Rich Levin's CHECKUP (tm) Virus Detection System

Documentation for Version 3.5
(See UPDATE.DOC for updates to this document)
Released June 14, 1989

For the IBM PC, XT, AT, PS/2 and IBM-compatible computers

Copyright (c) 1988 Richard B. Levin
All Rights Reserved


Give your files a CHECKUP! (tm)


This is not free software. You are granted a limited license to
evaluate this program for ten days in your home or office. If
you continue to use this program, you must register with the
author. Registration fees are $20.00 per copy for home users and
$40.00 per copy for non-home users. A deluxe edition is
available to all users for $60.00.

If you purchased CHECKUP through a retail outlet, send a copy of
your dated sales receipt in lieu of a registration fee.

Registered users receive a special program, REGISTER.EXE, that
enables advanced features and disables CHECKUP's time-delayed
opening screen. Remit registration fees and sales receipts to
Richard B. Levin, P.O. Box 14546, Phila., PA 19115 using the
REGISTER.DOC form included in the CHECKUP distribution archive.

CHECKUP is published by

Richard B. Levin
9405 Bustleton Ave.
P.O. Box 14546
Phila., PA 19115

Lab: (215) 333-8274
BBS: (215) 333-8275

Corporate support: Inquire for details

Site licenses and quantity discounts available. Dealers and
consultants protected. Call or write for details.

Thank you for using CHECKUP.


















Table of Contents

CONSUMER ALERT.............................................2
IMPORTANT NOTE.............................................2
CHECKUP'S MASTER DISK CONTENTS.............................2
COPYRIGHT NOTICE...........................................2
SOFTWARE LICENSE...........................................3
DISTRIBUTION POLICY........................................4
UPGRADE POLICY.............................................5
REGISTRATION FORM..........................................6
DEDICATION.................................................8
NOTE TO USERS OF MS-DOS....................................8
THE PROBLEM DEFINED........................................8
THE TROUBLE WITH ANTI-VIRUS SOFTWARE.......................9
VACCINES..............................................10
ANTIDOTES.............................................11
FILE COMPARISON UTILITIES.............................12
DISK-MAPPERS..........................................13
ANTI-VIRUS TSRs.......................................14
HOW CHECKUP WORKS.........................................15
RUNNING CHECKUP...........................................16
CHECKUP'S COMMAND-LINE OPTIONS........................17
CREATING A CLEAN CHECKUP FLOPPY DISK..................20
CHECKUP'S CHECKUP.BAT/AUTOEXEC.BAT FILE...............22
CHECKUP'S ERRORLEVELS.................................24
CHECKUP'S .XUP FILES..................................25
CHECKUP'S ALTERNATE OUTPUT FILE EXTENSIONS............25
THE CHECKUP.LOG FILE..................................26
RUN-TIME MESSAGES AND EXPLANATIONS....................27
ERROR CODES AND EXPLANATIONS..........................28
FATAL ERRORS..........................................31
ADVANTAGES OF USING CHECKUP...............................31
CONFLICTS WITH OTHER ANTI-VIRUS PROGRAMS..................33
A COLLECTION OF ANTI-TROJAN AND ANTI-VIRUS TECHNIQUES.....33
DIAGNOSING AN INFECTED COMPUTER...........................38
WHAT TO DO IF YOUR SYSTEM IS INFECTED.....................39
A GUIDE TO POPULAR VIRUS-RELATED TERMS....................41
CHECKUP'S RELEASE HISTORY.................................43
























1
























"The only truly secure system is one that is powered off, cast in
a block of concrete and sealed in a lead-lined room with armed
guards--and even then I have my doubts."

Eugene H. Spafford




































2



CONSUMER ALERT

This Is The Original CHECKUP (tm) Program
Not To Be Confused With Other Programs Of The Same Name
If It's Not Software By Rich Levin
It's Not The Original CHECKUP (tm) Virus Detection System

CHECKUP has become one of the world's leading virus
detection systems for IBM PC-class microcomputers. It is used by
government agencies of the USA, Canada, Europe and Australia;
hospitals and research laboratories, colleges and universities,
member companies of the Forbes and Fortune 500s, BBS SysOps and
individual users everywhere. It is likely that CHECKUP runs on
more systems world-wide than all other anti-virus systems
combined.

IMPORTANT NOTE

Please read this document before running CHECKUP. If you
are upgrading from a previous release of CHECKUP, please note:
the CHECKUP program, invocation syntax, file formats and
documentation have been substantially revised.

CHECKUP'S MASTER DISK CONTENTS

Your CHECKUP disk/archive contains the following files:

CHECKUP.BAT - sample CHECKUP batch file (ASCII)
CHECKUP.DOC - this file (ASCII)
CHECKUP.EXE - CHECKUP program (Binary)
CHECKUP.REG - registered user data file (Binary)*
INSTALL.BAT - installation program (ASCII)*+
README.DOC - last-minute errata (ASCII)+
REGISTER.DOC - owner registration form (ASCII)
REGISTER.EXE - registration program (Binary)*
SETUP.BAT - setup program (ASCII)*+
UPDATE.DOC - updates to CHECKUP.DOC (ASCII)+

* Provided to registered users only. Registered users
are provided most of the above files in a
self-extracting archive file named CHKUP.EXE.

+ May or may not be present

COPYRIGHT NOTICE

The name "CHECKUP" and the CHECKUP program, documentation,
CHECKUP-created input and output files, visual displays,
interface, look and feel ("the CHECKUP system") are copyright (c)
and trademark (tm) 1988 Richard B. Levin ("the author"), all
rights reserved.











3



The CHECKUP system is protected by United States Copyright
Law (Title 17 United States Code). Unauthorized modification,
reproduction, duplication, transfer or sales may result in
imprisonment of up to one year and fines of up to $25,000.00 (17
USC 506). Copyright infringers may also be subject to civil
liability. The Federal Bureau of Investigation investigates
allegations of criminal copyright infringement.

SOFTWARE LICENSE

Please read the terms and conditions of this software
license before using the CHECKUP system. This license is
effective from the day you first run the CHECKUP system and
remains in effect for as long as you possess, in whole or in
part, a copy the CHECKUP system. By using the CHECKUP system,
you agree to honor the terms and conditions of this license.

The CHECKUP system is the sole and exclusive property of
Richard B. Levin ("the author") and is provided to you without
warranty of any kind, either express or implied. The entire risk
as to the results and performance of the CHECKUP system is
assumed by you. Should the CHECKUP system prove defective,
ineffective or unsatisfactory, you (and not the author) assume
the entire cost of repair or replacement to damaged or unusable
hardware or software. The author is not liable for any damages
incurred by you or any other party through the use or misuse of
the CHECKUP system.

You are granted a limited license to use and evaluate
unregistered copies of the CHECKUP system on a single computer
for a period of ten days, beginning with the date you first
acquired the CHECKUP system. If you continue to use the CHECKUP
system after the expiration of the ten day evaluation period, you
must register with the author by following the instructions
contained in the accompanying REGISTER.DOC file. Upon credit of
your paid registration or receipt of your dated sales voucher,
the author will provide you with both a program and data file
("REGISTER.EXE" and "CHECKUP.REG") that enable the CHECKUP
system's advanced features and disable its time-delayed opening
screen.

Registered users of the CHECKUP system are granted the
non-exclusive right to use the CHECKUP system in accordance with
this license. Each registered copy of the CHECKUP system is
licensed for use on a single computer. Registered users may
transfer the CHECKUP system from one computer to another provided
the CHECKUP system is in use on only one computer at a time. You
must separately register every copy of the CHECKUP system used on
non-registered computers. Failure to register copies of the
CHECKUP system used on non-registered computers is a violation of
this license and United States Copyright Law.











