TopWare Tools

home *** CD-ROM | disk | FTP | other *** search

/ TopWare Tools / TOOLS.iso / tools / top1513 / intro.doc < prev next >

Wrap

Text File | 1993-04-12 | 45.0 KB | 1,440 lines

Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Table of Contents 1. COPYRIGHT, LICENCES AND DISCLAIMER................ 2 1.1. Copyright................................... 2 1.2. Distribution and usage...................... 2 1.3. Disclaimer.................................. 3 1.4. Trademarks.................................. 3 1.5. Registration................................ 3 1.6. The registration key........................ 4 2. INTRODUCTION TO THUNDERBYTE ANTI VIRUS............ 5 2.1. An overview................................. 5 2.1.1. Signature scanning.................... 5 2.1.2. Algorithmic virus recognition......... 5 2.1.3. Integrity checking.................... 5 2.1.4. Heuristic analysis.................... 5 2.1.5. High speed............................ 5 2.1.6. A reconstructive cleaner.............. 5 2.1.7. A heuristic cleaner................... 6 2.1.8. Resident signature scanner............ 6 2.1.9. Resident integrity checker............ 6 2.1.10. Bootsector immunizer................. 6 2.1.11. MBR/CMOS maintenance................. 6 2.1.12. Memory guard......................... 6 2.1.13. Disk guard........................... 6 2.1.14. File guard........................... 6 2.1.15. Network support...................... 6 2.2. TbSetup..................................... 7 2.3. TbScan...................................... 7 2.4. TbDriver.................................... 7 2.5. TbScanX..................................... 7 2.6. TbCheck..................................... 8 2.7. TbMem....................................... 8 2.8. TbDisk...................................... 8 2.9. TbFile...................................... 8 2.10. TbClean.................................... 8 2.11. TbUtil..................................... 8 2.12. Compatibility.............................. 9 2.13. MS Windows................................. 9 3. EXAMPLE SETUPS................................... 11 3.1. Initial installation....................... 11 3.2. Creation of a recovery diskette............ 11 3.3. Prevention of illegal software............. 12 3.4. Prevention of viruses...................... 12 3.5. Detection of viruses....................... 13 3.6. A full protected system.................... 13 3.7. Protection against employees............... 14 3.8. System maintenance......................... 14 3.9. Recovering from viruses.................... 15 Page i Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 4. MISCELLANEOUS INFORMATION........................ 16 4.1. Who are we?................................ 16 4.2. Updates.................................... 16 4.3. Distribution of the signature file......... 16 4.4. Language support........................... 17 4.5. Thanks..................................... 17 5. A VIRUS, NOW WHAT?............................... 18 5.1. Prevention................................. 18 5.2. Confirmation............................... 18 5.3. Identification............................. 19 5.4. Don't Panic................................ 19 5.5. Global recovering.......................... 20 6. NAMES AND ADDRESSES.............................. 21 6.1. Contacting the author...................... 21 6.2. ESaSS B.V.................................. 21 6.3. TBAV registration/support sites............ 21 6.4. Recommended magazines and organizations.... 21 Page ii Page 1 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 1. COPYRIGHT, LICENCES AND DISCLAIMER 1.1. Copyright All Thunderbyte Anti-Virus utilities are copyright 1989-1992 Thunderbyte B.V.. All rights reserved. The diskettes provided with the Thunderbyte Anti-Virus utilities are not copy protected. This does not imply that they can be freely copied in unlimited quantities. The Thunderbyte Anti-Virus utilities are protected by copyright law, which applies to computer software as well. 1.2. Distribution and usage The Thunderbyte Anti-Virus utilities and the accompanying documentation are SHAREWARE. You are hereby granted a licence by Thunderbyte B.V. to distribute the evaluation copy of the software and its documentation, subject to the following conditions: 1. The evaluation package of the Thunderbyte Anti-Virus utilities may be distributed freely without charge in evaluation form only. 2. The evaluation package of the Thunderbyte Anti-Virus utilities may not be sold or licensed. Neither may a fee be charged for its use. If a fee is charged in connection with the Thunderbyte Anti-Virus utilities at all, it should only cover the cost of copying or distribution. UNDER NO CIRCUMSTANCES should payment of such fees be understood to constitute legal ownership. 