Copyright: Copyright © 1996-97 VDS Advanced Research Group
Citation: Copyright © 1996-97 VDS Advanced Research Group


Table Of Contents

Copyright and Disclaimer

Introduction

Program Requirements

Program Features

How To Install Perforin

Technical Support

How To Order Perforin

Order Form


Copyright and Disclaimer

Perforin for WinWord

Windows 95/NT 4.0 Edition

Version: 2.0

Revision: June 1997

Copyright © 1996-1997  VDS Advanced Research Group

   Portions Copyright © 1996-1997 Joe Hartmann

All Rights Reserved

WARNING

THIS SOFTWARE AND MANUAL ARE BOTH PROTECTED BY U.S. COPYRIGHT LAW (TITLE 17 UNITED STATES CODE)AND INTERNATIONAL COPYRIGHT LAWS. UNAUTHORIZED REPRODUCTION AND/OR SALES MAY RESULT IN IMPRISONMENT OF UP TO ONE YEAR AND FINES OF UP TO $10,000 (17 USC 506). COPYRIGHT INFRINGERS MAY ALSOBE SUBJECT TO  CIVIL LIABILITY.

Disclaimer

The developers and distributors of Perforin make no warranty of any kind, either express or implied, with respect to this software and accompanying documentation. In no event shall the developers be liable for any damages arising out of the use of or inability to use the included programs. The entire  risk as to the results and performance of this software package is assumed by the customer. We specifically disclaim any implied warranties of merchantability or fitness for any purpose. Use at your own risk.

The developers and distributors of Perforin reserve the right to revise the software and accompanying documentation and to make changes in the contents without obligation to notify any person of such revision or changes.


Introduction

Perforin is an easy-to-use 32-bit antivirus solution designed specifically to fight macros viruses that target WinWord 6/7 documents. It runs under Windows 95 and Windows NT 4.0 or higher. We do not have a 16-bit edition at this time.

We are making the trial copy of Perforin available to everyone. That way, you can evaluate our product and decide if you wish to buy a copy. The trial copy is significantly functional in that it will scan for and remove macro viruses. It has some advanced features disabled, and it will expire after the date shown in the About box.

Perforin trial copy includes a help file that describes its operation in some detail. It also contains brief descriptions for some of the common macro viruses reported so far. We are adding more descriptions on  a regular basis. At the time of this writing, there are roughly 1000 variants of some 180 strains of macro viruses that target the WinWord documents. This number is likely to change. In fact, there are more and more variants of these viruses reported every day. If you use WinWord for your word processing and share documents with other people, you are at risk from this type of viruses. We are offering Perforin to everyone to combat this new trend in virus development.

There are some macro-based solutions that claim to deal with macro viruses. Though some have merit, we are convinced that they cannot offer adequate protection against this form of threat to your documents. In fact, they may complicate the matters in some cases. We do not recommend using MS ScanProt as an effective solution.

Other people may suggest making the NORMAL.DOT global template file read-only. Though this may seem like an effective technique, it has several problems; WinWord itself needs to write to the global template to save certain configuration settings, viral macros can be loaded in memory from an infected document and infect other documents you work on during that sessions and so on. If you wish to write-protect your NORMAL.DOT, we encourage you not to rely on that approach, and use it only as an auxiliary measure.

Check your documents, especially the ones you send out to other people, with a scanner, such as Perforin, and clean them if necessary. Furthermore, try to use a document format that cannot contain macros, such as the RTF format. Many documents do not need fancy formatting features and they can easily be saved in the RTF format. However, Word 6 will not allow you to save an infected document in the RTF format. If you notice that this option is not available, you might have a macro virus infection. By following a few simple procedures, and scanning any documents you receive, you can greatly reduce your risk from macro viruses.

You can read more about macro viruses in the Perforin help file after you install it.


Program Requirements

Perforin has the following requirements:

•	IBM PC compatible computer

•	Hard drive with 2 megabytes of free space

•	Windows 95 or Windows NT 4.0 or higher

•	OLE32 dynamic libraries (default in Windows 95 and NT 4)

Optionally, Perforin needs the following:

•	Internet connection that can offer HTTP and FTP protocols

•	Microsoft Internet API dynamic link library (INSTALL will copy it to your hard drive if this library is not present. It is part of the Windows 95/OSR2 release and higher, but not the August 1995 release)

•	Network client software capable of resolving UNC-compatible paths. Both Netware and NT drivers offer this functionality.


Program Features

Perforin is a professionally developed product. We strive to improve it based on user suggestions. Please feel free to contact us if you think we should add a certain feature or even remove one.

The following are some of Perforin's currently implemented features:

•	It can scan for and disinfect over 1000 known WinWord macro viruses.

•	Polymorphic macro virus detection and cleaning.

