F-Secure Script Viruses Detector  Version 1.3b
Scans files for script-based viruses. Copyright (c) 1998 Data Fellows Ltd.


OVERVIEW

F-SCRIPT is a DOS program which searches *.HTML, *.INF, *.VBS, *.JS, *.HTT
and *.HTA files for known script viruses. F-SCRIPT is able to disinfect them
by removing virus code from the infected files and to delete files with
malicious code inside.


TECHNOLOGY

F-SCRIPT uses the script scanning engine from the F-Secure Anti-Virus Toolkit
for Windows available from Data Fellows.

F-Secure Anti-Virus intergates the best in script virus protection with the
best in traditional virus protection and corporate system and network
management features.


USAGE

General command line is: F-SCRIPT <path> <<option1>> <<option...n>>
The <path> option allows to specify location for scanning. Scanning
path should contain drive letter. To scan current directory the '.' option
should be specified. If no parameters are specified the help screen is
output. Then any drive scanning is offered. If a drive letter is input the
corresponding drive is scanned with options obtained from command line and
disinfection and log option set by default. If no drive is specified the
control is passed to the system.


OPTIONS:

 /A or /AUTO    - automatic scan mode
 /- or /DISINF  - disinfect infected files
 /D or /DELETE  - delete infected files
 /E or /RENAME  - rename infected files
 /O or /LIST    - display OK for clean files
 /V or /VIRLIST - display the list of currently detected viruses
 /L or /REPORT  - create log file F-SCRIPT.LOG
 /* or /DUMB    - scan all files (slow mode)
 /R or /NOSUB   - do not scan subdirectories
 /? or /HELP    - help screen
 /B             - create backup copies for disinfected files
 /Y             - do not ask for confirmation on delete/disinfect
 /HARD          - scan all available hard drives
 /FREEZE        - confirm each delete/disinfect
 /INTER         - force interactive mode


NOTE:

The '/E', '/D' and '/B' parameters can't be used together.


EXAMPLES:

     F-SCRIPT .
     F-SCRIPT C:
     F-SCRIPT D:\WINNT /- /Y
     F-SCRIPT D:\TOOLS\ /* /O /E /R


F-SCRIPT returns following errorlevels:

	0:  Normal program termination
	1:  Incorrect command line parameter
	2:  Too long command line parameter
	3:  Log file creation error
	4:  Incompatible options specified
	5:  Error opening database file 'F-SCRIPT.DEF'
	6:  Incompatible or corrupted database file 'F-SCRIPT.DEF'
	7:  Error reading database file 'F-SCRIPT.DEF'
	8:  Error manipulating database file pointer
	9:  Not enough memory for database loading
	10: Not enough memory for service areas
	11: Not enough memory on startup

	other: Abnormal program termination.


VIRUS LIST ATTRIBUTES

Attributes of viruses in currently detected viruses list are given below. The
general attribute output format is: NNN...

  First attribute - type of infected files
    H = HTML, V = VBS, I = INF, J = JS

  Second attribute - type of infection
    V = virus, T = trojan, D = dropper, I = intended

  Third attribute - type of virus (if a virus entry)
    O =overwriting, A = appending, P = prepending, I = inserting, C = companion


NOTES:

F-SCRIPT does NOT disinfect anything by default. You need to turn
disinfection on by specifying the /- parameter. If you want all infected
files to be renamed or deleted use /E or /D parameter respectively.

We recommend you make a backup copy of important files before
disinfecting them, just to be safe. You can specify /B option and
disinfected files will be automatically backuped by F-SCRIPT.

If you want to scan all files (not only *.HTML, *.VBS, *.INF, *.JS, *.HTT and
*.HTA), use the /* parameter to switch all files scanning mode.

IMPORTANT: If you find a new variant of script virus, please send a
suspected sample for closer analysis. See the SUPPORT part below for more
information.


SUPPORT AND VIRUS SAMPLES

For technical support please contact <F-SCRIPT-Support@DataFellows.com>. To
send samples of new or suspected viruses, use <Samples@DataFellows.com> or
upload to our FTP site and send a note to 'samples'.

        ftp://ftp.Europe.DataFellows.com/incoming


UPDATES

Updates, when available, can be downloaded from the Data Fellows ftp sites
at these locations:

        ftp://ftp.datafellows.com/pub/anti-virus/tools/f-script.zip
        ftp://ftp.europe.datafellows.com/pub/anti-virus/tools/f-script.zip

Normally only the F-SCRIPT.DEF definition file is updated. Latest
F-SCRIPT.DEF is always inside the F-SCRIPT.ZIP file and can be also
downloaded separately.

The Data Fellows web site has up-to-date descriptions on the operation
and effects of viruses, see

        http://www.datafellows.com/vir-info/


HISTORY

1.0a: First version able to detect all known at the moment of release HTML,
      VBS, JS and INF viruses, droppers and trojans. The first polymorphic VBS
      virus is detected at 100% rate. Disinfection capabilities include
      deletion of overwriting viruses, droppers and trojans or renaming of
      all infected files.

1.0b: Currently detected viruses list output added. Delete files key added.

1.1b: Disinfection of appending and prepending viruses added.

1.2b: Disinfection of companion viruses added. More command line parameters
      added. F-PROT or/and AVP command line parameters can be specified.

1.3b: Minor bugs fixed. /HARD scan mode output info added.


LEGAL

F-SCRIPT is protected by international copyright laws. F-SCRIPT is (c)
1998 Data Fellows Ltd, and it is not in public domain or freeware, but
you are free to use and share this software with no charges. You can
not get the source code of this program. You are not allowed to
decompile and reuse the program code of this application. You are not
allowed to resell this software for your own profit (normal copying
costs excluded) or claim to hold rights to this software. Although you
may have the right to use F-SCRIPT, it will remain the exclusive
property of Data Fellows. Data Fellows does not warrant that the
software is error free and we will not cover any costs created by
function or malfunction of this program. Data Fellows also disclaims
liability for possible consequential damages. Please redistribute
F-SCRIPT only with this documentation. If you cannot agree to these
restrictions, you should not use F-SCRIPT.

Copyright (c) 1998 Data Fellows Ltd, Finland
