VirusCheck

User Documentation

Version 2.3b

Copyright 1991, Jon Freivald

All Rights Reserved

Table of Contents

Overview	1

What is VirusCheck?	1

Who should use VirusCheck?	1

What does VirusCheck do?	1

What else is needed?	2

System requirements	2

Additional requirements	2

Background	2

Installation	4

Configuration	5

Setting the Scan Interval	5

Operation	5

Customizing the Screens	6

Warning	6

Alert	6

Scandate	7

Examples	7

Lockups	9

What does it do?	9

What will trigger a lockup?	9

Troubleshooting	10

Known Incompatibilities	10

Common Problems and Remedies	10

Technical Information	12

Parameters passed to ViruScan	12

Constant	12

Variable	12

Configurable	12

DOS Errorlevel Exit Codes	12

Networks and the Enforcer	14

Overview	14

All Versions	14

Generic Version	16

Banyan Vines Version	16

Banyan Vines Remote Version	16

Licensing Information	17

Warranty	17

Support	18

Revision History	19

Overview

Richards Laws of Data Security:

1.	Don't buy a computer.

2.	If you do buy a computer, don't turn it on.

VirusCheck was designed for those of us who cannot adhere to Richard's laws.

What is VirusCheck?

VirusCheck is a watchdog or security shell that is designed to be used in conjunction with McAfee Associates ViruScan anti-virus software. As a watchdog, it relieves the user from needing to know the intricacies of their hardware and from having to sit and watch while ViruScan searches their system for the presence of viruses.

Who should use VirusCheck?

Anyone who uses an IBM PC or compatible computer system with MS or PC DOS as the operating system. VirusCheck also includes supplementary utilities for Network Administrators to use in the enforcement of anti-virus policies.

What does VirusCheck do?

VirusCheck interrogates the system it is run on to determine it's configuration. After determining the configuration, it executes the McAfee ViruScan software in the proper manner to insure that the entire system gets checked for the presence of viruses. If ViruScan detects the presence of a virus, VirusCheck will lock the system, preventing the inadvertent spread of a virus by using an infected system.

What else is needed?

System requirements:

An IBM PC, XT, AT, PS/2 or 100% compatible computer.

MS or PC DOS version 2.0 or higher.

384K FREE memory.

A hard disk with at least one DOS partition.

Additional requirements:

ViruScan from McAfee Associates - minimum version 7.8V82.

Background

The use of McAfee Associates ViruScan on all US Marine Corps systems is mandated by CMC/CCI msg R 220032Z Oct 90 ZY3. The display of a warning screen at boot time is mandated by IRM-5239-10, Small Computer System Security.

VirusCheck was written to act as a watchdog or shell for ViruScan as well as display the required warning screen at boot time. It not only takes the burden of familiarity with hardware off of the user (a situation exacerbated at our site because of shared machines), but insures that if a system becomes infected that the spread of the virus is stopped as quickly as possible. There is also an included companion program that can be utilized on Local Area Networks to insure that all workstations that are using the network are virus free.

Although specifically tailored to US Marine Corps security regulations and mandates, VirusCheck is being used by many individuals and civilian corporations worldwide. Numerous features have been added at the request of these users as well as the Marine Corps using community. All requests for new features will be considered as long as they do not contradict the security regulations that caused the birth of this program.

Being closely tied to the McAfee Associates ViruScan software, VirusCheck is often updated to exploit new features as they are added to ViruScan. A short list of features include:

-	Scanning can occur daily, weekly or at an arbitrary interval of days.

-	The "warning" screen is customizable. One college using VirusCheck uses it as an instruction screen in the student lab, some corporations use it as a welcome screen.

-	The warning screen is optional.

-	The alert screen is customizable. This was requested by a foreign user, but can be handy to display the name and phone number of who to call if it is displayed.

-	High memory is automatically scanned on systems that have it.