•	GPF-proof implementation even when using the buggy MS OLE2 DLLs.

•	Supports Far Eastern Word 6/7 documents.

•	It can identify and report multiple infections, and remove each one.

•	It can scan inside password protected documents and even disinfect them on the fly all transparently without disturbing the protection. Thanks to StripSearch(tm) Technology, Perforin can discover viruses hiding in protected files. In addition, you will see the password for infected/disinfected documents (but not clean ones). Some viruses add password protection, and sometimes use random passwords rendering your data unavailable without the password.

•	Reliable yet fast operation. Perforin examines all files except those usually known not to be documents (such as EXE, DLL),not just ones with .DOC or .DOT extensions since the name of a file is not a good indicator of its contents. Many products will miss them by default.

•	Instant signature updates over the Internet at the click of a button. No extra payment or other hassle. Perforin will even try the next distribution site if it cannot reach our primary server. All automatically.

•	Smart removal capability allows Perforin to determine if all macros should be excised automatically. Some viruses require this option for proper cleaning. The user does not need to know the details of each virus or specify unusual options. Perforin will do the right thing on a virus by virus basis.

•	Frequent updates to identify newly discovered variants.

•	Suspicious document quarantine and isolation capability.

•	Heuristic scan capability to isolate new viruses.

•	User-adjustable heuristic levels.

•	Ability to scan inside PkZIP compressed archives.

•	Option to show all documents that have macros, not just infected ones. This is useful when you suspect a new virus infection that is not detected yet.

•	Flexible operation for advanced users. You can disinfect just the way you want. Many options to choose from.

•	Context-sensitive help.

•	Readable online documentation with brief information on dozens of common macro viruses.

•	ZooSort option that can turn a bunch of infected documents into a well-organized directory tree based on the CARO names of known macro viruses. This feature uses long filenames.

•	Audit log that shows each infected file and the virus found.

•	Long filename support and 32-bit implementation for Win95 and NT 4.0.

•	Compatible with FAT32 and NTFS partitions.

•	Excellent network support and UNC compatible path usage.

•	Includes a simple installation program that automates creating a shortcut, and adding the necessary registry keys.

•	Automatic uninstall feature thru Setting|Control Panel|Add/Remove Programs.

•	Fairly self-contained operation. Perforin installs only a few Microsoft DLLs if they are needed to enable MS Internet APIs. These are distributed with the Win95 OSR2 release. They are required only if you have the Aug '95 release and you have not installed Internet Explorer 3.0. All other files Perforin installs or creates during its operation are confined t o the Perforin home directory.

•	Free program updates for a year over the Internet.

•	Self-check capability to recognize if Perforin.exe and the signature database are damaged or modified.

•	Suspicious document upload to our tech support area over the Internet at the click of a button.

•	External signature support. You can easily create an external signature file (a text file) that contains identification and cleaning data for new variants that you may encounter. All you need is an infected document that did not have any macros before infection.

•	Examine Document capability to browse thru the macros in a document  without having to worry about activating the virus. No more risky ToolsMacro problems. You can zap macro at a time, save macros to a file, and more. Researcher options.

•	ExamineDoc can even show you which viruses use a particular macro. Since 75% of currently known macros are borrowed from other viruses or innocent macro packages, this feature allows you to determine if a new variant is related to a known virus.

•	Simple and elegant user interface with tooltips, right-click help, tabbed dialogs, status bar, 3D-look ...

•	Affordable prices to fit everyone's budget. The standard edition can be had only for $40 including S/H in the States. The Pro edition sells for $80 and offers some advanced features that can be helpful to consultants or to those in charge of tech support. The standard one is all what most people will ever need to scan and clean their documents.


How To Install Perforin

To install Perforin, follow these steps:

1. Put the Perforin program diskette in drive A:

2. Click on the Start button and choose Run frome the menu.

3. In the Open: edit box, type in the following:

A:\INSTALL.EXE

4. Click on the OK button to run the installation program.

5. You will see the INSTALL main dialog. The source directory should be already set to A:\. If not, type in the correct path for the directory where the original Perforin files are located. Type in the path for the directory in the destination directory edit box. It will be set to C:\PERFORIN by default.

6. Click on the Install button to start the installation process.

7. After the installation is completed, click on the Exit button to get back to Windows.

8. Now that Perforin is installed, you should see its icon on your desktop. Double-click on the Perforin icon to run it. Choose the directory you wish to scan and click on the Scan button on the toolbar to check your documents for macro viruses.


