Lara wrote on 2025-01-09, 07:40:

can this be made to work on a USB boot drive? does anyone have a ready made iso?

yes, extract and just copy it into a USB drive, it's just a single .EXE program file. you can use Rufus to format a USB drive into a bootable DOS drive

clb wrote on 2025-01-09, 20:01:

There would exist a simple antivirus algorithm that will detect all file and boot sector tampering viruses on a vintage DOS syst […]
Show full quote

There would exist a simple antivirus algorithm that will detect all file and boot sector tampering viruses on a vintage DOS system.

1. Install the antivirus software to a pristine DOS installation that you know to be good. (e.g. new formatted system)
2. On the first boot of the system, store a mirror copy or a hash of the boot sector.
3. On subsequent boots, if the mirror/hash differs from the actual boot sector, report that a modification has occurred.
4. Hook into DOS mechanism that starts up .EXE and .COM files.
5. Whenever a new .EXE or a .COM file is launched, record its hash and its path.
6. Whenever an existing .EXE or a .COM file is launched that already has a hash for that path, compare the hash. If it differs, then report that a modification has occurred.

This is similar to what I implemented in the SvarDOS package manager: when a package is installed, a CRC32 of each file is stored. Then, a "pkg check" action makes the packager compare the executable files against their known hashes (or "pkg check+" for all files, executable or not, but it takes much longer). This works only for files, maybe I will extend it to the boot sector at some point.

Still, an actual antivirus is much needed, as it prevents damage instead of letting the user know that their system has been broken.

Geri wrote on 2024-09-07, 20:20:

The final Virus Buster version for DOS - from around 1999 - was able to detect about 20 000 or so, if my memory is correct. These were all existing, and alive viruses for dos, and most antivirus were super crappy compared to it.
Sadly, i haven't made a backup from it, and only the very limited versions float online with non-full virus list.

Are you referring to V-BUSTER by a malaysian guy, which claims to detect 52943 viruses in ver. 10 from 2001?

I was able to run Virus Buster 5.10.00 from 1996 in an 8088 XT PC with 512KB RAM on a monochrome display adapter.

It took about 5 minutes to scan 180 files on a floppy.
It detects 879 viruses, and you can manually add new virus signatures into a text file quite easily.
The scan engine is 27 KB in size and its virus signature database is about 45 KB in size . So it is quite compact.

analog_programmer wrote on 2025-02-03, 00:54:

Geri wrote on 2024-09-07, 20:20:

The final Virus Buster version for DOS - from around 1999 - was able to detect about 20 000 or so, if my memory is correct. These were all existing, and alive viruses for dos, and most antivirus were super crappy compared to it.
Sadly, i haven't made a backup from it, and only the very limited versions float online with non-full virus list.

Are you referring to V-BUSTER by a malaysian guy, which claims to detect 52943 viruses in ver. 10 from 2001?

No, i am referring to the real thing.
https://en.wikipedia.org/wiki/VirusBuster

Geri wrote on 2025-02-08, 22:55:

No, i am referring to the real thing.
https://en.wikipedia.org/wiki/VirusBuster

Ok, then. I have some version of this hungarian "real thing" from 1998. Unfortunately it's with hungarian interface and therefore useless for me.

P.S. It turned out that it's from your attachment here.

analog_programmer wrote on 2025-02-08, 23:28:

Geri wrote on 2025-02-08, 22:55:

No, i am referring to the real thing.
https://en.wikipedia.org/wiki/VirusBuster

Ok, then. I have some version of this hungarian "real thing" from 1998. Unfortunately it's with hungarian interface and therefore useless for me.

P.S. It turned out that it's from your attachment here.

I have the original in english but it's a later version released in 2004, Also a "Lite" 1996 version that was licensed to Leprechaun Australia

Masaw wrote on 2025-02-09, 06:19:

I have the original in english but it's a later version released in 2004, Also a "Lite" 1996 version that was licensed to Leprechaun Australia

Can you share them, please? I'm collecting all kinds of forgotten AV-software for DOS.

Your VCheck+ software is very handy for old machines with floppy drives. Do you intend to release a full (non-beta) version some day?

analog_programmer wrote on 2025-02-09, 10:19:

Masaw wrote on 2025-02-09, 06:19:

I have the original in english but it's a later version released in 2004, Also a "Lite" 1996 version that was licensed to Leprechaun Australia

Can you share them, please? I'm collecting all kinds of forgotten AV-software for DOS.

