                                                                   May, 1995
    Product upgrade, 6.02
    ---------------------
    The major change in version 6.02 is the handling of large capacity IDE
    drives. These drives appeared on the market in mid 1994 and they are now
    quite common. Several enhancements to handle the large capacity IDE were
    already introduced in version 6.01D. The new drives present technical
    challenges in the area of disaster recovery and vulnerability to boot
    and mbr viruses, that were unforeseen by both the drive's producers, and
    the AV industry. Version 6.02 consolidates the former enhancements and
    lays the grounds for further improvements, especially in the disaster
    recovery area of these drives. Read also in UPGRADE.TXT how to upgrade
    your licensed copy of InVircible.

    Licensing of large capacity IDE. The installation of the license record
    to large capacity IDE, was impossible with earlier versions, if the
    Ontrack extended boot driver (DM 6.03+) was used. It could be done only
    with plain FDISK partition, using the LBA (logical block access) option
    in the setup. Version 6.02 will allow the licensing of these drives too.

    Version 6.02 consolidates changes done to the hardware access routines,
    used in InVircible, to suit the newer fast access hard disks and boards
    (100 mhz and higher). Hardware access is sensitive to timing, and new
    industry standards were introduced in the last year. Therefore, we
    recommend that InVircible copies earlier than 6.01D are upgraded.
    Version 6.01B and 6.01C still have some slow routines that won't work
    properly with the newer fast disks. Also, versions earlier than 6.01D
    still have a routine that conflicts with a defect in design of some
    older models of Maxtor hard drives. The problem has been identified by
    NetZ Computing and acknowledged by Maxtor. From version 6.01D and on,
    there should be no problem anymore, all models of Maxtor included. Yet,
    if you have a large capacity IDE hard drive, we strongly recommend that
    you upgrade to 6.02.

    Bug fix in INSTALL. Some DOS variants are using SYS.EXE instead of
    SYS.COM. In former versions, the procedure for preparing the rescue
    diskette looked only for SYS.COM and refused the use of SYS.EXE. The
    bug was fixed.

    ResQdisk improvement, fixing the boot sector via DOS, the ResQdisk ^B
    function. There are instances when the boot sector of hard drive #1 is
    infected, and it cannot be accessed via regular int 13 functions. Such
    is the case with the newer large capacity IDE drives. The active
    partition's boot sector can then be refreshed through the ^B key
    combination. The ^B function operates on the boot sector, the same way
    that does FDISK/MBR on the mbr - it refreshes the bootstrap code,
    without affecting the BPB data. The ^B function should only be used when
    booted from the hard drive.

    Temporary files handling, bug fix. Former versions of InVircible used a
    couple of fixed names, SOFIA and \WRITEST, to perform certain tasks. If
    a file with the name SOFIA was present in the current directory while
    executing any of the IV self protected modules, then the file was
    erased. The same would happen to a file named WRITEST, if present in the
    root directory, while IVinit or IVtest are run. These routines slipped
    by, since no incident was reported in regard with them during the five
    years they were in use. Recently, an incident was reported in which a
    file named SOFIA was erased while executing an IV module. Therefore, the
    routine responsible for this has been changed and fixed. InVircible does
    now use only unique names (that are not in use by the user) for its
    temporary and bait files. Note that no other than files named SOFIA or
    \WRITEST were of any concern, in formers versions.

    Long pathname handling in networks, bug fix. Pathnames under DOS are
    limited to 64 characters. Yet it is possible to create pathnames of up
    to 255 characters (the maximum length allowed for strings). Such
    condition is encountered on file servers. On such instances InVircible
    hung when scanning a network file server, containing directories with
    pathnames longer than the DOS limit. The problem existed only in the
    sweeping programs: IVB, IVscan, IVX and IVmenu. It is now possible to
    scan with IV's sweepers (except for IVmenu) across file structures that
    have directories with pathnames longer than the DOS limitation. The
    limitation in IVMENU remains as before. The reason for this is that
    IVMENU allocates memory for keeping track of up to 500 directories, with
    pathnames no longer than the 64 bytes DOS limit. We need some memory to
    be left for some useful job to be done, other than just showing the user
    a nice directories tree. :-) We thus could provide the same with IVMENU,
    but only for 125 directories, if the pathname length is to be 255
    characters. This would be inadequate for most users, that have more than
    125 directories in a partition, and less than 500.

