THE VIRUS TERMINUS -- v4.8B Copyright 1990-1993 S.T.CALISE All Rights Reserved!! STC BBS: 908-206-1386 TABLE OF CONTENTS page Brief Program Overview ........................... 3 Hardware/Software Required ........................... 3 Operation Restrictions ........................... 3 Disinfection Sequence ........................... 4 Installation - General ........................... 5 Installation Procedure for Systems Already Infected ........................... 6 360Kb Disk Install/Swapping ........................... 8 Terminus Start-Up Options ........................... 9 Self-Test Virus Check ........................... 9 Start-Up Virus Check ........................... 9 Configure Terminus ........................... 10 Default Parameters/Options ........................... 10 Adding NEW Options ........................... 11 DOS Session ........................... 11 Mouse Operation ........................... 12 SCAN/CLEAN Version Notes ........................... 12 SCAN/CLEAN Files Menu ........................... 13 SCAN/CLEAN Drive(s) Menu ........................... 13 IMMUNIZATION/RECOVERY Menu ........................... 13 REPORT FUNCTIONS Menu ........................... 14 VIRUS Info Sheets ........................... 14 SCAN/CLEAN Option Switches ........................... 15 SAVING SCAN/CLEAN Options ........................... 16 OPTIONS Lock ........................... 16 OPTIONS Lock Password ........................... 16 Limit Operation To Floppies ........................... 17 Experimental Virus Data ........................... 18 WRITE PROTECTED Floppy Notes ........................... 18 SCREEN SAVER ........................... 19 Memory Available Function ........................... 19 DOS ERRORLEVEL on Exit ........................... 19 Operation From WINDOWS ........................... 20 Program ERROR Messages ........................... 20 Upgrades ........................... 22 Registration Information ........................... 22 Acknowledgements ........................... 23 Additions/Changes VTEC48B ........................... 23 - PAGE 2 - ***** Programs included in THE VIRUS TERMINUS(c) Package: VT48B.EXE ; VTCF2B.EXE ; VTCF48.EXE ; PRINTDOC.BAT ; VT48BDOC.TXT ; STC.ICO README48.TXT (7 files ONLY!) ***** You have a contiguous five(5) day period to evaluate THE VIRUS TERMINUS starting from the date you first receive it. Your PAID registration/ license is required for any use beyond this period. The author and holder of copyright hereby disclaim all warranties relating to this software, whether express or implied, including and without limitation to any implied warranties of merchantability or fitness for a particular purpose. The USER of this software shall bear all risk as to the quality and performance of the software. In no event shall S.T.Calise be liable to you for any consequential, special, incidental or indirect damages of any kind arising out of the performance or use of the software, even if S.T.Calise has been advised of the possibility of such damages. THE VIRUS TERMINUS(c) IS DISTRIBUTED 'AS IS' . ALL RIGHTS ARE RESERVED! ******************** PAID Registration gives license and right to use The Virus Terminus on a single machine for personal home use only and updates as described in VT48BDOC. A PAID negotiated site license is required for educational, business, corporation, government and/or agency environment use. ******************** **** REFER TO PAGE #22 FOR REGISTRATION FORM - PERSONAL HOME USE ONLY! **** ****************************************** Trademarks of other companies mentioned in this program,help file and/or accompanying documentation appear strictly for identification purposes only and are the property of their respective companies. Refer to pages 22,23 for trademark acknowledgements. * It is strongly suggested that you get experienced help in * * dealing with computer virus infection. * - PAGE 3 - THE VIRUS TERMINUS(c) is a SHELL Menu utility program for the McAfee Associates Anti-Virus programs VIRUSCAN, CLEAN, and VALIDATE. VIRUS TERMINUS is menu driven and may be used with a mouse or keyboard. The SCAN/CLEAN option switches have been made visible and can be toggled through an easy to use interface. Reports may be viewed, printed, merged or deleted. Virus Info Sheets allow the user to obtain information on virus infectors such as the known characteristics, areas of damage, the McAfee Associates disinfection program needed, etc. A quick program test is available and there are a variety of options including screen saver, options lock with password, mono video mode, etc. Virus Terminus v4.8 supports SCAN/CLEAN's advanced IMMUNIZATION and RECOVERY functions. These functions help to provide protection with recovery after detection from new or unknown virus infectors. ****** HARDWARE RECOMMENDATIONS ****** RAM MEMORY: 640K BYTES MEMORY (512K MIN) DISK DRIVE: HARD DRIVE + (1 or 2 FLOPPIES) or 2 FLOPPY WITHOUT A HARD DRIVE - ONE SHOULD BE 720K, 1.44M, or 1.2M HIGH CAPACITY TYPE (See note on 360Kb installation.) VIDEO : (True MDA),(CGA C80) TEXT MODE/EMULATION REQ. or VGA/EGA Downward Compatible to CGA OPERATION : KEYBOARD or MS COMPATIBLE MOUSE OPTIONAL SOFTWARE REQUIREMENTS: PC/MS DOS V2.11 - 5.0 (DOS 3.1 or higher required for certain SCAN/CLEAN options) Version 9.14v102 - SCAN, CLEAN; VALIDATE.COM; VIRLIST.TXT from McAfee Associates (See Version notes & restrictions) ***** SOME