Filehawk 2.20 (c) 1991-1993 David Kesterton 65 Front St.W., Suite 116-32 Toronto, Ontario M5J 1E6 voice: (416) 340-1195 [first BBS release: April, 1993] Purpose Over the past five years, personal computers have become infested, not with viruses but with virus scanners. These scanners function on the same basic assumption: that if they can't find a virus signature, your system is safe. Let loose upon your computer like village vigilantes armed with pitchforks, they poke and prod your memory and hard drive, sometimes driving a virus or two into the open, thereby reaffirming their heroic stature. But what they discover is only what they look for: old, known viruses. New viruses are being written and released at an ever increasing rate. But before they can be caught and analysed, a system or two must be victimized. Filehawk is intended to detect hostile system activity that might otherwise be unnoticed by more popular security software. It should not be considered a replacement to your favorite scanner, but a partner. Features þ Backup and restore Partition Sector þ Backup and restore Dos Boot Sector þ Backup and restore File Allocation Tables þ Announce directory structure changes þ Announce file structure changes þ Scan new and changed files for virus signatures þ Scan new and changed files for Trademarks and Keywords þ Announce companion file and system time error warnings Distribution Filehawk is available only as follows: 1) a limited demo: 'HAWKxxx.yyy' [where 'xxx' is the version, 'yyy' is an archive format, the first release being HAWK220.ZIP]. This version may be listed on BBS's and freely copied. All files should be included and none of the contents may be changed. 2) a corporate license or individual registration, which has been modified to display the name of the licensed corporation or registered user, and which is only available directly from the author or any of his assigned agents. Filehawk may not be distributed by anyone not assigned by the author. It may only be distributed in a limited demo format as defined in (1) above. ÿ Filehawk License Agreement: Filehawk and its accompanying programs and files located on the original registration diskette, including subsequent versions, upgrades and revisions are collectively referred as Filehawk. Individual Registration A registered user (one person) may use Filehawk on one or more machines, as long as the usage is confined to the original registered user, and his or her immediate family (spouse and children). The registration period is for the lifetime of the user. Corporate License A corporate license for Filehawk extends to the entire corporation, all of its employees, and their immediate families (spouse and children) on all of their machines within one nation, for one year. A Government "corporate" license extends to all departments of one Government entity; e.g., Federal, Provincial, State, Municipal. An individual or corporate enterprise may make any number of backup and usage copies as long as the spare copies are not sold, rented, loaned or in any other manner made available to outside users; specifically, individuals or corporate entities who do not hold valid registrations or licenses. You may not modify any copyright notices or programs or original files. Technical Support is not included in any fee, but will not be withheld, unreasonably. Documented and mailed definitions of questions, discoveries, or problems arising from the use of Filehawk which may not be referenced in the documentation will be given preferential support. ÿ Warranty: The author licenses Filehawk AS IS for machines commonly trademarked or known as IBM, IBM-compatible, and models for which Filehawk was intended to be used, which are known or trademarked as PC, XT, AT, PS/n, 286, 386, 486. Warranty is limited to the ability of Filehawk to perform its functions error-free. If Filehawk cannot perform its ordinary functions to the total satisfaction of the registered individual or licensed enterprise within two months of the acceptance of the registration or license, write to request a full refund, with no questions asked. Simply submit a promise to delete all copies of Filehawk. For any claim related to the performance of Filehawk, any liability to actual damages will be limited to fees paid. ÿ System Requirements: Filehawk 2.20 was created for and intended to be used on machines known or trademarked as PC, XT, AT, PS/n, 286, 386, and 486. The program requires a minimum of 256K RAM and Dos 