VirusBuster for Windows 9x/NT/2000 help

How to use the program

The program is started by selecting the VirusBuster™ for Windows icon of the Program Files section in the Start menu.

How to test the virus scanning engine

In order to see what happens, when our virus scanning engine finds an infected file, you can use the EICAR (European Institute of Computer Anti-virus Research) Standard Anti-virus Test file, which naturally is not a virus, but is detected by our engine as if it were. To create a file that contains the EICAR sequence, type the following string and save it in a file having a *.COM extension (like EICAR.COM):

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Note that if executed, this small COM file (that should have a length of 68 bytes) will display the "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" message, and will exit.

Menu items

File menu
Actions menu
Settings menu
View menu
Help menu

VirusBuster Components

VirusBuster general settings

VirusBuster Install Copier Component
VirusBuster Scheduled Scan Component
VirusBuster Log Component
VirusBuster Mailer Component
VirusBuster Mail Notifier Component
VirusBuster Quarantine Component
VirusBuster Registration Component
VirusBuster Virus Search Component
VirusBuster Task Manager Component
VirusBuster Program Update Component
VirusBuster Virus Database Component

© VirusBuster Kft., 1988-2001


File menu commands

File menu

The File menu contains commands related to log file save and print operations. The following functions are supported:

Import settings Importing program settings from external save file
Export settings Saving the program settings to an external save file
Printer setup Setting up printer
Print Printing log content
Exit Exit the program

Import settings

Using this function (accessible with the CTRL+F3 hotkey combination) loads all program settings from an external file. These configuration storage files have a default .CFG extension.

Export settings

Using this function (accessible with the CTRL+F2 hotkey combination) saves all program settings to an external file. These configuration storage files have a default .CFG extension.

Printer setup

This menu item gives access to the printer configuration dialog and the general print preparations.

Print

This menu item prints the log.

Exit

This menu item exits the VirusBuster program. The command is also available with the ALT+F4 keyboard shortcut.


Actions menu

Update Update the program
Update database Update the virus information database
Registration Displayor change the registration information
Log Update the log
Send mail Send out mail
Virus scan Initiate virus scan

Update

This menu item updates the program components.
See also: VirusBuster Updater Component.

Update database

This menu item starts the update of the virus information database.
See also: VirusBuster Updater Component.

Registration

This menu item gives access to entering registration information. Based on the validity of the entered information the program enables or disables the full operation mode. If there is no valid registration key present, the program is started in demo mode which means that the majority of the viruses can only by identified but not cleaned.
If your computer is infected with a virus, you can contact our virus hotline, where our experts are at you service.
See also: VirusBuster Registration Component.

Log

This menu item displays the log.
See also: VirusBuster Log Component.

Mail

This menu item initiates the creation and sending of an outgoing e-mail message.
See also: VirusBuster Mail Component.

Virus scan

This menu item starts the virus scan of the currently selected target items.
See also VirusBuster Virus Search Component.


Beállítások menü parancsai

Settings menu

General settings
Install copier - General Settings
Install copier - CD drive settings
Install copier - local/network path
Install copier - FTP server settings
Scheduled scan - general settings
Log - General settings
Mailer - General settings
Mailer - Mail clients
Mail notifier - General settings
Quarantine - General settings
Virus search - General settings
Virus search - Search area settings
Virus search - Search method settings
Task manager - General settings
Updater - General settings
Updater - CD drive settings
Updater - local/network path
Updater - FTP server settings
Virus Database - General settings

General settings

This section serves for settings general options of the program.
See also VirusBuster General Settings window.

Install copier - General settings

This section sets the VírusBuster Install Copier General settings..
See also VírusBuster Install Copier General Settings window.

Install Copier - CD drive settings

This section sets the VirusBuster Install Copier settings for CD drive update path.
See also VirusBuster Install Copier CD drive setting window.

install copier - local/network path

This section sets the VirusBuster Install Copier local/network path settings.
See also VirusBuster install copier local/network path settings window.

