VirusKeeper 1
VKDOC.HTM Last updated on 11/15/99
Introduction
VirusKeeper One is meant to be a complete virus collectors data management system. From here you should be able to do everything you need to do.
This program was written for my own use to build up my collection. I believe my collection statistics show that it has been an effective tool. I decided to share it with others when some friends asked to see my work.
Since then I have released it via the web for public use. If you do not like the way VK works, I am sorry. It has never been written for popular usage. After all, there are only
so many virus collectors, this is a free program and life does exist outside the world of computers. With that cranky statement out of the way, here is the scoop:
VirusKeeper is not a quick little DOS utility.
VK will take will take a little getting used to, it is not meant to be a clone of anything else out there. It does things differently. For instance, VK does not store viruses with long names like
Intended.Frog.Tadpole.COM. Instead, they are simply named VS000001.COM, and so on. You can browse all the virii in a database and find them that way. Much nicer than working you way through
all those subdirectories (try it out, find Intended.Macro.Word.Snothead.damaged sometime).
VK is batch ready. For instance, to read in your logs, check for new virii, bring them in and put them in ZIP archives you would need to run VK CHECK. That's all! Not bad for a little set up is it?
Back to Top of page
Quick Start (New Install/Upgrading)
To start a new installation of VK here are the steps:
- What you need: AVP32 for DOS, F-Prot for DOS, PKZIP25 (or some DOS ZIP
program), and some viruses.
- Put VK.EXE in a directory where you can safely test VirusKeeper. VK can't handle long filenames or directory names. It is a limitation
of Clipper, the language used for VirusKeeper.
- Run VK. It will create the necessary database files and indexes.
- run VK CONFIG (see help on CONFIG if you need further help)
- Exit VK.
- Put some virii in the directory NEW. Run your scanners on this directory, creating the report files.
- Run VK CHECK)
- After VK has run, go out and look in VFILES, NEW and DELETE. There will probably be some virii in each one:
ARCHIVES - If you marked the option to automatically move files to ZIPS your collection will be zipped up here. VFILES - your collection will be here if you didn't auto-archive.
DELETE - virii files you did not need. NEW - virii files you did not detect.
- VK BROWSE to view your collection.
- When you feel ready to use VK, move all your files into the NEW directory and scan it in.
- When your virus scanner is updated, run it on your collection. Use the UPDATE function of VK to add any changes into the database.
To Upgrade your existing VK (any version) install here are the steps:
- make a backup!!!!
- Unzip your public viruses (VZ*.ZIP) in VFILES
- Make an AV scan of VFILES with AVP and FPROT
- erase *.DBF
- erase *.NTX
- erase ARCHIVES\*.*
- Set your configuration options with VK CONFIG
- VK BUILDUP
- VK REZIP (this will now archive your files into zips)
- Unzip your public viruses (VZ*.ZIP) in VFILES
- Make an AV scan of VFILES with AVP and FPROT
- VK BUILDUP ADD NOSHARE
- VK REZIP
- - files left in VFILES are undetected viruses.
An example batch is as follows:
- MD OLD
- MOVE ARCHIVES\*.* OLD
- MOVE *.NTX OLD
- MOVE *.DBF OLD
- pkzip25 -extract archives\vz*.zip VFILES
- AVPDOS32 /O- /S /Y /* /M /B /P /V /MD /MP /K /W+=AVP.REP VFILES
- F-PROT /DUMB /ARCHIVE /NOMEM /PACKED /COLLECT /REPORT=FPROT.REP VFILES
- VK CONFIG
- VK BUILDUP
- VK REZIP
- pkzip25 -extract archives\pv*.zip VFILES
- AVPDOS32 /O- /S /Y /* /M /B /P /V /MD /MP /K /W+=AVP.REP VFILES
- F-PROT /DUMB /ARCHIVE /NOMEM /PACKED /COLLECT /REPORT=FPROT.REP VFILES
- VK BUILDUP ADD NOSHARE
- VK REZIP
Back to Top of page
Command Line Parameters
- 4ME - Makes lists of what you need from the logs specified on the command line. i.e. VK 4ME AVP.REP FPROT.LOG. Use the REQALL to force VK to ignore the CONFIG settings and request all types of viruses.
