Tools en Utilities/CDASS_5.ISO/shell/file/bff301.arj/BFF.DOC

Text File | 1995-02-19 | 22.0 KB | 503 lines

Bad File Finder - Version 3.01 - Hans Govaarts, Orion Automatisering

(C) 1993, 1995 All Rights Reserved....


1.  Introduction and features.

BFF is a program that has the ability to scan your drives for hacks. Scan
your archives for viruses and has a powerful netmail-function. Further,
it has many options that can be very helpful to you.

The features of BFF are :

* The ability to scan your entire HD for hacks. The hacks that are known have
been imported in the source of the program, so BFF scans your drive very
fast. Most hackscanners only have the ability to scan one directory.

* The first time BFF will find quite a few hacks. Normally these hacks will
be shown always when starting up BFF. BFF has a filter-option so it is
possible to "filter" the hacks the next time BFF starts up.

* A list of all the hacks can be created by writing them to disk.

* BFF can work like a real file finder. It's not necessary to enter wildcards
anymore, but just a string (small piece) of the filename you are looking
for. It's an easy way to find a file on your HD.

* When having a lot of archived files, it's possible to check them with BFF.
BFF has the ability to check all the archived files on your entire drive, or
seperate directory. The integrity of the files will be checked by extracting
them into a subdirectory. After extraction it's possible to check the files
with 3 virusscanners (MacAfee's Scan, TBAV and F-Prot). A logfile will be
created, so you can read the results after checking the archives.

* BFF will be released every few months with the latest updates from the
hacklists of Lee Jackson and AlarmNet Nederland (Dutch Network).


Sysops of BBS-es will find extra options !

* A badfiles.ctl can be created with BFF. With this option you can prevent
users to upload a known hack to your system. (Does not work with FileDoor !).

* It's very easy to use BFF in a nightly event. While scanning the HD for
hacks it is possible to write the results to disk....

* .... Uhhhm, better, to write the results to a netmail if you like. When no
hacks are found, it's possible to erase the output automatically.

* Directory's can be scanned in a way, that the filter-option will not be
used. The results can always be read through netmail or a file. This can
be helpful when scanning the useruploaddirectory.

* When your HD is full of archives in seperate directory's (area's), you can
select to scan for hacks in a specific directory (Easy for large BBS-es).
Further with BFF you can work with the archive-bit in various ways. It is
possible to scan your latest archives on your HD.

* If you scan your HD for viruses, and you use a logfile that is made by the
virusscanner, it is possible to copy the output of the scan to netmail (This
is also possible for every log of a particular program). The logfile will
then be deleted. BFF is also able to append the logfile itself to the
BFF-logfile when problems have been detected. When everything is OK, the
logfile will then be automatically deleted.

* BFF will always be FREEWARE for non-commercial use !

* BFF is still under construction. See also netmail.1st !

2.  What is a hack.

It's very difficult to give a good definition of the phenomenon hack. When a
program has been hacked, one or more changes are made to the program. E.g.
the program can be pirated, or it's possible that someone put a virus or a
trojan in the file. It is not always the truth that a trojan-file or a
virus-file will be scanned by a virus-scanner. When you start up a program
which claims to be a game and afterwards your HD has been formatted, then you
can also say that the program has been hacked.


3.  What are the hackreports and the hacklists.

So, the definition is not an easy one to give.... The names of the hacks are
collected by a few people in the world. One of them is Lee Jackson, who
brought out his hackreport every month. He did this job for several years,
but due to a disease he (temporarily) stopped with his report. His hackreport
is a great contribution for people that fight against hacks. His report can
be found on a lot of BBS-es in the world. Download the file HACK93*.* . The
latest issue however is from September 1993.

Another group of people who bring out the (Dutch) hacklist, is a group of
sysops living in the Netherlands. They created a kind of a warning system, so
that a lot of sysops of various nets (it's not always fido here ;-)) ) are
warned when a hack has been found somewhere, or when a virus-upload has been
reported. The nodes are gathered in the AlarmNet. The reports are bundled in
several lists that completes the hacklist. The hacklist is written in Dutch,
and can be found on all Dutch BBS-es that are connected to DigitalNet,
HupitelNet, MathNet and FidoNet (285-Net).  Since Lee Jackson stopped with
his report, AlarmNet Nederland also have implemented international hacks into
their lists (from October 1994).

The hacks reported in both lists are imported in BFF after the hackreports
have been released. In the header of the program you can find the version and
the month of release of BFF.


4.  Quick installation of BFF

- Create a directory with a name of your own choice, and extract the BFF-
archive into this directory.

- You must startup BFF from this directory when scanning your HD for hacks.
When using BFF as a File Finder very often, it's wise to adopt this directory
in your path.