GENERAL OPERATION GUIDELINES: DO NOT run The Virus Terminus from the hard disk if your system is already infected. Read Page #4 for disinfection sequence. DO NOT use the Virus Terminus in any environment or on any machine where another virus disinfector utility is currently installed and running. This includes but is not limited to TSR virus utilities. No claim is made herein or otherwise as to compatibility with other author/program virus disinfector & detector utilities. The Virus Terminus was designed to run in a stand-alone PC environment. This does not include use in LAN environments, etc. Users should make every effort to use only the most recent versions of SCAN, CLEAN and the Virus Terminus. Version 4.8B of The Virus Terminus was updated for CLEAN/SCAN 9.14v102 Files contained in archive envelopes should be extracted using an appropriate archive extraction utility before processing. - PAGE 4 - ***** TYPICAL DISINFECTION SEQUENCE: * It is strongly suggested that you get experienced help in * * dealing with computer virus infection. * * The outlined procedure below is a suggested typical disinfection * * sequence. This procedure may vary depending on the extent and * * type of computer virus infection being dealt with. These * * instructions are not meant to replace those which are found in * * the documentation for SCAN and CLEAN. * DO NOT RUN THE VIRUS TERMINUS FROM A HARD DISK if your system is already infected. Use the following steps for best results: 1. Power Down your system. DO NOT reset your computer by pressing CTRL-ALT-DEL or the hardware reset button! 2. Boot from a KNOWN NON-INFECTED WRITE-PROTECTED DOS SYSTEM DISK. 3. Use the floppy installation procedure for systems already infected as outlined on page #6 . Write Protect your disk. Do a SELF-TEST. 4. SCAN your hard disk to determine which and/or how many virus infections may be present. Make sure MEMORY SCAN is toggled ON. 5. CLEAN - Disinfect your hard disk. Use the virus ID code previously reported by SCANand make sure MEMORY SCAN is ON. Do a SELF-TEST. NOTE: If you are unable to access your hard disk after booting from a floppy, check to make sure that any special device drivers needed to use the hard disk are on the floppy and run from the CONFIG.SYS or AUTOEXEC.BAT file.AT THIS POINT IF YOU HAVE NOT DONE A BACKUP OF ANY CRITICAL FILES ON YOUR SYSTEM, THEN DO SO IMMEDIATELY. If more than one virus type was detected, then CLEAN-UP will have to be run for each type of virus. 6. Power down the system after CLEANing your hard disk. 7. Check your hard disk once again with SCAN to make sure you were successful in disinfecting the system. If not, repeat steps #1, 2, 4, 5, 6 and 7 all over again. 8. Now, check any floppies that may have been inserted into your drives to determine if they are infected. If so, follow the directions in the CLEAN documentation to disinfect. Power Down your system when finished. 9. SCAN your Hard Disk once again to make sure you have not reinfected your system. Make sure MEMORY CHECK is toggled ON. Perform a SELF-TEST. Failure to disinfect floppies previously used in an infected system may lead to virus re-infection. - PAGE 5 - ***** INSTALL THE VIRUS TERMINUS(c): ( NON-Infected System Only! ) THE VIRUS TERMINUS(c) operates most efficiently when used in conjunction with a hard drive. You may also run this program from a floppy drive when your hard drive is infected.(360K, 720K, 1.2MEG, 1.44MEG disk size) Please read page #8 for information on 360Kb installation SCAN/CLEAN disk swapping. McAfee Associates files : SCAN.EXE; CLEAN.EXE; VALIDATE.COM; VIRLIST.TXT VIRUS TERMINUS files : VT48B.EXE; VTCF2B.EXE; VTCF48.EXE -------------------------------------------------------------- HARD DRIVE: 1. Create separate subdirectories - one each for SCAN,CLEAN, VALIDATE, VIRLIST.TXT, and THE VIRUS TERMINUS files. 2. Copy McAfee Associates FILES and VIRUS TERMINUS files to their own subdirectories. * 3. Change the current drive and subdirectory to the location of The VIRUS TERMINUS and then run the file VT48B.EXE. Press after typing each of the following lines. C: cd\location vt48B.exe C: may be D: or whatever drive you installed The VIRUS TERMINUS program on. cd\location may be cd\utility\viruscan or any subdirectory where you placed the TERMINUS files. 4. Press F5 to configure when you reach the Main Menu. ------------------------------------------------------------ FLOPPY : 1. Format blank disk.(720K, 1.2Meg, 1.44Meg) 2. Copy McAfee Associates and VIRUS TERMINUS files to the disk. DO NOT copy the Virus Terminus files to a subdirectory on your floppy disk. Place ALL files in the ROOT directory. - PAGE 6 - * 3. Place this disk in DRIVE #A or DRIVE #B A: B: cd\ or cd\ vt48B.exe vt48B.exe Press F5 to configure at the Main Menu. The first time you run VT48B.EXE make sure you go no further than the MAIN MENU before you press F5 and make the needed additions or corrections to the DEFAULT TABLE. ********************************************************************* ***** INSTALLATION FOR SYSTEMS ALREADY INFECTED ***** !! POWER DOWN your system first !! !! DO NOT -USE CTRL-ALT-DEL KEY RESET SEQUENCE !! !! DO NOT -PRESS THE RESET BUTTON !! 1. Turn your system on and BOOT from a known non-infected DOS disk.(Place the DOS system disk in drive #A - WRITE PROTECT) DO NOT MAKE THE MISTAKE OF LEAVING AN INFECTED FLOPPY IN THE BOOT DRIVE.(READ ABOVE!) 