- 4YOU - Makes lists of what your friend misses using the logs specified on the command line. Zips the lists into VIR4YOU.ZIP
- HTML - Create HTML access to your archives
- ALLSTAT - Creates all statistics pages (AVPSTAT, FPSTAT, HTMSTAT).
- ARCHIVE - ARCHIVE - Archive all virii in VFILES directory. In "zipped" mode it archives files out of VFILES into the archives directory. In non-zipped mode it zips without moving into the ARCHIVES directory. In both methods, VK keeps track of which files have been archived. It will only archive those files that have not already been zipped. If you wish to rebuild the archives: 1. In zipped mode you must unzip all files into the VFILES directory, run VK MARKUNZIP and then VK ARCHIVE. 2. In non-zipped mode, you must delete *.zip in ARCHIVES, run VK MARKUNZIP then VK ARCHIVE.
- AVPSTAT - Creates Statistics of your collection according to AVP.
- AVPPACK - Writes out sets of viruses meeting the specification ex: VK AVPPACK=PIXEL would write all AVP viruses starting with PIXEL (Pixel.343, etc) to SORTED. See Also: FPPACK
- BROWSE - Kicks you into a browser showing all the data stored for your virii collection. Arrow keys move you up and down the list and left and right across the
data. Keep pressing right or left arrow until you hit the far side of the data. Keys:
- PGUP - Move up one page.
- PGDN - Move down one page.
- HOME
- END
- DEL - Deletes the file from the database and from the archives.
- CTRL-PGUP
- CTRL-END
- F3 will write the current virus out to the SORTED directory. It will name it according to the virus name. Intended.Frog.Soup.EXE or something like that. A pop up a menu will allowing you to pick which scanner to use for the filename.
- F4 Search for a virus.
- F7 to change the index (sorting).
- Pressing a letter, number or other character will jump you to virii beginning with that name. This works only when the AVP or FPROT indexes are active (set with F7). Watch which index you are using. If AVP is active and you are viewing FPROT it will look pretty strange.
- BUILDUP (or REBUILD) - Use this to build up VK databases from logs. Usually this is only necessary when upgrading VK, to rebuild your database or using VK simply to create logs statistics. Warning! This will erase the main database and rebuild it from the logs specified in your CONTROL settings. This will also update the AV definition file dates in the control database. Extra parameters:
- ADD - Add viruses to database without erasing main database.
- NOSHARE - Mark viruses added in as private, not for trading.
- CHECK - The heart of virii trading! Check through the scanner logs created by AVP and FPROT. VK should read in files from any directory,
but several directories containing duplicate names may confuse VK.
VK will attempt to access files in ZIPs, but again multiple files with
the same name will cause problems. VK will check the scanner data
against your database. If new ones are found it will move them into
VFILES and update your database. If you already have a file it will
move it into the DELETE directory (unless it is in a ZIP). When it
finishes it leaves unknown files in the original directory. Use the ACCALL parameter to force VK to ignore the CONFIG settings and accept all types of viruses.
- CLEARSTATS - Clears the statistics database.
- CONFIG - Configure the system options
- DELETE - Deletes all the files in the delete diretory.
- FPPACK - Writes out sets of viruses meeting the specification ex: VK FPPACK=PIXEL would write all F-Prot viruses starting with PIXEL (Pixel.343, etc) to SORTED. See Also: AVPPACK
- EXTENSIONS - Writes out a list of extensions used in your virus collection with a count of how many of each file you have. Writes to the screen and to EXTENS.RPT.
- FPSTAT - Statistics of your collection according to F-Prot
- GIVE - Build a zip from files specified on command line. If no file is specified, it defaults to GIVE.TXT. Up to 20 filenames may be specified on the command line (i.e. VK GIVE newfprot.log newavp32.log).