4



You are permitted to copy and distribute UNREGISTERED copies
of the CHECKUP system to other users through any legal means
available to you, provided such copies conform to the terms,
conditions and spirit of the author's "Distribution Policy,"
presented below. You are NOT permitted to copy and distribute,
in whole or in part, REGISTERED copies of the CHECKUP system, the
REGISTER.EXE file or the CHECKUP.REG file. Registered users are
permitted to make archival back-up copies of the CHECKUP system.

You are not permitted to de-compile, disassemble, make
changes to or reverse engineer the CHECKUP system in any way
whatsoever, nor are you permitted to attempt to de-compile,
disassemble, make changes to or reverse engineer the CHECKUP
system.

This license is non-transferable. Any violation of this
license or attempt to assign, sub-license or transfer same,
except as provided for herein, renders this license null and
void. The author reserves the right to make changes to this
license and to the CHECKUP system at any time without prior
notice. This license is governed by the laws of the Commonwealth
of Pennsylvania and the United States of America. Terms or
conditions of this license found to be unenforceable or illegal
will not effect the remaining license terms and conditions.

DISTRIBUTION POLICY

You are permitted to distribute UNREGISTERED copies of the
CHECKUP system to other users when the following conditions are
met:

1. The CHECKUP system must be distributed in its
entirety, as originally produced by the author.

2. No part of the CHECKUP system may be altered,
added to, removed, re-archived or modified in any
way whatsoever.

3. The CHECKUP system must not be sold by anyone
other than the author or authorized
representatives of the author.

4. The REGISTER.EXE program and the CHECKUP.REG data
file (both provided to registered users) must NOT
be distributed.

















5



UPGRADE POLICY

The latest edition of the shareware version of CHECKUP is
stored on the Mother Board BBS (215-333-8275) in the "Software by
Rich Levin" area and may be downloaded, free of charge, at any
time. Upgrades are also regularly posted to the IBMNET\IBMSYS
Forum on the CompuServe Information Service (GO IBMSYS) and the
IBM and BBS RoundTables (RTs) on the General Electric Network for
Information Exchange (GEnie). Registered users can enable
advanced features of CHECKUP system upgrades and disable their
time-delayed opening screen.

Upgrades are also available by mail to registered users.
Send a blank, formatted, IBM-compatible 360k diskette; a
postage-paid, pre-addressed disk mailer and your check or money
order (drawn on a U.S. bank or financial institution and made
payable to "Richard B. Levin") in the amount of $10.00 per copy
for home users and $20.00 per copy for non-home users to:

CHECKUP Upgrade
P.O. Box 14546
Phila., PA 19115

Please remember to note your registered user serial number on
your order.





































6



REGISTRATION FORM

Please print, complete and mail this form within ten days to:

Richard B. Levin
CHECKUP Registration
P.O. Box 14546
Phila., PA 19115

Home users: Enclose payment in the amount of $20.00 per copy
Non-home users: Enclose payment in the amount of $40.00 per copy

All users: Enclose payment in the amount of $60.00 per copy
if you would like to receive the "deluxe"
(typeset and bound) edition of the CHECKUP
documentation.

Please have checks and money orders drawn on a U.S bank or
financial institution and made payable to "Richard B. Levin."

Purchase orders are accepted on a net terms basis, with approved
credit and a minimum initial purchase of $500.00. Orders are
shipped insured, freight collect. Quantity pricing, site
licenses and other information available on request. Prices
subject to change without notice.


Registered owner's name:

_________________________________________________________________


Title: _________________________________________________________


Department: ____________________________________________________


Company:

_________________________________________________________________


Address:

_________________________________________________________________

_________________________________________________________________














7



City, State and Zip:

_________________________________________________________________


Home telephone number: ( ) -
Work telephone number: ( ) -


Comments: ______________________________________________________

_________________________________________________________________

_________________________________________________________________

_________________________________________________________________


Total number of unregistered computers running CHECKUP: ________

Amount enclosed (check all that apply):

[ ] Home user @ $20.00 per copy: $_____________
[ ] Non-home user @ $40.00 per copy: $_____________
[ ] Deluxe edition @ $60.00 per copy: $_____________
[ ] Sales receipt enclosed @ $0.00 per copy: $_____________


Sign here: _____________________________________________________

































8



DEDICATION

Many people have selflessly contributed to the creation of
the CHECKUP system; you know who you are. This program is
dedicated to you.

NOTE TO USERS OF MS-DOS

The files IO.SYS and MSDOS.SYS are the MS-DOS equivalents to
PC-DOS' IBMBIO.COM and IBMDOS.COM.

THE PROBLEM DEFINED

Ours is not to reason why there exists, in this wonderful
but crazy computing world of ours, programs that intentionally
destroy your hard-earned data while pretending to be just another
run-of-the-mill application. These programs are popularly called
"bombs" or "Trojan horses" and they "explode" on users who do not
properly evaluate software before they run it (safe-computing
procedures outlined later in this document). The consequences of
running a bomb can be disastrous: erased files, scrambled disk
directories and re-formatted disks are but some of the documented
results. Because bombs willingly self-destruct--they run on the
systems they destroy--they have limited run-time lives and pose,
therefore, a finite threat.

Like bombs, computer viruses are typically delivered hidden
inside harmless-looking "Trojan" carriers (usually stored on
illegal, pirated copies of commercial program disks). Unlike
bombs, which detonate immediately when run, viruses pursue a more
sinister and long-range plan: the conversion of ordinary
programs into infected Trojan carriers. Once infected, the new
carriers also reproduce in secret, penetrating other computers
and infecting files exponentially--one program infects two, two
infects four, four infects eight and so on. This reproductive
cycle continues until the number of affected systems and diseased
files reaches epidemic proportions; the viruses have effectively
extended their run-time lives.

To manage their activities and to avoid re-infecting the
same files over again, viruses store coded bytes called
"v-markers" (virus markers) into files during their initial
infection. When unmarked, uninfected files cannot be found,
viruses assume their hosts have been thoroughly poisoned(1) with
viral code; tampering with system operations and user data
usually begins at this time when all-out contamination has been
achieved. Viruses may begin by simply toying with users,
printing taunting messages on screens or causing abnormal system
behavior. Eventually, however, most viruses detonate and damage
disk-based data.












9



[(1) One clever way to prevent the spread of a virus is to put
copies of its v-markers into all executable files. To implement
such a plan would, of course, require careful study of the
dissected viral code--not a task for the meek.]

It is extremely difficult--sometimes nearly impossible--to
accomplish total eradication of a virus allowed to obtain total
system saturation (especially in a networked environment). When
infections are discovered too late, countless viral offspring
have probably been spawned; generations of back-up data and
multiple computers have also been infected. Eradication can be a
nerve-wracking, time-consuming and complicated process, best
performed by highly skilled (and highly paid) anti-virus experts,
with relapses occurring long after systems appear to have been
cleansed.

Well-written computer viruses are difficult to detect using
modern file management and anti-Trojan techniques. They are
ingenious yet simple programs, polluting systems by inserting
copies of themselves into, appending viral clones onto or
creating shells around ordinary executable files. Expertly
engineered viruses will not change file date or time stamps, nor
will they alter attributes, sizes or checksums. Converting the
attributes of potential viral targets (such as COMMAND.COM,
IBMBIO.COM and IBMDOS.COM) to "read-only" may prevent
inadequately designed viruses from infecting them. Most viruses,
however, can check file attributes, reset them if necessary,
infect, then return the attributes to their original state. As
you will learn in the following sections, there are no sure-fire
ways to prevent viruses from infecting your systems. The only
practical solution is to isolate and eradicate infections
immediately after they occur using virus detection software
stored off-line.

THE TROUBLE WITH ANTI-VIRUS SOFTWARE (or "Hey--what a market!")

Many public domain, shareware and commercial utilities
designed to combat viruses have appeared since the first virus
panic swept the nation in early 1988. Of the anti-virus products
examined during our ongoing testing, all were over-hyped,
underpowered or engineering overkill, providing no real benefits
to consumers. Virtually all of the offerings are marketed using
"the fear factor"--the exploitation of under-educated users. It
is of the utmost importance that users understand the failings
inherent in most anti-virus programming; thus, our observations
on the state of virus protection programs follows.
