3. The evaluation package of the Thunderbyte Anti-Virus utilities must be presented in its complete form. It is not allowed to distribute the program and its documentation files separately. 4. Neither the software nor its documentation may be amended or altered in any way. 5. By granting you the right to distribute the evaluation copy of the Thunderbyte Anti-Virus utilities, you do not become the owner of these utilities in any form. 6. Thunderbyte B.V. accepts no responsibility in case the program malfunctions or does not function at all. 7. Thunderbyte B.V. can never be held responsible for damage, directly or indirectly resulting from the use of the Thunderbyte Anti-Virus utilities. 8. Using the Thunderbyte Anti-Virus utilities means that you agree to these conditions. Any other use, distribution or representation of the Thunderbyte Page 2 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Anti-Virus utilities is expressly forbidden without the written permission of Thunderbyte B.V. 1.3. Disclaimer Neither Thunderbyte B.V. nor anyone else who has been involved in the creation, production or delivery of the Thunderbyte Anti-Virus utilities or the documentation grants any warranties in respect to the contents of the software or the documentation and each specifically disclaims any implied warranties of merchantability or fitness for any purpose. Thunderbyte B.V. reserves the right to revise the software and the documentation and to make changes from time to time in the contents without obligation to notify any person. 1.4. Trademarks. The Thunderbyte Anti-Virus utilities are registered trademarks of Thunderbyte B.V.. All other product names mentioned are acknowledged to be the marks of their producing companies. 1.5. Registration. THIS IS NOT FREE SOFTWARE! If you paid a 'public domain' vendor for this program, you paid for the service of copying the program, and not for the program itself. Proceeds from such transactions would never reach the makers of this product. You may evaluate this product, but if you decide to make use of it, you should register your copy. To register: fill out one of the REGISTER.* files and return it to a Thunderbyte registration site. You will find a list of registration sites in the file AGENTS.DOC. We offer several inducements to you for registering. First of all, you are entitled to support for the Thunderbyte Anti-Virus utilities, which can be quite valuable at times. Some very enhanced features (like the TbScan option 'extract') are only available to registered users. Once you have become a registered user, these advanced options will be made available to you. Once you have become a registered user of the Thunderbyte Anti- Virus utilities all future upgrades will be free. Your regisrations allow us to enhance our products and to keep them up to date! Page 3 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 1.6. The registration key Registered users receive the information and instructions to generate their TBAV.KEY. The key file will contain important information such as the licence number and the name of the licensee. The key file TBAV.KEY is NOT to be sold or transferred in any way. The Thunderbyte Anti-Virus utilities do search for the key file in the current directory. If they do not find it there, they search the same directory where the program file itself resides. If the key file is corrupt or invalid, the Thunderbyte Anti-Virus utilities continue without error message although your version of the Thunderbyte Anti-Virus utilities will then be treated as a SHAREWARE version. If your key is only valid for some of the Thunderbyte Anti-Virus utilities, the other utilities will ignore it when run. Users who have already registered and possess a valid TbScan.Key should rename the key to TBAV.KEY. Although you are allowed to evaluate the Thunderbyte Anti-Virus utilities for a reasonable period of time, it is ILLEGAL to use them in combination with a key, produced without authorization of Thunderbyte B.V. or ESaSS B.V., or generated by any software not distributed by Thunderbyte B.V. or ESaSS B.V.. Page 4 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 2. INTRODUCTION TO THUNDERBYTE ANTI VIRUS 2.1. An overview What is Thunderbyte Anti-Virus? Thunderbyte Anti-Virus (TBAV) is a toolkit designed to protect against, and recover from computer viruses. There are already many anti-virus packages, so you may wonder what is so special about these utilities. Here is a quick overview. Note that this overview is not complete, it just highlights a few of the many remarkable features. 2.1.1. Signature scanning The signatures used by this package are not just created by us as the vendor. Many independant researchers contribute to the signature list we use. The signature file is in ASCII and can be updated by yourself in case of emergency. 