-	Additional parameters can be passed to ViruScan besides the ones built in to VirusCheck.

-	Network administrators can implement the Enforcer to insure that all systems utilizing their network have been scanned and are free of viruses.

If you have suggestions, comments or criticism, feel free to send them to me at the address (US Mail or E-Mail) listed in the support section.

Installation

Installation is a straightforward process. Enough familiarity with DOS to create directories, copy and edit files is needed. If this is beyond your DOS knowledge, please consult your DOS manual or call a friend or colleague who is familiar with DOS computers.

Create a directory on drive c: named \security.

The following list is the minimum files that need to be copied to the c:\security directory:

scan.exe	This is the McAfee Associates ViruScan. It should be the latest available version. It MUST be version 7.8V82 or higher.

viruschk.com	This must be located here if you intend to use either the ScanDate or Enforcer utilities. If you won't be using either of these programs (or will not be using the trigger feature of ScanDate) you can put it in the directory of your choice.

warning	If you want the warning screen to be displayed, it must be in this directory.

Copy the file scandate.exe to a directory that is in your path.

Edit your autoexec.bat file and add:

c:\security\viruschk

as the first line.

Configuration

Setting the Scan Interval

The interval for scanning can be set to daily, weekly, or an arbitrary number of days. If you desire daily scanning, once you have completed the installation steps listed above, you are done.

If you desire weekly scanning, edit your autoexec.bat file again and give VirusCheck an argument for the day of the week you want the scanning to occur on. These arguments are case sensitive and must be entered exactly as follows:

Mon Tue Wed Thu Fri Sat Sun

Only one argument is allowed. You can utilize the ScanDate utility to insure that if a day is missed, the system will be scanned the next time it is booted.

To set the interval to an arbitrary number of days, you would use the ScanDate utility. Examples are given in the ScanDate section of this documentation.

Operation

The operation of ViruScan can be configured by passing it additional parameters. At runtime, VirusCheck checks for the presence of the file c:\security\viruschk.cfg. If this file exists, it must consist of a single line of parameters for ViruScan. You can add comments to subsequent lines of the file, but the first line must be nothing but parameters for ViruScan. The parameters must be entered exactly as you would type them on the ViruScan command line.

The following example shows the contents of viruschk.cfg for a user wanting to scan all files, check validation codes, display messages in French, and report to the printer:

/A /CV /FR /REPORT prn

For a list of valid parameters, please refer to the file scanv??.doc that came with your version of ViruScan.

Customizing the Screens

The screens are cusomizable by the user. They can be either an ASCII text file, or an ANSI graphics file. The files should be kept to a maximum of 24 lines or the top of the file will scroll before it can be seen.

Warning

The warning screen is optional. If it exists, it will be displayed for a period of 30 seconds. A countdown timer will inform you of how long is left for the display and pressing any key will bypass this display. The sample supplied with VirusCheck is that required for US Marine Corps use. Other users can make this screen whatever they desire, or eliminate it completely.

Alert

There is a default alert screen built into VirusCheck. To see this screen, change to your security directory and type the following command:

viruschk display

You will need to press a key to return to DOS. To change the default screen, create a file named alert in the security directory. If the alert file exists, it will be displayed in place of the default screen.

Scandate

Scandate is a decoding utility for the last run control file (c:\security\viruschk.lrd). If run without any parameters, it will simply display the date that VirusCheck was last successfully run and how many days past that was according to the system clock. If the control file is not found, an error message will be displayed.

If (optionally) given a numeric parameter, scandate acts as described above until the number of days since VirusCheck was last run is equal to or greater than the number given. At this time, scandate will act as a trigger and execute VirusCheck. Although scandate.exe does not need to be in the c:\security directory, for scandate to work properly in it's capacity as a trigger, viruschk.com must be located in the c:\security directory.

