🚀 go-pugleaf

Hi folks,
I have downloaded from MCAFEE.COM OS2SCAN and OS2CLEAN. I checked
OS2SCAN but not OS2CLEAN, as I don't have any viruses in my system and
hope to keep it so. I ran it on my home-PC, with 2 IDE HDs with HPFS
format. At work I have no OS2, but at home I even don't have a modem.

What I found to be improved:
1) You state in the documentation, that there are several switches, which do
not exist in the OS2 versions. But if you invoke "OS2SCAN /? " you will see
all switches available under DOS. You should update these pages of help.
2) After scanning is finished, the program asks constantly if I want more
help. "OS2SCAN C: D:" does not ask for help, does it?
3) Watching the filenames that pop up for short, I got the impression, that
OS2SCAN does not scan *.DLL, *.DRV, *.ADD files. You can correct this either
with /A or /E switch. But these do belong to the standard executables and it
should not be necessary to think about these. Probably there are more ex-
tensions to be included.
4) Did you think of the built-in undelete-function ? I hope the /D switch
works correct. You need to overwrite first, and then delete the file to en-
sure it does not survive as a deleted shadow.
5) A minor problem, but still annoying for OS2ers: VALIDATE should become a
genuine OS2 program. For shure it does not need a fancy outfit, but why do I
have to start a DOS session, just see the results of VALIDATE ? If I in-
voke VALIDATE from an OS2-window a DOS window is created and closed immediately
after it finished. I know, I could change the settings, but why do I have to
do this for a single check ?
6) Another nice thing I miss is a background-scanner, that checks all in-
coming files, be they from floppy or modem or whatever. Probably you can't
check what the floppy is reading, but you can do a check on all newly
appeared files on HD. I admit, that I still have no idea, how to check files
executed from floppy. But at least all or specified drives could be scanned
every n miutes or on request.
7) Maybe a kind of *.INI file could help to maintain the settings like drives
and directories to scan and a userdefineable list of extensions and other
often used options instead of writing them directly into OS2SCAN. I know of
the parameterfiles you can create, but wouldn't look an interactively created
setup (like the one you have in WSCAN) much nicer ?

8) SCAN for DOS rel.9.0 V99 (most recent on Dec. 12th, 1992) does not do any-
thing within a OS2 DOS-box. Neither windowed nor fullscreen. Although I read
the readme.1st and *.DOC, where I found a suggestion to use the /MAINT switch
and/or the /AD option, it either told me it can not access my HPFS-drives
(no options or /AD) or that D: is incompatible with /MAINT (/AD /MAINT) or no
errors were reported for scanning drive C: (scan c: /maint), but nothing was
scanned (no disk-access) and the program returned almost immediately.
9) In Virlist I found a passage for the fam*-viruses where no information
is provided about their behaviour. Is this correct ? And if so, why ?
I thought, that Mutation Engine is a .OBJ-file to be linked with viral coding.
So DAME itself would not be a virus to be listed this way in VIRLIST.TXT.
It would be better to introduce a new column for viruses using MtE.

10) I did some testing on F-Prot 2.06a too. The /NOBOOT switch is the thing to
make it run on HPFS drives. What I miss in COMMANDS.DOC is the /EXT= switch
to force scanning of other extensions. Especially within WINDOWS and OS2 we
find extensions like *.DLL, *.DRV and the like. The should be scanned by
standard too, as they contain executable code like any *.OV?. Also an example
in the *.doc file for /EXE=switch would be nice. I did not manage to make it
recognise multiple extentions. Does it work and if, what is the delimiter ?
11) A thing I could not recreate, but looking kind of funny: I did a heuristic
scan on all drives and all files. No viruses found so far, but a suspicious
file: my C-compiler (QC 2.5). It didn't say it looks like a virus or so, but
there are opcodes which will make the program crash. "CRASH" was the word it
used. Maybe due to the fact, that F-Prot checked for the CPU and found itself
running within a virtual 8086. Frisk?

12) As Vesselin is getting sick of reiterating his answers on faqs: how about
posting the last recent faq-list ? I think it is almost a full year, since the
members of this list received one. Nobody seems to download and read it by
him/herself. I suggest that faqs should be answered in a way like:
email to "listserv@lehigh.edu" with the letterbody  "get faq-list" (not exactly
to be copied, but you know what I mean)
13) A more special question. I hope I didn't miss it in the faq-list: What is
exactly a companion virus? I mean, under which circumstances does it infect
and in which environments. Somehow I have the impression, they are especially
dangerous within networks. Vesselin? Padgett? Anybody?
14) Sometimes even mailers seem have their DEJA VU ... :)

Alfred JILKA

#############################################################################
Alfred Jilka             #
Geologic Survey, Austria #         OS2 is the worst OS I know,
KARGRA@GBA930.ZAMG.AC.AT #     but I don't know any  better one ...
#############################################################################