2.1.2. Algorithmic virus recognition. Algorithmic virus recognition through the use of AVR modules. TbScan can detect polymorphic viruses very easily by use of the easy to update external AVR modules. 2.1.3. Integrity checking. TbScan performs an integrity check automatically, and it does not have the false alarm rate other integrity checkers have. The goal is to detect viruses and not to detect configuration changes! 2.1.4. Heuristic analysis. TbScan is the world's first scanner that incorporates heuristic analysis in a normal scan session. Heuristic analysis is a technique that makes it possible to detect about 90% of all viruses by searching for suspicious instruction sequences rather than using any signature. This is possible because TbScan contains a real disassembler and code analyzer. 2.1.5. High speed. In a normal scan session, TbScan is faster than any other scanner, even with signature scanning, integrity checking and heuristic analysis fully enabled! 2.1.6. A reconstructive cleaner. A reconstructive cleaner that removes viruses by using the Page 5 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. integrity check information for a guaranteed 100% restoration. 2.1.7. A heuristic cleaner. The worlds first heuristic cleaner! Heuristic cleaning is a technique that makes it possible to remove even unknown viruses, without any information about the virus and without any information about the original file! Literally, the cleaner removes the unknown from the unknown! The success rate of this unknown virus remover is 80%, which even beats conventional cleaners that require predefined virus information. 2.1.8. Resident signature scanner. A resident signature scanner that can swap itself into expanded, XMS, or high memory, using only 1Kb of conventional memory! 2.1.9. Resident integrity checker. A resident integrity checker for higher protection. It is fast and consumes only 600 bytes of memory. 2.1.10. Bootsector immunizer. The TbUtil program can install a new master boot record which has some unique virus detection capabilities, without becoming resident in memory! 2.1.11. MBR/CMOS maintenance. Master boot record, bootsector, and CMOS; save, restore and checking facilities. 2.1.12. Memory guard. A memory guard program that detects viruses and prevents them from going resident in memory. 2.1.13. Disk guard. A disk guard program that detects viruses and prevents them from overwriting and formatting the disk. It also traps direct disk writes, tunneling and direct calls into the BIOS code. 2.1.14. File guard. A file guard program that detects viruses and prevents them from infecting programs. 2.1.15. Network support. Page 6 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Most other resident anti-virus products offer you the choice to invoke them before the network is loaded and losing the protection after the logon procedure, or to invoke the anti- virus software AFTER the logon to the network, resulting in a partially unprotected system. The Thunderbyte Anti-Virus utilities recognize the network software and take appropriate actions to ensure their functionality. 2.2. TbSetup TbSetup is a program that collects information from all software found on your system. The information will be put in files named Anti-Vir.Dat. The information maintained in these files can be used for integrity checking, program validation, and to clean infected files. 2.3. TbScan TbScan is one of the fastest (and at this moment the fastest) virus scanner available. Besides its blazing speed it has many configuration options, it can detect mutants of viruses, it can bypass stealth type viruses, etc. The most remarkable feature is the ability of TbScan to disassemble files. This makes it possible to detect suspicious instruction sequences and to detect yet unknown viruses. TbScan can detect 95% of the viruses without any information like signatures or checksum files! This generic detection is named heuristic analysis. Another feature of TbScan is the integrity checking it performs when it finds the Anti-Vir.Dat files generated by TbSetup. 2.4. TbDriver TbDriver is a memory resident utility. This driver is needed by the resident TBAV utilities. It takes care for the pop-up window, the language support, the network support, the MS-Windows support, etc. 2.5. TbScanX TbScanX is the memory resident version of TbScan. This signature scanner remains resident in memory and automatically scans those files which are being executed, copied, de-archived, downloaded, etc. TbScanX performs even faster than TbScan, and does not require much memory. It is even possible to reduce the memory requirements of TbScanX to zero (!) as TbScanX can make use of unused parts of your Page 7 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. video memory. 