About the application

 Home Next

AVZ Antiviral Toolkit is a system analysis and repair solution designed for automatic or manual search and removal of the following:

· Spyware, adware programs, and modules (a key function of this application).
· Rootkits and malware that hide their processes.
· Network and email worms.
· Trojans (all varieties, in particular Trojan-PSW, Trojan-Downloader, and Trojan-Spy) and back doors (programs used for stealthy remote control of computers).
· Deceptive dialers (Dialer, Trojan.Dialer, Porn-Dialer).
· Keystroke loggers and other applications that spy on the user.

The AVZ toolkit has been registered with the Russian Industry Fund of Algorithms and Software (OFAP); OFAP certificate: 6427; code in the Unified Software Documentation System (ESPD): 52038851.00116-01.

The toolkit is a direct analog of such applications as Trojan Hunter and LavaSoft Ad-aware 6. Its primary task is removal of adware, spyware and trojans.

It should be noted from the outset that spyware and adware applications are not viruses or trojans by definition. They spy on the user and download data and program code to the infected computer mainly for marketing purposes. This means that the information they upload does not contain critical data, such as passwords, credit card numbers, or the like, while the downloaded data contains only ads or program updates. Yet very often the dividing line between spyware and trojans is very thin, complicating precise classification. Classification methods and criteria are described in these help files. For additional information on malware, please refer to the book Rootkits, SpyWare/AdWare, Keyloggers & BackDoors. Detection and Defense.

A feature of AVZ is that it enables the user to configure the way the application responds to every category of malware. For example, you can configure it to remove any viruses or trojans detected, while blocking the removal of adware.

Another feature of AVZ is multiple heuristic checks that are not based on signature-based search. These checks include searching for rootkits, keyloggers, and various backdoor exploits against a database of standard TCP/UDP ports. Such search methods make it possible to detect new varieties of malware.

In addition to the signature-based file search capability that is standard for programs in its class, AVZ incorporates a database of digital signatures of tens of thousands of system files. This database helps to minimize the number of false positives returned by the heuristics analyzer while also serving a number of other purposes. In particular, the file search system has a filter for excluding known files from search results. Trusted processes are color-coded in the manager of running processes and SPI settings. When files are being quarantined, AVZ prevents known files from being added to quarantine.

Practice shows that very often a spyware application can be categorized as adware and the other way around, for the simple reason that targeted advertising is the purpose of spying in most cases. For such eventualities, a common category called “spy” was introduced to include both adware and spyware. The term “spy” provides the most fitting description for this class of programs.

Starting with version 4.29, the AVZ interface and protocols are localized by using updatable databases, with Russian and English currently supported. The language is selected automatically or manually—using the command-line parameter “Lang” or the localization profile. The language is set automatically to Russian on Russian-language systems and to English on systems using other languages. The command-line parameter syntax is lang=X, where X is the locale name (RU for Russian and EN for English). To force the Russian-language interface, start AVZ by typing avz.exe lang=ru in the command line (accordingly, type avz.exe lang=en to force the English-language interface).

Limitations of the application:

1. Because the toolkit mainly targets spyware and adware modules, it does not currently support the checking of archives of some types, PE compressors, and documents. This functionality is unnecessary when scanning for spyware. The application is constantly improved and such functions are planned to be added.

2. The toolkit does not repair applications infected with computer viruses. Use specialized anti-virus applications (such as Kaspersky Anti-Virus, DrWeb, Norton Antivirus, Panda, and the like) to repair an infected program thoroughly and correctly. Reproducing the functionality of these anti-virus applications is not neccessary, especially because computer viruses appear less and less frequently.


License agreement

 Home Previous Next

1. The copyright to the application belongs to its author, Oleg Zaytsev (http://z-oleg.com/secur).
2. This version is freeware and not intended for commercial use.
3. The author reserves the right to terminate this license for any of the subsequent AVZ licenses.
4. AVZ is freeware as long as this setup package remains unchanged. No individual or company may charge a fee for AVZ without the author’s prior consent in writing.
5. The AVZ toolkit is supplied “as is” without any warranty, either expressed or implied. Use this software at your own risk. The author is not liable for any data losses or corruption, impairment of other programs or the system, or any lost profit resulting from the use or misuse of this software product. By default, the application operates in analytical mode and does not modify anything in the host system. The user makes the decision to enable the removal mode.
6. You may not use, copy, emulate, clone, rent, lease, sell, modify, decompile, disassemble, otherwise reverse engineer the application or use the application or its components in ways other than those identified in this license agreement. Any such unauthorized use shall result in immediate and automatic termination of this license agreement and may result in prosecution under law.
7. All rights not expressly granted herein are reserved by the author.
8. By installing and using AVZ you signify understanding and acceptance of this license agreement.
9. If you do not agree to this license agreement, remove the AVZ setup package files from your data storage devices and discontinue using the application.


