40Hex Number 6 Volume 2 Issue 2                                       File 001

-------------------------------------------------------------------------------
                    Memory Resident Anti-Virus Detection
                              and Removal
-------------------------------------------------------------------------------

Here is a list of ways to see if anti-viral utils are present in memory.
I got the list out of PC interupts, a book by Ralph Brown.  Here they are:

F.-DRIVER.SYS (Part of the F-Protect virus package by Fridrik Skulason.)
              This program "grabs" the INT 21 monitoring code, if it was not
              already taken by another program.
              INT 21h, Function 4Bh, Sub Function EEh
              AX must = 4BEEh at call, and call returns AX=1234h if F-Prot
              sucessfully grabbed INT 21, and AX=2345h if the grab failed.

F-DLOCK.SYS  (A HD access restrictor, part of F-Protect Package)
              Call INT 2Fh, Funct. 46h, SubFunct 53h
              At call, AX must = 4653h, CX=0005h, BX= 0000h
              If present in ram, AX will return FFFFh.  To uninstall, call
              with AX & CX the same as above, but BX= 0001h.  AX, ES, & BX
              will be destroyed.

F-LOCK.EXE  (Part of F-Protect package, looks for "suspicious" activity)
            INT 2Fh, Funct 46h, SubFunct. 53h
            To call:  AX = 4653h, CX=0002h, BX=0000h (installation check)
                                            BX=0001h (uninstall)
                                            BX=0002h (disable v1.08 & below)
                                            BX=0003h (enable v1.08 & below)
            Call returns AX=FFFFh if installed ( BX=0000h at call)
            AX, BX, and ES destroyed, if uninstalled (BX=0001 at call)

F-POPUP.EXE (Pop up menu for F-Protect)
          INT 2Fh, Funct. 46h, SubFunct. 53h
          To call: AX=4653h, CX=0004h, BX= 0000h, 0001h or 0002h
                                       (See above - BX same as F-Lock)
          Returns: Same as F-LOCK.EXE

F-XCHK.EXE (Prevents execution of any progs which don't have self-checking
            code added by F-XLOCK)
           INT 2Fh, Funct. 46h, SubFunct 53h
           To Call: Registers = same as F-Popup, except CX=0003h, and
                    BX = 0000h (installation check) or 0001h (uninstall)
           Returns: same as F-LOCK, above.

TBSCANX (Resident Virus scanning Util by Frans Veldman)
        INT 2Fh, Function CAh, SubFunct 00h
        Call: AX=CA01, BX=5442h ("TB")
        Returns: AL=00h if not installed, AL=FFh if installed
                 BX=7462h ("tb") if BX was 5442h during call

        INT 2Fh, Function CAh, Subfunction 02h (Set state of TBSCANX)
        Call: AX=CA02h, BL = new state (00h=disabled, 01h=enabled)

VDEFEND (Part of PC-tools.  Works on v7.0)
        INT 21h, Function FAh
        To call: AH=FAh, DX=5945h, AL=subfunction (01h to uninstall)
        returns: CF set on error, DI = 4559h (?)

DATAMON (PC Tools 7.0 file protection)
        INT 2Fh, Funct 62h, Sub Funct 84h
        Call: AX=6284h, BX=0000h (for installation check), CX=0000h
        Returns: AX=resident code segment, BX & CX = 5555h

Flu Shot, or Virex PC
        INT 21h
        Call: AX=0ff0fh
        Returns if either is installed: AX=101h

If anyone has any more Anti-Viral IDs, post 'em on Digital Warfare and I'll
update this list.

                                       ---DecimatoR PHALCON/SKISM