2. Format a blank disk using the DOS format command. Use the FORMAT.COM file found on your non-infected DOS disk. Avoid accessing or using any files and utilities found on your hard disk. Format the highest capacity floppy your system drives will allow. Current program version sizes allow 720K, 1.2MEG, 1.44MEG disk sizes. 3. Follow these guidelines for the drive specification that you are using: A. Copy SCAN.EXE, CLEAN.EXE, VALIDATE.COM, VIRLIST.TXT to the newly formatted disk. - PAGE 7 - B. Copy VT48B.EXE, VTCF2B.EXE, and VTCF48.EXE to the newly formatted disk. DO NOT put these files in a subdirectory on your disk. Put ALL files in the ROOT. C. Place this disk in DRIVE #A or #B and type each of the following lines pressing after each: A: cd\ VT48B.EXE or B: cd\ VT48B.EXE D. Press F5 as soon as you are in the main menu and configure VIRUS TERMINUS. E. NOW write protect the disk! F. Select #7 at the MAIN menu to run a Self-Test to make sure the installation did not infect your work disk AND/OR computer RAM memory. ***** NOTE: Your configuration file vt48B.cfg will be ignored if any of the directory paths specify a drive other than A: and/or B: when running Virus Terminus from a floppy. The configuration and defaults will be initialized as when the program is first run. ***** NOTE: The Report and LOG options of SCAN and CLEAN will not work since you will have write protected the disk. All requests to SCAN/CLEAN single or job batch files will be directed to the ENTIRE SUBDIRECTORY.Terminus must make a temporary file named OPTIONS.$$$ on your disk when you are in the SCAN/CLEAN FILE(s) submenu. This will be impossible if your floppy is write protected! Instead, when your disk is write protected, Terminus sends SCAN/CLEAN a set of command line options which include the name of the of the subdirectory you select. ( \*.* instead of individual file names.) - PAGE 8 - ***** 360Kb Installation, DISK SWAPPING, ALTERNATE SOLUTIONS: Disk swapping is forced on when the startup option /D is detected. This mechanism allows the creation and use of two or three installation disks with appropriate prompts issued to the user indicating which disk to put in the drive during runtime. DISK #1 - vt48B.exe, VTCF2B.exe, vtcf48.exe, validate.com and virlist.txt DISK #2 - scan.exe and clean.exe The following program functions are disabled when disk swap is ON: 1. SELF-TEST including startup SELF-TEST (/T) 2. Startup LOCK (/L) which includes SELF-TEST before program entry. OPTIONS LOCK may still be activated from within the program. 3. SCAN/CLEAN report generation and activity log. Disk swapping may be activated by adding the /D options at startup time: A> vt48B.exe D It is possible in a two floppy system to use both drives when the main objective is to scan or disinfect the hard disk. One disk/drive would be utilized for The Virus Terminus programs plus virlist.txt & validate.com, and the other for SCAN and/or CLEAN. The default table should be modified to indicate which drive will contain SCAN & CLEAN. There are other alternatives such as eliminating virlist.txt and placing both SCAN.EXE and CLEAN.EXE with the Virus Terminus files ALL on one 360Kb disk. The above installation tips are offered as suggestions ... users may elect different variations as needed. Disk swapping is offered as a solution to limited disk space on those systems which employ a single 360Kb floppy drive and hard disk where the intention is to SCAN and/or CLEAN the hard disk. Despite the tendency of computer manufacturers to now market systems with higher capacity floppy drives, such systems may still exist in the work place today. - PAGE 9 - You should not run any programs located on your hard drive until you are sure ALL files and the entire system has been disinfected! ********** SUGGESTION: If your system is not infected it would be wise to make ********** up a disk like one of those previously described so that if ever the need arises you will be prepared to meet any virus infection threat without delay and inconvenience. ***** VIRUS TERMINUS START-UP OPTIONS: /S = Check Snow - Use to clear up display - older CGA's /M = Mono - Eliminates window background colors and makes certain textcolor adjustments. Use with green/amber CGA, gray VGA display, Laptop models, etc. Mouse will work if present. DO NOT use with true IBM MDA(Monochrome). /T = Start-up SELF-TEST - Checks Terminus file set, SCAN, COMMAND.COM, and RAM memory. /L = Limit Operation to SCAN FLoppies ONLY! - forces Terminus to proceed directly to the SCAN/CLEAN DRIVE(s) submenu, OPTIONS LOCK forced on, only floppy drives given as choice for SCAN or CLEAN, password required to continue if virus infection is found, password needed to exit the SCAN/CLEAN DRIVE(s) submenu. Also forces startup self-test. Read Page #17 for more details. /D = Enable SCAN/CLEAN program disk swapping. /Q = Quiet mode - disable sound routines! Implement as follows: (or combinations thereof) A> vt48B.exe S (press ENTER) or A> vt48B.exe M (press ENTER) A> vt48B.exe T (press ENTER) or A> vt48B.exe L (press ENTER) A> vt48B.exe D (press ENTER) or A> vt48B.exe MTLSQ ***** RUN-TIME and START-UP SELF-TEST: The Virus Terminus provides a quick and easy way to SELF-TEST for possible known virus infectors. The Main menu selection #7 and F7-SELF-TEST found in each submenu will scan memory and the Virus Terminus dir. and command.com(utilized for DOS session) Start-up Self-Test for known virus infections may be initiated