TBSCAN.HLP This file will be displayed if using the 'help' option of TbScan.

 This help is very comprehensive and does NOT replace the documentation!

Program invokation:

TBSCAN [@][<path>][<filename>]... [<options>]...

Example:
TBSCAN C:\ D:\

When no filename has been specified but only a drive and/or path,
then the specified path will be used as top-level path.All its
subdirectories will be processed too.

When a filename has been specified then only the specified path
will be searched. Subdirectories will not be processed.

Wildcards in the filename are allowed although only executable
files will be processed.

You can also specify a list file to TbScan. A list file is
a file that contains a list of paths/filenames to be scanned.
Preceed the file with the character '@' on the TbScan command line:
TBSCAN @TBSCAN.LST

Command line options

optionwordparameter shortexplanation
------------------- ----- -------------------------------------

helphe=help (-? = short help)
pausepa=enable 'Pause' prompt
monomo=force monochrome
quickqs=quick scan (uses Anti-Vir.Dat)
allfilesaf=scan non-executable files too
mutantmu=enable fuzzy search
heuristichr=enable heuristic alerts
directdd=direct calls into DOS
extractex=extract signature (registered only)
validva=force signature file authorization
onceoo=only once a day
compatco=maximum-compatibility mode
ignofilein=ignore no-file-error
nobootnb=skip bootsector check
sectorss=scan all disk sectors
nomemnm=skip memory check
hmahm=force HMA scan
nohmemnh=skip UMB/HMA scan
subdirsd=scan in sub directories
nosubns=skip sub directories
noavrna=do not use AVR modules
repeatrp=scan multiple diskettes
batchba=batch mode. No user input
deletede=delete infected files
movemv=move infected files
loginfoli=log lowercase flags too
logallla=log files unconditionally
expertlogel=no heuristic descriptions in log
log[=<filename>]lo=append log file
session[=<filename>]sl=create session log file
path=<move-path>mp=set move-path
rename[=<ext-mask>]rn=rename infected files
sigfile[=<filename>]sf=signature file to be used

help (he)

If you specify this option TbScan displays the contents of the
TBSCAN.HLP file if it is available in the home directory of TbScan.
If you specify the '?' option you will get the summarized help info
as listed above.

pause (pa)

When you enter option 'pause' TbScan will stop after it has checked
the contents of one window.

mono (mo)

This option forces TbScan to refrain from using colors in the
screen output.

quick (qs)

If you specify this mode TbScan will use the Anti-Vir.Dat files to
check for file changes since the last time. If a file has been changed
(CRC change) or is not yet listed in Anti-Vir.Dat it will be scanned.

allfiles (af)

This option causes TbScan to scan non-executable files (files without
extension COM, EXE, SYS or BIN) too. If TbScan finds out that such
a file does not contain anything that can be executed by the processor
the file will be 'skipped'. Otherwise the file will be searched for
AVR, COM, EXE and SYS signatures. TbScan however will not perform
heuristic analyzes on these files.

It is recommended to NOT use this option for a normal system scan.

mutant (mu)

If you use the 'mutant' option TbScan allows up to two extra changes
anywhere in the signature. Needless to say, if you use this option
false alarms may occur. Therefore this option is not recommended to
be used in a regular scan session.

heuristic (hr)

TbScan always performs a heuristic scan on the files being
processed. However, only if a file is very probably infected with a
virus TbScan will report the file as being infected. If you use
option 'heuristic' TbScan is somewhat more sensitive. In this mode
90% of the new, unknown, viruses will be detected without signature,
but some false alarms may occur.

direct (dd)

TbScan communicates with DOS through interrupt 21h. To prevent this
from being 'monitored' by viruses, option 'direct' can be entered on
the command line. TbScan will use its built-in debugger to trace
through the chain of interrupts until it has reached the DOS entry
point. This address is shown on the display and from then on it
will be used for TbScan communication with DOS.

valid (va)

If you have changed the contents of the signature file, TbScan will
issue a warning to that effect. If you don't want this warning to be
displayed, use the 'valid' option.

once (oo)

If you specify this option TbScan will 'remember' after its scan
that is has been executed that day, and that it should not be run
again the same day with this particular option set. This option is
very useful if you incorporate it in your AUTOEXEC.BAT file.

compat (co)

Use this option if TbScan does not behave as can be expected or even
halts the system. This option will slow down the scanning process so
it should only be used when necessary. Note that option 'compat'
does not affect the results of a scan.

ignofile (in)

If this option is specified and no files can be found, TbScan will not
display the 'no files found' message, nor does it exit with errorlevel 1.

sector (ss)

This option is experimental. It enables the scanning operation of a
disk at sector level. This way you can trace those viruses that
reside outside files and bootsector and the hard-to-spot stealth
viruses.