3.0 or higher. For Windows (tm) users, Filehawk should be defined as an MS-DOS utility or application. ÿ Fees Individual Registration: $40 (Includes all Provincial & Federal Sales Tax, and Shipping and Handling fees, whether local or outside Canada. Corporate License: $2 per company computer. Minimum fee is $50. A maximum of 10 diskettes will be shipped for any Corporate License. Your company representative is responsible for making additional copies for the purpose of distributing Filehawk to other branches, departments and users. If the registered user or company representative does not specify the size of diskette, a 3 1/2 inch diskette will be assumed. Sample Filehawk Screen |i ÿ ÿ Thursday August 27, 1993 6:13 pm ÿ LOG.000 ÿ ÿ ÿ 0:50 ÿ ÿSystem Update Paths/Files Update Paths/Files Comparisonÿ {Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ -File Allocation Table BACKUP created- ÿ ÿ ÿ ÿ New pathname: \DOS ÿ ÿ ÿ ÿ New pathname: \UTILITIES ÿ ÿ ÿ ÿ New filename: \IBMBIO.COM ÿ ÿ ÿ ÿ New filename: \IBMDOS.COM ÿ ÿ ÿ ÿ New filename: \TESTER.COM ÿ ÿ ÿ ÿ New filename: \STARTQ.EXE ÿ ÿ ÿ ÿ |i ÿ Filehawk v2.20 ÿ paths hdn EXE COM BAT SYS BIN OVL files ÿ ÿ (c) 1991-1993 ÿ ÿ old 0 0 0 0 0 0 0 0 0 ÿ ÿ David Kesterton ÿ ÿ new 2 1 3 1 2 1 1 1 27 ÿ ÿ ÿ ÿ |i ÿ 50% ÿ\UTILITY\IBMDOS.COMÿ ÿ ÿ ÿ ÿ exit scanner Methods System Comparison is a series of hard drive examinations which includes the copying and comparing of the Partition Boot Sector, Dos Boot Sector and the File Allocation Tables. Executable files, those with the extensions: .COM, .EXE, .BAT, .SYS, and 4 optional extensions, are "checksummed" and compared for changes. Contaminated boot sectors or scrambled File Allocation Tables can be restored from the copies. System Scanning is a search of system memory and executable files for virus signatures, trademarks and keywords. Filehawk automatically keeps a record of files already scanned. It will scan only files that are new or changed. The search for trademarks and keywords allows Filehawk to alert the user to the presence of some viruses immediately upon their release into the public domain. Quick Start - The Only Start Boot up your system from a clean, write-protected diskette, preferably from an original system boot diskette. Do not run any shells or applications of any kind. This is imperative for the first run only. Copy all program files to any directory. Run FILEHAWK.EXE. You require no command line, no arguments, no setup, and no intervention. The run is over when the Options Menu appears. After exploring the options, press to exit to Dos. In order for the program to run, it must have its data file -- FILEHAWK.BIN in the same directory. It will create its own update file -- FILEHAWK.SAV, which it uses to compare the system for changes. It will also generate one log file for each run. The First Run |i ÿ ÿSystem Update Paths/Files Update Paths/Files Comparison Virus Scanning ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ ÿ "System BACKUP and UPDATE file created" Filehawk creates its own update file the first time it executes. This holds boot sector copies as well as path and file vital statistics. By comparing and updating the contents, Filehawk can alert you to system abnormalities. In the demonstration version, the update file is called FILEHAWK.SAV. In the licensed version, for security purposes, the name of the update file is uniquely defined for the registrant. |i ÿ {System Update ÿ Paths/Files Update Paths/Files Comparison Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ ÿ "Master Boot Sector copy created" "Dos Boot Sector copy created" Since there is no update file the first time you execute Filehawk, the boot sector copies will be created and stored. If an infection already exists on those sectors, then bad copies are being made. Only the virus scanner or a study of abnormal system activity can point to pre-infection. |i ÿ {System Update ÿ Paths/Files Update Paths/Files Comparison Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ ÿ "FAT Tables Match [+13.83 Meg] "16.8 MEGABYTES free space available" The next procedure in the System Update is a comparison of the FATS or File Allocation Tables. If they do not match, then your files are at risk. The [+13.83 Meg] shows that 13,830,000 bytes were added to the system since the last update. This value is approximate because it is derived from the FAT, and is primarily used for evaluating FAT integrity. The next announcement, "16.8 MEGABYTES free space