as outlined in the START-UP OPTIONS section above. The self-test will be performed before program operation reaches the Main Menu. An orderly program HALT is available if a virus infection is found. NOTE: SCAN and CLEAN also perform their own self-test each time they are run. - PAGE 10 - ***** CONFIGURE THE VIRUS TERMINUS: THE VIRUS TERMINUS(c) may be configured from the main program menu or any sub-menu while the program is running. It is highly recommended that you configure your paths and parameters when running the program for the first time. DON'T RUN THE VIRUS TERMINUS FROM YOUR HARD DRIVE IF THE SYSTEM IS INFECTED. Use the floppy installation and disinfect your drive first - then install and run from your hard drive. Above all, FOLLOW THE DIRECTIONS THAT CAME WITH SCAN or CLEAN. Here is an explanation of the program default parameters: VIRUS TERMINUS PRGM DIR: Directory where the VIRUS TERMINUS files will be found. SCAN.EXE PROGRAM DIR: Directory where SCAN.EXE is located at. CLEAN.EXE PROGRAM DIR: Designates where CLEAN.EXE is located at. SCAN/CLEAN REPORTS DIR: Same directory as TERMINUS PRGM DIR. VALIDATE.COM PRGM DIR: Location of VALIDATE.COM VIRLIST.TXT FILE DIR: Location of VIRLIST.TXT DOS SESSION WORK FILE : This parameter will describe where the DOS COMMAND.COM file is located. The location is set at startup. EXP.VIRUS DAT.FILESPEC : Path and filename for the experimental data to be used with SCAN. Please read the DOCS that came with SCAN. ADVANCED USER FUNCTION! EXP. VIRUS DATA ON/OFF : Set this switch to 'ON' and the experimental virus data file will be used by SCAN. /EXT Read further for more info. on Exp. Data ACTIVITY LOG - ON/OFF : Turns on/off SCAN/CLEAN activity log /HISTORY LOG DIRECTORY/FILENAME : Drive\directory\name of activity log. DISABLE CTRL-BRK ON/OFF: Disable CTRL-BRK key combo during SCAN & CLEAN operations. /NOBREAK DISABLE MORE? ON/OFF: Disable SCAN/CLEAN MORE? prompt when screen is full. /NOPAUSE - PAGE 11 - SCREEN SAVER ON/OFF: Enables screen saver. User given choice of 1 to 60 minute delay before Saver activates START-UP OPTION LOCK: Set this parameter to ON if you wish to lock options including access to the default table each time the program is run. This mechanism may be defeated during program operation by pressing F6-OPTIONS LOCK and entering the correct password. Read further for a list of options which are locked for each menu. This option forces a Self-Test at startup. ADD SCAN PRGM OPTIONS : Enter options not available with The Virus Terminus program. Clear by entering ADD CLEAN PRGM OPTIONS : Enter options not available with The Virus Terminus program. Clear by entering * NOTE: The state of each switch can be changed after THE VIRUS TERMINUS is up and running. This is the only area where the options /HISTORY, /NOBREAK, and /NOPAUSE may be activated. ***** ADDING NEW or EXTRA OPTION PARAMETERS: Modify the default table entries designated as ADD SCAN PARAMETERS and ADD CLEAN PARAMETERS. Refer to your SCAN.EXE and CLEAN.EXE documentation for a list of valid parameter options. ***** DOS SESSION:(HARD DISK INSTALLATION ONLY!) Just press F3 at any menu. THE VIRUS TERMINUS will suspend operation and drop you off at the command prompt. You can get back to THE VIRUS TERMINUS by using the DOS EXIT function. Type 'EXIT' at the DOS command prompt. DO NOT attempt to go back to THE VIRUS TERMINUS by re-launching VT48B.EXE. - PAGE 12 - ***** MOUSE OPERATION: The two button Microsoft Mouse hardware specifications are supported by this program when used in conjunction with a color display/card that supports the CGA C80 standard. The program's video mode auto-detect logic disables mouse operation if a Monochrome Display Adapter is detected. Only keyboard entry is functional in MONOCHROME video mode(MDA standard). Most other Microsoft Mouse compatible mice should function properly. The program logic checks for a 'connected' mouse. You should not experience any trouble if your mouse is truly MS compatible, connected to the serial port or buss card, and the mouse driver software was installed prior to running this program. ***** SCAN/CLEAN Version Notes: The VIRUS TERMINUS(c) V4.8B was updated for SCAN/CLEAN 9.14v102 ***** SCAN/CLEAN FILE(s): (Main Menu #1) Use this main menu selection when all you need to do is scan or clean an individual or batch of files. The /A ALL switch is forced on. You may choose file(s) from a paged directory display if your disk is not write protected. Each time you SCAN or CLEAN files you are given a choice of what subdirectory to pick files from. Archive files, those with the file extensions like ZIP, PAK, ARJ, ARC etc. should have the files within extracted using an appropriate extraction utility before processing. You must specify a VIRUS CLEAN CODE before you can 'CLEAN' a file or batch of files. An attempt to auto-detect the code will be made if you use SCAN first and provided the Virus ID is still present on the current screen page when SCAN has finished running. Only the first ID (looking down from the top of the screen) will be reported in the case of multiple infections. A manual entry mechanism is also available for entry of ID codes. Press #2. ENTER VIRUS CODE. The Virus ID is the character string specified between the [ ] brackets which SCAN outputs to the screen. - PAGE 13 - ***** SCAN/CLEAN DRIVE(s): (Main Menu #2) Use this main menu selection when you wish to scan ENTIRE floppy