- If you want to use the netmail-option create a file named 'NETMAIL.BFF'. On
the first line you fill in your name, on the second your main aka and on the
third line the path of your netmail-directory. Note : Every time a file or
log is copied to netmail, the original file will be deleted by BFF ! This to
keep your HD clean of unnecessary files. This option should only be used
by users that have a mailer online (sysops or points).

Since version 3.00+ it is possible to use BFFCFG.EXE to make a configuration-
file for you. The program is not very difficult to understand. See also
below...

- If you want to use the archive option edit the file 'PATHS.BFF', and fill
in the paths of your archivers and scanners. Do not erase the first 4
characters on each line ! When you do not want to use one or more programs
listed in the file, just erase the line or enter a semi-colon in front
of this line. You have to select at least one archiver, and at least one
virusscanner.

Since version 3.00+ it is possible to use BFFCFG.EXE to make a configuration-
file for you. The program is not very difficult to understand. See also
below...


5.  Commands and options of BFF

BFF has several options. The first time you start up BFF you probably find it
difficult to understand the parameters that have to be given to the program.
However, it is easy to understand once you know what kind of structure is
used for the parameters.

The first parameter is usually the one that is used to determine whether you
want the output sent to screen or to disk  Also other commands can be given
in the first parameter. The second parameter determines the filespecificati-
on. From the third parameter on, you can select three other parameters, which
will be explained below.

IMPORTANT !

You can use the archive-option in two ways. You can directly select this by
entering it as a command, and you can use it as an option of the commands
S or D. You have to select the last option, when you want to check all your
archives on your HD. This prevents you from making errors accidently, which
could cause a serious loss of your expensive time. When choosing for a
wildcard or complete directory you can select both ways...


5.1. BFF S <drive>

The program will start up and it will scan your whole drive for hacks. The
output of the program will be sent to screen. When a hack is found the
program will show you the filename and path. Further you can see where the
file is listed in one of the hackreports. For the meaning of the abbreviati-
ons, startup BFF with BFF /?. In the first screen you will see a scheme with
the abbreviations.

When a hack is found do NOT erase any file immediately. It is always possible
that the alarm is false. When you are using MSDOS, BFF will always find
several hacks in your DOS-directory. Just read the hackreports whether you
can determine if you have to do with a hack or not. Always regard this
program as an indicator of wrong files when searching for hacks !

5.2. BFF D <drive>

This option is the same as BFF S <drive> with one difference. Output will be
sent to the file "HACKREP?.BFF". The "?" stands for the drive you selected.

5.3. BFF D <drive> W

When no hack is found no output will be created to any file or netmail.

5.4. BFF S <drive> F

When starting BFF for the first time, you will notice that quite a few hacks
will be found on your HD. When running BFF more often, it can be annoying to
see these hacks again and again and again. Therefore it's possible to filter
these "hacks". Each time a hack is found BFF asks you if the file should be
filtered for the next time BFF starts up. BFF will then create and maintain a
list in a file named "FILTER.BFF". It is a plain textfile, so it's possible
to edit the list when it suits you. The next time BFF starts up, the hacks
you saw in the previous run, will be skipped.

5.5. BFF <S or D> <filespec> C

BFF will display all hacks found on the given path, regardless if the file
has been filtered before.


6.  Extra options of BFF

6.1. BFF or BFF ?

A helpscreen will be shown. When adding the parameter ? on the command line
more information of the program will be shown.

6.2. BFF L

The hacknames that are included in the source of BFF will be sent to the file
FILES.BFF

6.3. BFF B

This option is for sysops only. A list of hacks that are included in the
source of BFF will be sent to the file badfiles.ctl. The output chosen is
done in a way that this list can be used with BBS-programs like Remote
Access. Read the docs of your BBS-program how to use this file.

Note : This list can not be used with FileDoor !!! FileDoor is not capable of
getting so many hacks into the memory of your PC ! FileDoor will not start
up anymore and will give an error-message.

6.4. BFF F <string> <drive>

BFF can also be used like a real file-finder. With file-finders of several
commercial programs you can enter a wildcard when searching for a file. BFF
does not work like that. Just enter a string (piece) of the filename you are
looking for. E.g. when you are searching for COMMAND.COM you only have to
enter "BFF F omma". Command.com will then be found. When entering "BFF F
can", your HD is scanned for every filename containing the string "can".
Filenames as virusCAN, trashCAN or CANdy will be found. Within the string you
can also include the extension to find a file (e.g. BFF F F.EX).
It seems to me that it must quite easy now to find a file you are looking
for, certainly when you are doubting about the name of the file.
New from BFF version 2.20 and higher, is the option to select a specific
drive. This could not be achieved with older versions.

6.5. BFF P <listing> <D>

A new option in BFF (from 2.25 and higher) is to scan a file containing a
list of programs/files for hacks. The only condition to use this command is
that the format of the listing must be like a files.bbs or a BBS-allfiles-
listing. The programs/filenames to be scanned must be on the first 12
positions of one line. It is allowed to seperate the filename and the
extension with spaces.