available", is a necessary reminder which alerts the user to a resource that some trojans and viruses tamper with. |i ÿ {System Update ÿ Paths/Files Update Paths/Files Comparison Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ -File Allocation Table BACKUP created- ÿ ÿ ÿ ÿ ÿ "-File Allocation Table BACKUP created-" Every time you run Filehawk, a File Allocation Table backup will be created and saved. In the licensed version, this backup can be used to restore the scrambled or damaged FAT tables. |i ÿ ÿSystem Updateÿ {Paths/Files Update ÿ Paths/Files Comparison Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ -File Allocation Table BACKUP created- ÿ ÿ ÿ ÿ ÿ "Paths/Files Update" The Paths/Files Update procedure reads each executable file and generates a "checksum" value. This is the most effective method of determining any and all system changes. In the first run, starting values are chosen at random resulting in file checksums that are uniquely initialized for each machine. You will have to initiate a first run for each computer that you operate. |i ÿ ÿSystem Update Paths/Files Updateÿ {Paths/Files Comparison ÿ Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ -File Allocation Table BACKUP created- ÿ ÿ ÿ ÿ New pathname: \DOS ÿ ÿ ÿ ÿ New pathname: \UTILITIES ÿ ÿ ÿ ÿ New filename: \IBMBIO.COM ÿ ÿ ÿ ÿ New filename: \IBMDOS.COM ÿ "Paths/Files Comparison" This procedure compares the last run's update checksums to determine system changes. During this first run, all paths and files are seen as new. Many messages will scroll rapidly up the window area. You will have a chance to view all of the messages after all procedures have ended. |i ÿ Filehawk v2.20 ÿ paths hdn EXE COM BAT SYS BIN OVL files ÿ ÿ (c) 1991-1993 ÿ ÿ old 0 0 0 0 0 0 0 0 0 ÿ ÿ David Kesterton ÿ ÿ new 2 1 3 1 2 1 1 1 27 ÿ ÿ ÿ ÿ |i ÿ 000K to bypass Memory Scan |i Before the files are scanned for viruses, the first megabyte of memory will be scanned for signatures. |i ÿ ÿSystem Update Paths/Files Update Paths/Files Comparisonÿ {Virus Scanning ÿ ÿ Master Boot Sector copy created Dos Boot Sector copy created ÿ ÿ ÿ ÿ FAT Tables Match [+13.83 Meg] 16.8 MEGABYTES free space available ÿ ÿ ÿ ÿ System BACKUP and UPDATE file created ÿ ÿ ÿ ÿ -File Allocation Table BACKUP created- ÿ ÿ ÿ ÿ New pathname: \DOS ÿ ÿ ÿ ÿ New pathname: \UTILITIES ÿ ÿ ÿ ÿ New filename: \IBMBIO.COM ÿ ÿ ÿ ÿ New filename: \IBMDOS.COM ÿ "Virus Scanning" This procedure scans only files that are new or changed. Since this is the first run, all executables are new, so all will be scanned. |i ÿ ÿ Thursday August 27, 1993 6:13 pm ÿ LOG.000 ÿ ÿ ÿ 0:50 |i The date-and-time line identifies the run. System problems, including date dependent viruses, can be traced to previous runs. The log for the current run appears on the same line. This file contains the record of events and conditions the program has detected. All variations, however insignificant, can later be studied for suspicious activity. The countdown timer, located beneath the current log, estimates the minutes and seconds remaining to complete the update and comparison procedures. As an approximate value which was calculated during the last run, it gives the means of evaluating a system's performance. Abnormal running times will be announced, since these can result from a virus or a system defect. |i ÿ Filehawk v2.20 ÿ paths hdn EXE COM BAT SYS BIN OVL files ÿ ÿ (c) 1991-1993 ÿ ÿ old 0 0 0 0 0 0 0 0 0 ÿ ÿ David Kesterton ÿ ÿ new 2 1 3 1 2 1 1 1 27 ÿ ÿ ÿ ÿ |i During the Paths/Files update, counts will be kept and displayed. The last column represents the total number of files of all extensions. Executables (EXE, COM, BAT, SYS, BIN, OVL) are listed in separate columns. Notice that hidden files are also counted, since viruses will sometimes create them for their own use. The "old" line contains counts from the last run; the "new" line contains the totals from the current run. Variations between each run will be highlighted because their importance should not be ignored. In some infections, unaccountable totals may be the only indication that a virus is at work on the system. OPTION MENU |p ÿ ÿ PARTITION SECTOR ÿ ÿ ÿ ÿ DOS BOOT SECTOR ÿ ÿ ÿ ÿ FILE EXTENSIONS ÿ ÿ ÿ ÿ EVENT LOGS ÿ ÿ ÿ ÿ RESTORE FAT ÿ ÿ ÿ ÿ HELP ÿ ÿ ÿ ÿ |p After the run completes, the Option Menu appears. The choices allow you to study the run, and correct some of the more obvious system problems. |p ÿ ÿ PARTITION SECTOR ÿ |p Select this to look at an ASCII representation of your Partition