This option might also tell you that a virus ever resided in your
system in the past.If so, this does not mean that the virus
itself is still active. Even if TbScan itself deleted an infected
file in the past, this option still enables TbScan to detect the
signature for quite a while. Hence this option is NOT recommended
for a regular scan.

Note that TbScan cannot disassemble files in this mode. False
alarms may occur frequently since everything is being searched, and
the search even covers unused disk space containing garbage.

hma (hm)

TbScan detects the presence of an XMS-driver, and scans HMA
automatically. If you have an HMA-driver that is not compatible
with the XMS standard you can use the 'hma' option to force TbScan
to scan HMA.

nohmem (nh)

By default TbScan identifies RAM beyond the DOS limit and scans that
too. You can use the 'nohmem' option to disable the scanning of
non-DOS memory.

noavr (na)

If you specify this option TbScan will not look for its AVR modules
(Algorithmic Virus Recognition modules; .AVR files) at start-up.

delete (de)

If you specify the 'delete' option, TbScan will not ask the user
what to do but will delete the infected file automatically. Use
this option if you have established that your system has been
infected.Make sure that you have a clean back-up, and that you
really want to get rid of all infected files at once.

rename (rn)

If you specify the 'rename' option, TbScan will not ask the user
what to do but will rename the infected file automatically. By
default, the first character of the file extension will be replaced
by the character 'V'. This prevents the infected programs from being
executed, spreading the infection. At the same time they can be kept
for later examination and repair.

move (mv)

If you specify the 'move' option, TbScan will not ask the user what
to do but will move the infected file to another directory
automatically.

The file will be moved to the TbScan directory or to the directory
specified with option 'path'.

path (mp)

This option can be used to specify the move-path. The move path is
used to move an infected file if option -move is specified or when
the user selects the M) in the virus alert window.

batch (ba)

If TbScan detects a file virus it prompts the user to delete, move
or rename the infected file, or to continue without action. If you
specify the 'batch' option TbScan will always continue. This option
is designed for use in a batch file that is executed without the
user attending. We highly recommended you to use a log file in such
situations, as a scanning operation does not make much sense
without the return messages being read.

repeat (rp)

This option is very useful if you want to check a large amount of
diskettes. TbScan does not return to DOS after checking a disk, but
it waits until you insert another disk in the drive. You don't have
to press a key on the keyboard when ready. TbScan detects
automatically when the drive is ready to be accessed.

log (lo)

When you use this option, TbScan creates a LOG-file.The default
filename is TBSCAN.LOG and it will be created in the current
directory.You may optionally specify a path and filename. If the
log file already exists, the new LOG-file will be appended to the
existing one.

session (sl)

This option is nearly identical to the 'log' option above. The
difference is that if a log file already exists, the 'session'
option will make sure that this will be overwritten by new log
information.

loginfo (li)

If you use a log file and want to log files with lower-case
(informative) warnings too, you should specify this option.

Note: you have to combine this option with option 'log' or
'session'.

logall (la)

If you use a log file and want a complete file listing (of all files
that have been scanned) in the log file, you can use this option.

Note: you have to combine this option with option 'log' or
'session'.

expertlog (el)

If you specify this option TbScan will not display the descriptions
of the heuristic flags into the log file.

sigfile (sf)

You can override the default path and name of the signature file by
using this option.

---

The heuristic flags

C - File has been changed.

This warning can only appear if you used TbSetup to generate the
Anti-Vir.Dat files. If this warning appears this means that the
file has been changed. If you did not upgrade the software it is
very likely that a virus infected the file! Note that TbScan does
not display this warning if only some internal configuration area
of the file changes. This warning means that code at the program
entry point, the entry-point itself and/or the file size have been
changed.

c - No information found.

