               Changes to F-PROT

Version 1.16 added the following features:

        Detection, but not disinfection of 27 new viruses:

		200
		268-plus
                483 
		Bad Boy
		Cascade - 2 new variants: Formiche and JoJo-1703
		Darth Vader (4 variants)
                Diamond - 4 new variants: Damage, Damage-B, David and Greemlin 
		Eddie - new variant: MIR
 		Fingers 08/15
		Hero
		Leech
		Murphy - 4 variants: Cemetery, Kamasya, Migram-1 and Migram-2
		Stardot
		Swiss-143
		VCS 1.0
		Warrior
		Witcode

	Detection and removal of 85 new viruses:
		
		1024-PrScr
                1575-B (alias 'Greencat-2')
		Backtime
		Bljec - 7 variants: Bljec-3, Blec-4, Bljec-5, Bljec-6,
			Bljec-7, Bljec-8, Bljec-9
		Boys
		CARA
 		Casino
                Cinderella
                Demon (overwriting)
		Diamond - new variant: Lucifer
		Eddie - 4 new variants: 1028, 1801, Apocalypse-2 and Zeleng
		ETC
                Frog
		Horse (alias 'Naughty Hacker') - 8 variants: Horse-1, Horse-2,
			Horse-2B, Horse-3, Horse-4, Horse-5, Horse-6, Horse-7
                Incom
		Jerusalem - 6 new variants: Apocalypse, Carfield, Discom,
			GP1, Phenome and Skism
		Keypress-1228
 		Kiev-483
		Little Pieces
		Magnitogorsk - new variant: 2048
		MG - new variant: MG-1A
		Minimal-30
		Murphy - 11 new variants: AntiChrist, Diabolik, Erasmus,
			Finger, Goblin, Guru, Murphy-3, Murphy-4, Pest,
			Smack-1835 and Smack-1841
		Mutant - 3 variants
		Old Yankee - new variant: Bandit
		PcVrsDs
		Pixel - 11 new variants: 257, 275, 283, 295, 779, 837,
			850, 854, 877, 892, 936
                Raubkopi
		Sparse
 		Striker #1
		Sylvia-B (previously identified as Sylvia)
		Tequila
                Tumen - 2 variants: 0.5 and 2.0
 		USSR-311
                Vienna - 2 new variants: Arf and Vienna-645
		WWT - 2 variants: WWT-01 and WWT-02 (overwriting)
   		Yaunch (alias 'Wench')
		Yukon (overwriting)
		ZK-900

	Disinfection of the following viruses, which were detected in
	earlier versions:

		Faust (alias Chaos) (previously called 'Spyer')
		Form

	The following names have been changed, in an attempt to reduce
	the incredible confusion in the virus naming area.

		1075 --> DBF blank
		June 4th --> Bloody!
                Spyer --> Faust
		Turku --> Keypress

	The following bugs/problems have been fixed:	

		The signature for the 1049 virus has been changed, as it
		could cause false alarm in the 386COM.SYS file.

		F-FCHK would not detect all the possible mutations of
		the Whale virus in .COM files, although all infected
		.EXE files were found.  This has been corrected.

		Occasional very long delays when some programs, such as
		SORT.EXE in DOS 4.0 were run have been eliminated.

		F-OSCHK will now correctly handle the case where a
		checksum evaluates to 0, as 0 previously meant "ignore".
		Instead the string ----- is now used when a checksum
		should be ignored.

		When F-DRIVER and F-NET were in use, Novell "execute-only"
		programs could sometimes not be executed.  This has
		been corrected.

		F-DRIVER would on some computers fail to detect some boot
		sector viruses if it was loaded into high memory (above
		640K.  This has been corrected - LOADHI etc should now
		work without problems.

        F-FCHK will now indicate if a program has been compressed by
        DIET 1.10, ICE 1.01 or EXEPACK.  This warning only indicates that
	a virus could possibly have been hidden in the program before it
	was packed - not that anything appears to be wrong.

