SANSASKA SYSTEMS
3311 Concord Blvd.
Concord, CA 94519
(415) 676-2268
Compuserve 71140,3727
Copyright 1985, Sansaska Systems.
9/23/89

The following files are included:

global.com - executes a command for the current directory and all
it's subdirectories
inoculat.c - source code for MSC 5.1
inoculat.exe - DOS executeable
inoculat.os2 - OS/2 executeable, rename to inoculat.exe for use
minimal.doc - you're looking at it
shots.bat - does all .exe & .com files in a directory
shots2.bat - called by shots
vacinate.exe - improved version of inoculat.exe

This file, novirus.zip, and its included programs are all placed in the
public domain and may be freely copied and distributed WITHOUT charge.
They may not be changed in any way nor incorporated into any other
package.


OPERATION

The operative programs are inoculat.exe and vacinate.exe

inoculat
vacinate <.ext>

Inoculat saves the full pathname, file length and CKS (rotating checksum)
of each file passed to it into \filelog.cks. If the full pathname is
already in \filelog.cks the new calculated values are compared with the
values in \filelog.cks and you are informed of the result. If you get a
change message on a file and you know why the change occured you can use
any ASCII text editor (such as edlin) to delete the line containing the
full pathname in \filelog.cks. Then reinoculate your file. If you don't
know where the change came from maybe your file has a file VIRUS. (See
below)

To protect more than one file at a time use the batch file "shots.bat". It
calls shots2.bat for each .exe and .com file in the current directory.
Shots2.bat is needed to allow a pause on an error return from inoculat.
All the files, shots.bat, shots2.bat and inoculat.exe, must be on your
path for all this to work.

If you go to the root directory and enter "global shots" then all the .exe
and .com files on the disk will be "inoculated". Global.com needs to be on
the path too.

The second program, vacinate.exe, is a more sophisticated version of the
same thing. It processes all files with the extension entered on the
command line, in the current directory and its' subdirectories. In other
words it does not need global, shots or shots2. Both programs log into
\filelog.cks and generate the same output, vacinate is a little faster and
less of a kludge.

Inoculat is provided in source format for those of you who are
particularly paranoid. You can verify that the program won't corrupt your
files and then compile it yourself. The program compiles without error
under Microsoft C 5.1 for both DOS and OS/2 on at least three different
computers.

If you're really paranoid compile your own version of inoculat.exe then
starting in the root directory, run shots to build filelog.cks. Now run
vacinate to confirm that it matches inoculat. Now you can be sure that
vacinate doesn't corrupt your files.

For absolute certantity do the following:
1. Make a full backup of your disk.
2. Run inoculat.
3. Rename filelog.cks to xx.xx
4. Run vacinate
5. Compare xx.xx (from inoculat) with filelog.cks (from vacinate)
6. Delete filelog.cks
7. Run inoculat again
8. compare filelog.cks (new from inoculat) with xx.xx (original from
inoculat) to be sure nothing has changed
9. Delete xx.xx and use filelog.cks

For most effective use run either program immediately to build a data
base. Then run it again on a regular basis, especially before a major
backup. Also run it after you have run any other programs you suspect of
possibly carrying a virus. If you find a change investigate it before
going on.

Vacinate will be enhanced over the next few months to provide greater
functionality. These updates will NOT be placed in the public domain. If
you are interested in receiving them please register your copy by sending
$10.00 to the above address. Updates and revisions will be similarly
for original registrants only.

Both programs use the same "rotating checksum" algorithm instead of a CRC
to check the files. This is done for speed and is based on the perception
that any virus big enough to cause harm probably can't be written in such
a way that it could escape the check. If you feel this is not the case
please let me know as soon as possible.

WHAT TO DO IF YOU SUSPECT A VIRUS

If the program shows a file has been altered you should check the file
against an UNALTERED copy. You should have such a copy in your backup set
(you do keep regular backups don't you?) or in the package the program
originally came in. If the two versions don't compare and you are sure the
suspect file isn't modified as part of a configuration set up or normal
use then discard the altered version and use the unaltered copy.

If this has happened try to identify the virus carrier by running, one at
a time, all the programs you have run since the previous ant-virus check.
After running each program recheck your files for changes. Good luck.

Remember your best defense is GOOD BACKUPS.

Enjoy.


DISCLAIMER

Sansaska Systems believes that the software furnished herewith is accurate
and reliable, and much care has been taken in its preparation. However,
no responsibility, financial or otherwise, can be accepted for any
consequences arising out of the use of this material, including loss of
profit, indirect, special, or consequential damages. In no event shall
Sansaska Systems be liable for more than the purchase price of the
software.