This warning indicates that no checksum/recovery information has
been found about the indicated file. It is highly recommended to
use TbSetup in this case to store information of the mentioned
file. This info can later be used for integrity checking and to
recover from virus infections. If warning 'V' is displayed too, the
file has been excluded from integrity checking to avoid false
alarms.

F - Suspicious file access.

TbScan has found instruction sequences common to infection schemes
used by viruses. This flag will appear with those programs that
are able to create or modify existing files.

R - Suspicious relocator.

Flag 'R' refers to a suspicious relocator. A relocator is a
sequence of instructions that changes the proportion of CS:IP. It
is often used by viruses, especially COM type infectors. Tests on a
large collection of viruses show that TbScan issues this flag for
about 65% of all viruses. Those viruses have to relocate the CS:IP
proportion because they have been compiled for a specific location
in the executable file; a virus that infects another program can
hardly ever use its original location in the file as it is appended
to this file. Sound programs 'know' their location in the
executable file, so they don't have to relocate themselves. On
systems that operate normally only a small percentage of the
programs should therefore cause this flag to be displayed.

A - Suspicious Memory Allocation.

The program uses a non-standard way to search for, and/or allocate
memory. A lot of viruses try to hide themself in memory so they use
a non-standard way to allocate this memory. Some programs
(high-loaders or diagnostics software) also use non-standard ways
to search or allocate memory.

N - Wrong name extension.

Name conflict. The program carries the extension .EXE but appears
to be an ordinary .COM file, or it has the extension .COM but the
internal layout of an .EXE file. TbScan does not take any risk in
this situation, but scans the file for both EXE and COM type
signatures. A wrong name extension might in some cases indicate a
virus, but in most cases it doesn't.

S - Search for execuatbles.

The program searches for *.COM or *.EXE files. This by itself does
not indicate a virus, but it is a ingredient of most viruses anyway
(they have to search for suitable files to spread themselves).If
accompanied by other flags, TbScan will assume the file is infected
by a virus.

# - Decryptor code found.

The file possibly contains a self-decryption routine. Some
copy-protected software is encrypted so this warning may appear for
some of your files.

V - Validated program

The program has been validated to avoid false alarms.

If warning 'c' is not displayed:
The design of this program would normally cause a false alarm
by the heuristic scan mode of TbScan.

If warning 'c' is displayed too:
This program might change frequently, and the file is excluded
from integrity checking.

These exclusions are stored in the Anti-Vir.Dat file by either
TbSetup (automatically) or by TbScan (manually).

E - Flexible Entry-point

The program starts with a routine that determines the location of
itself within the program file. This is rather suspicious because
sound programs have a fixed entry-point so they do not have to 
determine this location. For viruses however this is quiet common:
about 50% of the available viruses cause this flag to be displayed.

The DOS 5.0 Format program causes this flag to be displayed too.

L - program Load trap.

The program might trap the execution of other software. If the
file also causes flag M (memory resident code) to be displayed, it
is very likely that the file is a resident program that determines
when another program is executed. A lot of viruses trap the program
load and use it to infect the program. Some anti-virus utilities
also trap the program load.

D - Direct disk access.

This flag is displayed if the program being processed has
instructions near the entry-point to write to a disk directly. It is
quite normal that some disk-related utilities cause this flag to be
displayed. As usual, if many of your files (which have no business
with the disk) cause this flag to be displayed your system might be
infected by an unknown virus.

M - Memory resident code.

TbScan has found instruction sequences which could cause the
program to hook into important interrupts.A lot of TSR (Terminate
and Stay Resident) programs will trigger this flag, because
hooking into interrupts is part of their usual behaviour. However,
if a lot of non-TSR programs cause this warning flag to appear, you
should be suspicious. It is then likely that your files have been
infected by a virus that remains resident in memory.

! - Invalid program.

Invalid opcode (non-8088 instructions) or out-of-range branche.

The program has either an entry point that has been located outside
the body of the file, or reveals a chain of 'jumps' that can be
traced to a location outside the program file.