Installation and system requirements

AVZ Antiviral Toolkit does not require installation (the current version comes without the installer and uninstaller, as there is no need for them). Likewise, removal is not required.

The only requirement for proper operation of the application is for the database with virus signatures (they have the *.avz extension) to be placed in the BASE subfolder of the application installation folder. When the removal mode is disabled (a default setting), AVZ Antiviral Toolkit does not make any changes to the system settings or registry, and does not install or remove classes or libraries. Therefore, scanning the PC with the removal mode disabled does not affect the operating system or the PC in any way. The only change made to the PC configuration during AVZ operation is the loading of the AVZ.SYS driver, which is copied to the Driver folder for the duration of the scanning and is removed after the scanning is completed. This driver is installed and loaded only when the rootkit search mode is enabled.

AVZ operation in removal mode results in changes to the system. In this case, the toolkit removes malicious programs and, in a number of cases, data associated with them (registry keys, icons, and the like).

AVZ Antiviral Toolkit does not have any special system requirements. It has been successfully tested on hundreds of PCs running the following operating systems: Windows 9x, Windows NT, Windows 2000 Professional and Server, Windows XP Home Edition and XP Professional (SP1, SP2, SP3), Windows 2003 (SP1), Windows Vista (SP1, SP2), Windows 7. The AVZPM, AVZGuard, and Boot Cleaner technologies are not supported in Windows 9x, or in 64-bit versions of the operating systems Windows XP, Windows Vista and Windows 7.

Note: AVZ users must exercise special care when using the application on servers, particularly when running AVZ from a terminal session. Server operation is highly specific. For example, system reboots are inadmissible; there are multiple user profiles on a server; there are processes running in the background; the terminal mode has its specifics.

AVZ Antiviral Toolkit does not exchange information over a network or over the Internet; the toolkit does not transmit or receive data, and does not listen on ports. This is why the toolkit does not require any additional firewall settings. The only exception are AV database updates, those are launched by the user. To update its database, AVZ connects to the website specified in the settings via port 80 using the HTTP protocol.

If necessary, you can force the removal of registry keys and files that AVZ may have created on the drive, which is equivalent to uninstalling the application. To force the removal, use microprogram number 6 in the Standard Scripts section or run the following script:

begin

ExecuteStdScr(6);

end.


Program folder structure

AVZ Antiviral Toolkit files can be installed to any folder. For ease of reference, let us assume it is a folder named AVZ. The AVZ folder contains several subfolders, with the following contents:

Base — AVZ database of malware descriptions and methods of fixing them. Downloaded updates are placed into the Base folder.

Backup — Backup copies of critical system settings. The application creates backup copies automatically in the process of repairing and restoring the system or does so when commanded by the user. The Backup folder contains subfolders that are named using the YYYY-MM-DD convention, where YYYY represents the year, MM the month, and DD the day.

Infected — Copies of deleted malicious objects.

Quarantine — Copies of suspicious objects. The Infected and Quarantine folders contain subfolders that are named using the YYYY-MM-DD convention, where YYYY represents the year, MM the month, and DD the day. This organization considerably simplifies subsequent use of these folders, in particular cleaning them up and viewing them.

Note: You can move the Infected and Quarantine folders to any folder by using the command-line key QuarantineBaseFolder.


Technical support

Even though AVZ Antiviral Toolkit is freeware, it comes with technical support, available via email:

• avz@z-oleg.com — Write to this address with questions about using the application, bug reports, or suggestions of improvements to the program and the algorithms used by it.
• newvirus@z-oleg.com – Use this address to submit viruses that AVZ failed to detect, AVZ protocols, and suspicious files that need to be checked (submit suspicious objects in a ZIP archive protected with the password “virus”; preferably, quarantine suspicious objects in the AVZ quarantine and create the archive using AVZ tools).
• VirusInfo.Info – This forum of virologists contains the “Help” section where you can describe your issue and attach the AVZ system analysis log (the forum rules describe the detailed procedure for requesting assistance). In particular, AVZ training is based on the malware found within this website. Logs are analyzed and recommendations issued promptly, so that in most cases the issue is resolved the same day. The “Submit trusted files” service of this website can be used to submit an archive with trusted files for the AVZ Trusted Objects Database. New AVZ versions and proposals for improvement are discussed in the “Beta testing” section.
• Use the form located at http://www.z-oleg.com/secur/avz/report.php to report an error encountered while using AVZ. Submissions made using the WEB form are anonymous and they are recommended for error reports. There is no point in using this form to ask questions without providing contact details.
• A service located at http://www.z-oleg.com/secur/avz/uploadvir.php is designed for submitting suspicious files for analysis and malware that is not detected by AVZ for their subsequent inclusion in the database. Use this form to submit archives created for the AVZ quarantine objects only.

