global menu:
ANTI-VIRUS SCANNERS
Maybe the biggest defect in DOS isn't the 640K boundary but rather its susceptibility to viruses (ironic how such a fundamental compromise in OS design has made the a-v industry a flourishing enterprise). I won't presume to know much about the performance of the virus scanners listed here. F-PROT has consistently achieved honorable placings in many test comparisons.
1. F-PROT- Anti-virus monitor, scanner, and disinfectant.
unrated [updated 05-04-01]
F-Prot is a shareware anti-virus package that has received rave reviews. Not only is it free for individual (non-commercial) use, but it is regularly updated to keep pace with new virus types. Can scan within archives (zip/arj) and many packed executables. The F-Prot scanner/disinfectant is a DOS program. (No longer includes the Win9x resident scanner (now avail. in win9x version) F-StopW or the macro scanner, or F-Macrow). Requires a 386+ PC.
Author: Fridrik Skulason / Frisk Software Int. (2001). Primary distribution site / virus definition updates.
05-04-01: v3.09a available.
download fp-309a.zip (about 1.2MB)
2. NAVC- Norton command-line AV scanner.
unrated [added 04-12-99]
Revise description. NAVC is a free command line a-v scanner from Symantec Corp- this scanner also purports to repair infected files. Can scan zipped files as well.
NAVC pathname [options]
/? Display the help screen.
/A Scan all drives (A: and B: are skipped.)
/L Scan local drives (A: and B: are skipped.)
/B[+|-] Enable or disable scanning of boot records.
If /B[+|-] is omitted, /B+ is the default.
/BOOT Scan only the boot sectors of specified drives.
/M[+|-] Enable or disable scanning of memory.
If /M[+|-] is omitted, /M+ is the default.
/MEM Scan only memory.
/S[+|-] Enable or disable scanning subdirectories.
If /S[+|-] is omitted, /S- is the default.
/REPAIR Repair infected files automatically.
/DELETE Delete infected files automatically.
/HALT Halt the system if a virus is found.
/CFG:[directory] Specify the directory containing NAVC
configuration files.
/LOG:file Create and log to the specified file.
/APPENDLOG:file Append to an existing log file.
/DOALLFILES Scan all files, not just executables.
/ZIPS Scan files contained in compressed files.
/NOBEEP Run silently (no beeps).
/HELPERROR List possible DOS errorlevels returned by NAVC.
If desired, you can run NAVC from a batch file
and process the errorlevel with IF ERRORLEVEL
constructions.
Limitations: Doesn't scan files on FAT32, NTFS or a HPFS partitions but will scan and clean the master boot record of the primary hard drive.
Distributed as a winzip SFX but one can also extract contents with any DOS zip extracter that reads zip SFX's. Link below is to English version; other language versions may exist (?) on Symantec's web site. More info on this scanner is at Symantec. Regular virus definition updates can be found here (or FTP)- users of plain DOS should get a *16* bit updater (mmddi16*.exe ). Author: Symantec Corp. Suggested by Miky Gutman, Israel. (1999).
download navc10.exe (about 1.4MB)
3. AVPLite-(AntiViral Toolkit Pro)- Command line anti-virus scanner and disinfectant.
unrated [added 10-11-99 updated 02-19-00]
Note [10-03-00]: AVPLite seems to have disappeared from AVP web sites- has it been discontinued??
Fully functional command-line sibling of the commercial AntiViral Toolkit Pro. Features from the docs:
Usage: AVPLITE [options] path[\name][...]
Options:
/- disinfect /SET=filename alternate set-file
/E delete infected files /* check all files
/M skip memory test /N check remote disks, used with *:
/P skip Master Boot Record test /1 check only one floppy disk
/B skip DOS Boot Sector test /R do not scan subdirectories
/T=path swapping directory /U disable unpack
/W[A][=filename] save report /A disable extract
/WA appends to existing file /H disable heuristic analysis
/O display OK messages /@[!]=filename check files by list
/Y skip all dialogs /@! delete list after scanning
/S sound off /D daily
/X do not use XMS memory /K disable pack info
/MD check mail databases /Z disable aborting
/MP check plain mail /? help screen
/Lx language (/Lx! - set as default).
02-19-00: latest version is 3.0 build 134 (01-00).
Author: Eugene Kaspersky, Russia (2000), suggested by many.
4. RHBVS- Heuristic virus scanner.
[added 05-13-00 updated 05-06-01]
The RHBVS virus scanner differs from other scanners listed here because it's based soley on heuristics. Compared with their conventional counterparts, heuristic scanners don't require the often huge virus signature databases, and consequently tend to be smaller and shouldn't require as much updating (except for engine revisions). A good heuristic scanner should be able to detect novel and mutated viruses. On the downside, the detection capability of heuristic scanners is only as good as the underlying algorithms. Many heuristic scanners seem to generate more false positives than their conventional counterparts (on my system, RHBVS has tended to bite on DOS TSR executables). Heuristic scanners can also be slower.
Notes on RHBVS: "...quite small, reasonable speed, high detection rate, option-rich." "...Detection modules for batch viruses, Trojans, malware, scripting viruses like Corel Draw, VBS, HTML, Windows Batch (WBT), Java-Script and IRC script worms are also included..." Limitations: No repair functions, doesn't handle boot sector infectors.
Author: Ralph Roth, ROSE Software Engineering (2001) Home Page., suggested by CyberRax.