disks or a hard drive. Turn the /MANY switch on if you want to SCAN/CLEAN more than one floppy disk. Archive files, those with the file extensions like ZIP, PAK, ARJ, ARC etc. should have the files within extracted using an appropriate extraction utility before processing. ***** IMMUNIZATION/RECOVERY FUNCTIONS SUBMENU: (Main Menu #3) (* Advanced User Level! *) This program feature helps you protect your files/system against new or unknown virus infectors. Use it wisely. #1. ADD IMMUNIZATION ( /AG ) : This function will add 52 bytes of recovery information to each EXE or COM file selected. The added data facilitates detection and recovery from unknown or new virus infectors. NOTE: self-modifying files like MS/PC DOS SETVER.EXE should not have recovery information added to them. The Virus Terminus will look for a file named VALNOT.TXT before proceeding. VALNOT.TXT is an ASCII text file with a list of [path + filename] exceptions not to add recovery data to. This is a user defined/created file. Read the documentation that came with SCAN for information on how to construct such a file. VALNOT.TXT should be placed in The Virus Terminus directory. You should not add validation data to files that are already immunized. SCAN with /RG to remove before adding #2. CHECK IMMUNIZATION ( /CG ) : Performs a SCAN of each file etc. selected and uses the added recovery data to determine if selected files, partition table, etc. have been tampered with. Selecting this function also sends /CERTIFY option to SCAN so that any files without validation information will be reported. #3. REMOVE IMMUNIZATION ( /RG ) : Removes the recovery data from selected files restoring them to original length. #4. ATTEMPT RECOVERY ( CLEAN /GENERIC ): CLEAN will attempt to disinfect known/unknown virus infections using the recovery information added to files and found in SCANVAL.VAL hidden file(boot record, partition table) and attached to individual files. Recovery of the original file/area will be attempted. #5. The CRC CHECKSUM menu selection #5 will perform a two method check on the file of your choice which will provide a comparison for future checks. The file display for this selection IS NOT filtered since you may perform a CRC checksum on ANY FILE. - PAGE 14 - ** NOTE: You should not add validation data to files already immunized or to files that are self-modifying or perform their own self-check!. The Virus Terminus looks for a USER CREATED ASCII TEXT EXCEPTION LIST file named VALNOT.TXT . The file must be named VALNOT.TXT, an ASCII text file, and be located in the same subdirectory as the Virus Terminus program files. Read the documentation that came with SCAN for information on how to construct this file. Place this file in the Virus Terminus directory. Read SCANV102.DOC for more information on when and when not to add validation. ***** REPORT FUNCTIONS: (Main Menu #4) Version 4.8B offers several options. The REPORT FUNCTIONS submenu allows viewing, merging, printing and deleting of report files. The MERGE function first displays a list of all report files found in the TERMINUS directory. You may choose from any or all of them. Then MERGE will create a master file which combines ALL chosen report files together. ***** SCAN/CLEAN REPORTS: A report counter is initialized when THE VIRUS TERMINUS is first run. Each report generated is given a different name by using the report counter value as part of the name(rpt_1.txt, rpt_2.txt, etc,) You may generate 35 different reports before the counter recycles back to #1. It is important to note that the reports will always start with rpt_1.txt each time the program is run. Therefore, if you wish to save a report copy it to another disk or directory so that the original report is not overwritten the next time that you run THE VIRUS TERMINUS. As reports are merged into RPTMASTR.TXT they are automatically deleted so that a separate deletion operation to purge the merged reports is not necessary anymore. ***** VIRUS FACT SHEETS: (Main Menu #5) 5. VIRUS INFO SHEETS. Information on individual virus known characteristics, areas of damage, which McAfee Associates dis- infector utility to use, etc. is available. * It is strongly suggested that you get experienced help in * * dealing with computer virus infection. * - PAGE 15 - ***** SCAN/CLEAN OPTION SWITCHES Point the mouse cursor over the word ON! or OFF to change add or delete options.Press a letter key (A through H) A. SCAN/CLEAN -EXPAND FILE TYPE SEARCH- : SCAN/CLEAN OPTION = /A SCAN and CLEAN will their file search instead of just EXE, COM, SYS, etc. ( Read SCAN/CLEAN documentation ) NOTE: Archive files with ZIP, ARC, LZH, or other extensions should first have the files within extracted with an appropriate extraction utility before processing. B. SCAN & OVERWRITE/DELETE INFECTED FILES: SCAN OPTION = /D Instructs SCAN to overwrite / delete any infected files when found. Use with caution! C. TURN MEMORY CHECK ON: SCAN/CLEAN OPTION = (/NOMEM, /M) Terminus sends /NOMEM option by default to SCAN/CLEAN. You should turn this switch ON! to check memory. /M is then sent to SCAN / CLEAN so ALL KNOWN memory resident virus infectors are searched for . READ SCAN documentation for more information. D. CHECK MEMORY ABOVE 640KB: SCAN/CLEAN OPTION = /CHKHI Instructs SCAN/ CLEAN to check memory 640K to 1088K (1024) . This switch will not function with MEMORY CHECK switch #C OFF E. SCAN/CLEAN MULTIPLE FLOPPIES: SCAN/CLEAN