Email messages preferably contain a clearly formulated subject and a succinct description of the issue, request, or question. The response time depends on this; without a doubt, a subject line that reads “Suspicious object for analysis” is far more informative than “Help!”, “Mayday”, “SOS”, and the like. When submitting a suspicious object that you know to be safe (for example, AVZ suspects that a certain DLL is a keylogger, but you know that it is a component of a particular application), please say so. This will speed up the analysis. Files submitted other than through the AVZ quarantine or in exotically formatted archives are analyzed in the last place.

Please follow these rules when composing your email message to technical support:

1. Write an informative header. This simplifies analysis and ensures shorter response times. For example, the subject line that reads “Suspicious file (anti-keylogger triggered)” or “Rootkit suspected” is far more informative than such headers as “Emergency”, “From John Doe”, and the like.

2. Please provide the following in the message body:
· Operating system version
· A brief description of the issue (what you detected and where, what the symptoms are)
· If possible, attach the AVZ log and system analysis results (“File” / “System Analysis”).
3. If the suspicious files in the archive are large (over 1-2 MB), send beforehand the message with the issue description, the logs and state the size of suspicious files.


Application purpose

The purpose of the application is as follows:

• AV database — Helps diagnose malware known to AVZ and removes it. Removal involves automatic cleanup of malware traces in the registry and in the INI files that are critical to system operation. In this regard, AVZ is convenient for a quick cleanup of an infected PC before bringing in “heavy artillery” – installing a powerful anti-virus package and using it to run a scan. The scanner can scan archives of common types, email files, and NTFS streams.
The AV scanner can be integrated with The Bat by using a plug-in. The AVZ database is updated daily.
• Quick automatic PC scan with the results displayed in the html log file. During the scan, files found in the AVZ Trusted Objects Database and the Microsoft Security Catalog are filtered out, which considerably reduces the size of logs. This mode is convenient for a quick scan of a suspicious computer by the administrator, and for a remote scan of the system. The ability to run system analysis and to quarantine objects by using a script makes it possible to automate this operation fully. By this means, the local user’s involvement is reduced to running a *.bat file.
• Automatic quarantining of files that do not have a Microsoft digital signature and are not described in the AVZ Trusted Objects Database. To make these files subsequently analyzed manually or by using anti-virus applications. Additionally, AVZ supports list-based quarantine and quarantine commands in scripts, which simplifies remote collection of suspicious files from PCs being scanned.
• Search for rootkits and other API hooks, with the ability to search for hidden processes. Besides analysis of hooks, AVZ has the functionality to neutralize UserMode and KernelMode rootkits.
• System Restore . AVZ contains microprograms that automatically fix common corruptions of Internet Explorer and Windows Explorer settings, reset desktop settings, and neutralize policy rules set by trojans. Anti-virus applications do not normally perform these operations, which is why normal system operation is not restored after a trojan or spyware has been removed.
• Automatic checking of SPI/LSP settings and automatic fixing of errors. This eliminates most of the LSP problems encountered after the removal of some adware types. If settings cannot be restored, the toolkit will fully recreate them.
• File search . The search function is protected by the AVZ Rootkit Block (antirootkit), which offers a number of useful virus and trojan search functions. For example, antirootkit filters out files that have been cleared through the AVZ Trusted Objects Database and the Microsoft Security Catalog, allowing the search scope to be narrowed considerably.
• A script language for controlling AVZ. Scripts make it possible to use AVZ in a corporate network. In this case, AVZ can be launched from a logon script or autorun and run according to an administrator-developed script. Scripts also make it possible to automate the majority of AVZ operations.
• Built-in disk inspector. The disk inspector creates databases containing file information that corresponds to the user settings (by specifying folders and search masks). These databases can be used for keeping track of disk changes.
• Process Manager, which makes it possible to run a search for suspicious objects in maximum heuristics mode.
• The AVZGuard system, which protects AVZ and legitimate applications from malware affecting the system and limits the impact of malware on the system.
• A system providing direct access to the disk for handling blocked files. It operates on FAT16/FAT32/NTFS systems and is supported by all Windows NT operating systems, enabling the scanner to analyze blocked files and quarantine them.
• The AVZPM processes and drivers monitor. It keeps track of processes that are started and stopped and drivers that are loaded and unloaded in order to locate hidden drivers and detect corruptions created by DKOM rootkits in structures that describe processes and drivers.
• Boot Cleaner driver. Designed for cleaning the system (removing files, drivers, services, and registry keys) from KernelMode. The cleanup operation can be performed both during PC rebooting and while the toolkit repairs the system.
• Vulnerability search. Designed for locating invalid PC settings that can adversely affect security.
• Backup. Designed for backing up critical system settings. Backup is carried out upon user command or automatically while the toolkit repairs and restores the system.
• Troubleshooting wizard. This system automatically locates and eliminates issues that result from infection by malware and clears traces of user activity and trash from the PC.