	A new file has been added with information on Trojans and "Joke"
	programs, often found in virus collections.  Those programs are
	not a threat like viruses - but some of my competitors detect
	them, so....

        /QUERY switch added to F-FCHK.  if it is used, F-FCHK will ask if
	it should disinfect any infected files - this used to be the
	default.

	A conflict has been reported between F-DRIVER and Desqview, and
	I am trying to determine if a problem exists.

Version 1.15 added the following features:

        Detection, but not disinfection of

		Akuku
		Doom2
                Mardi Bros
                Microbes
                MIX2
                Ontario
                Spyer
                Swedish disaster
		USSR-1594
                X-boot

	Detection and removal of

                10 past 3
                1575
                1600 (Jerusalem variant)
		4th Black Friday (Jerusalem variant)
                Aircop
 		AntiCAD/Plastique-2576
                AntiCAD/Plastique-3004 (COBOL)
		Australian 403
                Azusa
                Burger-382
                Cascade 1701-YAP
		Christmas Violator	
                Dark Lord (variant of Terror)
                Deicide
                Dutch-555
                Enigma
                Fichv 2.1
                Flip/Omicron-2153
		The 4th Black Friday (Jerusalem variant)
                Frere-2 (Jerusalem variant)
		G-Virus, version 1.3 (731)
                Gergana
		Grither (Vienna variant)
                HIV
		Hybryd
		Iraqui Warrior (Vienna variant)
                Jeff (impossible to disinfect)
                June 4th (Stoned variant)
                Klaeren (impossible to disinfect)
		Kylie (Jerusalem variant)
                Leprosy-A  
                Leszop (Stoned variant)
                Magnitogorsk
                Michelangelo (Stoned variant)
                Micro-128
		Minimal-45
                Mirror
                MG-4
                Monxla-B
		Paris
                Phantom
                Plague
                Rostov (Stoned variant)
                September 18th-789 (first reported as "805")
                September 18th-801 (first reported as "817")
                Sexual revolution (Stoned variant)
		South African-408
                Spanish Telecom (boot-form)
                Staf
		SVC 3.1
		Taiwan-C (752 byte variant)
		Taiwan-D (677 byte variant)
		Testvirus B
 		Vienna VHP-622 from Bulgaria
                Vienna 822 from Hungary
                Wolfman

	Removal of the following viruses, which were detected in 1.14

		905
		Lovechild
                Terror
                Vienna-644

	The "405" and "382" viruses have now been reclassified as
	Burger-variants.

	The names of some viruses have been changed, in most cases
	because the viruses had only a temporary, numeric name.

		1600 --> Happy New Year
		417 --> F-word
		Perfume --> G-Virus

	/NOBOOT switch added to F-DRIVER to disable memory check at boot
	time.  Should only be used on computers with Network Boot ROMs,
	where the standard F-DRIVER is known to cause problems.

	/QUICK switch added to F-FCHK.  Using it results in faster
        scanning, but reduces the chances of detecting previously
	unknown variants of "old" viruses.

	/DELETE switch added to F-FCHK.  If it is used, infected files
	will be overwritten several times and then deleted.

	The F-INOC and F-DIR programs are not included any more,
	as they were practically useless.

        F-FCHK will now indicate if a program has been compressed by
        DIET, LZEXE or PKLITE.  The programs will not be scanned - that
	will be added in a later version.

        A small program (F-TEST) has been added to determine if F-DRIVER
	is installed and working properly.  See USAGE.TXT for further
        information.

	The following bugs/problems have been fixed:	

		F-DISINF /MULTI did not work under all circumstances.

		Conflicts between F-DRIVER and PC-NFS have been
		eliminated.

                Version 1.14 was not able to remove all variants of
		Jerusalem, including some which 1.13 handled successfully.
		This has been fixed.