Sector, or Master Boot Record. Commercial virus scanners will see only the signatures they were programmed to see. They are unable to detect all malicious code. By comparing a copy of the original sector with what is currently contained in that sector, the slightest change will announce the contamination. Restore the sector if infected, or make a new backup copy if changed. |p ÿ ÿ DOS BOOT SECTOR ÿ |p The same options that are available for the partition sector, are available for the DOS boot sector. Restore if infected or generate a new backup if changed. |p ÿ ÿ FILE EXTENSIONS ÿ |p Hostile code is most likely to attack files with the extensions .COM, .EXE, .BAT, and .SYS. For this reason, Filehawk always updates and compares files with these extensions. With this option, you may select up to 4 additional extensions for regular updating and scanning. |p ÿ ÿ EVENT LOGS ÿ |p Because large numbers of events can scroll rapidly out of the viewing area, this option allows you to review and print the results of each run. |p ÿ ÿ RESTORE FAT ÿ |p Many Trojans, as well as viruses, will scramble one or both File Allocation Tables. Although it is preferable to copy the FILEHAWK.FAT backup file off your hard drive, Filehawk is capable of finding it on your scrambled drive. This option allows you to attempt a recovery of the FAT, without which your files would be inaccessible. This option is only available in registered and licensed versions. PARTITION BOOT MESSAGES ÿ Master Boot Sector copy created ÿ The first run creates a backup copy of the MBR. Because you cannot be certain that the Master Boot Record was a good and uncontaminated sector when this copy was made, you should carefully study system activity over the next few runs of Filehawk. ÿ Partition Boot Sector is unchanged ÿ The original MBR matches the copy byte for byte, indicating no threat to your Partition sector. This is the message you expect to encounter every time you run Filehawk. ÿ * Cannot read Partition Boot Sector * ÿ For some reason, Filehawk was not able ÿ Security software may be installed * ÿ to read the sector. This may occur if a security program was installed which relocates or encodes the sector. Test this by using a utilities program which can read absolute disk sectors. It is likely that a marauding virus will be equally locked out. If you receive this message, make certain that you performed the first run ONLY AFTER booting the computer from an original, write-protected boot diskette. ÿ ! Partition Boot Sector Has Changed ! ÿ If you have not adjusted the partition sector by adding or subtracting one of the partitions, then a virus may be at fault. After Filehawk completes, select the Partition Sector option, compare the original sector bytes to the copy, and restore the sector from the backup if necessary. Take careful note of any other abnormal events on your system. Go back to prior logs, studying them for unreasonable system changes. Dos Boot Messages ÿ Dos Boot Sector copy created ÿ Filehawk stores a copy of the Dos boot sector during the initial run. If the hard drive sector was already infected when the backup was made, a contaminated record will be used for comparisons. Carefully observe system activity during subsequent runs of Filehawk. ÿ Dos Boot Sector is unchanged ÿ The existing sector matches the backup byte for byte. If you are certain that there was no pre-infection of the hard drive, then your drive and files are safe. This is the message you expect to see every time you run Filehawk. ÿ * Cannot read DOS Boot Sector * ÿ You may encounter this if the Dos boot ÿ Security software may be installed * ÿ sector has been relocated. The likely cause is security software. If you are certain that such a protection program is responsible, then you may ignore the message. It is likely that the sector will be equally unavailable to most hostile software. ÿ !!! Dos Boot Sector Has Changed !!! ÿ If you have installed a new version of Dos, this message will result. If you have not updated your Dos version, the next most likely culprit is a virus. If the former is the case then you will want to make a new backup copy. When Filehawk concludes, select the Dos Boot Sector option. Choose option 1# to make a new backup copy, or 2# to restore the original Dos boot sector. FILE ALLOCATION TABLE MESSAGES ÿ FAT Tables Match ÿ The two tables match, byte for byte. Since the FATs point to the location of each file, some viruses and many more trojans attempt to