OPTION: /MANY Allows SCAN/CLEAN of multiple floppies. F. SCAN -INVALID MEDIA- ERROR DAMAGED DISKS SCAN/CLEAN OPTION: /MAINT Instructs SCAN/CLEAN to perform partition, boot record etc. type operations with considerations for DOS 4.x and higher. NO files are processed when using this option G. FAST DISPLAY & SKIP INSIDE LZEXE/PKLITE: SCAN/CLEAN OPTION: /FAST Speeds up SCAN / CLEAN operations by not checking inside LZEXE / PKLITE envelopes. Display output which shows name of file being processed is disabled . This option may cause missing of some virus infections - PAGE 16 - H. TURN ON SCAN/CLEAN REPORT FUNCTION: SCAN/CLEAN OPTION: /REPORT Turns on SCAN/CLEAN text file reports. The report for each run of SCAN / CLEAN is placed in the TERMINUS directory. The name of each report is automatically generated Read VT48BDOC for more info. ***** SAVING SCAN/CLEAN OPTIONS: To save the state of option switches A .. I simply press F5-PROGRAM SETUP. Then press to leave the default table area. Your option settings are saved along with the other program parameters found in the default table. Each time you start Terminus the option settings for switches A .. I will be restored. ***** OPTIONS LOCK: OPTIONS LOCK set to the ON position disables the following options: MAIN Menu ................... : F3-DOS SESSION; F5-PROGRAM SETUP; #6. Run DOS BATCH FILE SCAN/CLEAN FILE(s) Submenu : SCAN/CLEAN OPTION A .. I; F3-DOS SESSION; F5-PROGRAM SETUP; SCAN/CLEAN DRIVE(s) Submenu : SCAN/CLEAN OPTIONS A .. I; F3-DOS SESSION; F5-PROGRAM SETUP; IMMUNIZATION/RECOVERY Submenu : F3-DOS SESSION; F5-PROGRAM SETUP; #1. ADD IMMUNIZATION; #3. REMOVE IMMUNIZATION REPORT FUNCTIONS ............ : F3-DOS SESSION; F5-PROGRAM SETUP; #4. DOS BATCH FILE ***** OPTIONS LOCK PASSWORD: The password supplied as a default is "PASSWORD" . Do not include the quotes and enter in upper case letters only. The password default was deliberately left out of the Default Table to promote operation security. You must edit the file VT48B.CFG with an ASCII text editor to change the password. VT48B.CFG is an ASCII text file. Password is the 18th line in VT48B.CFG . Use ONLY the numbers 0 .. 9 and upper or lower case letters A .. Z . No other keyboard characters will be recognized. Limit the password to 12 characters or less. Eliminate any spaces between characters. - PAGE 17 - ***** LIMIT OPERATION TO SCAN FLOPPIES ONLY: (Start-up option /L) This mode of operation may be brought up by adding a /L option at startup. ! YOU MUST CONFIGURE TERMINUS & SAVE VT48B.CFG FIRST ! /L causes Terminus to perform a self-test and then proceed directly to the SCAN/CLEAN DRIVE(s) submenu setting OPTION LOCK to the ON position. In addition the drive choices are limited to A: and to B: if one exists. No exit from this submenu is allowed until the OPTION LOCK is defeated by pressing F6-OPTIONS LOCK and the correct password is entered. (Not available with 360Kb disk swapping) This mode of operation may also be initiated at any time during normal program operation by moving to the SCAN/CLEAN DRIVE(s) submenu and pressing F6-OPTIONS LOCK. Upon entering the correct password the user is given the choice of just locking the normal amount of options as outlined above or initiating further limitations to allow SCAN FLOPPIES ONLY. Password to Continue is required when a virus is detected during either a SCAN or CLEAN. This will necessitate the intervention of the Superuser who should take action to prevent further system and or floppy infection spread. The password required is the same used to enable/disable the Options Lock. It is strongly suggested that SCAN/CLEAN OPTION "E - SCAN/CLEAN MULTIPLE FLOPPIES" be left in the "OFF" position. The following SCAN/CLEAN DRIVE(s) submenu options are locked and no access is given to same when in this mode: 1. A .. I SCAN/CLEAN option list 2. F3-DOS SESSION, F5-PROGRAM SETUP 3. Submenu selects #2, 3 - Select Virus ID; CLEAN DRIVE 4. Submenu select #4. QUIT - Options Lock must be disabled in order to leave this submenu when Floppy Lock is ON. * It is strongly suggested that you get experienced help in * * dealing with computer virus infection. * ***** USE WITH CAUTION ***** This feature was NOT intended to be used as AN UNATTENDED SCAN STATION. A SuperUser or System Administrator should be present to intervene and take control when virus infection is detected. - PAGE 18 - Pressing F6 will request the user to enter a password to disable the lock and return Terminus back to normal operation. OPTIONS LOCK and FLOPPY LOCK may be toggled ON or OFF by use of F6-OPTIONS LOCK. ***** EXPERIMENTAL VIRUS DATA:( ADVANCED USER FUNCTION! ) Please read the SCAN docs to get a better understanding of what an 'experimental virus data file' consists of. If you decide that you need to utilize this function, press F5-SETUP and make an entry to the default 'EXP.VIRUS DAT.FILESPEC'. This entry will be the path and filename for your experimental virus data file. Next, turn default switch 'EXP. VIRUS DATA ON/OFF' to the 'ON' position. NOTE: This is the only way to tell THE VIRUS TERMINUS program to relay the /EXT switch to SCAN. Be sure to go back to PROGRAM SETUP and turn this switch off when you are finished! ***** WRITE PROTECTED FLOPPY OPERATION: Running The Virus Terminus, SCAN, CLEAN, etc. from a write protected floppy is a must if your system is infected. Doing so, however, imposes a few minor limitations. A.The SCAN/CLEAN report or LOG function will not work since SCAN/CLEAN must write to the disk to create a report. B. The SCAN/CLEAN FILES submenu normally uses the @filename response file for super fast operation. If your floppy is found to be write protected this mechanism is suspended. You are not given choice of individual files. Instead, you must choose from whole subdirectories only. ***** DIRECTORY PATH SELECT: The Following limitations are imposed: 1. Only paths 64 characters or less are included in the selection list. 2. A 35 character limition on selected paths is imposed when user is attempting to grab a path to be placed in the default table. User is warned and allowed to make another selection. 