2.6. TbCheck TbCheck is a memory resident integrity checker. This program remains resident in memory and checks automatically every file just before it is being executed. TbCheck uses a very fast integrity checking method and it consumes only 400 bytes of memory. It can be configured to reject files with incorrect checksums, and/or to reject files that do not have a corresponding Anti-Vir.Dat record. 2.7. TbMem TbMem detects attempts from program to remain resident in memory, and makes sure that no program can remain resident in memory without permission. Since most viruses remain resident in memory, this is a powerfull weapon against all those viruses, known or unnown. Permission information is maintained in the Anti-Vir.Dat files. 2.8. TbDisk TbDisk detects attempts from programs to write directly to disk (without using DOS), direct calls into the ROM-BIOS, attempts to format, etc., and makes sure that no malicious program will succeed in destroying your data. Permission information about the rare programs that write directly and/or format the disk is maintained in the Anti-Vir.Dat files. 2.9. TbFile TbFile detects attempts from programs to infect other programs. It also guards read-only attributes, detects illegal timestamps, etc. It will make sure that no virus succeeds in infecting programs. 2.10. TbClean TbClean is a generic file cleaning utility. It uses the Anti-Vir.Dat files generated by TbSetup to enhance file cleaning and/or to verify the results. TbClean can however also work without these files. It disassembles and emulates the infected file and uses this analysis to reconstruct the original file. 2.11. TbUtil Some viruses copy themselves onto the partition table of the hard Page 8 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. disk. Unlike bootsector viruses, they are hard to remove. The only solution would seem to be to low-level format the hard disk and to create a new partition table. TbUtil offers a more convenient alternative to such radical measures. It makes a back-up of your uninfected partition table and boot sector. If these get infected in your system, the TbUtil back-up can be used as a verifying tool and as a means to restore the original (uninfected) partition table and bootsector without the need for a disk format. The program can also restore the CMOS configuration for you. If a back-up of your partition table is not available, TbUtil will try to create a new partition table anyway, again avoiding the need for a low-level format. Another important feature of TbUtil is that it can be used to replace the partition table code by new code that offers greater resistance to viruses. The TbUtil partition code will be executed before the boot sector gains control, enabling it to check this sector in a clean environment. The TbUtil partition code performs a CRC calculation on the boot sector just before control is passed to it. If the boot sector has been modified the TbUtil partition code will warn you about this. The TbUtil partition code also checks the RAM lay-out and informs you whether or not it has been changed. It carries out these checks each time you boot from your hard disk. Note that once the boot sector has been executed unchecked, it is very difficult to check it afterwards. A virus could have become resident in memory during boot-up and have hidden its presence. Once again, TbUtil will offer you a great deal of security here as it is active BEFORE the boot sector is executed. Also note that the use of TbUtil is much more convenient than the traditional strategy of booting from a clean DOS diskette for an undisturbed inspection of the boot sector. 2.12. Compatibility The Thunderbyte Anti-Virus utilities are designed to cooperate with networks, MS-Windows, DR-DOS, etc. 2.13. MS Windows The Thunderbyte Anti-Virus utilities are Microsoft Windows compatible. The utilities remain active in every DOS box, without mixing the operation of the adjacent windows. All TBAV utilities can also be invoked in a graphics DOS box inside Windows. Page 9 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. What you will not find in the TBAV package are fancy looking Windows programs. There are several reasons for this omission: - A Windows scanner never offers additional functionality. Instead, a Windows scanner requires more system resources, becomes larger and slower, and performs less reliable. The only 'gain' would be a prettier screen lay-out. If the screen layout is your major concern, TBAV is not the Anti-Virus package for you! - If one of the Windows files gets infected, Windows will most likely refuse to work and hang the machine. Just in this case you need a scanner to see what is going on, but you can not use it anymore! - To cope with stealth viruses it is required to boot from a clean DOS diskette before running the scanner. But, ever tried to boot Windows off a diskette? TBAV provides fine Windows support, but no nonsense. Page 10 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 3. EXAMPLE SETUPS 3.1. Initial installation In the following examples it is assumed that all utilities are copied in a directory named TBAV. If this is not the case, execute the following commands: MD C:\TBAV COPY *.