Scandate will set the DOS errorlevel on exit. If VirusCheck was executed, the errorlevel will be the same as that returned by VirusCheck, as documented below. If VirusCheck is not executed, the errorlevel will be set to 4 if no errors occurred, or 5 if there was an error. These exit codes can be used for batch file programming as shown in the example below. All error messages generated by scandate are self-explanatory and stop execution until a key is pressed.

Examples

c:\security\scandate 8

if not errorlevel 4 goto forced

c:\security\viruschk Mon

:scanned

In this example, VirusCheck will be executed every Monday. If the system doesn't happen to get turned on on a Monday, scandate will catch it the next time it is. The "if not errorlevel 4 goto forced" prevents VirusCheck from being executed twice if scandate needs to trigger it.

c:\security\scandate 7

VirusCheck will be executed every 7 days. If the system is not booted on the 7th day, VirusCheck will be executed on the next day the system is booted.

The file c:\security\warning (if it exists) would only be displayed every 7 days when VirusCheck is actually executed.

c:\security\scandate 30

VirusCheck will be executed every 30 days. If the system is not booted on the 30th day, VirusCheck will be executed on the next day it is booted.

The file c:\security\warning (if it exists) would only be displayed every 30 days when VirusCheck is actually executed.

This configuration is specifically NOT authorized on US Marine Corps systems! Please refer to the appropriate policy guidelines.

Lockups

What does it do?

The lockup is the primary security feature of VirusCheck. The reason behind this is that using a system that is infected with a virus is a sure fire way of spreading the virus. This makes the potential for damage greater and the process of disinfecting the system harder. When a lockup occurs, the program stops. The only keystrokes that will have any effect are <Ctrl><Alt><Del> (if you have a Zenith computer, <Ctrl><Alt><Ins> will also work). You will then be able to boot from a (WRITE PROTECTED) floppy disk and take corrective action.

What will trigger a lockup?

Although the lockup is primarily intended to occur when a virus is found by ViruScan, there are actual a number of conditions that will cause a lockup:

1.	If VirusCheck has been modified in any way, it will fail it's self-check. Modification indicates compression (such as from pklite, lzexe or diet), tampering, or a virus.

2.	c:\security\scan.exe could not be executed. This indicates a corrupt ViruScan or that a virus has taken over control of the DOS load and execute function.

3.	ViruScan found a virus(es) on the system.

4.	ViruScan exited with an error code (see troubleshooting below).

All of the above conditions indicate that either there is a virus present or the system could not be properly scanned. If an error occurs, it is better to err to the side of caution, therefore, we lockup the system.

Troubleshooting

VirusCheck is designed to be used as painlessly as possible, however, there are a few known anomalies that must be addressed.

Known Incompatibilities

1.	Norton Utilities "Ndisks".

The NDisks appear to DOS as a drive. Since VirusCheck finds a "drive", it passes that on to ViruScan. Since this is not actually a drive, ViruScan cannot read it properly and exits with an error, causing a lockup. I hope to be able to fix this problem, but have not received any cooperation out of Symantec on this issue.

Common Problems and Remedies

1.	VirusCheck aborts with an error message saying it is improperly configured.

a.	ViruScan (scan.exe) is not located in c:\security. ViruScan is NOT executed via the path to prevent a copycat virus from planting a bogus scan in the path and getting it executed instead of the legitimate scan.

2.	ViruScan cannot execute - VirusCheck locks up my system - ViruScan will run when executed manually.

a.	Memory - ViruScan requires 256K of RAM. Adding the overhead of VirusCheck brings system requirements up to 384K.

b.	Version - the MINIMUM required version of ViruScan is 7.8V82. Most sources will have this available as scanv82.zip. Using an earlier version will cause false lockups because the older program will be confused with the new parameters and exit with an error code. Any later version will work as long as McAfee does not change their command interface.

c.	Parameters - if you take advantage of the ability to pass additional parameters to ViruScan, they must be valid. If the parameters are not valid, they will confuse ViruScan and it will exit with an error code, causing a lockup.

