MemScan examines your working memory for resident MS-DOS computer viruses. If you have further questions about computer viruses, please read the files VIRSCAN.DOC & VIRSCAN.TXT (if available).

MemScan can also check the "UPPER" DOS Memory (UMB = memory between 640 KB and 1 MB) and the HMA (High Memory Area = 1088 KB) gate. MemScan needs approx. 450 KB of free working DOS memory for the virus database and hash tables! MemScan main memory usage was adapted especially to network environments and therefore needs only 450 KB of free memory!

MemScan detects due to heuristic scanning unknown viruses (option /UNB). MemScan usually reports such viruses with one of the following messages:

In case of detection of one of these two viruses please send me an infected file: To classify the virus (if VirScan reports the same virus type with the option /HEUR) and to include it in MemScan! Try to make the virus infect the "victim/bait/goat files" INFECTME.* included in this package!

We are using MemScan internally to quickly and securely add new viruses to VirScan. However, customers frequently asked us for a program that checks ONLY the working memory. For this reason MemScan was made accessible to the public for FREE.

MemScan detects approx. 98% of ALL new resident DOS or boot viruses with the option /UNB; however, this option is only for absolute virus gurus. Hint: If you suspect a virus on your system, execute VirScan Plus with the following parameters:

This screen shot is normally a false positive, because the "virus" is only found with

A normal virus infection looks like this, and MemScan won’t go to the main screen at all (in this case a 572 byte long new COM infector):

MemScan return an error-code back to DOS that can be evaluated by the variable ERRORLEVEL. The following error-codes are used:

A: I think this is a so called "false positive". Please read the attached document (MemScan_Eng.txt). If you have a DOS or boot virus, you should be able to trace it (as described in MemScan_Eng.txt) with QMS/MemScan and VirScan Plus. What DOS Version and Windows Version do you use. Some special DOS drivers in usage?

A: That’s normal for the first (initial run) - I have added were possible an English translation in the new version!

The program contains an integrated check-sum tester to alert the user on a possible virus infection. The check-sum for the program can be found in the file with the extension ".XXX".

This check-sum contained in the file as well as the main program must not be changed nor modified in any case! Otherwise, the main program regards itself being possibly infected by a virus (a virus still unknown to the program)!

Following features of the EXE file are monitored and checked for modifications every time the program is executed:

I strongly recommend not making any changes to the EXE & XXX-file since the program will not run any more!

The file with the extension ".XXX" also contains the creation date and the standard MD5 checksum that can be checked with other tools like md5dir or hashall from ROSE SWE. Verifying the CRC32 checksum takes less than 1 second (depending on computer type and hard disk drive). If the check-sum is OK, the program is being executed. Otherwise a detailed error report with indications of possible error reasons will be displayed.

This is a screen shot of MemScan self check envelope finding itself infected with an 647 bytes EXE infector!

If you want to obtain the full versions of my antivirus software, please start the program REGISTER.COM, and an order form will be printed.

By the way: MemScan is compressed from 380 KB to currently 87 KB EXE + 183 KB overlay!

This program may be freely copied and passed on. It is considered as so- called Bannerware. I only request the following declarations to be kept:

Trademarks of other companies mentioned in this documentation and package appear for identification purposes only and are property of their respective companies.

NOTICE TO USER: You should read the following terms and conditions carefully before using this software. Your use of this software indicates your full acceptance of this license agreement and warranty. BY INSTALLING THIS SOFTWARE YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT.

The SOFTWARE is owned and copyrighted by ROSE SWE. Your license confers no title or ownership in the SOFTWARE and should not be construed as a sale of any right in the SOFTWARE.

No Warranty. The Software is being delivered to you AS IS and ROSE SWE makes no warranty as to its use or performance. ROSE SWE AND ITS SUPPLIERS DO NOT AND CANNOT WARRANT THE PERFORMANCE OR RESULTS YOU MAY OBTAIN BY USING THE SOFTWARE OR DOCUMENTATION. ROSE SWE AND ITS SUPPLIERS MAKE NO WARRANTIES, EXPRESS OR IMPLIED, AS TO NON INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY, OR FITNESS FOR ANY PARTICULAR PURPOSE. IN NO EVENT WILL ROSE SWE OR ITS SUPPLIERS BE LIABLE TO YOU FOR ANY CONSEQUENTIAL, INCIDENTAL OR SPECIAL DAMAGES, INCLUDING ANY LOST PROFITS OR LOST SAVINGS, EVEN IF AN ROSE SWE REPRESENTATIVE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY THIRD PARTY.

In short: This software is provided as-is, without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. If you do NOT agree simply do NOT install and use this software!

Malware, or malicious software, is a generic term for a variety of malicious or intrusive software, including computer viruses, worms, Trojans, ramsomware (ransoms), spyware, adware, scareware and other malicious programs. It can take the form of executable code, scripts, active content and other software. Malware is defined by its malicious intent, which violates the requirements of the computer user - and therefore does not include software that causes unintentional damage due to a defect.

