*p+163Y(0U(s1p14v0s3b5T (0U(s1p10v0s0b5TViruschk is distributed as freeware. It may be distributed freely as long as there is no fee charged for it or it's
*p+52Y(0U(s1p10v0s0b5T*p240Xdistribution. Viruschk must be distributed as a complete package, containing all of the files contained in the file
*p+52Y(0U(s1p10v0s0b5T*p240Xreadme.1st. Viruschk may not be distributed as a feature with any other software package without the prior
*p+52Y(0U(s1p10v0s0b5T*p240Xwritten permission of 1st Marine Corps District. There is no fee for registration, however, if you register as a
*p+52Y(0U(s1p10v0s0b5T*p240Xuser, you will be placed on distribution for future updates. Refer to the notes section for further information on
*p+52Y(0U(s1p10v0s0b5T*p240Xhow to register.
*p+171Y(0U(s1p10v0s0b5T*p240X(0U(s1p14v0s3b5TWHAT IT IS:
*p+163Y(0U(s1p14v0s3b5T (0U(s1p10v0s0b5TThe use of McAfee's Viruscan (scan.exe) on all USMC systems is mandated by CMC/CCI msg R 220032Z
*p+52Y(0U(s1p10v0s0b5T*p240XOCT 90 ZY3.(0U(s1p10v0s3b5T Viruschk(0U(s1p10v0s0b5T is a "shell" or "watchdog" for McAfee's scan.exe. It also displays the warning screen
*p+35Y(0U(s1p10v0s0b5T *p948X(0U(s1p8v0s0b5T1
*p+17Y(0U(s1p8v0s0b5T*p240X(0U(s1p10v0s0b5Tmandated by USMC security regulations *p964X. If a virus condition is found, it will lock up the user's system and
*p+52Y(0U(s1p10v0s0b5T*p240Xwith a loud tone and unmistakable screen, alert them to the infected condition! It is highly recommended that
*p+52Y(0U(s1p10v0s0b5T*p240Xyou also use the Vshield program (also by McAfee) - especially if you use the option to limit scanning to once a
*p+52Y(0U(s1p10v0s0b5T*p240Xweek. Please refer to the referenced message for further guidance regarding use of the McAfee virus
*p+52Y(0U(s1p10v0s0b5T*p240Xprevention software. This documentation does not cover all policy set forth in the message, nor does it intend
*p+52Y(0U(s1p10v0s0b5T*p240Xto be taken as a statement of policy.
*p+60Y(0U(s1p8v0s0b5T*p240X1. For non USMC users, you can make this a welcome screen, display a corporate message, etc, or you can eliminate it all together. The
*p+36Y(0U(s1p8v0s0b5T *p273Xcontent of the screen file is irrelevant to the operation of the program. The file should only be one screen long, or it will scroll before
*p+36Y(0U(s1p8v0s0b5T *p273Xthe first part can be read.
(0U(s1p8v0s0b5T*p+255Y*p+95Y(0U(s1p8v0s0b5T*p240X(0U(s1p14v0s3b5THOW TO INSTALL IT:
*p+163Y(0U(s1p14v0s3b5T (0U(s1p10v0s0b5TTo install Viruschk, proceed as follows:
*p+104Y(0U(s1p10v0s0b5T*p240XMake a directory on the c: drive named "security" (this is CMC mandated and hard-coded into Viruschk).
*p+104Y(0U(s1p10v0s0b5T*p240XCopy the following files into c:\security:
*p+104Y(0U(s1p10v0s3b5T*p240Xscan.exe(0U(s1p10v0s0b5T *p727X(This should be the latest version supplied through official channels. It(0U(s1p10v0s3b5T *MUST*(0U(s1p10v0s0b5T be
*p+52Y(0U(s1p10v0s0b5T *p727Xversion 7.2V77 or higher.)