3.	My warning screen looks like a jumbled mess.

a.	You likely have an ANSI graphics screen and do not have the ansi.sys device driver loaded. Insure that your config.sys file contains a line something to the effect of "device=c:\dos\ansi.sys". If it does not, add the line (make sure you give the correct path to ansi.sys) and reboot your system.

4.	I have more than two floppy drives and VirusCheck does not work.

a.	Currently VirusCheck will only execute properly when ViruScan is located in c:\security. If your c: drive is a floppy disk, you will need to have a diskette in the drive with ViruScan in the security directory when you boot. If you have a d: floppy, you will also need to have a diskette there or VirusCheck will never get far enough to find your hard drive(s).

Technical Information

The following information is provided for those who desire to know a bit more about how the program works and for those who wish to do conditional batch processing.

Parameters passed to ViruScan

By the very nature of the program, VirusCheck passes a number of parameters to ViruScan. The parameters can be broken down into three types, Constant, Variable or Configurable.

Constant

The following is a list of the parameters and their meaning that are passed to ViruScan every time it is executed by VirusCheck:

a list of all the system drives (c: d: ... ?:)

/M	scan memory for all viruses

/NOPAUSE	do not pause if screen is filled with output

Variable

The following parameters are either passed or not, depending on runtime conditions:

/CHKHI	if an 80286 or higher processor was found and extended or XMS memory was detected.

/NOBREAK	if the viruschk.lrd file is not found, or, if the date it contains is older than the current system date.

Configurable

Any valid parameter can be passed to ViruScan via the viruschk.cfg file. Please refer to the configuration section for more information on how to set up this file.

DOS Errorlevel Exit Codes

VirusCheck will set the DOS errorlevel upon exit. You can use the DOS batch command "if errorlevel" to check these codes and take conditional action if desired. The following is a list of the codes and their significance:

0	VirusCheck ran uninterrupted to completion of the delay countdown or the "display" command line option was used.

1	A keystroke was pressed to bypass the delay.

2	The file c:\security\warning was not found, therefore no display or delay.

3	Warning was present, but VirusCheck was unable to display it.

100	You errantly obtained a copy of the program that does not have the anti-virus information imbedded in it. This copy should not have been distributed and will not run under DOS 3.0 or higher.

101	Improper configuration. Most likely ViruScan was not found in c:\security.

255	The DOS version being run is less than version 2.0. VirusCheck requires at least version 2.0 to run and at least 3.0 to perform it's self-check.

Networks and the Enforcer

Overview

Being a Network Administrator myself, I am very used to users doing what they wanted on "their" PC's. This has on many occasions included disabling or removing the anti-virus software installed on their systems.

The Enforcer is a utility that works hand in hand with VirusCheck to insure that all systems that are accessing a Local Area Network have been scanned for viruses prior to being allowed access to the LAN.

Due to the many variations in Network Operating Systems (NOS), this section of the documentation must be somewhat vague. You will need to make appropriate modifications per your NOS. If you don't see your NOS listed, I would like to add it if you can provide me with sufficient information to do it properly and to do the testing for me.

All Versions

The Enforcer is designed to be incorporated in the login process for the users of the LAN. It will verify that VirusCheck is installed on the workstation, and that it has been run successfully within an allowed period of time. If VirusCheck is not installed, or has not been run recently enough, Enforcer will disallow access to the LAN. (Refer to the appropriate version for the specific method used to disallow access.)

Copy the Enforcer to a network file service that all users share. If within the capabilities of your NOS, set the attributes on it to read/execute access only.

Add the Enforcer to the appropriate profile, script or batch file(s) to insure that it will be executed by all users as they login to the network.

The Enforcer MUST be given one parameter. The parameter determines whether to allow weekly scanning, force daily scanning, or to set an arbitrary maximum number of days between scans. The parameters are either the letter "d" for daily scanning required, the letter "w" to allow weekly scanning, or a numeric value of the number of days to be allowed between scans.