---------

AVZ is an interactive tool for semiautomatic scanning of the PC with the aim of finding and eliminating malware. One of the key AVZ features is support of external scripts that can be used to control automatic PC scanning and cleanup and quarantining of files. The system of script language commands with examples is described in help files.


Main application window

Before you start using the application, it is recommended to disable background monitors of registry changes and anti-virus monitors for the duration of scanning and removal. While this is not a mandatory requirement, failure to do so may significantly prolong the scan time—to several hours instead of several minutes. The reason is that the anti-virus monitor checks all files when they are opened.

Main application window

The main application window contains all the principal controls: main menu, search and removal process settings, log view, and status bar.

Click the “Start” button to launch a scan of selected drives and folders.

Click the “Pause” button to suspend the scanning process. This button automatically becomes available when the toolkit performs operations that can be suspended. To resume scanning click the “Pause” button again.

Click the “Stop” button to abort the scanning process at any time.

Most AVZ interface items are blocked for the duration of scanning.

See also:


“Search scope” tab

The “Search scope” tab lets you specify the scope of the search for malware. It contains a tree view of disks and folders. A check box is next to each item of the list. Use the check boxes to include any item in the search or exclude it.

Right click the list of folders to open a menu that allows you to select one of the following:

• Select all hard drives (HDD).
• Select all CD/ROM and DVD/ROM drives.
• Select all floppy drives and flash drives.
• Update the list of drives. You can update the list by pressing the F5 key.
• Add a folder. Click this menu item to open a dialog box that asks you to specify the folder name. This function is convenient for selecting a folder quickly, if you know the full path to it.
• Scan files in the selected folder only (without subfolders). This is a special folder selection mode. The toolkit scans files in the selected folder only and ignores all subfolders.

Check boxes next to folders determine the scan mode. Possible options are as follows:

– Files and subfolders of this folder are not scanned.

– All files and subfolders of this folder are scanned.

– All files in this folder and a part of its subfolders are scanned (this happens when there are several subfolders and only some of them have been selected).

– Only files in this folder are scanned; subfolders are ignored. You can enable this folder scan mode by right-clicking and selecting “Scan the specified folder only (do not scan its subfolders)”.

“Scan running processes” check box

The “Scan running processes” check box lets you enable the scanning of all running processes and loaded libraries before starting the system scan. This check box is selected by default, and it is not recommended to clear it. If removal mode is enabled, upon detecting a malware process AVZ will force the process to close before removing its file.

“Heuristic system check” check box

The “Heuristic system check” check box enables an additional heuristic check of the system. This check involves analyzing running processes, the registry, and the disk in order to find malware varieties unknown to AVZ by spotting the characteristic attributes of the malware programs. If this mode is enabled and AVZ detects suspicious objects, it will report this in the log file. Enabling the heuristic scan increases the overall system scan time. At the core of the heuristic scan are the so-called heuristics microprograms that are stored in the database and that are constantly updated.

“Searching for vulnerabilities” check box

The “Searching for vulnerabilities” check box enables a subsystem that looks for potential security vulnerabilities. Messages returned by this system are recommendations. They are meant to direct your attention to existing vulnerabilities. If you run a system scan after performing a search for vulnerabilities, the tool that generates the script of the system scan log will add items that order the execution of a script to fix the vulnerabilities detected — provided they can be fixed with a script.

