Simtel MSDOS 1992 June/SIMTEL_0692.cdr/msdos/trojanpr/datacure.arc/DATACURE.DOC

Text File | 1989-10-11 | 9KB | 151 lines

DOCUMENTATION FOR DATACURE AND DATASTOP

This version of these programs is being distributed as shareware in the
public interest.  The author has incurred no little expense trying to
get it out in time.  If you are glad to have these programs, I would be
very glad to have $10 or so. Checks or other forms of exchange should be
made out to Rikki Cate and can be sent to either of the following
addresses:  In America, 9266 S.W. Arapaho Rd., Tualatin, Ore. 97062.  In
Europe, P.O. Box 12956, 1100 AZ Amsterdam, the Netherlands.  Commercial
inquiries:  call 20-981963 in Amsterdam.

These programs have been written with great care and precision.  The
author can, however, accept no liability for any damage arising from
their use.  Comments are always welcome and can be addressed via NEABBS
in the Netherlands.  Tel.: [phone], Fido 2:280/2, UUCP ...!hp4nl!neabbs.

This package should contain three files:  DATACURE.COM, DATASTOP.COM and
DATACURE.DOC.  The programs DATACURE and DATASTOP were written
specifically for the so-called "DATACRIME II" virus.  They are not
intended for other viruses and will not work against them.

The program DATASTOP is a memory-resident ('TSR') program that protects
against new infections by DATACRIME II and prevents DATACRIME from
formatting the hard disk.  Once loaded, DATASTOP will provide complete
protection against DATACRIME II.  If an infected program is run, a
warning will appear on the screen and you can choose between aborting
the program or removing the virus.  DATASTOP is 'passive', that is, it
only becomes activated if an infected program is run.  To install it,
simply type 'DATASTOP'.

DATACURE searches all files for possible infections.  It can be set to
only generate a status report or to actually erase the virus and repair
the infected file.  DATACURE parameters can be given from the command
line.  For example, type 'DATACURE *.*/R' to search all files in all
subdirectories of all disks and to generate a report of any infections
found, but not to make any changes to the infected files.  Type
'DATACURE *.*/L' to generate a report and also remove any infections
found.  Type 'DATACURE *.*' to remove any infections, but not to
generate a report.  If you type 'DATACURE' without a command tail,
instructions on the use of the program will appear on the screen.

DATACURE can also be instructed only to check specific files, drives, or
subdirectories.  Simply specify the path, file name or drive letter.  If
a path is specified, it must be terminated with a backslash character.
Otherwise DATACURE will think a file is being specified and will report
a 'file not found' error.  Example:  'DATACURE \DOS\'. Note that DATACURE
will produce a DOS error if it is run on a write-protected disk, even if
it is set to only generate a report.  This is because DATACRIME also
infects hidden and system files.  To check for such infections, DATACURE
temporarily changes all file attributes to read/write.  These are
restored to their original settings when the program has finished
checking the files.  DATACURE does not make any alterations to the disk
or any files, other than removing the virus code (if found and if
instructed to do so) and repairing infected files.

DATACURE is a highly specialized program that employs a number of
precise techniques for identifying and removing the virus.  In addition,
it attempts (usually successfully) to repair programs that have been
damaged by the virus.  This is particularly difficult in the case of
.EXE files, as the virus contains an unintended bug that can make these
programs unusable, while at the same time permanently destroying vital
information in the program header. DATACURE recovers as much of this
information as possible, then uses clues from the program and from the
virus itself to reconstruct as accurately as possible the information
that cannot be recovered.  In this manner, many .EXE files that have
been infected by the virus can be made usable again.  They may be a
slightly different length than the original versions, and they may
require a little more memory.  This is because a new stack segment has
to be created, and since the original size can no longer be determined,
DATACURE tries to ensure that too much, rather than too little, is made
available.  Certain assumptions and compromises have to be made while
doing this.  In principle, this should not cause problems in the
majority of cases, and most .EXE files repaired in this way ought to
function correctly.  A few may still experience conflicts which will
cause the computer to 'hang' or otherwise behave strangely.  If this
happens, the program is beyond repair.  Delete it and reflect on the
wisdom of maintaining back-up copies.

A .COM program that has been repaired by DATACURE will be identical to
the original uninfected program and can be used without fear.  A
disinfected .EXE program cannot normally harm other programs, even if
the repair was not successful.  There is, however, an extremely small
possibility that an unsuccessful repair might cause the odd .EXE program
to write random data over other files or out the ports to external
apparatus, but the risk of this is negligable.  There is also an
extremely small possibility of being struck by lightning.  If unlikely
disasters worry you, disconnect your robots or other external apparatus
before trying the repaired program or run it first on a test system. If
a repaired program works normally, then it is certainly safe to use.  Of
course, it is always better to replace any infected files with original
back-up copies, if they are available. DATACURE's repair function is
included as a service for those cases where there are no back-ups of
valuable programs.  As always, it is included with the usual disclaimer
of responsibility for any damage whatsoever that it might cause.
DATACURE has been written with great care and precision, but you use at
at your own risk.

DATACURE searches each file for a virus signature that is always the same.
If it finds this, it obtains data from the infected part of the file and
uses this to decrypt the rest of the virus code.  It then searches for
the DATACRIME announcement which is contained in that code.  If DATACURE
finds the virus signature but cannot find the DATACRIME announcement, it
displays a message that the file is probably infected but cannot be
disinfected.  It does not attempt to alter the file.

If the DATACRIME announcement is also found, DATACURE obtains other data
from the virus to enable it to precisely locate the beginning and end
of the virus code and, in the case of .EXE programs, to reconstruct the
file header.  The program is restored to its original state and the virus
code is obliterated.

DATACURE includes a number of options.  If a drive, directory or file name
is specified, it will limit its search to the specification.  Wild cards
can also be included in the specification, and If "*.*" is specified,
DATACURE will search all files in all subdirectories on all drives. Since
DATACRIME Only infects files of the .COM and .EXE type, these are the
only extensions allowed in filename specifications and only these file
types are searched.

Disks must not be write-protected while DATACURE is searching them. This
will result in an error message.  DATACURE can be set, however, to only
search for the virus but not to make any changes to infected files.
Simply add the "/R" switch at the end of the command line.  This will
cause DATACURE to generate a report of any suspicious files found, but no
attempt will be made to change them.  Use the "/L" switch to have DATACURE
generate a report while also destroying any virus it finds.

If either switch is specified, DATACURE will create a log file named
"CRIME.LOG" on the root directory of the default drive.  Any suspicious
or infected files will be written to this log, along with a status report
on DATACURE's success at disinfecting them (if the "/L" switch is used).
If a switch is specified and no log file is created, this means that no
suspicious or infected files were found.  Note that this file will be
overwritten by DATACURE the next time it is run from the same default
drive.  If you want to save it, either rename it or copy it to somewhere
else.  DATACURE also sends a full status report to the screen as it
progresses, regardless of the switches. DATACURE can be aborted at any time
by typing CTRL-C.

This program assumes that the DOS ANSI.SYS driver or an equivalent is
installed on your system (usually the case).  If it is not, the program
will still function correctly, but the screen displays will not appear
as neat.

DATACURE will eradicate and repair DATACRIME II infections.  It will not
provide protection against new infections, or against DATACRIME's hard
disk format.  Use the companion program "DATASTOP.COM" for that.

These programs were originally created by the Amsterdam firm "Hands On"
for the Dutch Personal Computer Magazine. The author is Rikki Cate.