* C:\TBAV C: CD \TBAV For all example setups it is required that TbSetup has been executed: TbSetup C:\ If your system has more hard disks or disk partitions you should repeat the TbSetup invocation for every drive or partition. It is also highly recommended to make a recovery diskette. The example setups assume you have created such a recovery diskette. It is also highly recommended to read the manuals of all the TBAV products. The example setups outlined below are just intended to give you some ideas about the use of the TBAV utilities, and these examples are not intended as a full featured protection setup! 3.2. Creation of a recovery diskette A recovery diskette is required to get rid of any virus in the future. Without such a diskette, you will never be able to get rid of any virus! So, take a few minutes to make this diskette now! Take a new, empty diskette, put it in drive A:, go to your DOS directory and execute the following commands: Format A:\ /S Copy SYS.COM A: Now return to the TBAV directory: CD \TBAV Execute the batch file MakeResc: MakeResc A: Now copy any other utilities you think you need in case of an emergency to the diskette. A tiny editor - to edit Config.Sys and/or AutoExec.Bat - is also highly recommended. If your hard disk needs some special device driver to be accessed Page 11 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. (like a Stackered disk), copy the required device drivers also to the recovery diskette and install the drivers in the Config.Sys file on drive A:. Consult the manual of these device drivers for additional help. Now execute TbSetup as follows: TbSetup A: The diskette is now almost ready. MAKE THE DISK WRITE PROTECTED BY USING THE WRITE PROTECT TAB! Label the diskette with 'Recovery'. Now store the diskette into a safe place. Do not use it until you need it! 3.3. Prevention of illegal software A lot of companies do not want their users to install or execute unauthorized software. TBAV can help to prevent this. Add to the Config.Sys the following lines: Device=C:\TBAV\TbDriver.Exe Device=C:\TBAV\TbCheck.Exe secure Execute TbSetup on the system. TbSetup C:\ Reboot the system. Press Ctrl-Alt-Del. If the user now tries to execute new software - software not authorized by TbSetup -, TbCheck does not allow these files to be executed. 3.4. Prevention of viruses To prevent virusses from doing any harm on your system, execute or install the following products: Execute TbUtil to make a backup of the partition table and to replace the partition code by a partition sector with virus detection capabilities: TbUtil immnunize a:tbutil.dat Add the following lines to the config.sys file: Device=C:\TBAV\TbDriver.Exe Device=C:\TBAV\TbScanX.Exe Device=C:\TBAV\TbMem.Exe Device=C:\TBAV\TbFile.Exe Add the following line to the autoexec.bat file: C:\TBAV\TbDisk Page 12 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Reboot the system. Press Ctrl-Alt-Del. It is very likely that some of the TBAV utilities display a message when you boot again. This because some programs that are invoked perform operations that are monitored by the TBAV utilities. TBAV has to 'learn' which programs perform these operations. If you respond with 'Y' everytime, TBAV will remember this for next time, and it will not bother you again with these messages and questions. Reboot the system again. Press Ctrl-Alt-Del. The TBAV utilities now monitor the system and warn you if something suspicious - or worse - is going on! They also warn you if a new file contains a virus. In all situations, viruses are detected before they can do any harm. 3.5. Detection of viruses To detect viruses AFTER an infection occured, you can also use the TBAV utilities. Add the following lines to the config.sys file: Device=C:\TBAV\TbDriver.Exe Device=C:\TBAV\TbCheck.Exe Add the following line to the autoexec.bat file: C:\TBAV\TbScan C:\ once Reboot the system. Press Ctrl-Alt-Del. TbCheck will warn you if files have been changed. TbScan is invoked automatically once a day. 3.6. A full protected system The best protection is achieved with the following setup. Execute TbUtil to make a backup of the partition table and to replace the partition code by a partition sector with virus detection capabilities: TbUtil immunize a:tbutil.dat Add the following lines to the config.sys file: Device=C:\TBAV\TbDriver.Exe Device=C:\TBAV\TbCheck.Exe Device=C:\TBAV\TbScanX.Exe Device=C:\TBAV\TbMem.Exe Page 13 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Device=C:\TBAV\TbFile.Exe Add the following line to the autoexec.bat file: C:\TBAV\TbDisk C:\TBAV\TbScan C:\ once Reboot the system. Press Ctrl-Alt-Del. It is very likely that some of the TBAV utilities display a message when you boot again. This because some programs that are invoked perform operations that are monitored by the TBAV utilities. TBAV has to 'learn' which programs perform these operations. If you respond with 'Y' everytime, TBAV will remember this for next time, and it will not bother you again with these messages and questions. Reboot the system again. Press Ctrl-Alt-Del. The TBAV utilities now monitor the system and warn you if something suspicious - or worse - is going on! They also warn you if a new file contains a virus. In all situations, viruses are detected before they can do any harm. Viruses are also detected after they are installed on the system for any reason. 