Technical Support

If you need to ask technical questions, have suggestions to improve Perforin, or run into something that seems to be a bug in our program, please contact us at the following email address:

support@vdsarg.com

If you have a document that may be infected with a new virus, or you are not sure if it is infected, please submit a copy for analysis. You can send us suspicious files over the Internet as follows:

•	Use the Upload Suspicious Document command in Perforin. It is a selection under the Tools menu. You can select just one document to send or put all your suspicious documents in the \PERFORIN\VARIANTS directory and upload all of them. This command will encrypt and send the file to our secure FTP area on our server. Please make sure that you send us a copy of your NORMAL.DOT global template file. Many macro viruses infect this template.

•	Email us an encrypted copy of the file. We encourage you to use PGP and encrypt the document with our public key first. If you do not have PGP, you can also encrypt the files with the PkZip program using the -s option. You can then send the password you have used to tyetiser@blazenet.net.  Suspicious documents should be sent to analysis@vdsarg.com. Please do NOT password protect the document in WinWord. This will only complicate analysis and it will not offer enough security for email transmission over the Internet.

•	You can upload suspicious documents to our tech support FTP area as follows:

login anonymously to ftp.vdsarg.com

change to the incoming directory

set to binary transfer mode and upload the file

If your concerns are not addressed, send all complaints to:

problem@vdsarg.com


How To Order Perforin

The copy of Perforin you download is for trial purposes only. If you like the product, you are expected to pay for the full copy and buy a license to continue to use it. Otherwise, you are supposed to uninstall it. The trial copy expires on the date shown in the About box. Reinstalling it will NOT change the expiration date. After it expires, Perforin will display a message and abort operation.

The registered copy is full-featured and it does not expire. It also has all the advanced options enabled. We make the updated virus identification database available for registered users over the Internet. This database is not compatible with the trial edition. Certain features such as external signature capability, zoosort option, automatic cleaning without prompts and document macro examination command are disabled in the trial copy. Registered users can receive free updates for one year thru the Internet as we make them available.  That offer includes program as well as signature updates.


Order Form

To get a full-featured copy, all you need to do is print out the following form, fill it out legibly, enclose a check made out to VDS Advanced Research Group for the amount shown, and mail it to us. You should receive a registered full copy on diskette within two weeks. All fields in bold letters must be filled in for correct processing of your order. Please use all capital letters and avoid cursive if possible.

------------------------------------------------------------------------------------------------------------------

VDS Advanced Research Group

P.O. Box 7573   York, PA 17404, U.S.A.

BBS: (717) 846-3873      http://www.vdsarg.com       perforin@vdsarg.com

Perforin 2.0a Order Form

* All bold fields must be filled out. All sales are final.

 	                                              	      Date: ___/___/_____

Name:__________________________________________________________

Address:________________________________________________________

        ________________City:_________________ State: _____ Zip:_________

Phone:  (      )        -                              Alt Phone:  (      )       -

Email address: ________________________Contact Person:______________

Number of Copies:______________

Quantity:_______________________ Price/Unit: $37.00

Sub-total:______________________ (multiply quantity by price/unit)

Shipping:_____$3.00_(add another $15 if you are outside the U.S.)

Sales Tax (6% in PA):___________ (multiply sub-total by 0.06)

TOTAL:__________________________ (add sub-total, shipping, and sales tax)

Payment Method:

  (  ) Check #:__________ (payable to VDS Advanced Research Group)

  (  ) Credit Card:

          (  ) VISA   (  ) Mastercard   (  ) Discover   (  ) AmEx

           Card Number: __________________________ Exp. Date: _________

           Name on the Card:_________________________________________

Customer's Signature:___________________________________________

Where did you get Perforin?

 ( ) http://www.vdsarg.com	 ( ) http://www.ccso.com

 ( ) http://www.psnw.com/~joe	( ) AOL	( ) Other:_______________________

-Name one thing you like about it:____________________________________

-May we add your email address to our list to notify you of new releases?

( ) Yes    (  ) No

* Fill in the blanks, enclose a money order (outside the U.S.) or check for the total amount  and mail it to our address. Allow 1-2 weeks for delivery. For faster service, you can pay by credit card and request electronic delivery over the Internet.

 =================================================================

For us to serve you better, please answer the following questions:

1. If any, which virus(es) infected your PCs so far? _______________________

2. Which antivirus software did you use to find/remove them? _____________

3. Do you use WinWord at home? ( ) No    ( ) Yes___version:________

4. Do you use WinWord at work?  ( ) No   ( ) Yes____version:________

5. Do you use any other word processing program besides WinWord?

( ) No   ( ) Yes __________________

6. Have you ever lost data due to a computer virus infection?  ( ) No   ( ) Yes

7. Do you own a Pentium multimedia PC?  ( ) No   ( ) Yes

8. What is your operating system?   ( ) Windows 95        ( ) Windows NT 4

===================================================================

* You can direct all questions/suggestions to  info@vdsarg.com