The progress indicator that shows the status of a scan process is also displayed on the “Search scope” tab.


“File types” tab

The “File types” tab allows you to configure the types of files to be scanned.

“File types” options

In the “File types” group box, you select the file types to be checked by AVZ.

The “Potentially dangerous files” option is selected by default. In this case, AVZ checks only files with specific extensions (EXE, DLL, OCX, SYS, CAB, INF…), that is, executable files or files that can contain malware installation data or dangerous scripts.

If you select the “All files” option, the application scans all files regardless of their extensions. Scanning the disk in this mode involves checking a large number of files, which reduces the scan speed. In this mode, the “Include files matching the template” check box is unavailable, because this option is pointless in this case.

If you select the “Files matching user-defined templates” option, the application runs the search only using file masks specified by the user in the "Include files matching the template” and “Exclude files matching the template” fields.

Note: If the “Scan running processes” check box is selected on the "Search scope" tab, the running processes and loaded libraries are always scanned, regardless of their extensions or the settings specified on the “File types” tab.

“Include files matching the template” check box

The “Include files matching the template” check box allows you to include files that match the user-defined mask in the search. This option is pointless in the “All files” mode, which is why it is automatically disabled and grayed out when the “All files” option is selected.

“Exclude files matching the template” check box

The “Exclude files matching the template” check box allows you to exclude files that match the user-defined mask from the search. This option can be used together with the “Include files matching the template” option or the “All files” option. Specifying the same items in the inclusion and exclusion lists is not an error. Exclusions take precedence over inclusions. For example, if you specify *.vir files in the inclusion list and *.vir files in the exclusion list at the same time, the exclusion prevails. Moreover, exclusion with a more common file mask prevails over inclusions. For example, if you include trojan.exe in a scan and exclude *.exe files, the file named trojan*.exe will be excluded from the scan.

Note: The "Include files matching the template” and “Exclude files matching the template” fields can contain several masks separated with a comma, space or semicolon. A mask can include the question mark (?) (substitutes any character in the position of the question mark) and wildcard characters (*) (substitutes any characters).

*.* – All files are searched.

*.exe – Files with the EXE extension are searched.

dialer.exe – A search is conducted for files that are named dialer.exe.

dialer.exe, *.dll, trojan*.sys – The application searches for files named dialer.exe, dll-files that have any name, and files named trojan<any characters>.sys.

*.exe, *.dll, *.sys, *.ocx – The application searches for files with the specified extensions only.

“Report clean objects” check box

The “Report clean objects” check box allows you to log a list of files that were scanned by AVZ and were found not to be viruses or malware.

“Check clean objects by Trusted Objects Database” check box

This check box is available only when the “Report clean objects” check box is selected. When you select this check box, every file that AVZ has found not to be a virus or malware is checked against the Trusted Objects Database and the scan results are logged. This operation slows down the scanning and is useful for system administrators and virologists who sort files before analysis.

“Scan NTFS streams” check box

Use this check box to enable scanning of streams in NTFS files. Streams are not visible when you use file managers or Windows Explorer, which is why many malicious programs hide their executable files in a stream. AVZ can scan streams and remove malicious objects that it detects in them. This check box is selected by default, and it is not recommended to clear it.

“Scan archives” check box

Use this check box to manage the scanning of archives. This check box is selected by default. The concept of an archive also covers chm-files, mht-files, email files, and other objects that can contain other files.

“Do not scan archives larger than” check box

This check box is available when archive scanning is enabled. It is selected by default and archives larger than 10 MB are not scanned. The user specifies the threshold, but it cannot be lower than 1 MB.


“Search parameters” tab

The “Search parameters” tab lets you configure the search parameters:

“Heuristic analysis” options

The “Heuristic analysis” group box includes a slider for regulating the heuristics triggering threshold. AVZ supports 4 heuristic analysis levels:

• Heuristic analysis disabled. In this mode, AVZ detects only known malicious objects when the object being checked fully matches the description in the database.
• Minimum heuristics mode. In this mode, AVZ issues warnings upon detecting objects that closely resemble malicious objects.
• Medium heuristics mode. This mode is equivalent to the minimum heuristics mode, but with a lower triggering threshold. This is the recommended mode, in which the percentage of false positives usually does not exceed 10-15%.
• Maximum heuristics mode. This mode is often referred to as “paranoid", because the application issues warnings of suspected viruses even when the scanned object only remotely resembles a malicious object. Numerous false positives are possible in this mode. The “Extended analysis” check box becomes available when the slider is set at maximum heuristics mode. Selecting this check box enables additional checks that make it possible to detect suspicious objects based on secondary attributes, such as a double extension, a large number of spaces in the name preceding the extension, and so forth. The common messages of the heuristics analyzer are shown in the AVZ heuristics analyzer section.