scramble these tables. As long as the File Allocation Tables match, integrity of the file structure is maintained. ÿ FATS Do Not Match [-8.0 Meg] ÿ Unlike boot sectors which can change for sometimes valid reasons, the FAT tables should always match. If this message is displayed, then a serious condition has occured. For this reason, the megabyte message informs the user of the potential degree of damage. If the value is large -- greater than 0.5 Meg -- it is likely that the FATs have been scrambled. ÿ -File Allocation Table BACKUP created- ÿ Each time you run Filehawk, a FAT ÿ BACKUP will be created. Stored as ÿ a file, the copy is compressed on the drive itself. Should the hard drive File Allocation Tables be destroyed, restoration can proceed as long as the sectors where the backup was saved have not been tampered with. It would be in your best interest to always copy this backup to a floppy immediately after running Filehawk. FAT restoration is only available in the registered/licensed versions. ÿ ** Warning! excess changes in File Allocation Table # ÿ This common message indicates potential danger to your hard drive. Based on FAT calculations, it is determined that more than 2 megabytes of additions or deletions have occured. If you are responsible for the many additions or deletions, there is no problem. But if you did not engineer the changes, then review the results of Filehawk's comparison routine with care. DIRECTORY/PATH MESSAGES ÿ PATH DELETED \SAMPLE1 ÿ Filehawk announces the removal or the addition of a subdirectory. A ÿ NEW PATHNAME \SAMPLE2 ÿ common event, this helps to paint the total picture of incidents or conditions which may be affecting your hard drive. In some situations, a seemingly minor event may be far more significant when matched with other occurences. It is not unusual for hostile software to create new directories in order to hide malignant executables. ÿ !PATH HIDDEN! \SAMPLE1 ÿ Paths are not normally hidden, so from this warning you should look for the creation of hidden files. ÿ Path Visible: \SAMPLE2 ÿ Hidden subdirectories that become visible are rare events that must be brought to your attention. ÿ Path number exceeds maximum allowable ÿ Filehawk records a maximum of 255 pathnames. Beyond that, the paths are ignored. FILENAME MESSAGES ÿ FILE DELETED TEST.EXE ÿ If you did not delete the file, a trojan may be responsible. ÿ NEW FILENAME TEST.COM ÿ Some viruses create new files for their own purposes. Be alert to the addition of a .COM version of a file with an .EXE extension. If two files with the same name exist in the the same directory, the .COM file will be executed first. This is a standard technique of some hostile software. A separate warning will be given if this situation is encountered for the first time. ÿ FILE CHANGED! TEST.COM ÿ Viruses replicate by changing the contents of other files. They can attach themselves to the start or end of executables, or overwrite sections of the object file. If this warning appears, be certain that you were responsible for changing the file contents. If you did not, then most likely a virus was responsible. Filehawk automatically scans files that have changed. If Filehawk's scanner, or any other scanner fails to find hostile code in any file which has changed for no apparent reason, a virus is still the probable cause. ÿ ATTRIBUTES CHANGED TO ----> READ ONLY -HIDDEN- *SYSTEM* +ARCHIVE+ NORMAL. One or more of the attributes may be changed in a file. It is not unusual for a utility or backup program to update file attributes, usually from Normal to Archive. But be alert to the removal of Read Only or Hidden attributes from major system files. All attribute changes should be accounted for. ÿ Dup filename \DOS\CHKDSK.COM ÿ Duplicate filenames for the most ÿ \CHKDSK.COM ÿ part indicate redundancy. Delete one copy to free up space. This announcement is made for changed or new files with the result that it appears once only for the same files. ÿ Number of files exceeds maximum storage allotment. Filehawk can remember up to 3000 executable files. If this message appears, it may be time for you to archive little used or redundant files. Virus Scanning Messages ÿ DANGER: A signature for the "Vicious" Virus is in: ÿ \DOS\FORMAT.COM 2218 A virus signature has been identified in the file FORMAT.COM. This does not necessarily mean that the file is infected. The signature scanning method is the least reliable means of determining file infection. This is because