                                                                  June, 1995
    Product upgrade, 6.02A
    ----------------------
    IVX major upgrade. New features were added to IVX, enabling automatic
    signature extraction and signature scanning. IVX now creates its own
    signatures database from sampled files. The extraction of the signatures
    is automatic and does not require any special skills. The signatures can
    then be used to scan for their presence in other files. IVX also accepts
    user defined signatures by editing the database with an ASCII editor. An
    average user can now easily generate a signature for a new virus and
    announce it on the net or else. IV user can now scan for the presence of
    new viruses announced on the net. The new features of IVX reduce the
    response time to new virus alerts.

    The algorithm of IVX in statistical mode was refined and its detection
    capability improved, especially against some of the more difficult
    polymorphs, such as MtE viruses.

    IVB daily test under Win 95, bug fix. In former versions, the IVB DAILY
    test repeated itself on every boot, while booting in Win 95 DOS. The bug
    was traced to be caused by IVINIT and was fixed. IV 6.02A is compatible
    with Win 95 DOS.

    Licensing for OS/2 and Win 95. In version 6.02, InVircible's license
    reverted to Sentry when in Windows' or OS/2's DOS shell. Version 6.02A
    fixed that problem. Yet, you will need to run IV once in real DOS in
    order to upgrade your license from a former version, to 6.02A. This
    procedure does not apply to new licensed users, since the license can be
    installed to disk only in REAL DOS mode.

    Detection of PKLITE'd droppers and Trojans. During the last year,
    several droppers and Trojans were found, that used PKLITE in order to
    conceal the gen-1 file. Gen-1 is the designation of the first generation
    of a virus, usually the one used to launch the virus. While scanners
    usually find the offsprings, the gen-1 file will not be suspected, as
    many times it isn't recognized to be a compressed file, as the PKlite
    marks were removed, or disguised. The most recent case that used the
    PKlite method is related to the Big Caibua virus. The detection of
    potential droppers was added to IVscan, as the default. This feature
    should help SysOps and network administrators to keep their board and
    systems clean.

    Improved IVB signatures. Functional changes were made in order to
    improve IVB's discrimination between non-viral and legal modification of
    program, as well as to improve their immunity to dedicated viruses
    attacks (for details read the attached SECURITY.TXT file). The new
    signatures are no more compatible with the lower versions of IVB. To
    avoid confusion, or the loss of the former database, the default
    filename of the signature files was changed to IVB˙.NTZ. Note that there
    is a trailing character 255 (it looks like a space, but it is not!)
    between the IVB filename, and the .NTZ extension.

    Micro House boot driver's awareness. IV version 6.01D was aware of the
    WD large capacity ID, using the Disk Manager 6.03 dynamic boot driver.
    Other brands like Seagate are using the Micro House boot driver for
    their Decathlon models (540+ meg). In lower versions, IVinit indicated
    that the partition was "faked". This was objectively true, but it didn't
    indicate the presence of a virus. It actually detected the stealth used
    by the boot driver, since this is exactly how they work. These special
    boot programs load a special driver through the booting process and they
    use stealth to protect the special mbr from being accidentally
    overwritten, by FDISK/MBR for example. From version 6.02A, InVircible is
    aware of the possibility that a Micro House boot driver, or DM 6.03 is
    used.

    No escape in Sentry mode. System administrators asked to disable Sentry
    users from escaping IVB's daily full check. Adding the /ESC switch to
    the command line re-enables the Esc key when scanning daily. This change
    applies only to the Sentry mode.

    IVB exceptions list. There are instances when you may want to exclude a
    file from IVB's list of files to process. IVB has now provisions to
    exclude up to 5 filenames. Edit IVB.INI in the IVB.EXE directory with an
    ASCII editor, or create a new file with the above name, if it doesn't
    exist yet. Add a line for each file to exclude as follows: SKIP =
    EXCLUDE.BIN

    The CMOS "Restore" option was removed from IVINIT in Sentry mode.

    IVINIT bug fix. The errorlevel returned by IVINIT in case of a
    suspicious finding should be 1, and 0 when no finding. Due to a bug in
    former versions this wasn't always the case. The bug was fixed.

    INSTALL/R bug fix. The rescue diskette procedure couldn't find the
    SYS.COM (or SYS.EXE) file in the search path, if the DOS directory was
    after character 64 in the environment string 'PATH', and the process
    aborted. The problem is now fixed.