    If you want to use IVMENU on file servers containing directories with
    long pathnames, then use the network "map" function to define volumes
    for sub-trees of the root, and then you can use IVMENU on the new
    logical drive, as usual.

    Product upgrade, 6.01D
    ----------------------
    Improved installation procedure. The Installation of IV will now run
    without needing to actually change the current directory. Just type the
    full pathname of where IV's INSTALL program is.

    Daily inspection for companion virus. The companion virus verification
    was added to IVB, since IVB runs daily. The same routine is retained in
    IVscan, for operational redundancy.

    Keeping track of the last inspected drive. In former revisions of IV
    there was need to manipulate the COMSPEC variable in order to keep track
    of the last drive checked by IVB DAILY. Now, just issue the IVB DAILY
    command and the tracking record will be updated, according to the
    current environment settings. Only make sure to always run the DAILY
    check from within the same environment shell. The last improvement is
    especially useful to LAN administrators.

    The user interface in ResQdisk was improved further. The newer features
    were grouped in three menus, Edit (accessible by pressing ^E), Track
    Zero maintenance (^Z) and Analyze sector (^A). Also, the new ^B function
    was added. The latter will refresh the boot sector of drive C: while
    accessing via DOS instead of the BIOS, and is the equivalent of the
    SYS C: command. The ^B function is helpful in removing boot sector
    viruses such as Da'Boys, Boot-437, Form etc.

    IVinit was enhanced to automatically invoke ResQdisk when needed. From
    now, Most boot / mbr infectors can be handled right at startup.

    Improved editing features in ResQdisk. Additional editing features were
    added to resQdisk. The sequence ^E ^F will read a file into the sector
    clipboard, while ^E ^D drops the content of the displayed sector into a
    file. The combination ^E ^Y will decrypt an encrypted sector into the
    clipboard and display it on screen. The later is especially useful for
    the recovery of damaged hard drives, like from the Monkey virus. It is
    indispensable for rescuing hard drives lost to inappropriate
    disinfection procedures, like with fdisk/mbr, or inadequate antiviral
    products. The above further improve ResQdisk as the best disaster
    recovery and boot-antiviral utility.

    Improved "track 0" maintenance features. ResQdisk is used in the rescue
    diskette for backing up track zero of the hard disk to floppy and for
    restoring track zero from file to the hard drive. The "track 0"
    functions are now available on-line, with the visual inspection of
    ResQdisk, in both SeeThru modes (backup only, recovery is always done
    with SeeThru off). The track 0 functions are started by the ^Z keys
    combination, followed by ^B for backup to file or ^R for restore from
    file.

    Either the Ctrl (^) or the Alt key can now be used for the editing
    and the "track 0" functions. For on-line help press Alt+H while running
    the ResQdisk program.

    Making a rescue diskette for other than standard configurations. The
    rescue diskette in the INSTALL program was improved to simplify the
    preparation of a rescue diskette in configurations containing other than
    Stacker, DoubleSpace or Disk Manager drivers. For details read in the
    on-line documentation.

    Improved resistance to IV dedicated viruses. The first virus aimed to
    "kill" IV's signatures has been reported and a sample of was analyzed by
    NetZ. It is recommended that users change the default filename of the
    signatures to one of their own definition. The signature files are no
    longer traceable as IV's, and cannot be identified as such -- provided
    you don't leave them with the default name. The new signatures are fully
    downward compatible with the former ones, and there is no action that a
    user needs to take in this regard.

    Random signatures' filename. When installing InVircible through IVlogin,
    a random signatures' filename will be selected. IVLOGIN can be used for
    standard installation with the default parameters. The random signature
    filename will be implemented on first time installation only, and with
    the default installation parameters only (to C:\IV).

    Compatibility with large capacity IDE. IVTEST was corrected to ignore
    the dynamic boot loader of large capacity IDE disks.

    Revision 6.01c was compatible with only Ontrack's Disk Manager extended
    bios drivers (XBIOS.OVL). The new revision is also compatible with other
    brands, recently introduced into the market - e.g. Micro House.

    Troubleshooting with IV. New text was added to the on-line help in
    regard of troubleshooting problems with IV. There is guidance how to
    detect an incompatible IDE controller with your hard drive, as well as
    disclaimers about a couple of hardware: Promise hard drive controllers
    with disk cache, and certain models of Maxtor's hard drives.