10



"VACCINES"

Many anti-virus programs claim to provide a software
"antigen" or "vaccine" that, when "injected" into executable
files, "inoculates" them to prevent viral infections.
Unfortunately, the implicit comparisons between anti-virus
software and true biological vaccines is misleading--just so much
marketing rhetoric.

What software vaccines actually do is append small
anti-virus programs and data (usually file checksums or CRCs) to
target executable files. The target files are modified so that,
when run, control is passed first to the appended anti-virus
programs. As the target files run, the anti-virus programs
compare the file checksums to their appended data. When
comparisons are successful, control is returned to the target
files, which (if all goes well) begin normal operations. When
comparisons fail, users are alerted and (hopefully) appropriate
actions taken.

Users should be aware of the following shortcomings and
complications associated with software vaccines before they put
them into service:

1. "Vaccinated" programs take longer to load because
appended anti-virus code and data increases
overhead.

2. Large amounts of disk space can be consumed as
appended anti-virus code and data enlarge program
files.

3. Data and overlay files cannot be protected;
vaccines must be used with executable files.

4. Some vaccines cannot protect .COM files because
they (the vaccines) try to modify .EXE headers.
.COM files do not have .EXE headers.

5. Many vaccines cannot protect packed .EXE files.
(Packed .EXE files have been compressed during
programming's LINK process to conserve disk space;
they expand in-memory when run. CHECKUP.EXE is an
example of a packed file.)

6. False alarms are generated when self-modifying
programs (like Borland's SideKick) update internal
data areas. To prevent false alarms, users are
forced to remove and re-install vaccines before
and after self-modifying programs are used.












11



7. For programmers, source code modifications are
often misinterpreted as viral alterations.

8. There are no guarantees that modifications to
executable files (like the appending of anti-virus
code and data) will not adversely affect their
operation.

9. The virus-like behavior of vaccines may cause
conflicts with other viral defense systems.

10. A virus can detect the modification of target
files and simply delete the anti-virus code and
data.

11. Non-destructive file-checking utilities (like
CHECKUP) provide a safer, easier way of conducting
pre-run file checksums and CRCs.

Vaccines operate in a manner fundamentally similar to
viruses, although they do not reproduce without authorization or
purposely damage files. Most users are uncomfortable with the
concept of injecting a virus--antigen or otherwise--into their
executable files, especially when safer, less drastic
alternatives are available.

"ANTIDOTES"

Some anti-virus vendors claim their products can remove
viruses or repair files damaged by a virus. Perhaps so; a far
more reliable method, however, is to restore infected files from
certified back-up or master copies. Other vendors con the
computing public by boldly demonstrating their programs'
"amazing" ability to restore "virus-deleted" data from
re-formatted, repartitioned hard disks. The truth is they are
merely restoring back-up copies of critical disk information:
the boot sectors, File Allocation Tables, disk directories and
partition data.

Most users are blissfully unaware that re-formatting disks
and repartitioning hard disks does not delete user data; instead,
it just marks allocated disk space as "unused." By replacing
disk "road maps" with accurate back-ups, user data appears to be
miraculously resurrected. Like their cousins, the software
vaccines, antidotes and format-recovery programs are not without
their drawbacks:

1. If the back-up data is not current, the
information it replaces will be out of date--an
inaccuracy that leads to further data loss.












12



2. Format recovery programs cannot reconstruct data
erased by low-level or destructive high-level
re-formatting. (Low-level formatting is employed
by most hard disk controller manufacturers;
destructive formatting is a feature of AT&T's and
Compaq Computer's DOS' and perhaps other OEM DOS
versions.)

3. If new data has been written to a disk after it
has been re-formatted, deleted data cannot be
reliably recovered.

4. Many users already own data recovery programs
(like the Mace Utilities, the Norton Utilities and
PC-Tools) that are capable of restoring even the
most badly damaged disk to a usable condition.

Once again, it is safer (and more reliable) to restore files
from certified back-up copies or through the use of proven data
recovery programs. There are no substitutes for regularly
scheduled back-ups.

FILE COMPARISON UTILITIES

File comparison utilities compare, byte for byte, two
mirror-image copies of a target file specification. There are
several problems with this simple technique:

1. The same level of protection is achieved using any
file-comparison utility, including those provided
with DOS.

2. A duplicate copy of every compared file must be
stored on another disk or directory, a waste of
valuable disk space.

3. File comparison utilities generally do not support
features essential for the management of virus
detection; options like activity logs, alarms,
data encryption, system locks and wildcard (? and
*) input filespecs are sorely missed.

4. Viruses can check disk directories for duplicate
files and infect both copies of a target filespec.
Future file comparison checks would not detect any
differences between the two infected files.
















13



5. Most file comparison utilities designed
specifically for virus detection prevent users
from comparing more than system start-up files
(IBMBIO.COM, IBMDOS.COM and COMMAND.COM). All
other files, including user data, remain
unprotected.

"DISK-MAPPERS"

Disk-mappers (also known as "picture takers,"
"finger-printers" and "signature checkers") maintain centralized
data files consisting of coded disk images. These programs
notify users when changes are discovered between target disks and
their coded images. Here again, the solution fails to provide an
adequate defense against viral infections:

1. Disk-mappers' output files can occupy vast amounts
of disk space; they increase in direct proportion
to the number of files being tracked.

2. Time consuming maintenance of disk-mapper data
files is generally required. As the state of the
target disk evolves, entries must be sorted,
updated, deleted or purged.

3. Disk-mappers can be complex to operate because
they must support many data-file maintenance
options.

4. Disk-mappers customarily update data files at
system start-up, increasing boot time.

5. Viruses can detect, modify and delete disk-mapper
data files.

6. Some disk-mapping programs convert files
(including raw data) to read-only status, thereby
assuring conflicts with other applications.

7. Several disk mapping schemes rely on
memory-resident modules to intercept DOS commands
in order to provide last-minute checks of programs
about to run. The problems with memory-resident
anti-virus programs are discussed in the next
section.

8. File-checking utilities (like CHECKUP) provide a
safer, easier way of performing last-minute checks
of programs about to run.













14



ANTI-VIRUS TSRs

Programs that load and stay RAM-resident (like Borland's
SideKick) are commonly referred to as "TSRs" (an anacronym for
"terminate and stay resident"). Anti-virus programs employing
this technology typically monitor disk writes directed to
specific files or provide last-minute checks of files about to
run. Unfortunately, the complications presented through the use
of anti-virus TSRs are numerous and severe:

1. Many computer configurations respond poorly to
particular groupings of TSR programs--they crash,

lock-up or simply behave abnormally.

2. Anti-virus TSRs often consume considerable
portions of limited available RAM space.

3. False alarms occur frequently, triggered by normal
disk activity that's misinterpreted.

4. Unattended computer operations, such as e-mail
transfers, uploads and downloads, are subject to
unanticipated--and usually fatal--interruptions
when anti-virus TSRs accidentally activate.

5. Most anti-virus TSRs allow a limited number of
files to be monitored, leaving other files--user
data included--unprotected.

6. System performance decreases as each BIOS- or
DOS-driven disk write is intercepted for
processing by anti-virus TSRs.

7. Viruses can directly manipulate disk controller
hardware to bypass interception by anti-virus
TSRs.

8. Anti-virus TSRs can be easily detected by viruses,
which is not surprising, since TSRs are always
evident in RAM. Viruses can disable or remove
TSRs and for this reason alone, anti-virus TSRs
provide users with a false sense of security.




















15



A final point, relevant to all anti-virus systems: viruses
have complete control of PC system resources at the moment of
infection. Anti-virus programs renamed and stored in hidden
subdirectories, write-protected hard disks; hidden, read-only and
vaccinated files, file comparison utilities, disk maps, TSR
programs, device drivers, you name it--all are subject to the
scrutiny of viruses as they examine their hosts. Obviously,
then, anti-virus systems stored on non-removable media, relying
on support files stored on non-removable media or residing in
memory are themselves subject to infection.