“Anti-RootKit” options

The “Anti-RootKit” group box contains settings of the RootKit detection and blocking system. The “Detect API hooks and RootKits” check box lets you enable the RootKit detector, which tries to detect the presence of RootKit in the system by their characteristic attributes. It is worth noting that certain false positives may be returned: system utilities, anti-virus monitors, and firewalls may be detected as rootkits. This is normal, because such programs and utilities interfere with the functioning of other applications and distort the operation of standard API functions.

The “Block User-Mode Rootkits” and “Block Kernel-Mode Rootkits” check boxes are available only when the “Detect API hooks and RootKits” check box is selected, and let you enable the active rootkit block system. It is worth noting that enabling rootkit block system can have unforeseen consequences and you should be ready for AVZ and the entire system to hang. Therefore, before you activate rootkit blocking, you have to shut down all applications, preferably disconnect from the network, and unload the anti-virus monitor and firewall.

When rootkit blocking is enabled, the system of the heuristic search for rootkit processes and files is enabled automatically. The operating principle of the system is based on system analysis before and after the blocking of hooks, which enables the detection of hidden processes, services, and drivers.

The AVZGuard system and the kernel-mode rootkit blocking mode are mutually exclusive. When AVZGuard is enabled, kernel-mode rootkit blocking is disabled.

Note: System reboot is required when the system has been scanned with the kernel-mode rootkit blocking enabled. This is due to the fact that the blocking of hooks can disrupt the operation of anti-virus monitors, firewall components, and other security applications. A reboot is indicated only when intercepted functions have to be restored. In this case, AVZ prompts you, at the end of the log, to reboot the system.

“Winsock Service Provider” options

The “Winsock Service Provider” group box lets you configure the operation of the scanning system and the SPI analyzer (more widely known as LSP, because of the LSP Fix utility). Many modern viruses and spyware applications modify SPI settings. A common manifestation of damaged settings is the occurrence of failures during Internet browsing. The “Check SPI/LSP settings” check box lets you enable the settings analyzer. In this case scanning is performed automatically and all issues and errors detected are shown in the log. Selecting the “Fix SPI/LSP errors automatically” check box to enable the automatic fixing of detected errors. Errors are detected automatically, and the user does not have to understand the subtleties of SPI operation. Starting with version 4.26, after detecting errors AVZ automatically backs up SPI settings in the BackUp folder before fixing the errors automatically. The backup copy is a standard reg-file that can be imported into the registry if necessary.

To remove errors manually, it is recommended to use the Winsock SPI (LSP, NSP, TSP) manager.

“Search for keyloggers” check box

The “Search for keyloggers” check box lets you enable the detector of keylogger and trojan dll-files (a trojan dll-file is a library embedded in the address space of running processes). The search is carried out without using the signature mechanism, which makes the search results probabilistic in nature. The application assesses the degree of similarity of detected libraries to a keylogger by using a neural network that detects the characteristics of a keylogger. Additionally, AVZ performs behavioral analysis of all suspicious libraries and shows the data collected in the log.

Note: The AVZ analyzer and the neural network are capable of locating suspicious libraries and assessing the degree of their similarity to common interceptors of window events, keyboard events and mouse events (the so-called hooks). However, the analyzer is unable to differentiate between a malicious hook (designed for spying on the user) and a hook performing useful actions.

“Search for TCP/UDP ports used by Trojan horses” check box

The “Search for TCP/UDP ports used by Trojan horses” check box lets you enable automatic analysis of the list of open TCP and UDP ports. AVZ incorporates a special database describing several hundred ports used by common trojans, backdoor exploits and viruses. When it detects open ports described in this database, AVZ logs a warning indicating the port number and lists malicious programs that use this port. You can also view open TCP and UDP ports in the “Open TCP/UDP ports” window.

“Fix system errors automatically” check box

The “Fix system errors automatically” check box lets you enable automatic fixing of dangerous system errors. The search for system errors is performed during system scan. This check box is cleared by default, meaning that the error search is carried out, error information is logged, but they are not fixed. Bear in mind that besides automatic error fixing, you can use the Troubleshooting wizard that lets you choose manually which of the detected issues should be fixed. In the process of automatically fixing system errors, the application logs the changes made, making it possible to undo these changes via the Troubleshooting wizard if necessary.