- GIVEYOU - Builds a zip file by adding everything you have That is not in your friend's log specified by AVPLOG=xxxx, etc. (may be used together with 4ME, 4YOU)
- HELP - Generates this list
- HTML - Create HTML access to your archives
- HTMSTAT - Stats in HTML format
- IDGIVE - Build a zip from files specified on command line, using virus name matching instead of file names. If no file is specified, it defaults to GIVE.TXT. Up to 20 filenames may be specified on the command line (i.e. VK GIVE newfprot.log newavp32.log).
- IGNORE - Ignores all the NOSHARE flag when giving out virii. This is used internally here for to allow moving virii from one place to another.
- NOID - Removes the "AVP = xxxx", etc from the 4ME, 4YOU lists. (default is to include the "AVP = xxxx", etc.)
- NOSHARE - Sets the NOSHARE flag so files that are brought in during this session will not be traded out.
- NOZIPUNSCAN - Turns off zipping of unscanned virs. Overrides setting in system configuration file
- PSEUDO - Make pseudo report files
- RAW - Create raw reports (FPROT.RAW, etc)
- REINDEX - Rebuild index files
- RENOBJ - Lists files that F-Prot reports as object files, but don't have the .OBJ extension.
- RESET - Reset zip and file numbers to 0. Use this only in special circumstances. This could cause serious problems with your collection.
- REZIP - Reset zip information (marks all files as not in zips) and run ARCHIVE. Use this with BUILDUP for example.
- SUMDTL - Detailed summary statistics (SUMDTL.RPT).
- SUMSTAT - Summary statistics (SUMSTAT.RPT).
- UNSHARE - reads in log files and marks those virii as unshareable.
- UPDATE - This is where you update your virus information when your virus scanners are updated. Run your virus scanners on your collection.
Sometimes F-Prot mis-ids some viruses when zipped. Because of that I made a batch file to unzip my collection, run the scanners, then take care of the files. Once you run the
scanners, run UPDATE. VK will check the new scan information against what is stored in its database. It will change any virii that have a
different report than what is stored in the database. This will also update the AV definition file dates in the control database.
- UPAVP - Update AVP only
- UPFP - Update FPROT only
- VERSION - Report on VirusKeeper program and database version.
- VGREP - Output VGREP .DAT file
- ZIPUNSCAN - Zip unscanned Virs in NEW directory into dated zip
Back to Top of page
Files and directories used by Virus Keeper
All the data files in VirusKeeper are DBASE III format. They should be easy to read into any program that will import this format. The file are as follows:
- CONTROL.DBF - contains log names, zip #s, next virus #, etc
- VIRUS.DBF - the main data for your virii. You see it when you use BROWSE.
- GIVETEMP.DBF - temporary database used by the GIVE function. It is emptied out each time GIVE finishes.
- TEMPIN.DBF - Temporary database for several trading, scanning functions. Emptied out each time a function is finished. This file can get very large when scanning several thousand viruses.
- *.NTX - Index files used for faster search times through databases. Clipper format indexes. If erased, VK will recreate (but it takes a while with a large database).
- *.RPT - All log files can be deleted. The system will recreate them when necessary.
- SYSTEM.RPT - Logs various system functions.
- NEWVIRUS.RPT - Logs all new virii scanned, plus some data about scan runs.
- DELETE.RPT - Logs all virii deleted (moved to DELETE). This can be disabled in CONFIG. It gets large quickly.
- UPDATE.RPT - Logs all virii that are updated.
The directories are as follows:
- VFILES - Where virii are put when new ones are found. If you do not set the autozip in CONFIG they will stay here. I strongly recommend that you use the autozip.
- ARCHIVES - Where the *.ZIP files are stored. This is your collection!
- DELETE - Virii that you already had according to the scanners used. Files are renamed DL*. These can be erased anytime you wish.
- TEMP - Temporary directory used by several functions.
- GIVETEMP - temporary directory used by the GIVE function.
- NEW - The place where the new virii go to be scanned and checked!