3.7. Protection against employees. Most of the TBAV utilities are interactive. They require communication with the user if something is going on. In companies however it may be that the system operator is the only one who should commnicate with TBAV in case something is going on. All TBAV utilities support the option 'secure'. If this option is specified, the TBAV utilities will not ask the user for permission before allowing dangerous operations: TBAV will always deny all dangerous and suspicious operations. 3.8. System maintenance. Unfortunately, a system needs maintenance. This maintenance also affects the TBAV utilities. The signature file of TbScan needs a frequent update. You can obtain a new signature file on one of our support Bulletin Board Systems. It is likely that you add, update or replace programs on your system. If you do so, do not forget to use TbSetup to make or update the fingerprints of these programs! If you install a new version of DOS, the bootsector will be changed. If you change the configuration of your disks, the partition table and/or CMOS configuration will change. You need to Page 14 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. create a new recovery diskette in these cases. 3.9. Recovering from viruses. DO NOT MAKE A NEW BACK-UP OF YOUR SYSTEM THAT WILL OVERWRITE AN ALREADY EXISTING BACK-UP. Make a separate back-up instead and label it as being infected and unreliable. When recovering from a virus infection it is important that you boot from the uninfected, write-protected, recovery diskette. (If you followed our recommendations, you have a diskette labeled 'recovery'). Do NOT run any program from your hard disk! The virus must be denied access to your memory while you clean up the system. TbCheck will warn you if you accidentially try to execute an infected or unauthorized program of your hard disk. Run TbScan for an indication about what is wrong. TbScan will report the virus name if the virus is known, or it will report file changes in case the virus is unknown. TbScan C:\ log=lpt1 Also run TbUtil to compare the bootsector, partition code and CMOS configuration. TbUtil compare If the bootsector or partition code contains a virus, you can use TbUtil to remove the virus from these items: TbUtil restore In case of a file virus, restore all executables. TbClean is not recommended unless you don't have a back-up of the uninfected executable files. Depending on the kind of virus it might also be necessary to replace all data files. Once the system has been cleaned, check all diskettes, back-ups, etc. One infected diskette can cause you the same trouble all over again. Therefore we highly recommend you to take measures to protect your system against re-infections, since there is always the possibility that you forgot to clean up one of your diskettes. Use a virus scanner frequently, install a resident scanner (like TbScanX), or even better, install the Thunderbyte PC Immunizer card. Page 15 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 4. MISCELLANEOUS INFORMATION 4.1. Who are we? The Thunderbyte Anti-Virus utilities have been developed by Frans Veldman, chief executive of the ESaSS and Thunderbyte company. ESaSS is the company that developed the well-known Thunderbyte card, the first hardware PC immunizer, and has gained a great deal of experience with and knowledge of viruses and assembler-written system software. Of course, we do have a large collection of viruses to test our products on. 4.2. Updates The Thunderbyte Anti-Virus utilities are updated often. The updates will be available on all Thunderbyte support BBSs but also a lot of other BBSs will have the most recent version of our software available. The standard complete release will be named: TBAVxxx.ZIP. The 'xxx' will be replaced by the three digit version number of the Thunderbyte Anti-Virus utilities. To maintain the high reliability of the products, beta releases are available. They will not be distributed widely, but are just available on the Thunderbyte support BBS in The Netherlands and in the USA. They will only contain the files that have been changed. Beta versions can be recognized because they