Install Copier - FTP server settings

This section sets the VirusBuster Install Copier settings regarding the FTP server update settings.
See also VirusBuster Install Copier FTP server settings window.

Scheduled scan - General settings

This section sets the VirusBuster Scheduled Scan general settings..
See also VirusBuster Scheduled Scan General Settings window.

Log - General settings

This section sets the VirusBuster Log Component general settings.
See also VirusBuster Log Component General Settings window.

Mailer - General settings

This section sets the VirusBuster Mailer Component general setting..
See also VirusBuster Mailer General Settings window.

Mailer - Mail clients settings

This section sets the VirusBuster Mailer Component's mailer client settings.
See also VirusBuster Mail component settings window.

Mail Notifier - General settings

This section sets the VirusBuster Mail Notifier General settings.
See also VirusBuster Mail Notifier General Settings window.

Quarantine - General settings

This section sets the VirusBuster Quarantine Component's general settings..
See also VirusBuster Quarantine General Settings window.

Virus Search - General components

This section sets the VirusBuster Virus Search Component general settings.
See also VirusBuster Virus Search General Settings window.

Virus search - Search area settings

This section sets the search areas and files for the VirusBuster Virus Search Component.

See also VirusBuster Virus Search Component Search Area Settings window.

Virus search - Search methods settings

This section sets the search methods for the VirusBuster Virus Search Component.
See also VirusBuster Search Component Search Method Settings window.

Task manager - General settings

This function sets the VirusBuster Task Manager Component general settings.
See also VirusBuster Task manager General Settings window.

Updater - General settings

This section sets the VirusBuster Updater Component general settings.
See also VirusBuster Updater Component General Settings window.

Updater - CD drive settings

This section sets the VirusBuster Updater Component CD drive settings.
See also VirusBuster Updater Component CD drive settings window.

Updater - local/network path settings

This section sets the VirusBuster Updater Component local/network drive settings..
See also VirusBuster Updater Component local/network path settings window.

Updater - FTP server settings

This section sets the VirusBuster Updater Component FTP server settings.
See also VirusBuster Updater Component FTP Server Settings window.

Virus database - General settings

The section sets the VirusBuster Database Component general settings..
See also VirusBuster Virus Database Component window.


VirusBuster Install Copier Component

The VirusBuster Install Copier Component regularly checks the release of new version of the VirusBuster family. If any of them is found on the specified source location, it is retrieved and copied to the specified target location. The VirusBuster Install Copier Component requires the VirusBuster Task Manager Component as the update is specified as a specific task.

VirusBuster Install Copier Component General Settings

The General Settings window lists the defined Install Copier task. Each item has an icon assigned, a task name and a task state (finished/running/suspended/paused). New tasks can be added or existing tasks can be deleted in this window.

A new task can be added by filling in the task name field and pushing the Apply button. At this point the task setup window appears where additional details can be specified.

An existing task's settings can be modified by selecting the task and pressing the Modify button.

An existing task's settings can be modified by selecting the task and pressing the Delete button.

An existing and currently running task can be suspended by selecting it and pressing the Suspend button. Such tasks will not be started until they are re-enabled.

Suspended tasks can be enabled with the Enable button after selecting the item.

Task can be started in the VirusBuster Task Manager Component after switching to it with the Taskman button.

VirusBuster Copier Component CD drive settings

The following parameters are configurable:

The source can be activated after the CD switch is selected and disabled if the CD switch is cleared.

If more CD drives are available, the installation source must be specified in the drive drop-down menu.

VirusBuster Install Copier Local/network path settings

The Local/network drive switch enables or disables this installation source. The source location can be specified in the Path text box using the Browse button.

On NT systems you can also choose if you want to use the default security context (given at the General settings section), or if you want to give a particular security context for this component. Warning: Use the Domain\User format for the user name.