HOW CHECKUP WORKS

CHECKUP detects viral infections by comparing target file
sizes, incremental cyclic redundancy checks (CRCs) and total file
CRCs to previously stored baseline values. CHECKUP examines
files by dissecting them into randomly sized blocks of data,
using a dynamic block size allocation that allows files as small
as one byte to be accurately checked. CHECKUP then scans and
compares each and every byte of the target files on a
block-by-block basis. If the recorded file sizes or any of the
block CRC comparisons or CRC totals do not match, CHECKUP alerts
users that the target files have been altered.

CHECKUP's incremental block CRC technique is superior to
simply calculating a sum-of-the-bytes and comparing past and
present checksum totals. Future viruses may be able to compute
checksums prior to infections, pad their viral code with
characters that maintain checksum integrity and then infect.
Even more alarming is the knowledge that viruses can effortlessly
exchange bytes within data files--a potent form of data
destruction ordinary checksum programs cannot detect. (For
example, the checksum of both 1 + 2 and 2 + 1 is 3, yet the order
of operators [the numbers 1 and 2] are different.) This kind of
viral activity would defeat other checksum calculation programs,
but not CHECKUP.

We believe it is impossible for a virus to maintain an
accurate intra-file (inter-block) CRC. This is especially true
when the checked block size varies from one byte to near total
file size, when the method for calculating the CRC is unknown and
the results encrypted. To survive CHECKUP's scrutiny, a virus
would need to know the block size, the exact calculation entry
point, the CRC algorithm and the encryption key used at
initialization. The virus would then have the difficult--if not
impossible--task of padding its code with dummy characters, since
adjustments would have to occur every hundred few bytes. Even if
a virus were able to achieve this high degree of adaptability, it
would nevertheless be unable to operate in such an internally
scrambled condition.












16



RUNNING CHECKUP

Launch syntax is:

[d:][path]CHECKUP [d:][path]filename[.ext] [/options]

Where:

* [d:] specifies the letter of the drive that
contains the CHECKUP program file.

* [path] specifies the path name that contains the
CHECKUP program file.

* CHECKUP is the run-time name of the CHECKUP.EXE
program file.

* [d:][path]filename[.ext] specifies the drive, path
and target file name(s) you want CHECKUP to
process.

* [/options] are one or more of CHECKUP's
command-line actions (explained below).

Notes:

1. If a drive letter is not specified, the default
drive is assumed.

2. If a path name is not specified, the default
directory is assumed.

3. The global file name characters * and ? may be
used to specify target files.

4. The target file specification must be the first
parameter on the CHECKUP command-line.

5. If CHECKUP is stored in the current directory or
in a directory specified by the PATH environment
variable, the drive letter and path name preceding
the CHECKUP file name become optional.

Examples:

* To check COMMAND.COM on the logged default drive
in the logged default directory, the launch syntax
would be:

CHECKUP COMMAND.COM












17



* To check all of the .COM files on the logged
default drive in the logged default directory, the
launch syntax would be:

CHECKUP *.COM

* To check FOO.EXE (a very popular program) on the
C: drive in the \PLOP\PLOP\FIZZ\FIZZ directory,
the launch syntax would be:

CHECKUP C:\PLOP\PLOP\FIZZ\FIZZ\FOO.EXE

* To check all of the .EXE files on the C: drive in
the \PLOP\PLOP\FIZZ\FIZZ directory, the launch
syntax would be:

CHECKUP C:\PLOP\PLOP\FIZZ\FIZZ\*.EXE

CHECKUP accepts all legal DOS path and file names. Running
CHECKUP without command-line parameters causes the correct
invocation syntax and other helpful information to be displayed.

CHECKUP'S COMMAND-LINE OPTIONS

CHECKUP supports a variety of command-line options that
allow you to tailor the program's actions to address specific
application requirements. These command-line options are
provided as tools to aid in the control of CHECKUP'S execution;
CHECKUP does not require any of these options to run.

The switch character ("/") and first letter of the option(s)
selected must appear after the target file specification on the
CHECKUP command-line (note that future releases may implement
changes to these options):

/B[LOCK]:#### Override auto-block sizes and use
#### byte blocks

CHECKUP automatically selects
random data block sizes. Use this
option to specify fixed data block
sizes.

In general, the larger the selected
block size, the faster CHECKUP
processes the file. Our testing
shows ideal block sizes range from
1024 to 2048 bytes; your testing
may yield different results.













18



Note that the colon character (":")
must appear before the block size
value. For example, the commands

/B:1024
/BLOCK:1024

both specify a block size of 1024
bytes.

/C[OLOR] Override auto-attributes and use
color

CHECKUP automatically detects the
type of video adapter card
(monochrome or color) installed and
sets on-screen colors accordingly.
Use this option if CHECKUP does not
detect your color video adapter
card.

/D[EBUG] Print verbose error messages

Causes CHECKUP to report error code
and line numbers in addition to
standard error messages.

/E[CRC] Override CRCs and use enhanced CRCs

CHECKUP automatically uses
table-driven CRCs (cyclic
redundancy checks) to detect
changes in target files. ECRCs are
a proprietary superset of CRCs that
provide better error checking but
may take longer to run.

/F[AST] Override CRCs and use checksums

CHECKUP automatically uses
table-driven CRCs (cyclic
redundancy checks) to detect
changes in target files. Checksums
provide faster error checking but
cannot detect adaptive-checksum
viruses and one type of data
tampering (see the section titled
"HOW CHECKUP WORKS," above, for
more information on checksums and
data tampering).












19



/I[NFO] Display program information

Causes CHECKUP to display an
informational message when no other
options are entered.

/L[OCK] Lock-up system when file
modifications are detected

Causes CHECKUP to secure the host
system and sound a continuous alarm
when file modifications are
detected. The host system must be
re-booted in order to un-lock it.

/M[ONO] Override auto-attributes and use
monochrome

CHECKUP automatically detects the
type of video adapter card
(monochrome or color) installed and
sets on-screen colors accordingly.
Use this option if CHECKUP does not
detect your monochrome or Hercules
video adapter card.

/N[OLOG] Suppress output of CHECKUP.LOG file

CHECKUP normally maintains an
output file named CHECKUP.LOG.
This option prevents CHECKUP from
updating the CHECKUP.LOG file and
thus speeds CHECKUP's operations.
See the section titled "THE
CHECKUP.LOG FILE," below, for more
information on the CHECKUP.LOG
file.

/P[AUSE] Pause when file modifications are
detected

Causes CHECKUP to secure the host
system when file modifications are
detected. Pressing any key
un-pauses the host.

/R[EPLACE] Use replacement extension (.COM
becomes .XOM)














20



See the section titled "CHECKUP'S
ALTERNATE OUTPUT FILE EXTENSIONS,"
below, for more information on this
option.

/S[HIFT] Use shifted extension (.COM becomes
.XCO)

See the section titled "CHECKUP'S
ALTERNATE OUTPUT FILE EXTENSIONS,"
below, for more information on this
option.

CREATING A CLEAN CHECKUP FLOPPY DISK

We suggest that CHECKUP be run by an AUTOEXEC.BAT file
residing on a "clean" floppy disk. This ensures that files are
checked by a pure copy of CHECKUP loaded by uninfected system
files. It also guarantees that the .XUP files CHECKUP generates
will not be illegitimately altered.

If the "clean floppy disk/batch file method" is not
appropriate for your installation, other virus detection
strategies utilizing CHECKUP may be devised and used. We
recommend, however, that users read this section to gain an
understanding of the security benefits provided by implementation
of the clean floppy disk/batch file method.