3. Maximum of 512 paths with manual entry mechanism provided for monster systems, etc. - PAGE 19 - Terminus will develop a list with a maximum of 512 paths/dirs starting with the ROOT directories first and working in. This is usually good enough for most systems. However, some users maintain massive file/dir inventories. Therefore, a manual entry is provided for paths/dirs not found on the list. The following are active: = Display next or previous window page. = Selects highlighted path. CTRL-E = Enter a path/dir not on the list. CTRL-N = Select new drive and path - display new list CTRL-P = Hardcopy print of the path list with stats. CTRL-T = Creates an ASCII text file of the path list in the ROOT directory of the drive that was scanned. = Quit and return to submenu. F1,F10 = HELP ***** SCREEN SAVER : The screen saver is a program integrated function which blanks your computer screen after a pre-determined period of keyboard or mouse inactivity. The screen saver is turned on from the Default Table(press F5). Users may enter from 1 to 60 minutes of *approximate* delay time before activation. The screen saver responds to keypress AND mouse clicks. The screen saver will not interfere with system I/O's and other program functions. The following area of Virus Terminus program operation IGNOREs the screen saver: 1. Any point of keyboard string entry(i.e. Enter Password, etc.) ***** MEMORY AVAILABLE FUNCTION: (LARGEST CONTIGUOUS CONVENTIONAL RAM BLOCK) Memory available for SESSION launch or VIRUSCAN operations can be found by pressing CTRL-F key combination while in ANY MENU or PROGRAM SETUP. (This is NOT DISK space, rather computer CONVENTIONAL RAM memory!) ***** DOS ERRORLEVEL on EXIT: The Virus Terminus sets the DOS errorlevel upon exit as follows: 0 = Normal Exit 1 = Virus Infection Detected 2 = Abnormal Termination In the event that a user chooses to (C)ontinue instead of (H)alt when a virus is detected, the errorlevel will still be set to 1 when the Virus Terminus is finally quit from the main menu. - PAGE 20 - ***** OPERATION FROM Microsoft WINDOWS: The Virus Terminus is a DOS application. It should be run as such. A "PIF" file is not required although it may be of use to certain advanced users. A WINDOWS ICON, STC.ICO, has been included with this version of The Virus Terminus. Use the /UNATTEND SCAN option. Best to use full window - NOT the DOS BOX. ***** PROGRAM ERROR MESSAGES: The following is a partial list of program error messages and corrective actions. ------------------------------------------------------------------ 1. "ERROR!-Unable To Execute ... " "ERROR! Unable to Execute/Find SCAN.EXE or CLEAN.EXE!" "ERROR! Unable to Execute/Find DOS SESSION or BATCH FILE" Terminus was requested to perform a function which requires an external file and an error has resulted. REMEDY: 1. Press F5-PROGRAM SETUP and enter the correct location of the requested file. Check to make sure that the file is actually there by doing a directory listing at the DOS prompt (i.e. DIR C:\UTILITY\VIRUSCAN ) 2. Press CTRL-F at the MAIN MENU to determine how much memory free exists. Memory free reported should be 320Kb or more. Power Down and start over. Check memory free again. If still not enough, run Virus Terminus from the DOS prompt instead of your shell, etc. ------------------------------------------------------------------ 2. "REPORTS DISABLED WHEN DISK SWAP ON!" "SELF-TEST DISABLED/DISK SWAP IS ON!" A /D command line option was detected at program startup. REMEDY: Use a high capacity installation disk and/or put ALL needed program files on the same disk. ------------------------------------------------------------------ 3. "Switch Forced ON! For FILE Submenu!" "Switch NOT ACTIVE For FILE Submenu!" /A SCAN/CLEAN option is forced on and may not be disabled for any reason while in the SCAN/CLEAN Files submenu. /MAINT, /FAST and /MANY are not active - disabled and inappropriate for processing single or job batch groups of files only. - PAGE 21 - 4. "You MUST! First *ENTER* A VIRUS ID!" The CLEAN-up Virus ID Code is not present in the CLEAN-up ID Code window and you are trying to CLEAN or disinfect a file or diskette. If SCAN was not previously run and/or Auto-Detect logic couldn't grab the code from SCAN's output then you MUST press submenu select #2 Enter Virus ID. The code is displayed by SCAN when a virus infection is detected. It is the string found BETWEEN the [ and ] brackets. You may also find a list of codes in the McAfee Associates file VIRLIST.TXT. ------------------------------------------------------------------ 5. "DOS VERSION 4.x OR HIGHER REQUIRED!" You are trying to use /MAINT and DOS Version 4.0 or higher is not currently being run or was not used to format the disk you