TopWare Tools/TOOLS.iso/tools/top1570/sentry02.doc

Text File | 1990-04-10 | 13.3 KB | 289 lines

                             SENTRY VERSION 2.0
                           from McAfee Associates

Executable Program (STINSTAL.COM):
     Versions 2.0 and above are packaged with a VALIDATE program
the with authenticate the integrity of STINSTAL.COM.  Refer to the
VALIDATE.DOC instructions for the use of the validation program.
     The validation results for V2.0 should be:
                        SIZE: 6,976
                        DATE: 5-10-89
     FILE AUTHENTICATION:
                   Check Method 1 - AD2A
                   Check Method 2 - 1E5F

     You may also call the McAfee Associates bulletin board at 408
988 4004 to obtain on-line STINSTAL.COM verification date.  The
VALIDATE program distributed with SENTRY may be used to authenticate
all future versions of SENTRY.

OVERVIEW:

     Sentry version 2 is an updated version of the original Sentry
product.  It now runs on DOS 4.0 and above, and it has additional
checks for partition table viruses.  In operation, however, it is
identical to the original version.  If you currently are running
Sentry, the only modification required is to re-install using the
new install routine.  Everything else is identical.

     I have designed and marketed an number of antiviral products
commercially through InterPath Corporation, some with more
success than others.  I have also researched and tested every
antiviral product available in both the commercial and public
domain markets.  All of them (including my own) were less than
satisfying.  They left me with a sense of unease about the
security of my system, or alternately, were so difficult to
install and use that I would rather suffer the virus than the
product.  My answer to this problem is Sentry.
     Sentry uses a unique approach to the virus issue.  Prior
products have used TSR filters to attempt to trap viruses, or
checksums to detect changes in critical files.  The TSR approach
has numerous weaknesses, primarily because TSRs cannot prevent
viruses from directly interfacing with the system I/O
controllers.  Thus, over half of existing viruses cannot be
stopped or detected by such products.  The interrupt vectoring
techniques of these products are easily circumvented by viruses.
The checksum approach, on the other hand is very time consuming
and awkward to implement.  Both techniques are troublesome to
install and execute.
     Sentry relies on a characteristic of viruses that has been
overlooked  by other product developers.  That characteristic is
called the "Positioning Rule".  This rule relates to how viruses
attach to programs.  Very simply, viruses may attach to the
beginning, to the end or to the middle of a program, or any
combination of the three.  They may fragment themselves and
scatter virus segments throughout the program.  Or they may even
keep the main body of the virus unattached to the program, hidden
in a bad sector for example.  All viruses that have been
discovered, however, have modified at least some small portion of
the beginning instructions of the program.  This is because a
virus must be executed first, that is - before the host program
to which it has attached.  If the virus does not execute before
its host program, then the environment in which the virus "wakes
up" will be uncertain, and the probability of program failure
will be high.
     The exceptions to this positioning rule are viruses that
replace the entire program, such as boot sector infectors, and
viruses that attack only specific programs, like known operating
system files or other programs that would be commonly found in
large numbers of systems.  These viruses may gain control at any
point, since the structure of the host program is well known and
the environment can be predicted at any point in the host
program's processing.
     The implications of this principal are very important.
Sentry takes advantage of this characteristic to radically speed
up the checking function.  If every byte of every program is
processed by a checksum or other comparison technique, then
scanning the entire system for a virus takes a substantial time
to complete (15 minutes to an hour), and it is impractical to
perform this function frequently.  As a result, previous virus
products could not effectively perform this function.
     Sentry, on the other hand, employs a technique that locates
the initial instructions and branch addresses for each generic
program in the system and logs critical information about these
locations.  It is able to scan the entire system for a virus over
200 times faster than global checksum techniques.  As a result,
it is now practical to check the entire system each time the
system boots.  This normally takes less than 20 seconds for the
average system.
     Sentry is installed by simply typing the install command.
There is nothing else the user ever needs to do.  Install
automatically logs ALL components of the system that can be hosts
to a virus and places an automatic check function in your
autoexec.  If you ever do get a virus, Sentry will list any and
all components of the system that are affected.  That's all there
is to it.

                             SENTRY VERSION 2.0
                               USER'S  MANUAL

HOW IT WORKS:

     SENTRY is a computer virus detection system that catches
viruses that have entered your system.  It uses a high
reliability detection mechanism that monitors all system areas
that are susceptible to viral attacks.  If a virus does enter
your system, SENTRY will identify the specific system area or
program files that have been infected, so that virus removal is
simplified.
     SENTRY executes in two phases.  The initial install phase
logs the system's hardware and software parameters - including
the initial interrupt vector states, boot sector instructions,
hidden DOS files, device drivers and all executable code on the
hard disks.  Initial load instructions, branch addresses, and
other program states are also logged for each program on the hard
disk.  The subsequent check phase executes each time the system
is powered on or re-booted, and it checks all system parameters
for traces of infection.
     SENTRY is fully effective in detecting viruses, including
boot sector infectors and imbedded viruses (viruses that the
leave the infected program's size and external indicators
unchanged).  It provides a timely and near foolproof indication
of infection.