VirusBuster Install Copier FTP server settings

The FTP client switch enables or disables this installation source. The Server field specifies the name of the FTP server that contains the VirusBuster update files, the local path on the remote server, the user name and password used for the download. In case the user name is Anonymous the e-mail address should be supplied as password. Additionally TCP/IP port number can be specified (21 is used as default).

VirusBuster Install Copier Task Settings

The Source field specifies the path which points to the latest version of the product. This could be either a CD drive or a local/network path or an FTP server. After selecting the update source, the Description list files of the specified product should be supplied. After that it is possible to select which products should be checked for updated versions.

The target path specifies where the retrieved installation kits should be stored. The location could be either local or network directory or more of them, separated by semicolons.

In case the Progress indicator switch is enabled, the Install Copier Component provides a progress bar window to show the current status of the active operation.

The task can be started one of the following ways:

  • manual start;

  • automatic start (once a day upon system startup);

  • scheduled start.

When using scheduled scan the first start time, the last start time and the start frequency can be specified.


View menu commands

View menu

Toolbar Showing or hiding the toolbar
View toolbar Showing or hiding the View toolbar
Component toolbar Showing or hiding the Component toolbar
Status line Showing or hiding the status line
Selection tree Showing or hiding the selection tree
Messages Showing or hiding the messages window
Refresh Refreshing the currently selected windows
Window list List of currently open windows

Toolbar

This function shows or hides the Toolbar which contains the following buttons: Refresh , Send log, Save log as, Print log window, Settings, Help, Support, Name card.

View Toolbar

This function shows or hides the View Toolbar which contains the following buttons: Refresh view, Display the selection tree, Display of messages.

Component toolbar

This function shows or hides the View Toolbar which contains the following buttons: Setting log-filters, Detailed logs, Saving log messages, Sending log messages, Deleting log, Starting/stopping log, Selecting local drives, Selecting network drives, Selecting all drives, Clearing all selections.

Status line

The status line contains information about the program status.

Selection tree

The selection tree lists the installed components.The window on the right of the screen contains the window specific to the selected list item.

Messages

The Messages window contains the messages generated after the program start. The messages contain the type, user and module name, the message date and time and a brief description. A longer description is available by double-clicking the message. From the right-click pop-up menu the Filter settings function is available as well as the Save as option, the Send option and the Clear.

Refresh

This function redraws the content of the currently displayed window.

Window list

This list contains the actually selected window and the list of the other windows where changes were committed in the current session but have not been saved yet using the Apply window.


Help menu commands

Help menu

Version Displays version information
About Displays the About panel
Help Displays the online help
Support Send technical support request e-mail
Select language Select user interface language

Version

This menu item displays the version information. If there is any problem with the program, the correct version should be reported to the support personnel.

About

This menu item displays information about the VirusBuster Team.

Help

This menu item displays the VirusBuster online help.

Support

This menu item generates e-mail for technical support. The Subject: and To: fields of the mail are automatically filled in by the program.

Select language

This menu item enables the language selection for the VirusBuster Console user interface. The selected language becomes active after the program is restarted. Currently English and Hungarian user interface is supported.


VirusBuster General Settings

Under VirusBuster General Settings the following properties can be set:

Security context for network connections (NT only)
The modules that require network connection use the specified user name and password. The default settings are guest for user name without password. Warning: Use the Domain\User format for the user name.
Folder for temporary files
The virus scanner extracts the file in archives into this directory
Progress bar dialog
If the current operation is accompanied with a progress window, this window will be closed if this option is checked, otherwise the operation is suspended until the Close button is pushed.
Maximum number of displayed entries
The length of the displayed log history is controlled here in order to avoid slowdown caused by the long list box.


VirusBuster Scheduled Scan Component

The VirusBuster Scheduled Scan Component regularly scans for viruses the files/paths defined by the user. This component requires the VirusBuster Task Manager Component.

VirusBuster Scheduled Scan General Settings

The General Settings window lists all the recorded virus search tasks. Each task has a Component icon, task name and task state (stopped/running/suspended/paused).

New task can be added by filling in the Task name field and pressing the Add button after which the task details can be specified.