The following steps explain how to create a clean CHECKUP
floppy disk using an IBM PC-compatible with 2 floppy disk drives
and a hard disk. Experienced users can adapt these steps to
accommodate different configurations:

1. Turn off your computer. Remove all floppy disks.
Wait 60 seconds.

2. Insert a factory master copy of DOS into drive A.
Close the disk drive door, then turn your computer
on.

3. After your computer has completed the start-up
process, insert a NEW, never used, unformatted
floppy disk into drive B. Close the disk drive
door.


















21



4. Enter the command:

FORMAT B: /S

(The /S switch causes the FORMAT command to
transfer DOS' system files to the disk in drive B,
making it "boot-able.")

5. After the floppy disk in drive B has been
formatted and the system files transferred, copy
CHECKUP.BAT and CHECKUP.EXE to the floppy disk in
the B drive.

6. After CHECKUP.BAT and CHECKUP.EXE have been copied
to the floppy disk in the B drive, enter the
following commands:

B:
REN CHECKUP.BAT AUTOEXEC.BAT
COPY CON CONFIG.SYS
BUFFERS = 33

7. Press F6, then press ENTER.

8. Remove the factory master DOS disk from drive A.
Replace it with the factory master of your
favorite ASCII editor. (An ASCII editor is any
word processor capable of generating unformatted
text output. If you're uncertain of your word
processor's ability to create pure ASCII text, use
EDLIN.COM [provided on your factory master DOS
diskettes] instead.)

9. Run your ASCII editor and edit the AUTOEXEC.BAT
file on drive B to reflect the disks, paths and
files you want CHECKUP to process. Confirm that
the disk and path names of the target files and
.XUP files match exactly.

10. After you have finished editing the AUTOEXEC.BAT
file on drive B, remove the factory master of your
ASCII editor from drive A. Replace it with the
clean CHECKUP floppy disk you just created on
drive B (leaving CHECKUP in drive A and drive B
empty).

11. Press and hold the Ctrl+Alt+Del keys to re-boot
your computer. CHECKUP will process the files
specified in the AUTOEXEC.BAT file, copy the .XUP
files back to the A drive and delete duplicate
.XUP files from the target disk.











22



12. After CHECKUP's AUTOEXEC.BAT file has completed
its run, remove the clean CHECKUP floppy disk from
drive A and store it in a cool, dry place.

13. Press and hold the Ctrl+Alt+Del keys to re-boot
your computer.

Use the clean CHECKUP floppy disk to boot your computer
whenever you check files again.

Remember that all viruses, no matter how sophisticated,
share the same, simple weakness: they cannot affect programs or
data unless they have access to them. By storing CHECKUP, the
CHECKUP AUTOEXEC.BAT file and the .XUP files on a clean,
boot-able floppy disk, and by using that disk *ONLY* to boot and
run CHECKUP (and for *NO* other operations), you are isolating
your CHECKUP system files and ensuring their reliable operation.

CHECKUP'S CHECKUP.BAT/AUTOEXEC.BAT FILE

An example of the suggested CHECKUP AUTOEXEC.BAT file for a
hard disk drive system follows; users should edit this file to
support their specific needs. This sample batch file will
automatically run CHECKUP, check one of four ERRORLEVELs returned
by CHECKUP and back-up .XUP files as they are created. It is
included in the CHECKUP archive file (under the name of
CHECKUP.BAT) and may be edited as necessary:



































23



REM Rich Levin's CHECKUP.BAT (tm)
REM Copyright (c) 1988 Richard B. Levin
REM All Rights Reserved
REM
REM This batch file maintains clean copies of CHECKUP and .XUP
REM files. Rename to AUTOEXEC.BAT and store on a clean floppy
REM disk. See CHECKUP.DOC for information on how to create a
REM clean floppy disk.
REM
REM Set the system date and time:
REM
DATE
TIME
REM
REM Make sure we're on the root directory of the target disk
REM (substitute the disk drive letter of your choice):
REM
C:
CD \
REM
REM Copy CHECKUP and .XUP files from the A: drive to the target
REM disk:
REM
COPY A:\CHECKUP.EXE
COPY A:\IBMBIO.XUP
COPY A:\IBMDOS.XUP
COPY A:\COMMAND.XUP
COPY A:\FOO.XUP C:\PLOP\PLOP\FIZZ\FIZZ
REM
REM Check files and resulting ERRORLEVEL. An ERRORLEVEL of 1 or
REM higher indicates CHECKUP terminated abnormally. (CHECKUP
REM supports four ERRORLEVELs; see CHECKUP.DOC for details.) In
REM this example, system execution is halted by PAUSE-ing after
REM a non-zero ERRORLEVEL is encountered. You may want take
REM different action(s) based on specific ERRORLEVELs.
REM (Substitute your list of input files here):
REM
CHECKUP *.COM
IF ERRORLEVEL 1 PAUSE
CHECKUP C:\PLOP\PLOP\FIZZ\FIZZ\FOO.EXE
IF ERRORLEVEL 1 PAUSE
REM
REM Copy .XUP files from the target disk back to the clean floppy
REM disk:
REM
COPY C:\*.XUP A:\
COPY C:\PLOP\PLOP\FIZZ\FIZZ\*.XUP A:\
REM
REM Reclaim disk space by deleting CHECKUP-related files from the
REM target disk:












24



REM
DEL CHECKUP.EXE
DEL *.XUP
DEL C:\PLOP\PLOP\FIZZ\FIZZ\*.XUP
REM
REM End of CHECKUP.BAT

COMMAND.COM, IBMBIO.COM and IBMDOS.COM should be checked on
a daily basis, as they are the most likely targets of a spreading
virus. Other executable files should be checked prior to being
run or before they are exported to another system. Static data
(like initialization files) should also be periodically checked;
checking dynamic data (like data base files) will usually result
in CHECKUP detecting file modifications.

Note that CHECKUP does not require the attributes of hidden
and system files be changed prior to checking. CHECKUP will
successfully process all files, regardless of type, provided the
files are specified correctly on command-line.

CHECKUP'S ERRORLEVELS

Upon exiting to DOS, CHECKUP returns the following
ERRORLEVELs to the operating system. These ERRORLEVELs can be
tested for and acted upon in any DOS batch file:

ERRORLEVEL = Condition

0 = Process terminated normally
1 = Input file(s) modified since last check
2 = Fatal error occurred
3 = Cancelled on demand (user aborted)

The ERRORLEVEL condition will test positive if CHECKUP
generates an exit code equal to or greater than the ERRORLEVEL
being tested for; this means that ERRORLEVELs must be checked in
descending order to insure accuracy. For example, the following
batch file command executes if the ERRORLEVEL is equal to or
greater than 1:

[ ...
IF ERRORLEVEL 1 [command]
... ]

This code demonstrates how one command can be executed for
ERRORLEVELs equal to or greater than 2 while a separate action is
reserved for an ERRORLEVEL of 1:















25



[ ...
IF ERRORLEVEL 2 [command]
IF ERRORLEVEL 1 [command]
... ]

Finally, this code excerpt shows how different commands can
be executed for different ERRORLEVELs:

[ ...
IF ERRORLEVEL 3 [command]
IF ERRORLEVEL 2 [command]
IF ERRORLEVEL 1 [command]
... ]

ERRORLEVEL reporting is provided as a tool to aid in the
control of batch file execution; CHECKUP does not require users
to test ERRORLEVEL conditions.

CHECKUP'S .XUP FILES

The first time a file is checked, CHECKUP creates an .XUP
file in the same directory as the target file. CHECKUP creates
one .XUP for every checked file; access to the .XUP files are
required during future checks. If CHECKUP or any .XUP files are
mysteriously deleted or altered, a CHECKUP-aware virus may have
infiltrated your system. To prevent viruses from gaining control
of CHECKUP's files, use the clean floppy disk/batch file method
described in the section titled "CREATING A CLEAN CHECKUP FLOPPY
DISK," above.