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5Twarning(0U(s1p10v0s0b5T *p727X(This screen may be modified to suit your organization with any ANSI editor such
*p+52Y(0U(s1p10v0s0b5T *p727Xas "TheDraw", or you can substitute it with any ANSI/ASCII screen of your choice,
*p+52Y(0U(s1p10v0s0b5T *p727Xas long as it is named "warning". If you are not a USMC user, it may be omitted all
*p+52Y(0U(s1p10v0s0b5T *p727Xtogether.)
*p+104Y(0U(s1p10v0s0b5T*p240XAdd the line "c:\security\viruschk" to the beginning of the user's autoexec.bat file. This line should normally be
*p+35Y(0U(s1p10v0s0b5T *p791X(0U(s1p8v0s0b5T2
*p+17Y(0U(s1p8v0s0b5T*p240X(0U(s1p10v0s0b5Tthe first line of the autoexec.bat *p818X& should ALWAYS be before the user can login to the network.
*p+171Y(0U(s1p10v0s0b5T*p240X(0U(s1p14v0s3b5TWHAT IT DOES:
*p+163Y(0U(s1p14v0s3b5T (0U(s1p10v0s0b5TViruschk first checks the DOS version being run on the machine. If it is version 3.0 or higher, it performs an
*p+52Y(0U(s1p10v0s0b5T*p240Xintegrity check on itself. ANY modification (manual tampering, "pklite" compression, a virus, etc) will cause the
*p+52Y(0U(s1p10v0s0b5T*p240Xvirus warning screen to display and the system to lock up. If the DOS is less than version 3.0, a message is
*p+52Y(0U(s1p10v0s0b5T*p240Xdisplayed stating that the self-check cannot be performed.
*p+104Y(0U(s1p10v0s0b5T*p240XIt then checks the command line. The following command line options are valid:
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5Tdisplay(0U(s1p10v0s0b5T *p727Xshows the "lockup" screen & plays a snippet of the warning tones - no scan is
*p+52Y(0U(s1p10v0s0b5T *p727Xperformed and the warning screen is not displayed (this is included for demo
*p+52Y(0U(s1p10v0s0b5T *p727Xpurposes only!)
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5TMon(0U(s1p10v0s0b5T *p727XExecutes scan.exe on Monday only
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5TTue(0U(s1p10v0s0b5T *p727XExecutes scan.exe on Tuesday only
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5TWed(0U(s1p10v0s0b5T *p727XExecutes scan.exe on Wednesday only
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5TThu(0U(s1p10v0s0b5T *p727XExecutes scan.exe on Thursday only
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5TFri(0U(s1p10v0s0b5T *p727XExecutes scan.exe on Friday only
*p+60Y(0U(s1p8v0s0b5T*p240X2. If you use Zenith DOS with manual partition assignment, make sure that you place the asgnpart command BEFORE Viruschk or the
*p+36Y(0U(s1p8v0s0b5T *p273Xadditional partitions will not get scanned!
*p+72Y(0U(s1p8v0s0b5T *p273XIf your system does not have an internal clock/calendar, the DOS date command should be in the autoexec.bat prior to the viruschk
*p+163Y(0U(s1p14v0s3b5T *p290X(0U(s1p10v0s0b5T1. *p380XScan.exe cannot execute - Viruschk locks up system - scan.exe will execute when invoked manually.
*p+104Y(0U(s1p10v0s0b5T *p430Xa. *p520XMemory - scan.exe requires 256K of RAM. Adding the overhead of Viruschk brings system
*p+52Y(0U(s1p10v0s0b5T *p520Xrequirements up to 384K. It doesn't actually require that much, but that is the next step up from
*p+52Y(0U(s1p10v0s0b5T *p520X256K.