The details of a listed task can be changed by selecting the task and pressing the Modify button.

An existing task can be deleted by selecting the task and pressing the Delete button.

An existing and currently running task can be suspended by selecting it and pressing the Suspend button. Such tasks will not be started until they are re-enabled.

Suspended tasks can be enabled with the Enable button after selecting the item.

Task can be started in the VirusBuster Task Manager Component after switching to it with the Taskman button.

VirusBuster Scheduled Scan Settings

The scheduled scan specifies the regions scanned during the regular daily virus scan.

With the Interactive communication switch selected a special dialog box appears with the possible action choices regarding the searched region.

The task can be started one of the following ways:

  • manual start;

  • automatic start (once a day upon system startup);

  • scheduled start.

When using scheduled scan the first start time, the last start time and the start frequency can be specified.

The Apply button activates the introduced cahnges.


VirusBuster Log Component

The main job of the VirusBuster Log Component is to collect the messages arriving for the different modules of the program and forward them to the user. The component is accessible through a selection list and consists of a database window and an options window.

The log entries can be listed both in forward and reverse arrival order. The log is exportable to a text file or can be sent as an e-mail.

Database-window

The log database entries consist of 7 fields:

  • entry type (represented by an icon)

  • computer name

  • user name

  • component name

  • date

  • short description of the message

  • long description of the message

Of these fields only the first 6 can be listed in the database-window. The detailed description can be accessed by either selecting the Details function in the toolbar or from the right-click pop-up menu. It as also possible to define filters the limit the set of displayed log messages.

Currently the number of displayed log items is limited to 1024. In the future this number will be available for setting under the General settings.

General settings window

Log display
Chronological order
The log entries are displayed in arrival order, the oldest message appears on the top of the list.
Reverse chronological order
The log entries are displayed in reverse arrival order, the oldest message appears on the bottom of the list.
VirusBuster log file
Database directory
The name of the host directory of the database file containing the log entries. Upon exporting the log the resulting text file is saved in this directory by default.
Automatic cleaning
Controls the cleaning of entries older than the specified date
Database size limit
Controls the maximal size of the database in (MB)


VirusBuster E-mail Component

VirusBuster E-mail window

The VirusBuster contains a full-featured E-mail Component that handles the e-mail messages generated by the program. Before using this component, the e-mail client component must be configured otherwise the mail send operation will fail.

The main features of the component are:

  • Specifying CC and BCC fields (using ; or , as a list separator)

  • Adding attachments to the messages

  • Attaching signature file to the message

VirusBuster E-mail Component General Settings

This section contains the general settings of the e-mail component: the location of the signature file and whether it should be added to the outgoing messages.

VirusBuster E-mail client Settings

This section contains the currently used e-mail client (this version of the program supports only SMTP e-mail client).

VirusBuster E-mail SMTP Settings

The SMTP client settings are divided into 2 parts.

The first part contains the SMTP server settings. The server name and the used port number (25 by default) should be specified here.

The second part contains the identification data of the current user, the full name and the e-mail address. The outgoing messages will contain these data in the user_name<e-mail_address> form. Both fields can contain the %u% or %m% variables, the former representing the user name (as logged in to the computer) while the latter represents the name of the computer.

VirusBuster Outgoing Messages

It is not necessary to send out messages one-by-one. The program stores the outgoing messages (currently maximum 255 of them). The VirusBuster Outgoing Messages contains these yet unsent messages which can be deleted or modified here.


VirusBuster Mail Notifier Component

The VirusBuster Mail Notifier Component -in case it is activated- sends out e-mail messages to each new log entry that has the component registered in. This component requires the presence of the VirusBuster Mailer Component and the VirusBuster Log Component.

VirusBuster Mail Notifier General Settings

The Mail notifier controls the on/off state of the Mail Notifier Component. With the switch not selected, messages will not be generated.

The Message Type field specifies which log-entries (e.g. virus found or critical error) will generate a new message. If the Send message detail box is selected, the detailed description of the log entry will be attached to the message.