Back to Top of page
Examples
- Starting up a new copy of VK: VK BUILDUP - Make sure you have configured your log names with VK CONFIG. This will zap the main database and start from nothing.
- Starting up a new copy of VK with multiple logs: VK BUILDUP ADD - to add in a log of viruses, without zapping the main database. Do not use this to add in new viruses. This only for starting up your database, mostly for upgrading from an old version.
- Checking for new viruses: VK CHECK - make sure new viruses are in your NEW directory. Scan them with AVPDOS32 and FPROT. Then run this command.
- Checking some one else's logs: VK 4ME fprot.log avp.txt - VK should automatically recognize the logs.
- Giving viruses a friend has requested: VK GIVE avp4me.lst fp4me.lst - VK will find the viruses and make a zip for you.
Back to Top of page
Cost/Pricing
COST????
There is no cost for VirusKeeper. I started writing it to keep track of my virus collection. Then I decided to share it with others. As soon as
I mentioned releasing it to others someone sent me over a thousand more viruses (thanks, dude!). That encouraged me to keep working and to start getting VK ready
for release. If you like VirusKeeper and use it, would you please send me any
viruses that I don't have? You can download my logs at http://wwww.virusexchange.org/tally/tlog.zip It isn't like paying for it
because I'm not requiring it at all. But it encourages me to keep working and then you can try and convince me to change it! To all those who have sent
me new viruses - Thank You! Also, please continue sending me feedback and bug reports. You have
been very helpful in improving this program. Thanks!
At any rate, enjoy VirusKeeper and collect virii!
Back to Top of page
Frequently Asked Questions
- Why does VirusKeeper rename files? - VK renames files VS000001, VS000002, etc. This is simply to
differentiate files. If the files were not renamed it would quickly become difficult to keep track and renaming would still have to occur.
Naming the files according to the AV scanners is difficult, since some virii change names from one AV update to the next. Also, different
AVs give the same virus different names. VK avoids those problems by giving a numeric name and cross referencing. Thus VS000001 could be
Intended.Broken.Branch according to AVP, Vienna.Branch by F-Prot. VK would store all that information.
- What about dupes? - Since VK only brings in files that scan as new according to the AV programs, it
does not bring in dupes. However, as the AV programs update, some viruses may be changed to a duplicate ID.
- Yes, but what about CRC dupes - files that are copies of each other? - You may be surprised to discover that
using VK, with it's AV dependent dupe avoidance, actually brings in a very low number of CRC duplicates. Under normal operation the number is often
less that 1% and usually is 0. Running RENEXTS may uncover some duplicates. When you update VK with fresh logs, these will register as dupes.
- VirusKeeper has higher numbers that others programs such as VirSort,does it keep more files than it should?
VK relies on the AV scanner reports for its data. If the report says a file is a different virus, it is kept. You can configure just how
that works by editing your REQUEST/ACCEPT settings in VK CONFIG. Sometimes when an AV reports a file as different then changes it on a later update, VK will end up
with duplicate files. They can be removed with the DUPCHECK. The statistics reports will take dupes into consideration and not count
them. With the development of VirusKeeper One, a new move has been taken. VK now sees fully IDed, partially IDed, object code, damaged
viruses and trojans as different viruses. So if you have Snotty.123 in .OBJ format and Snotty.123 in .COM format VK sees two different
viruses. This is necessary because if you link the .OBJ file it will probably scan in a different way.
- Why is VirusKeeper bigger and slower than VirSort or VS2000?
Because they are both great programs! But seriously, VirusKeeper is is really a different approach to virus collecting than VirSort and
VS2000. VK is a data management approach, while VS is a utility approach. VirusKeeper keeps one large database and indexes to make
searching, reports and virus sending much easier. Many people use several different utilities to manage their collections. Batch files
become complex and long in order to manage all the functions. VK is an attempt to simplify that process. For instance, when I get a
bunch of virii I run my scanners then run "VK CHECK." It will find the ones I need, update the scanner data on all three scanners, move out
the files I already have, give me a report of what is new, make me a sandwich. I am willing to give a little space and time for that.
