to select the Terms field, type in YES to accept the
agreement, and press ENTER. The Install Menu now appears.
8. While you will probably accept the defaults, if you need to
change the source path (the path where the installation program
itself resides, usually drive A:) or the default Destination path
(where Install places the TBAV program files, usually C:\TBAV),
select the field, make your changes, and press ENTER.
9. Press B (or highlight Begin Installation and press ENTER) to
begin the installation. Install now scans your system to ensure that
it is clean (that is, no files are infected by a virus) and
informs you when it is done.
10. Press any key to continue. Install now copies the TBAV files to
the destination directory and makes a backup of your AUTOEXEC.BAT
file before making a few modifications to it. The installation
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 10
program adds the TBAV directory to your PATH and adds a statement
that will automatically run the TBSTART.BAT file.
NOTE:
The TBSTART.BAT file, which resides in the TBAV directory, contains
the following commands:
C:\TBAV\TBDRIVER
C:\TBAV\TBSCANX
C:\TBAV\TBCHECK
C:\TBAV\TBMEM
C:\TBAV\TBFILE
C:\TBAV\TBSCAN ONCE ALLDRIVES
You can configure these commands to suit your own personal needs.
Notice:
Install now displays a message that Recommends that you create a
Recovery Diskette, which you can use in the future, for example, to
restore your destroyed CMOS data, or restore your hard disk's
partition table after it has been tampered with.
11. Press any key to continue to the Final Menu. To create a
Recovery Diskette, press M, insert a clean formatted diskette into
Drive A, and press any key to continue. TBAV now copies the system
files to the diskette. See the Prepare a Recovery Diskette section
in Chapter 2 for more information. If you do not want to create a
Recovery Diskette, press Q to Quit Install.
12. When TBAV finishes, press any key to continue. TBAV invokes
TbSetup to generate an ANTI-VIR.DAT file for drive A and returns you
to the Final Menu.
13. Press Q to Quit Install. Install now invokes TbSetup again to
generate the ANTI-VIR.DAT reference files for your hard disk and
then returns you to the DOS prompt.
CAUTION:
It is extremely likely that some of the TBAV utilities are going to
display messages if you now reboot and continue using the computer
as you normally would. This is because some programs perform
operations that the TBAV utilities monitor. TBAV, therefore, needs
to learn which programs need proper permission. Before rebooting,
execute some of the programs you use regularly and respond
appropriately when TBAV requests permission to authorize or deny
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 11
their use. TBAV remembers the settings and will not bother you
again. Reboot the computer at the end of this test run.
14. After running some of the programs you use regularly (see
Caution box above), reboot your system.
The TBAV utilities are now ready to monitor your system and will issue a
warning if something suspicious (or worse!) is about to happen. The TBAV
utilities also warn you if any new file contains a possible virus, well
before it can do any harm.
1.1.3 Installation on a network
If a workstation does not have a hard disk, you can invoke the TBAV
utilities from a login script. You create a TbStart.Bat file containing
the following:
@echo off
x:\apps\tbav\tbdriver.exe
x:\apps\tbav\tbscanx.exe
x:\apps\tbav\tbcheck.exe
x:\apps\tbav\tbfile.exe
x:\apps\tbav\tbmem.exe
x:\apps\tbav\tbscan.exe alldrives
exit
In the login script add the following line:
#x:command.com /c /x:\apps\tbav\tbstart.bat
NOTE:
You need to enter the correct drive ID for 'X:'!
1.1.4 Starting And Ending TBAV
You can run TBAV in two ways: run the menu interface or run individual
utilities from the DOS prompt.
Starting TBAV With the Menu Interface
You can access most of the TBAV utilities from within the TBAV menu. To
start TBAV with the menu, follow these steps:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 12
1. At the DOS prompt, type CD \TBAV and press ENTER. This places you
in the TBAV directory.
NOTE:
This first step is actually optional since the TBAV directory was
added to the PATH during installation. You would need this step,
however, if you ever decided to remove that directory from the PATH.
2. Type TBAV and press ENTER. This starts TBAV and displays the menu
interface.
3. A common task is to scan your hard disk for viruses. To do this,
press S on the "Main Menu" to select the TbScan command. Press S
again to select the "Start Scanning" command on the TbScan Menu.
Press D on the "Path Menu" and press ENTER.
4. If TbScan finds a virus, it presents an action menu. "D)elete"
deletes the infected file. "K)ill" also deletes the infected file,
but in such a way that it can't be undeleted by an undelete utility
(such as DOS's UNDELETE command). "R)ename" renames an EXE extension
to VXE and a COM extension to VOM, preventing the execution of
infected programs and thereby precluding the spread of an infection,
and also enabling you to keep the file for later examination and
repair. "C)ontinue scanning" continues the scan without taking
action on the virus. "N)onstop continue" instructs TbScan not to
stop when it detects a virus.
NOTE:
If you use C or N, we recommend that you select L on the "TbScan
Menu" and then O on the "TbScan Log Menu" so that TbScan will log
detected viruses. To view this log, select V from the "TbScan Menu."
5. Another common task is to scan a diskette. To scan a diskette in
drive A, press A, or to scan a diskette in drive B, press B.
6. You can use one of three methods to end TBAV:
Press X to exit and save any configuration settings
you have set
Press Q to exit without saving any configuration
settings
Press ESC, which is the same as pressing Q
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 13
Starting TBAV Utilities from the DOS Prompt
You can also start each of the individual TBAV utilities directly from
the DOS prompt by typing the command name followed by one or more options
(or switches) to control special features. You can use either the full
name of the option or its one- or two-letter mnemonic to shorten the
command line.
For example, if you want to use TbScan to scan for viruses on your hard
disk, you could execute either one of the following commands:
TBSCAN ALLDRIVES
TBSCAN AD
The advantage of being able to execute individual utilities is that you
can use the utilities in batch files to create your own custom routines.
A simple example of this is putting TbScan in your AUTOEXEC.BAT file so
that it will scan for viruses when you boot up. To accomplish this, do
the following:
1. If you are using DOS 5 or later, type CD\ and press ENTER to go
to the root directory. Now type EDIT AUTOEXEC.BAT and press ENTER to
load this file into the MS-DOS text editor Edit.
NOTE:
If you are using a version of DOS prior to version 5.0, consult your
DOS manual on how to edit AUTOEXEC.BAT. You might have your own text
editor that you can use, or you could even use a word processor to
edit the file and then save it as an ASCII text file. Consult your
word processor's documentation for instructions.
2. Add the following line to the beginning of the file, making sure
you separate the options from the command and from each other using
a space:
C:\TBAV\TBSCAN AllDrives Once
3. Press ALT, F, S to save the file again, and then press ALT, F, X
to exit the editor (that is, if you are using the MS-DOS text editor
EDIT; otherwise, use the commands of your favourite editor to save
the file, and to exit the editor).
4. Reboot your computer so the changes will take effect.
CAUTION:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 14
This line already exists in the TBSTART.BAT file, which runs
automatically from AUTOEXEC.BAT. If you don't want to load all the
TSR utilities that TBSTART.BAT loads, you could replace TBSTART.BAT
with the above TBSCAN command. While this is still good protection,
be aware that it doesn't fully protect your system. Refer to the
Configuring TBAV section later in this chapter for more information
on configuring TBAV.
Now the first time you boot your computer on a given day, TbScan
will check for viruses on all fixed drives. Because of the OO
option, however, if you boot again, you'll receive the Option once
already used today message, meaning that since TbScan has already
run once that day, it will not run again.
Another useful TBAV utility, not just for deleting infected files but any
files you want destroyed, is TbDel. This utility overwrites every byte of
a file with a nul character, thereby completely obliterating the file.
If, for security reasons, you have files you want to destroy and prevent
someone from undeleting using a file recovery program, enter the
following command:
TBDEL [filename]
WARNING:
Be absolutely sure you want to destroy a file before using TbDel.
Once you execute the command, the file is gone forever, and no file
recovery utility can bring it back.
1.1.5 Using TBAV Commands
There are many commands in The TBAV Utilities, but most of them are
available from the menu. You can select commands using either the
keyboard or the mouse. To select a command, do one of the following:
Highlight an option using the arrow keys and press Enter
Press the highlighted letter of a command
Move the mouse pointer to a command and click the left button
As mentioned earlier, you can use all TBAV commands directly from the DOS
prompt. You must separate the command from the first option and options
from each other using a space. You can use the standard slash (/)
character or hyphen (-) before an option, but it is not necessary.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 15
The standard command line syntax for all ThunderBYTE Anti-Virus commands
is:
COMMAND [<path>][<filename>] [<option>] [<option>]
where <path> and <filename> is where you want the command to execute and
<option> is the specific option you want to use. For example, the
following command executes a virus scan on all executable files in the
root directory of drive C: and all subdirectories and skips the boot
sector scan:
TBSCAN C:\ NOBOOT
1.1.6 Getting Help
TBAV enables you to get help at any time, whether you are working from
the menu or the DOS prompt.
Getting Help From the Menu
To get help at anytime while working from the TBAV menu, follow these
steps:
1. From the Main Menu, select Documentation.
2. From the Documentation menu, select TBAV User Manual.
3. Use the up and down arrow keys and Page Up and Page Down to move
through the manual.
4. Press ESC to exit the manual.
TIP:
Instead of using the internal file viewer to view the User Manual,
you can substitute your own favorite viewer. See the Configuring
TBAV section later in this chapter for details.
Getting Help at the DOS Prompt
To get help about proper syntax when working with individual TBAV
utilities, do one of the following:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 16
Type the name of the command followed by a question mark (?), TBSCAN
?, for example. Some commands (TbClean, TbDel, and TbUtil) display
the Help screen if you type the command name only.
Each command also displays the help screen if you issue the command
with an invalid option.
1.1.7 Configuring TBAV
The choices you made when installing the TBAV utilities might need a
little fine tuning. You might want to edit AUTOEXEC.BAT, as mentioned
earlier, for example, or you might want to edit TBSTART.BAT file, which
AUTOEXEC.BAT executes.
Additionally, you might want to change how TBAV operates within the menu
interface. This section explains how you can configure the TBAV utilities
and use them the way you prefer. The following sections explain how to
customize TBAV.
NOTE:
After making certain changes and then initializing and rebooting
your system, TBAV needs to be "trained" as it encounters new TSR's.
NOTE:
Options that have a check mark beside them indicate that they are
selected. Options may be toggled by selecting: the highlighted
letter, clicking on them with your mouse or moving the highlight bar
with your cursor keys and then pressing Enter.
+-----Main menu-----+
| Confi+----------TBAV configuration---------+
| TbSca|v Use colors |
| TbSet| Save configuration to TBAV.INI |
| TbUti| File view utility |
| TbCLe|v Wait after program execution |
| Virus| Show command line before executing |
| TBAV |v Edit path string before scanning |
| Docum+-------------------------------------+
| Register TBAV |
| About |
| Quit and save |
| eXit (no save) |
+-------------------+
The "Use Colors" Option
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 17
If you disable this option, that is, select it so the check mark
disappears, TBAV appears in monochrome mode, which is convenient for use
on laptop and notebook computers. When you select the Configure TBAV
option from the Main Menu, the Configuration menu appears:
The "Save Configuration to TBAV.INI" Option
When you select this option, TBAV saves all configuration values set
within the TBAV menu in the TBAV.INI file. The next time you load the
TBAV utilities, these configuration values take effect. These values
apply to the TBAV menu itself and the utilities TbSetup, TbScan and
TbClean.
Although you can edit the TBAV.INI file manually, we recommend that you
allow the TBAV menu to do it. By default, the contents of the TBAV.INI
file are valid only while using the TBAV menu shell. You can, however,
enable the Use TBAV.INI file options (or specify the USEINI switches in
the TBAV.INI file itself) for each of the TBAV utilities.
For example, to use the settings in TBAV.INI with TbScan, you would
follow these steps:
1. Select TbScan from the Main Menu. This displays the TbScan Menu.
2. From this menu, select the Options Menu option.
3. From this menu, select the Use TBAV.INI option and notice that a
check mark appears beside it.
After selecting this option, TbScan also uses the TBAV.INI when you
run TbScan from the DOS prompt. The same is true if you select this
option for TbSetup and TbClean.
CAUTION:
Be careful, since command line options do NOT undo TBAV.INI
settings. TBAV creates a TBAV.INI file when enabling this option for
the first time. This file lists all valid configuration switches.
Additionally, a semicolon precedes disabled switches.
The "File View Utility" Option
TbSetup and TbScan generate a data file and a log file respectively. By
default, you can view these files, as well as the TBAV documentation
mentioned earlier, from the TBAV menu using TBAV's internal file view
utility.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 18
If you prefer, however, you can specify your own file viewing utility. To
do this, follow these steps:
1. Press F to select the File View Utility option.
2. Type in the complete path and the file name, including the
extension, of the utility you want to use (e.g.,
C:\DIRNAME\VIEWER.EXE), and press ENTER.
The "Wait After Program Execution" Option
If you enable this option, TBAV displays the message "Press any key to
return to the TBAV menu..." after executing an external utility.
The "Show Command Line Before Executing" Option
Enabling this option forces TBAV to display the DOS command that loads
the external file viewing utility. This option comes in handy for
enabling you to see the command(s) you specified before. After pressing
ENTER, TBAV then executes the DOS commands.
The "Edit Path String Before Scanning" Option
If you enable this option, TBAV prompts you to edit or confirm the path
to scan after you select Start Scanning from a scan menu.
1.2 Understanding TbSetup
By way of analogy, if you think of TbScan as being the heart of TBAV, you
can think of TbSetup as being the skeleton. TbSetup collects information
from all software it finds on your system and places this information in
files, one in each directory, named ANTI-VIR.DAT and uses this informati-
on for integrity checking, program validation, and cleaning infected
files.
WARNING:
NEVER, NEVER, NEVER use TbSetup when there is the slightest evidence
of a virus on your system.
Since TbSetup was run during the installation program, it is not really
necessary for you to run it again. In fact, the less you run it the
better. The only time you should run TbSetup again is in directories with
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 19
new or changed program files. Assume you just added a new program to your
system, which installed into a new directory called NEWPRO. To run
TbSetup on that new directory, you could execute one of the following
procedures:
From the TBAV Main Menu, select TbSetup, select Start TbSetup from
the TbSetup Menu, type in C:\NEWPRO as the path to process, and then
press ENTER.
From the DOS prompt, enter TBSETUP C:\NEWPRO and press ENTER.
See the "Using TbSetup" section in Chapter 3 for more information about
using TbSetup.
WARNING:
NEVER, NEVER, NEVER use TbSetup when there is the slightest evidence
of a virus on your system.
1.3 Understanding TbDriver
TbDriver is a small memory resident (TSR) program that you must load
before loading any of the other five TBAV memory resident programs, which
include: TbScanX, TbCheck, TbMem, TbFile, and TbDisk. Chapter 3 fully
explains all of these programs, but to conclude our earlier analogy, if
TbScan is the heart of TBAV, and TbSetup is the skeleton, then TbDriver
and the other TSRs are the muscles. They simply wait in memory until
called into action. When they detect suspicious code or other
irregularities, they immediately inform you and take appropriate action.
TBAV Install places a call to TBSTART.BAT in your AUTOEXEC.BAT file so
that all of these TSRs, except TbDisk, load automatically when you boot.
For maximum security, we recommend that you allow these utilities to load
and remain in memory.
TIP:
If you prefer, you can put the memory resident utilities listed in
TBSTART.BAT in your CONFIG.SYS file. Remove the call to TBSTART.BAT
from AUTOEXEC.BAT, and then use a DEVICE= command in CONFIG.SYS for
each utility. Don't forget to use the full path and to specify the
.EXE extension. If you are using DOS 5 or higher, you can load these
utilities into upper memory using the
LOADHIGH command in either TBSTART.BAT or CONFIG.SYS.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 20
1.4 Maintaining the System
All systems need maintenance, and the TBAV utilities are no different.
This section, therefore, describes how to maintain the TBAV utilities.
1.4.1 Maintaining ANTI-VIR.DAT Files
Whenever you add, update or replace programs on your system, be sure to
use TbSetup to generate or update their fingerprints in the ANTI-VIR.DAT
files. See the Using TbSetup section earlier in this chapter and the
Using TbSetup section in Chapter 3 for more information.
1.4.2 Creating a New Recovery Diskette
There will be times when you will want to create a new recovery diskette.
This will be necessary, for example, when you install a new version of
DOS because this changes the boot sector. You should also do this if you
change the configuration of your hard disk because this can affect the
partition tables and the CMOS setup. You should prepare a new recovery
diskette after all system modifications. See the Prepare a Recovery
Diskette section in the next chapter for more information.
1.4.3 Getting Updates
As new viruses emerge, which is almost daily, you need to replace
TbScan's signature file (TBSCAN.SIG) periodically with a more up to date
one. You can get the latest signature file from your local ThunderBYTE
dealer. Subscribing to the ThunderBYTE update service at your local
dealer is a convenient way to guarantee the delivery of each new update.
You can also download the file directly from the ThunderBYTE support
Bulletin Board Systems (BBS).
To download updates, follow these steps:
1. Using your telecommunications program, dial the BBS phone number.
2. When the modem logs on, press the ESC twice to go to the
ThunderBYTE On-line Service.
3. From the File Menu select Download Latest ThunderBYTE Anti-Virus
Utilities .
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 21
4. Select the File Transfer Protocol "zmodem" or "ymodem" from the
Protocol Menu to select the file protocol you want to use, and then
begin your download procedure.
Additionally, you can check with a local bulletin board regularly, as
many of them offer updated versions of our software.
We issue the standard complete release in an archive named: TBAVxxx.ZIP,
where xxx represents the three-digit version number. The archive
extension might vary on local bulletin boards using a different archive
method.
The release of TBAV for Windows is archived in a file named:
TBAVWxxx.ZIP. Again, xxx represents the three-digit version number of
TBAV for Windows. The same holds for the release of TBAV for Networks; it
is distributed in a file called TBAVNxxx.ZIP.
To maintain the highest reliability, the Dutch and US ThunderBYTE support
sites issue regular beta releases, also containing only the files that
have changed. You can identify beta versions by a B in the filename,
such as TBAVBxxx.ZIP.
The resident ThunderBYTE Anti-Virus utilities are also available in
processor optimized formats. These processor optimized versions, named
TBAVXxxx.ZIP, are for registered users only. You can buy these versions
through your local ThunderBYTE dealer.
NOTE:
The ThunderBYTE Anti-Virus utilities currently support several
languages, by means of separate language files. Check your local
ThunderBYTE dealer for the availability of the TBAV support file in
your language.
1.4.4 Maintaining a Network
Since you should replace the signature file TBSCAN.SIG frequently, this
can turn into much work if you have to update all workstations on a
network manually. Fortunately, there are several possibilities to do this
job automatically.
Using the TbLoad Utility
The TbLoad utility that ships with TBAV for Windows is used to
automatically update the existing ThunderBYTE Anti-Virus software
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 22
installed on your system. Please refer to the section about TbLoad in the
TBAV for Windows documentation.
Using the DOS REPLACE Command
Maintain a directory \TBAV_UPD\ on a public server drive and place any
new version of the TBAV utilities or any new signature file (TBSCAN.SIG)
in this directory.
The workstations should execute a batch file automatically after users
login on the network. This batch file should contain the following lines:
REM UPDATE TBAV IF A NEW RELEASE IS AVAILABLE.
REPLACE X:\TBAV_UPD\*.* C:\TBAV /U /R
REPLACE X:\TBAV_UPD\*.* C:\TBAV /A /R
REPLACE is a standard DOS utility. If the /U option is specified, it
copies the files specified by the first parameter ONLY if they are newer
than the files specified in the second parameter. The /A option makes
sure that REPLACE copies files that do not yet exist in the destination
directory (specified by the second parameter). Make sure REPLACE is in
the current path, and that the specified paths are valid for your
configuration. The x in the above example represents the drive letter
of the public server drive.
Using this technique, you only have to update one drive with the new
signature file or anti-virus software; all workstations will then update
themselves when users login! You can also add the /S option if you want
REPLACE to scan all directories on the workstations drives for matching
files. Please consult your DOS Operating System manual for more details.
WARNING:
Don't forget to execute TbSetup on the new utilities in the
X:\TBAV_UPD directory, thus ensuring that the REPLACE command also
copies the new ANTI-VIR.DAT file.
1.4.5 Using the PKUNZIP Utility
Maintain a directory \TBAV_UPD\ on a public server drive and place any
new version of the TBAV utilities or any new signature file (TBSCAN.SIG)
in this directory.
The workstations should execute a batch file automatically after users
login on the network. This batch file should contain the following lines:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 23
REM UPDATE TBAV IF A NEW RELEASE IS AVAILABLE.
PKUNZIP -N -O X:\TBAV_UPD\TBAV???.ZIP C:\TBAV
Make sure the file PKUNZIP.EXE is in the current path, and that the paths
specified are valid for your configuration.
Following this procedure, the PKUNZIP command comes into action only when
you just updated the ZIP files in the X:\TBAV_UPD directory. Now you only
have to update one drive with the new anti-virus software, and all
workstations update themselves when users login.
WARNING:
If you did not create a Recovery Diskette during installation, we
recommended that you do so. See the "Create a Recovery Diskette"
section in Chapter 2 for instructions on how to do this. The example
setups assume you have created such a recovery diskette.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 24
2 Defining Your Anti-Virus Strategy
In this chapter, you learn how to accomplish two things: how to protect
yourself against virus infection, and how to recover from virus
infection. We recommend you read this chapter because it contains several
useful tips.
2.1 Protecting Yourself Against Virus Infection
Maintaining a reliable safety system implies that you actively take
measures to protect your system from virus infection, since some viruses
can hide themselves perfectly once resident in memory.
TIP:
At least once a week you should boot from a clean and
write-protected diskette and execute TbScan to check your computer
for virus infections.
The tightness of your safety system really depends on two things:
1. The vitality of the appropriate computer system
2. The amount of time you want to invest to let the safety measures
take place
For example, on a standalone computer containing low risk data, and in an
environment with little exchange of computer software, a daily scan is
usually sufficient. For company use, however, in a network environment
where users exchange diskettes frequently, where disks contain highly
vulnerable information, and where a network going down means the loss
of an extensive amount of money, protection must be as tight as the
organization can practically handle.
With this in mind, it's impossible to define one strategy for system
protection that will work for everybody. It all depends on your demands
and possibilities.
The TBAV utilities, however, are extremely flexible and enable you to
define your own strategy, one that will work for your special needs.
Although the following six basic precautions are NOT intended to be a
complete protection system, they do provide a foundation on which you can
build your own strategy.
1. Install TBAV on your hard disk
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 25
You can customize the installation to suit your specific needs. Be
sure to use TbSetup to maintain recovery information of all
executable files of your system! Refer to the Installing the TBAV
Utilities section in Chapter 1 for details.
The following examples assume that all utilities reside in the
default directory \TBAV. All example setups require that TbSetup is
running. If your system has more hard disks or disk partitions, you
should repeat the TbSetup invocation for every drive or partition.
TIP
Remember that you can use the ALLDRIVES and ALLNET options to
make TbSetup process all local respectively remote
non-removable drives.
Furthermore, the example setups assume you have created a recovery
diskette.
2. Prepare a recovery diskette
It is imperative to have a clean recovery diskette to recover from
virus infection. If you didn't create a recovery diskette during the
TBAV installation, take a few minutes to prepare one now. Later,
when a virus infects your system, it's too late! To create a
recovery diskette, follow these steps:
1. Insert a new diskette in drive A:, and then change to the
DOS directory by typing CD \DOS and pressing ENTER.
2. Type FORMAT A: /S, and press ENTER. The /S switch copies
the DOS system files to the disk so you can boot the computer
with it.
3. Type COPY SYS.COM A: and press ENTER. This copies the
SYS.COM program, which is the program that DOS uses to copy its
system files to a disk.
4. Type CD \TBAV to return to the TBAV directory.
5. Type MAKERESC A: and press ENTER to create a recovery disk
in drive A.
WARNING:
If your computer has two floppy disk drives, be sure you
know which one is drive A and create your recovery disk
there. A PC never tries to boot from drive B.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 26
The MAKERESC.BAT procedure creates a reliable recovery diskette
by creating or copying the following:
- A backup of the boot sector, partition sector and CMOS
configuration.
- A CONFIG.SYS file, containing:
FILES=20
BUFFERS=20
DEVICE=TBDRIVER.EXE
DEVICE=TBCHECK.EXE FULLCRC
- An AUTOEXEC.BAT file, containing:
@ECHO OFF
ECHO OFF
PATH=A:\
TBAV
CLS
ECHO WARNING!!!
ECHO IF YOU SUSPECT A VIRUS, DO NOT EXECUTE
ANYTHING FROM THE HARD DISK!
- The following files:
TBAV.EXE
TBAV.LNG
TBSCAN.EXE
TBSCAN.LNG
TBSCAN.SIG
TBDRIVER.EXE
TBDRIVER.LNG
TBCHECK.EXE
TBCLEAN.EXE
TBUTIL.EXE
TBUTIL.LNG
6. Copy to the diskette any other utilities that could come in
handy in an emergency, such as a simple editor to edit
CONFIG.SYS and AUTOEXEC.BAT files. If your hard disk needs
special device drivers to unlock added features, such as
DoubleSpace or Stacker, copy the appropriate drivers to the
recovery diskette and install them in the CONFIG.SYS file on
drive A:, being careful to avoid statements that access the
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 27
hard disk. Be sure to check the instructions in the device
driver's manual for the correct procedures.
CAUTION:
If you are using the text editor that ships with DOS 5.0
or later, be sure to not only copy the file EDIT.COM to
drive A:, but also QBASIC.EXE, which EDIT.COM uses.
7. Make sure you write protect your recovery disk. Now label it
"Recovery Disk" and include on the label the identification of
the PC to which the diskette belongs. Store the diskette in a
safe place.
TIP:
For additional security, make another recovery diskette
and store it in a separate location.
3. Prevent the Installation of Unauthorized Software
Many companies do not allow employees to install or execute
unauthorized software. Similarly, perhaps you want to keep family
members from invading your computer with haphazard games and sundry
software. TBAV provides a watchdog function that can help to enforce
this. Follow these steps:
1. First you need to add the following lines to the CONFIG.SYS
file:
DEVICE=C:\TBAV\TBDRIVER.EXE
DEVICE=C:\TBAV\TBCHECK.EXE SECURE
Alternately, if you are using the TBSTART.BAT file, then you
would add the following two lines to it:
C:\TBAV\TBDRIVER
C:\TBAV\TBCHECK SECURE
2. Run TbSetup on the system by typing "TBSETUP ALLDRIVES" and
pressing ENTER.
3. Reboot the system.
From now on, TbCheck puts an effective clamp on any user who tries
to execute software that TbSetup has not duly authorized first.
Whenever someone is trying to execute an unknown program, TBAV
displays the following message:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 28
+-----------TBAV Interception-----------+
| The requested program (GAME.EXE) |
| is not authorized and can not be |
| executed. |
| Execution cancelled! Press any key... |
+---------------------------------------+
4. Restrict User Access
Most of the TBAV utilities are interactive; that is, they
communicate with a knowledgeable user to establish appropriate
action in ambiguous situations. Many companies, however, insist that
the system operator be the sole authority allowed to communicate
with TBAV, and so avoid wrong doing by possibly inept employees.
It is for this very reason that most of the TBAV utilities support
the SECURE option. When you specify this option, TBAV suspends all
user interaction with the utilities. In other words, TBAV never asks
users for permission to allow questionable operations, avoiding
erroneous decisions that might well result in irreparable havoc.
This option also prevents the user from disabling or unloading the
TBAV utilities.
5. Never Use "Strange" Diskettes to Boot
Boot only from your hard disk or from your original DOS diskette.
NEVER use someone else's disk to boot the computer. If you have a
hard disk, make certain that the door to your floppy drive is open
before resetting or booting the machine.
6. Run the DOS CHKDSK Command Often Use the DOS program CHKDSK
frequently (without the /F switch). CHKDSK can sometimes indicate
the presence of a virus simply because some viruses change the disk
structure incorrectly, thereby causing disk errors in the process.
Look out for changes in the behavior of your software or your PC.
Any change in their behavior is suspect, unless you know its cause.
Some highly suspicious symptoms are:
A decrease in the amount of available memory space.
CHKDSK should report 655,360 total bytes of memory.
Programs require more time to execute.
Programs do not operate as they used to, or they cause
the system to crash or reboot after some time.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 29
Data mysteriously disappears or becomes damaged.
The size of one or more programs has increased.
The screen behaves strangely or displays unusual
information.
CHKDSK detects many errors.
TIP:
You can also instruct TbScan to mimic the behavior of the DOS
command CHKDSK. Simply execute TbScan with the fatcheck option
enabled. For example, if you want TbScan to scan your C: and D:
drive once a day, and to check the integrity of those disks,
place the following command in your AUTOEXEC.BAT file:
TbScan C:\ D:\ FATCHECK ONCE
2.2 Recovering from Virus Infection
This section presents some tips on how to clean your computer system when
it is has been compromised by a virus.
1. Backup Your Data
The very first thing to do when you realize that your system might
be infected is to back up all important files immediately. Label the
new backup as unreliable, since some of the files might be infected.
CAUTION:
Use fresh backup media and do not overwrite a previous backup
set. You might need the previous set to replace lost or
contaminated files.
2. Boot From a Recovery Diskette
When you become aware of a virus infection, it is imperative that
you boot only from a reliable, write protected recovery system
diskette.
3. Know the Symptoms of a Virus
Now execute TbScan for an indication of what is wrong, or boot from
a recovery diskette and compare its system files with those on the
hard disk to check for changes. During this test you should take
care to stay logged onto your system diskette.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 30
TbScan reports the virus name if it knows the virus, or it gives a
summary of file changes if it can't identify the virus. If you use
the command line below, for example, TbScan processes all
non-removable drives and prints the results of the scan process to
the printer.
TBSCAN ALLDRIVES LOGNAME=LPT1 LOG
Also run TbUtil, to check the boot sector, partition code and the
CMOS configuration, using the following command:
TBUTIL COMPARE
WARNING:
To prevent a virus from invading the system's memory and
possibly masking the test results, do not execute any program
on your hard disk. TbCheck warns you if you accidentally try to
execute an infected or unauthorized program on your hard disk.
Remember that it is in the nature of a file virus to infect as many
programs as possible over a short period. You ll seldom find only a
few programs on a hard disk to be infected. A TbScan virus alert
that flags a mere one percent of the files on a hard-worked system
is probably just a false alarm that has nothing to do with a real
virus.
In other words, if the file compare test indicates that all of them
are still the same, you know at least that you are not dealing with
a file virus. Avoid using the same copy of the TbScan program on
another system after discovering a virus. Like any other program
file, TBSCAN.EXE itself can become infected!
To check infections of the TbScan program, the program performs a
sanity check when it runs. Unfortunately, there is no way to make
software 100% virus-proof. A sanity check does not work if a
stealth-type virus is at work. A stealth virus can hide itself
completely when you run a self-check.