The Notified addresses list box contains the names of the recipients of the generated message. New items can be added pressing the Add or Browse buttons, while recipients can be removed by the Remove button.


VirusBuster Quarantine Component

VirusBuster Quarantine General Settings

Currently there is only 1 parameter required for the Quarantine Component which is the name of the directory where the infected and not cleaned objects are moved - in case the user selected the quarantine option under the scanning options.


VirusBuster Registration Component

The VirusBuster Registration Component checks and stores the registration keys provided by the user. The component is accessible through the selection list . The registration keys require only the user name and the registration key which can be entered in the Registration data window.

Registration data window

This window contains the registration key. Entering a key can be simply achieved by entering the required registration data, then pressing the Apply button. After that either the program verifies the validity of the key or displays an error message.


VirusBuster Search Component

The VirusBuster Search Component is responsible for searching and disinfecting viruses.

The search path can be specified by drag-and-drop technology: if an Explorer window is open, the files/directories can be dropped into the seach window.

New search areas can be added by pressingthe INSERT key.

Warning! On Windows NT the Boot can be scanned only if the VirusBuster Shield is active, or if the logged user is an administrator on the local computer.

Search window

The search window is necessary to start the search. The Search initiates the virus scan. The window contains additional data like the last identified virus, the last infected file, the number of scanned, infected, suspicious and cleaned files, and the name of the scanned file.

The search path can be specified in two ways:

  1. The fastest way is to select all local drives and all network drives in the component toolbar.

  2. The second way is to select one-by-one the directories/drives to be scanned.

General settings window

This window contain the place for setting general properties for the VirusBuster Scan Component.

Other
Interactive Communication
With this switch selected the program will prompt the user in case of each infected/suspicious object. Otherwise the program will follow the settings specified in Search method.
Quick Scan
The quick scan can be started by pressing the left mouse button and selecting the Scan item of the appearing popup menu. This starts the VBScan.EXE command line scanner that is part of the VirusBuster installation. This program will follow the settings specified in Search method except for the following 2 options:
Interactive communication
With this switch selected the program will prompt the user in case of each infected/suspicious object.
Show progress dialog
With this switch selected the progress of the current search operation will be displayed in a progress window.

Search area settings

Search areas settings
Memory
With this switch selected the program checks the system memory for viruses.
Master Boot Record
With this switch selected the program checks the Master Boot Record for viruses.
Boot sector
With this switch selected the program checks the Boot sector for viruses.
Folders
With this switch selected the program checks the folders for viruses
Selected files
With this switch selected the program checks the specified files. The list includes the possible virus targets.
Packed files
With this switch selected the program checks the files in packed archives.

Note: the Boot sector search and the Master Boot Record search can only be executed if VBShield is running or the current user has administrator privileges.

The selected files list contains the following file types:

Target files

This section describes the files to be scanned by the program.

All files
The program will scan all files for viruses. this is a very time consuming operation.
Selected files
The program will check only selected specific file. These can be the following:
  • Program files: files that are executable in Windows operating systems.
  • Document files: Microsoft Office document files, the most common targets for Word macro viruses.
  • Table files: Microsoft Office spreadsheet files, the most common targets for Excel macro viruses.
  • Jet engine files: Microsoft Office database files, the most common targets for Access macro viruses.
  • Script files
Included files

This section contains the additional file extensions to be scanned.

Excluded files

This section contains the file extensions to be excluded from the scan.

Search method settings

Normal scan
Sensitivity
This field specifies the scan sensitivity:
The available options are:
Fast
Careful
Full
On killable virus found
This section specifies the action to be performed when a disinfectable virus is detected:
The available options are:
Kill
Keep
Rename
Quarantine
Delete
On not killable virus found

This section specifies the action to be performed when a not disinfectable virus is detected:

The available options are:
Keep
Rename
Quarantine
Delete
Heuristic scan

This section contains the settings concerning the heuristic scan options vor the VirusBuster Scanner.