“Automatic actions” options

The “Automatic actions” group box contains settings that define AVZ actions upon detecting malware.

The “Enable malware removal mode” check box is the principal option in this group. This check box is cleared by default, and AVZ runs in diagnostic mode. Information about all malicious objects detected is logged, but no actions are performed on them (AVZ makes no changes to the registry or the disk during scanning).

“Enable malware removal mode” check box

When the “Enable malware removal mode” check box is selected, AVZ goes in removal mode, making settings available for each malware category. For every object category you can select one of the two actions: “Remove” (a malicious object is removed), “Report only” (removal is blocked but a warning about a detected object is logged), and “Ask user”.

“Heuristic file deletion” check box

The "Heuristic file deletion” check box allows you to enable “smart” deletion of malicious objects. After a file is deleted, the application analyzes the system and deletes all detected links to the file (autorun key in the registry, classes registered in the registry, autorun and WinLogon items, SPI/LSP items, and so forth). As a result, file deletion is performed correctly. Keepeng this mode enabled is recommended.

“Copy deleted files to ‘Infected’ folder” check box

The “Copy deleted files to ‘Infected’ folder” check box allows you to enable the backup copying of deleted files in the “Infected” folder. This folder is created automatically in the AVZ installation folder. AVZ incorporates a special viewer for viewing files in the “Infected" folder. You can open the viewer from the “File” menu.

“Copy suspicious files to Quarantine” check box

The “Copy suspicious files to Quarantine” check box allows you to enable the copying of suspicious objects to Quarantine. This is very convenient for subsequent submission of files for analysis, because AVZ copies suspicious files and supplies each file with summary data indicating file location on the disk, quarantine date and reason. You can use the quarantine view window to create a password-protected archive automatically and email it.


Log

AVZ Antiviral Toolkit keeps two logs:

· AVZ text log — Displayed in the lower part of the main application window. The text log contains various information describing the course of system scanning, and detection of errors and malicious files.
· Detected objects log — Click

in the pane to the right of the AVZ text log to access this log. It represents tables in a “file” – “description” format. The file description specifies the name of the virus or what caused the file to be considered suspicious. Each table row has a check box that lets you select the file. Selected files can be copied to quarantine or removed manually.

The text log can be filtered automatically. The filtration mode is controlled using the MiniLog command- line switch. Additionally, the data being logged can be simultaneously recorded in a text file. You control this mode using the SpoolLog key.


Database update

Database update

AVZ database updates are available starting with version 4.00 and can be performed via the Internet. To update the database, select "Database Update” on the "File” menu. The updates are downloaded from either of two sites: avz.virusinfo.info or z-oleg.com/secur. By default, the application selects the site randomly. However, you can specify the website address manually.

The database update process involves four operations:

1. Downloading the file with a description of the current status of the AV database.
2. Comparing the local PC database with the description.
3. In case of differences (due to new files having been added to the database, existing files updated, or corruptions detected in the existing database), the requisite files are downloaded.
4. Then downloaded files are checked and installed.

If the file download fails, all successfully downloaded files remain in the Temp folder and are not downloaded again during repeated update attempts.

By default, Internet Explorer settings are used when connecting to the Internet. However, in a number of cases (when Internet Explorer is not used as the default browser or when it is not configured) the Internet connection settings must be specified manually. To do so, click the button on the right of the “Settings” field to view the following settings dialog box:

In this dialog box you can specify one of the four operation modes:

• Use Internet Explorer settings. In this mode, all Internet connection settings are taken from Internet Explorer.
• Direct Internet connection. A direct Internet connection is established.
• Using anonymous proxy server. The Internet connection is established via a proxy server. In this mode in the “Proxy:port” field you must specify the name or IP address of the proxy server in the “name:port” format. For example, my_proxy:3128 or 192.168.0.1:8080.
• Using proxy server requiring NTLM authorization. Differs from the previous mode in that the proxy server requires you to specify credentials.

Selecting the “Save settings” check box saves your settings, allowing you to avoid configuring the Internet connection every time you launch AVZ. Settings are saved in the AVZ.INI file and loaded automatically the next time you run AVZ.

Note: When AVZ is used in a corporate network, the database can be updated from any address and with any parameters specified by the administrator. To do so, use the script containing the ExecuteAVUpdateEx command.


Delayed deletion of files

Delayed file deletion is a built-in AVZ function that is used by the scanner automatically to delete known malware. Delayed file deletion lets you delete files of running applications, downloaded DLL libraries or files opened with exclusive access.