With option D the output will be sent to the file "LISTING.BFF".

6.6 BFF S or D <filespec> V

From version 2.53 and higher it is possible to read a verbose output on
screen like file-finders and virusscanners usually do.


7. Checking archives

It is possible to check all your archives with BFF. The integrity of the
archives will be checked by extracting them into a subdirectory each time an
archive has been found on your HD. When the archive-program returns with
errorlevel 0 (no error occurred) the file will be checked for viruses. After
checking all the files in the subdirectory, they will be deleted. Only one
archive will be extracted at the time.

You have a little configuring to do when using this option. Within this
package you will find the file 'PATHS.BFF'. Please edit the file before using
this option. The only thing you have to do is to edit the paths of the
archive-programs and the virusscanners. BFF only supports ARJ, ZIP, LHA,
MacAfee's virusscanner, Thunderbyte Virusscanner and F-Prot. Please do not
adding any other virusscanner because BFF A will not work anymore when
configuring incorrectly. You can also use BFFCFG.EXE (see below)...

7.1. BFF <S or D> <filespec> <W,C or F> A

After a standard run of BFF, the program has created a file named
'ARCHTEST.BFF'. All archived files on your HD are stored in this textfile.
BFF will then create the subdirectory (see 7.0) and check all the files
stored in 'ARCHTEST.BFF'. After the run BFF will store the results in the
file 'ARCHLOG.BFF'. When netmailoption is used, BFF will copy the results to
a netmail-message. Each file scanned will be reported. When an error has
occurred, you can read the meaning of the error. 'ARCHTEST.BFF' will be
deleted after the run.

7.2. BFF A <filespec>

This will work the same as in chapter 7.1., only now BFF will only scan in
one directory or in a part of the directory. You have the option to scan the
whole directory (do not finish your entrance with a back-slash), or just a
few files by entering a wildcard, or just one file.

When you are a sysop, it could be very inconvenient to scan all the archives.
It would take a very long time, so I added this option.

NOTE : It is not possible to enter a drivecharacter here. Just use BFF S or D
for this !!!

7.3. BFF A <filespec> B

Only files with the archive-attribute set, will be checked. When everything
checkes out OK, the archive-bit will be removed from the file. The next
time BFF starts up with the same (!!!) parameters, BFF will skip these
files, and will not check them out again.

WHEN USING THIS OPTION, DO IT WITH CONSISTENCE !

This option can interfere with back-up programs ! Read the manual of the
back-up program that you use.

7.4. BFF A <filespec> M

Before checking out the archives you can check your computer's memory and
boot-record for viruses. When your system is not clean, BFF will report an
error-message and will hang your computer. You'll never know...

7.5. BFF A <filespec> L

Normally BFF will create a log-file when checking the archives. When adding
the L-option, BFF will also let the virusscanners create a log-file when a
archive is checked. When a file checkes out OK, BFF will automatically delete
these files. When a virus is found, BFF will add the logfile of the virus-
scanner to the BFF-logfile, and will then delete the logfile of the virus-
scanner to keep your system as clean as possible ( ;-) ).

7.6. BFF I <options>

This is the same as BFF A only you can specify more directory's or wildcards
that you save in the file FILES.BFF...

To use this only create an asci-file and use per line one specification.


8.  Ansiboms - option I

When adding the I-option all the files with the extensions .ANS, .ASC, .TXT,
.DOC, .MSG and .1ST will be checked. Maybe someone wants to add more extensi-
ons; let the author know. When an ANSI-bomb is found, BFF will show the first
60 bytes after the escape-code. When a string can be displayed, BFF will do
this. When ascii-codes of 31 and lower are found, BFF will only show the code
used for this bomb. When BFF comes with a report, it is not always the truth
that the message (or you) will have to do with an ansi-bomb. BFF just looks
for the escape-code in combination with the 'p' character, necessary for the
bomb. When an invalid ansi-code is found, BFF will also report this.

Note : This option can be used with both the archive-option as with the scan
commands S and D, e.g. BFF S <filespec> I, and BFF A <filespec> I is possi-
ble.


9.  Archive-bit manipulation - options R and S

This option can be chosen with BFF from version 2.52 and higher.

USE THESE OPTIONS WITH CARE !!!!

It's only possible to use this option with the S-command and will not work
when the archive-option is on during a run. The principle of this command is
that it can remove and set the archive-bit of many files on your HD in one
run. Therefore these options can interfere with back-up programs that use
this archive-bit.