Sensitivity

The available options are:

Disabled
Normal
Strong
Paranoid
On found

This section contains the actions that should be performed when a virus is found.

The available options are:

Keep
Rename
Quarantine
Macro heuristic scan
Sensitivity

This section contains the settings of the heuristic macro virus scan.

The available options are:

Disabled
Normal
Sensitive
On found

This section contains the actions that should be performed when a macro virus is found.

The available options are:

Keep
Rename
Quarantine
Delete macro


VirusBuster Task Manager Component

The VirusBuster Task Manager Component is responsible for managing the operation of those system procedures that are established as tasks of a specified component. At this moment there are 2 such components, the VirusBuster Install Copier Component and the VirusBuster Scheduled Scan Component.

Tasks are characterized by the following:

  • task name that identifies the procedure - this must be unique within the component

  • task description - brief specification of the task;

  • task state - can be running, stopped, paused or suspended;

  • start parameters of the task

Tasks can be started by the following ways:

  • manually (from the VirusBuster Task Manager General Settings window);

  • automatically (upon system startup - once a day or each time);

  • scheduled start.

Scheduled starts can be configured to start:

  • start on a given day and time

  • start each x minutes;

  • start each x hours;

  • start each x days;

  • start each x weeks;

  • start each x months;

  • start each x years;

where x can be an arbitrary number.

Except for the first type for the rest types the time of the first start can be specified along with the expiry date of the task, the deadline after what the task will not be started any more.

VirusBuster Task Manager General Settings Window

Task are controlled by the 3 colored buttons on the left side of the screen.

The PLAY button starts the task if it is not running or suspended.

The PAUSE button pauses the currently running task or resumes a suspended task.

The STOP button stops the currently running or suspended tasks.

The Modify buttons switches to the settings window of the selected task.

The Manual Start switches from scheduled scan run mode to manual run mode.

The Delete button removes the selected task.


VirusBuster Updater Component

The VirusBuster Updater Component regularly checks the release of new version of the VirusBuster family. If any of the selected packages is found on the specified source location, it is updated on the target machine. The VirusBuster Updater Component requires the VirusBuster Task Manager Component as the update is specified as a specific task.

VirusBuster Updater Component General Settings

The General Settings window lists the defined Updater task. Each item has an icon assigned, a task name and a task state (finished/running/suspended/paused). New tasks can be added or existing tasks can be deleted in this window.

A new task can be added by filling in the task name field and pushing the Apply button. At this point the task setup window appears where additional details can be specified.

An existing task's settings can be modified by selecting the task and pressing the Modify button.

An existing task's settings can be modified by selecting the task and pressing the Delete button.

An existing and currently running task can be suspended by selecting it and pressing the Suspend button. Such tasks will not be started until they are re-enabled.

Suspended tasks can be enabled with the Enable button after selecting the item.

Task can be started in the VirusBuster Task Manager Component after switching to it with the Taskman button.

VirusBuster Updater Component CD drive settings

The following parameters are configurable:

The source can be activated after the CD switch is selected and disabled if the CD switch is cleared.

If more CD drives are available, the installation source must be specified in the drive drop-down menu.

VirusBuster Updater Local/network path settings

The Local/network drive switch enables or disables this installation source. The source location can be specified in the Path text box using the Browse button.

On NT systems you can also choose if you want to use the default security context (given at the General settings section), or if you want to give a particular security context for this component. Warning: Use the Domain\User format for the user name.

VirusBuster Updater FTP server settings

The FTP client switch enables or disables this installation source. The Server field specifies the name of the FTP server that contains the VirusBuster update files, the local path on the remote server, the user name and password used for the download. In case the user name is Anonymous the e-mail address should be supplied as password. Additionally TCP/IP port number can be specified (21 is used as default).

VirusBuster Updater Task Settings

The Source field specifies the path which points to the latest version of the product. This could be either a CD drive or a local/network path or an FTP server. After selecting the update source, the Description list files of the specified product should be supplied. After that it is possible to select which products should be checked for updated versions.

