F-TENT - Scanner and disinfector for the Tentacle.1958 virus Copyright (c) 1996 Data Fellows Ltd OVERVIEW F-TENT will detect and disinfect the Tentacle.1958 Windows virus. This document gives a brief description of the Tentacle virus and explains how to use F-TENT to detect and disinfect this virus. ABOUT THE TENTACLE VIRUS This Windows-based virus was found in the wild from France and UK in March 1996. The virus was distributed in a file called dogzcode.zip via the alt.cracks usenet newsgroup. Tentacle infects Windows 3.1x EXE files. The virus infects only Windows 3.x executables (NE). The virus adds a new segment to the executable and modifies the structure of the file. Tentacle infects files in the current and Windows directories. It does not stay memory resident. Occasionally, Tentacle will replace the icon in the infected EXE file with it's own copy. This new icon has a picture of a tentacle and the text 'Tentacle'. Tentacle also sometimes corrupts EXE files when infecting them. Such program do not work after the infection. The author of this virus also wrote the Shell (Tentacle II) virus. SYMPTOMS Tentacle causes no obvious symptoms, except slowing the PC down (the infection process is slow). For this reason it is recommended that suspect PCs be scanned using the F-TENT utility. HOW TO USE F-TENT Run F-TENT with the drive letter of directory as a parameter. For example: F-TENT C: F-TENT Z:\USERS If F-TENT finds the virus, you will be notified. Then, type F-TENT /DISINF, and F-TENT will disinfect any infected files. IMPORTANT: It is not always possible to recover an infected file completely. The file will usually work after disinfection, but is not an exact copy of the original. We recommend reinstalling and restoring infected files instead of disinfecting them. Disinfected files will almost always work correctly, unless the program has a self-check routine. MS Mail and MS Schedule are examples of programs which will warn about failed self-check after disinfection. WHAT ABOUT FLOPPIES? Since infected files may have been copied to floppy diskettes, you will want to scan your floppy diskettes as well. To do this, invoke F-TENT using the /MULTI switch (eg F-TENT A: /MULTI). -- F-TENT by Peter Szor, Data Fellows F-PROT Professional Development. F-TENT is protected by international copyright laws. F-TENT is (c) 1996 Data Fellows Ltd, and it is not in public domain or freeware, but you are free to use and share this software with no charges in non-commercial private use. Use of this software in other environments is not allowed in Europe, Asia and Africa without a license to F-PROT Professional or a current license from Frisk Software International. To purchase a license, contact your local distributor listed in PRO.DOC. Please redistribute F-TENT only with this documentation. You are not allowed to resell this software for your own profit (normal copying costs excluded) or claim to hold rights to this software. Although you may have the right to use F-TENT, it will remain the exclusive property of Data Fellows. Data Fellows does not warrant that the software is error free and we will not cover any costs created by function or malfunction of this program. Data Fellows also disclaims liability for possible consequential damages. If you cannot agree to these restrictions, you should not use F-TENT. Copyright (c) 1996 Data Fellows Ltd, Finland Data Fellows Ltd Paivantaite 8 FIN-02210 ESPOO FINLAND tel: +358-0-478 444 fax: +358-0-478 44 599 e-mail: F-PROT-Support@DataFellows.com www: http://www.DataFellows.com/