CHECKUP'S ALTERNATE OUTPUT FILE EXTENSIONS

".XUP" is CHECKUP's default output file extension. There
are times, however, when use of the .XUP extension presents
complications (when checking numbered overlay files, for example,
or files with the same name). CHECKUP provides two command-line
alternatives designed to resolve target filename conflicts: the
/R[EPLACE] and /S[HIFT] commands.

1. The /R[EPLACE] command creates output files with
"replacement" extensions when a /R appears on
CHECKUP's command-line. CHECKUP replaces the
first character of the input file extension with
the letter X:

OVERLAY.001 Input file
OVERLAY.X01 Optional replacement extension
OVERLAY.XUP Default CHECKUP output file














26



OVERLAY.002 Input file
OVERLAY.X02 Optional replacement extension
OVERLAY.XUP Default CHECKUP output file

When checking OVERLAY.002, CHECKUP will attempt to
use OVERLAY.XUP--an incorrect data file since it
contains output information gathered from checking
OVERLAY.001. In this example, a non-fatal
"Input/output file mismatch" error would occur if
the /R switch was not used.

2. The /S[HIFT] command creates output files with
"shifted" extensions when a /S appears on
CHECKUP's command-line. CHECKUP replaces the
first character of the input file extension with
the letter X and replaces the second two
characters of the input file extension with the
first two characters (in effect shifting the
extension one character to the right):

COMMAND.COM Input file
COMMAND.XCO Optional shifted extension
COMMAND.XUP Default CHECKUP output file

Use CHECKUP's alternate output file extension options
whenever Input/output file mismatch errors are encountered, when
checking overlay files with numeric extensions or input files
with the same name.

THE CHECKUP.LOG FILE

CHECKUP maintains a file named CHECKUP.LOG on the root
directory of the logged disk. CHECKUP.LOG contains a detailed
record of CHECKUP's activities and may be invaluable in the event
a virus is detected; it will be your only recorded history of
viral exercises.

You can view the CHECKUP.LOG file with any ASCII editor and
delete it at any time (although we recommend back-up copies be
maintained). The CHECKUP.LOG file is provided as an
informational tool only; CHECKUP does not require it to run.

You can optionally SET a log file directory. CHECKUP will
store the CHECKUP.LOG file in the directory specified by the LOG
or TMP environment variables. The following command (ideally
added to AUTOEXEC.BAT) causes CHECKUP to store the CHECKUP.LOG
file in the C:\CANYA\DIGIT directory:

SET LOG=C:\CANYA\DIGIT













27



CHECKUP looks first for the LOG, then the TMP, environment
variables. If LOG is not found or null, CHECKUP attempts to use
the TMP variable. If TMP is not found or null, CHECKUP will use
the root directory of the default drive. Note that output of the
CHECKUP.LOG file can be suppressed if the /N[OLOG] switch appears
on CHECKUP's command-line.

RUN-TIME MESSAGES AND EXPLANATIONS

The following messages are encountered when using CHECKUP:

1. This is the unregistered commercial version ....

An unregistered commercial version of CHECKUP was
launched. See the section titled "REGISTRATION
FORM," above, for information on how to register
your copy of CHECKUP.

2. This is not free software.

An unregistered, user-supported shareware version
of CHECKUP was launched. See the section titled
"REGISTRATION FORM," above, for information on how
to register your copy of CHECKUP.

3. Syntax is ....

CHECKUP was launched without command-line
parameters and the help screen was displayed.

4. Cancelled on demand

Either the ESC or C keys were pressed; CHECKUP
discontinued file processing and returned to DOS.
An ERRORLEVEL of 3 was returned to DOS by CHECKUP.

5. Press any key to continue

Either the SPACE, P, CR or I keys were pressed, or
CHECKUP detected file size or CRC changes while
the /P[AUSE] option was specified on the
command-line. CHECKUP paused processing and
displayed this message.

6. Checksums|CRCs|ECRCs calculated and logged

CHECKUP processed the input file for the first
time or updated an existing .XUP file to a new
version.













28



7. File sizes are different

The input file size changed since CHECKUP first
processed it. An ERRORLEVEL of 1 was returned to
DOS by CHECKUP.

8. Checksum|CRC|ECRC error on block # ....

CHECKUP detected changes to the input file
beginning at the specified block number. An
ERRORLEVEL of 1 was returned to DOS by CHECKUP.

9. Checksums|CRCs|ECRCs match

The input file has not changed since CHECKUP last
processed it.

10. CHECKUP ALERT

CHECKUP detected file size or checksum|CRC|ECRC
changes. An ERRORLEVEL of 1 was returned to DOS
by CHECKUP.

11. ... file(s) checked

CHECKUP completed processing of one or more files.

12. System locked

CHECKUP detected changes to an input file while
the /L[OCK] command was specified on the
command-line. An ERRORLEVEL of 1 was returned to
DOS by CHECKUP.

ERROR CODES AND EXPLANATIONS

The following error messages may be encountered when using
CHECKUP:

1. Endless loop error

See the explanation of "Loop error," below.

2. Bad file name
Bad file name or number

See the explanation of "Path/File access error,"
below.














29



3. Device fault
Device timeout
Device unavailable
Disk media error
Disk not ready

Indicates a hardware error (like an open disk
drive door or a bad, non-existent or incorrectly
specified device) or a hardware failure (such as a
damaged disk).

Retry the operation after checking disks, disk
drive doors, printer switches, cables, connections
and related hardware.

4. Device I/O error

An unrecoverable input/output error occurred.

Retry the operation.

5. Disk full

The disk is full.

Retry the operation using another disk or delete
some non-CHECKUP related files from the current
disk.

6. Error in EXE file

A portion of the CHECKUP.EXE file is missing or
the file is corrupt.

Replace CHECKUP.EXE with a certified clean copy
downloaded direct from one of CHECKUP's principal
distribution points. See the section titled
"UPGRADE POLICY," above, for a list of authorized
distribution points or call 215-333-8274 to
arrange the purchase of a new CHECKUP master disk.

7. File not found

An input filespec does not exist.

Retry the operation using the correct filespec.
















30



8. Input file contains 0 bytes

The input file did not contain data.

Retry the operation using a file that contains
data.

9. Input/output file mismatch

The input file was not the same as the one used to
create the output .XUP file.

Retry the operation using the correct input and
output files. Use either the /R[EPLACE] or
/S[HIFT] options on CHECKUP's command-line to
prevent most input/output file mismatches from
occurring.

10. Out of memory
Out of string space

CHECKUP needs more RAM than is available.

Retry the operation after unloading TSRs (memory
resident utilities like "SideKick") or buy an
expansion card to increase the amount of RAM.

11. Path/File access error
Path not found

An input file or path does not exist.

Retry the operation using the correct path and
file name.

12. Permission denied

An attempt was made to write to a write-protected
disk or to a locked file in a multi-user or
networked environment.

Retry the operation.

13. Too many files

CHECKUP was unable to open the input file.

Try adding the following statement to the
CONFIG.SYS file:

FILES = 25











31



14. Loop error

See the explanation of "Endless loop error,"
above.

FATAL ERRORS

The following error messages should never be encountered.
If they are, they indicate an internal problem with CHECKUP.
Contact us if any of these error messages are displayed more than
once:

RETURN without GOSUB
Out of DATA
Illegal function call
Overflow
Subscript out of range
Division by zero
String formula too complex
No RESUME
RESUME without ERROR
CASE ELSE expected
Variable required
FIELD overflow
Internal error
File not found
Bad file mode
File already open
FIELD statement active
File already exists
Bad record length
Input past end of file
Bad record number
Communication-buffer overflow
Advanced feature unavailable
Rename across disks
Registration error
Filename initialization error
Unassigned error
Compression unsuccessful
No-new-taxes error

ADVANTAGES OF USING CHECKUP

CHECKUP provides many advantages over other anti-virus
systems:

* CHECKUP is fast, taking only seconds to check most
files.













32



* CHECKUP is easy to use. There are no commands or
switches to learn (they're optional), no
maintenance modes, no extraordinary hardware
requirements and no unusual installation
procedures or other cumbersome features.