In case the Progress indicator switch is enabled, the Updater Component provides a progress bar window to show the current status of the active operation.

The task can be started one of the following ways:

  • manual start;

  • automatic start (once a day upon system startup);

  • scheduled start.

When using scheduled scan the first start time, the last start time and the start frequency can be specified.


VirusBuster Virus Database Component

VirusBuster Virus Database Component General Settings

Currently there is only one configurable parameter, the Database path that specifies the location of the virus database file. In the same window the current version and date of the database file is also displayed.


Heuristic flags

Heuristics

See also: Macro virus heuristics

The heuristic scan examines the target object for signs of code fragments characteristic to viruses.

Flags and explanations:

ID | Name | Explanation
# | DECODER | the file contains self-decoding code.This can be present in copy-protection programs.
! | INVALID CODE | Illegal operation or jump to unreachable memory area. Probably a defected program.
? | INVALID EXEHDR | The program has an invalid EXE header. Some viruses might corrupt the EXE header during infection.
h | HIDDEN OR SYSTEM | Hidden file.
p | PACKED | Compressed file. Needs to be extracted for scanning.
w | WIN OR OS/2 HEADER | The program can only be run under Widows or OS/2 environment.
x | SUSP. EXEHDR | The entry point of the EXE header points after the last relocation item. The most visible sign of viruses.
A | SUSP. MEM. ALLOC | Unusual memory allocation or handling mechanism.
B | BACK TO ENTRY | The program after execution runs back to the original entry point. Usual behaviour of viruses.
D | DISK WRITE | Direct disk access. Normal program (apart from disk utilities) do not use this method.
E | FLEXIBLE ENTRY | The code attempts to determine its entry address.
F | SUSP. FILE ACCESS | Code fragment for creating or modifying files. used by virus infection routines.
G | GARBAGE CODE | The program contains garbage code. Characteristic to polymorphic viruses or poorly written programs.
J | SUSP. JUMP | The code contains consecutive jumps. Unusual for normal programs.
K | UNUSUAL STACK | the EXE program uses unusual stack
L | LOADING TRAP | The code attemptes to trap other programs.
M | RESIDENT | The program hooks several critical interrupts.
N | SUSP. EXTENSION | EXE file with COM structure or COM file with EXE structure.
O | CODE OVERWRITE | The code is self-modifying but not self-decoding.
R | RELOCATOR | The code directly modifies the CS:IP registers to relocate the execution. Not used in normal programs.
S | SEARCH EXEC | The program is searching the disk for EXE/COM files.
T | INVALID TIMESTAMP | Bad time-date. Many viruses use unusual file dates as infection indicator.
U | UNDOCUMENTED INT | The code uses undocumented interrupt calls.
Y | INVALID BOOT | The BOOT sector is not IBM format.
Z | EXE COM DETERMINATE | The program attempts to determine whether the file is EXE or COM. Used in viruses but in several utliity programs also.


Macro virus heuristics

Explanation of macro virus heuristic flags

See also: Heuristic flags

The heuristic scan examines the target object for signs of code fragments characteristic to viruses. The macro virus heuristic flags have an additional importance property:

  • important: the flag is characteristic to viruses

  • supplemental: tha flag is characteristic to malicious programs.

  • Informational: the flag itself is not virus-characteristic but in the presence of additional flags indicates a virus

Flags and explanations:

