home *** CD-ROM | disk | FTP | other *** search
- echo off
- echo.
- echo ┌───────────────────────────────────────────────────┐
- echo │ Virus testbench based on directory comparisons │
- echo │ By Prof. Timo Salmi, ts@chyde.uwasa.fi, 21-Oct-90 │
- echo └───────────────────────────────────────────────────┘
-
- if "%1"=="" goto _help
-
- rem Make an ex-ante directory for comparison, add more directories
- rem and files as you deem fit
- dir c:\*.* > tmp.$$$
- if exist *.exe dir *.exe >> tmp.$$$
- if exist *.com dir *.com >> tmp.$$$
- type tmp.$$$ | find /v "bytes free" > virusold.$$$
- if exist tmp.$$$ del tmp.$$$
-
- rem Run the suspect program
- set program_=
- :_loop
- set program_=%program_% %1
- shift
- if not "%1"=="" goto _loop
- %program_%
-
- rem Make an ex-post directory for the comparison
- dir c:\*.* > tmp.$$$
- if exist *.exe dir *.exe >> tmp.$$$
- if exist *.com dir *.com >> tmp.$$$
- type tmp.$$$ | find /v "bytes free" > virusnew.$$$
- if exist tmp.$$$ del tmp.$$$
-
- rem Check for changes using MsDos fc.exe file compare and MsDos
- rem find.exe text search utility
- fc virusnew.$$$ virusold.$$$ > tmp.$$$
- type tmp.$$$ | find /v "fc: no differences encountered" > diffe.$$$
- del tmp.$$$
- if exist notsame.$$$ del notsame.$$$
- copy diffe.$$$ notsame.$$$ > nul
- if exist notsame.$$$ goto _differ
-
- rem No changes have occurred
- if exist diffe.$$$ del diffe.$$$
- if exist virusold.$$$ del virusold.$$$
- if exist virusnew.$$$ del virusnew.$$$
- echo ┌─────────────────────────────────────────────────────────┐
- echo │ The scanned directories and files have not been changed │
- echo └─────────────────────────────────────────────────────────┘
- goto _out
-
- :_differ
- if exist notsame.$$$ del notsame.$$$
- echo ┌────────────────────────────────────────────────────────────────┐
- echo │ Warning: The scanned directories and files have been changed │
- echo │ See virusold.$$$, virusnew.$$$, and diffe.$$$ for details │
- echo └────────────────────────────────────────────────────────────────┘
- goto _out
-
- :_help
- echo.
- echo Usage: VIRUS SuspectProgram [parameter1] [parameter2] [...]
- echo.
- echo This batch makes a directory both prior and after running the
- echo suspect program, and gives a warning if the directories differ,
- echo and prepares a list of the differences.
- echo.
- echo This batch can be also used by a knowledgeable user for the more
- echo benevolent similar purpose of checking what files a certain programs
- echo changes.
- echo.
- echo If you get an "Out of environment space" message, increase your
- echo environment space by using shell configuration in config.sys:
- echo MsDos 3.30 example: shell=c:\bin\command.com /e:1024 /p
- goto _out
-
- :_out
- set program_=
- echo on
-