In case you are wondering, this is not a bug in TbScan. The failure
to detect stealth viruses is common to all software that performs a
sanity check. We, therefore, recommend that you keep a clean version
of TbScan on a write-protected diskette. Use this diskette to check
other machines once you have found a virus on your system.
4. Identify Virus Characteristics
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 31
Viruses come in many different guises and have their own
peculiarities. It is extremely important to know at the earliest
possible stage which particular kind of virus you are dealing with.
This gives you at least some indication of the nature and the amount
of the damage it might have caused already.
Some viruses infect only executable files that you can easily
reinstall or replace from a clean source. Others swap some random
bytes anywhere on the hard disk, which could affect data files as
well, although the results might not be noticeable for some time.
Then there are those viruses that damage the hard disk partition
table or file allocation table. Some of the even nastier viruses,
the so-called multipartite viruses, operate in more than one area.
Once you isolate the virus, either contact your support BBS, consult
literature on virus problems, or get in touch with a virus expert.
WARNING:
Whatever you do, DON'T PANIC! An inexperienced user, reacting
in confusion, can often create more havoc than the virus
itself, such as blindly eradicating important data. While an
instant reformat might get rid of the virus, it will definitely
destroy all your recent work as well.
5. Restore the System
Again, while recovering from a virus infection, it is particularly
important to boot only from a clean write-protected system diskette.
This the only way to keep a virus out of the system's memory. Never
execute a program from the hard disk.
Using the SYS command on the system or recovery diskette, restore
the master boot sector and the DOS system files to the hard disk. If
the boot sector or partition code contains a virus, you can also use
the following command to get rid of it by restoring clean sectors:
TBUTIL RESTORE
WARNING:
Many modern hard disks, notably IDE or AT drives using advanced
pre-formatting methods, are low-level formatted by the
manufacturer, ready for partitioning and a DOS format. NEVER
try to low-level format these drives yourself. Doing so can
ruin the drive. It is always better to back up the partition
table with a utility such as TbUtil, which restores the
partition table for you without reformatting.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 32
If TBAV identifies the virus as a file virus, the safest course is
to remove the infected files (using TbDel) and to copy or reinstall
all executables from a CLEAN source. A virus cleaning utility, such
as TbClean, won't always be able to fully restore the original
program code, so use this only as a last resort, such as when you
don't have a reliable backup. It might be necessary to replace data
files as well if the virus is known to cause damage in that area.
CAUTION:
After reassuring yourself that the system is absolutely clean
again, run a careful check on all diskettes and backups to
remove every single trace of the virus. Keep in mind that it
takes only one infected diskette to reacquire the problem.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 33
3 Using the TBAV utilities
This chapter fully describes each of the TBAV utilities. For quick
reference, we will present each utility using at least three sections:
Understanding the utility, Working with the utility, and Maximizing the
utility. Most discussions also include a fourth section: Understanding
the utility's operating process.
3.1 Using TbSetup
Even though TbSetup does not take an active part in actual virus
detection or cleaning, it is nonetheless an indispensable tool in adding
support to the rest of the ThunderBYTE Anti-Virus utilities. TbSetup
organizes control and recovery information, thereby giving extra power to
the other utilities. It gathers information, mainly from program files,
into a single ANTI-VIR.DAT reference file, one in each directory.
NOTE:
See the "Understanding ANTI-VIR.DAT Files" section at the end of
this chapter for a fuller explanation of these files.
3.1.1 Understanding TbSetup
Although the ThunderBYTE utilities can work perfectly well without the
ANTI-VIR.DAT files, we recommend that you have TbSetup generate these
files. TBAV uses these files for several purposes:
TbScan and the memory resident TbCheck program perform an integrity
check while scanning if it can detect the ANTI-VIR.DAT file. If a
file becomes infected by a virus, the information in the
ANTI-VIR.DAT file will not match the actual file contents, and
TbScan and TbCheck will inform you that the file has been changed.
The TbSetup program recognizes some files that need special
treatment. An example of such a file is a disk image file of a
network remote boot disk. You should completely scan such a file,
which actually represents a complete disk. TbSetup puts a mark in
the ANTI-VIR.DAT file to ensure that TbScan scans the entire file
for all viruses.
Once a file becomes infected, TbClean can reconstruct the original
file. The information in the ANTI-VIR.DAT file will be of great help
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 34
to TbClean. TbClean can cure some infected programs only if there is
information about the program in the ANTI-VIR.DAT file.
TbCheck (a tiny resident integrity checker) has no purpose if there
are no ANTI-VIR.DAT files on your system. The resident TBAV
utilities need the ANTI-VIR.DAT files to maintain permission
information. Without ANTI-VIR.DAT files you can't prevent false
alarms other than by disabling a complete feature.
NOTE:
Be aware that the ANTI-VIR.DAT directory entries have by default the
attribute hidden and therefore do not show up when you use
standard directory commands. You can see the filenames only with the
help of special utilities or with the DOS 6 command DIR AH.
3.1.2 Working with the TbSetup Menu
This is the one program where the rule applies: The less you use the
program, the better your protection against viruses! Why? Keep in mind
that an ANTI-VIR.DAT file stores vital information needed to detect a
virus, as well as data for subsequent recovery and for cleaning.
Consider, then, what would happen if you were to execute TbSetup after a
virus entered the system. The information in the ANTI-VIR.DAT file would
be updated to the state of the infected file, wiping out all traces of
data needed to reconstruct the original file to its uninfected state.
WARNING:
NEVER, NEVER, NEVER, use TbSetup when there is the slightest
evidence of a virus on your system. Once TbSetup generates
ANTI-VIR.DAT files as part of the initial setup, you should confine
any subsequent use of TbSetup to directories with new or changed
program files.
Now we will explore these menu options.
Selecting the "TbSetup" option from the Main Menu displays the following
menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 35
+-----Main menu------+
| Confi+-----TbSetup menu------+
| TbSca| Start TbSetup |
| TbSet| Options menu >|
| TbUti| Flags menu >|
| TbCLe| Data file path/name |
| Virus| View data file |
| TBAV +-----------------------+
| Documentation >|
| Register TBAV |
| About |
| eXit (no save) |
| Quit and save |
+--------------------+
The "Start TbSetup" Option
Select this option only after you complete your selection of other
options on this menu and other sub-menus. When you select this option,
the "Enter disk / path / file(s) to process:" window appears. Type in the
drive and directory you want to setup and press ENTER.
The "Options Menu" Option
Selecting this option displays the following menu:
+-----Main menu------+
| Confi+-----TbSetup menu------+
| TbSca| Start+-----------TbSetup options----------+
| TbSet| Optio| Use TBAV.INI file |
| TbUti| Flags| Prompt for pause |
| TbCLe| Data | Only new files |
| Virus| View | Remove Anti-Vir.Dat files |
| TBAV +-------| Test mode (Don't change anything) |
| Documentation|v Hide Anti-Vir.Dat files |
| Register TBAV| Make executables readonly |
| About | Clear readonly attributes |
| Quit and save|v Sub-Directory scan |
| eXit (no save+------------------------------------+
+--------------------+
Use TBAV.INI file.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 36
By enabling this option, the TbSetup configuration values, saved in
the TBAV.INI file, will also apply when loading TbSetup from the
command line.
CAUTION:
If you specify options in the TBAV.INI file, you cannot undo
them on the command line.
Prompt for pause.
When you specify this option, TbSetup stops after it processes the
contents of one window. This enables you to examine the results.
Only new files.
Use this option if you want to add new files to the ANTI-VIR.DAT
database but prevent the information of changed files from being
updated. Updating the information of changed files is dangerous
because if the files are infected, the information to detect and
cure the virus is overwritten. This option prevents the information
from being overwritten but still allows adding information of new
files to the database.
Remove ANTI-VIR.DAT files.
If you want to stop using the ThunderBYTE utilities you do not have
to remove all the ANTI-VIR.DAT files yourself. By using this option
TbSetup neatly removes all ANTI-VIR.DAT files from your system.
Test mode (Don't change anything).
Use this option if you want to see the effects of an option without
the risk of activating something you don't want to activate. This
option instructs the program to behave as it normally would but not
change or update anything on your hard disk.
Hide ANTI-VIR.DAT files.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 37
The ANTI-VIR.DAT files are normally not visible in a directory
listing. If you prefer them to be visible, disable this option.
NOTE:
Be aware that this option applies only for new ANTI-VIR.DAT
files
Make executables read-only.
Since TbFile permanently guards the read-only attribute, we
recommend that you make all executable files read-only to prevent
any modifications on these files. TbSetup automatically does this
job for you if you enable this option. TbSetup recognizes files that
you should not make read-only.
Clear read-only attributes.
Use this option to reverse the "Make executables read-only"
operation. If you enable this option, TBAV clears all read-only
attributes on all executable files.
Sub-Directory scan.
By default, TbSetup searches sub-directories for executable files,
unless you specify a filename (wildcards allowed). If you disable
this option, TbSetup will not process sub-directories.
The "Flags Menu" Option
Selecting this option displays the following menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 38
+-----Main menu------+
| Confi+-----TbSetup menu------+
| TbSca| Start+-----TbSetup flags------+
| TbSet| Optio|v Use normal flags |
| TbUti| Flags| Set flags manually |
| TbCLe| Data | Reset flags manually |
| Virus| View | Define flags >|
| TBAV +-------+------------------------+
| Documentation >|
| Register TBAV |
| About |
| Quit and save |
| eXit (no save) |
+--------------------+
NOTE:
"Flags" refer to internal indicators, created by ThunderBYTE to
signal internal file attributes.
This menu contains the following options:
Use normal flags.
This is the default setting for TbSetup.
Set flags manually.
This option is for advanced users only. Using this option, you can
manually set permission flags in the ANTI-VIR.DAT record. This
option requires a hexadecimal bit mask for the flags to set; you can
specify this bit mask by selecting one of more of the items listed
in the "Define flags" sub-menu, which appears below.
Reset flags manually.
This option is for advanced users only. Using this option, you can
manually reset permission flags or prevent flags from being set in
the ANTI-VIR.DAT record. This option requires a hexadecimal bit mask
for the flags to reset; you can specify this bit mask by selecting
one or more of the items listed in the "Define flags" sub-menu,
which appears below.
Define flags.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 39
Selecting this option displays the changed following menu:
+-----Main menu------+
| Confi+-----TbSetup menu------+
| TbSca| Start+-----TbSetup flags------+
| TbSet| Optio|v Use n+--Define flags to be--------+
| TbUti| Flags| Set f| 0001: Heuristic analysis |
| TbCLe| Data | Reset| 0002: Checksum changes |
| Virus| View | Defin| 0004: Disk image File |
| TBAV +-------+-------| 0008: Read only sensitive |
| Documentation >| | 0010: TSR program |
| Register TBAV | | 0020: Direct disk access |
| About | | 0040: Attribute modifier |
| Quit and save | | 8000: Interrupt rehook |
| eXit (no save) | +----------------------------+
+--------------------+
Selecting one or more of these options accomplishes the following:
0001: Heuristic analysis.
Programs with the 0001 flag will not be heuristically scanned.
0002: Checksum changes.
Programs with the 0002 flag will not be checked for file changes.
0004: Disk image File.
Files with this flag contain a disk layout and are checked
completely.
0008: Read only sensitive.
Files with this flag cannot be changed to read-only.
0010: TSR program.
Programs with this flag have permission to stay resident in memory.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 40
0020: Direct disk access.
Programs with this flag have permission to write directly to the
disk.
0040: Attribute modifier.
Programs with this flag have permission to change program
attributes.
8000: Interrupt rehook.
After a program with this flag starts, TbDriver should rehook
interrupts.
The "Data File Path Name" Option
TbSetup searches for "special" files by using a file named TBSETUP.DAT.
You can use this option to specify another path or filename that contains
a list of special files. Select the option, and then enter the name
(and path if necessary) of the data file you want to use.
The "View Data File" Option
Selecting this option displays the TBSETUP.DAT file on the screen for
your viewing. Use the cursor movement keys to move through the file.
TIP:
Instead of using the internal file viewer to view the User Manual,
you can substitute your own favorite viewer. See the "Configuring
TBAV" section in Chapter 1 for details..
3.1.3 Maximizing TbSetup
Now that you know how to use TbScan's menus, you can more easily
understand how to maximize its performance by using command line options.
The following table summarizes these options:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 41
option parameter short explanation
------------------ ----- ----------------------------------------
help he help
pause pa enable "Pause" prompt
mono mo force monochrome output
nosub ns skip sub-directories
newonly no do not update changed records
alldrives ad process all local fixed drives
allnet an process all network drives
remove rm remove ANTI-VIR.DAT files
test te do not create / change anything
nohidden nh do not make ANTI-VIR.DAT files hidden
readonly ro set read-only attribute on executables
nordonly nr remove / do not set read-only attribute
set=<flags> se set flags
reset=<flags> re reset flags / do not set flags
datfile=<filename> df specify the data file to be used
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
help (he).
Specifying this option displays a short list of available options,
as listed above.
pause (pa).
Specifying this option stops after processing the contents of one
window. This enables you to examine the results.
mono (mo).
This option enhances the screen output on some LCD screens or
color-emulating monochrome systems.
nosub (ns).
By default, TbSetup searches sub-directories for executable files,
unless you specify a filename (wildcards allowed). If you specify
this option, TbSetup will not process sub-directories.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 42
newonly (no).
Use this option if you want to add new files to the ANTI-VIR.DAT
database but prevent the information of changed files from being
updated. Updating the information of changed files is dangerous
because if the files become infected, the information to detect and
cure the virus is overwritten. This option prevents the information
from being overwritten but still allows adding information of new
files to the database.
alldrives (ad).
If you want TbSetup to process all local non-removable drives you
can specify this option. Except for the initial execution, it isn't
a good idea to use this option.
allnet (an).
Specify this option if you want TbSetup to process all network
drives.
WARNING:
Except for the initial execution of the TBAV utilities, it
isn't a good idea to use the "allnet" option
remove (rm).
If you want to stop using the ThunderBYTE utilities, you do not have
to remove all the ANTI-VIR.DAT files manually. By using this option,
TbSetup neatly removes all ANTI-VIR.DAT files from your system.
test (te).
Use this option if you want to see the effects of an option without
the risk of activating something you don't want to activate. If you
specify this option, the program behaves as it would normally but
does not change or update anything on your hard disk.
nohidden (nh).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 43
The ANTI-VIR.DAT files are normally not visible in a directory
listing. If you prefer the ANTI-VIR.DAT files to be visible, use
this option.
NOTE:
Be aware that the "nohidden" option applies only for new
ANTI-VIR.DAT files
readonly (ro).
Since, TbFile permanently guards the read-only attribute, we
recommend that you make all executable files read-only to prevent
any modifications on these files. TbSetup automatically does this
job for you if you use this option. TbSetup recognizes files that
you should not make read-only.
nordonly (nr).
This option reverses the operation of READONLY option. If you use
this option, TbSetup clears the read-only attribute from all
executable files.
set (se).
This option is for advanced users only. Using this option you can
manually set permission flags in the ANTI-VIR.DAT record. This
option requires a hexadecimal bit mask for the flags to set. For
information about the bit mask consult the TBSETUP.DAT file. Option
format: Set =<flags>; for example: Set = 0001.
reset (re).
This option is for advanced users only. With this option you can
manually reset permission flags or prevent flags from being set in
the ANTI-VIR.DAT record. This option requires a hexadecimal bit mask
for the flags to reset. For information about the bit mask consult
the TBSETUP.DAT file. Option format: Reset =<flags>; for example:
Reset = 0001.
datfile (df).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 44
After the datfile option you can specify the name of the data file
to use.
For the initial installation of TBAV, you could use the following
command:
TBSETUP ALLDRIVES
Using the following command, you could specify which drives (C: and D:,
for example) you want TbSetup to process:
TBSETUP C:\ D:\
Since you did not specify a filename in the above command, TbSetup
assumes that the specified path to be the top-level path. In other words,
TbSetup processes all its sub-directories. If you do specify a filename,
TbSetup processes only that path, not any subdirectories. You can use
wildcards (the asterisk [*] or the question mark [?]) in the filename.
You can use the NEWONLY option to prevent TbSetup from overwriting
existing information. To help you remember that you need to run TbSetup
again, the next time you run TbScan it displays either a small 'c'
after the file to indicate a new file or a capital 'C' if a file has
simply been changed.
If you add a new file called TEST.EXE to your directory C:\TESTING, you
should execute the following command:
TBSETUP C:\TESTING\TEST.EXE
If you install a new product in a new directory, C:\NEW, you should use
the following command:
TBSETUP C:\NEW
3.1.4 Understanding TbSetup's Operation
TbSetup divides the screen into three windows: an information window
displaying data file comments across the top of the screen, a scanning
window on the left, and a status window on the right.
The lower left window lists the names of the files being processed, along
with file specific information in the following way:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 45
TEST.EXE 01234 12AB23CD Added * 0001
| | | | | |
| | | | | |
| | | | | 'flags' set for this file
| | | | indicates 'special' file
| | | action performed
| | 32-bit CRC (checksum)
| file size in hexadecimal number
name of file in process
Do not be concerned if the information flies too fast for you to read, or
if it puzzles you. These details are provided purely for diagnostic use.
The scanning window also displays an action performed field, which
indicates whether an entry in the ANTI-VIR.DAT was added, changed or
updated:
Added.
Means that there was no previous entry for this file in the
ANTI-VIR.DAT record and that a new entry was added.
Changed.
Means that there was an existing entry but the file has been changed
and ANTI-VIR.DAT information was updated.
Updated.
Means that there was an ANTI-VIR.DAT record and the file was found
to be unchanged. TbSetup did, however, change some of the program's
permission flags, due to either an entry in the TBSETUP.DAT file or
in compliance with a SET or RESET option.
TIP:
You can abort TbSetup at any time by pressing Ctrl+Break.
3.1.5 Understanding TBSETUP.DAT Files
Although the ThunderBYTE utilities perform well on almost every file
without extra help, there are some files that need special attention.
TbSetup uses information collected in the TBSETUP.DAT data file, to flag
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 46
these special files in the ANTI-VIR.DAT file. The other ThunderBYTE
utilities then use this information to determine how they should treat
such a "special" file.
Some programs maintain configuration information inside the
executable file (EXE, COM) itself. Whenever you change the
configuration of these programs, the executable file changes as
well, along with its checksum. As a result, the new checksum no
longer matches the one stored in the TBSETUP.DAT file. Since some
TBAV utilities use this checksum information to verify integrity or
cleanup results, they need to know when a file's checksum is allowed
to change. TbScan can use generic detection methods such as
"heuristic" analysis to detect unknown viruses. Since heuristic
analysis implies inevitable false alarms when a file looks like a
virus, TbScan might have to decide not to do a heuristic analysis on
such a program.
Some of the TBAV utilities guard the read-only attribute and ensure
that it can be removed only with the user's explicit permission. A
few programs, however, refuse to run properly with the read-only
attribute set.
TbScan's default scanning method performs perfectly well with just
about any file, but there are some that need special analysis. Such
a file is the Novell NET$DOS.SYS file, which is not a device driver
as the filename extension suggests, but a disk image of the bootable
disk. You should, therefore, scan it completely for all signatures,
including COM and BOOT. The resident monitoring utilities of the
TBAV package detect all sorts of virus-specific behavior. Some
programs, even though they might act like a virus, are still
perfectly normal and should be permitted to execute without TBAV
interference.
You need not worry if you discover that a few files will be excluded from
heuristic analysis. TBAV still scans these files in the conventional way
for signatures. Furthermore, TBAV will not grant heuristic exclusion
unless a file exactly matches its entry in the TBSETUP.DAT file,
including its name, size, and 32-bit CRC checksum.
This safety feature eliminates security holes effectively, since if a
listed file is already infected, its checksum won't match the 32-bit CRC
in the TBSETUP.DAT file and the exclusion does not apply. By the same
token, if a program becomes infected at a later date, the result is a
change in at least one of its characteristics, so the record in the
ANTI-VIR.DAT file no longer matches and the file will be subject to full
heuristic analysis like any other.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 47
3.2 Using TbScan
TbScan is the program you will most likely use the most detect virus
infections.
3.2.1 Understanding TbScan
TbScan is a scanner which has been specifically designed to detect
viruses, Trojan Horses and other such threats to your valuable data. Most
viruses consist of a unique sequence of instructions, called a
signature. By checking for the appearance of such signatures in a file
we can find out whether a program has been infected. Scanning all program
files for the signatures of all known viruses helps you to find out
quickly whether your system has been infected and, if so, by which virus.
Understanding TbScan involves understanding three main features of the
program.
Fast Scanning
TbScan is the fastest scanner on the market today. It, therefore,
invites you to use it from within your AUTOEXEC.BAT file every
morning. Thanks to its design, TbScan does not slow down if the
number of signatures increases. It doesn't matter whether you scan a
file for 10 or a 1000 signatures.
TbScan even checks itself upon launching. If it detects infection,
it aborts and displays an error. This minimizes the risk of the
TbScan program itself transferring a virus to your system.
Heuristic Scanning
TbScan can detect unknown viruses. The built-in disassembler is able
to detect suspicious instruction sequences and abnormal program
layouts. This feature is called "heuristic scanning" and is
partially enabled by default. TBAV performs heuristic scanning on
files and boot sectors.
NOTE.
Virus scanners can only tell you whether your system has been
infected. By that time only a non-infected backup or a recovery
program such as TbClean can properly counter a virus infection.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 48
Scan Scheduling
Every PC owner should use a virus scanner frequently. It is the
least one should do to avoid damage caused by a virus. We recommend
that you devise your own schedule for a regular scan of your system.
See Chapter 2 for details.
We recommend the following scan sessions, to be used in combination
with each other:
Execute TbScan from write-protected bootable diskette once a
week. Boot from this diskette before invoking the scanner.
Booting from a clean diskette is the only way to make sure that
no stealth virus can become resident in memory.
Invoke a daily scan. You can invoke TbScan with the ONCE option
from within the AUTOEXEC.BAT file to perform the daily scan
session automatically, which is the default if you used the
standard installation procedure for TBAV (see Chapter 1). It is
not necessary to boot from the bootable TbScan diskette to
perform the daily scan.
Scan each new diskette. You should scan EVERY diskette you
receive from a friend or acquaintance for viruses to ensure
that a virus hasn't been included along with a copy of "a great
game!"
3.2.2 Working with the TbScan Menus
For daily use you can activate TbScan by loading the program from the DOS
command line (e.g., in the AUTOEXEC.BAT file), or through the TBAV menu.
For weekly use, when scanning from the TbScan diskette, you could use the
DOS command. The Maximizing TbScan section of this chapter lists the
TbScan DOS options. This section describes the use of the TbScan Menu,
which is part of the TBAV menu. Taking each menu item in order, we ll
explore the function of each.
Selecting the "TbScan" option from the TBAV menu displays the following
menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 49
+-----Main menu-----+
| Confi+----TbScan menu-----+
| TbSca| Start scanning |
| TbSet| Options menu >|
| TbUti| Advanced options >|
| TbCLe| If virus found >|
| Virus| Log file menu >|
| TBAV | View log file |
| Docum+--------------------+
| Register TBAV |
| About |
| Quit and save |
| eXit (no save) |
+-------------------+
The "Start Scanning" Option
Selecting the "Start Scanning" option from the TbScan Menu displays one
of the following "Path Menu" configurations:
+-----Main menu-----+
| Confi+----TbScan menu-----+
| TbSca| Sta+---------Path menu---------+
| TbSet| Opt| Specified files/paths |
| TbUti| Adv| Current directory |
| TbCLe| If | Diskette in drive A: |
| Virus| Log| Diskette in drive B: |
| TBAV | Vie| All fixed Drives |
| Docum+-----| All fixed Local drives |
| Register TB| All fixed Network drives |
| About +---------------------------+
| Quit and save |
| eXit (no save) |
+-------------------+
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 50
+-----Main menu-----+
| Confi+----TbScan menu-----+
| TbSca| Sta+---------Path menu---------+
| TbSet| Opt| Specified files/paths |
| TbUti| Adv| Current directory |
| TbCLe| If | CD-ROM |
| Virus| Log| Drive_a |
| TBAV | Vie| Fullscan |
| Docum+-----| Local |
| Register TB+---------------------------+
| About |
| Quit and save |
| eXit (no save) |
+-------------------+
The first menu configuration includes scan targets such as CD-ROM,
Drive_a, etc. Primarily, TBAV for Windows uses these scan targets, but
TbScan for DOS can also use them. If the TBAV menu finds one or more of
these scan targets (the targets are really files with the filename
extension SCN), the Path Menu will then display the list of available
targets. If no such scan targets exist, the second Path Menu
configuration will appear.
NOTE:
Please be aware that the actual menu items you come across in the
Path menu might differ slightly, depending on your system
configuration.
The Path Menus list the following options:
Specified files/paths.
This option always presents you with a small prompt window in which
you can specify the drives, paths, or even files you want to scan.
You can specify multiple path specifications by separating each with
spaces. This specification automatically initializes with the last
path you scanned before you saved the configuration.
Current directory.
Select this option if you want to scan only the directory from which
you started the TBAV menu shell.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 51
Diskette in drive A: or Diskette in drive B:.
If you want to scan multiple diskettes, you might wish to activate
the Repeat option of TbScan. See the TbScan Options Menu for more
information.
All fixed drives.
This option instructs TbScan to scan all available drives (except
the removable ones) completely. Depending on the settings in the
TBAV configuration menu, TbScan prompts you to confirm the selected
drives.
All fixed Local drives.
If you are on a network, you probably don't want to scan the entire
network. Using this option you can scan just the drives that reside
in your machine. Depending on the settings in the TBAV configuration
menu, TbScan prompts you to confirm the selected drives.
All fixed Network drives.
Using this option you can scan all network drives. Depending on the
settings in the TBAV configuration menu, TbScan prompts you to
confirm the selected drives.
The "Options Menu" Option
Selecting the "Options Menu" option displays the following menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 52
+-----Main menu-----+
| Confi+----TbScan menu-----+
| TbSca| Start+------TbScan options-------+
| TbSet| Optio| Use TBAV.INI file |
| TbUti| Advan| Prompt for pause |
| TbCLe| If vi| Quick scan |
| Virus| Log f| Maximum Compatibility |
| TBAV | View |v Bootsector scan |
| Docum+-------|v Memory scan |
| Register TBAV| HMA scan forced |
| About |v Upper memory scan |
| Quit and save|v File scan |
| eXit (no save|v Windows-OS/2-virus scan |
+--------------|v Sub-Directory scan |
| Repeat scanning |
|v Abort on Ctrl-Break |
| Sound Effects |
|v Fast scrOlling |
|v Large directories |
| FAT checking |
+---------------------------+
Taking each menu item in order, we ll explore the function of each.
Use TBAV.INI file.
TbScan searches for a file named TBAV.INI in the TBAV directory. By
enabling this option, the TbScan configuration values, saved in the
TBAV.INI file, will also be valid when loading TbScan from the
command line.
CAUTION:
Be aware that if you specify options in the TBAV.INI, you
cannot undo them when running TbScan from the command line.
Prompt for pause.
When you activate this option, TbScan stops after it checks the
contents of each window. As each window fills with files, a
"[More]" prompt appears at the bottom of the screen. Simply press
any key to view the next list of files. Using this feature enables
you to examine the results of the scan without having to consult a
log file afterwards.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 53
Quick scan.
This option instructs TbScan to use the ANTI-VIR.DAT files to check
for file changes since the last scan. TbScan scans only those files
that have changed (CRC change) or are not yet listed in
ANTI-VIR.DAT. The other files are just checked for matching
ANTI-VIR.DAT records. By default, TbScan always scans files (the
quick scan option is not enabled by default).
Maximum compatibility.
If you select this option, TbScan attempts to be more compatible
with your system. Use this option if the program does not behave as
you would expect or if it halts the system. Be aware, however, that
this option slows down the scanning process. Therefore, use it only
when necessary. Be aware also that this option does not affect the
results of a scan.
Boot sector scan.
Enabling this option forces TbScan to scan the boot sector. A boot
sector is a certain part of a disk, which is used by the operating
system to initialize itself. A special class of viruses (boot sector
viruses) use this special part of a disk to infect your system.
Memory scan.
Enabling this option forces TbScan to scan the memory of the PC.
HMA scan forced.
By default, TbScan automatically detects the presence of an
XMS-driver and scans the HMA. If you are using an HMA-driver that is
not compatible with the XMS standard, you can use this option to
force TbScan to scan HMA.
Upper memory scan.
By default, TbScan identifies RAM beyond the DOS limit and scans
that memory. This means that it scans video memory and the current
EMS. You can use this option to enable the scanning of non-DOS
memory.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 54
File scan.
By default, TbScan checks files for viruses. Removing the check mark
disables file scanning. This option is particularly useful if, for
example, you have been struck by a boot sector virus. In order to
scan only boot sectors of your floppy disks, you can disable file
scan using this option.
Windows-OS/2-virus scan.
By default, TbScan scans Windows and OS/2 files for viruses.
Removing the check mark disables Windows and OS/2 file scanning.
Subdirectory scan.
By default, TbScan searches sub-directories for executable files,
unless you specify a filename (wildcards allowed). If you disable
this option, TbScan does not scan sub-directories.
Repeat scanning.
This option is very useful if you want to check a large number of
diskettes. TbScan does not return to DOS after checking a disk,
rather it prompts you to insert another disk in the drive.
Abort on Ctrl-Break.
If you don't want to be able to abort the scanning process by
pressing Ctrl+Break, you can disable this option.
Sound Effects.
Checking this option enables an audible sound when TbScan detects a
virus.
Fast scrolling.
TbScan displays processed files in a scrolling window, which scrolls
in one of two methods: fast scrolling, in which the files appear on
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 55
top of the previous ones if the window becomes full, and the
conventional slow method of scrolling, in which the files at the
bottom "push up" the previous ones. By default TbScan uses the
faster but less attractive method of scrolling.
Large directories.
If TbScan's directory table runs out of space, which is very
unlikely, you can use this option to allocate a large directory
table.
Fat checking.
If this option is specified, and TbScan is able to use its internal
file system, it will check the disks for lost clusters, cross linked
clusters, invalid cluster numbers, and invalid allocation sizes.
These errors often indicate system problems and need to be corrected
as soon as possible. Because TbScan needs to read the FAT and all
directories anyway, it can perform this important check without
using additional time.
The "Advanced Options" Option
When you select the Advanced Options option, the following menu is
displayed:
+-----Main menu-----+
| Confi+----TbScan menu-----+
| TbSca| Start+------TbScan advanced options-----+
| TbSet| Optio| High heuristic sensitivity |
| TbUti| Advan|v Auto heuristic sensitivity |
| TbCLe| If vi| Low heuristic sensitivity |
| Virus| Log f| Non-executable scan |
| TBAV | View | FAT info (fragmented files) |
| Docum+-------| Extract signatures |
| Register TBAV| Configure executable extensions |
| About +----------------------------------+
| Quit and save |
| eXit (no save) |
+-------------------+
Let's now explore these options.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 56
High heuristic sensitivity.