the method assumes that the signature is located only in an infected file. Since it is possible for a signature to appear in an ordinary file, the file update procedure is necessary for cross-referencing. If files which have changed on the system show positive warnings, then they are likely infected. Additional cross-referencing is accomplished with the trademark and keyword scans, since infected files frequently contain more than one signature or keyword string. The number after the filename, in this case "2218", is a reference code which identifies the signature encountered. Include this number if writing to seek more information. ÿ <*> WARNING: a virus trademark can be found in the line: ÿ this is a test showing ÿBigGuys Incorporatedÿ as a sample trademark ÿ located in: \UTILITY\TEST.EXE 3819 A 'trademark' is a string that a virus writer has included in at least one of his creations. The author usually displays it as a trademark, which suggests that if he creates more viruses, they will contain the same trademark. Where this has occured in the past, the trademark has been repeated in a new virus. This has resulted in Filehawk being able to detect some viruses in advance of their release into the public domain. The presence of a trademark does not confirm the existence of a virus. Study the line in which the trademark appears, as this usually indicates whether or not the author's intent is to announce his creation. ÿ <+> Caution: a virus keyword can be found in the line: ÿ this is a test showing ÿSaMpLe ÿ as an example keyword ÿ located in: \UTILITY\TEST.EXE 3733 Virus keywords are strings that tend to occur in hostile software. Because a keyword can easily appear in uninfected files, the context of the string will be significant. Keyword categories include: profanity, demonology, romance, hostility, terrorism, and other predictably adolescent interests. Filehawk is able to detect all uppercase-lowercase mixtures of a keyword, eg. sample, SAMPLE, sAmPlE. The presence of a keyword is least likely to confirm the existence of hostile code. The keyword is normally supportive evidence where sometimes a trademark or a signature merely suggest a virus. In itself, the keyword is not proof. OTHER MESSAGES ÿ System Update HAS EXCEEDED TIME ESTIMATE BY: 7 SECONDS ÿ Paths/Files Update SHORTER THAN TIME ESTIMATE BY: 12 SECONDS The length of time it takes for a procedure to run is saved and compared with the current duration. Times greater than or less than 4 seconds are noted in the log to help in system evaluation. If you have not added or deleted files since the last run, and the time estimates are abnormally high, then a virus, or another hostile event, may be active on your system. ÿ *WARNING* Executable Files of the same name are in the same directory: ÿ \UTILITY\BASIC.COM ÿ \UTILITY\BASIC.EXE One technique used by viruses, is to create a "COMPANION" file. A .COM file containing the viral code will be created in the same path as a file with an .EXE extension. Given the command to execute the file, Dos elects to run the harmful .COM file, ignoring the intended .EXE file. If you try running a .BAT file, while a .COM or .EXE file with the same name exists in the same directory, the .COM or .EXE file will be executed by Dos. It is not unusual to encounter companion files on ordinary systems. They are used for a variety of reasons by normal applications. For this reason, the announcement will occur once only -- for new and changed executable files. ÿ UNABLE TO READ UPDATE FILE ÿ The update file stores adjustable data. When it cannot be found, Filehawk creates one for the first time. If it cannot be read, a hard drive error is the likely cause. ÿ INSUFFICIENT MEMORY ÿ Over time, because of the steady rise in the ÿ 142K REQUIRED 98K AVAILABLE ÿ number of virus signatures, memory needs are expected to rise. Filehawk lets you know how much memory it requires. The solution is to run Filehawk before loading TSRs or run it outside of memory-gobbling shells. The example shows the total memory Filehawk requires (142K), to process extra signature data, and how much free memory is available (98K). In this example, you must provide Filehawk with an additional 44K. ÿ * COMMAND UNAVAILABLE * ÿ The demonstration version of Filehawk, available on ÿ This is a demonstration ÿ some Bulletin Board Systems, does not allow the use ÿ version only ÿ of all commands: restoring a scrambled FAT table is the only feature not permitted on the demo version. - end -