Another possibility is that the program contains invalid processor
instructions.

The program being checked is probably damaged, and cannot be
executed in most cases. Anyway, TbScan does not take any risk and
uses the 'scan' or 'browse' method to scan the file.

T - Invalid timestamp.

The timestamp of the program is invalid: e.g. the number of seconds
in the timestamp is illegal, or the date is illegal or later than
the year 2000. This is suspicious because many viruses set the
timestamp to an illegal value (like 62 seconds) to mark that they
already infected the file, preventing themselves from infecting a
file for a second time round. It is possible that the program being
checked is contaminated with a virus that is still unknown,
especially if many files on your system have an invalid timestamp.
If only a very few programs have an invalid timestamp you'd better
correct it and scan frequently to check that the timestamp of the
files remains valid.

J - Suspicious jump construct.

The program did not start at the program entry point. The code has
jumped at least two times before reaching the final start-up code,
or the program jumped using an indirect operand. Sound programs
should not display this kind of strange behaviour. If many files
cause this warning to be displayed, you should investigate your
system thoroughly.

? - Inconsistent header.

The program being processed has an exe-header that does not reflect
the actual program lay-out. The DOS SORT.EXE program will cause
this warning to be displayed, because the actual size of the
program file is less than reported in the 'size-of-load module'
field in the exe-header! Many viruses do not update the exe-header
of an EXE file correctly after they have infected the file, so if
this warning appears a lot it seems you have a problem.

G - Garbage instructions.

The program contains code that seems to have no purpose other than
encryption or avoiding recognition by virus scanners. This flag is
very important, in fact it is the only flag that is powerfull
enough to cause by its own that TbScan reports the file as
infected. In most cases there will not be any other flags since the
file is encrypted and the instructions are hidden for the scanner.

U - Undocumented system call.

The program uses unknown DOS calls or interrupts. These unknown
calls can be issued to invoke undocumented DOS features, or to
communicate with an unknown driver in memory. Since a lot of
viruses use undocumented DOS features, or communicate with memory
resident parts of a previously loaded instance of the virus, it is
suspicious if a program performs unknown or undocumented
communications. However, it does not necessarily indicate a virus
because some 'tricky' programs use undocumented features too.

Y - Invalid bootsector.

The bootsector is not completely according to the IBM defined
bootsector format. It is likely that the bootsector contains a
virus or has been corrupted.

Z - EXE/COM determinator.

The program seems to check whether a file is a COM or EXE type
program. Infecting a COM file is a process that is not similar to
infecting an EXE file, so viruses that are able to infect both
program types should be able to distinguish between them.

There are of course also innocent programs that need to find out
whether a file is a COM or EXE file. Executable file compressors,
EXE2COM converters, debuggers, and high-loaders are examples of
programs that may contain a routine to distinguish between EXE and
COM files.

O - code Overwrite.

This flag will be displayed if TbScan detects that the program
overwrites some of its own instructions. However, it does not seem
to have a complete (de)cryptor routine.

B - Back to entry.

The program seems to execute some code, and after that it jumps
back to the entry-point of the program. Normally this would result
in an endless loop, except when the program has also modified some
of its instructions. This is quiet common behaviour for computer
viruses. In combination with any other flag TbScan will report a
virus.

K - Unusual stack.

The EXE file being processed has an odd (instead of even) stack
offset or a suspicious stack segment. Many viruses are quiet buggy
by setting up an illegal stack value.

p - Packed or compressed file.

The program has been packed or compressed. There are some utilities
that are able to compress a program file, like EXEPACK or PKLITE.
If the file was infected after the file had been compressed, TbScan
will be able to detect the virus. However, if the file had already
been infected before it was compressed, the virus has also been
compressed in the process, and a virus scanner might not be able to
recognize the virus anymore.

w - Windows or OS/2 header.

The program can be or is intended to be used in a Windows (or OS/2)
environment.

h - Hidden or System file.

The file has the 'Hidden' or the 'System' file attribute set.

i - Internal overlay.

The program being processed has additional data or code behind the
load-module as specified in the exe-header of the file. The program
might have internal overlay(s), or configuration or debug
information appended behind the load-module of the EXE file.