If the workstation has VirusCheck installed, and it has been run within the required period, Enforcer's operation will be completely transparent to the user. On a quick system, the delay while Enforcer verifies the workstation will almost be too short to notice, while on a slow machine it is not intolerable (less than 10 seconds on a 4.77mhz PC/XT on 10Base2 Ethernet).

If VirusCheck is not found, or if it has not been successfully run in the required time period, the user is given an error message and disallowed access to the network. The error messages all inform the user that using the VirusCheck/ViruScan combination is required to access the network, as well as specific messages. The error messages and their meaning are:

Improper parameters, contact your system administrator for configuration!

Most likely, the parameter given to Enforcer was not the required "w", "d", or an integer value not equal to zero. If this is not the case, please contact me for tech support.

VirusCheck/ViruScan combination not found!

If you don't have them installed, you can't have run them!!

Exactly what it says - using the Enforcer requires both ViruScan and VirusCheck (scan.exe and viruschk.com) to reside in the c:\security directory.

VirusCheck/ViruScan have not been run in the past week!

You are allowing weekly scanning ("w" parameter), but this workstation has not been scanned in the last 7 days.

VirusCheck/ViruScan have not been run today!

You are disallowing weekly scanning ("d" parameter) and this workstation has not been scanned today.

You have exceeded the length of time for mandatory scanning!

You have set an arbitrary value (a numeric parameter) that the user has exceeded.

This program has encountered an internal error!

Contact your system administrator!

Exactly what it says - you should (fingers crossed here...) never see this error. If you do, contact me ASAP for tech support.

Upon receiving the error message, the user will be disallowed access to the network. The following sections specify the different methods used between versions.

Generic Version

(enfall.exe)

This version will work with ALL networks. After showing the user the error message, it waits for a keypress. Upon receiving the keypress, the program issues a hard reset (cold boot).

This version can be run either from a network file service or from a local hard disk.

Banyan Vines Version

(enfban.exe)

The program executes z:\logout, then gives the user the error message and waits for a keypress.

If the user has exceeded the time limit for scanning (VirusCheck is properly installed), upon receiving a keypress, VirusCheck will be executed. If VirusCheck runs successfully, all memory will be released and z:\login will be executed, returning the user to the login screen.

Banyan Vines Remote Version

(enfbanr.exe)

Designed for dial-up users. In an effort to reduce the large amounts of time required to load programs across the phone line (and due to the fact that access to z: is lost after logout is executed), enfbanr.exe is identical to enfban.exe with two exceptions:

1.	It is intended to be executed off of the user's local hard disk.

2.	Both logout and login are executed via the path instead of explicitly off of the z: drive.

Licensing Information

VirusCheck is distributed as freeware. It may be distributed freely as long as there is no fee charged for it or it's distribution. VirusCheck must be distributed as a complete package, containing all of the files listed in the readme file. VirusCheck may not be distributed as a feature with any other software package without the prior written permission of Jon Freivald. There is no fee for registration, however, if you register as a user, you will be placed on distribution for notification of future updates.

To register, send your name, address, daytime phone number and company name (if registering for the company) to the address listed in the support section. If you have an E-Mail address, please list it as well.

Warranty

There are no warranties, either expressed or implied. It is entirely the user's responsibility to evaluate this product and determine suitability and fitness for use. I do not accept any liabilities that may stem from the use (or misuse) of this product. This statement applies to the entire VirusCheck family of software (VirusCheck, ScanDate and Enforcer). If you cannot agree to this warranty statement, do not use my product.

Support

Support can be obtained via US Mail, E-Mail or by telephone. When calling, please note that this is Eastern Standard Time and Daylight Savings Time is observed.