- What information does VirusKeeper store?
VirusKeeper stores the virus name according to all three scanners, the new file name (VS000001.COM, etc.), the file size, whether the
virus is a dupe or undetected by each scanner (update only when running DUPECHECK or STATS), the ZIP it is stored in, which scanner
found the virus first, whether the virus is store in a zip and the file type (partial ID, full ID, Trojan, Dropper, damaged, etc).
- My GIVE function isn't zipping the files!
VirusKeeper is a real memory hog (due to the nature of Clipper programs). When it shells to DOS to run PKZIP it needs as much memory as you can give it. If you are running
Smartdrv or other DOS resident programs, it may not run correctly. Remove those programs from memory and try again.
- How do I update my virus files when I download a new virus scanner version?
I recommend NOT scanning the files within their ZIP files because some scanners will give a different report when files are zipped.
So here is the recommended procedure (for those using archiving). Those not using archiving may simple do steps 2 & 3.
- unzip all the zips from ARCHIVES into VFILES (PKZIP25 -EXTRACT ARCHIVES\*.ZIP VFILES)
- scan the files in VFILES with your scanner(s)
- Run VK UPAVP for AVP, VK UPFP for F-Prot (or VK UPDATE for both)
- erase the files in VFILES (zipped mode only)
- Why don't I have any friends? This is most likely beyond the scope of VirusKeeper's capabilities.
However, you might try getting out once in a while!
Back to Top of page
Configuration Entries
- AVP LOG NAME - The name of the AVP log file you create with your AVP anti-virus (e.g. AVP.REP, AVP.LOG, AVPDOS32.TXT)
- FPROT LOG NAME - The name of the FPROT log file you create with your F-Prot antivirus (e.g. FPROT.REP, F-Prot.log)
- STATS TITLE - The title for your statistics page. HTML codes can be entered here.
- STATS FOOTER - The footer (text for bottom of page) for your stats page. HTML codes can be entered here.
- REQUEST OBJ FILES - Set to "T" if you want VK to request .OBJ files.
- REQUEST PARTIAL ID - Set to "T" if you want VK to request partially IDed files.
- REQUEST DAMG FILES - Set to "T" if you want VK to request damaged files.
- REQUEST TROJANS - Set to "T" if you want VK to request trojans or backdoors.
- REQUEST DROPPERS - Set to "T" if you want VK to request droppers.
- REQUEST SUSPICION - Set to "T" if you want VK to request suspicious files.
- REQUEST INACTIVE - Set to "T" if you want VK to request inactive viruses.
- ACCEPT OBJ FILES - Set to "T" if you want VK to accept .OBJ files. The difference between this is that REQUEST .OBJ works with the 4ME function. ACCEPT .OBJ works with the CHECK function. This was you can disabled requesting for certain files (such as .OBJ code) while still keeping the ones you get. This prevents you from wasting precious trade credits on .OBJ viruses.
- ACCEPT PARTIAL ID - Set to "T" if you want VK to accept partially IDed viruses.
- ACCEPT DAMG FILES - Set to "T" if you want VK to accept damaged files.
- ACCEPT TROJANS - Set to "T" if you want VK to accept trojans and backdoors.
- ACCEPT DROPPERS - Set to "T" if you want VK to accept droppers.
- ACCEPT SUSPICION - Set to "T" if you want VK to accept suspicious files.
- ACCEPT INACTIVE - Set to "T" if you want VK to accept inactive viruses.
- FULLY IDed VIRUS RATIO - Ratio at which you will trade fully IDed viruses (e.g. a 3 will set 3-1, 5 means 5-1, etc.)
- PARTIALLY IDed VIRUS RATIO - Ratio at which you will trade partially IDed viruses.
- TROJAN/BACKDOOR RATIO - Ratio for trojans and backdoors.
- DAMAGED FILE RATIO - Ratio for damaged files.
- OBJECT FILE RATIO - Ratio for object files.
- DROPPER RATIO - Ratio for virus droppers.
- SUSPICION RATIO - Ratio for supicious (AVP's "suspicion") viruses.