While TbScan always performs a heuristic scan on the files being
rocessed, it reports a file as infected only if it is very probable
that the file is infected. If you select this option, TbScan is
somewhat more sensitive. In this mode, TbScan detects 90% of the
new, unknown viruses without any signature. Be aware, however, that
some false alarms might occur.
Auto heuristic sensitivity.
By default, TbScan automatically adjusts the heuristic detection
level after it finds a virus. In other words, when TbScan finds a
virus, it then goes on as if you had selected High heuristic
sensitivity. This option provides you maximum detection
capabilities in case you need it, while at the same time keeps false
alarms at a minimum.
Low heuristic sensitivity.
In this mode TbScan almost never issues a false alarm. It still,
however, detects about 50% of the new, unknown viruses.
Non-executable scan.
This option instructs TbScan to scan non-executable files (files
with an extension other than COM, EXE, SYS, OV? or BIN) as well as
executables. If TbScan finds out that such a file does not contain
anything that the processor can execute, it skips the file.
Otherwise TbScan searches the file for COM, EXE and SYS signatures.
Be aware that TbScan does not perform heuristic analysis on
non-executable files. Since viruses normally do not infect
non-executable files, it is not necessary to scan non-executable
files too. We recommend, in fact, that you NOT use this option
unless you have a good reason to scan all files. Again, you must
execute a virus before it can do what it was programmed to do, and
since you do not execute non-executable files, a virus in such a
file cannot do anything. For this reason viruses do not even try to
infect such files. Some viruses, however, do write to non-executable
files, but this is a result of "incorrect" programming. And even
though these non-executable files contain corrupted data, they still
won't harm other program or data files.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 57
FAT info (fragmented files).
If this option is specified, TbScan displays the number of
fragmented files after it has finished scanning. If the number of
fragmented files is high, you can increase the system performance by
using a disk optimizer. This option is only valid if the option
'fatcheck' has been specified, and TbScan is using its internal file
system.
Extract signatures.
This option is available to registered users only. See the Using
TbGenSig section in Chapter 4 for more information.
Configure executable extensions.
By default, TbScan scans only those files that have a filename
extension that indicates that the file is a program file. Viruses
that do not infect executable code simply do not exist. Files with
the extension EXE, COM, BIN, SYS, and OV? (note the wildcard: the
OV? specification includes files such as OVR and OVL) are considered
executable. There are, however, some additional files that have an
internal layout that makes them suitable for infection by viruses.
Although it is not likely that you will ever execute most of these
files, you might want to scan them anyway. Some filename extensions
that might indicate an executable format include: .DLL (MS-Windows
Dynamic Link Library), .SCR (MS-Windows screen saver file), .MOD
(MS-Windows file), .CPL (MS-Windows Control Panel application), .00?
and .APP. While infection of such files is not likely, you might
want to scan them once in while. To force TbScan to scan these files
by default, select this option and fill out the extensions you want
TbScan to scan. For example, you can specify .DLL.SCR.CPL (with no
spaces in between). You can also use the question mark wildcard.
WARNING:
Be careful which extensions you specify. Scanning a
non-executable file, for example, causes unpredictable results,
and might result in false alarms.
The "If Virus Found" Option
Selecting this option displays the following menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 58
+-----Main menu-----+
| Confi+----TbScan menu----+
| TbSca| Start+--What if a virus is found?-+
| TbSet| Optio|v Present action menu |
| TbUti| Advan| Just continue (logonly) |
| TbCLe| If vi| Delete infected file |
| Virus| Log f| Kill infected file |
| TBAV | View | Rename infected file |
| Docum+-------+----------------------------+
| Register TBAV |
| About |
| Quit and save |
| eXit (no save) |
+-------------------+
Let's explore these options.
Present action menu.
This option (the default) instructs TbScan to display a menu listing
four possible actions if it detects a virus: just continue, delete,
kill or rename the infected file.
Just continue (logonly).
By default, if TbScan detects an infected file, it prompts you to
delete or rename the infected file, or to continue without action.
If you select this option, however, TbScan always continues. We
recommend that you use a log file in such situations, since a
scanning operation does not make much sense if you don't read the
return messages (see the Log File Menu option below for further
information).
Delete infected file.
By default, if TbScan detects a virus in a file it prompts you to
delete or rename the infected file, or to continue without action.
If you select this option, however, TbScan deletes the infected file
automatically, without prompting you first. Use this option if you
know your computer is infected by a virus and you want to erase all
files the virus has infected. Make sure you have a clean backup and
that you really want to get rid of all infected files at once.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 59
Kill infected file.
This option is almost the same as the "Delete infected file" option
with one major difference. The DOS UNDELETE command enables you can
recover a deleted file, but if you delete the infected file using
this "Kill" option, recovery is no longer possible.
Rename infected file.
By default, if TbScan detects a file virus it prompts you to delete
or rename the infected file, or to continue without action. If you
select this option, however, TbScan renames the infected file
automatically, without prompting you first. By default, TbScan
replaces the first character of the file extension by the character
'V'. It names an .EXE file, to .VXE, for example, and a .COM file to
.VOM. This prevents the execution of infected programs and thereby
spreading the infection. This also enables you to keep the files for
later examination and repair.
The "Log File Menu" Option
You can use the "TbScan Log Menu" to handle the results of the scan
process (write them to a file or to a printer, for example). The menu
appears below, followed by a description of the options.
+----Main menu-----+
| Confi+------TbScan menu------+
| TbSet| Start+-------TbScan LOG menu-------+
| TbSca| Optio| Log file path/name |
| TbUti| Advan| Output to log file |
| TbCLe| If vi| Specify log-level >|
| TBAV | Log f| Append to existing log |
| Docum| View | No heuristic descriptions |
| Regis+-------| Truename filenames |
| Quit and save+-----------------------------+
| eXit (no save) |
+------------------+
Log file path/name.
Using this option you can specify the name of the log file you want
to use. TbScan creates the file in the current directory unless you
specify a path and filename. If the log file already exists, TbScan
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 60
overwrites the file (unless you selected the "Append to existing
log" option. If you want to print the results, you can specify a
printer device name rather than a filename (LPT1 instead of
C:\TBAV\TBSCAN.LOG, for example).
CAUTION:
To create the log file, you must select the "Output to log
file" option.
Output to logfile.
When you select this option, TbScan creates a log file. The log file
lists all infected program files, specifying heuristic flags (see
Appendix B) and complete pathnames.
Specify log-level.
This option enables you to configure the actual contents of the log
file using the following menu:
+----Main menu-----+
| Confi+------TbScan menu------+
| TbSet| Start+-------TbScan LOG menu-------+
| TbSca| Optio| Log f+--------Log-level menu--------+
| TbUti| Advan| Outpu| 0: Log only infected files |
| TbCLe| If vi| Speci|v 1: Log summary too |
| TBAV | Log f| Appen| 2: Log suspected too |
| Docum| View | No he| 3: Log all warnings too |
| Regis+-------| Truen| 4: Log clean files too |
| Quit and save+-------+------------------------------+
| eXit (no save) |
+------------------+
These levels determine what kind of file information TbScan notes in
the log file. The default log level is 1, but you can select one of
five levels:
0: Logonly infected files.
Specifies that if there are no infected files, do not create or
change the log file.
1: Log summary too.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 61
Places a summary and time stamp in the log file, and specifies
that TbScan put only infected files in the log file.
2: Log suspected too.
This is almost the same as level 1, but TbScan also logs
suspected files, files that would trigger the heuristic alarm
if you specify the "High heuristic" sensitivity option.
3: Log all warnings too.
This level is an extension of the previous level. It specifies
that TbScan log all files that have a warning character printed
behind the filename.
4: Log clean files too.
This places the information of all files being processed into
the log file.
Append to existing log.
If you select this option, TbScan appends new information to the
existing log file instead of overwriting it. If you use this option
often, we recommended that you delete or truncate the log file once
in a while to avoid unlimited growth.
CAUTION:
To create the log file, you must select the "Output to log
file" option.
No heuristic descriptions.
If you enable this option, TbScan does not specify the descriptions
of the heuristic flags in the log file. See Appendix B for the
heuristic flag descriptions.
Truename filenames.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 62
If this option is specified, TbScan uses 'truenames' rather than DOS
filenames. If you process a file on a network, accessed by DOS as
F:\USER\FILE.EXE then TbScan will use the fully expanded filename
(like \\SERVER2\PUBLIC\USER\FILE.EXE) on the screen and in the log
file.
The "View Log File" Option
If you activate one of the above log file options, you can then select
this option to view and study the log. Otherwise, this option is not
available.
TIP:
See the "Configuring TBAV" section in Chapter 1 for how you can
specify your own file viewer using the "Configure TBAV, File view
utility" command.
3.2.3 Maximizing TbScan
Now that you know how to use TbScan's menus, you can more easily
understand the power of using it from the command line.
When you run TbScan from the DOS command line, it recognizes command line
options (often called "switches" in DOS terms). These options appear as
"key-words" or "key-letters." The words are easier to memorize, so we
will use these in this manual for convenience.
When you run TbScan, it looks for a file named TBAV.INI in the TBAV
directory. If the keyword USEINI appears in the [TbScan] section of the
TBAV.INI file, the other options listed in the [TbScan] section will be
includede when you run TbScan from the command line.
CAUTION:
Be aware that if you specify options in the TBAV.INI file, you
cannot undo them when you run TbScan from the command line.
The following table lists the TbScan command line options:
option parameter short explanation
------------------ ----- ----------------------------------------
help he help
pause pa enable Pause prompt
mono mo force monochrome output
quick qs quick scan (use ANTI-VIR.DAT)
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 63
allfiles af scan non-executables too
alldrives ad scan all local non-removable drives
allnet an scan all network drives
heuristic hr enable heuristic alerts
extract ex extract signatures (registered users only)
once oo scan only once a day
slowscroll ss enable conventional (slow) scrolling
secure se disable "user abort" (registered users
only)
compat co maximum compatibility mode
ignofile in ignore no-file error
largedir ld use large directory table
fatcheck fc check the FAT for errors
fatinfo fi display amount of fragmented files
old ol disable the "This program is old" message
noboot nb skip boot sector check
nofiles nf skip scanning of files
nomem nm skip memory check
hma hm force HMA scan
nohmem nh skip UMB/HMA scan
nosub ns skip sub-directories
noautohr na auto heuristic level adjust
nowin nw do not scan for Windows-OS/2 viruses
repeat rp scan multiple diskettes
audio aa make noise if virus found
batch ba batch mode - no user input
delete de automatically delete infected files
kill ki automatically kill infected files
truename tn use true name instead of DOS name
log lo output to log file
append ap log file append mode
expertlog el no heuristic descriptions in log
logname=<filename> ln set path/name of log file
loglevel=<0...4> ll set log level
wait=<0...255> wa amount of timer-ticks to wait
rename[=<text-mask>] rn rename infected files
exec=.<ext-mask> ee specify executable extensions
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBSCAN ?.
help (he).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 64
If you specify this option TbScan displays the help as listed above.
pause (pa).
When you specify the PAUSE option, TbScan stops after it checks the
contents of one window. This enables you to examine the results
without having to consult a log file later.
mono (mo).
This option prevents TbScan from using colors in the screen output.
This might enhance the screen output on some LCD screens or
color-emulating monochrome systems.
quick (qs).
This option instructs TbScan to use the ANTI-VIR.DAT files to check
for file changes since the last scan. TbScan scans only those files
that have changed (CRC change) or do not appear in ANTI-VIR.DAT. By
default, TbScan always scans files.
allfiles (af).
If you specify this option, TbScan also scans non-executable files
(that is, files without a .COM, .EXE, .SYS or .BIN extension). If
TbScan finds that such a file does not contain executable code, it
"skips" that file. Otherwise, TbScan searches the file for COM, EXE
and SYS signatures. Be aware that TbScan does not perform heuristic
analysis on non-executable files. Since viruses normally do not
infect non-executable files, it is not necessary to scan them. We
recommend, in fact, that you do not use this option unless you have
a good reason to scan all files since a file infected with a virus
must normally be executed before it can perform what it is
programmed to do, and since you can't execute a non-executable file,
a virus in such a file cannot do anything. Some viruses write to
non-executable files, but this is simply a result of "incorrect"
programming or a specific targeted attack-- the result of which
may be corrupted data, which will not likely harm other program or
data files.
alldrives (ad).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 65
This option instructs TbScan to scan all local non-removable disks.
allnet (an).
This option instructs TbScan to scan all network drives.
heuristic (hr).
While TbScan always performs a heuristic scan on the files being
processed, if you select this option TbScan increases it's level of
sensitivity. In this mode, TbScan detects 90% of the unknown viruses
without any signatures. Be aware, however, that some false alarms
might occur. See the "Understanding Heuristic Scanning" section
later in this chapter for more information.
extract (ex).
This option is available to registered users only. See the "Using
TbGenSig" section in Chapter 4 for more information.
once (oo).
If you specify this option, TbScan "remembers" whether it has run
that day, and that if it has, it will not run again. In other words,
this instructs TbScan to run only once a day, regardless of how many
times you actually enter the command from the DOS prompt or a batch
file. This command is very useful in your AUTOEXEC.BAT file, for
example: TBSCAN @EVERYDAY.SCN ONCE RENAME. TbScan now scans the list
of files and/or paths specified in the file EVERYDAY.SCN during the
first boot-up of the day. If the systems boots more often that day,
TbScan returns to the DOS prompt immediately. This option does not
interfere with the regular use of TbScan. If you invoke TbScan
without this option, it always runs, regardless of a previous run
with the ONCE option set.
NOTE:
If TbScan cannot write to TBSCAN.EXE because it is flagged
"read-only" or is located on a write-protected diskette, the
ONCE option fails and the scanner executes without it.
slowscroll (ss).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 66
If you specify this option, TbScan scrolls the files in the files
window conventionally. This method is slower but looks more
attractive.
secure (se).
This option is available to registered users only. If you use it, it
is no longer possible to cancel TbScan by pressing Ctrl+Break, or to
respond to a virus alert window.
compat (co).
If you select this option, TbScan attempts to be more compatible
with your system. Use this option if the program does not behave as
you would expect, or if it even halts the system. This option slows
down the scanning process, so you should use it only if necessary.
This option in no way affects the results of a scan.
ignofile (in).
If you specify this option and TbScan doesn't find any files, TbScan
does not display the no files found message, nor does it exit with
ERRORLEVEL 1. You might use this option for automatic contents
scanning.
largedir (ld).
If TbScan's directory table runs out of space, which is very
unlikely, you can use this option to allocate a large directory
table.
fatcheck (fc).
If this option is specified, and TbScan is able to use its internal
file system, it will check the disk(s) for lost clusters, cross
linked clusters, invalid cluster numbers, and invalid allocation
sizes. These errors often indicate system problems and need to be
corrected as soon as possible. Because TbScan needs to read the FAT
and all directories anyway, it can perform this important check
without using additional time.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 67
fatinfo (fi).
If this option is specified, TbScan displays the amount of
fragmented files after it finished scanning. If the amount of
fragmented files is high, you can increase the system performance by
using a disk optimizer. This option can only be used in combination
with option "fatcheck", and if TbScan is using its internal file
system.
old (ol).
This option suppresses the message that appears if TbScan is 6
months old.
noboot (nb).
If you specify this option, TbScan does not scan the boot sector.
nofiles (nf).
This option disables the scanning of files. This can be useful if
you are the victim of a boot sector virus and want to scan a large
stack of diskettes as fast as possible.
nomem (nm).
If you specify this option, TbScan does not scan memory.
hma (hm).
By default, TbScan automatically detects the presence of an
XMS-driver and scans HMA. If you have an HMA-driver that is not
compatible with the XMS standard, you can use this option to force
TbScan to scan HMA.
nohmem (nh).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 68
By default, TbScan identifies RAM beyond the DOS limit and scans it.
This means that it scans video memory and the current EMS pages. You
can, therefore, use this option to disable the scanning of non-DOS
memory.
nosub (ns).
By default, TbScan searches sub-directories for executable files,
unless you specify a filename (wildcards allowed). If you enable
this option, TbScan does not scan sub-directories.
noautohr (na).
TbScan automatically adjusts the heuristic detection level after it
locates a virus. In other words, when TbScan finds a virus, it
continues as if you used the HEURISTIC option. This provides you
maximum detection capabilities in case you need it, while keeping
the amount of false alarms to a minimum. If you don't want this, you
can specify option NOAUTOHR.
nowin (nw).
By default, TbScan scans Windows and OS/2 files for viruses.
Removing the checkmark disables Windows and OS/2 file scanning.
repeat (rp).
This option is very useful if you want to check a large amount of
diskettes. Instead of returning to DOS after checking a disk, TbScan
prompts you to insert another disk in the drive.
audio (aa).
This enables an audible alarm sound when TbScan finds a virus.
batch (ba).
By enabling this option, TbScan scans without displaying any
messages. If you use this option, we recommend that you use a log
file (see the LOG option below).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 69
delete (de).
By default, if TbScan detects a virus in a file, it prompts you to
delete or rename the infected file, or to continue without action.
If you specify this option, however, TbScan deletes the infected
file automatically, without prompting you first. Use this option if
you know there is a virus infection. Make sure that you have a clean
backup, and that you really want to get rid of all infected files at
once.
kill (ki).
By default, if TbScan detects a virus in a file it prompts you to
delete or rename the infected file, or to continue without action.
If you specify the DELETE option, TbScan deletes the infected file
automatically, without prompting you first. Unlike the DELETE
option, however, KILL prevents files from being undeleted. Be
careful if you use this option. Make sure you have a clean backup!
truename (tn).
This option instructs TbScan to use "truenames" rather than DOS
names. For example, if you process a file on a network that DOS
accesses using the name F:\USER\FILE.EXE, TbScan uses the full name
\\SERVER\PUBLIC\USER\FILE.EXE on the screen and in the log.
log (lo).
When you use this option, TbScan creates a log file. The log file
lists all infected program files, specifying heuristic flags (see
Appendix B) and complete pathnames.
append (ap).
If you use this option, TbScan appends new information to an
existing log file rather than overwriting it. If you use this option
often, we recommend that you delete or truncate the log file
occasionally to avoid unlimited growth.
NOTE:
If you use this option, you must also use the LOG option.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 70
expertlog (el).
If you enable this option, TbScan does not specify the descriptions
of the heuristic flags in the log file. Appendix B lists the
heuristic flag descriptions
logname =<filename> (ln).
Using this option, you can specify the name of the log file you want
to use. TbScan creates the file in the current directory unless you
specify a path and filename after selecting this option. If the log
file already exists, TbScan overwrites it. If you want to print the
results, you can specify a printer device name rather than a
filename (for example, you can specify LOGNAME=LPT1).
NOTE:
If you use this option, you must also use the LOG option.
loglevel =<0..4> (ll).
These levels determine what kind of file information the log file
stores. The default log level is 1, but you can select one of five
log levels:
0 : Log only infected files.
This specifies that if there are no infected files, do not
create or change the log file.
1 : Log summary too.
This places a summary and time stamp in the log file, and
specifies that TbScan put only infected files in the log file.
2 : Log suspected too.
This is almost the same as level 1, but TbScan also logs
"suspected files," files that would trigger the heuristic alarm
if you specify the "High heuristic" sensitivity option.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 71
3 : Log all warnings too.
This level is an extension of the previous level. It specifies
that TbScan log all files that have a warning character printed
behind the filename.
4 : Log clean files too.
This places the information of all files being processed into
the log file.
NOTE:
If you use this option, you must also use the LOG option.
wait =<0..255> (wa).
Use this option to delay TbScan. This might be handy if you want to
scan a very busy network but don't want to occupy the network too
heavily. You have to specify the amount of timer ticks you want to
insert between scanned files.
rename [=<text-mask>] (rn).
By default, if TbScan detects a file virus, it prompts you to delete
or rename the infected file, or to continue without action. If you
select this option, TbScan renames the infected file automatically,
without prompting you first. Also by default, TbScan replaces the
first character of the file extension with the character 'V.' It
renames an .EXE file to .VXE, for example, and a .COM file to .VOM.
This prevents the execution of infected programs and thereby
prevents spreading the infection. This option also enables you to
keep the infected files for later examination and repair. You can
also add a parameter to this option specifying the target extension.
This parameter should always contain three characters; you can use
question marks. The default target extension is "V??."
exec =.<ext-mask> (ee).
Using this option you can add filename extensions that indicate what
files are executable. If you want to use this option, you probably
want to put it in the configuration file. Refer to the "Advanced
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 72
Options" Option section earlier in this chapter for an explanation
of configuring executable extensions.
Here are a few examples using TbScan from the DOS command line.
1. This command:
TBSCAN C:\ NOBOOT
scans all executable files in the root directory and its
subdirectories and skips the boot sector scan.
2. This command:
TBSCAN \*.*
scans all files in the root directory but does not process
subdirectories.
3. This command:
TBSCAN C:\ LOG LOGNAME=C:\TEST.LOG LOGLEVEL=2
scans all executable files on drive C: and creates a LOG file named
C:\TEST.LOG that contains all infected and suspected files.
4. This command:
TBSCAN \ LOG LOGNAME=LPT1
scans the root directory and its subdirectories and then redirects
the results to the printer instead of a log file.
3.2.4 Understanding the Scanning Process
This section adds to your knowledge of TbScan by explaining a little more
about the scanning process. TbScan starts scanning immediately whenever
you run it from the DOS command line or select the Start Scanning
option in the TbScan Menu. As TbScan begins its scan, your screen will
look similar to the following:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 73
TbScan divides the screen into three windows: an information window (at
the top), a scanning window (the bottom-left window) and a status window
(to the right of the scanning window). The information window initially
displays the vendor information only.
+-----------------------------------------------------------------+
|Thunderbyte virus detector (C) 1989-95, Thunderbyte B.V. |
| |
| TBAV is upgraded every two months. Free hotline support is |
| provided for all registered users via telephone, fax and |
| electronic bulletin board. Read the comprehensive documentation |
| files for detailed info. |
| |
| C:\DOS\ |
| |
| ANSI.SYS scanning..> OK signatures: 986 |
| COUNTRY.SYS skipping..> OK |
| DISKCOPY.COM tracing...> OK file system: OWN |
| DISPLAY.SYS scanning..> OK |
| DRIVER.SYS scanning..> OK directories: 01 |
| EGA.CPI skipping..> OK total files: 17 |
| FASTOPEN.EXE looking...> OK executables: 12 |
| FDISK.EXE looking...> OK CRC verified: 10 |
| FORMAT.COM tracing...> E OK changed files: 00 |
| GRAFTABL.COM tracing...> OK infected items: 00 |
| GRAPHICS.COM tracing...> OK |
| GRAPHICS.PRO skipping..> OK elapsed time: 00:05 |
| Kb /second: 57 |
+-----------------------------------------------------------------+
If TbScan detects infected files, it displays the names of the file and
the virus in the upper window. The lower left window displays the names
of the files being processed, the algorithm in use, information and
heuristic flags, and finally an OK statement or the name of the virus
detected.
Notice the following example:
NLSFUNC.EXE checking..> FU OK
| | | |
| | | result of scan
| | heuristic flags
| algorithm being used to process file
name of file in process
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 74
You will see comments following each file name, such as: "looking,"
"checking," "tracing," "scanning," or "skipping." These refer to the
various algorithms being used to scan files.
Other comments that TbScan displays here are the heuristic flags. Consult
the Understanding Heuristic Flags section later in this chapter and
Appendix B for more information on these warning characters.
The lower right window is the status window. It displays the number of
files and directories encountered as well as the number of viruses found.
It also displays which file system is being used: either DOS or OWN.
The latter means that TbScan is able to bypass DOS. If this is the case,
TbScan reads all files directly from disk for extra security and speed.
You can abort the scanning process by pressing the two keys Ctrl+Break
simultaneously (that is, if you didn't specify the "SECURE" option).
When TbScan detects an infected program, it displays the name of the
virus. If you did not specify the BATCH, RENAME or DELETE options, TbScan
prompts you to specify the appropriate action. If you choose to rename
the file, TbScan replaces the first character of the file extension with
the character 'V.' This prevents you or someone else from accidentally
executing the file before you can investigate it more thoroughly.
If TbScan detects an infected file, it displays one of the following
messages:
[Name of file] is infected by [name of virus] virus.
The file is infected by the virus mentioned.
[Name of file] is Joke named [name of Joke].
Some programs simulate that the system is infected by a virus; such
a program is a "joke." A joke is completely harmless; however it
causes confusion and might cause people to stop using the computer,
and should therefore be removed..
[Name of file] is Trojan named [name of Trojan].
The file is a Trojan Horse. A Trojan Horse is a program that
pretends to be a harmless program (like a game) but it is designed
to do something harmful like erasing a disk. Some Trojan Horses also
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 75
install viruses on your system. Do not execute the program, but
delete it instead.
[Name of file] damaged by [name of virus].
Unlike an infected file, which carries the virus itself, a damaged
file has only been damaged by the virus.
[Name of file] dropper of [name of virus].
A "dropper" is a program that has not been infected itself, but
which does contain a boot sector virus and is able to install it
into your boot sector.
[Name of file] garbage: (not a virus) [name of garbage].
A "garbage" program is a file that does not work because it is badly
damaged or may have been overwritten with "garbage." Some virus
collections (i.e. a CD-ROM based virus collection) contain
"garbage-like" program code that was designed specifically to
trigger virus detection programs (and fool them), which is exactly
why ThunderBYTE identifies them as "garbage."
It is also possible for TbScan to encounter a file that appears infected
by a virus, although it could not find a signature. In this case TbScan
displays the prefix "Probably" before the message.
If TbScan finds a file to be suspicious and displays a virus alert
window, you can avoid future false alarms by pressing V (Validate
program). Note that this works only if there is an ANTI-VIR.DAT record of
the file available. Once TbScan validates a program, the program is no
longer subject to heuristic analysis, unless the program changes and no
longer matches the ANTI-VIR.DAT record. This will be the case if such a
file becomes infected at a later time. In such a case, TbScan still
reports infections on these files.
NOTE:
Be aware that a validated program is still subject to the
conventional signature scanning.
If you specify the HEURISTIC or the HIGH HEURISTIC SENSITIVITY option, it
is likely that TbScan will find some files that look like a virus. In
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 76
this case, TbScan uses the prefix "Might be" to inform you about it. So,
if TbScan displays:
[Name of file] Probably infected by an unknown virus
or:
[Name of file] Might be infected by an unknown virus
it does not necessarily mean that the file is infected. There are a
lot of files that look like a virus but are not.
It is extremely important to understand that false alarms are part of the
nature of heuristic scanning. In its default mode, it is very unlikely
that TbScan will issue a false alarm. If you specify the HEURISTIC
option, however, some false alarms might occur.
How should you deal with false alarms? If TbScan thinks it has found a
virus, it tells you the reason for this suspicion. In most cases you will
be able to evaluate these reasons when you consider the purpose of the
suspected file.
NOTE:
Viruses infect other programs. It is, therefore, unlikely that you
will find only a few infected files on a hard disk you use
frequently. You should ignore the result of a heuristic scan if only
a few programs on your hard disk trigger it. If, on the other hand,
your system behaves "strangely" and several programs trigger the
TbScan alarm with the same serious flags, your system
could very well be infected by a (yet unknown) virus.
3.2.5 Understanding Heuristic Flags
Heuristic flags consist of single characters that appear behind the name
of the file that just scanned. There are two kinds of flags: the
informative ones, which appear in lower-case characters, and the more
serious flags, which appear in upper-case characters.
The lower-case flags indicate special characteristics of the file being
scanned, whereas the upper-case warnings might indicate a virus. If the
loglevel is 3 or above, the important warnings not only appear as a
warning character, but TbScan also adds a description to the log file.
How should you treat the flags? You can consider the less important
lower-case flags to be informational only; they provide file information
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 77
you might find interesting. The more serious uppercase warning flags
MIGHT (we repeat, MIGHT) indicate a virus. It is quite normal that you
have some files in your system that trigger an uppercase flag.
NOTE:
Appendix B lists the heuristic flag descriptions.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 78
3.3 Using TbDriver
TbDriver is a small memory-resident (TSR) program that you must load
before any of the other TBAV memory-resident utilities. This brief
section explains the use of TbDriver.
3.3.1 Understanding TbDriver
By itself, TbDriver does not provide much protection against viruses,
rather its use is to enable the memory resident ThunderBYTE Anti-Virus
utilities, such as TbScanX, TbCheck, TbMem, TbFile, and TbDisk, to
perform properly. It is the source for some of the routines these
utilities have in common, including: support to generate the pop-up
window routines, driving the translation unit that enables the
possibility of displaying messages in your native language, and support
for networks. Additionally, TbDriver also contains basic protection
against "stealth" viruses and against "ANSI bombs."
NOTE:
See the NOFILTER option below for an explanation of an ANSI bomb.
3.3.2 Working with TbDriver
You must load TbDriver before loading any of the other memory-resident
TBAV utilities. If you ran the TBAV Install program, TbDriver is already
set up to load automatically when you boot. Your AUTOEXEC.BAT file calls
the TBSTART.BAT file, which in turn loads TbDriver.
If you prefer, you can load TbDriver directly from the command line or
from an individual line in AUTOEXEC.BAT by using this command:
<PATH>TBDRIVER
If TbDriver resides in the TBAV directory on drive C:, for example, you
could enter C:\TBAV\TBDRIVER.
An even more secure way to load TbDriver, and the other TBAV
memory-resident utilities (which we ll examine in more detail in the
Using TbScanX section later in this chapter), is to load it via the
CONFIG.SYS file. After removing the call to TBSTART.BAT in AUTOEXEC.BAT,
you could put the following command in CONFIG.SYS:
DEVICE=<PATH>TBDRIVER.EXE
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 79
If TbDriver resides in the TBAV directory on drive C:, for example, you
could enter DEVICE=C:\TBAV\TBDRIVER.EXE.
TIP:
If you want protection against ANSI-bombs, you should load TbDriver
AFTER the ANSI.SYS driver. Also, if you install TbDriver on a
machine that boots from a boot ROM, specify the message file with
the drive and path where it resides AFTER the machine boots. The
default message file will no longer be accessible after the machine
boots.
3.3.3 Maximizing TbDriver
This section describes how to use TbDriver's option to maximize its
performance and how to get foreign language support for the TBAV
utilities.
When you run TbDriver from the DOS command line, it recognizes command
line options (often called "switches" in DOS terms). These options appear
as "key-words" or "key-letters." The words are easier to memorize, so we
will use these in this manual for convenience.
TbDriver enables you to specify loading options on the command line. It
treats a filename specification as a language file specification (see the
following "Getting Language Support" section).
The first three options in the following table are always available. The
other options are available only if TbDriver is not already memory
resident. The command-line syntax is as follows:
TBDRIVER [<PATH>][<FILENAME>]... [<OPTIONS>]...