* CHECKUP is easily customized, allowing users to
override all automated features and implement the
options of their choice.

* CHECKUP is 100% compatible with IBM PC-compatible
computers and software.

* CHECKUP is 100% accurate, capable of detecting
changes to any file, regardless of type, size,
attributes or storage location.

* CHECKUP is capable of detecting all viruses--past,
present and future--with absolute accuracy,
without requiring hardware or software upgrades.

* CHECKUP, when used as directed, is 100% secure
from viral infection and alteration.

* CHECKUP never writes to or modifies input files.

* CHECKUP never writes to or modifies sensitive disk
boot sectors, nor does it tamper with File
Allocation Tables or disk directories.

* CHECKUP does not reduce the amount of available
RAM.

* CHECKUP, when used as directed, does not reduce
available disk space.

* CHECKUP provides a relocatable usage log that
tracks file checkups, verifications and changes.

* CHECKUP is available as user-supported software,
allowing shareware users a full and fair
evaluation prior to purchase.

* Unregistered copies of CHECKUP can be legally
shared among users without fear of promoting
software piracy.

* CHECKUP is easy to register, requiring only one
command to enable advanced features and to disable
the time-delayed opening screen.












33



* CHECKUP is reasonably priced for home and non-home
users alike.

* CHECKUP can be easily upgraded by mail or
electronic BBS.

* Support for CHECKUP is free and available by mail,
telephone or electronic BBS.

* CHECKUP is the virus detection system preferred by
educated users.

CONFLICTS WITH OTHER ANTI-VIRUS PROGRAMS

Flu_Shot Plus, an anti-virus TSR program, incorrectly flags
CHECKUP as attempting to write to the input file being checked.
CHK4BOMB, an anti-bomb program, incorrectly identifies CHECKUP as
capable of formatting a hard disk.

CHECKUP's output is restricted to the .XUP files and the
CHECKUP.LOG file. CHECKUP cannot overwrite an input file, format
a disk or perform other destructive actions. If you are
concerned about the integrity of your copy of CHECKUP, however,
visit one of CHECKUP's principal distribution points and download
the latest version. See the section titled "UPGRADE POLICY,"
above, for a list of authorized distribution points.

A COLLECTION OF ANTI-TROJAN AND ANTI-VIRUS TECHNIQUES

By employing the techniques described below, you will
severely limit the ability of computer viruses and other
destructive software to affect your system. We welcome your
enhancements and additions to this list:

* Run CHECKUP daily, using the clean floppy
disk/batch file method described above. (See the
section titled "CREATING A CLEAN CHECKUP FLOPPY
DISK," above, for more information on creating a
clean floppy disk.)

* Run major applications via DOS batch files and
have CHECKUP perform pre-run, last-minute checks
of programs about to run. Use the /L[OCK]

command-line option to prevent execution of the
target file when file modifications are
encountered or use the DOS "GOTO" batch file
command to skip execution of the checked file if
the ERRORLEVEL reported by CHECKUP is not 0.














34



For example, instead of typing the "WORD" command
to run Microsoft Word, create a batch file named
"WRD.BAT" that reads as follows:

CD \WORD

CHECKUP WORD.COM
IF ERRORLEVEL 1 GOTO EXIT

CHECKUP WORD_DCA.EXE
IF ERRORLEVEL 1 GOTO EXIT

CHECKUP MAKEPRD.EXE
IF ERRORLEVEL 1 GOTO EXIT

CHECKUP MERGEPRD.EXE
IF ERRORLEVEL 1 GOTO EXIT

CHECKUP MW.PGM
IF ERRORLEVEL 1 GOTO EXIT

CHECKUP SPELL-AM.EXE
IF ERRORLEVEL 1 GOTO EXIT

WORD

:EXIT

Then, in the future, use the WRD command to invoke
Microsoft Word. CHECKUP will examine all of
Microsoft Word's executable files and will allow
them to run if (and only if) they pass CHECKUP's
scrutiny. Of course, unlike Microsoft Word, many
applications have only one principal executable
file to check, greatly simplifying implementation
of pre-run checking through DOS batch files.

You can also store pre-run .XUP files on a clean
floppy disk or have pre-run batch files rename the
.XUP files for an extra measure of protection.
See the section titled "CREATING A CLEAN CHECKUP
FLOPPY DISK," above, for information on creating
clean floppy disks.

* Use CHECKUP to examine files after they are first
installed and before exporting them to another system.
Do not export files that fail to pass CHECKUP's
inspection.














35



* Regularly check and log available disk space.
Aggressive viruses decrease storage space as they
spread throughout a system. This activity can be
identified through rigorous monitoring.

The following commands, added to AUTOEXEC.BAT,
will track disk usage:

CD \
DIR >> DIR.LOG
TYPE DIR.LOG > PRN

* Observe the time it takes for programs to
load--infected files take longer. Programs
exhibiting longer than normal load times may be
infected (see next tip for related information).

* Scrutinize disk accesses whenever possible.
Viruses can spend large amounts of time scanning
directories and executable files as they search
for new, uninfected host files. Programs
conducting longer than normal disk I/O, especially
during load-time, may be infected.

* Periodically re-install applications from their
master disks. This overwrites application files
in use and any viruses incubating within them.

* Once a week, use the SYS command to re-install the
system files onto your boot disk(s). This
eliminates viruses lurking in the boot sectors.

* Use the DOS "SHELL" command to rename and relocate
COMMAND.COM to a directory other than the root of
your boot disk. Then place a different copy of
COMMAND.COM in the root directory. This may
divert viruses into infecting the decoy copy
instead of your actual command processor. Refer
to your DOS reference manuals for information on
the SHELL command.

* Boot from a certified clean floppy disk copy of
your DOS master disks whenever possible. This
insures your system is running under an
uncorrupted operating system at all times.

















36



* Change executable file attributes to read-only.
Poorly engineered viruses may not be able to alter
read-only files. (Executable files are those
ending in a .BAT, .COM or .EXE extension or those
loaded in CONFIG.SYS. Some application programs
use non-standard extensions on their executable
files [numbered overlays, for instance]. Check
with your software vendors for detailed
information about specific application programs.)

Many programs write to their master executable
file when saving configuration information. If
such a file has been converted to read-only, the
read-only attribute must be removed before
re-configuring and reset afterward.

There are many utilities that can reset file
attributes, including ATTR.COM, available for
downloading from the PC-Magazine Network on
CompuServe. CompuServe users can "GO PCMAGNET" to
download ATTR.COM. If you own the Norton
Utilities, use Norton's FA.EXE to change file
attributes. To change COMMAND.COM to read-only
using Norton's FA, enter:

FA COMMAND.COM /R+

Some versions of DOS provide an ATTRIB (or
similar) command. Check your DOS reference
manuals for more information on modifying file
attributes.

* Use extreme caution when working with directory
and FAT editors, directory sorters, disk
optimizers, disk "snoopers," DOS shells, file
movers, format-recovery systems, partition-related
tools, un-erasers and other low-level DOS
utilities. These programs manipulate critical
data and one bug or errant keystroke can
annihilate a disk.

Safe bets for low-level disk management are the
Norton Utilities, Advanced Edition, from Peter
Norton Computing, Inc.; PC-Tools from Central
Point Software and the Mace Utilities from Paul
Mace Software. Among DOS shells, we recommend the
Norton Commander, also from Peter Norton
Computing, Inc. These programs are available at
most computer retailers.













37



* Install a hard disk utility like BOMBSQAD,
DPROTECT, FLU_SHOT PLUS or WPT (Write Protect
Tab). As TSRs, these programs may suffer from the
drawbacks discussed earlier, however, they provide
adequate protection against poorly engineered
bombs and viruses.

* Do not run files downloaded from public access
BBSes (bulletin board systems) that do not
validate users who upload. If the SysOp of a
bulletin board did not contact you directly (by
phone, mail or automatic callback), you can be
certain that other users have not been validated.
(SysOps: If validating users is a burden, a
practical alternative is to validate them after
they upload their first file.)