Jon Freivald

48 Mitchel Ave

East Meadow, NY 11554

(516) 483-7968 (evenings/weekends)

Commanding Officer

HQ, 1st Marine Corps District

605 Stewart Avenue

Garden City, NY 11530

ATTN: SSgt Freivald

(516) 228-5635

Autovon 994-5635

BBS	D	(516) 483-5841 (8,N,1 - 300-2400,9600 HST)

InterNet	D	jaflrn!jaf@utoday.com

Prodigy	W	ktfp55a

CompuServe	M	70274,666

D	>INTERNET:jaflrn!jaf@utoday.com

MCDN	WD	bk1md4:gisnad05

*	Frequency checked, D = daily, WD = every weekday, W = Weekly, M = Monthly

Bug reports and problems will be handled as quickly as possible. Requests for additional features or custom versions will be considered on a case by case basis.

Revision History

2.3b	Fixed a minor bug in the drive display. A disk of over 1 meg with less than 1 meg free would result in a negative percentage being displayed as free.

Minor code optimization. Also added check for proper configuration - will now abort with an error message instead of a false lockup.

Added the external virus alert screen option for non-english speaking users and other site specific customization.

Changed the scandate utility to display the date in the format of "March 5, 1991" - thanks to Trevor Wright for reminding me that "3/5/1991" is read differently in different parts of the world.

Re-wrote documentation.

2.3a	A small compatibility fix. It seems that some editors insist on adding a carriage return/line feed to the end of a line when it saves the file. This fix prevents the cr/lf from being passed as a part of the parameters (thereby confusing ViruScan and causing a lockup!) if the viruschk.cfg file is used.

Implemented a generic version of Enforcer.

2.3	Added scandate.exe to the package. Credit for this idea goes to Mr. Trevor Wright of the Marconi Research Centre, Chelmsford, Essex, UK.

Added user configurable parameter passing to ViruScan via the viruschk.cfg file. Credit for this feature also goes to Mr. Wright.

Updated Enforcer to allow an arbitrary number as the scan interval parameter (in addition to daily/weekly) to make it more compatible with systems using scandate.

2.2	Updated the code to take advantage of the "/CHKHI" capability that has been added to ViruScan. Processor type is checked - if it is an 80286 or higher, the system is tested for the presence of extended or XMS memory. If extended memory or an XMS driver is found, Viruscan is executed with the "/CHKHI" parameter. This update requires the use of ViruScan version 7.8V82 or higher.

2.1	Implemented the Banyan Vines version of "Enforcer."

Cleaned up the formatting of the drive display line(s).

2.03	Fixed a bug that would cause a divide error with program termination if a RAM Drive or hard disk partition was smaller than one meg or had less than one meg free. Thanks to Aryeh Goretsky from McAfee Associates tech support for discovering it and bringing it to my attention.

2.02	Added the feature of the "/NOBREAK" being passed to ViruScan only on the first run of any given day. This added the requirement for a 4 byte control file which is named "c:\security\viruschk.lrd" (lrd stands for "last run date"). Credit for this idea goes to both Captain Steve Ritacco of 1st Marine Corps District, Garden City, NY and Mr. Tim Millis of Trellis Network Services, Princeton, NJ. It was suggested by both of them, completely independent of each other, about 20 minutes apart.

2.01c	Updated the code to invoke ViruScan with the "/M", "/NOPAUSE" and "/NOBREAK" options. This update requires the use of ViruScan version 7.2V77 or higher.

2.01b	Documented DOS errorlevel exits.

2.01a	Captured the keystroke if the delay was bypassed to prevent inadvertent input to the next program run.

2.01	Added drive information display. Changed 5 second delay to a 30 second delay that is bypassable with a keystroke. Made the warning screen optional.

2.0	Added file integrity self-check, system interrogation for drive table and options to run on a specific day of the week. Converted from .exe to .com format. Documentation written. First general distribution.

1.0	First release. Not distributed beyond First Marine Corps District. Would only scan drive c: and had a fixed 5 second delay for the warning screen, which was mandatory.