TbDriver recognizes the following options:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 80
option parameter short explanation
------------------ ----- -----------
help ? help
net n force LAN support
remove r remove TbDriver from memory
mode=<m|c> m override video mode (mono|color)
freeze j freeze the machine after an alert
lcd l enhance output on LCD screens
noavok=<drives> o assume permission for specified drives when
ANTI-VIR.DAT record is missing
quiet q do not display activity
secure s do not allow permission updates
notunnel t do not detect tunneling
nofilter f do not filter dangerous ANSI codes
nostack ns do not install a stack
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBDRIVER ?.
help (?).
If you specify this option, TbDriver shows you the valid command
line options as listed above.
net (n).
TbDriver cooperates well with most networks. In normal situations
you will not need the NET option at all. You should use it only if
both the following conditions are true at the same time:
1. You make a connection to a Novell network and TBDRIVER.EXE
before using the logon command.
2. There is no valid ANTI-VIR.DAT record in the directory where
the NET?.COM program resides or after renaming the NET?.COM
file.
remove (r).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 81
This option disables TbDriver and attempts to remove the resident
part of its code from memory and return this memory space to the
system.
Unfortunately, this works only if you loaded TbDriver last. An
attempt to remove a TSR after you load another TSR leaves a useless
gap in memory and could disrupt the interrupt chain. TbDriver checks
whether it is safe to remove its resident code; if not, it simply
disables itself.
mode (m).
On dual video systems TbDriver uses the currently active screen. It
might be forced to use the alternate screen with the MODE=M option
for monochrome or the MODE=C option for color systems.
lcd (l).
This option enhances the output on LCD screens.
freeze (f).
This option freezes the computer when there is a virus alert.
noavok (o).
We don't recommend this option for normal use. You might need it to
grant permission automatically for programs without an ANTI-VIR.DAT
record. The option requires a parameter specifying the drives to
which the default permission applies. If, for example, you do not
want TbMem to display a message when a TSR without ANTI-VIR.DAT
executes from drive E: and F:, you could specify NOAVOK=EF on the
TbDriver command line. Additionally, if you want to exclude network
drives, you should use an asterisk [*]. For example, if you want to
grant permission for all files without ANTI-VIR.DAT records on drive
A:, your ram disk F: and your remote network drives, specify
NOAVOK=AF*.
quiet (q).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 82
Some resident TBAV utilities display an activity status. TbScanX,
for instance, displays a rectangle with the word Scanning in the
upper left corner of your screen while scanning a file. The QUIET
option disables this message.
secure (s).
Some ThunderBYTE utilities can store permission flags in the
ANTI-VIR.DAT files. You can use this option if you don't want these
flags changed. It has no effect on flags already set, so you can use
the option after installing new programs or packages.
notunnel (t).
"Tunneling" is a technique viruses apply to determine the location
of the DOS system code in memory, and to use that address to
communicate with DOS directly. This inactivates all TSR programs,
including resident anti-virus software. TbDriver is able to detect
these tunneling attempts, and informs you about it. Some other
anti-virus products also rely on tunneling techniques to bypass
resident viruses, thereby causing false alarms. If you are currently
executing other anti-viral products, the NOTUNNEL option disables
TbDriver's tunneling detection.
nofilter (f).
The original ANSI driver has a feature to assign text strings to
keys. Years ago people used this feature, for example, to assign the
DIR /W command to the F10 key. Such reprogramming can be done simply
by embedded ANSI codes in batch files. Almost no one uses this
feature nowadays. Some misguided people, however, use this feature,
for example, to make a text file that reprograms the Enter key to
execute the DEL *.* command or something even worse. Such a file is
an "ANSI-bomb." TbDriver protects you against ANSI-bombs by
filtering out the keyboard reprogramming codes. All other ANSI codes
pass without interference. If you don't want this protection, or if
you want to use this obsolete ANSI feature, you can use the NOFILTER
option.
nostack (ns).
By default, TbDriver maintains a stack for the resident TBAV
utilities. For most systems, however, this isn't necessary. If you
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 83
use this option, TbDriver uses the application stack, saving a few
hundred bytes of memory. If the system hangs or becomes unstable,
however, discontinue use of this option.
You can use the optional filename specification to direct TbDriver to the
location of the language file you want to use. TbDriver retrieves pop-up
window messages from a TBDRIVER.LNG file, which it expects to find in its
own home directory. The default English language file is TBDRIVER.LNG,
which you can replace with a file in your local language. You can order
separate language support packages at your local ThunderBYTE dealer, or
download the language file from a ThunderBYTE support BBS. See the
Maintaining the System section in Chapter 1 for more information about
the ThunderBYTE support BBS.
To load a language file, either rename it to the default (TBDRIVER.LNG),
or specify the full path and filename following the command. You can also
switch to another language by calling TbDriver again with a different
message file. This will not take up any extra memory.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 84
3.4 Using TbScanX
TbScanX is virtually identical to TbScan, with one important difference:
TbScan is memory-resident. This section describes TbScanX in detail.
3.4.1 Understanding TbScanX
To implement real-time or on-the-fly virus protection, the TBAV for DOS
utilities include the TbScanX program, a memory-resident (TSR) program
that tracks all file operations. If you copy an infected file from a
diskette to your hard disk, for example, TbScanX recognizes the virus
hidden in the file and informs you about it, BEFORE the virus becomes
active.
Why use TbScanX? Let's assume you have a virus scanner that automatically
runs from your AUTOEXEC.BAT file. If it doesn't find any viruses, your
system should be uninfected. Right? Not necessarily. To be sure that no
virus infects your system, you need to execute the scanner every time you
copy a file to your hard disk, after downloading a file from a bulletin
board system, or after unarchiving an archive such as a ZIP file. Now be
honest, do YOU invoke your scanner every time you introduce a new file
into the system? If you don t, you take the risk that within a couple of
hours all files will become infected by a virus.
Once you load TbScanX, it remains resident in memory and automatically
scans all files you execute and all executable files you copy, create,
download, modify, or unarchive. It uses the same approach to protect
against boot sector viruses; every time you put a diskette into a drive,
TbScanX scans the boot sector. If the disk is contaminated with a boot
sector virus, TbScanX warns you in time!
NOTE:
TbScanX is fully network compatible. It does not require you to
reload the scanner after logging onto the network.
3.4.2 Working with TbScanX
Since TbScanX is memory resident, you can execute and configure the
program from the command line or from within a batch file. It is
important to load TbScanX as early as possible after the machine boots.
We therefore recommend that you execute TbScanX from within the
CONFIG.SYS file.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 85
CAUTION:
TbScanX requires that you load TbDriver first! See the previous
section on "Using TbDriver" for details.
There are three possible ways to load TbScanX:
1. From the DOS prompt or within the AUTOEXEC.BAT file:
<PATH>TBSCANX
2. From the CONFIG.SYS files as a TSR (DOS 4+ and above):
INSTALL=<PATH>TBSCANX.EXE
The INSTALL= CONFIG.SYS command is NOT available in DOS 3.xx.
3. From the CONFIG.SYS as a device driver:
DEVICE=<PATH>TBSCANX.EXE
NOTE:
Using TbScanX as a device driver does not work in all OEM
versions of DOS. If it does not work, use the INSTALL= command
or load TbScanX from within the AUTOEXEC.BAT. TbScanX should
always work correctly if you run it from AUTOEXEC.BAT.
Unlike other anti-virus products, you can load the ThunderBYTE Anti-Virus
Utilities before starting a network without losing the protection
afterwards.
In addition to the three loading possibilities, you can also load TbScanX
into an available UMB (upper memory block) if you are using DOS version 5
or higher. To accomplish this from AUTOEXEC.BAT, use the following
command:
LOADHIGH <PATH>TBSCANX
Alternately, to accomplish this from CONFIG.SYS, use the following
command:
DEVICEHIGH=<PATH>TBSCANX.EXE
If you are using Microsoft Windows, you should load TbScanX BEFORE
starting Windows. When you do this, there is only one copy of TbScanX in
memory regardless of how many DOS windows you might open. Every DOS
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 86
window (that is, every virtual machine ) has a fully functional copy of
TbScanX running in it.
TbScanX automatically detects if Windows is running, and switches itself
in multitasking mode if necessary. You can even disable TbScanX in one
window without affecting the functionality in another window.
NOTE:
TBAV for Windows includes a full-featured resident scanner. Please
refer to the TBAV for Windows documentation for more information.
3.4.3 Maximizing TbScanX
When you run TbScanX from the DOS command line, it recognizes command
line options (often called "switches" in DOS terms). These options appear
as "key-words" or "key-letters." The words are easier to memorize, so we
will use these in this manual for convenience.
You can maximize TbScanX's performance by using one or more command line
options. The first four options in the following table are always
available. The other options are available only if TbScanX is not already
resident in memory.
option parameter short explanation
------------------ ----- ----------------------------------------
help ? display on-line help
off d disable scanning
on e enable scanning
remove r remove TbScanX from memory
noexec n never scan at execute
allexec[=<drives>] a always scan at execute
noboot b do not scan boot sectors
wild w only search viruses which appear "in the
wild"
ems me use expanded memory (EMS)
xms mx use extended memory (XMS)
secure s deny all suspicious operations
lock l lock PC when a virus is detected
api i load TbScanX's Application Program
Interface
compat c increase compatibility
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 87
TIP:
Remember that you can display these options from the command line by
entering TBSCANX ?.
help (?).
This option displays the command line options as shown above. Once
you load TbScanX, however, this option does not display all the
options.
off (d).
This option disables TbScanX, but leaves it in memory.
on (e).
This option re-enables TbScanX after you disable it with the OFF
option.
remove (r).
This option disables TbScanX and attempts to remove the resident
part of its code from memory and return this memory space to the
system. Unfortunately, this works only if you loaded TbScanX last.
An attempt to remove a TSR after you load another TSR leaves a
useless gap in memory and could disrupt the interrupt chain. TbScanX
checks whether it is safe to remove its resident code; if not, it
simply disables itself.
noexec (n).
TbScanX normally scans files located on removable media just before
they execute. You can use this option to disable this feature
completely.
allexec (a).
TbScanX normally scans executable files only if they reside on
removable media. It "trusts" files on the hard disk, since these
files must have been copied or downloaded before, and since by this
time TbScanX has already scanned them automatically. If you want to
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 88
scan every file before it executes, however, regardless of whether
it is on the hard disk or removable media, you should use this
option. It is possible to explicitly specify drives from which you
want executed files to be scanned. For example, if you specify
option ALLEXEC=DF, then TbScanX will only scan files being executed
that reside on either drive D: or drive F:.
noboot (b).
TbScanX automatically monitors the disk system. Every time DOS reads
the boot sector, TbScanX scans the disk for boot sector viruses. If
you change a disk, DOS first reads the boot sector; otherwise it
does not know what kind of disk is in the drive. As soon as DOS
reads the boot sector, TbScanX checks it for viruses. If you don't
like this feature, or if it causes problems, you can switch it off
using the NOBOOT option.
wild (w).
TbScanX can distinguish viruses that do not appear "in the wild"
from frequently appearing viruses. In order to reduce the memory
requirements of TbScanX, you can specify option WILD, which makes
TbScanX load and use the viruses signatures from viruses that
frequently appear "in the wild." This option is disabled by default.
ems (me).
If you specify this option, TbScanX uses expanded memory (such as
that provided by the LIM/EMS expansion boards or 80386 memory
managers) to store the signatures and part of its program code.
Since conventional memory is more valuable to your programs than
expanded memory, we recommend the use of EMS memory. TbScanX can use
up to 64Kb of EMS memory. (Refer to the XMS option also.)
xms (mx).
If you specify this option TbScanX uses extended memory to store the
signatures and part of its program code. An XMS driver (such as
DOS's HIMEM.SYS) must be installed to be able to use this option.
XMS memory is not directly accessible from within DOS, so every time
TbScanX has to scan data it has to copy the signatures to
conventional memory. To be able to save the original memory
contents, TbScanX needs a double amount of XMS memory. Swapping to
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 89
XMS is slower than swapping to EMS memory, so if you have EMS memory
available, we recommend swapping to EMS. Swapping to XMS might
conflict with some other software, so if you experience problems try
using TbScanX without the XMS option.
secure (s).
TbScanX normally asks you to continue or to cancel when it detects a
virus. In some business environments, however, employees should not
make this choice. By using the SECURE option, you can disallow
suspicious operations.
NOTE:
This option also disables the OFF and REMOVE options.
lock (l).
If you are a system operator, you can use this option to instruct
TbScanX to lock the system when it detects a virus.
api (i).
This option is for advanced users only. It enables TbScanX's
Application Program Interface (API), which is necessary if you want
to call TbScanX from within your application. Consult the
ADDENDUM.DOC file for detailed programming information.
compat (c).
In most systems TbScanX performs trouble free. Another TSR program,
however, might conflict with TbScanX. If you load the other TSR
first, TbScanX normally detects the conflict and uses an alternate
interrupt. If, on the other hand, you load the other TSR after
TbScanX, and it aborts with a message telling you that it is already
loaded, you can use the COMPAT switch of TbScanX (when installing it
in memory). It is also possible for TbScanX to conflict with other
resident software that is using EMS or XMS. In this case, the system
will hang. Again, the COMPAT option solves this problem, but be
aware that due to extensive memory swapping, TbScanX's performance
will slow down.
TIP:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 90
If you are using DOS version 5 or above and have extended
memory (XMS) on your system, you can use EMM386.SYS to treat a
portion or extended memory as expanded memory (EMS). See your
DOS manual for details.
Here is one example of loading TbScanX:
DEVICE=C:\TBAV\TBSCANX.EXE XMS NOBOOT
In this example, the memory resident portion of TbScanX loads into
extended memory (XMS) and will not scan boot sectors for viruses.
3.4.4 Understanding the Scanning Process
This section adds to your knowledge of TbScanX by explaining a little
more about the scanning process.
Whenever a program tries to write to an executable file (files with the
extensions .COM and .EXE), you will briefly see the text "*Scanning*" in
the upper left corner of your screen. As long as TbScanX is scanning,
this text appears. Since TbScanX takes very little time to scan a file,
the message appears very briefly. The text "*Scanning*" also appears if
you execute a program directly from a diskette, and if DOS accesses the
boot sector of a diskette drive.
If TbScanX detects a suspicious signature that is about to be written
into a file, a window appears similar to the one displayed below:
+---------TBAV interception---------+
| WARNING! |
| TbScanX detected that COMMAND.COM |
| is infected with |
| Yankee_Doodle {1} |
| Abort? (Y/N) |
+-----------------------------------+
Whenever this message appears, you should press N to continue, or any
other key to abort. If TbScanX detects a suspicious signature in a boot
sector, it displays a message like the following:
+------------TBAV interception-----------+
| WARNING! |
| TbScanX detected that the bootsector |
| of disk in drive A: is infected with |
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 91
| Form |
| Do NOT attempt to boot with that disk! |
+----------------------------------------+
Although a virus seems to be in the boot sector of the specified drive,
the virus cannot do anything since it has not yet executed. If you reboot
the machine with the contaminated diskette in the drive, however, the
virus copies itself into memory and onto your hard disk.
NOTE:
To display the name of a virus, TbScanX needs access to the virus
signature file (TBSCAN.SIG). If for any reason TbScanX cannot access
this file, it still detects viruses, but no longer displays the name
of the virus. It displays "[Name unknown]" instead.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 92
3.5 Using TbCheck
This section describes another one of TBAV's memory resident (TSR)
utilities, TbCheck.
3.5.1 Understanding TbCheck
TbCheck is a memory-resident integrity checker that comes into action
whenever the system is about to execute a file. It uses the ANTI-VIR.DAT
records TbSetup generates to detect file changes, which is often the
first sign of a virus infection. These records contain information, such
as file sizes and checksums, of every executable file in a directory. By
comparing this information with the actual file status, it is possible to
detect automatically any changes, including infections caused by viruses.
Assume your AUTOEXEC.BAT file automatically loads a conventional
integrity checker. If no files appear changed, your system should be
uninfected, but to be sure that no virus can infect your system, you have
to execute the checker frequently. In contrast, once you load TbCheck, it
remains resident in memory, and automatically checks all programs you try
to execute.
NOTE:
TbCheck is fully network compatible. It does not require you to
reload the checker after you are logged onto the network.
3.5.2 Working with TbCheck
Since TbCheck is a memory resident program, you can execute and configure
it from the DOS command line or from within a batch file. You should,
however, load TbCheck automatically when the computer boots, preferably
during the execution of AUTOEXEC.BAT, or better yet, CONFIG.SYS.
CAUTION:
Be sure to load TbDriver before trying to load TbCheck. TbCheck will
refuse to load without it.
There are three possible ways to start TbCheck:
1. From the DOS prompt or within the AUTOEXEC.BAT file:
<PATH>TBCHECK
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 93
2. From CONFIG.SYS as a TSR (DOS 4 or above):
INSTALL=<PATH>TBCHECK.EXE
The INSTALL= CONFIG.SYS command is NOT available in DOS 3.xx.
3. From CONFIG.SYS as a device driver:
DEVICE=<PATH>TBCHECK.EXE
NOTE:
Executing TbCheck as a device driver does not work in all OEM
versions of DOS. If it doesn't work, use the INSTALL= command
or load TbCheck from AUTOEXEC.BAT. TbCheck should always work
correctly if you load it from AUTOEXEC.BAT. Also, unlike other
anti-virus products, you can load the ThunderBYTE Anti-Virus
utilities before starting a network without losing the
protection after the network is started.
In addition to the three loading possibilities, if you are using DOS
version 5 or above, you can load TbCheck into an available UMB (upper
memory block) from AUTOEXEC.BAT using this command:
LOADHIGH <PATH>TBCHECK
You can also load TbCheck into high memory from within the CONFIG.SYS
using this command:
DEVICEHIGH=<PATH>TBCHECK.EXE
If you are using Microsoft Windows, you should load TbCheck BEFORE
starting Windows. When you do this, there is only one copy of TbCheck in
memory regardless of how many DOS windows you might open. Every DOS
window (that is, every virtual machine ) has a fully functional copy of
TbCheck running in it.
TbCheck automatically detects if Windows is running, and switches itself
into multi-tasking mode if necessary. You can even disable TbCheck in one
window without effecting the functionality in another window.
NOTE:
TBAV for Windows comes with a full-fledges Windows-based version of
TbCheck. Please refer to the documentation of TBAV for Windows for
more information.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 94
3.5.3 Maximizing TbCheck
When you run TbCheck from the DOS command line, it recognizes command
line options (often called "switches" in DOS terms). These options appear
as "key-words" or "key-letters." The words are easier to memorize, so we
will use these in this manual for convenience.
You can maximize TbCheck's performance by using it's various options. The
first four options in the following table are always available. The other
options are available only if TbCheck is not yet memory resident.
option parameter short explanation
----------------- ----- ----------------------------------------
help ? display on-line help
remove r remove TbCheck from memory
off d disable checking
on e enable checking
noavok [=<drives>] o do not warn for missing ANTI-VIR.DAT record
fullcrc f calculate full CRC (slow!)
secure s do not execute unauthorized files
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBCHECK ?.
help (?).
Specifying this option displays the above options list.
remove (r).
This option disables TbCheck and attempts to remove the resident
part of its code from memory and return this memory space to the
system. Unfortunately, this works only if you loaded TbCheck last.
An attempt to remove a TSR after you load another TSR leaves a
useless gap in memory and could disrupt the interrupt chain. TbCheck
checks whether it is safe to remove its resident code; if not, it
simply disables itself.
off (d).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 95
This option disables TbCheck, but leaves it in memory.
on (e).
This re-enables TbCheck after having been disabled with the OFF
option.
noavok (o).
TbCheck looks in the ANTI-VIR.DAT file for checksum information on
the file you want to check. TbCheck displays a message if it finds
no checksum information or if the specific checksum is incorrect.
This ensures that you will receive a warning whenever a malicious
program deletes the ANTI-VIR.DAT file. Although we recommend that
you maintain ANTI-VIR.DAT files on all drives, this might not always
be practical with floppy disks, RAM disks, or CD-ROM disks. This
option, therefore, tells TbCheck not to look for an ANTI-VIR.DAT on
specific drives. For example, if you don't want TbCheck to alert you
about the absence of an ANTI-VIR.DAT record on floppy disks A: and
B: or on your RAM disk E:, you should load TbCheck using the
following command line:
<PATH>TBCHECK NOAVOK=ABE
If you don't want a message when an ANTI-VIR.DAT record is missing
on network drives, you should specify an asterisk (*) instead of a
drive letter. If you don't specify a drive to the NOAVOK option,
TbCheck never issues a warning if an ANTI-VIR.DAT record is missing
on any drive.
CAUTION:
This presents a security hole for viruses: by deleting the
ANTI-VIR.DAT file you will not be able to detect file changes
caused by a viral infection. Also, please note that the NOAVOK
option does not prevent the detection of infected programs if
the ANTI-VIR record is available. If a program has changed and
the ANTI-VIR record is available, you will still get an alarm
regardless of how you implement the NOAVOK option.
fullcrc (f).
By default, TbCheck verifies only that part of the file near the
program's entry point. If a virus infects the file, this area will
definitely change, so this is perfectly adequate to detect all
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 96
infections. Other file changes, notably configuration variations,
will not trigger the alarm. If, however, you should ever desire a
full check that detects ANY file changes, this option takes care of
it. Be aware that this option slows down the system considerably, so
we don't recommend its use in normal circumstances.
secure (s).
TbCheck normally asks whether you want to continue or cancel when a
file has been changed or when there is no checksum information
available. In a business environment it may be unwise to leave such
decisions to employees. Option SECURE makes it impossible to execute
new or unknown programs, or programs that have been changed.
NOTE:
Be aware that the SECURE option also disables the OFF and
REMOVE options.
3.5.4 Understanding the Scanning Process
This section adds to your knowledge of TbCheck by explaining a little
more about the scanning process.
Whenever a program wants to execute, TbCheck steps in to see if it really
has the authority to do so. During that time it displays the message
"*Checking*" in the upper left hand corner of the screen. TbCheck
operates at lightning speed, so the message appears only momentarily.
TbCheck quickly checks a program when the program loads. If TbCheck
detects that a file has changed, a notification message appears. At this
point, you can choose to either continue, or to abort the program's
execution.
If there is no information in the ANTI-VIR.DAT file about the program,
TbCheck also informs you of this. You can either choose to continue
without checking, or to abort the program's execution.
TIP:
You can prevent users from executing unauthorized software by using
the SECURE option.
3.5.5 Testing TbCheck
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 97
Understandably, many users wish to test the product they are using. In
contrast to a word processor, for example, it is very difficult to test a
smart integrity checker like TbCheck. You cannot change a random 25 bytes
of an executable file just to find out whether TbCheck detects the file
change. On the contrary, it is very likely that TbCheck will NOT detect
it because the program checks only the entry area of the file, whereas
the changed bytes might reside in another location within the file. But
again, if a virus infects the file, this entry area will definitely
change, so this is perfectly adequate to detect all infections.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 98
3.6 Using TbClean
In case a virus infects one or more files, and you wish to remove the
virus from those files (for example, in case you do not have a clean
backup of the files), you can use TbClean. TbClean is the program that
can remove viruses from infected files, even without knowing the virus
itself. This section explores TbClean.
3.6.1 Understanding TbClean
TbClean isolates viral code in an infected program and removes it. It is
then safe to use the program again, since TbClean securely eliminates the
risk of other files becoming infected or damaged.
Understanding the Repair Cleaner
TbClean works differently from conventional virus cleaners because it
does not actually recognize any specific virus. TbClean's disinfection
scheme is unique, employing ThunderBYTE's heuristic ( learn as you go )
technology so that it works with almost any virus.
Actually, the TbClean program contains two cleaners: a "repair" cleaner,
and a "heuristic" cleaner. The repair cleaner needs an ANTI-VIR.DAT file
generated by the TbSetup program before the infection occured. This
ANTI-VIR.DAT file contains essential information such as the original
file size, the bytes at the beginning of the program, a cryptographic
checksum to verify the results, etc. This information enables TbClean to
disinfect almost every file, regardless of the specific virus that has
infected it, even if it is unknown.
Understanding the Heuristic Cleaner
In the heuristic cleaning mode TbClean does not need any information
about viruses either, but it has the added advantage that it does not
even care about the original, uninfected state of a program. This
cleaning mode is very effective if your system becomes infected with an
unknown virus and you neglected to let TbSetup generate the ANTI-VIR.DAT
files in time.
In the heuristic mode, TbClean loads the infected file and starts
emulating the program code to find out which part of the file belongs to
the original program and which belongs to the virus. The result is
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 99
successful if TbClean restores the functionality of the original program,
and reduces the functionality of the virus to zero.
NOTE:
This does not imply that the cleaned file is 100% equal to the
original. Please read on.
When TbClean uses heuristic cleaning to disinfect a program, the file
most likely will not be exactly the same as in its original state. This
does not imply a failure on TbClean s part, nor does it mean the file is
still infected in some way.
It is actually normal that the heuristically cleaned file is still larger
than the original. This is normal because TbClean tries to be on the safe
side and avoids removing too much. The bytes left at the end of the file
are dead code, that is, instructions that will never execute again
since TbClean removes the jump at the beginning of the program. If the
cleaned file is an EXE type file, it is likely that some bytes in front
of the program (the EXE-header ) are different. There are several
suitable solutions for reconstructing the EXE-header, so TbClean
cannot, of course, know the original state of the program. The
functionality of the cleaned file will nevertheless be the same.
NOTE:
This applies only to heuristic cleaning. If there is a suitable
ANTI-VIR.DAT record available, the cleaned program will normally be
exactly the same as the original clean file.
It's also possible for a virus to infect a file with multiple viruses, or
multiple instances of the same virus. Some viruses keep on infecting
files, and in such cases the number of infected files keeps growing. If
TbClean used its heuristic cleaning mode, it is very likely that TbClean
removed only one instance of the virus. In this case, it is necessary to
repeat the cleaning process until TbClean reports that it cannot remove
anything else.
3.6.2 Working with the TbClean Menus
Selecting TbClean from TBAV's Main Menu displays the following menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 100
+-----Main menu-----+
| Confi+------TbClean men-------+
| TbSca| Start cleaning |
| TbSet| List file name |
| TbUti| Use TBAV. INI file |
| TbCLe| Prompt for pause |
| Virus|v Use Anti-Vir.Dat |
| TBAV |v Use Heuristics |
| Docum|v Expanded memory |
| Regis| Display program loops |
| About| Make list file |
| Quit +------------------------+
| eXit (no save) |
+-------------------+
We'll now explore these menu options.
The "Start Cleaning" Option
After tracking one or more viruses, all you should do is select the
Start cleaning option. After specifying the relevant filename, TbClean
goes into action. Before beginning, however, you can select various
parameters. We will explore these in the following sections.
The "List File Name" Option
By selecting this option you can specify a filename to use as a list file
(see also the Make list file option below).
The "Use TBAV.INI File" Option
If you enable this option, the TbClean configuration values, saved in the
TBAV.INI file, will also be valid if you run TbClean from the DOS command
line. Be careful, however, since if you specify options in the TBAV.INI
file, you cannot undo them on the command line. See the "Configuring
TBAV" section of Chapter 1 for details about TBAV.INI.
The "Prompt For Pause" Option
This option instructs TbClean to stop disassembling information after
each full screen, enabling you to examine the results.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 101
The "Use ANTI-VIR.DAT" Option
If you turn this option off, TbClean acts as if there were no
ANTI-VIR.DAT records available and therefore performs heuristic cleaning.
The "Use Heuristics" Option
If you turn this option off, TbClean does not try to apply heuristic
cleaning, even when there are no ANTI-VIR.DAT records available.
The "Expanded Memory" Option
If you select this option, TbClean detects the presence of expanded
memory and uses it in heuristic mode. You might want to disable EMS usage
if it is too slow or if your expanded memory manager is not very stable.
The "Show Program Loops" Option
By default TbClean keeps track of looping conditions to prevent
repetitive data from appearing on your screen thousands of times. If you
select this option, TbClean "works out" every loop.
CAUTION:
Using this option drastically reduces TbClean's performance speed.
Also, do not combine this option with the "Make list file" option,
because the list file might grow too big
The "Make List File" Option
Selecting this option instructs TbClean to generate an output file with a
chronological disassembly of the virus being removed.
Maximizing TbClean
Now that you know how to use TbClean's menus, you can more easily
understand the power of using it from the command line.
3.6.3 Using TbClean Command Line Options
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 102
When you run TbClean from the DOS command line, it recognizes command
line options (often called "switches" in DOS terms). These options appear
as "key-words" or "key-letters." The words are easier to memorize, so we
will use these in this manual for convenience.
You can maximize TbClean's performance by using its command line options.
The following table lists these options:
option parameter short explanation
------------------ ----- ----------------------------------
help he display on-line help
pause pa enable pause prompt
mono mo force monochrome display output
noav na do not use ANTI-VIR.DAT records
noheur nh do not use heuristic cleaning
noems ne do not use expanded memory
showloop sl show every loop iteration (slow!)
list[=<filename>] li create list file
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBCLEAN ?.
help (he).
Specifying this option displays the above options list.
pause (pa).
This option instructs TbClean to stop disassembling information
after each full screen, enabling you to examine the results. The
PAUSE option is available for registered users only.
mono (mo).
This option enhances the screen output on some LCD screens or
color-emulating monochrome systems.
noav (na).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 103
If you specify this option, TbClean acts as if there were no
ANTI-VIR.DAT records available and therefore performs heuristic
cleaning.
noheur (nh).
If you specify this option, TbClean does not try to apply heuristic
cleaning, even when there are no ANTI-VIR.DAT records available.
noems (ne).
If you specify this option, TbClean does not detect the presence of
expanded memory and use it in heuristic mode. You might want to
disable EMS use if it is too slow, or if your expanded memory
manager is not very stable.
showloop (sl).
By default TbClean keeps track of looping conditions to prevent
repetitive data from appearing on your screen thousands of times. If
you select this option, TbClean "works out" every loop.
CAUTION:
Using this option drastically reduces TbClean's performance
speed. Also, do not combine this option with the "Make list
file" option, because the list file might grow too big
list [=<filename>] (li).
This option instructs TbClean to generate an output file with a
chronological disassembly of the virus being removed. The LIST
option is available for registered users only.
Here are two examples of using TbClean from the command line:
1. This command:
TBCLEAN VIRUS.EXE
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 104
instructs TbClean to make a backup of the file VIRUS.EXE using the
name filename VIRUS.VIR, and then disinfect VIRUS.EXE.
2. This command:
TBCLEAN VIRUS.EXE TEST.EXE
instructs TbClean to copy the file called VIRUS.EXE to the new
filename TEST.EXE and then disinfect TEST.EXE.
3.6.4 Understanding the Cleaning Process
TbClean's cleaning process is extremely important. To better illustrate
it, let's look at a sample file cleaning.
Assume you want to clean a file called COMMAND.COM, which resides in the
TMP directory on drive G. To do so, you would follow these steps:
1. Select the "Start cleaning" option on the TBAV menu. The following
window appears:
+-------------------------------------------------------------------+
| |
|Enter name of program to clean. TbClean will create a backup first!|
| |
| |
+-------------------------------------------------------------------+
The ThunderBYTE utility cleans on a file-by-file approach; that is, it
cleans one file, verifies the result, and continues on to the next file.