*p+104Y(0U(s1p10v0s0b5T *p428Xb. *p520XLocation - scan.exe MUST be located in C:\SECURITY. Because this location was mandated
*p+52Y(0U(s1p10v0s0b5T *p520Xby CMC, it has been hard-coded into Viruschk. If it cannot execute the program
*p+52Y(0U(s1p10v0s0b5T *p520Xc:\security\scan.exe, it is considered an error & the lock up is initiated on purpose. This
*p+52Y(0U(s1p10v0s0b5T *p520Xprevents a virus from planting a trojan "scan" elsewhere in your path and having it executed by
*p+52Y(0U(s1p10v0s0b5T *p520XViruschk.
*p+104Y(0U(s1p10v0s0b5T *p432Xc. *p520XVersion - starting with Viruschk version 2.01c, Viruscan (scan.exe) 7.2V77 is the minimum
*p+52Y(0U(s1p10v0s0b5T *p520Xversion required.
*p+104Y(0U(s1p10v0s0b5T *p290X2. *p380XMy warning screen comes out looking like a bunch of jumbled garbage.
*p+104Y(0U(s1p10v0s0b5T *p430Xa. *p520XMost likely your screen was done in ANSI graphics and you do not have ansi.sys loaded. Insure
*p+52Y(0U(s1p10v0s0b5T *p520Xthat your config.sys file contains a line something to the effect of "device=c:\dos\ansi.sys". If it
*p+52Y(0U(s1p10v0s0b5T *p520Xdoes not, add the line (make sure you give the correct path to ansi.sys), then reboot your
*p+60Y(0U(s1p8v0s0b5T*p240X3. This condition should **p607XN*p634XE*p659XV*p686XE*p711XR*p738X* *p765Xhappen! If it does, please contact me because I'm interested in knowing if this can actually happen.
*p+163Y(0U(s1p14v0s3b5T (0U(s1p10v0s3b5T2.03(0U(s1p10v0s0b5T *p727XFixed a bug that would cause a divide error with program termination if a RAM
*p+52Y(0U(s1p10v0s0b5T *p727XDrive or hard disk partition was smaller than one meg or had less than one meg
*p+52Y(0U(s1p10v0s0b5T *p727Xfree.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.02(0U(s1p10v0s0b5T *p727XAdded the feature of "/NOBREAK" being passed to scan.exe only on the first run
*p+52Y(0U(s1p10v0s0b5T *p727Xof any given day. This added the requirement for a 4 byte control file, which is
*p+52Y(0U(s1p10v0s0b5T *p727Xnamed "c:\security\viruschk.lrd" (lrd stands for "last run date").
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.01c(0U(s1p10v0s0b5T *p727XUpdated the code to invoke scan.exe with the "/M", "/NOPAUSE" and
*p+52Y(0U(s1p10v0s0b5T *p727X"/NOBREAK" options. This update requires the use of Viruscan (scan.exe) version
*p+52Y(0U(s1p10v0s0b5T *p727X7.2V77 or higher.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.01b(0U(s1p10v0s0b5T *p727XAdded (actually just made consistent & documented) DOS errorlevel exits.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.01a(0U(s1p10v0s0b5T Captured the keystroke if the delay was bypassed to prevent inadvertent input to the
*p+52Y(0U(s1p10v0s0b5T *p727Xnext program run.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.01(0U(s1p10v0s0b5T *p727XAdded drive information display, changed 5 second delay to a 30 second delay
*p+52Y(0U(s1p10v0s0b5T *p727Xbypassable with a keystroke, and made the warning screen optional.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T2.0(0U(s1p10v0s0b5T *p727XAdded integrity (virus) self-check, system interrogation for drive table and option to
*p+52Y(0U(s1p10v0s0b5T *p727Xrun on a specific day of the week. Converted from .exe to .com format.
*p+52Y(0U(s1p10v0s0b5T *p727XDocumentation written. First general distribution.
*p+104Y(0U(s1p10v0s0b5T*p240X(0U(s1p10v0s3b5T1.0(0U(s1p10v0s0b5T *p727XFirst release, not distributed beyond First District users. Would only scan drive c:,
*p+52Y(0U(s1p10v0s0b5T *p727Xhad a fixed 5 second delay for the warning screen (which was required), and ran