have a 'B' in the name: TBAVBxxx.ZIP. To minimize download costs there will also be upgrade archives which contain files that have been changed since the previous official release. They will have a 'U' in their name: TBAVUxxx.ZIP. The resident Thunderbyte Anti-Virus utilities are also available in processor optimized formats. These processor optimized versions are available for registered users only, and they are archived in a file with a 'X' in the name: TBAVXxxx.ZIP. 4.3. Distribution of the signature file The signature file (VIRSCAN.DAT) is updated every month. It will be distributed in an archive called VSIGYY##.ZIP (YY = Year, ## = release sequence number). Emergency updates are released as files called ADDNSIGS.DAT which will be distributed as the archive ASIGYY##.ZIP file.YY = Year, ## = release sequence number). Most Bulletin Board Systems will get a fresh copy of these two files within 48 hours after the Master Copy has been updated at Bamestra BBS. The most recent signature files can also be obtained from any Page 16 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Thunderbyte support BBS. 4.4. Language support The Thunderbyte Anti-Virus utilities do support several languages. The language support files are distributed in archives named TB<name><version>.ZIP, whereas <name> stands for the two or three character country code, and version for the version number of TBAV. A language support file for The Netherlands whould have the name TBNL500.ZIP (version 5.00). You will find these language files on most Thunderbyte support BBSes. 4.5. Thanks The Thunderbyte Anti-Virus utilities would not have evolved to their current state without the valuable contributions made by a number of people. Special thanks to: Jan Terpstra, for maintaining the signature file. Righard Zwienenberg, for testing TbScan on over 20Mb of viruses. John Lots, for beta-testing and technical advice. Eric Richet, for beta-testing. Stephane Veaux, for beta-testing. Alan Solomon, for testing and for the discovery of a FCB problem. Harry Thijssen, for stimulating the scanner speed competition. Jeff Cook, for revision and correction of the manual. Fridrik Skulason, for cooperation of heuristic implementation. Page 17 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 5. A VIRUS, NOW WHAT? 5.1. Prevention It is always better to be safe now than to be sorry afterwards. You can prevent an infection by using reliable software only, i.e. software of which the origins are known. MAKE SURE YOU HAVE AN UNINFECTED WRITE-PROTECTED BOOTABLE DOS DISK STORED IN A SAFE PLACE. The disk will be needed in case of infection. Without an uninfected bootable disk you will never be able to get rid of any virus! The disk should be write-protected to make sure it will remain uninfected! Make sure you use TbSetup to maintain recovery information of all executable files of your system! Only boot from your hard disk or from your original DOS diskette. NEVER use someone else's disk to boot from. Should you have a hard disk, make certain that you have opened the door to your floppy drive before resetting or booting your PC. Use the DOS program ChkDsk frequently (without the /F switch). ChkDsk is able to detect some viruses because the viruses change the disk structure in an incorrect manner, causing disk errors in the process. Look out for changes in the behaviour of your software or system. Any change in their behaviour is suspect, unless you know its cause. Some highly suspicious symptoms are: - The amount of available memory space has decreased. - Programs need more time to execute. - Programs do not operate as they used to, or cause the system to crash or reboot after some time. - Data disappears or get damaged. - The size of one or more programs has increased. - The screen behaves strangely, or you will find unusual information displayed there. - ChkDsk detects many errors. 5.2. Confirmation Once you think your system may have been infected by a virus, try to get confirmation. You can get confirmation by using a virus scanner, or by booting from the uninfected write-protected DOS diskette and comparing the files on the hard disk to the known uninfected original copies. DO NOT RUN ANY PROGRAM ON THE HARD DISK WHILE AND BEFORE PERFORMING THIS TEST TO PREVENT THE VIRUS FROM GOING RESIDENT IN MEMORY. If the files have not been changed you Page 18 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. are not dealing with a file virus. However, if they all appear changed in the same manner, it is very likely that the files have been infected. The bootsector is more difficult to test. Use the DOS SYS command to replace the bootsector in case of doubt. Note that file viruses infect other programs. It is highly unlikely that you will find a few infected programs on a hard disk used frequently. If TbScan reports a virus in only 1% of the files on your hard disk, you should treat it as a false alarm. If you find a virus, do NOT use your copy of TbScan to check other machines, unless you have copied it to a write-protected diskette before the system became infected. Although TbScan performs a sanity check on invocation, there are some viruses that are able to fool a self-check, and TbScan might therefore carry such a virus without detecting it itself. 