This helps you keep track of which file is clean, which file is damaged
and should be restored from a backup, and which file is still infected.
2. Specify the name of the file. In this case, you would type
G:\TMP\COMMAND.COM and press ENTER. The following window appears:
+-------------------------------------------------------------------+
| |
| Enter name of cleaned file. Keep blank if infected program may be | |
changed. |
| |
| |
+-------------------------------------------------------------------+
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 105
3. Type a new file name and press ENTER. In this case, we'll use
G:\TMP\TEST.EXE. TbClean now begins the cleaning process.
By specifying a different name you ensure that the cleaned file cannot
overwrite the original file. In this example TbClean copies COMMAND.COM
to TEST.COM and disinfects TEST.COM.
If you do not specify a backup filename, TbClean creates a backup with
the .VIR extension. In this example, the TbClean would copy the original
file to COMMAND.VIR and then clean COMMAND.COM.
During the cleaning process, TbClean displays as much information as
possible about the current operation, as illustrated below. All the major
actions appear in the emulation window at the lower half of the screen,
which displays a disassembly and the register contents of the program
under scrutiny, as well as a progress report. The top-left and top-right
status windows reveal useful details of the infected file and (if TbClean
can find a suitable ANTI-VIR.DAT file) the file's original status. You
can abort the cleaning process by pressing Ctrl+Break.
+-----------------------------------------------------------------+
| Thunderbyte clean utility (C) 1992-95 Thunderbyte B.V. |
+---------Infected state----------++---------Original state-------+
| Entry point (CS:IP) 34BF:0012 || Entry point (CS:IP) 34BF:0012|
| File length || File length UNKNOWN! |
| Cryptographic CRC 9F90F52A || Cryptographic CRC UNKNOWN! |
+---------------------------------++------------------------------+
| |
| Starting clean attempt. Analyzing infected file... |
| Anti-Vir not found: original state unknown. Trying emulation... |
| Emulation terminated: |
| |
| G:\VIRUS\COMMAND.COM |
| CS:IP Instruction AX BX CX DX DS SI ES DI SS SP |
| 9330:0101 mov ah,40 FFFE9330FFFFEFFFD382FFEDEFFEFFFF9520007E|
| 9330:0103 mov bx,0002 40FE9330FFFFEFFFD382FFEDEFFEFFFF9520007E|
| 9330:0106 mov cx,0016 40FE0002FFFFEFFFD382FFEDEFFEFFFF9520007E|
| 9330:0109 mov dx,cs 40FE00020016EFFFD382FFEDEFFEFFFF9520007E|
| 9330:010B mov ds,dx 40FE000200169330D382FFEDEFFEFFFF9520007E|
| 9330:010D mov dx,0117 40FE0002001693309330FFEDEFFEFFFF9520007E|
| 9330:0110 int 21 40FE0002001601179330FFEDEFFEFFFF9520007E|
| 9330:0112 mov ax,4CFF 40FE0002001601179330FFEDEFFEFFFF9520007E|
| 9330:0115 int 21 4CFF0002001601179330FFEDEFFEFFFF9520007E|
| 9330:0115 <End of emulation> |
+-----------------------------------------------------------------+
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 106
A successful purge is not the end of the story! Your job is only
partially complete. Some viruses damage data files. They could randomly
change bytes on your disks, swap sectors, or perform other nasty tricks.
A cleaning utility can never repair data!
4. Check your data files thoroughly and consult a virus expert to find
out what the virus is capable of doing. If there is any doubt, restoring
the data is definitely the most reliable option.
WARNING:
Under no circumstances should you continue to use cleaned software!
Cleaning is a temporary solution that simply enables you to delay a
large restore operation until a more practical time. You should
never rely on a cleaned program for any length of time. This is not
a criticism of anti-viral cleaning agents. If your data is valuable
to you, you should care for it as much as possible, and sticking to
original software is simply an elementary precaution. In other
words, restore the original programs as soon as possible!
3.6.5 Understanding Cleaning Limitations
Although TbClean has a very high success rate and is able to clean
programs that other cleaners refuse to process, it simply cannot remove
all viruses and cannot clean every file. Examples of computer viruses
that TbClean (or other virus cleaners) cannot clean include:
Overwriting viruses. This type of virus does not add itself to the
end of the original program, rather it copies itself over the
original file. Further, it does not attempt to start the original
program but simply hangs the machine or returns you to DOS after it
activates. Since it overwrites the original file, no cleaner can
restore the file.
Some encrypted viruses. TbClean is usually able to decrypt the
virus. However, some viruses use anti-debugger features that TbClean
cannot yet cope with (but we re working on it!).
The construction of some program files makes them impossible to
clean, making reinstallation the only option. Some of these file
types include:
EXE-programs with internal overlays. TbScan marks these files
with an "i" flag. Any infection is sure to cause major damage
to these files. Some viruses recognize such programs and do not
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 107
infect them, but most viruses infect these programs anyway and
corrupt them. No cleaner can repair this kind of damage.
Programs with sanity check routines. Some programs (mostly
anti-virus software or copy-protected programs) perform their
own kind of sanity check. Heuristic cleaning of an infected
program normally results in a program that is not physically
identical to the original. So, although TbClean removes the
virus from the program and the program is functionally
identical to the original, the program's internal sanity check
usually detects the slight changes and aborts the program.
Cleaning Multiple Files
TbClean has no provisions for cleaning multiple programs in one run.
There are two reasons for this omission:
1. TbClean cannot search for viruses automatically since it does not
know any virus.
2. We recommend that you clean the system on a file-by-file basis.
Clean one file, verify the result, and go on to the next file.
Again, this helps you keep track of which files are clean, which
files are damaged and should be restored from a backup, and which
files are still infected.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 108
3.7 Using TbMem
TBAV provides three extra utilities that help you build a massive
security wall around your computer system. This set includes: TbMem,
TbFile and TbDisk. In this section, we'll introduce these three utilities
collectively as a set and then examine each individual utility.
3.7.1 Introducing the TbMem, TbFile & TbDisk Utilities
As the old saying goes, An ounce of prevention is worth a pound of cure,
and the computer virus threat gives this old saying new meaning. TBAV is
the best product on the market for removing viruses, but if this is all
it did, it would be of little use. It's much wiser to prevent virus
infection than wait until you get one and remove it.
This is where a set of three small memory-resident (TSR) programs come
in. These utilities are shipped with TBAV for DOS; they monitor specific
areas of your system and protect against virus infection. These three
utilities are:
TbMem.
This program detects attempts by programs to remain resident in
memory and ensures that no program can remain resident in memory
without permission.
TbFile.
This program detects attempts by programs to infect other programs.
TbDisk.
This program detects attempts by programs to write directly to the
disk (bypassing DOS), attempts to format disks, and other such
destructive actions.
3.7.2 Loading TbMem, TbFile and TbDisk
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 109
The TbMem, TbFile and TbDisk programs load in the same way. The following
sections contain specific information on each of the programs, but here
we present loading information that is common to all of them.
CAUTION:
You must load TbDriver before you can load any of the TbMem, TbFile
or TbDisk utilities. These utilities will refuse to load without it.
There are three possible ways to load TbMem, TbFile or TbDisk. Please
note that we call the programs TbXXX here. Naturally, you will replace
the XXX with either Mem, File, or Disk when you load each utility.
1. From the DOS prompt or within the AUTOEXEC.BAT file:
<PATH>TBXXX
2. From the CONFIG.SYS file as a TSR (DOS 4 or higher):
INSTALL=<PATH>TBXXX.EXE
The INSTALL= CONFIG.SYS command is NOT available in DOS 3.xx.
3. From the CONFIG.SYS as a device driver:
DEVICE=<PATH>TBXXX.EXE
NOTE:
Executing one of the utilities TbMem, TbFile or TbDisk as a device
driver does not work in all OEM versions of DOS. If it doesn't work,
use the INSTALL= command or load the desired program from within the
AUTOEXEC.BAT. TbMem, TbFile and TbDisk should always work correctly
after being started from within the AUTOEXEC.BAT file. Also, unlike
other anti-virus products, you can load the ThunderBYTE Anti-Virus
utilities before starting a network without losing the protection
after the network starts.
In addition to the three loading possibilities, if you are using DOS
version 5 or above, you can load the TbMem, TbFile or TbDisk programs in
an available UMB (upper memory block) from AUTOEXEC.BAT using the
following command:
LOADHIGH <PATH>TBXXX.EXE
You can load TbMem, TbFile or TbDisk high from within the CONFIG.SYS
using the following command:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 110
DEVICEHIGH=<PATH>TBXXX.EXE
If you are using Microsoft Windows, you should load the resident TBAV
programs BEFORE starting Windows. When you do this, there is only one
copy of the program in memory regardless of how many DOS windows you
might open. Every DOS window (that is, every virtual machine ) has a
fully functional copy of the program running in it.
Each of the programs automatically detects if Windows is running, and
switches itself into multitasking mode if necessary. You can even disable
each of the programs in one window without affecting the functionality in
another window.
3.7.3 Using Command Line Options
You can load all the TbMem, TbFile or TbDisk utilities using several
command line options. See the description of each individual utility for
further information.
3.7.4 Understanding TbMem
Once they execute, most viruses remain resident in memory. While resident
in memory, they might have many opportunities to infect other files in
the background, interfere with the system operation, hide themselves from
virus scanners or checksumming programs, and/or perform other nasty
tasks.
On the other hand, because so many viruses remain resident in memory,
most of them are easy to detect by monitoring the process of becoming
memory resident.
TbMem monitors the system and ensures that no program can remain resident
in memory without permission. This brings to your attention any software
that attempts to remain resident, thereby reducing the likelihood of a
virus going unnoticed.
TbMem also protects CMOS (a small area of memory that stores vital
information concerning your computer).
NOTE:
What exactly is a memory-resident program? Most programs run by
executing a command at the DOS command line, perform some task, and
then terminate, placing you back where you started. Some programs,
however, continue to operate after you terminate them. These
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 111
programs load themselves into memory, remain resident in memory, and
perform some task in the background. Programs in this category
include: disk caches, print spoolers and network software. These
programs are often referred to as TSR (Terminate and Stay Resident)
programs.
Like a TSR program, most viruses also remain resident in memory, and it
is for this reason that TbMem should be usedto control the process of
becoming resident in memory.
If a program attempts to become resident, TbMem offers you the option to
abort the attempt. It does this by guarding the DOS TSR function calls
while also monitoring important interrupts and memory structures. TbMem
uses the ANTI-VIR.DAT records to determine whether it will allow a
specific program to remain resident in memory.
TbSetup recognizes many common TSRs. If it doesn't recognize a TSR,
however, TbMem asks your permission for the TSR to load. It then
maintains permission information in the ANTI-VIR.DAT files to prevent
TbMem from bothering you when an approved TSR is loading.
TbMem also checks the contents of the CMOS configuration memory after
each program termination to ensure that programs have not changed. TbMem
offers you the option of restoring the CMOS configuration when it
changes. Once you teach TbMem which programs are TSRs and which are not
on a PC, you can use TbSetup to set the permission flag of these files on
other machines.
TbMem also installs a hot key that you can use to escape from nearly all
programs.
TbMem is fully network compatible. It does not require you to reload the
checker after logging onto a network.
3.7.5 Working with TbMem
Since TbMem is a memory resident program, you can execute and configure
it from the command line or from within a batch file. It is more
efficient, however, to load TbMem at boot up from either CONFIG.SYS or
AUTOEXEC.BAT. See the "Introducing the TbMem, TbFile and TbDisk
Utilities" section earlier in this chapter for details.
CAUTION:
You must load TbDriver before you can load TbMem. TbMem will refuse
to load without it.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 112
3.7.6 Maximizing TbMem
You can maximize the performance of TbMem by using its command line
options. The first four options in the table below are always available.
The other options are available only if TbMem is not yet memory resident.
option parameter short explanation
------------------ ----- ----------------------------------------
help ? display on-line help
remove r remove TbMem from memory
on e enable checking
off d disable checking
secure s do not execute unauthorized TSRs
hotkey<=keycode> k specify keyboard scancode for the program
cancel hotkey
nocancel n do not install the cancel hotkey
nocmos m do not protect CMOS memory
The explanations in the above table serve as a quick reference, but the
follow descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBMEM ?.
help (?).
Specifying this option displays the brief help as shown above.
remove (r).
This option disables TbMem and attempts to remove the resident part
of its code from memory and return this memory space to the system.
Unfortunately, this works only if you loaded TbMem last. An attempt
to remove a TSR after you load another TSR leaves a useless gap in
memory and could disrupt the interrupt chain. TbMem checks whether
it is safe to remove its resident code; if not, it simply disables
itself.
on (e).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 113
This option reactivates TbMem after you disable it using the OFF
option.
off (d).
Specifying this option disables TbMem but leaves it in memory.
secure (s).
TbMem normally asks the user to continue or to cancel when a program
tries to remain resident in memory. In some business environments,
however, employees should not make this choice. If you use this
option, it is no longer possible to execute new or unknown resident
software. It is also no longer possible to use the REMOVE or OFF
options.
hotkey (k).
TbMem offers you a reliable way to escape from any program by
pressing a special key combination. You can not only use this
feature to escape from programs that "hang," but also from software
that seems to be malicious (although we recommend powering down and
rebooting from a write-protected system disk). Instead of the
default combination (Ctrl+Alt+Insert), you can specify another
keyboard combination using the HOTKEY=<KEYCODE> option. You must
specify the scancode using a 4-digit hexadecimal number; the first
two digits specify the shift-key mask, and the last two digits
specify the keyboard scancode. Consult your PC manual for a list of
"scan codes." For example, the default scan code is 0C52, but you
can change this to another code, such as 0C01, the code for
Ctrl+Alt+Esc.
nocancel (n).
TbMem normally installs the program cancel hot key
(Ctrl+Alt+Insert). If you do not want to use the program cancel hot
key, specify this option, since this saves a few bytes of memory.
nocmos (m).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 114
TbMem normally protects the CMOS memory if available. If you do not
want TbMem to do this, you can specify this option.
The following command loads TbMem as a device driver in the CONFIG.SYS,
configures the "program cancel hot key" as Ctrl+Alt+Esc, and cancels
protection of CMOS memory:
DEVICE=C:\TBAV\TBMEM.EXE HOTKEY=0C01 NOCMOS
To achieve the same functionality, you could execute TbMem from the DOS
command line rather then specifying the TbMem command line in the
CONFIG.SYS by entering the following command at the DOS command line:
C:\TBAV\TBMEM.EXE HOTKEY=0C01 NOCMOS
3.7.7 Understanding TbMem's Operation
If TbMem detects that a program tries to remain resident in memory, it
displays a pop-up window displaying a message to that effect. You can
either choose to continue, or to abort the program's loading. If you
answer "NO" to the question "Remove program from memory?" the program
continues undisturbed, and TbMem places a mark in the ANTI-VIR.DAT file
about this program. Next time you invoke the same resident program, TbMem
will not disturb you again.
There are many programs that normally remain resident in memory, such as:
disk caches, print spoolers, and others. How, then, does TbMem
distinguish between these programs and viruses?
TbMem uses the ANTI-VIR.DAT records generated by TbSetup to keep track of
which files are normal TSRs and which are not. It marks most common
resident software as being common so you don't have to worry about these
files.
If TbMem pops up with the message that a program tries to remain resident
in memory, you have to consider the purpose of the program mentioned. For
example, is the program supposed to continue to operate in the
background? The answer is obviously yes if the program is a disk cache,
print spooler, pop-up utility or system extension software.
If, on the other hand, the message appears after you have exited your
word processor, database, spreadsheet application, something is
definitely wrong! You ought to terminate the program immediately and use
a virus scanner to check the system. The same applies when software that
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 115
operates normally without staying resident in memory suddenly changes its
behavior and tries to remain resident in memory.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 116
3.8 Using TbFile
This section concerns another resident TBAV utility, TbFile, which checks
programs for virus infections as they begin to load.
3.8.1 Understanding TbFile
The two most dangerous virus categories are the boot sector and the file
variants. File viruses all have a common purpose, namely, to infect
programs. Infecting a program involves very unusual file manipulations
that are quite dissimilar to normal file handling procedures, so in order
to detect viral activity it is essential to keep an eye out for program
file changes involving peculiar actions.
TbFile monitors the system and detects attempts by programs to infect
other programs. Unlike other file guards, TbFile monitors the system only
for virus specific file modifications. TbFile doesn't generate an alarm
when a program modifies itself for configuration purposes, nor does it
bother you when you update a program or create one yourself. On an
average system, configurations should never cause a false alarm. TbFile
has a very sophisticated infection detector and will not give a false
alarm when you perform standard file operations. In normal configurations
you will never get a false alarm!
TbFile not only detects attempts to infect programs, it also offers you
the option of aborting the infection process and continuing a program's
execution.
TbFile also detects other suspicious activities, including setting the
seconds value of time stamps to an illegal value.
TIP:
As many users know, you can protect files against unwanted
modifications by means of the read-only attribute. Without TbFile,
however, someone can easily circumvent this standard DOS protection.
TbFile detects any attempts to sabotage the read-only attribute.
This gives you added security by enabling you to use this
uncomplicated method to fully protect your files against
destruction and infection.
TbFile is fully network compatible. It does not require you to reload the
checker after logging onto a network. In contrast, other resident
anti-virus utilities force you to choose between protection BEFORE you
start the network, or protection AFTER you start network, but not both.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 117
3.8.2 Working with TbFile
Since TbFile is a memory resident program, you can execute and configure
it from the command line or from within a batch file. It is more
efficient, however, to load TbFile at boot up from either CONFIG.SYS or
AUTOEXEC.BAT. See the "Introducing the TbMem, TbFile and TbDisk
Utilities" section earlier in this chapter for details.
CAUTION:
You must load TbDriver before you can load TbFile. TbFile will
refuse to load without it.
3.8.3 Maximizing TbFile
You can maximize the performance of TbFile by using its command line
options. The first four options in the table below are always available.
The other options are available only if TbFile is not yet memory
resident.
option parameter short explanation
------------------ ----- ------------------------------
help ? display on-line help
remove r remove TbFile from memory
on e enable checking
off d disable checking
secure s all permissions denied
allattrib a readonly check on all files
compat c allow CPM-style file I/O calls
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBFILE ?.
help (?).
Specifying this option displays the brief help shown above.
remove (r).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 118
This option disables TbFile and attempts to remove the resident part
of its code from memory and return this memory space to the system.
Unfortunately, this works only if you loaded TbFile last. An attempt
to remove a TSR after you load another TSR leaves a useless gap in
memory and could disrupt the interrupt chain. TbFile checks whether
it is safe to remove its resident code; if not, it simply disables
itself.
on (e).
This option reactivates TbFile after you disabled it using the OFF
option.
off (d).
Specifying this options disable TbFile, but leaves it in memory.
secure (s).
TbFile normally asks you to continue or to cancel when a program
tries to perform a suspicious operation. In some business
environments, however, employees should not make this decision. If
you use the SECURE option, it is no longer possible to allow
suspicious operations. It is also no longer possible to use the OFF
and REMOVE options.
allattrib (a).
TbFile normally protects only the read-only attribute of executable
files (program files with the extension COM and EXE). If you want to
have the read-only check on all files, add this option. In this case
you always get an alarm when something attempts to remove the
read-only attribute of any file.
compat (c).
DOS still contains some CPM (an earlier operating system) internal
functions, even though DOS programs no longer use these functions.
Some viruses, however, use these functions to bypass anti-virus
software. TbFile closes these backdoors by default, but you can
prevent this by specifying this option.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 119
The following command loads as a device driver in CONFIG.SYS and it
guards the read-only attribute of all files:
DEVICE=C:\TBAV\TBFILE.EXE ALLATTRIB
To achieve the same functionality, you could execute TbFile from the DOS
command line rather then specifying the TbFile command line in the
CONFIG.SYS by entering the following command at the command line:
C:\TBAV\TBFILE.EXE ALLDRIVES
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 120
3.9 Using TbDisk
This section deals with TbDisk, which prevents viruses from damaging data
on your hard disk.
3.9.1 Understanding TbDisk
Many viruses try to damage the data on disk. They accomplish this by
various actions, such as, formatting the disk, overwriting the FAT, and
swapping disk sectors, among others. Almost anything is possible!
Another category of malicious software, known as boot sector virus
droppers, install a boot sector virus on the disk. The program itself is
not a virus, so detection with virus scanners and other anti-viral
software is very difficult. The only way to detect such a program is by
monitoring its behavior.
The main problem in all this lies in the way these programs manage to
avoid the usual DOS procedures: they go directly to the BIOS (Basic
Input/Output System). This is the reason you need TbDisk, to monitor the
system and to ensure that no program can write directly to disk without
permission. TbDisk draws attention to any software that attempts to write
directly to disk, thereby reducing the likelihood of a virus remaining
unnoticed. TbDisk prevents viruses from damaging data on your disk and
stops boot sector virus droppers in their tracks.
TbDisk not only informs you when a program tries to write directly to the
disk, it also offers you the option to abort the program before it can
cause any damage.
TbDisk is able to detect stealth techniques, that is, attempts to
single step through the BIOS software, and even monitors the use of
undocumented calls that could cause disk damage. For example, TbDisk is
able to distinguish whether DOS or an application makes direct write
attempts via Int 13h (a system call implemented in the BIOS of your
computer). Direct writes are perfectly legal for DOS, but unusual for
application software.
TbDisk does require a little maintenance. TbDisk uses the ANTI-VIR.DAT
records to determine if it should allow a program (including popular disk
utilities, which TbSetup recognizes) to write directly to the disk. In
the absence of an ANTI-VIR.DAT record, TbDisk asks your permission first
and, if granted it, updates the record accordingly to avoid repeated
warnings about the same program.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 121
TbDisk is fully network compatible. It does not require you to reload the
program after logging onto a network. Other resident anti-virus utilities
force you to choose between either protection BEFORE the network is
started, or protection AFTER it starts, but not both..
TIP:
TbDisk also comes in handy if you ever need to write protect a hard
disk. This bonus feature often helps when testing new software.
3.9.2 Working with TbDisk
Since TbDisk is a memory resident program, you can execute and configure
it from the command line or from within a batch file. It is more
efficient, however, to load TbFile at boot up from either CONFIG.SYS or
AUTOEXEC.BAT. See the "Introducing the TbMem, TbFile and TbDisk
Utilities" section earlier in this chapter for details.
CAUTION:
You must load TbDriver before you can load TbDisk. TbDisk will
refuse to load without it.
In addition to all this, there are several special considerations in
using TbDisk.
Loading TbDisk
Improper installation of TbDisk can cause excessive false alarms! If you
want to install TbDisk in your CONFIG.SYS or AUTOEXEC.BAT file, we
recommend that you use the INSTALL option of TbDisk first. If the system
continues to behave normally and TbDisk does not give false alarms when
you copy files on your hard disk, TbDisk is installed correctly and you
can remove the INSTALL option from the command.
WARNING:
Failure to use the Install option when you install TbDisk in
CONFIG.SYS or AUTOEXEC.BAT file might cause loss of data! Please
read on.
While the INSTALL option instructs TbDisk to allow all disk accesses, it
also displays a message as it would do in normal mode. If no false alarms
occur when you copy files on your hard disk, TbDisk is installed
correctly and you can remove the INSTALL option.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 122
If TbDisk causes false alarms, load TbDisk further ahead in your
CONFIG.SYS or AUTOEXEC.BAT file until it works as it should.
CAUTION:
Unlike the other TBAV utilities, we recommend that you load TbDisk
after other resident software! Failure to do so can cause false
alarms!
TbDisk detects if Windows is running and automatically switches into
multitasking mode if necessary. You can even disable TbDisk in one window
without affecting the functionality in another. If you are using Windows
fast 32-bit disk access, you might need to use TbDisk's WIN32 option if
Windows displays an error-message.
3.9.3 Maximizing TbDisk
You can maximize TbDisk's performance by using its command
line options. The first four options are always available.
The other options are available only if TbDisk is not yet
memory resident.
option parameter short explanation
------------------ ----- -----------------------------------
help ? display on-line help
remove r remove TbDisk from memory
on e enable checking
off d disable checking
wrprot p makes hard disk write protected
nowrprot n allow writes to hard disk
win32 w allow Windows 32-bit disk access
secure s deny access without asking first
notunnel t do not detect tunneling
nostealth a do not detect stealth disk access
install i installation test mode
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
TIP:
Remember that you can display these options from the command line by
entering TBDISK ?.
help (?).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 123
Specifying this option displays the brief help as shown above. After
loading TbDisk into memory, not all options appear.
remove (r).
This option disables TbDisk and attempts to remove the resident part
of its code from memory and return this memory space to the system.
Unfortunately, this works only if you loaded TbDisk last. An attempt
to remove a TSR after you load another TSR leaves a useless gap in
memory and could disrupt the interrupt chain. TbDisk checks whether
it is safe to remove its resident code; if not, it simply disables
itself.
on (e).
This option activates TbDisk after you disabled it using the OFF
option.
off (d).
Specifying this option disables TbDisk but leaves it in memory.
wrprot (p).
Hard disks are more difficult to protect against writing than
floppies, which adds considerable risk when doing such things as
testing new software. Sometimes you might want to find out what this
software does to your hard disk and how this could possibly affect
your valuable data. Using the "WRPROT" option makes this safer to
do. Whenever a program wishes to write to a protected disk, you will
see a message such as:
Write protect error writing drive C: A)bort, R)etry, I)gnore?
You can then take the appropriate action.
CAUTION:
Software write protection is not absolutely reliable. Some
viruses can bypass this protection, but fortunately they are
few and far between. Despite its shortcomings, this option can
be a valuable shield against most malicious software.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 124
nowrprot (n).
Use this option to undo the WRPROT option.
win32 (w).
Windows 386 Enhanced Mode uses some undocumented DOS calls to
retrieve the original BIOS disk handler when you enable 32-bit disk
access. Since TbDisk guards these calls, 32-bit disk access will no
longer be possible, unless you specify the WIN32 option when you
initialize TbDisk.
CAUTION:
Use this option only in Windows 386 Enhanced Mode with fast
32-bit disk access enabled as it reduces anti-viral security to
some extent.
secure (s).
TbDisk normally asks whether the user wants to continue or cancel
when a program tries to perform direct disk access. In some business
environments, however, employees should not make this decision. This
option disables direct disk access permission to new or unknown
software. It also disables the OFF and REMOVE options.
notunnel (t).
"Tunneling" is a technique viruses apply to determine the location
of the DOS system code in memory, and to use that address to
communicate with DOS directly. This inactivates all TSR programs,
including resident anti-virus software. TbDisk is able to detect
these "tunneling" attempts, and informs you about it. Some other
anti-virus products also rely on tunneling techniques to bypass
resident viruses, thereby causing false alarms. If you are currently
executing other anti-viral products, the NOTUNNEL option disables
TbDisk's tunneling detection.
nostealth (a).
TbDisk tries to detect direct calls into the BIOS. If such an
attempt occurs, TbDisk pops up with a message that something is
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 125
accessing the disk in an unusual way. If this feature causes false
alarms, you can use this option to turn it off.
install (i).
Incorrect installation can result in a large number of false alarms.
You should use this option when installing TbDisk because it reduces
the risk of canceling a valid disk write operation as a result of
false alarms.
3.9.4 Understanding TbDisk's Operation
What is Direct Disk Access? Programs usually access files through the
operating system (DOS). Whenever a program wants to update a file, for
example, it asks DOS to write the data to disk. It is also possible,
however, to write to a disk without using DOS. This is called direct
disk access.
While normal programs do not write to the disk directly, there are some
programs that need to do so, including:
Format utilities. Direct disk access is the only way to format a
disk.
Disk diagnosis utilities (such as the Norton Disk Doctor, and DOS's
CHKDSK command and ScanDisk utility).
Disk optimizers and defragmenters (such as Norton SpeedDisk and
DOS's Defrag utility).
Since many viruses can perform direct disk access, it is essential to
control this. TbDisk can distinguish between legitimate programs and a
virus with the help of the ANTI-VIR.DAT records, which you can generate
using TbSetup.
Whenever TbDisk pops up a message that says a program accesses to the
disk directly, consider its purpose carefully. While it is perfectly
acceptable for a format utility or a disk optimizer to format or edit
disk sectors, this is not acceptable for a word processor or database.
When TbDisk warns you that a spreadsheet or some other normal program
is about to format a sector, you can be sure that something is wrong.
Terminate the program pronto! Then check things out with a virus scanner
before the worst happens.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 126
3.10 Using TbUtil
This section describes TbUtil, which is designed primarily to make a
precautionary backup of clean partition tables and boot sectors.
3.10.1 Understanding and using TbUtil
TbUtil provides a defense against partition table and boot sector
viruses. TbUtil can be used to:
Copy the partition table, boot sector and CMOS data area into a
file. You can use TbUtil on a regular basis to compare both the
current and the original versions of the partition table, boot
sector and CMOS data area. After an accident virus, (virus or
otherwise), you can restore the copy using the TbUtil program.
Remove a partition table virus without having to low-level format
the hard disk, even if there is no backup of the partition table.
Remove boot sector viruses and creates a partition table that has
some first-line virus defenses built-in.
Replace the infected or clean boot sector with a safe TBAV boot
sector.
NOTE:
What is a partition table? A physical hard disk might consist of
more than one "partition" (or division). Each partition is a logical
disk drive and has it own ID, such as C:, D:, and E:. The partition
table, then, contains the disk lay-out and the starting and ending
cylinder of every partition. The partition table also contains
information about the operating system of a partition and which
partition should be used to boot. The partition table (also called
the Master Boot Record, or MBR) always resides at the very first
sector of the hard disk.
Unlike most file viruses, partition table viruses are hard to remove. The
only solution is to low-level format the hard disk and to make a new
partition table, or to make use of scantily documented DOS commands.
TbUtil, however, makes a backup of the partition table and boot sector
and uses this backup to compare and restore both the original partition
table and boot sector once they become infected. You no longer have to
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 127
format your disk to get rid of a partition table or boot sector virus.
The program can also restore the CMOS configuration.
Optionally, TbUtil replaces the partition table code with an immunized
partition table containing facilities against viruses. The TbUtil
partition code executes before the boot sector gains control, so it is
able to check the boot sector in a clean environment. Once the boot
sector executes, it is difficult to check it because the virus is already
resident in memory and can deceive a protection scheme. Instead of
booting from a clean DOS diskette just to inspect the boot sector, the
TbUtil partition code performs a CRC calculation on the boot sector just
before passing control to it.
If TbUtil detects a change in the boot sector, the TbUtil partition code
warns you about it. The TbUtil partition code also checks the RAM layout
and informs you when it changes. TbUtil does all of this every time you
boot from your hard disk.
TbUtil can replace infected and clean diskette boot sectors with a new
and specialized boot sector, which has several advantages over the
standard boot sector:
It has boot sector virus detection capabilities.
