Anti-virus software helps protect your computer against known viruses, worms, Trojan horses, and other unwanted invaders that can make your computer "ill". Computer viruses are much the same as biological viruses, they attach themselves to programs or hosts and replicate themselves repeatedly, however the hosts take the form of USB drives, email attachments or files rather than living organisms. However, in this case, it’s worse than the flu. Viruses, worms, Trojans and the like often perform malicious acts, such as deleting files, accessing personal data, or using your computer to attack other computers, spread to other computers or simply replicate and interfere with your system, making it unstable or more vulnerable to attacks. A program that is able to detect viruses is called a virus scanner.

FindMirc is both a very fast signature scanner and a so-called heuristics scanner. It can detect virus mutations; it will search for Trojans, fun and joke programs, scripts viruses (VBS, HTML etc.), IRC worms, malware and dropper programs. FindMirc is able to disassemble and decrypt files using a software emulator. This generic detection, called heuristic analysis, is a technique that makes it possible to detect unknown viruses by searching for suspicious command sequences instead of relying on any signature. FindMirc is therefore able to detect suspicious instructions, abnormal sequences and the detection of still unknown viruses!

Version 2.00 is ported from DOS (16 bit) to Windows (32 bit) allowing FindMirc to use long file names on all Win32 platforms. Furthermore the code is now portable and is able to run under Linux (32/64 bit) and other operating systems! As a trade off of using the new 32 bit compiler, the generated code is slower on Windows than the DOS 16 bit code! The Linux versions are super fast!

Version 3.00 is compiled for Pentium MMX CPUs and better and WILL NOT run on a 486 or Pentium CPU without MMX support!

Version 4.00 has the option -log and -logall as well as we added basic detection for Win32 Trojans, Backdoor and other malware (currently around 2000 signatures).

Version 4.50: Added the Trojan scan engine from VSP and RHBVS (~4000 viruses).

See below "History for more details"

FindMirc is Freeware by ROSE SWE. All Rights Reserved!

FindMirc is available for different operating system. When you start FindMirc a banner with the program version, build number and target platform is printed.

E.g.:

The following platforms are currently supported

The build number is a unique increasing number that is incremented with each build of FindMirc. A higher build number means a newer program version.

1.) The command line engine can not handle spaces, e.g. -log="C:\Documents and Settings..." will currently NOT work!

2.) DOS Entry Point versus Windows EP may report "Corrupted MS-DOS Header! Size=10.992, EP=157.686"

3.) List option (-list=filename) was reported to be buggy under Linux

Customers familiar with the American or UNIX parameter syntax (minus sign) instead of the slash ( / ) can also use the minus sign ( - ) to start an option. Under Linux the use of the minus sign for command line arguments is mandatory!

Example: -all is equivalent to /ALL

Instead of always calling F_Mirc with arguments, F_Mirc can be controlled with a so-called environment variable. For example, enter the following at the DOS prompt:

If you start F_Mirc now, F_Mirc reads all required arguments from the variable. This assumes that the FindMirc binary is named f_mirc.exe

Sometimes it might be desired to reset already set options (i.e. set by SET F_Mirc=…) This can simply be done by a minus sign following the option on the command line. With this action the option is being switched off.

For example, you have entered the following:

Then start F_Mirc with the following argument:

In this case the command line option overrides the option set by the environment variable! Command line always override environment options.

For testing F_Mirc against other virus scanners we suggest the following options:

Boot viruses are the oldest known computer viruses. These viruses were the most common form of viruses until 1995, but are now extinct. Nowadays there are almost no boot sector viruses any more, because BIOS and operating systems usually have a well-functioning software or hardware protection.

A boot virus is a computer virus that becomes active when the computer starts (boots) before the operating system (DOS, Linux or Windows) is fully loaded. Boot sector viruses exploit the fact that the boot sector is always loaded first. On floppy disks, the virus is at least partially in the boot sector, so that even floppy disks that do not contain any files can be infected. On hard disks, the virus infects the master boot record (MBR) or in the logical boot sector.

A boot sector virus infects the boot sector of floppy disks and the master boot record (MBR) of a hard disk. The boot sector is the first physical part of a floppy disk and one sector (512 bytes). The boot sector is used by boot floppies to boot from the floppy disk. If a user wants to boot from an infected boot floppy or forgets an infected floppy disk in the floppy drive when the computer starts, the BIOS accesses this sector and executes it with the appropriate BIOS boot setting. The virus then attempts to infect the MBR of the hard disk each time the computer starts. When an infected computer starts, the MBR, which is normally responsible for recognizing the different partitions on the hard disk, is loaded. The now loaded virus remains in memory and monitors access to floppies. When a diskette is inserted into a computer infected with a boot sector virus, the virus infects the boot sector of the diskette.

Known boot viruses are the form virus, Parity Boot and Boot-437.