* Do not run files downloaded from public access
BBSes where the SysOps do not test and approve all
files.

* Do not run files provided by shareware/public
domain disk distributors, including your local
users group, where the disk librarians do not test
and approve all files.

* Do not run self-extracting archives unless they
have been tested. Self-extracting archives are a
classic delivery method used by bomb developers.

* Beware of suspicious-looking files. A 128 byte
.COM file that un-archives without documentation
and whose description reads "Great Word Processor"
is certainly suspect.

* Use a binary file-viewing utility (like the one
included in the Norton Commander) to examine

executable code. Look for suspicious comments and
messages embedded in the code.

* Do not run programs unaccompanied by well-written
documentation prepared by the program's author.

* Do not run programs that do not include the name,
address and telephone number(s) of the author
within the documentation or executable(s).
















38



* Call program authors and verify the version
number, time and date stamps, file sizes and
archive contents of files you have received. Ask
authors where you can get certified clean copies
of their programs, then discard the copies you
have and get the certified copies.

* Download shareware direct from the author's BBS.
Most professional shareware authors provide
support BBSes for their products. You are
guaranteed uncorrupted programs when you download
them directly from their authors.

* Do not use hacked or pirated software. Software
pirates have the skill and the tools needed to
create bombs and viruses. Many reported incidents
of viral infections have been associated with
software piracy. In fact, some of the deadliest
Trojans have been modified copies of well-known
applications.

* Back-up your system regularly! No system exists
in a vacuum, nor is any anti-virus or anti-Trojan
technique foolproof. Back-up on a daily, weekly
and monthly basis. When disaster strikes, users
who have regularly backed-up their systems will
have the last laugh (and their data)!

DIAGNOSING AN INFECTED COMPUTER

Systems exhibiting any of the following traits should be
checked by an experienced viral diagnostician. If you are unable
to locate a good consultant, call us for advice (don't be shy;
we've helped hundreds of users resolve their virus-related
problems):

1. Computer operations seem sluggish.

2. Programs take longer to load.

3. Programs access multiple disk drives where they
didn't before.

4. Programs conduct disk accesses at unusual times or
with increased frequency.

5. Available disk space decreases rapidly.

6. The number of bad disk sectors steadily increases.













39



7. Memory maps reveal new TSR programs of unknown
origin.

8. Normally well-behaved programs function abnormally
or crash without reason.

9. Programs encounter errors where they didn't
before.

10. Programs generate undocumented messages.

11. Files mysteriously disappear.

12. Files are replaced with objects of unknown origin
or replaced with garbled data.

13. Names, extensions, dates, attributes or data
changes on files or directories that have not been
modified by users.

14. Data files or directories of unknown origin
appear.

15. CHECKUP detects changes to static objects (files).
Changes detected to dynamic objects are not
necessarily an indication of viral alterations.

WHAT TO DO IF YOUR SYSTEM IS INFECTED

Swift action is called for when a viral infection has been
diagnosed and confirmed. The longer eradication is delayed, the
larger the scope of the infection will become; virus removal
without loss of data could become impossible. The following
steps, performed immediately upon detection of a virus, will
usually cure a system from a viral infection:

1. Wash your hands and face. Wear rubber gloves if
possible.

2. Delete all executable files (those ending in a
.COM, .EXE or .SYS extension and any other files
you know to be executable [such as MW.PGM and
overlay files]) from the infected disk.

3. Turn off your computer. Wait sixty seconds.

4. Write-protect all storage media (disks, tapes,
etc.).

5. Remove all non-fixed storage media (floppy disks,
streaming tapes, etc.).











40



6. Disconnect all external port-connected peripherals
(printers, modems, etc.) except for the video
monitor and keyboard.

7. Insert a write-protected, factory master copy of
DOS into drive A. Close the disk drive door, then
turn your computer on.

8. After your computer has completed the start-up
process, enter the following commands:

SYS [d:]
COPY COMMAND.COM [d:]

where [d:] is the letter of the drive being
eradicated.

9. After the system files have been re-installed via
the SYS command, manually re-install all of your
favorite application programs, one by one, from
their write-protected, factory master disks onto
the disk being eradicated.

10. Re-format all external storage media (disks,
tapes, etc.). (CAUTION: During the eradication
process, do NOT insert disks containing
IBMBIO.COM, IBMDOS.COM or COMMAND.COM into the A
drive unless they are the write-protected, factory
master copies of DOS. Destroy all storage media
containing non-factory master copies of DOS.)

11. After your application programs have been
re-installed onto the disk being eradicated,
remove the write-protected, factory master copy of
DOS from drive A. Turn your computer off. Wait
sixty seconds, then turn your computer on.

12. Back-up your system onto NEW, NEVER USED storage
media (floppy disks, streaming tapes, etc.) using
whatever method of back-up you prefer. Do NOT
overwrite or append back-up data to old back-up
disks or tapes.

13. If, after a few hours or days, the virus
reappears, you will have no choice but to
re-format your floppy disks or low-level re-format
your hard disk(s). Contact your computer dealer,
consultant or hardware manufacturer for
instructions on how to low-level re-format or call
us for technical support.












41



A GUIDE TO POPULAR VIRUS-RELATED TERMS

The buzz words relating to the many faces of rogue software
are often misused by both users and the popular computer press.
Worms are confused with viruses, the three types of software
bombs are usually addressed as one all-encompassing
classification, and so on. We hope to clear up some of this
misinformation and confusion by presenting this guide to popular
virus-related terms:

Anti-virus A program designed to prevent or
detect viral infections.

Back Door Undocumented, secret program
features or commands known only
(and perhaps available only) to the
program's designer.

Bomb A program that unconditionally
executes destructive instructions
(actions) without user
authorization.

Bug A hardware or software error that
causes a system or program to
function incorrectly.

Drill Sergeant A bomb, logic bomb or time bomb
program that continuously executes
other programs or operating system
instructions.

Host See the definition of "Target,"
below.

Hostess A yummy cupcake.

Input file See the definition of "Target,"
below.























42



Logic bomb A program that conditionally
executes destructive instructions
(actions) without user
authorization, depending upon the
status of specific environmental
variables. For instance, a logic
bomb could monitor payroll records,
looking for the designer's social
security number. The logic bomb
could be programmed to detonate
(erase the payroll records or
re-format the hard disk) if the
social security number failed to
appear in the records for three
consecutive weeks.

Rabbit See the definition of "Replicator,"
below.

Replicator A bomb, logic bomb or time bomb
program that creates--continuously
and without end, either on-disk or
in-memory--independent, executable
copies of itself.

Rogue Any program specifically designed
with the capability to destroy
hardware or software without user
authorization.

Target Any computer or file that is
subject to at least one category of
rogue software.

Time bomb A program that conditionally
executes destructive instructions
(actions) without user
authorization, depending upon the
status of counter- or time-related
environmental variables. For
example, a time bomb could be
programmed to detonate after three
consecutive runs, to detonate on a
given date (such as April first or
Friday the thirteenth) or to
detonate at a certain time (like
midnight).















43



Trojan Horse A bomb, logic bomb, time bomb,
virus, worm or other rogue
(destructive) program that pretends
to be an ordinary (non-destructive)
program.

Virus A program that modifies other
programs to include an executable
(and possibly altered) copy of
itself.

Virus detector A program designed to detect viral
infections.

Worm (core) A program that consumes memory by
traveling through it, much like a
worm burrows through dirt.

Worm (network) A program that travels through a
network from computer to computer,
sometimes creating executable
copies of itself in the process.

CHECKUP'S RELEASE HISTORY

Version Release Date

1.0 April 1, 1988
2.0 December 18, 1988
3.0 April 12, 1989
3.5 June 14, 1989































44

























Give your files a CHECKUP! (tm)







































45


































This document was created using Microsoft WORD Version 4.0

- End of CHECKUP.DOC -