- INACTIVE RATIO - Ratio for inactive (F-Prot's "(inactive)") viruses.
- Run In Zip Mode - Set to "T" if you want VK to automatically archive your viruses. Setting this to FALSE tells VK to create subdirectories in VFILES and store your viruses there.
- NUMBER OF VIRS/ZIP - Enter a number here. This is how many viruses VK will put into each archive in the ARCHIVES directory.
- AUTO. ZIP UNDETCT. - Set to "T" if you want VK to automatically archive any files that don't scan in as viruses.
- MAKE SHARE FILES - Set to "T" if you want VK to make extra zip files of all the new viruses you get. These zips are great for sharing your newest viruses with your group or friends. Zip files are dated (NW990823.ZIP, NW990824.ZIP, etc.)
- TRACK DELETIONS? - Set to "T" if you want VK to create a log of all files deleted. Normally this will be set to "F" (not tracking).
- CREDIT FOR ALL FILES - Set to "T" if you intend to give at least 1-1 credit for all files received.
- PKZIP LOCATION - the full path/filename of your pkzip program with all parameters (e.g. C:\PKZIP\PKZIP25 -add -move)
- PKUNZIP LOCATION - the full path/filename of your pkunzip program with all parameters (e.g. C:\PKZIP\PKZIP25 -extract)
- MOVE - the parameter to move files when zipping, i.e. -MOVE
- DELETE - the parameter to delete a file from a zip, i.e. -DELETE
Back to Top of page
Credits
- All VirusKeeper Users: Yes, this means you! Thanks for using this humble program. I hope your collection grows and grows!
- My family: Thanks for being willing to let me spend hours at the computer - downloading, programming and collecting.
- Authors: Hey, without you VX authors, my hobby would be very boring! Thanks, folks!
- Babyvirii: For beta testing, trades and friendship.
- Cicatrix: Thanks for all the hours of work you put into VDAT, CCTX, and collecting. Thanks for giving me ideas on how to make collecting accurate. And thanks for all the trades!
- FoxZ: Thanks for all your help getting my page up and running on Source of Kaos! We miss you already in VXing!
- Knowdeth: Thanks for all the chats, advice, support and laughs. (and the Tally.* viruses)
- PhageVX: Thanks for the hours of beta testing, recommendations, great ideas, philosophical musings, encouragement and trades! No one can crash VK like you, pal! :)
- Roadkill: Thanks for BETA testing, trades and chats.
- Shadow Seeker: Thanks for all the BETA testing, ideas, virii trades, encouragement, etc. Oh, and thanks for VirSort. An excellent program. It was a real help in getting VK started.
- #VIR,#VIRUS,#VXTrader: Thanks for the help, ideas, trades, laughs and challenges.
- AV community: Thank you for providing free or evaluation versions of your software. I hope that VirusKeeper and collectors will help you improve your products also.
Back to Top of page
Contact/Download
- VirusKeeper Homepage: http://www.virusexchange.org/vk.html
- Tally's Logs: http://www.virusexchange.org/tlog.zip
Back to Top of page
Recommended Utilities
Keeping a good, clean collection requires some work. But some of the essentials can be handled by batchable, easy to use programs.
While VirusKeeper handles most of the operations for you, there are some other utilities that will greatly enhance your
collection.
- Renexts - this program renames files to the proper extension. This is absolutely necessary as F-Prot detects files differently depending on the extension. A copy can be found at: http://members.home.com/phagevirusexchange/renexts.zip
- Nome Weeder (NW) - this program is a fast CRC dupe checker. When it finds a CRC dupe, it then does a byte by byte comparison just to be safe. Fast, efficient and accurate! This is a must for using on your "slush" or "bulk" directory. A copy can be found at: http://www.fortunecity.com/campus/caltech/834/nwcmd.zip
- Bulk - copies files, giving them a CRC based name. Excellent for keeping multiple copies of viruses. Keep those extra samples - they may be variants that show up in a later AV update! A copy can be found at: BULK.ZIP