Sophos InterCheck Release Notes ------------------------------- Version 4.04, 15 October 1998 Contents -------- 1. Installation and upgrade 2. Modifications from version 4.03 3. New features in version 4 4. Known Problems 5. Compatibility issues 6. Acknowledgments 1. Installation and upgrade --------------------------- Version 4.04 of InterCheck requires: Sweep version 3.15 or above. Please consult the appropriate SWEEP manual for instructions on installing InterCheck. 2. Modifications from version 4.03 ---------------------------------- i. Long file names in networked mode ------------------------------------ Version 4.03 could cause fatal "blue-screen" error messages from Windows 95 when the following conditions were all true: a. InterCheck is operating in networked mode b. The PopupDisplay= option in INTERCHK.CFG is set to ALL c. InterCheck needs to authorise a file whose name including extension is longer than 32 characters excluding path information. The setting in (b) is the default. This problem has been resolved. ii. Thread data slot usage reduced ---------------------------------- Thread data slots are very scarce resources in Windows 95 and Windows 98. Windows 95 has a total of twelve, at least seven of which are used by Windows 95 itself. InterCheck 4.04 requires only one of these; InterCheck 4.03 required two. iii. "0 viruses found" reports ------------------------------ InterCheck 4.03 for Windows 95/98 would infrequently report "0 viruses found" with a white cross in a red circle icon. InterCheck version 4.04 resolves this problem. iv. Windows-only mode of operation for InterCheck for DOS --------------------------------------------------------- The new Windows-only mode of operation for InterCheck for DOS is selected by the WindowsOnly= configuration file option described below: WindowsOnly=YES|NO (DOS ONLY) When this option is set to YES, InterCheck for DOS will allow all file and disk access while Windows is not active. As soon as Windows loads the Sweep VxD, InterCheck becomes fully active, and programs, documents, and disks will be swept on access. This has the effect of allowing free access to the machine to start Windows without an InterCheck server, and without a full sweep of the files on the local hard disk(s). On the other hand, it also allows the user to use the machine without InterCheck's protection. If the SweepVxDLoad=YES option is not present in the INTERCHK.CFG file, then this option is forced to be NO. The default is NO. 3. New features in version 4 ---------------------------- i. 'On-the-fly' disinfection ---------------------------- This version of InterCheck supports 'on-the-fly' disinfection for stand-alone Windows and Windows 95 InterCheck clients. This option is disabled by default. It can be enabled using the following configuration file options IN THE SWEEP VXD SECTIONS (see below): DisinfectDocuments=YES|NO When this option is enabled the Sweep VxD will try to disinfect Word/Excel viruses. DisinfectDisks=YES|NO When this option is enabled the Sweep VxD will try to disinfect boot sector viruses. For example, to enable both forms of disinfection for all users running Windows 95, use the following in INTERCHK.CFG: [SweepVxDW95Global] DisinfectDocuments=YES DisinfectDisks=YES These configuration options are only valid in the Sweep VxD configuration sections of the InterCheck configuration file. The Sweep VxD section identifiers are described later. All documents reported as having been disinfected should be reviewed to ensure that the virus made no changes to the content. Disinfection of boot sector viruses is not supported for NEC PC-9800 series machines. ii. New user Interface for Windows 95/98 InterCheck clients ----------------------------------------------------------- Windows 95/98 InterCheck clients have a new user interface. This is fully described in the manual supplement "Windows 95/98 InterCheck GUI" which is available in PDF format. iii. Novell IntraNetWare/Client32 support ----------------------------------------- InterCheck is now fully compatible with the Novell IntraNetWare client and the Novell NetWare Client32 network drivers for DOS, Windows and Windows 95. iv. Support for the NEC PC-9800 series computers ------------------------------------------------ The InterCheck for Windows 95/98 client has been modified to operate correctly on NEC PC-9800 series computers. However, not all the standard InterCheck functions are available; requesting authorisation messages are not displayed in full screen DOS boxes and InterCheck does not prevent a restart when an infected floppy disk has been left in the floppy drive. Disinfection of boot sector viruses is not supported for NEC PC-9800 series machines. At present, InterCheck 4.04 has been tested only on the following PC-9800 models: PC9821 La13 laptop with Windows 95 version 4.00.950B PC9821 Xa13 desktop with Windows 95 version 4.00.950A As more PC-9800 models are tested, they will be added to this list. For more information, contact Sophos or your local distributor. v. Automatic installation ------------------------- The iclogin program can now be used from a login script to automatically install the stand-alone Windows 95 InterCheck client on a workstation. This option is enabled using the '-9' command line option. For a description of how to use this feature please refer to the description of the iclogin '-a' option in the appropriate SWEEP manual. The '-a' option automatically installs the stand-alone Windows 3.x InterCheck client on a workstation. vi. Removing the networked Windows 95 InterCheck client ------------------------------------------------------- The networked Windows 95 InterCheck client installs an additional VxD (icstatic.vxd) on the workstation the first time the client is activated. Simply removing the central InterCheck installation from the server will not remove the locally installed VxD. The following command must be used to remove the VxD from the workstation: ICLOAD95 -remove Note: The VxD must be loaded very early in the computer’s boot sequence to ensure that the InterCheck client can correctly intercept all file activity. Therefore it cannot be started from the network. vii. Sweep VxD configuration file sections ------------------------------------------ The following section headers may be used in the InterCheck configuration file to pass information to the SWEEP VxD. [SweepVxDGlobal] [SweepVxDDOSGlobal] [SweepVxDW95Global] [SweepVxDWorkStation] [SweepVxDDOSWorkStation] [SweepVxDW95WorkStation] The distinctions between global and workstation specific sections, and between general, DOS specific, and Windows 95 specific sections are the same as for the InterCheck configuration section headers. viii. New configuration file options ------------------------------------ The following new InterCheck configuration options have been introduced: AllowRestartLater=YES|NO (Windows 95 ONLY) The first time that the Windows 95 InterCheck client is used on a workstation the computer must be restarted before InterCheck can provide protection from viruses. By default the computer is automatically restarted after a short delay. However, if AllowRestartLater is YES, InterCheck allows the user to restart the computer at a later time. AltCommsDir= This option is now supported by the Windows 95 InterCheck client. Please refer to the appropriate SWEEP manual for more information. CheckFloppyOnShutdown=YES|NO (Windows 95 ONLY) InterCheck normally checks the floppy disk in drive A: before allowing the computer to be shut down. This feature can be disabled by setting CheckFloppyOnShutDown to NO. PurgeChecksumsNow (Windows 95 ONLY) This option instructs the InterCheck loader to purge the checksums every time InterCheck is started. The option is designed to be used for a limited period after a virus incident in order to force InterCheck to re-sweep all files for viruses. RestartTimeout=