It performs a sanity check.
It offers you the possibility to redirect the boot process to the
hard disk without opening the diskette drive door.
3.10.2 Working with the TbUtil Menu
The TbUtil module contains several programs, which you can execute from
either the TbUtil Menu or, in case of an emergency, from a TbUtil recove-
ry diskette using the DOS command line. The menu, however, offers some
additional menu options. Selecting the "TbUtil" option from the TBAV Main
Menu displays the following menu:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 128
+------Main menu------+
| Confi+-----------TbUtil menu-----------+
| TbSet| System maintenance menu >|
| TbSca| Immunize/clean bootsector A: |
| TbUti| Immunize/clean bootsector B: |
| TbCLe| Immunize/clean partition code |
| Virus+---------------------------------+
| TBAV Monitor >|
| Documentation >|
| Register TBAV |
| About |
| Quit and save |
| eXit (no save) |
+---------------------+
We'll now explore these menu options.
The "System Maintenance Menu" Option
Selecting the "System maintenance menu" option displays the System
Maintenance menu:
+------Main menu------+
| Confi+-----------TbUtil menu-----------+
| TbSet| Syste+-------System maintenance-------+
| TbSca| Immun| Execute TbUtil |
| TbUti| Immun| Describe this machine |
| TbCLe| Immun| Save system configuration |
| Virus+-------|v Compare system configuration |
| TBAV Monitor | Restore system configuration |
| Documentation|v process CMOS memory |
| Register TBAV|v process Partition code |
| About |v process Bootsector |
| Quit and save+--------------------------------+
| eXit (no save) |
+---------------------+
This menu contains the actual TbUtil program. The program takes care of
saving, restoring or comparing the system configuration of your PC. It
stores the backup system configuration on a diskette in a file with
either a default name or a name you can specify yourself.
WARNING:
You can only restore a system configuration data file on the machine
that created the data file. Restoring a configuration file from one
PC to another makes the PC inaccessible!
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 129
The "System Maintenance Menu" contains the following items:
Execute TbUtil.
Before activating this option, you must select one of the optional
functions: Save, Compare, or Restore the system configuration. Move
to the desired option you want to activate and press ENTER. A check
mark indicates that an option is active.
Describe this machine.
Enter a meaningful description of the machine. Enter something like,
"486DX4 @ 100MHz, 32Mb, 2 Gb SCSI disk, room 12, Mr. Smith." You do
NOT have to remember this description; TbUtil displays it on the
screen when comparing or restoring, which helps you to verify that
the data file belongs to the machine.
Save system configuration.
This option stores the partition table, boot sector and CMOS data
area into the TbUtil data file.
WARNING:
Since the PC is completely inaccessible to DOS if the partition
table becomes damaged, we RECOMMEND that you store both the TbUtil
data file AND the program TBUTIL.EXE itself on a "rescue" diskette!
If the partition table is damaged or destroyed, then the only
solution to the problem may reside on the "rescue"
diskette, since your hard drive may be inaccessible!
When loading TbUtil from the command line you must specify a
filename after the STORE option. In contrast, using the TBAV menu,
you can use the default filename TBUTIL.DAT. If you own more than
one PC, we recommend that you create one TbUtil diskette with all
TbUtil data files of all your PC's on it. Use the extension of the
file for PC identification, as in the following:
A:TBUTIL.<NUMBER>
Compare system configuration.
This option enables you to check on a regular basis that everything
is still okay. If you specify this option, TbUtil compares the
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 130
information in the TbUtil data file against the partition table,
boot sector, and CMOS data areas. It also displays the comment
stored in the data file. Using this option also guarantees that the
TbUtil data file is still readable.
Restore system configuration.
This option enables you to restore the partition table, boot sector,
and CMOS data area. It asks you to confirm that the data file
belongs to the current machine. Finally, it can restore the
partition table, boot sector of the partition to be used to boot,
and the CMOS data area.
Process CMOS memory,
Process Partition code, and
Process Boot sector.
By default, TbUtil restores the partition code, boot sector, and
CMOS if you specify the "Restore system configuration" option. If
you use one of the above options in combination with the "Restore
option," TbUtil restores only the items you specify.
The "Immunize/Clean Boot sector A: [or] B:" Options
You can use these options to clean diskettes infected by a boot sector
virus or to replace the standard boot sector with a boot sector that has
advantages over the original one:
The TBAV boot sector has virus detection capabilities. The TBAV boot
sector checks that it resides on the correct place on the diskette,
and that Int 13h and/or Int 40h still exist in system ROM. This
makes it possible to detect even stealth and boot sector viruses.
The TBAV boot sector can load the system files if they are available
on the disk, but if the DOS system files are not on the disk, the
TBAV boot sector displays a small menu offering you two
possibilities: retry the boot operation with another diskette, or
boot from the hard disk. If you select the latter, you don't have to
open the diskette drive door.
The "Immunize/Clean Partition Code" Option
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 131
This is an extremely powerful option, which you can use to clean an
infected partition table if there is no TbUtil data file. It saves
the original partition code in a file and replaces the existing
partition table code with a new partition routine that contains some
virus detection capabilities. You must execute TbUtil from a floppy
drive or you have to specify the name of the file (the specified
drive should be a diskette drive) to store the original partition
code.
If the original partition table becomes irreparably damaged and
can't be used to build a new one, TbUtil scans the entire disk for
information about the original disk layout. TbUtil also searches for
TbUtil data files on the hard disk.
CAUTION:
While it is a good idea to keep a copy of the data file on the
hard disk, we recommend that you store the data file on a
diskette. Just in case!
If your system configuration changes, that is, you update your DOS
version or change the amount of memory, you need to update the
information stored in the immune partition as well. You can do this
by using this option.
In the unlikely event that the system does not boot properly, you
can restore the original partition table using the TbUtil RESTORE
option (refer to The "System Maintenance Menu Option" section
above) or by using the DOS version 5 or above FDISK /MBR command
(which creates a new partition table).
TIP:
If you have installed two hard drives in your computer, you can
immunize the partition code of the second hard drive by
specifying the physical drive number rather than the drive ID
(i.e., execute the command TbUtil 2: )
If the new partition code works properly, you should make a backup
copy of it on a diskette using the TbUtil STORE option (refer to
The "System Maintenance Menu Option" section above).
3.10.3 Maximizing TbUtil
This section describes how to fully maximize TbUtil in three ways: use
command line option, use the anti-virus partition, use the TbUtil
diskette.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 132
Now that you know how to use TbUtil's menus, you can more easily
understand how to maximize its performance by using its command line
options.
option parameter short explanation
------------------ ----- -------------------------------------
immunize <drive> im Immunize/Clean boot sector or MBR of
<drive>
getboot <drive> gb Save boot sector/MBR into file
store [<filename>] st Store system information
restore [<filename>] re Restore system information
compare [<filename>] co Compare system information
Sub-options of immunize option:
--------------------------------------------------------------
norepeat nr Do not ask for next diskette
nomem nm Do not check for amount of RAM
batch ba Do not prompt to insert a disk
Sub-options of store option:
--------------------------------------------------------------
description=<descr.> de Add description to data file
Sub-options of restore option:
--------------------------------------------------------------
part pt Restore partition table
boot bo Restore boot sector of hard disk
cmos cm Restore CMOS data memory
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
Immunize <floppy drive> (im).
You can use this option to clean diskettes infected by a boot sector
virus or to replace the standard boot sector by a boot sector that
has advantages over the original one:
The TBAV boot sector has virus detection capabilities. The boot
sector checks that it still resides on the correct place on the
diskette, and that Int 13h and/or Int 40h still exist in system
ROM. This makes it possible to detect even stealth and boot
sector viruses.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 133
The TBAV boot sector is able to load the system files if they
are available on the disk, but if the DOS system files are not
on the disk, the TBAV boot sector displays a small menu
offering you two possibilities: retry the boot operation with
another diskette, or boot from the hard disk. If you select the
latter, you don't have to open the diskette drive door.
Immunize c: (im c:).
This is an extremely powerful option, which you can use to clean an
infected partition table if there is no TbUtil data file. It saves
the original partition code in a file and replaces the existing
partition table code with a new partition routine that contains some
virus detection capabilities. You have to execute TbUtil from a
floppy drive or you have to specify the name of the file (the
specified drive should be a diskette drive) to store the original
partition code.
TIP:
If you have installed two hard drives in your computer, you can
immunize the partition code of the second hard drive by
specifying the physical drive number rather than the drive ID
(i.e., execute the command TbUtil 2: )
If the original partition table becomes irreparably damaged and
consequently can't be used to build a new one, TbUtil scans the
entire disk for information about the original disk layout. TbUtil
also searches for TbUtil data files on the hard disk.
CAUTION:
While it is a good idea to keep a copy of the data file on the
hard disk, we recommend that you store the data file on a
diskette. Just in case!
If your system configuration changes, that is, you update your DOS
version or change the amount of memory, you need to update the
information stored in the immune partition as well. You can do this
by using this option.
In the unlikely event that the system does not boot properly, you
can restore the original partition table using the TbUtil RESTORE
option (refer to The "System Maintenance Menu Option" section
above) or by using the DOS version 5 or above FDISK /MBR command
(which creates a new partition table).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 134
getboot <drive> (gb).
With this option you can copy the boot sector of the specified drive
into a file.
store [<filename>] (st).
This option stores the partition table, boot sector and CMOS data
area into the TbUtil data file.
WARNING:
Since the PC is completely inaccessible to DOS if the partition
table becomes damaged, we RECOMMEND that you store both the
TbUtil data file AND the program TBUTIL.EXE itself on a rescue
diskette! If the partition table is damaged or destroyed, then
the only solution to the problem may reside on the "rescue"
diskette, since your hard drive may be inaccessible!
When loading TbUtil from the command line you must specify a
filename after the STORE option. In contrast, using the TBAV menu,
you can use the default filename TBUTIL.DAT. If you own more than
one PC, we recommend that you create one TbUtil diskette with all
TbUtil data files of all your PC's on it. Use the extension of the
file for PC identification, as in the following:
A:TBUTIL.<NUMBER>
restore [<filename>] (re).
This option enables you to restore the partition table, boot sector,
and CMOS data area. It asks you to confirm that the data file
belongs to the current machine. Finally, it restores the partition
table, boot sector of the partition to be used to boot, and the CMOS
data area.
compare [<filename>] (co).
This option enables you to check on a regular basis that everything
is still okay. If you specify this option, TbUtil compares the
information in the TbUtil data file against the partition table,
boot sector, and CMOS data area. It also displays the comments
stored in the data file. Using this option guarantees that the
TbUtil data file is still readable.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 135
norepeat (nr).
By default, TbUtil prompts you for the next diskette after you have
immunized a diskette. This option disables this function.
nomem (nm).
If you specify this option when you are immunizing your partition
code, the partition code skips the RAM check while booting. This is
necessary for some systems that change the memory setup during the
boot process.
batch (ba).
If you specify this option, TbUtil will assume a disk has already
been inserted in your disk drive. This option is particularly useful
with batch files.
description =<descr.> (de).
For <desc.> enter a meaningful description of the machine. Enter
something like, "486DX4 @ 100MHz, 32 Mb, 2 Gb SCSI disk, room 12,
Mr. Smith." You do NOT have to remember this description; TbUtil
displays it on the screen when comparing or restoring, which helps
you to verify that the data file belongs to the machine.
part (pt) ,
boot (bo), and
cmos (cm).
By default, TbUtil restores the partition code, boot sector, and
CMOS if you specify the RESTORE option. If you use one of these
options in combination with the RESTORE option, however, TbUtil
restores only the items you specify.
In the following two examples TbUtil simply store system information
gathered from the partition table and boot sectors of your fixed disk(s)
and the CMOS data area into a file in the current directory called
TBUTIL.DAT.
TBUTIL STORE
TBUTIL ST
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 136
The following example does the same as the previous, except that TbUtil
stores the information on a diskette instead of in the current directory.
TBUTIL STORE A:TBUTIL.DAT
It's a good idea to describe the machine from which you are saving
information about the partition table, boot sectors and CMOS data. You
can use the DESCRIPTION option to add a small, single-line description of
the machine:
TBUTIL STORE A:TBUTIL.DAT DESCRIPTION = "TEST MACHINE"
You can always fall back on the information TbUtil stores if you suspect
an infection by a boot sector virus. Suppose the information gathered
earlier by TbUtil is stored in the file A:\TBUTIL.DAT. To compare the
current system information with the information stored in the TbUtil data
file, you could use this command:
TBUTIL COMPARE A:TBUTIL.DAT
Now suppose that TbUtil informs you that the current system information
(that is, the partition table and the CMOS data area) does not match the
information stored earlier. If you did not change the configuration of
your computer, it is most likely that a virus is guilty of the change.
You could restore the old system information using this command:
TBUTIL RESTORE A:TBUTIL.DAT PART CMOS
In case of a boot sector virus infection, we recommend that you disinfect
(clean) all diskettes. Using the following command, TbUtil cleans and
immunizes the boot sector of the diskette in drive A: and then repeats
the action after asking you to insert other (possibly) infected diskettes
into the disk drive:
TBUTIL IMMUNIZE A:
In case of a virus infection you should always make certain that the
Master Boot Record of your fixed disk is not infected. The following
command specifies an extra option, which you must use in case your
computer changes its memory setup during the boot process:
TBUTIL IMMUNIZE C: NOMEM
You can easily view the contents of a TBUTIL.DAT by using the DOS TYPE
command:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 137
TYPE A:TBUTIL.DAT
3.10.4 Using the Anti-Virus Partition
If you install the ThunderBYTE partition code (by using TbUtil's IMMUNIZE
option), you will see the following when booting a clean system:
Thunderbyte anti-virus partition (C)1993-95 Thunderbyte BV.
Checking boot sector CRC -> OK!
Checking available RAM -> OK!
Checking INT 13h -> OK!
In contrast, if there is a virus in the boot sector or partition table,
you will see this message:
Thunderbyte anti-virus partition (C)1993-95 Thunderbyte BV.
Checking boot sector CRC -> OK!
Checking available RAM -> Failed!
System might be infected. Continue? (N/Y)
Other messages that might appear are:
"No system." This message means that there is no active partition on
the disk.
"Disk error." The meaning of this message is obvious.
3.10.5 Using the TbUtil diskette
To use the TbUtil diskette, follow these steps:
1. Take a new diskette and format it as a bootable diskette (by
using the DOS FORMAT /S command).
2. Copy the TbUtil files onto the diskette using this command:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 138
COPY TBUTIL.* A:
The TbUtil files you need are TBUTIL.EXE and TBUTIL.LNG.
3. In case of an emergency (such as a damaged or infected partition
table, for example), boot from the TbUtil diskette.
4. Run the TbUtil program, using the IMMUNIZE option:
A:\TBUTIL IMMUNIZE C:
This cleans the partition table.
5. You should now be able to boot from your hard disk normally.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 139
3.11 Using TbLog
This section describes TbLog, which is designed primarily to create log
files in response to various TBAV alert messages.
3.11.1 Understanding and using TbLog
TbLog is a memory resident TBAV utility that writes a record into a log
file whenever one of the resident TBAV utilities pops up with an alert
message. It also records when a virus is detected.
This utility is primarily for network users. If all workstations have
TbLog installed and configured to maintain the same log file, the
supervisor can easily keep track of what's going on. When a virus enters
the network he is able to determine which machine introduced the virus,
and he can take action in time.
A TbLog record provides three pieces of information:
The time stamp of when the event took place.
The name of the machine on which the event occurred.
An informative message about what happened and which files were
involved.
This information is very comprehensive and takes only one line.
3.11.2 Working with TbLog
Since TbLog is a memory resident program, you can execute and configure
it from the DOS command line or from within a batch file. You should,
however, load TbLog automatically and when the computer boots, preferably
during the execution of AUTOEXEC.BAT, or better yet, CONFIG.SYS.
You should install TbLog on every workstation. If you want to use all
workstations to maintain the same log file, we recommend that you load
TbLog after starting the network.
By default, TbLog maintains a log file with the name TBLOG.LOG in the
TBAV directory. If you want to use another filename or another disk
and/or directory, you can specify a filename (and path) on the TbLog
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 140
command line. In a network environment, we recommend that you put the log
file on a server disk.
CAUTION:
Be sure to load TbDriver before trying to load TbLog. TbLog will
refuse to load without it.
There are three possible ways to load TbLog:
1.From the DOS prompt or within the AUTOEXEC.BAT file:
<PATH>TBLOG
2.From CONFIG.SYS as a TSR (DOS 4 or above):
INSTALL=<PATH>TBLOG.EXE
The INSTALL= CONFIG.SYS command is NOT available in DOS 3.xx.
3.From CONFIG.SYS as a device driver:
DEVICE=<PATH>TBLOG.EXE
NOTE:
Executing TbLog as a device driver does not work in all OEM versions
of DOS. If you encounter problems, use the INSTALL= command or make
sure to load TbLog from the AUTOEXEC.BAT. Also, unlike other
anti-virus products, you can load the ThunderBYTE Anti-Virus
utilities before starting a network without losing the protection
after the network is started.
In addition to the three loading possibilities, if you are using DOS
version 5 or above, you can load TbLog into an available UMB (upper
memory block) from AUTOEXEC.BAT using this command:
LOADHIGH <PATH>TBLOG
You can also load TbLog into high memory from within the CONFIG.SYS using
this command:
DEVICEHIGH=<PATH>TBLOG.EXE
If you are using Microsoft Windows, you should load TbLog BEFORE starting
Windows. When you do this, there is only one copy of TbLog in memory
regardless of how many DOS windows you might open. Every DOS window (that
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 141
is, every virtual machine ) has a fully functional copy of TbLog running
in it.
TbLog automatically detects if Windows is running, and switches itself
into multi-tasking mode if necessary. You can even disable TbLog in one
window without affecting its functionality in another window.
3.11.3 Maximizing TbLog
You can maximize TbLog's performance by using its command line options.
The first five options in the following table are always available. The
other options are available only if TbLog is not yet memory resident.
option parameter short explanation
------------------ ----- ---------------------------------
help ? Display some on-line help
remove r Remove TbLog from memory
on e Enable TbLog
off d Disable TbLog
test t Log test message
machine=<descr.> m Description/name of your machine
secure s Do not allow removal of TbLog
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
help (?).
Specifying this option displays the brief help as shown above.
remove (r).
This option disables TbLog and attempts to remove the resident part
of its code from memory and return this memory space back to the
system. Unfortunately, this works only if you loaded TbLog last. An
attempt to remove a TSR after you load another TSR leaves a useless
gap in memory and could disrupt the interrupt chain. TbLog checks
whether it is safe to remove its resident code; if not, it simply
disables itself.
on (e).
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 142
This option reactivates TbLog after you disabled it using the OFF
option.
off (d).
Specifying this option disables TbLog but leaves it in memory.
test (t).
Use this option to record a test message. If you use this option at
the initial loading of TbLog, it records the time and machine name
into the log file. If you use this option after the initial loading,
it simply places a test message into the log file.
machine (m).
Using this option, you can specify the name of the machine on which
TbLog is running. This machine name appears in the log file. By
default, TbLog uses the network machine name on NetBios compatible
machines. On other networks, such as Novell, you must enter the
network name on the TbLog command line.
secure (s).
If you specify this option, it is not possible to use the OFF and
REMOVE options.
The following command loads TbLog, disables, the OFF and REMOVE options,
specifies that the logfile reside in directory F:\SECURITY, and
identifies the machine as DESK3:
C:\TBAV\TBLOG F:\SECURITY\TBLOG.LOG SECURE MACHINE=DESK3
The following CONFIG.SYS command loads TbLog, creates the logfile in
directory X:\LOGS, and specifies that the first line of the log file
contain a date/time stamp and the name of the computer:
DEVICE=C:\TBAV\TBLOG X:\LOGS\TBLOG.LOG MACHINE=JOHN TEST
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 143
3.12 Using TbNet
TBAV for DOS can cooperate with TBAV for Networks, another ThunderBYTE
product, via the program called TbNet. If you do not want to use the
combination of TBAV for DOS and TBAV for Networks, you can skip this
section.
NOTE:
For more information about TBAV for Networks, please refer its
documentation. If you did not purchase TBAV for Networks yet, your
local dealer can inform you about this product.
3.12.1 Understanding TbNet
TbNet is a memory resident TBAV utility that implements the communication
between TBAV for DOS and TBAV for Networks. TBAV for Networks has several
options for controlling remote workstations. For Windows workstations,
TBAV for Windows contains all logic needed to implement the communication
between the workstation and TBAV for Networks. For DOS workstations you
need TbNet for this communication.
3.12.2 Working with TbNet
Since TbNet is a memory resident program, you can execute and configure
it from the DOS command line or from within a batch file. You should,
however, load TbNet automatically when the computer boots, preferably
during the execution of AUTOEXEC.BAT, or better yet, CONFIG.SYS.
You should install TbNet on every workstation.
CAUTION:
Since TbNet uses a public network directory for its communication
with TBAV for Networks, you must load TbNet after starting the
network.
There are three possible ways to load TbNet:
1. From the DOS prompt or within the AUTOEXEC.BAT file:
<PATH>TBNET
2. From CONFIG.SYS as a TSR (DOS 4 or above):
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 144
INSTALL=<PATH>TBNET.EXE
The INSTALL= CONFIG.SYS command is NOT available in DOS 3.xx.
3. From CONFIG.SYS as a device driver:
DEVICE=<PATH>TBNET.EXE
NOTE:
Executing TbNet as a device driver does not work in all OEM
versions of DOS. If it doesn't work, use the INSTALL= command
or load TbNet from AUTOEXEC.BAT. TbNet should always work
correctly if you load it from AUTOEXEC.BAT. Also, unlike other
anti-virus products, you can load the ThunderBYTE Anti-Virus
utilities before starting a network without losing the
protection after the network is started.
In addition to the three loading possibilities, if you are using DOS
version 5 or above, you can load TbNet into an available UMB (upper
memory block) from AUTOEXEC.BAT using this command:
LOADHIGH <PATH>TBNET
You can also load TbNet into high memory from within the CONFIG.SYS using
this command:
DEVICEHIGH=<PATH>TBNET.EXE
We recommend that you do not use TbNet if you use MS-Windows, but use
TBAV for Windows instead. TBAV for Windows has built-in functionality for
communication with TBAV for Networks.
If you do want to use TbNet with MS-Windows for some reason, you should
load TbNet BEFORE starting Windows. When you do this, there is only one
copy of TbNet in memory regardless of how many DOS windows you might
open. Every DOS window (that is, every "virtual machine") has a fully
functional copy of TbNet running in it.
TbNet automatically detects if Windows is running, and switches itself
into multi-tasking mode if necessary. You can even disable TbNet in one
window without affecting the functionality in another window.
3.12.3 Maximizing TbNet
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 145
You can maximize TbNet's performance by using its command line options.
The help and remove options in the following table are always
available. The other options are available only if TbNet is not yet
memory resident.
option parameter short explanation
------------------ ----- --------------------------------------
help ? Display some on-line help
remove r Remove TbNet from memory
netname=<netname> n Netname of the workstation
commdir=<path> c Communication directory used by workstation
frequency=<seconds> f Poll frequency (default is 30 seconds)
buffers=<number> b Number of disk buffers (default is 2)
The explanations in the above table serve as a quick reference, but the
following descriptions provide more information about each option.
help (?).
Specifying this option displays the brief help as shown above.
remove (r).
This option disables TbNet and attempts to remove the resident part
of its code from memory and return this memory space back to the
system. Unfortunately, this works only if you loaded TbNet last. An
attempt to remove a TSR after you load another TSR leaves a useless
gap in memory and could disrupt the interrupt chain. TbNet checks
whether it is safe to remove its resident code; if not, it simply
disables itself
netname (n).
TBAV for Networks distinguishes workstations by their unique
netnames. These netnames are assigned by TBAV for Networks; the
agents software running at the workstations (i.e., TbNet or TBAV for
Windows) receive this netname upon registering the workstation with
TBAV for Networks. You need to specify this netname for correct
behavior of TbNet.
commdir (c).
The communication between TBAV for Networks and the agent software
running at the workstations (i.e., TbNet or TBAV for Windows) takes
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 146
place via a special "communication directory," a directory that is
public to all users. You must specify the path of this directory
when loading TbNet.
frequency (f).
TbNet checks the communication directory every once in a while, to
see if messages originating from TBAV for Networks need to be
processed. You can change the default period of 30 seconds by
specifying the FREQUENCY option.
buffers (b).
TbNet internally needs some buffers to speed up the communication
with TBAV for Networks. The number of these disk buffers used by
TbNet can be changed by using the BUFFERS option.
The following command loads TbNet, for workstation 001AE3, making use of
the communication directory J:\TBAVNW.NET.
C:\TBAV\TBNET NETNAME=001AE3COMMDIR=J:\TBAVNW.NET
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 147
4 Understanding Advanced User Information
This chapter presents some advanced information on using memory, TbSetup,
TbScan, and TbClean. It also introduces you to another TBAV utility,
TbGenSig, signature file compiler. While some of this material is simply
for a better understanding of the utilities and might not be of interest
to you, we recommend that you at least look at the first section on
memory considerations.
4.1 Understanding Memory Considerations
This section presents the memory requirements for each of the TBAV
utilities and how you can reduce the requirements of each utility.
4.1.1 Understanding Memory Requirements
The following table lists the memory requirements for each of the TBAV
utilities:
TBAV Utility Memory Memory
needed consumed
to load after exiting
TbScan * 200 Kb -
TbScanX ** 10 Kb 800 bytes
TbCheck 4 Kb 600 bytes
TbUtil 64 Kb -
TbClean *** 96 Kb -
TbMem 4 Kb 600 bytes
TbFile 5 Kb 1 Kb
TbDisk 4 Kb 800 bytes
TbDriver 5 Kb 3 Kb
TbLog 5 Kb 1 Kb
* If you decide to use a log file, TbScan requires an additional 16
kilobytes of memory for the log file buffer. If TbScan uses its own
built-in file system, it uses additional memory to keep the FAT in
memory. Note that the memory requirements are independent of the number
of signatures. The current memory requirements are adequate to manage at
least 2500 signatures.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 148
** The amount of memory TbScanX requires depends on the number of
signatures. If you enable all features, TbScanX uses 30 kilobytes of
memory when scanning for 1400 family signatures. If you enable swapping,
TbScanX normally uses only one kilobyte of memory. You can swap to EMS
and XMS memory. Naturally you can load the remaining kilobyte of TbScanX
into upper memory.
*** In the heuristic cleaning mode TbClean requires much more memory,
depending on the size of the infected file. TbClean can also use expanded
memory (EMS).
4.1.2 Reducing Memory Requirements
Most PC users try to maintain as much free DOS memory as possible. The
memory resident TBAV utilities (TbScanX, TbCheck, TbMem, TbFile, TbDisk,
TbLog and TbDriver) use only a small amount of DOS memory. To decrease
the memory requirements of these utilities even further, do the
following:
Load the programs from within the CONFIG.SYS file. When loaded as a
device driver, a TBAV utility has no Program Segment Prefix (PSP, a
DOS-internal memory area), which saves 256 bytes for each TBAV
utility.
If you load the TBAV utilities from within the AUTOEXEC.BAT file,
load them before establishing environment variables. DOS maintains a
list of environment variables for every resident program, so keep
this list small while installing TSRs. Once you install all TSRs,
you can then define all environment variables without affecting the
memory requirements of the TSRs.
Make use of memory swapping. If you use the EMS or XMS option,
TbScanX swaps itself to non-DOS memory, leaving only one kilobyte of
code in DOS memory. It is better to swap to expanded memory (EMS
option) because it is faster.
Use high memory if possible. If you have DOS 5 or higher, try to
load the program into an upper memory block using the LOADHIGH or
DEVICEHIGH commands. We recommend that you also enable swapping to
limit the use of upper memory.
Use one of the processor specific versions of the relevant TBAV
utility. They all consume less memory than the generic versions.
Processor optimized versions are available on any ThunderBYTE
support BBS.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 149
Use memory-saving program options. Consider using TbDriver's NOSTACK
option, TbMem's NOCANCEL option, and TbScanX's NOBOOT, EMS and XMS
options.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 150
4.2 Understanding TbSetup
This section presents advanced user information about TbSetup. It
explains the design of ANTI-VIR data files, editing the TBSETUP.DAT file,
and how to easily install TBAV on several machines.
4.2.1 Understanding ANTI-VIR.DAT File Design
Most ThunderBYTE Anti-Virus utilities expect every directory on your
system with executable files to contain its own ANTI-VIR.DAT file. Some
other anti-virus products maintain a somewhat similar fingerprint list
of all executable files, but in one large file rather than a separate
file in each directory. TBAV's approach is superior for several reasons:
One file in each directory is easy to maintain. If you want to
remove the complete product, you can remove the accompanying ANTI-
VIR.DAT file as well.
It consumes less disk space because it is not necessary to store
full path information in the information file.
The TBAV utilities perform faster because they do not have to search
through a huge file to locate the information for one specific file.
Installation is easier and more reliable in network environments. On
a network, it is not unusual that the same files have different
drive ID's on different workstations. If there is only one
information file, the drive-IDs should be stored as well, so every
workstation should maintain its own list. The supervisor can quickly
lose control in this type of situation.
4.2.2 Editing the TBSETUP.DAT File
Editing the TBSETUP.DAT file is useful to TBAV site installation (see the
next section). Therefore, some information on the format of this file is
necessary.
Understanding the Format of TBSETUP.DAT
The format of the TbSetup.Dat file is quite simple. You can either ignore
empty lines, lines starting with a semi-colon (;), and lines starting
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 151
with a percentage symbol (%), or you can treat them as comment lines. The
lines with a preceding percentage symbol also appear in TbSetup's upper
window.
Each entry in the TBSETUP.DAT file has four items:
1. The filename. The filename MUST appear in capital letters and
without spaces.
2. The length of the file in hexadecimal notation. This field might
contain a single asterisk [*] if an exact file length match is not
required.
3. The file's 32-bit CRC in hexadecimal notation. You can use a
single asterisk if an exact checksum match is not required.
4. The hexadecimal number representing flags you want set when the
listed file is found on the system.
You can use the rest of the line for a brief comment.