A multipartite virus is a computer virus that infects and spreads in multiple ways. The term was introduced to describe the first viruses that included DOS executable files and PC BIOS boot sector virus code, where both parts are viral themselves. Prior to the discovery of the first of these, viruses were categorized as either file infectors or boot infectors. Because of the multiple vectors for the spread of infection, these viruses could spread faster than a boot or file infector alone.

In addition to hiding the boot information, DOS file stealth viruses attack .com and .exe files when opened or copied, and hide the file size changes from the DIR command. The major problem arises when you try to use the CHKDSK/F command and there appears to be a difference in the reported files size and the apparent size. CHKDSK assumes this is the result of some cross-linked files and attempts to repair the damage. The result is the destruction of the files involved.

With a full stealth virus, all normal calls to file locations are cached, while the virus subtracts its own length so that the system appears clean.

You need a clean system so that no virus is present to distort the results of system status checks. Thus you should start the system from a trusted, clean, bootable diskette before you attempt any virus checking.

A polymorphic virus is one that produces varied but operational copies of itself. This strategy assumes that virus scanners will not be able to detect all instances of the virus. One method of evading scan-string driven virus detectors is self-encryption with a variable key. Polymorphic code was the first technique that posed a serious threat to virus scanners.

More sophisticated polymorphic viruses (e.g., V2P6) vary the sequences of instructions in their variants by interspersing the decryption instructions with "noise" instructions (e.g., a No OPeration instruction (NOP), or an instruction to load a currently unused register with an arbitrary value), by interchanging mutually independent instructions, or even by using various instruction sequences with identical net effects (e.g., Subtract A from A, and Move 0 to A). A simple-minded, scan-string based virus scanner would not be able to reliably identify all variants of this sort of virus; in this case, a sophisticated scanning engine has to be constructed after thorough research into the particular virus.

One of the most sophisticated forms of polymorphism used so far is the Mutation Engine (MtE) or the Trident Polymorph Engine (TPE), which comes in the form of an object module. With such mutation engines, any virus can be made polymorphic by adding certain calls to its assembler source code and linking to the mutation-engine and random-number generator modules.

The advent of polymorphic viruses has rendered virus scanning an increasingly difficult and expensive endeavor; adding more and more search strings to simple scanners will not adequately deal with these viruses.

The Cascade virus (also known as Herbstlaub in Germany) is a prominent DOS computer virus that is a memory resident virus written in assembly language. Cascade was widespread in the 1980s and early 1990s. It infected DOS .COM files and had the effect of making text on the screen cascade down and form a heap at the bottom of the screen. It was notable for using an encryption algorithm to avoid being detected. However, one could see that infected files had their size increased by 1701 or 1704 bytes. In response, IBM developed its own antivirus software.

The virus has a number of variants. Cascade-17Y4, which is reported to have originated in Yugoslavia, is almost identical to the most common 1704 byte variant. One byte has been changed, probably due to a random "mutation". This, however, has resulted in a "bug" in the virus. Another mutated variant is also known - it infects the same file over and over.

Jerusalem is a DOS virus first detected in Jerusalem, in October 1987. On infection, the Jerusalem virus becomes memory resident (using 2kb of memory), and then infects every executable file run, except for COMMAND.COM. COM files grow by 1,813 bytes when infected by Jerusalem and are not re-infected. .EXE files grow by 1,808 to 1,823 bytes each time they are infected. The virus re-infects .EXE files each time the files are loaded until they are too large to load into memory. Some .EXE files are infected but do not grow because several overlays follow the genuine .EXE file in the same file. Sometimes .EXE files are incorrectly infected, causing the program to fail to run as soon as it is executed.

The virus code itself hooks into interrupt processing and other low level DOS services. For example, code in the virus suppresses the printing of console messages if, for example, the virus is not able to infect a file on a read-only device such as a floppy disk. One of the clues that a computer is infected is the mis-capitalization of the well-known message "Bad command or file name" as "Bad Command or file name".

The program contains one destructive payload that is set to go off on Friday the 13th, all years but not in 1987. On that date, the virus deletes every program file that was executed. Jerusalem is also known as BlackBox because of a black box it displays during the payload sequence. If the system is in text mode, Jerusalem creates a small black rectangle from row 5, column 5 to row 16, column 16. The rectangle is scrolled up by two lines.

As a result of the virus hooking into the low-level timer interrupt, PC-XT systems slow down to one fifth of their normal speeds 30 minutes after the virus has installed itself. The slowdown is less noticeable on faster machines. The virus contains code that enters a processing loop each time the processor’s timer tick is activated.

Symptoms also include spontaneous disconnection of workstations from networks and creation of large printer spooling files. Disconnections occur since Jerusalem uses the interrupt 21h low-level DOS functions that Novell Netware and other networking implementations required to hook into the file system.

Jerusalem was initially very common (for a virus of the day) and spawned a large number of variants. However, since the advent of Windows, these DOS interrupts are no longer used, so Jerusalem and its variants have become obsolete.

/* End of Document */