05-20-01: v3.50 (05-01) available.
download rhbvsXXX.zip (~220K)
FILE CHECKSUM UTILS
Using a variety of algorithms, these utils calculate a unique signature or "fingerprint" for a file. (e.g., by calculating the checksum value for a program file you can compare it to a reference, valid value to help ensure it has not been modified by viruses, hacking, editing, transmission errors, or other actions).
MD5SUM- Calculate and verify MD5 hash values for files.
unrated [added 08-09-00]
This program will calculate an MD5 value for a given file and also allows you to check the values against an existing, valid value to determine if the file has been changed/corrupted. MD5SUM is most often used to validate the integrity of transferred files which have a reference md5 value stored on the server. But I employ it as a cheap, anti-viral "checksum comparer" for files on my local hard drive.
As a simple usage example, first generate a file (TEST.MD5) holding a baseline MD5 value for a given file (MY.ZIP):
"MD5SUM -b MY.ZIP >TEST.MD5" (-b: assume binary file).
To check the MD5 value of the file at a later date (or to validate copy of file) use,
"MD5SUM -b -c TEST.MD5"
If the values match, output will be: "C:\MY.ZIP: OK" ; If new value doesn't match: "C:\MY.ZIP: FAILED"
Notes: MD5SUM doesn't accept wilcards- if you want to obtain many file values at once, write an appropriate batch file. For an entire drive, you could use an easy batch helper like Locate to collect baseline values, e.g., all *.exe files on drive C, write a batch similar to:
"locate C:*.exe /o:"MD5SUM -b &F>>BASELN.MD5"> MD5DRV.BAT"
(Run MD5DRV.BAT, or just replace the /o switch above with /c to execute immediately)
Run "MD5SUM -c BASELN.MD5" (e.g., at a later date) to compare values against baseline values.
Unrelated (but similar) 16-bit and 32-bit (DJGPP, Win9x LFN compatible) versions of MD5SUM exist:
download md5sum.zip (16-bit, w/ source)
or
md5sum.zip, see txtutils (DJGPP, 32-bit w/ Win9x LFN support)
CHKSUM- Calculates 32 bit CRC and 16 bit checksums.
[added 06-12-99 updated 06-05-00]
CHKSUM calculates two checksums for each file: a 32-bit CRC and a 16-bit checksum. Also 16 and 32 bit "master" total checksums are calculated for all files successfully processed. NASM source incl., distrib. under the GPL. Author: Charles Dye (2000). Home Page. 07-28-99: v1.04a (04- 00) available: "Filespec buffers expanded to 260 bytes to handle the super-long pathnames permitted by Windows 95/98."
Syntax: CHKSUM [filespecs] [switches]
/S recurse into subdirectories
/M page output
/H do not hook critical errors
Filespecs may include DR DOS-style file lists.
download chksum.zip (35K)
OTHER
ADinf- Anti-viral, disk integrity checker.
unrated [added 04-13-99 updated 05-31-00]
From the docs: ADinf "is a unique and powerful disk integrity checker which scans a disk, reading its sectors...through BIOS. It does not utilize DOS tools in searching for infectors and, therefore, can trap formidable stealth viruses that are known to intercept more than twenty DOS functions. It also traps infectors in disk drivers and hitherto- unknown viruses...Unlike other anti-virus tools....ADinf detects viruses on booting a system from the hard disk...[B]esides detecting infectors, ADinf scrupulously x-rays a system for full data integrity and security, and for other data modifications...
ADinf reads vital data about such parameters as the memory size, the address of Int 13h handler in BIOS, Hard Disk Parameter Tables, the master boot record and boot sectors, bad clusters, directory tree, and data on all files under control; then creates a [hidden] diskinfo table for every drive and saves [table in root directory]...At subsequent starts, ADinf first reads these parameters and compares them with those in its diskinfo tables. During scanning it notes any changes in the size of the memory allotted to DOS, Hard Disk Parameter Tables, master boot record, boot sectors of every logical drive, as well as new bad clusters, directories and files newly created or deleted since the last check, and changed files."
The non-commercial version described here lacks some features found in the commercial version. Author: Dmitry Mostovoy, Russia (1999). Suggested by: Originally featured on Yves Bellefeuille's Best freeware for DOS and Windows 3.1.
05-31-00: latest version is v12.14 (05-00); Version history unavailable?
download adinf.zip (330K)
Russian and German versions also available.
DISKSECURE- Protects basic disk files from Viruses.
unrated [added 10-25-98]
reviewed by H. Schwartz (10-06-98)
DISKSECURE: There are three critical files (well, not actually files) at the beginning of your hard disk that perhaps up to 1/3 of the viruses in the wild like to hide in, or like to attack and corrupt:
By corrupting or destroying any one of these three items, a virus can make a disk completely unusable. DISKSECURE protects items #1 and #2 from viruses by:
DISKSECURE also includes a program that bypasses its defenses if you want a program to be able to access your hard disk's beginning sectors directly. DISKSECURE cannot protect your File Allocation Table in this way because it is constantly being written to and changed as new files are created, old ones deleted, etc. To protect this critical table, use a utility like stf.com (save the fat) to back up the FAT table each time you start your computer. Author: Padgett Peterson (1994).
download ds242.zip (31K)
[ Go to Top | Front Page ]
© 1994-2001. Rich Green