You can use the following flags. If several flags require setting for a
file, you can combine them using the bitwise OR operation:
bit 0: (0001) Do not perform heuristic analysis
bit 1: (0002) Ignore CRC changes (self-modifying file)
bit 2: (0004) Scan for all signatures (LAN remote boot file)
bit 3: (0008) Do not change read-only attribute of this file
bit 4: (0010) The program stays resident in memory
bit 5: (0020) The program performs direct disk access
bit 6: (0040) Program is allowed to remove read-only
attributes
bit 15: (8000) Interrupt rehook required for TBDRIVER.EXE
The following are a few example entries from a TBSETUP.DAT file:
; filename Length 32-bit CRC Flags Comment
; Files that trigger the heuristic alarm of TbScan:
4DOS.COM 19FEA * 0001 ;4Dos 4.0a
AFD.COM 0FEFE 4B351A86 0001 ;AFD debugger
ARGV0FIX.COM 001D8 431E70C0 0001 ;Argv[0]fix
EXE2COM.EXE 00BEA 49276F89 0001 ;Exe to Com conv. util
KILL.EXE 00632 74D41811 0001 ;PcTools 6.0 utility
WATCH.COM 003E1 2353625D 0001 ;TSR monitoring util
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 152
; Files that need to be scanned completely, for ALL viruses:
NET$DOS.SYS * * 0004 ;Disk-image Novell boot
; Files without fixed checksum due to internal config area's:
Q.EXE * * 000A ;Qedit (all versions)
TBCONFIG.COM * * 000A ;all versions
Defining New Entries in TBSETUP.DAT
If you have any files that we should include in TBSETUP.DAT, please let
us know! We would like to receive a copy to enhance our products and keep
TBSETUP.DAT up to date. Candidates for inclusion are any programs that
trigger the heuristic analysis of TbScan.
Whenever you choose "V)alidate program" in the TbScan message window, you
will discover that on subsequent occasions TbSetup displays the value
"0001" in the flags field. If your company has several files like this
installed on multiple machines, you might want to include these files in
the TBSETUP.DAT file yourself. To do this, execute TbSetup for the file
in question and make a note of its file length and 32-bit CRC, as
displayed on the screen. Then edit the TBSETUP.DAT file, entering the
exact filename, the file length, and the CRC number, plus the number of
any flags you wish to set for that file. If you now use TbSetup on
another machine (using the updated TBSETUP.DAT file), it sets the
appropriate flags automatically.
TIP:
You can manually set or clear a flag field value when executing
TbSetup at the DOS prompt using the SET or RESET option as follows:
TBSETUP TEST.EXE SET=0001.
4.2.3 Simplifying Installation on Several Machines
If you need to install the TBAV utilities on several machines in one
company, it would be tedious, for example, to run every TSR and disk
utility on each machine to "teach" TBAV which programs are valid and
which are not. Fortunately, this is not necessary. We present here some
examples of how to simplify installation on several machines.
If a resident utility named, for example, TSRUTIL.EXE, is in use
throughout the company, you can predefine permission by using TbSetup.
First, use TbSetup to determine the length and CRC of the program.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 153
Second, put the name of the program, along with its other information,
in the TBSETUP.DAT file, and then assign the flag 0010 to it:
TSRUTIL.EXE 01286 E387AB21 0010 ;OUR TSR UTILITY
If a disk utility named, for example, DISKUTIL.EXE, is in use throughout
the company, you can predefine permission by using TbSetup. First, use
TbSetup to determine the length and CRC of the program. Second, put the
name of the program, along with its other information, in the TBSETUP.DAT
file, and then assign the flag 0020 to it:
DISKUTIL.EXE 01286 E387AB21 0020 ;OUR DISK UTILITY
If a utility named, for example, UTIL.EXE, causes TbScan to give false
positives and is in use throughout the company, you can use TbSetup to
"teach" TbScan to avoid heuristic scanning of the program. First, use
TbSetup to determine the length and CRC of the program. Second, put the
name of the program, along with its other information, in the TBSETUP.DAT
file, and then assign the value 0001 to it:
UTIL.EXE 01286 E387AB21 0001 ;OUR UTILITY
If you now run TbSetup on every machine (you have to do this anyway), it
recognizes the utilities you added in the TBSETUP.DAT file. Additionally,
all the TBAV utilities automatically adapt their behavior for those
files.
TIP:
Consult the TBSETUP.DAT file itself. It contains useful comments on
this subject.
4.3 Understanding TbScan
This section offers advanced information about TbScan, including:
heuristic scanning, integrity checking, program validation, algorithms,
and the TBSCAN.LNG file.
4.3.1 Understanding Heuristic Scanning
What makes TbScan so unique is that it is not just a signature scanner,
but it is also a disassembler. It disassembles files for the following
purposes:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 154
By disassembling a file, the scanner restricts itself to the area of
the file where the virus might reside, reducing false alarms and
speeding up the process. Disassembling a file makes it possible to
use the algorithmic detection method on encrypted viruses whose
signatures would otherwise remain invisible to the scanner.
Disassembling the file makes it possible to detect suspicious
instruction sequences.
This detection of suspicious instruction sequences is "heuristic
scanning." This extremely powerful feature enables you to detect new or
modified viruses and to verify the results of the signature scan. You no
longer have to rely on the scanner's publisher having the same virus as
you might have. In normal cases a scanner can find a virus only if the
scanner's publisher had a sample of that virus and includes that virus's
signature in a signature file. In contrast, heuristic scanning does not
require signatures, enabling the scanner to detect yet unknown viruses by
looking for the characteristics of a virus instead of a signature.
Never underestimate the importance of heuristic scanning, since every
month at least 50 new viruses are reported, and it is extremely unlikely
that a publisher is the first one to get a new virus.
TbScan distinguishes two heuristic levels. The following table describes
the properties of these levels:
Heuristic Level 1 Heuristic Level 2
----------------------- ---------------------------------------
always enabled only enabled with command-line option
"heuristic", or TBAV menu option "High
heuristic sensitivity," or after a virus
has been found
detects 50 % of (yet) detects 90 % of (yet) unknown viruses
unknown viruses
almost never causes might cause few false alarms
false alarms
displays "Probably displays "Might be infected"
infected"
The following lines show the effect of scanning four files, each having
its own characteristics. Please note the heuristic flags that appear next
to the word "scanning."
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 155
FILE1.EXE scanning...OK (no flags)
FILE2.EXE scanning...ROK (nothing serious)
FILE3.EXE scanning...FRM might be infected by unknown virus
FILE4.EXE scanning...FRALM# probably infected by unknown virus
It is obvious from these four examples that heuristic scanning (resulting
in the heuristic flags) is very powerful for finding yet unknown viruses.
4.3.2 Understanding How Heuristic Scanning Works
Every program contains instructions for the computer's microprocessor. By
looking into the file's contents and interpreting the instructions,
TbScan is able to detect the purpose of these instructions. If the
purpose appears to be formatting a disk, or infecting a file, TbScan
issues a warning. There are many instruction sequences that are very
common for viruses but are very uncommon for normal programs. TbScan,
therefore, assigns every suspicious instruction sequence to a character
called a heuristic flag. Every heuristic flag denotes a score. If the
total score (that is, the sum of scores for each flag that triggered)
exceeds a predefined limit, TbScan assumes the file contains a virus.
There are actually two predefined limits. The first limit is quite
sensitive and can be reached by some normal innocent programs. If the
suspicious program reaches this limit, TbScan highlights the heuristic
flags that appear on the screen and increases the suspicious item's
counter. TbScan does not indicate the existence of a virus unless you
specify the heuristic or high heuristic sensitivity option. If you do
specify this option, TbScan informs you that the file Might be infected
by an unknown virus.
In contrast to the first option, many viruses trigger the second
heuristic limit, while normal programs do not. If a suspicious program
reaches this limit, TbScan informs you that the file is Probably
infected by an unknown virus.
NOTE:
TbScan performs heuristic analysis only near the entry-point of a
file. Therefore, TbScan does not detect direct writes to disk by
some disk utilities nor does it detect some programs as TSR
programs. This is simply the result of a specific approach that
minimizes false alarms. In case of a virus, the offending
instructions are always near the entry-point (except when the virus
is over 10Kb in size), so TbScan detects suspicious
phenomena in these situations anyway.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 156
4.3.3 Understanding Integrity Checking
TbScan performs integrity checking while scanning. For this purpose, you
must use TbSetup to generate the ANTI-VIR.DAT files. Once these files
exist on your system, TbScan verifies that every file being scanned
matches the information maintained in the ANTI-VIR.DAT files. If a virus
infects a file, the maintained information no longer matches the now
changed file, and TbScan informs you of this.
NOTE:
There are no command line options to enable this feature. TbScan
performs integrity checking automatically if it detects the ANTI-
VIR.DAT files.
Note that TbScan reports only those file changes that could indicate a
virus. While internal configuration areas of program files might also
change, TbScan normally does not report these. If a file becomes infected
with a known or unknown virus, however, the vital information does change
and TbScan does indeed report it to you!
In contrast, there might be files that change themselves frequently or
change frequently due to another cause. In such a case you might want to
exclude the program from integrity checking to avoid future false alarms.
If TbScan detects such a change, it informs you of it. Additionally,
TbScan offers the possibility to Validate the program, which is the
subject of the next section.
Understanding Program Validation This section applies only if you use
TbSetup to generate the ANTI-VIR.DAT records. Without these records,
program validation is not an option.
TbScan performs as intended on most programs. There are some programs,
however, that require special attention in order to avoid false alarms.
TbSetup recognizes most of these programs automatically. Nevertheless it
is certainly possible your PC contains some program files that trigger
the heuristic alarm of TbScan and/or programs files that change
frequently.
If TbScan finds an infection using heuristic analysis or integrity
checking, and if there is an ANTI-VIR.DAT record available, it offers an
additional option in its virus-alert window, namely, V)alidate program.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 157
If you are sure that the indicated program does not contain a virus, you
can press V to set a flag in the program s ANTI-VIR.DAT record. This
avoids future false alarms.
There are two validation modes. If TbScan alarms you to a file change,
the validation applies to future file changes only. If the alarm is due
to heuristic analysis, the validation applies only to heuristic results.
If you exclude the file from heuristic analysis, TbScan still performs an
integrity check. Conversely, if you exclude the file from integrity
checking, TbScan still performs heuristic analysis.
CAUTION:
If you replaced a file (for example, because of a software upgrade)
and you did not apply TbSetup to the changed files, TbScan pops up
its virus alert window to inform you of the file change. Do not
select the validation option in this case, because this would
exclude the file from future integrity checking. You should abort
TbScan and execute TbSetup on the changed file(s) instead.
4.3.4 Understanding the Scan Algorithms
When TbScan processes a file it displays one of the following messages:
Looking.
"Looking" indicates that TbScan has successfully located the entry
point of the program in one step; that is, it has identified the
program code so it knows where to search without the need of
additional analysis. TbScan uses "Looking" on most known software.
Checking.
"Checking" indicates TbScan has successfully located the entry point
of the program, and is scanning a frame of about two kilobytes
around the entry point. If the file is infected, the virus signature
appears in this area. "Checking" is a very fast and reliable scan
algorithm, so TbScan applies it to most unknown software.
Tracing.
"Tracing" means that TbScan has successfully traced a chain of jumps
or calls while locating the entry point of the program and is
scanning a frame of about two kilobytes around this location. If the
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 158
file has been infected, the signature of the virus appears in this
area. "Tracing" is a fast and reliable scan algorithm. TbScan uses
it primarily for memory resident COM programs. Most viruses force
TbScan to use "Tracing."
Scanning.
"Scanning" indicates that TbScan is scanning the entire file (except
for the EXE-header that cannot contain any viral code). It uses this
only if it can't safely use "Looking," "Checking," or "Tracing."
Such is the case when the entry point of the program contains other
jumps and calls to code located outside the scanning frame, or when
the heuristic analyzer finds something that you should investigate
more thoroughly. Because Scanning is a slow algorithm, it
processes almost the entire file, including data areas, and it is
more likely to trigger false alarms. TbScan uses this algorithm when
scanning boot sectors, SYS files, and BIN files.
Skipping.
"Skipping" occurs only with SYS and OVL files. It simply means that
the file will not be scanned. As there are many SYS files (such as
CONFIG.SYS) that contain no code at all, it makes absolutely no
sense to scan these files for viruses. The same applies to .OV?
files. Many overlay files do not deserve the name overlay because
they lack an EXE-header. Such files cannot execute through DOS,
which in-turn makes them just as invulnerable to direct virus
attacks as .TXT files. If TbScan reports that a virus has infected
an .OV? file, that file is one of the relatively few overlay files
that does contain an EXE-header. In such a case, the infection was
the result of the virus monitoring the DOS exec-call (function 4Bh)
and thereby infecting any program that executes that way, including
real overlay files.
Decrypting.
TbScan detected that the file is encrypted, and decrypts it to be
able to "look inside." TbScan performs signature scanning and
heuristic analysis on the decrypted code since that is very reliable
and also reveals polymorphic viruses.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 159
4.3.5 Understanding the TBSCAN.LNG File
The TBSCAN.LNG file contains all the text that TbScan displays. You can
translate or customize the messages with any ASCII editor. A dollar sign
[$] separates the messages.
The first message displays our address and registration information. You
can edit this message as you please, adding, for example, your company
name and logo.
CAUTION:
Take care in customizing messages so that you don't change the
essence of the message.
You can also add color codes to the TBSCAN.LNG file. You must precede a
color code with the "pipe" [|] character. Each color code consists of a
foreground (or highlight) color and a background color. The following
table lists the available color codes (all numbers are in hexadecimal
notation):
Color Foreground Highlight Background
--------- -------------- -------------- ----------
Black 00 08 00
Blue 01 09 10
Green 02 0A 20
Cyan 03 0B 30
Read 04 0C 40
Magenta 05 0D 50
Brown 06 0E (yellow) 60
Gray 07 0F (white) 70
To make characters blink, add 80 to the background color codes.
Here are few examples of defining colors:
To make a highlighted green character on a red background, use the
color code 0A+40=4A. To make the character blink, add 80h to the
result (4A+80=CA). To display white characters on a blue background,
use the color code 0F in combination with color code 10: 0F+10=1F.
If you prefer a cyan background with a gray foreground, you should
add 30 to 07 (30+07=37). If you want the characters to blink, the
color code becomes 37+80=B7.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 160
4.3.6 Understanding the TBAV.MSG File
The TBAV menu displays the contents of a file named TBAV.MSG, if it
exists in the ThunderBYTE directory. You can use this feature to display
your company logo on the TBAV screen. As in the TbScan language file, you
can embed color codes in this file. Consult the previous section for more
information about color codes.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 161
4.4 Understanding TbClean
This section takes a look at how TbClean works by explaining how a virus
goes about infecting a file and the difference between conventional
cleaners and generic cleaners.
4.4.1 Understanding how a Virus infects a file
To understand how a cleaning program works, try to imagine how a virus
usually goes about infecting a program. The basic principle is really
quite simple. A virus, which is simply another computer program, adds
itself to the end of the program it infects. The additional viral code
obviously increases the size of the program.
Simply appending a viral program to another program, however, is not
enough to do any real harm. To do damage, the viral code must first be
executed. To accomplish this, the virus grabs the first few bytes at the
start of the program and replaces them with a jump instruction to its
own viral code. That way the virus is able to take control when the
program starts. Chances are you will never even notice the momentary
delay while the extra code executes and does whatever the virus has been
programmed to do. The virus then restores the original instructions and
restarts the program (jumps to the original start of the program). Your
program, more often than not, works as usual, and of course, any virus
worth its salt makes sure it doesn't draw undue attention to itself, at
least not too soon.
So, in order to purge a program, we must first restore the starting
instruction bytes, which the virus replaced with the jump to its own
code. The virus is going to need these bytes again later on, so it stores
them somewhere in the viral code. The cleaner starts out to find those
bytes, puts them back in their proper place, and trims the file to the
original size.
Cleaner programs basically come in two types: the conventional type, for
specific types of viruses, and the far more advanced generic cleaner,
which offers a much wider scope. Let's take a closer look at both cleaner
types and find out where they differ.
4.4.2 Understanding Conventional Cleaners
A conventional cleaner has to know which virus to remove. Suppose one of
your programs is infected with a Jerusalem/PLO virus. This means that the
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 162
infected program has grown in size in comparison with the original
program, and that the first few bytes have been replaced by a "jump"
instruction to the viral code. The following drawing ilustrates this
process:
original program infected program
+--------------+ +--------------+
| | | |
| p | 100: |jump |
| r | |to 2487 |
| o | | o |
| g | | g |
| r | | r |
| a | | a |
| m | | m |
| | | |
| c | | c |
| o | | o |
| d | | d |
| e | | e |
| | | |
+--------------+ +--------------+
2487: | |
| VIRUS! p |
| r |
|jmp 100 |
+--------------+
When you start a conventional cleaner, a procedure much like the
following takes place:
"Hey, the signature file tells me this file is infected with the
Jerusalem/PLO virus. Okay, let's see, this virus tacks on 1873 bytes
at the end and overwrites the first three bytes of the original
program with a jump to itself. The original bytes are located at
offset 483 in the viral code. So, I have to take those bytes, copy
them to the beginning of the file, and then remove 1873 bytes of the
file. That's it!"
But there are several pitfalls to worry about in a scenario like this.
For one thing, the cleaner obviously must have some means to recognize
the virus it should remove. A conventional cleaner cannot cope with a
virus unless it knows exactly what to look for.
To make matters worse, it's even more important to establish whether or
not the virus is exactly the same one that the cleaner knows about.
Imagine what would happen if the virus in our example had been modified
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 163
and is now 1869 bytes in size instead of 1873. The cleaner would remove
too much! This is not an exceptional case at all. On the contrary, there
is a virtual epidemic of countless so-called mutant strains. The
Jerusalem/PLO family, to name but one example, now has more than 100
mutant members!
4.4.3 Understanding Generic Cleaners
A generic cleaner works on the principle that any kind of virus, whether
or not it has made the signature "charts," is just plain bad news. That's
why TbClean works with a completely different disinfection scheme that is
effective with almost all viruses; it doesn't even need to recognize
them. Actually, TbClean represents two cleaners in one: a "repair"
cleaner and a "heuristic" cleaner.
Repair cleaning
Repair cleaning needs an ANTI-VIR.DAT file generated by TbSetup before
the infection occurred. The ANTI-VIR.DAT file stores vital information
about programs, including their original size, the first few instruction
codes, and a cryptographic checksum. This information is usually all it
takes to disinfect a file, no matter what virus, known or unknown, caused
the infection. The cleaner simply restores the bytes at the beginning of
the program, trims the file to its original size, and verifies the result
using the original checksum. It's just that simple (and effective).
Heuristic cleaning
TbClean is the first cleaner in the world that has a heuristic cleaning
mode. Like the repair cleaner, this mode does not need any information
about viruses either, but it also has the added advantage that it doesn't
even care about the original, uninfected state of a program. This
cleaning mode is very effective if your system becomes infected with an
unknown virus and you neglected to let TbSetup generate the ANTI-VIR.DAT
files before infection.
In heuristic mode, TbClean loads the infected file and starts emulating
the program code. It uses a combination of disassembly, emulation and,
sometimes, execution to trace the flow of the viral code, pretending to
do more or less exactly what the virus would normally be doing. When the
virus gets to the original program's instructions and jumps back to the
original program code, TbClean stops the emulation process, with a
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 164
tongue-in-check thank you to the virus for its cooperation in
restoring the original bytes.
The actual cleaning process involves almost the same three steps as with
repair cleaning. First, TbClean repairs the program startup code and
copies it back to the file. Second, it removes the now ineffective code
for the sake of security. Third, it does a final analysis of the purged
program file.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 165
4.5 Using TbGenSig
This final section of Chapter 4 introduces you to TbGenSig, an advanced
user utility that enables you to define your own virus signatures.
4.5.1 Understanding and using TbGenSig
TbGenSig is a signature file compiler. Since we distribute TBAV with an
up to date, ready-to-use signature file, you do not really need the
signature file compiler.
If, however, you want to define your own virus signatures, you will need
this utility. You can use either published signatures or define your own,
if you are familiar with the structure of software.
One way or another, you need to do this only in case of an emergency,
such as in the unfortunate event that a yet unknown, and thus
unrecognized, virus attacks your machine, or even your company. We
recommend that you send a few samples of the virus to some of our
researchers, to insure that they can be examined and the results included
in one of the subsequent updates to our software.
NOTE:
Since it's not possible to explain the whole subject of virus
hunting in one manual, this section assumes you have enough
experience and knowledge to create your own virus signatures.
TbGenSig searches for the USERSIG.DAT file in the current directory. This
file should contain the signatures you want to add to the TBAV signature
file TBSCAN.SIG. TbGenSig checks the contents of the USERSIG.DAT file and
applies it to the TBSCAN.SIG file.
If you want to delete or modify your signatures, just edit or delete the
USERSIG.DAT file and run TbGenSig again.
TbGenSig lists all signatures in the TBSCAN.SIG file on screen as it
runs.
4.5.2 Working with TbGenSig
This section describes how to use TbGenSig. It outlines how to format the
text in the USERSIG.DAT file, add published signatures, define your own
signatures, and other procedures.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 166
Formatting Text in USERSIG.DAT
You can create and edit the USERSIG.DAT file using any DOS text editor
(such as DOS 5+ EDIT program) that uses un-formatted (ASCII) text. All
lines starting with a semicolon (;) are comment lines. TbGenSig ignores
these lines. Lines starting with a percentage character (%) appear in the
upper TbGenSig window.
The first line should contain the name of a virus, the second line
contains one or more keywords, and the third line contains the signature
itself. We call this combination of three lines a signature record. A
signature record should look like this:
TEST VIRUS
EXE COM INF
ABCD21436587ABCD
You can use spaces in the signature for your own convenience; TbGenSig
will just ignore them.
Adding a Published Signature
As outlined above, adding an already published signature is simply a
matter of editing or creating the USERSIG.DAT file to convert the
signature to an acceptable format for TbGenSig. Format the three lines
to include the virus name, keywords, and the signature, as in the
following:
NEW VIRUS
EXE COM BOOT INF
1234ABCD5678EFAB
After editing the file, execute TbGenSig.
4.5.3 Defining a Signature with TbScan
This section is for advanced users who have registered their copy of
ThunderBYTE Anti-Virus.
Although the TBSCAN.SIG file updates frequently, new viruses appear every
day, outpacing the regular upgrading service of the TbScan signature
file. It is possible for your system to become infected by a recently
created virus not yet listed in the signature file. TbScan will not
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 167
always detect the virus in such cases, not even with its heuristic
analysis. If you are sure that your system has become infected without
TbScan confirming this, this section will supply you with a valuable tool
to detect unknown viruses. This section offers step-by-step assistance in
creating an emergency signature that you can (temporarily) add to your
copy of TbScan.Sig
1. Collect some infected files and copy them into a temporary
directory.
2. Boot from a clean write-protected diskette.
WARNING:
Do NOT execute ANY program from the infected system, even
though you expect this program to be clean.
3. Execute TbScan from your write-protected TbScan diskette using
the EXTRACT option. Make sure that the temporary directory where
you stored the infected files is TbScan's target directory. Using
the EXTRACT option, TbScan will NOT scan the files but, instead,
displays the first instructions that it finds at the entry-point of
the infected programs.
NOTE:
We recommend that you also set TbScan's LOG option to generate
a log file.
4. Compare the "signatures" extracted by TbScan. You should see
something like this:
NOVIRUS1.COM 2E67BCDEAB1290909 09090 ABCD123490CD
NOVIRUS2.COM N/A
VIRUS1.COM 1234ABCD5678EFAB9 09090 ABCD123478FF
VIRUS2.COM 1234ABCD5678EFAB9 01234 ABCD123478FF
VIRUS3.COM 1234ABCD5678EFAB9 A5678 ABCD123478FF
If the "signatures" of the files are completely different, the files
are either probably not infected, or they have become infected by a
polymorphic virus that requires an algorithmic detection module to
detect it.
5. If there are some differences in the "signatures," you can use
the question mark wildcard (?). A signature to detect the virus in
the example above could be:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 168
1234ABCD5678EFAB ?3 ABCD123478FF
The "?3" means that there are three bytes at that position that
should be skipped. Note that two digits in the signature represent a
byte in your program.
6. Add the signature to USERSIG.DAT. Give the virus a name in the
first line of its entry, specify the COM, EXE, INF, and ATE in the
second line, and enter the signature in the third, as in the
following:
NEW VIRUS
EXE COM ATE INF
1234ABCD5678EFAB?3ABCD123478FF
7. Run TbGenSig. Make sure the resulting TbScan.Sig file is in the
TBSCAN directory.
8. Run TbScan again in the directory containing the infected files.
TbScan should now detect the virus.
9. Send a couple of infected files to a recommended virus expert,
preferably to the ThunderBYTE Corporation.
Congratulations! You have defined a signature all by yourself! Now you
can scan all your machines in search of the new virus.
CAUTION:
Keep in mind that this method of extracting a signature is a
"quick-and-dirty" solution to viral problems. The extracted
signature might not detect the presence of the virus in all cases.
You can make a signature guaranteed to detect all instances of the
virus only after complete disassembly of the new virus. For these
reasons you should NEVER distribute your home-made "signature" to
others. In most cases, the signature eventually assembled by
experienced anti-virus researchers may be different from your
homemade version.
4.5.4 Understanding Keywords
You can use keywords for several purposes. You can separate them by
spaces, commas, or tabs and use a maximum line length of 80 characters.
You also should specify at least one of the following flags: BOOT, COM,
EXE, HIGH, LOW, SYS, or WIN.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 169
These seven flags fall into three categories: "Item Keywords," "Message
Keywords," and "Position Keywords."
Using Item Keywords
Item keywords tell the scanner where to search for viruses with those
keywords. For example, the BOOT keyword tells the scanner that the
accompanying virus signature can reside only in a boot sector or
partition table. The Item keywords include the following:
BOOT. Specifies that the signature can be found in boot sectors
and/or partition tables.
COM. Specifies that the signature can be found in COM programs.
This flag instructs the scanner to search for this
signature in executable files that do not have an EXE
header or device header.
NOTE: Always keep in mind that the file content determines
the file type, not the filename extension!
EXE. Specifies that the signature can be found in EXE programs.
This flag instructs the scanner to search for this
signature in the load module of EXE type files. EXE files
are files that have an EXE header. (See the Note under the
COM keyword.)
HIGH. Specifies that the signature can be found in HIGH memory
(above program).This flag instructs the scanner to search
for this signature in memory above the memory allocated by
the scanner. This keyword is for resident viruses that
allocate memory at "system boot" or viruses that decrease
the size of the last MCB (Memory Control Block). Please
note that the flag HIGH does not mean that the signature
should be searched in UPPER memory.
LOW. Specifies that the signature can be found in LOW memory.
This flag instructs the scanner to search for this
signature in memory below the PSP (Program Segment Prefix)
of the scanner and in the UMBs (Upper Memory Blocks). This
keyword is for viruses that remain resident in memory,
using the normal DOS TSR (Terminate and Stay Resident)
function calls.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 170
SYS. Specifies that the signature can be found in SYS programs,
such as device drivers.
WIN. Specifies that the signature can be found in Windows
programs.
Message keywords
Message keywords describe the type and behavior of the virus. For each
keyword, this results in the scanner displaying a different message when
it finds such a virus. These keywords include the following:
DAM. Message prefix: damaged by.
DROP. Message prefix: dropper of.
FND. Message prefix: found the.
INF. Message prefix: infected by.
Message suffix: virus.
JOKE. Message prefix: joke named.
OVW. Message prefix: garbage: (not a virus).
PROB. Message pre-prefix: probably.
TROJ. Message prefix: trojanized by.
Position keywords
Position keywords indicate special file areas where the virus can be
found. If you use a position keyword, the virus must reside at the
specific position. TbGenSig can handle three position keywords:
UATE. Specifies that the signature starts directly at the
unresolved entry-point of the viral code. With some
polymorphic viruses, it might be possible to create a
signature from the degarbling routine, although it might
be either too short or give false positives with a global
search. An initial branch instruction can be part of the
signature. The unresolved entry-point is defined for COM-,
EXE-, and Windows-type files:
COM type files: top of file (IP 0100h).
EXE type files: CS:IP as defined in the EXE-header.
WIN type files: Non-DOS CS:IP of the new EXE-header.
NOTE:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 171
The UATE keyword is not allowed for BOOT, SYS, LOW,
HMA, or HIGH type signatures.
ATE. Specifies that the signature starts directly at the
entry-point of the viral code. With some polymorphic
viruses, it might be possible to create a signature from
the degarbling routine, although it might either be too
short or give false positives with a global search.
Therefore, use the ATE keyword to ensure that the scanners
do not scan the entire file for the signature, but only
look at the entry-point for the signature.
The first instruction that is not equal to either a "JUMP
SHORT," a "JUMP," or a "CALL NEAR" instruction defines the
entry point of a virus.
Let's examine the following code fragment:
Unresolved entry point: 1 JUMP SHORT 3
2 ...
3 JUMP 5
4 ...
5 CALL NEAR 7
6 ...
7 CALL NEAR 9
8 ...
Resolved entry point: 9 POP <reg>
The entry-point of the above fragment is Line 9, as this
is the first instruction to execute that is not a "JUMP
SHORT," a "JUMP," or a "CALL NEAR."
NOTE: You can determine the entry-point by a code analyzer
to cope with tricks such as coding an NOP or DEC just
before the branch instruction. Therefore test the results
of the scanner carefully. In case of trouble, use the
TbScan EXTRACT option to find out what TbScan considers to
be the entry point of the program. Also, the ATE flag is
not allowed for BOOT, SYS, LOW, HMA or HIGH type
signatures.
XHD. Specifies that the signature can be found at offset 2 of
the EXE header, but is rarely used. You should use it only
to detect the also very rare high-level language viruses,
viruses written in a programming language such as C or
Basic. These viruses normally contain standard setup
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 172
routines and library routines that are not suitable to
defining a signature. Use this keyword as a last resort to
detect such viruses.
NOTE:
You can use this flag only for EXE or WIN type
signatures.
Using Wildcards
You can use wildcards characters in a virus signature to recognize so
called polymorphic (self-modifying or self-mutating) virus code.
TbGenSig distinguishes two wildcard categories: position wildcards and
opcode wildcards (note that all numbers are in hexadecimal):
Using Position Wildcards
Position wildcard affect the position where the parts of the signature
match.
Skip fixed amount of bytes
?n Skip n bytes and continue.(0h <= n <= Fh)
?@nn Skip nn bytes and continue.(00h <= nn <= 7Fh)
Skip variable amount of bytes
*n Skip up to n bytes and continue. (0h <= n <= Fh)
*@nn Skip up to nn bytes and continue. (00h <= nn <= 1Fh)
Using Opcode wildcards
The opcode wildcards detect instruction ranges.
Low opcode
nL One of the interactions in the range of n0h to n7h.
High opcode
nH One of the interactions in the range of n8h up to nFh.
Since the opcode wildcards are rather difficult to understand, let's
explore an example.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 173
Suppose a polymorphic virus puts a value in a word register (using a MOV
WREG,VALUE instruction), increments a register (using an INC WREG
instruction), and pops a word register from the stack (using a POP
instruction). Both the registers and the value are variable. This means
that the signature you are writing to detect this virus should be able to
detect all code sequences for every value of the registers and the value,
but this is far too much work. Now, consider that B8-BF are the opcodes
for MOV WREG,VALUE, that 40-47 are the opcodes for INC WREG, and that
58-5F are the opcodes for POP REG.
By using the opcode wildcards, you can detect a sequence of these three
instructions using the following signature fragment:
bH4L5H
4.5.5 Understanding a Sample Signature: Haifa.Mozkin
To show the power of using the appropriate keywords and wildcards, here
is the signature of the Haifa.Mozkin virus. This virus is highly
polymorphic and encrypted. It contains a small variable decryptor to
decrypt the virus.