Programs officially delivered by companies can be considered malware if they secretly violate the interests of the computer user.

A computer virus is a type of malicious software program ("malware") that, when executed, replicates itself by modifying other computer programs and appending or inserting its own code. When this replication succeeds, the affected programs are then said to be "infected" with a computer virus.

The term "virus" is also commonly, but erroneously, used to refer to other types of malware. "Malware" encompasses computer viruses along with many other forms of malicious software, such as computer "worms", ransomware, spyware, adware, Trojan horses, keyloggers, rootkits, bootkits, malicious Browser Helper Object (BHOs) and other malicious software. The majority of active malware threats are actually Trojan horse programs or computer worms rather than classic computer viruses.

Roughly you can distinguished between - Memory resident (fast) infecting viruses and - Direct action viruses

A Trojan horse is a program that does something undocumented which the programmer intended, but that users would not accept if they knew about it. By some definitions, a virus is a particular case of a Trojan horse, namely, one which is able to spread to other programs (i.e., it turns them into Trojans too). According to others, a virus that does not do any deliberate damage (other than merely replicating) is not a Trojan. Finally, despite the definitions, many people use the term "Trojan" to refer only to a non-replicating malicious program.

Ransomware is a particularly invasive form of malware that takes a victim’s data or device and holds it hostage (or displays bogus claims of illegal activity, porn usage or suggests that a system is already infected with viruses) until a sum of money is handed over in order to secure its release. Ransomware has existed since around 1989, in the form of the “DOS-AIDS” Trojan (aka PC Cyborg) which encrypted files on a hard drive and then demanded a payment of $189 to unlock them again. Ramsomware had become in the last few years a significant and global threat.

Starting in 2018 Malware authors are increasingly relying on malicious mining software. This year for the first time there have been more infections of this type than with ransomware. More and more online criminals seem to turn their backs on Ramsonware and rely on crypto-miner. They secretly dig crypto money on infected computers - Monero is particularly popular. This is obviously extremely lucrative, as the latest figures show.

Reasons for the turnaround? If a ransomware/Trojan strikes and encrypts data from victims, they usually have to pay a ransom in the form of bitcoins. This is an obstacle that not every victim can or will take. Crypto-miner, on the other hand, only needs to infect computers. Afterwards, they dig in secret without any sacrifices and make silently sure that they bring the authors big profits - and not too short when you look at the exploding prices of different crypto currencies.

Any means of cheating or misleading a person and gaining their trust or receiving information to which the cheater is not entitled.

Spyware is a type of computer virus that hides on your computer or mobile device, records your private data and sends that information back to whoever created it or monitors it. The tricky thing about spyware, and what separates it from the growing threat of ransomware is the fact that, spyware is designed to both install discretely and operate silently in the background.

A point of access to a hidden program/system. Backdoors are usually intentionally created by a programmer for debugging or maintenance purposes, but if compromised, they can pose a security risk to unauthorized users or software, allowing access and causing damage. Malware often installs Backdoors on compromised systems!

A bot is a programs that run automated tasks over the Internet. Botnets are collection of bots that run autonomously and automatically. Typically they perform repetitive tasks at a much higher rate than a human is capable of. They can be used for malicious purposes, such as denial of service attacks or infecting other computers. An infected computer is called a bot or zombie.

A macro is a piece of code that can be embedded in a data file. A macro virus is thus a virus that exists as a macro attached to a data file. In most respects, macro viruses are like all other viruses. The main difference is that they are attached to data files (i.e., documents) rather than executable programs. Document-based viruses are, and will likely continue to be, more prevalent than any other type of virus.

Worms are very similar to viruses in that they are computer programs that replicate functional copies of themselves (usually to other computer systems via network connections) and often, but not always, contain some functionality that will interfere with the normal use of a computer or a program. Unlike viruses, however, worms exist as separate entities; they do not attach themselves to other files or programs. Because of their similarity to viruses, worms also are often referred to as viruses.

What is a stealth virus? A stealth virus is one that, while active, hides the modifications it has made to files or boot records. It usually achieves this by monitoring the system functions used to read files or sectors from storage media and forging the results of calls to such functions. This means that programs that try to read infected files or sectors see the original, uninfected form instead of the actual, infected form. Thus the virus’s modifications may go undetected by antivirus programs. However, in order to do this, the virus must be resident in memory when the antivirus program is executed, and the antivirus program may be able to detect its presence.

The very first DOS virus, Brain, a boot-sector infector for example monitored physical disk input/output and redirected any attempt to read a Brain-infected boot sector to the disk area where the original boot sector was stored.

One method of evading malware detection is to use simple encryption to encipher (encode) the body of the malware, leaving only the encryption module and a static cryptographic key in cleartext which does not change from one infection to the next.

Armored viruses use special tricks to make the tracing, disassembling, and understanding of their code more difficult. A good example is the Whale virus.

Phishing is when a 3rd party tricks an user into giving information in an email or by a phone call (vishing).

https://en.wikipedia.org/wiki/Timeline_of_computer_viruses_and_worms