When you have a lot of archives I can imagine that you do not want to use BFF
to scan all your files continuously. Before or after a run (with archive-
option on) you can e.g. run BFF with the parameters "S <drive> R".
The S stands for scanning hacks for drive. So on the chosen drive the
archive-bits of all archived files will be removed. When you run BFF later
with the B-option these files will be skipped for checking and only new files
that always "arrive" with the archive-bit set, will be checked. The B-option
will automatically remove the archive-bit of these files also. See also the
files examples.bff for other possibilities. BFF S <drive> S will set the
archive-attribute.


10. Requirements.

BFF without the archive-option will work with every PC (from XT until 486).

15 file-handles are needed, and when running under Desqview you need another
5 more (total of 20). It's to be recommended that you have at least 8 Mb free
on your HD when using the archive option.

Only when using the archive option BFF will need a lot more memory. At least
530 Kb must be free when everything has to work correctly. This has to do
with the memory-problems of MacAfee's Scan and F-Prot.

When you are short of memory, BFF will skip shelling to the archiver or the
virusscanner, and will report no errors. When things go wrong, BFF will stop
checking very quickly closing all the files.

When you have the suspicion that BFF is corrupt, or BFF does not work
correctly, you can always enter BFF V to let BFF erase all the secondary
files it has created.


11.  Nightly event (for sysops of BBS-es).

When selecting the option to sent the output to disk, BFF will never ask you
to press the 'enter' hotkey. Therefore it is safe for a sysop to include BFF
in one of its nightly events.


12.  BBFCFG and BFFBAT

From version 3.00 and higher you will find 2 simple programs that can help
you using Bad File Finder.

12.1  Bad File Finder Configuration

With Bad File Finder 2 configuration files are needed when you want to use
the archive-option and the netmail-option.

With the archive-option you need to enter the paths of the archivers and
virusscanners you want to use. BFFCFG will make this more comfortable for you
and can create this file. It's not very difficult to use and you will
certainly be able to configure PATHS.BFF.

When you are a sysop you will be asked to enter your name, nodenumber and
your netmail-path. The file NETMAIL.BFF will then be created. See for this
also the file NETMAIL.1ST.

12.2 Bad File Finder Batch-File Creator

Already since the beginning of BFF in January 1993 I received complaints
about the working of the parameters of BFF. I can imagine that when you look
at BFF for the first time that it is ugly and inconvenient. However if you
get used to BFF you will see that there is a kind of a good system in BFF.

BFFBAT.EXE will help you creating Batch-files for usage with BFF. After the
configuration you will be asked whether you want to store the information you
supplied, and when you confirm you will be asked for a filename. Enter this
filename without using the extension .BAT. When this file already exists in
the same directory as BFFBAT.EXE the information will be appended.

You can also try things out and erase test-batchfiles afterwards.


13.  Disclaimer.

Bad File Finder is freeware for non-commercial use !

This means, you may copy and distribute BFF freely in an unmodified form. You
are not allowed to make any changes, the copyright stays with the author. You
are not allowed to use this program in a commercial environment.

You are also not allowed to copy this file to CDROM or diskette that will be
used for commercial sales.

The BFF-archive should contain the following files :

BFF.EXE                  (Executable file)
BFF.OVR                  (Overlay-file for EMS)
BFF.DOC                  (This document)
BFFCFG.EXE               (Bad File Finder Configuration).
BFFBAT.EXE               (Bad File Finder Batch-File Creator).
EXAMPLES.BFF             (Examples for using Bad File Finder).

When one or more files are missing then don't use it !

The last Version of BFF is always available on the BFF support site
(Orion BBS, phone [phone]). Freq BFF*.* for the latest version of BFF.

Usage of BFF is at your own risk. The author can and will not be responsible
for any problems that appear by using BFF. The package is released as is.
The author is not obliged to release future versions. Of course I will try to
improve BFF in the future and will update the package as much as I can (each
month ;-) ) but I will not guarantee anything although I will always consider
requests of users...


14. Thanks to !

At first thanks to you for showing your interest in BFF of course !

I enjoyed creating BFF ! and I hope that I enjoyed other people also with
this package.

Thanks to those people who helped me creating this version of BFF.

Andre Hofman, Sjouke de Vegt, Jan Renting, Steven Hendriks, Andre Tromp
and Martin Arling, thanks for your help.

Also thanks to Lee Jackson for his hackreport :-).

I can be reached via netmail. Address your netmail to one of the following
nodenumbers :

64:100/0     - AlarmNet Nederland
15:1200/400  - DigitalNet
169:100/163  - ContactNet
2:282/208    - DFF/DCN / FidoNet
81:110/1     - FSFAN
9:317/200    - VirNet
27:5331/503  - SigNet
111:3112/0   - TechNet

An e-mail via InterNet is also possible. Send a message to...
[e-mail]
Your message will be sent through FidoNet and  will arrive here within a few
days.

Hans Govaarts, author Bad File Finder, sysop Orion BBS.