What's New In VIRx Version 1.7 ============================== Date: 8/04/91 1. VIRx 1.7 now detects 41 newly discovered viruses, bringing the total count to 543. 2. The scanning inside PKLite and LZExe precompressed executables has been sped up by 20-25%, through determined use of a profiler. Additionally, the infection site is now correctly reported. Problems Corrected from v1.6: 1. All the viruses that could sometimes escape detection, such as the "research" Virus-101, are now caught. ------------------------------------------------------------------------- VIRx 1.6 Revisions ============================== Date: 7/01/91 1. VIRx Version 1.6 now detects six newly discovered viruses, bringing the total count to just over 500. 2. VIRx now indicates whether an infected compressed program was infected before or after the compression (PKLITE and LZEXE). This was trivial to implement, but a useful addition. 3. Another few cycles were shaved off our decompression routines: experience pays. For those wondering, all decompression routines are completely internal and done in memory --- and always have been. Problems Corrected from v1.5: 1. False positives for the "Sathanyc/Goblin/Necrop" viruses. VIRx Version 1.5 was incorrectly identifying "ICE'ed" programs as infected. An example of this was the well known TIMESET program: our apologies and gratitude to Peter Petrakis for being a good sport about our mistake. 2. Occasional false positives for "Scrnched" files: fixed. 3. The P1 Virus string was occasionally left in DOS buffers: another scanner program which apparently used the same string would make erroneous reports of an active P1 Virus in memory. This has been fixed. 4. Due to similar templating of the V2P6 Virus, VIRx would find a possible infection in the VDEFEND program. This was rectified. ------------------------------------------------------------------------- VIRx 1.5 Revisions ============================== Date: 6/26/91 1. VIRx 1.5 detects over 80 additional newly discovered viruses, bringing the total to almost 500. This was accomplished without slowing down the scanner. 2. Wildcard string scanning is included for detecting viruses otherwise resistant to general scanner detection. 3. VIRx scans PKLite pre-compressed files internally about 10% faster than previous versions; probably not noticeable except on slower machines. Problems Corrected from v1.4: 1. Another rare problem with scanning certain Novell Network server volumes has been corrected. 2. The technique used to clean our scanning search strings out of memory has been changed. This change will prevent certain other anti-virus scanners from erroneously reporting an assortment of viruses active in the computer's memory immediately after a VIRx scan has completed. 3. Certain rare situations would result in VIRx scanning extremely slowly. This has been fixed. -------------------------------------------------------------------------- VIRx 1.4 Revisions ============================== Date: 5/11/91 1. VIRx now scans memory above 640K through 1 Meg if the -X command line option is selected. This feature is added for detection of viruses like E.D.V. that search high memory for writable RAM, and for protection against possible infected device drivers that have been loaded high. Note: Many programs use that area of memory for special disk caching and this has been noted to have caused some problems with incorrect results for some machines. 2. If a batch mode is selected, the resulting screens will now time out if you do not hit a key and the scan will continue. This makes the batch mode fully useable for unattended operation. 3. When this software becomes outdated, it will warn the user that scanning with outdated software can result in new viruses being missed. Then the user can elect to continue the scan anyway. Previous versions of VIRx would cease to function on the cut-off date; this is no longer the case, although you are advised to update your software before that date arrives. We consider VIRx 1.4 to be outdated by October, 1991, although we recommend obtaining each monthly update of VIRx in any case. 4. VIRx 1.4 detects over 50 newly discovered viruses, bringing the total to over 400. This was accomplished without slowing down the scanner. 5. VIRx 1.4 can now take multiple targets on the command line, allowing an entire set of file systems to be scanned: VIRx C:\ D: E:\thisdir F:\thatdir\thisfile scans the entire C: disk, the current directory on the D: drive and its children, the specified directory on the E: drive and its children and the specified file on the F: drive. Any options you select on the command line are valid for each target you specify. 6. Both decompression routines, LZEXE and PKLITE, were optimized for speed of decompression and memory model independence. String selection of compressed file hits take about 50% as long as did VIRx 1.2. Problems Corrected from v1.2 : 1. Problem with scanning certain Novell Network server volumes has been corrected. 2. Execute-only files on Novell Networks are handled properly now on screen as well as in the log. 3. There was a bug when write-protected files were scanned and discovered to contain a virus. Fixed. 4. False positive on Marc Perkel's MARXMENU menu compiler Marxcomp.exe, version 2.27, for the KAMAKAZI virus has been corrected. Our apologies to Marc. 3. PKLite from PKWare uses a special compression method on unusually highly compressible files that version 1.2 of VIRx did not decompress properly every time. This has been corrected, and VIRx 1.4 fully supports all compression methods used by PKLite as of version 1.05, still including the -e switch available in PKLite Professional.