INSTALLATION:

     SENTRY must be installed on your bootable hard drive.  If
your system contains multiple hard drives, they may also be
included in the SENTRY logging and monitoring function.  To
install SENTRY on a system with one hard drive (C:), type:

               STINSTAL C:

     SENTRY will load and then display a message that it is going
to automatically re-boot the system.  At this point, you must
remove diskettes from the A drive and any other floppies that are
in any drives.  When the floppies have been removed, press any
key to allow SENTRY to begin installation.
     If you have more than one hard drive in your system, you
should include them in the installation by typing the drive
designations after the boot drive.  For example:

               INSTALL C: D: E:

would install C: as the boot drive and also include D: and E: as
drives to be logged and monitored for viral infections.
     The SENTRY installation will re-boot your system and then
begin its logging function.  It will create a log file called
SENTRY.LOG and store it at the root of your boot disk.  It will
then install the SENTRY check routine at the root of your boot
disk and include it as the first program in your autoexec.bat
routine.  SENTRY.COM MUST REMAIN THE FIRST INSTRUCTION IN YOUR
AUTOEXEC IN ORDER TO OPERATE CORRECTLY.
     The SENTRY installation process may take 10 minutes or more
for systems with large numbers of files - the daily check
function however, will execute many times faster.  After the
installation has completed, the system's autoexec file will be
re-executed in order to return the system to its state prior to
installation.
     The SENTRY.LOG file will take approximately 10K of disk
space plus 100 bytes for each executable program on the disks.

RE-INSTALLATION

     SENTRY monitors the system each time the system is powered
on or re-booted and checks for modifications to key system
parameters.  If the system has been purposely modified, SENTRY
may flag the changed areas as possibly infected.  The following
system modifications will cause SENTRY to issue a warning:

          - Installing a new version of DOS
          - Removing or adding a device driver to CONFIG.SYS
          - Deleting a program
          - Replacing a program with a different version

     If any of the above have occurred, SENTRY should be re-
installed.  To re-install, follow the same instructions as for
initial installation.  The original SENTRY.LOG file will be
replaced with the new log file containing the new system data.

OPERATION

     The SENTRY check function compares the ongoing state of your
system to the original "snapshot" state.  A copyrighted, proprietary
algorithm checks ALL executable programs on your system for viral
modifications.  The algorithm is able to do this in a reasonable
amount of time due to a selective logging function.  This logging
function logs only those segments of program code and other
variables that would be affected by any virus attack.  "Inert"
sections of programs are removed from the checking process.
SENTRY also checks the entire boot sector and all system
interrupt routines for modifications.  Finally, system device
drivers and operating system hidden files are checked.
     The SENTRY check function executes each time the system is
powered on or re-booted.  If a discrepancy in any area of the
system is noted, the check function will pause and display a
message identifying the system area and the discrepancy.  If no
discrepancies are found, the check function will terminate with
an OK message.  The check function will require about 10 seconds
for each 100 executable programs stored on your hard disk.


IF A VIRUS IS FOUND

Important: If any virus is discovered by SENTRY, first note the
names of the infected programs or system areas.  Then immediately
power down the system.  Re-boot the system from the original DOS
distribution diskette prior to attempting to remove the virus.

     There are three general classes of PC viruses:  Boot
infectors, system infectors and program infectors.  Each class of
virus will typically affect different areas of the system and
require different approaches to removal.
     Generally, viruses can be removed by deleting or overwriting
the affected portion of the disk, and replacing the infected
component.  For program infectors (viruses that infect general
.COM or .EXE files), this is a fairly simple process.  SENTRY
will identify each program that has been infected (program size,
date, or internal components have changed).  Simply erase the
infected programs and replace them from the original distribution
diskettes.
     Boot infectors replace or modify a disk's boot sector.
SENTRY will identify an infected boot sector with a "Boot Sector
Infection" message.  This type of virus requires that the boot
sector be replaced using the DOS "SYS" command.  See your DOS
manual for instructions for the SYS command.
     System infectors attach to COMMAND.COM, IBMBIO.COM,
IBMDOS.COM or any installable device drivers.  SENTRY will
identify such viruses by naming one of the above files or by
specifying that the system interrupt vectors have changed.  To
remove this type of virus, erase the affected files, then perform
a SYS command as above.  Finally, replace any affected device
drivers.
     In all of the above cases, re-install SENTRY after virus
removal.

If SENTRY detects an infection, and you have any concerns or
questions, contact InterPath at the number and address at the end
of this document.

EXTRA PRECAUTIONS

     To prevent any possibility of viral tampering with the
SENTRY program and log file, you should copy the files SENTRY.COM
and SENTRY.LOG from the root of your boot disk to a backup floppy
immediately after installing SENTRY.  Periodically (each month or
so) you should copy these two files from the floppy back to the
root of your boot disk.



FOR ADVANCED USERS

     SENTRY defaults to a global scan a check of all system
components.  You may however, restrict its operation in a number
of areas:


Using the /s option:

     STINSTAL c: /s d:\temp, d:\masm, c:\prod

     This command string would install SENTRY so that it ignored
all activities in the three directories named.

Using the /i option:

     STINSTAL c: d: /i

     This command string would install SENTRY on drives D: and C:
and would instruct SENTRY to ignore any modifications in the
interrupt vectors caused by changes in the operating system
environment.  If you frequently modify your config.sys files, or
change out system device drivers you may want to use this option.

Using the /b option:

     STINSTAL c: /b

     This option tells SENTRY to ignore boot sector logging.  You
must use this option if running on a Zenith laptop.

Using the /L option:

     STINSTALL c: /L a:frog.log

     This option creates a second log file.