ID | Name | Explanation
A | MACRO COPY (important) | Macro copy to other document or the global template. The primary mean for virus propagation.
B | ORGANIZER (important) | Macro copy using the Organizer.
C | CREATE (important) | Generated mostly by polymorphic viruses to create a mutated copy of the macro module.
D | ADD TEMPLATE (important) | Attaching a new global template or WLL Word library. As this method is used by macro utility programs, false alarms are possible.
E | FORMAT (important) | Converting a document to a template which is the first step in infecting documents.
F | COUNT MACRO (supplemental) | Query of the total number of macros in the template. Used for macro enumeration by viruses.
G | MACRO NAME (supplemental) | Query the names of the macros in the template.
H | DELETE (supplemental) | Deleting macros. Used byy viruses to clean tracks but also used by virus protection templates.
I | SAVE AS (supplemental) | Saving documents as templates. Not characteristic to viruses, unless found together with the FORMAT (E) flag.
J | FAST SAVE (supplemental) | Turning on the fast save option. Often used by viruses.
K | AUTO MACRO (supplemental) | Turning on the automacro execution that is necessary for virus activation.
L | SAVE WINDOW (supplemental) | Query of the active window. Used by viruse for hiding activities.
M | SCREEN UPD. (supplemental) | Turning off screen updating. Used by viruse for hiding activities.
N | GLOBAL SAVE (supplemental) | Disabling the global template save prompt. Used by viruses to hide the signs of global template infection
O | DISABLE INPUT (supplemental) | Disabling the interrupt of running macro code.
P | RENAME MENU (informational) | Menu item rename, used by viruses to disable the macro-related application commands.
# | MACRO INSERT (important) | Creating a mcaro and filling with text. Often used by polymorphic viruses to create the temporary or mutated images.
a | PASSWORD (supplemental) | Protecting the documents with passwords. Often used in virus payloads.
b | INSERT TEXT (supplemental) | Inserting text into documents. Often used in virus payloads.
c | SHELL (supplemental) | Executing external program. Often used in virus dropper macros.
d | KILL (supplemental) | Deleting files.
e | WRITE (supplemental) | Direct sequnetial file write.
f | PRINT (supplemental) | Direct sequnetial file write.
g | RMDIR (supplemental) | Directory delete.
h | SETATTR (supplemental) | Changing file attributes.
I | DECLARE (supplemental) | Declaring external functions.
j | UNLOCK (supplemental) | Unprotecting documents.
k | ONTIME (informational) | Timed execution of macros. Often used in virus payloads
I | PROTECTION (informational) | Protecting fields in the document.
m | REMOVE PROT (informational) | Protecting fields in the document.
n | ENVIRONMENT (informational) | Query environment variables.
Q | EXECUTE ONLY (supplemental) | The document contains execute-only encrypted macros. Used in viruses to hide the macro content.
R | DOC-DOT (supplementary) | Document extension in template internal format. All infected documents are converted to templates.
S | AUTO (supplementary) | Using automacros, which is the primary activation method of viruses. However macro utility programs and wizards use the sam method.


VirusBuster Hot-line

Virus hot-line

Telefon | (361) 240-1546 v. (361) 242-2130
Fax | (361) 430-8350
Hot-line | (3630) 940-1459
E-mail | mail@vbuster.hu
Internet | http://www.vbuster.hu

The VirusBuster Team provides the following advanced services:

  • Free hotline and consultation. Our hotline is available 24 hours a day. Our experts can answer all your questions regarding viruses and data security.

  • Free regular updates distributed on CD ROM.

  • On-the-scene virus cleaning and software installation.

  • Working out operation and data security regulations.

  • System supervision.

  • Quick reaction on appearance of new viruses (virus updates are available within a few hours).

  • Quick and comfortable registration over phone or Inernet connection.


Purchasing VirusBuster

How to purchase the program?

The VirusBuster program family can be purchase for either personal or corporate use. Our price list is informal, for corporate users we offer discounts.

If you are interested in purchasing our program, you can contact us by any of the above means:

Hungarian VirusBuster Team

Telefon | (361) 240-1546 , (361) 242-2130
Fax | (361) 430-8350
Hot-line | (3630) 940-1459
E-mail | mail@vbuster.hu
Internet | http://www.vbuster.hu

What do we offer?

After purchasing our product you will receive virus database updates for one year in the form of by-monthly product update CD-s. The updates can be downloaded from our website. After signing your license agreement, you will receive your registration key.

Updates

After the one year free upgrade period you will be eligible for further updates for competitive prices.