Version 1.14 added the following features:

	Detection, but not removal of

		905
		Anthrax
		C-23693
		Crazy Eddie
		Lovechild
		Rat
		Terror
                V2P6
                Vienna-644
		Whale - warning - the Whale detection is not 100%
		perfect - I am improving it right now.

	The reason V2P6 is not removed is the complexity of
	the various encryption methods - If you ever get infected by the
	virus, I suggest you contact its author:

			Mark Washburn
			4656 Polk Street NE
			Coloumbia Heights, MN 55421
			USA

	Detection and removal of the following viruses:

                217
                417
                440
                492
                516
                600
                696
                699 (erronously called "711" elsewhere)
                707
                789
                948
                1049
                1067
                1075
                1226
                1600
                2144
		Agiplan
                Alabama-B
		Amstrad-852
		AntiPascal
		AntiPascal 2
                Attention
                Bebe
		Best Wishes
                Black Monday
                Burger-537
                Carioca
                Christmas in Japan
                Cookie
                Crew-2480
                Datalock
                Destructor
                DIR
                Diskjeb
                Doteater
                Evil
                Father Christmas (Choinka)
		Groen Links
                Guppy
                Hymn
                Internal
                Invader
                Jerusalem-G
                Joker
                Joker-01
                Kemerovo
                Leprosy-B
                Liberty II
                Lozinsky
                MG
                MG-3
                MGTU
                MLTI
                Monxla/Time
                Musicbug
                Nina
                Nomenklatura
                Parity
                Phoenix
                Piter 
		Plastique (4 new variants)
                Polimer
                Proud 
                Russian Mirror
                Saddam
                Scott's Valley
                Stone `90 (T@V) - a variant of Vienna
		Superhack (Scottish Murphy)
                SVC
		Sverdlov
                Tiny-family (11 different variants)
		Turbo-448
                Turbo Kukac
		Turku (Twins)
                V2P2
		VFSI (Happy)
                Vienna (several new variants)
		Violator
                Virdem-792
                Voronezh
                Vriest
		Westwood
                Wisconsin
		Zero Hunt (Minnow)

	F-FCHK now does a much better job of detecting minor variants of
	viruses, in particular those cases where the differences are
	insignificant and do not matter with regard to disinfection. As
	an example, it will now identify the minor Jerusalem-variants
	(Payday, Mendoza, A-204, Puerto, Sunday, Anarkia, Westwood, B, C, G
	GrLkDos etc.) correctly, instead of just labeling them "Jerusalem".

	The /LIST switch added to F-FCHK, to produce a report with a list
	of files scanned, and results.

	The /MULTI switch added to F-FCHK and F-DISINF to scan multiple
	diskettes.

	The switches may be combined with other switches - for example
	you can use 

		F-DISINF A: /MULTI /AUTO

	if you have a large pile of infected diskettes or 

		F-FCHK C: /AUTO /LIST > report.lis

	to scan and disinfect the entire hard disk and produce a report.

	The following bugs/problems have been fixed:	

		The identification string for "Zero Bug" has been changed
		as it produced a false positive in LB.COM from Lahey and
		several other programs.

		F-FCHK now reports the correct number of files disinfected,
		when files are infected with multiple viruses.

		Occasional (but very rare) crashes of F-XLOCK and F-FCHK
		if F-LOCK was not installed.

		Problems when removing "Stoned" from a hard disk formatted
		under some DOS versions earlier than 3.0

		Occasional incorrect removal of Alabama.	

Version 1.13 added the following features:

        Detection and removal of the following viruses:

		Blood
		Itavir
		TUQ
		Slow
		Burger (removal not possible)
		1024
		V-1    (file and boot sectors)
		Joshi
		Plastique 5.21 (file and boot sectors)
		Filler
		Casper
	
	The disinfection program updated to remove "Flash" infections of
 	boot sectors.

	Analysis of suspicious boot sector code improved.
	
	The package is now free of charge to any individual
	using it only on a single computer.