are working on. (Must be BOOT Drive C:) ------------------------------------------------------------------ 6. "ACCESS DENIED! Please Run VT48B.EXE" VTCF2B.exe and vtcf48.exe are not stand alone program files. They must be used in conjunction with vt48B.exe only! ------------------------------------------------------------------ 7. "ERROR! Unable to Execute/Find VTCF48.EXE !!" "Please Change Active Directory to Location of The Virus Terminus!" The current directory is not the location of the Virus Terminus. REMEDY: Try typing the following just before running Terminus. Press after each line: C: cd\location vt48B.exe C: may be D: or whatever drive Terminus is located on. "location" should be the name of subdirectory where Terminus is located at. ------------------------------------------------------------------ 8. "ERROR! COMMAND LINE TOO LONG!" You have exceeded the DOS command line limit for a particular operation. Check the VTEC configuration table for program locations that are several subdirectories deep. Change locations if necessary. Try putting the scan.log file into the root directory. Reduce the number of options used to include just those that are necessary. Note: This is not a common error since whenever possible VTEC will use the @response option file format to overcome this limitation. - PAGE 22 - PRODUCT REGISTRATION -- PERSONAL USE ONLY! ANY OTHER USE REQUIRES A NEGOTIATED SITE LICENSE PAID Registration gives license and right to use The Virus Terminus on a single machine of personal home use only and updates as described below, user help and technical assistance for The Virus Terminus. A PAID negotiated site license is required for educational, business, corporation, government and/or agency environment use. This registration does not apply to any underlying programs used in conjunction with The Virus Terminus. For a list of files contained in The Virus Terminus program package please read page 2 of this document.(VTEC48B) NAME : ________________________ CHOOSE ONE DISK MEDIA TYPE STREET : ________________________ 5.25" ____ 3.5" ____ CITY : ________________________ STATE/PROV.: ________________________ OWN/USE A MODEM ? Y__ N__ ZIP CODE : ________________________ COUNTRY : ________________________ TERMINUS OBTAINED FROM? _______________________ _______________________ | REGISTRATION / LICENSE $ 20.00 ONLY U.S. FUNDS ACCEPTED! | NJ SALES TAX IF APPLICABLE $ | ------- MAKE YOUR REMITTANCE TO: | $ | SHIPPING AND HANDLING $ 4.00 S.T.CALISE | OVERSEAS SHIPMENT ADD $2.00 673 HERBERTSVILLE ROAD | ------- BRICK, NJ 08724 USA | TOTAL = $ UPGRADES: REGISTERED users of V4.8B are eligible for upgrades to subsequent releases. Updates may be otained by mail by sending $6.00 in U.S. funds to S.T.Calise at the above address. Don't forget to specify the disk media type and your current address. Instant update/upgrade is also available to all REGISTERED users.Your registration packet will contain the needed access codes and information. STC BBS 908-206-1386 2400 .. 14.4k v.32/.32bis v.42/.42bis MNP 1-5 -------------------------------------------------------------------------- For registration/license information on VIRUSCAN(SCAN), CLEAN, and other McAfee Associates programs please contact: McAfee Associates (408) 988-3832 office 3350 Scott Blvd, Bldg. 14 (408) 970-9727 fax Santa Clara, CA 95054 U.S.A. - PAGE 23 - ****************************************** Trademarks of other companies mentioned in this program,help file and/or accompanying documentation appear strictly for identification purposes only and are the property of their respective companies. SCAN, CLEAN, VALIDATE, VIRLIST Copyright (c) 1989-1993 by McAfee Associates. VIRUSCAN(tm) is a registered trademark of McAfee Associates IBM and OS/2 are registered trademarks of International Business Machines. COMMAND.COM and SETVER.EXE are copyright by Microsoft Corporation. MS-DOS, WINDOWS, Microsoft Mouse are registered trademarks of Microsoft Corporation. PKLITE(tm) is a trademark of PKWARE, Inc. LZEXE is copyright by Fabrice Bellard. ***** UPDATE INFORMATION VERSION 4.8B (read README48.TXT also) ***** 1. Added further point and shoot capability to the default table area. 2. Updated VTEC48B for VIRUSCAN and CLEAN 9.14v102 3. Revised this documentation file to print properly on most types of printers. Also revised for additions and deletions. 4. Eliminated support for the /SP and /FR option switches. These are no longer available with VIRUSCAN and CLEAN 9.14v102. Support is now given to the MCAFEE.MSG language support file system. 5. Added support for /HISTORY option. This option creates an activity log which keeps track of SCAN/CLEAN times, dates, options used, etc. The user should note that it is not currently possible to have both REPORTS and ACTIVITY log on at the same time. The name and location of the activity log may be specified in the Terminus default table. The log may be turned ON/OFF from the default table. 6. Increased logical drive support from A .. I to A .. Z Corrections and additions made to version #48B vs. #48A 7. Added sort by name to file selection displays. 8. Added drive #b selection denial on single floppy systems when pressing CTRL + Drive Letter for others. 9. Fixed failure to view report files. Only Log file view worked. 10. Added PRINT LOG FILE to reports submenu. 11. Fixed limitation of drive selection when using /L startup. Added trap to CTRL + Drive Letter input routine.