5.3. Identification Identify the virus. This is extremely important because if you know which virus infected your system, you know what the virus must have done there, and whether or not your data files can still be relied upon. You can use a virus scanner to identify a virus. Once you know the name of the virus you should obtain additional information about the virus. Log on to our support BBS, consult literature on this subject, or consult a virus expert. If the virus only infects executable files you need only replace executable files. But if the virus swaps some bytes at a random location of your hard disk each time you execute a program, you have to replace your data files too, even though you didn't notice any changes in the data files themselves. 5.4. Don't Panic! The most important thing to do is NOT TO PANIC! Panicking doesn't help you, as you need to be calm to deal with the situation properly. In most cases of virus infection in the past, most of the damage was done by the operator of the system, not by the virus itself. Do nothing at all except for identifying the virus and obtaining information about it. An instant reformat of your hard disk(s) is the worst thing you can do. Once you know exactly what the virus does, you can work out a strategy to recover from the infection. DO NOT MAKE A NEW BACK-UP OF YOUR SYSTEM THAT WILL OVERWRITE AN ALREADY EXISTING BACK-UP. Make a separate back-up instead and label it as being infected and unreliable. Page 19 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 5.5. Global recovering When recovering from a virus infection it is important that you boot from an uninfected write-protected DOS diskette. Do NOT run any program from your hard disk! The virus must be denied access to your memory while you clean up the system. Restore the DOS system and bootsector by using the DOS SYS command. In case of a file virus, restore all executables. A virus removal utility is not recommended unless you don't have a back-up of the uninfected executable files. Depending on the kind of virus it might also be necessary to replace all data files. If the system has been infected by a virus that modifies the partition table it might be necessary to perform a low-level reformat of your hard disk(s). If you used a utility to back up the partition table (like TbUtil) it isn't necessary to reformat the disk(s). TbUtil restores the partition table for you. Once the system has been cleaned, check all diskettes, back-ups, etc. One infected diskette can cause you the same trouble all over again. Therefore we highly recommend you to take measures to protect your system against re-infections, since there is always the possibility that you forgot to clean up one of your diskettes. Use a virus scanner frequently, install a resident scanner (like TbScanX), or even better, install the Thunderbyte PC Immunizer card. Page 20 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. 6. NAMES AND ADDRESSES 6.1. Contacting the author. The Thunderbyte Anti-Virus utilities have been written by Frans Veldman. You can contact him via the following electronic media: Dutch support BBS Tel. +31-85-212395 Fidonet: 2:280/200 Internet: Veldman@esass.iaf.nl Registered users can also phone for technical support. To register, see one of the REGISTER.* files. 6.2. ESaSS B.V. For more information about the Thunderbyte Anti-Virus utilities you can contact: ESaSS B.V. Tel: + 31 - 80 - 787 881 P.o. box 1380 Fax: + 31 - 80 - 789 186 6501 BJ Nijmegen Data: + 31 - 85 - 212 395 The Netherlands (2:280/200@fidonet) (veldman@esass.iaf.nl) 6.3. TBAV registration/support sites. In order to provide the global community with anti-virus coverage in a timely manner, ESaSS B.V. has established an Agents program to provide service, sales and support for our products around the world. You will find all information in the file AGENTS.DOC. 6.4. Recommended magazines and organizations. Virus Bulletin. Virus Bulletin Ltd. 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel. +44-235-555139. International Computer Security Association. Suite 33 5435 Connecticut Avenue NW Washington D.C. 20015 Tel. +1-202-364-8252 National Computer Security Association. 227 West Main Street. Mechanicsburg, PA 17055, United States. Page 21 Thunderbyte Anti Virus. (C) Copyright 1989-1993 Thunderbyte B.V. Tel. +1-717-258-1816 Virus News International. Berkley court, Millstreet, Berkhamsted, Hertfordshire, HP4 2HB, England. Tel. +44-442-877877. Page 22