There are two problems here: most bytes are encrypted or variable, thus
not suitable to be part of a signature, and the remainder is short and
would cause dozens of false alarms.
Using the appropriate keywords and wildcards, however, it s possible to
define a reliable signature. TbScan actually uses the signature below to
detect the Haifa.Mozkin virus.
Haifa.Mozkin
com exe ate inf
bh?2bh?109?2*22e80?24l4h75fl
Now let's analyze this signature. The first line describes the name of
the virus. The second line tells the scanner to search for this signature
in COM and EXE type files. It also tells the scanner that it should
report the file as infected if the signature matches. The keyword ATE
instructs the scanner to match this signature only at the resolved
entry-point of the file. The virus starts, of course, by decrypting
itself, so it is certain that the scanner will scan this location. The
ATE instruction limits the scope of this signature to just one position
in a file, so this significantly reduces the chances of false alarms.
The third line is the signature definition. Let's reverse engineer it:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 174
bh?2 Means a byte in the B8-BF range is followed by two
variable bytes. B8-BF is a MOV WREG,VALUE instruction.
From the register we only know it is a word register; the
value is unknown as well.
bh?109 Means another MOV WREG,VALUE instruction. The register is
a word register, and from the value we know that it is in
the range 0900 to 09FF.
?2*2 Means skip two to four bytes. The virus inserts this
instruction to make it harder to define a signature.
2e80?2 Means that the virus performs an arithmetic byte sized
operation with an immediate value (decrypts one byte) with
a CS: segment override. The exact operation, the memory
location, and the value are unknown.
4l Means a byte in the 40-47 range. This is an INC WREG
instruction. The virus increments the counter to the next
byte to be decrypted.
4h Means a byte in the 48-4F range. This is a DEC WREG
instruction. The virus decrements the iteration count.
75fl Opcode 75 is a JNZ instruction. If the decremented
register did not reach zero, the virus jumps back and
repeats the operation. How much does it jump? That tells
the fl part: somewhere between -16 (F0h) to -8 (F7h)
bytes.
NOTE:
Although the signature language of TbGenSig is extremely powerful,
there are viruses that are simply so highly polymorphic that they
require even more sophisticated wildcards, keywords, or even special
detection algorithms. The explanation of these wildcards, keywords,
and algorithmic detection definitions, however, is beyond the scope
of this user manual.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 175
Appendices
Appendix A: TBAV messages
The TBAV utilities might display various messages when run. Most messages
are self-explanatory, but here is some additional information about
specific messages.
A.1 TbClean
ANTI-VIR.DAT record found: information matches the currentstate of the
file.
The ANTI-VIR.DAT record has been found, but the information matches
the current state of the file.
The ANTI-VIR.DAT file was created after the infection. Trying
emulation...
The ANTI-VIR.DAT record was created after the file became infected,
or the file is not changed at all. TbClean is going to emulate the
file to clean it heuristically.
ANTI-VIR.DAT record found: reconstructing original state...
The ANTI-VIR.DAT record that belongs to the infected file has been
found. The information will be used to reconstruct the file.
ANTI-VIR.DAT record not found: original state unknown. Trying
emulation...
The ANTI-VIR.DAT file did not exist or did not contain information
about the infected program, so the original state of the infected
program is unknown to TbClean. TbClean switches to its heuristic
mode to determine the state of the original file.
NOTE:
To prevent this situation, use the TbSetup program to generate
the ANTI-VIR.DAT records. These records are of great help to
TbClean. After infection, it's too late to generate the
ANTI-VIR.DAT records.
Emulation terminated: <Reason>
The emulation process terminated for the reason specified. TbClean
now consults the collected information to see if it can disinfect
the file. The reason for termination can be one of the following:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 176
Jump to BIOS code. The virus tried to perform a call or jump
directly into BIOS code. TBAV cannot emulate this process, so
aborts. The infected program probably cannot be disinfected.
Approached stack crash. The emulated program is approaching a
crash. Something went wrong while emulating the program so it
aborts. The infected program probably cannot be disinfected.
Attempt to violate license agreements. TbClean will not
disassemble this program for obvious reasons.
Encountered keyboard input request. The emulated program tries
to read the keyboard. This is very unusual for viruses, so the
file is probably not infected at all.
Encountered an invalid instruction. The emulator encountered an
unknown instruction. For some reason the emulation failed. The
infected program probably cannot be disinfected.
DOS program-terminate request. The emulated program requests
DOS to stop execution. The program is either not infected at
all, or infected by an overwriting virus that does not pass
control to its host program. The infected program cannot be
disinfected.
Jumped to original program entry point. The program jumped back
to the start position. It is very likely infected, but can
probably be disinfected.
Undocumented DOS call with pointers to relocated code. This is
very common for viruses that add themselves in front of the COM
type program. The program can probably be disinfected.
Encountered an endless loop. TbClean encountered a situation in
which the program is executing the same instruction sequences
repeatedly for hundreds of thousands of times. It is unlikely
that the program will ever escape from this loop, so the
emulation aborts.
Ctrl-break pressed. The user pressed <Ctrl>-<Break> so the
clean attempt aborts.
Emulation aborted for unknown reason. If this message appears,
please send a copy of the file being emulated to the
ThunderBYTE organization or one of the support BBS .
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 177
Sorry, the collected information is not sufficient to clean
file... The heuristic cleaning mode of TbClean aborts with
success. The only option left is to restore the file from a
backup or to re-install the program.
Collected enough information to attempt a reliable clean
operation... The emulation of the virus provided TbClean with
all information needed to disinfect the file.
Some DOS error occurred. TbClean aborted! Some DOS error
occurred while trying to clean the file. Check that no files
are read-only or located on a write protected disk, and make
sure there is a reasonable amount of free disk space.
The clean attempt seems to be successful. Test the file
carefully! TbClean thoroughly and reliably removed the virus
from the file. However, take care and test the file carefully
to see if it works as correctly.
Reconstruction failed. Program might be overwritten. Trying
emulation... TbClean tried to reconstruct the original file
with the help of the ANTI-VIR.DAT record, but the attempt
failed. TbClean is going to emulate the file to try to clean it
heuristically.
Reconstruction successfully completed. TbClean has
reconstructed the file to its original state with the help of
the information in the ANTI-VIR.DAT record. The CRC (checksum)
of the original file and the cleaned file are completely equal,
so it is almost certain that the cleaned file is equal to the
original file.
Starting clean attempt. Analyzing infected file... TbClean is
analyzing the infected file and trying to locate the
ANTI-VIR.DAT record.
A.2 TbDriver
Another version of TbDriver is already resident!
You started a TBDRIVER.EXE with another version number or processor
type than the TbDriver already in memory.
Cannot remove TbDriver. Unload other TSRs first!
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 178
You tried to remove TbDriver from memory, but other resident
software was loaded after TbDriver. You can only remove resident
programs from memory by unloading them in reverse order.
LAN support was already installed.
You tried to use the NET option a second time, or TbDriver already
enabled network support automatically.
TbDriver not active. Load TbDriver first!
The resident TBAV utilities need TbDriver, so you need to load
TbDriver first.
TbDriver is not <version>.
The version of TbDriver found in memory does not match the version
number of this resident TBAV utility. Be sure you do not mix version
numbers!
This version of TbDriver requires a <typeID> processor.
You are using a processor optimized version of TbDriver that the
current processor cannot execute.
A.3 TbScan
Cannot create logfile.
The specified log file path is illegal, the disk is full or write
protected, or the file already exists and cannot be overwritten.
[Cannot read datafile]
TbScan needs access to its data file to be able to tell you the name
of the virus. If it cannot access the data file, it displays this
message instead of the virus.
Command line error.
You specified an invalid or illegal command line option.
No matching executable files found.
The specified path does not exist, is empty, or is not an executable
file.
Sanity check failed!
TbScan detected that its internal checksum no longer matches. It is
possible that TbScan is contaminated by a virus. Obtain a clean copy
of TbScan, copy the program on a write protected system diskette,
boot from that diskette, and try again.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 179
A.4 TbScanX
Data file not found.
TbScanX cannot locate the data file.
Not enough memory.
There is not enough free memory to process the data file. Try to
enable swapping, or if you are already doing so, try another
swapping mode. See also the Understanding Memory Considerations
section in Chapter 4.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 180
Appendix B: TbScan Heuristic Flag Descriptions
This appendix describes TBAV's heuristic flags.
# - Decryptor code found
The file possibly contains a self-decryption routine. Some copy-protected
software is encrypted, so this warning might appear for some of your
files. If, however, this warning appears in combination with, for
example, the "T" warning, there could be a virus involved and TbScan
assumes contamination. Many viruses encrypt themselves and trigger this
warning.
! - Invalid program.
Invalid opcode (non-8088 instructions) or out-of-range branch. The
program has either an entry point that located outside the body of the
file, or reveals a chain of jumps that can be traced to a location
outside the program file. Another possibility is that the program
contains invalid processor instructions. The program being checked is
probably damaged and cannot execute in most cases. At any rate, TbScan
avoids risk and uses the scan method to scan the file.
1 - 80186+ instructions.
The file contains instructions which cannot be executed by 8088
processors, and require an 80186 or better processor.
@ - Strange instructions
The file contains instructions which are not likely to be generated by an
assembler, but by some code generator like a polymorphic virus instead.
? - Inconsistent header.
The program being processed has an EXE-header that does not reflect the
actual program lay-out. Many viruses do not update the EXE-header of an
EXE file correctly after they infect the file, so if this warning pops up
frequently, it appears you have a problem.
c - No integrity check
This warning indicates that TBAV found no checksum/recovery information
for the indicated file. We recommend you use TbSetup in this case to
store the file's information. TBAV uses this information for integrity
checking and to recover from virus infections.
h - Hidden or System file.
The file has the Hidden or the System file attribute set. This means
that the file is not visible in a DOS directory display but TbScan scans
it anyway. If you don t know the origin and/or purpose of this file, you
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 181
might be dealing with a Trojan Horse or a joke virus program. Copy
such a file onto a diskette, remove it from its program environment, and
then check if the program concerned is missing the file. If a program
does not miss it, you not only have freed some disk space, but you might
also have prevented a future disaster.
i - Internal overlay.
The program being processed has additional data or code behind the
load-module as specified in the EXE-header of the file. The program might
have internal overlay(s) or configuration or debug information appended
behind the load-module of the EXE file.
p - Packed or compressed file.
This means that the program is packed or compressed. There are some
utilities that can compress program files, such as EXEPACK and PKLITE.
If the file became infected after compression, TbScan is able to detect
the virus. However, if the file became infected before compression, the
virus was also compressed in the process, and a virus scanner might no
longer be able to recognize the virus. Fortunately, this does not happen
very often, but you should still beware! A new program might look clean,
but can turn out to be the carrier of a compressed virus. Other files in
your system will become infected too, and it is these infections that
will be clearly visible to virus scanners.
w - Windows or OS/2 header.
The program can be or is intended to run in a Windows (or OS/2)
environment. TbScan offers a specialized scanning method for these files.
A - Suspicious Memory Allocation
The program uses a non-standard way to search for, and/or to allocate
memory. Many viruses try to hide themselves in memory, so they use a
non-standard way to allocate this memory. Some programs (such as
high-loaders or diagnostic software) also use non-standard ways to search
or allocate memory.
B - Back to entry.
The program seems to execute some code, and after that jumps back to the
entry-point of the program. Normally this results in an endless loop,
except when the program also modifies some of its instructions. This is
quite common behavior for computer viruses. In combination with any other
flag, TbScan reports a virus.
C - File has been changed
This warning appears only if you use TbSetup to generate the ANTI-VIR.DAT
files and means the file has been changed. Upgrading the software would
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 182
trigger this message. Otherwise, it is very likely that a virus infected
the file!
NOTE:
TbScan does not display this warning if only some internal
configuration area of the file changes. This warning means that code
at the program entry point, the entry-point itself, and/or the file
size has been changed.
D - Direct disk access
This flag appears if the program being processed has instructions near
the entry-point to write to a disk directly. It is quite normal that some
disk related utilities trigger this flag. If several files that should
not be writing directly to the disk trigger this flag, your system might
be infected by an unknown virus.
NOTE:
A program that accesses the disk directly does not always have the
"D" flag. Only when the direct disk instructions are near the
program entry point does TbScan report it. If a virus is at fault,
the harmful instructions are always near the entry point, so it is
only there that TbScan looks for them.
E - Flexible Entry-point
This flag indicates that the program starts with a routine that
determines its location within the program file. This is rather
suspicious because sound programs have a fixed entry-point so they do not
have to determine this location. For viruses, however, this is quite
common. Approximately 50% of the known viruses trigger this flag.
F - Suspicious file access
TbScan has found instruction sequences common to infection schemes that
viruses use. This flag appears with those programs that are able to
create or modify existing files.
G - Garbage instructions.
The program contains code that seems to have no purpose other than
encryption or avoiding recognition by virus scanners. In most cases there
won't be any other flag since the file is encrypted and the instructions
are hidden.
NOTE:
This flag appears occasionally on "normal" files. This simply
indicates, however, that these are poorly designed, not infected..
J - Suspicious jump construct.
The program did not start at the program entry point. The code has either
jumped at least twice before reaching the final startup code, or the
program jumped using an indirect operand. Sound programs should not
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 183
display this kind of strange behavior. If several files trigger this
flag, you should investigate your system thoroughly.
K - Unusual stack.
The EXE file being processed has an odd (instead of even) stack offset or
a suspicious stack segment. Many viruses are quite buggy by setting up
an illegal stack value.
L - Program load trap
The program might trap the execution of other software. If the file also
triggers the "M" flag (memory resident code), it is very likely that the
file is a resident program that determines when another program executes.
Many viruses trap the program load and use it to infect the program. Some
anti-virus utilities also trap the program load.
M - Memory resident code.
TbScan has found instruction sequences that could cause the program to
hook into important interrupts. Many TSR (Terminate and Stay Resident)
programs trigger this flag because hooking into interrupts is part of
their usual behavior. If several non-TSR programs trigger this warning
flag, however, you should be suspicious. It is likely that a virus that
remains resident in memory infected your files.
NOTE:
This warning does not appear with all true TSR programs, nor can you
always rely upon TSR detection in non-TSR programs.
N - Wrong name extension.
Indicates a name conflict; that is, the program carries the extension
.EXE but appears to be an ordinary .COM file, or it has the extension
.COM but the internal layout of an .EXE file. A wrong name extension
might in some cases indicate a virus, but in most cases it does not.
O - code Overwrite.
This flag appears if TbScan detects that the program overwrites some of
its instructions. However, it does not seem to have a complete
(de)cryptor routine.
R - Suspicious relocator
Indicates a suspicious relocator. A relocator is a sequence of
instructions that changes the proportion of CS:IP. Viruses often use
this. Those viruses have to relocate the CS:IP proportion because they
were compiled for a specific location in the executable file; a virus
that infects another program can hardly ever use its original location in
the file as it is appended to this file. Sound programs know their
location in the executable file, so they don t have to relocate
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 184
themselves. On systems that operate normally, only a small percentage of
the programs should trigger this flag.
S - Search for executables
The program searches for *.COM or *.EXE files. This by itself does not
indicate a virus, but it is an ingredient of most viruses, since they
have to search for suitable files to spread themselves. If accompanied by
other flags, TbScan assumes the file is infected by a virus.
T - Invalid timestamp.
The timestamp of the program is invalid; that is, the number of seconds
in the time stamp is illegal, or the date is illegal or later than the
year 2000. This is suspicious because many viruses set the time stamp to
an illegal value (such as 62 seconds) to mark that they already infected
the file so they won't infect a file a second time. It is possible that
the program being checked is contaminated with a virus that is still
unknown, especially if several files on your system have an invalid time
stamp. If only very few programs have an invalid time stamp, you d better
correct it and scan frequently to check that the time stamp of the files
remains valid.
U - Undocumented system call.
The program uses unknown DOS calls or interrupts. These unknown calls can
be issued to invoke undocumented DOS features, or to communicate with an
unknown driver in memory. Since many viruses use undocumented DOS
features, or communicate with memory resident parts of a previously
loaded instance of the virus, a program is suspicious if it performs
unknown or undocumented communications. This does not necessarily
indicate a virus, however, since some tricky programs also use
undocumented features.
V - Validated program
The program has been validated to avoid false alarms. The design of this
program would normally cause a false alarm by the heuristic scan mode of
TbScan, or this program might change frequently, and TbScan excludes the
file from integrity checking. Either TbSetup (automatically) or by TbScan
(manually) stores these exclusions in the ANTI-VIR.DAT.
Y - Invalid boot sector.
The boot sector is not completely according to the IBM defined boot
sector format. It is possible that the boot sector contains a virus or
has been corrupted.
Z - EXE/COM determinator.
The program seems to check whether a file is a COM or EXE type program.
Infecting a COM file is a process that is not similar to infecting an EXE
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 185
file, which implies that viruses able to infect both program types should
also be able to distinguish between them. There are, of course, innocent
programs that need to find out whether a file is a COM or EXE file.
Executable file compressors, EXE2COM, converters, debuggers, and
high-loaders are examples of programs that might contain a routine to
distinguish between EXE and COM files.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 186
Appendix C: Solving Incompatibility Problems
Although TBAV utilities cooperate very well with other resident software,
other software might not behave so well. This can cause system errors or
even more serious problems. This section describes some common problems
and their solutions.
PROBLEM:
If a TBAV utility tries to display a message, the text message
"file <filename> could not be opened" appears.
Specify the FULL path and filename of the file to use as a message
file after the TbDriver loading command. The default file name is
TBDRIVER.LNG.
PROBLEM:
One of your utilities is loading a TSR into memory without an
executable filename extension, such as .EXE or .COM. Since TbSetup
creates ANTI-VIR.DAT records only for files with an executable
extension, there is no ANTI-VIR.DAT, so TbMem is not able to record
the TSR permission information.
Run TbSetup and specify the exact filename of the TSR. TbSetup
creates an ANTI-VIR.DAT record, regardless of the filename
extension, so TbMem can now record its information.
Although the ANTI-VIR.DAT record exists, TbScan does not use it to
check the CRC to avoid false alarms.
PROBLEM:
You are running a network, and one of the following problems arises:
1. TbScanX is installed, but does not display the *scanning*
message while accessing files. It also does not detect viruses.
2. TbCheck is installed, but does not display the *checking*
message while accessing files. It also does not detect viruses.
3. TbFile is installed, but does not detect anything.
4. TbMem is installed, but does not detect TSRs.
Use the "TbDriver net" command after the network loads.
PROBLEM:
The system sometimes hangs when the message *scanning* is on the
screen.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 187
Try TbScanX without the EMS or XMS option. If TbScanX now works
without any problems, add the EMS or XMS option again along with the
COMPAT option. On some systems, you cannot use the TbScanX XMS
option at all because these systems do not allow resident software
to use extended memory.
If the problem relates to the XMS option and still occurs when you
use the COMPAT option, you can use the XMSSEG = <VALUE> option to
change the XMS swap segment address. The value should be between
2000 and 8000. The default value is 4000.
PROBLEM:
After you have given permission for a program to remain resident in
memory, TbMem asks the same question the next time.
First, the SECURE option of TbDriver is in use. Remove this option,
reboot and try again.
Second, the program mentioned does not appear in the ANTI-VIR.DAT
file and, therefore, TbMem cannot permanently store the permission
flag. Use TbSetup first to generate this program's ANTI-VIR.DAT
record.
Third, for some reason it is not possible to write to the
Anti-Vir.Dat file. The file might reside on a write protected
diskette, on a network in a read-only directory, or the Anti-Vir.Dat
file has the read-only attribute set.
PROBLEM:
The system sometimes hangs when you answer "YES" (abort program) to
a TbMem message.
A solution here is difficult. Some resident programs seriously
interfere with the system, and once rejected from memory, the system
becomes unstable.
PROBLEM:
When you load TbDisk from the DOS command prompt, everything works
fine. When you install TbDisk from within the CONFIG.SYS or
AUTOEXEC.BAT file, however, it continually warns that programs write
to disk directly.
Load TbDisk at the end of your AUTOEXEC.BAT file.
PROBLEM:
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 188
You formatted the hard disk using DOS FORMAT, but TbDisk did not
display a message until the process was almost complete.
This is not a problem. A high level format program such as DOS's
FORMAT.COM does not actually format the disk (that is, divide the
disk into tracks and sectors), rather it reads all tracks to locate
possible bad spots and clears the FAT and directory structure. Only
this last step implies a disk write, so it is the only one TbDisk
detects.
PROBLEM:
After you give permission for a program to perform direct disk
access, TbDisk asks the same question the next time.
First, the SECURE option of TbDriver is in use. Remove this option,
reboot and try again.
Second, the program mentioned does not appear in the ANTI-VIR.DAT
file and therefore TbDisk can not permanently store the permission
flag. Use TbSetup first to generate this program's ANTI-VIR.DAT
record.
PROBLEM:
If you try to use Windows fast 32-bit disk access, Windows displays
an error message.
Use the WIN32 option on the TbDisk command line.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 189
Appendix D: TBAV Exit Codes and Batch Files
All TBAV utilities return to DOS with an error code that you can use with
DOS's ERRORLEVEL command. The chief use of these error codes is in batch
files. This appendix lists these error codes. Consult your DOS manual for
information how to use error codes in batch files.
D.1 TbScan Exit Codes
TbScan terminates with one of the following exit codes:
Errorlevel Description
---------- -------------------------------------
0 No viruses found/ No error occurred
1 No files found
2 An error occurred
3 Files have changed
4 Virus found using heuristic analysis
5 Virus found using signature scanning
255 Sanity check failed
D.2 TbUtil Exit Codes
TbUtil terminates with one of the following exit codes:
Errorlevel Description
---------- -------------------------------------
0 No error occurred
1 Option "compare" failed/An error occurred
D.3 General Exit Codes
All the TBAV utilities except TbScan and TbUtil (see above) exit with one
of the following exit codes:
Errorlevel Description
---------- -------------------------------------
0 No error occurred
1 A error occurred
D.4 Program Installation Check
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 190
To detect within a batch file whether a resident TBAV utility loaded, you
can check for the device names. All TBAV utilities install a device name,
whether they load from CONFIG.SYS or AUTOEXEC.BAT.
You can use the DOS IF EXIST batch file command to check for the device
names. The following example, illustrating a part of a batch file, uses
this construction to test whether TbScanX is loaded:
@ECHO OFF
IF NOT EXIST SCANX ECHO TBSCANX HAS NOT BEEN LOADED!
You could also branch to a label by using the GOTO command:
@ECHO OFF
IF NOT EXIST SCANX GOTO NOSCANX
ECHO TBSCANX EXISTS !
GOTO END
:NOSCANX
ECHO TBSCANX DOES NOT EXIST !
:END
Finally, the following table lists the device names used by the TBAV
utilities:
TBAV program Device name
------------ -------------------------------------
TbScanX SCANX
TbCheck TBCHKXXX
TbMem TBMEMXXX
TbFile TBFILXXX
TbDisk TBDSKXXX
TbLog TBLOGXXX
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page 191
Appendix E: Virus Detection and Naming
E.1 How Many Viruses Does TbScan Detect?
Most of the TbScan signatures are family signatures; that is, one
signature detects an entire set of viruses. All these viruses relate to
one another. The Jerusalem signature, for example, covers more than 100
viruses. For this reason, there is no way of knowing how many viruses
TbScan detects.
Some competitive products treat each virus mutant as a separate virus,
thus claiming to detect over 4000 viruses. TbScan, however, detects
viruses using only 2000 signatures. If you want to compare virus
scanners, you have to rely on the tests frequently published in
magazines.
E.2 The Virus Naming Convention
TbScan follows the CARO virus naming recommendations. CARO is an
organization in which leading anti-virus researchers participate. The
CARO approach groups viruses in a hierarchical tree, which indicates to
which family viruses belong. TbScan shows the complete CARO name where
possible.
In contrast, however, many other anti-virus products simply indicate the
family name or the member name. For example, many products might refer to
the Leprosy.Seneca.493 using the family name Leprosy or member name
Seneca, or even by the variant name 493. Worse yet, anti-virus
products developed by non CARO members might even use a completely
different name.
TbScan, however, tries to display as much of the name as possible.
Building on the previous example, if TbScan can t distinguish between the
Leprosy.Seneca.493 and Leprosy.Seneca.517 viruses, it indicates both
by the name Leprosy.Seneca
Some viruses mutate themselves frequently. To detect all instances of
such a virus, it is sometimes necessary to use multiple signatures.
Although these signatures cover exactly the same virus, they do have a
slightly different indication. Behind the name of the virus you will see
a number in angle brackets. This number has nothing to do with the name
of the virus, but is there just for maintenance reasons.
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page i
Index
Algorithms . . . . . . . . . . . . . . . . . . . . . . 74, 153, 157, 174
ANTI-VIR.DAT 1-4, 10, 18, 20, 22, 33-38, 41-43, 45, 46, 53, 62, 64, 75,
80-82, 92, 94, 95, 96, 98-103, 105, 111, 114, 120, 125, 150,
156, 157, 163, 175, 177, 181, 184, 186-188
Cleaner . . . . . . . . . . . . . . . . . . . . 1, 98, 106, 107, 161-163
Command line options 17, 40, 62, 79, 80, 86, 87, 94, 101, 102, 110, 112,
117, 132, 141, 145, 156
Communication . . . . . . . . . . . . . . . . . . . . . . . . . . 143-146
Configurations . . . . . . . . . . . . . . . . . . . . . . . . . 49, 116
Configuring TBAV . . . . . . . . . . . . . . . . . . 14-16, 40, 62, 100
Direct disk access . . . . . . . . . . . 39, 40, 124, 125, 151, 182, 188
Environment . . . . . . . . . . . . . . 3, 5, 24, 96, 127, 140, 148, 181
Exit codes . . . . . . . . . . . . . . . . . . . . . . . . . . . 6, 189
Generic cleaner . . . . . . . . . . . . . . . . . . . . . . . . 161, 163
Help . 15, 16, 27, 33, 34, 41, 44, 45, 62-64, 80, 86, 87, 94, 102, 108,
112, 117, 122, 123, 125, 141, 145, 175, 177
Heuristic cleaner . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Heuristic flags . . . . . . 6, 60, 61, 69, 70, 73, 74, 76, 154, 155, 180
Heuristic scanning . . . . . . . . . . . . . . . . . 47, 65, 76, 153-155
Immunized partition table . . . . . . . . . . . . . . . . . . . . . . 127
Installation . 8, 9, 11, 12, 18, 23, 25, 27, 44, 48, 121, 122, 125, 150,
152, 189
Integrity checking . . . . . . . . . . 1, 2, 18, 153, 156, 157, 180, 184
Interface . . . . . . . . . . . . . . . . . . . . . 5, 11, 12, 16, 86, 89
Maintenance . . . . . . . . . . . . . . 20, 120, 128, 129, 131, 133, 191
Memory requirements . . . . . . . . . . . . . . . . . . . . 88, 147, 148
Menu interface . . . . . . . . . . . . . . . . . . . . . . . 11, 12, 16
Microsoft Windows . . . . . . . . . . . . . . . . . . 5, 85, 93, 110, 140
Procedure . . . . . . . . . . . . . . . . . 3, 8, 9, 21, 23, 26, 48, 162
Program validation . . . . . . . . . . . . . . . . . . . 1, 18, 153, 156
Recovery diskette . . . . . . . . . . . . 10, 20, 23, 25-27, 29, 31, 127
Repair cleaner . . . . . . . . . . . . . . . . . . . . . . . . . 98, 163
Signature definition . . . . . . . . . . . . . . . . . . . . . . . . 173
Signature scanning . . . . . . . . . . . . . . . . . . . . 75, 158, 189
System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Targets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
TBAV for DOS . . . . . . . . . . . . . . . . . . . . . . 6, 84, 108, 143
TBAV for Networks . . . . . . . . . . . . . . . . . . . . 8, 21, 143-146
TBAV for Windows . . . . . . . . . . . . 8, 21, 22, 50, 86, 93, 143-145
TbCheck . . 1, 2, 5, 10, 11, 19, 26, 27, 30, 33, 34, 78, 92-97, 147, 148,
186, 190
TbClean
3, 16, 17, 26, 32-34, 47, 98-107, 147, 148, 161, 163, 164, 175-177
TbDel . . . . . . . . . . . . . . . . . . . . . . . . . . . 4, 14, 16, 32
TbDisk . 1, 3-5, 19, 78, 108-111, 117, 120-125, 147, 148, 187, 188, 190
TBAV User Manual. Copyright (C) 1989-1996 ThunderBYTE B.V. Page ii
TbDriver . 1, 10, 11, 19, 26, 27, 40, 78-83, 85, 92, 109, 111, 117, 121,
140, 147, 148, 149, 151, 177, 178, 186-188
TbFile 1, 3-5, 10, 11, 19, 37, 43, 78, 108-111, 116-119, 121, 147, 148,
186, 190
TbGenSig . . . . . . . . . 4, 57, 65, 147, 165, 166, 168, 170, 172, 174
TbLoad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21, 22
TbMem
1, 3-5, 10, 11, 19, 78, 81, 108-114, 117, 121, 147-149, 186, 187, 190
TbMon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
TbNet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143-146
TbScan 1, 2, 6, 10-15, 17-22, 24, 26, 29, 30, 33, 40, 44, 46-76, 84, 91,
106, 147, 151-160, 165-168, 171, 173, 178, 180-184, 186, 189, 191
TBSCAN.SIG . . . . . . . . . . . . . . . . 1, 6, 20-22, 26, 91, 165-168
TbScanX . 1, 2, 5, 10, 11, 19, 78, 82, 84-91, 147-149, 179, 186, 187, 190
TbSetup . 1-3, 10, 17-20, 22, 25, 27, 33-46, 92, 98, 111, 114, 120, 125,
147, 150, 151, 152, 153, 156, 157, 163, 175, 180, 181, 184, 186-188
TBSETUP.DAT . . . . . . . . . . . . . . . . . . . 40, 43, 45, 46, 150-153
TbUtil . . . . . . . . . . . . . 2, 3, 16, 26, 30, 31, 126-138, 147, 189
Thanks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1, 47
Updates . . . . . . . . . . . . . . . . . . . . . . 20, 80, 120, 165, 166
USERSIG.DAT . . . . . . . . . . . . . . . . . . . . . . . . 165, 166, 168
Virus detection . . . . . . . . . . . . . . . . 33, 75, 127, 130-133, 191
Virus infection . . . . . . . . . 1, 24, 25, 29, 31, 47, 69, 92, 108, 136
Virus naming . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Virus protection . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Windows . 5, 8, 21, 22, 44, 50, 52, 54, 57, 63, 68, 73, 85, 86, 93, 105,
110, 122, 124, 140, 141, 143-145, 170, 181, 188
Workstation . . . . . . . . . . . . . . . . . 11, 139, 143, 145, 146, 150