Your VCheck+ software is very handy for old machines with floppy drives. Do you intend to release a full (non-beta) version some day?

I'll send you thru dm.

I have plans on releasing the full and "lite" versions but doing so requires a rewrite of majority of the code (especially the interface) in assembly language so that I will have more control over the size of the .EXE file rather than relying on the C compiler. Furthermore, the "lite" version will have the same detection and scan engines but will support 8086 machines. two such problems with the current build are ; the use of ENTER/LEAVE and PUSH immediate values by the C compiler which are allowed only on 80286

Currently my oldest PC system is a 386SX machine, but I welcome your idea to (re)write a VCheck+ version with 8086/8088 CPU support.

analog_programmer wrote on 2025-02-08, 23:28:

P.S. It turned out that it's from your attachment

Thats a quite limited version which i was able to track down. Back then i had the full version on my 486, and regularly upgraded the data base up to like 2000 for it, till it became eol.
Another fantastic thing the langoliers ate...

Geri wrote on 2025-02-09, 23:16:

Thats a quite limited version which i was able to track down. Back then i had the full version on my 486, and regularly upgraded the data base up to like 2000 for it, till it became eol.
Another fantastic thing the langoliers ate...

Thanks to Masaw now I have VirusBuster virus database file (VBUSTER.VDB) from 2004. I think it will work with your VirusBuster scanner ver. 8.03.557 from 1998, but I can't use this software with its hungarian language interface 🙁

analog_programmer wrote on 2025-02-09, 23:36:

Thanks to Masaw now I have VirusBuster virus database file (VBUSTER.VDB) from 2004. I think it will work with your VirusBuster scanner ver. 8.03.557 from 1998, but I can't use this software with its hungarian language interface 🙁

keresési mód = search mode
irtható akció = action when removable
heurisztika = heuristics
makróheurisztika = macro heuristics
karantén helye = location of quarantine
csendes mód = quiet mode
tömörítvényekben = in compressed
ms documentumok = ms documents
ms access fileok = ms access files
nem írtható akció = action when non removable
heurisztika akció = heuristics action
makróher. akció = macroheuristics action
összes file = all files
program fájlok = program files
ms excel fileok = ms excel files
ms ppt fileok = ms ppf tiles

Geri wrote on 2025-02-09, 23:54:

keresési mód = search mode irtható akció = action when removable heurisztika = heuristics makróheurisztika = macro heuristics k […]
Show full quote

keresési mód = search mode
irtható akció = action when removable
heurisztika = heuristics
makróheurisztika = macro heuristics
karantén helye = location of quarantine
csendes mód = quiet mode
tömörítvényekben = in compressed
ms documentumok = ms documents
ms access fileok = ms access files
nem írtható akció = action when non removable
heurisztika akció = heuristics action
makróher. akció = macroheuristics action
összes file = all files
program fájlok = program files
ms excel fileok = ms excel files
ms ppt fileok = ms ppf tiles

👍 Thanks for the translation, mate! I'll try to change those strings inside the hungarian interface executable, hopefully it don't have any super-duper checksum self-check.

P.S. Damn! Whit the newer data base file I got this error:

Hiba: A program a virus adatbazis ezen verziojat mar nem tamogatja.
Frissebb valtozat a program forgalmazojanal szerezheto be !

Which means:

Error: The program does not support this version of the virus database.
A more recent version can be obtained from the program vendor!

Anyway, I can still try to partially translate the interface...

P.S.2: Nope. I just hex-edited "Igen" to "Yes" and as expected the software checked itself for modifications:

Figyelem! A program file tartalma megvaltozott.
Az alkalmazas jelen allapotaban nem futtathato!

Attention! The contents of the program file have been changed.
The application cannot be run at this time!

Better off to search the "deep web" for a suitable english version 😁

This is a great idea. Currently all I have been doing is use virustotal to scan any new downloads and ClamAV to scan any disks that I aquire. I am not actually sure if either of those would even detect DOS-based viruses still... Do they?

RetroPCCupboard wrote on 2025-02-10, 06:54:

This is a great idea. Currently all I have been doing is use virustotal to scan any new downloads and ClamAV to scan any disks that I aquire. I am not actually sure if either of those would even detect DOS-based viruses still... Do they?

Virustotal still detects dos viruses, but clamav is probably useless. Even in 2000 most of the antivirus software havent detected dos viruses any more.