    Further improvement for use in networked environment. IVMENU, the
    integrated menu shell was upgraded to avoid conflicts in certain Netware
    environment.

                                                               January, 1995
    Product upgrade, InVircible 6.01C
    ---------------------------------
    Improved performance in networked environment: Revision 6.01C has
    further improvements for the operation of InVircible in the networked
    environment. All the scanning modules; IVB, IVscan and IVX were revised
    to avoid Novell's Netware files. The verification of Netware files under
    DOS created errors because of the special attributes of Netware's system
    files. IV's current revision avoids these files.

    Updated manual: The use of IV in network environment, as well as the
    strategy of how to disinfect the server and network are covered in a new
    appendix, in the manual text.

    Automatic IV version upgrades in network: IVLOGIN can now be used for
    both the automatic installation of InVircible to workstations in a
    networked environment, as well as the upgrading of an older IV version
    to a newer one. IVLOGIN checks whether its own version is newer than the
    current one installed on the hard drive. An older version will be
    automatically replaced by a new one, by just invoking IVLOGIN. It is
    recommended that the IVLOGIN command should always be included in the
    users login script, in networks.

    Improved piggybacking detection: Revision 6.01C has higher sensitivity
    of piggybacking detection. The detection threshold has been lowered to
    detect piggybacking within few affected files. The improved sensitivity
    has no effect on speed since the loss in speed was compensated for with
    a better search algorithm.

    New "copy and paste" functions in ResQdisk: It is an advantage to have
    editing capability of the master and boot sectors of the hard disk.
    ResQdisk can now copy the content of a displayed sector to the clipboard,
    by the ^E ^R sequence, then paste it elsewhere by pressing ^E ^W. The
    copy and paste functions are useful to recover from mbr and boot sector
    viruses, that relocate the original sector elsewhere, usually on track 0.
    The copying and pasting of the original sector can be done under the
    visual control of ResQdisk. The new functions can be used to store copies
    of the critical sectors (mbr and boot sectors) in the unused section of
    track 0, usually from sector 2 to the last sector on the track. Avoid
    using sector 3 (used by Monkey), 7 (Stoned, Michelangelo), 8 (used by
    Disk Manager - not a virus), 17 (B1-NYB), 13 (NewBug) and the last sector
    (Quox and a few others).

                                                               December 1994
    Product upgrade, InVircible 6.01B
    ---------------------------------
    Installation of InVircible on networked PC: Revision 6.01B has an
    additional file, IVLOGIN.EXE. As its name implies, its use is from the
    user login script in networks. When a workstation connects to the
    network, IVLOGIN verifies whether it has a hard drive, and if InVircible
    is installed on that disk. If not, INSTALL/FAST is invoked to install IV
    to the hard disk. The LAN administrator is required to install IV to the
    server and add the IVLOGIN command to the user login script. The rest
    is done automatically.

    IVB upgrade: Some lame viruses affect *.SYS and *.OVL files, if they
    have an executable structure (usually an EXE one). Thus, *.SYS and *.OVL
    files were added under IVB's coverture. These files are now secured by
    IVB, and can be recovered, in case they get infected.

    ResQdisk upgrades: There were disk configurations that ResQdisk didn't
    recognize properly. These were found mostly on Compaq models, having a
    special partition dedicated to proprietary diagnostics, coming first,
    before the DOS active partition. ResQdisk was upgraded to accommodate
    for these configurations too.

    In addition, ResQdisk had a few fixes to assure its proper functioning
    with the new mode 3 and 4 IDE standards, EIDE as well as with large
    capacity SCSI drives. This now covers all hard disk types used in
    personal computers.

    Install upgrades: The French version of InVircible configures now the
    rescue diskette to start with a French keyboard. Install also takes care
    to REM out the Thunderbyte TSR in the autoexec, at the installation of
    IV. The TB TSR intercept IV initialization checks and may crash the
    system. Also, Install will now install the IV registration key to hard
    drives having the Compaq configuration (see ResQdisk, above).

    User interface updates. Both IVB and IVSCAN command line syntax has been
    improved. The [d:] argument, where d represents a drive letter, will now
    start the program from the drive's root, instead of the current
    directory. For the default directory just don't give any drive argument.
