[comp.virus] F-DRIVER.SYS

nelson@bolyard.wpd.sgi.com (Nelson Bolyard) (04/05/91)

With F-DRIVER.SYS installed, there is a 24 second delay when I run a
TSR called PSFX.  NO error message is displayed, and no warning sounds
are emitted from the speaker during this inexplicable 24 second delay.
At the end of this delay, the PSFX program displays its
successful-installation banner, and terminates.  The TSR seems to work
correctly, once the 24 second delay is past.

With F-DRIVER.SYS removed from CONFIG.SYS, PSFX takes much less than
one second to run and install.

To solve this problem, I've removed F-DRIVER.SYS from my
configuration.  I surely wish I could run F-DRIVER.SYS *and* PSFX, but
a 24 second delay in AUTOEXEC.BAT is simply unacceptable.  Can enyone
help me solve this?

For some time now, I've had the F-DRIVER.SYS driver from the FPROT114
package installed on my 386 PC system at home, along with QEMM 5.11
and HyperDisk, without any apparent problems.  Recently, I purchased
PSFX, an EPSON FX-85 printer emulator that converts FX-85 output sent
to LPT1 into PostScript, which it then sends to a PostScript printer
on the real LPT1.  This PSFX TSR should install in a flash, and does,
*except* when F-DRIVER.SYS is installed.

In truth, I don't know exactly what protection F-DRIVER.SYS supposedly
gives me, what types of problems it supposedly prevents, nor what I
should expect to experience (i.e. what F-DRIVER will do) if and when I
actually encounter a virus.  I hope the answer is *not* a 24 second
delay 8-(.

I have read a posting that suggested that F-DRIVER gets involved in
the execution of programs by DOS, and then every time a new program is
executed, F-DRIVER checks the program for viruses first, and doesn't
allow the program to be executed if it finds a virus.  Is this true?
Is this 24 second delay its clever 8-( way of telling me that it
thinks PSFX is infected?

I have also read that it's only function is to check for and detect
boot-sector viruses, immediately after boot-up, and that if/when it
detects boot sector viruses, it hangs the system hard, to prevent the
boot sector virus from doing any more damage, without displaying any
kind of explanation message.  Is this true?

I would appreciate it very much if someone would post a message to
this newsgroup (comp.virus) that says exactly what F-DRIVER does, what
kind of viruses it looks for, when it looks for them, and what it does
when it finds them.  A suggested set of remedial steps to be taken
when F-DRIVER reports a virus (or whatever it does) would also be
appreciated.

Thanks in advance.

- -----------------------------------------------------------------------------
Nelson Bolyard      nelson@sgi.COM      {decwrl,sun}!sgi!whizzer!nelson
Disclaimer: Views expressed herein do not represent the views of my employer.
- -----------------------------------------------------------------------------

frisk@rhi.hi.is (Fridrik Skulason) (04/08/91)

nelson@bolyard.wpd.sgi.com (Nelson Bolyard) writes:
>With F-DRIVER.SYS installed, there is a 24 second delay when I run a
>TSR called PSFX.  NO error message is displayed, and no warning sounds
>are emitted from the speaker during this inexplicable 24 second delay.

This is odd - F-DRIVER normally only adds a fraction of a second to
the loading time of each program.  I would very much appreciate a copy
of the PSFX program, so I can determine what the problem is.

>In truth, I don't know exactly what protection F-DRIVER.SYS supposedly
>gives me, what types of problems it supposedly prevents, nor what I
>should expect to experience (i.e. what F-DRIVER will do) if and when I
>actually encounter a virus.

The main purpose of F-DRIVER is to prevent the execution of any
program virus on the computer.  If you attempt to run an infected
file, it will not be executed, and a message will appear.  Example:

		This program is infected by the Magnitogorsk virus
		Access denied

If this happens, just disinfect the affected file, or replace it with
a non-infected copy.

I try to keep F-DRIVER.SYS fully up do date, and it is able to stop
around 400 virus variants.  However, unlike F-FCHK, it will not
produce an accurate variant identifiation.

F-DRIVER will also attempt to analyze the system on boot-up, in order
to determine if the machine is infected with a boot virus.  If this is
the case, it will display a warning message and hang the computer,
forcing the user to reboot from a (hopefully non-infected) system
floppy.

I am adding an option in version 1.15 to disable the second feature,
as it occasionally caused problems on computers with network Boot
ROMs.

- -frisk