AVZ performs delayed file deletion in two steps:

1. It attempts to delete files in the usual way. If this attempt is successful and the file is deleted, delayed file deletion is not applied.
2. If file deletion failed at Step 1, AVZ registers the file for delayed deletion.

Select the "Delayed file deleting" command on the "File" menu to perform delayed file deletion. A dialog box in which you enter the file name opens.

You can enter the file name manually, paste it from the clipboard, or select it using the dialog box that opens when you click the button on the right of the file name entry field. With the file name entered, click OK to delete the file or Cancel to close the dialog box without deleting the file.

Clicking OK opens a dialog box with file deletion settings.

AVZ supports two file deletion modes:

1. Common file deletion (performed when you select the “Delete files” option). Using this mode is not recommended.
2. File deletion and heuristic system cleanup. In this mode, in addition to deleting the file, AVZ performs automatic cleanup of autorun and a number of registry keys in which the deleted file could be registered (Winlogon, CLSID registration, Internet Explorer and Windows Explorer extensions, and so forth). The cleanup is performed automatically, making the deletion more thorough.

Selecting the “Copy deleted files to Quarantine” check box causes a copy of the file to be created in Quarantine before deletion.


Configuration profiles

AVZ lets you save settings as named configuration profiles. Profiles are text files containing parameters identical to those of the command-line parameters. After saving profiles, you can edit them manually.

To save current settings as a profile, click “Save setup profile” on the “File” menu. In the Save As window that opens, specify the file name and location. The file extension does not matter. However, the configuration profiles are saved in the PRF format by default.

To load a configuration profile, click "Load setup profile" on the "File" menu. Clicking this menu item opens a dialog box that lets you select the necessary profile file.

AVZ supports a default profile. This profile is loaded automatically upon AVZ startup and can be found in the AVZ working folder, named “avz.prf”.


Localization profiles

A localization profile is an INI file with an .loc extension located in the same folder as the avz.exe file. By default, its name is avz.loc. However, if avz.exe is renamed to gluck.exe, for example, the localization profile should be renamed symmetrically to gluck.loc. The profile contains the following sections:

[MAIN]—The section with main setting. It currently contains a single parameter, Lang=X, which is analogous to the corresponding command-line parameter (the command-line parameter takes precedence over “Lang” in the “Main” section).

[X] —Therecan be an unlimited number of such sections. X represents the name of localization, RU for Russian and EN for English. It contains the following parameters:

Font — Font name used in the given localization instead of the standard MS San Serif font.

· CharSet — Code page. RUSSIAN_CHARSET corresponds to 204, OEM_CHARSET – 255, ANSI_CHARSET – 0, DEFAULT_CHARSET – 1.
· ThreadLocale — If this parameter exists, SetThreadLocale command is called and the value specified in the ThreadLocale parameter is assigned to the given API function. See details, for example, at http://www.frolov-lib.ru/books/bsp/v27/ch4.htm. In particular, the value for the Russian language is 25.

Sample of the localization profile:

[Main]

Lang=RU

[RU]

Font=Arial

CharSet=204

The “Font” and “CharSet” parameters should be modified if there are problems when Russian text is displayed in a non-Russian Windows system.


Quarantine and the “Infected” folder

AVZ Antiviral Toolkit has two folders for storing copies of malicious files that have been deleted or removed: the “Infected” folder for infected files and the “Quarantine” folder for suspicious files, those have been found by the heuristic analyzer or quarantined by the user manually.

The Quarantine and Infected folders are managed identically and in a special viewing window that is opened from the “File” menu. To open the Quarantine folder in the window, click “Quarantine Folder Viewer” on the "File" menu. To open the Infected folder in the window, click “Infected Folder Viewer” on the "File" menu.

Further operations will be examined on the basis of the Quarantine folder.

A list of subfolders in the Quarantine folder appears on the left pane of the window. For the sake of simplicity, folders are named automatically using the YYYY-MM-DD mask, where YYYY represents the year, MM the month, and DD the day. Such folders are created automatically if and when necessary, and this structure significantly simplifies analysis of quarantined files. They are grouped by date of quarantine. The selected folder is highlighted.

Buttons under the list let you delete the current folder (“Delete folder” button) and clear the entire Quarantine (“Clear Quarantine” button). Clearing the Quarantine causes the removal of all files and folders in Quarantine.

When you select the folder on the left of the window, a list of quarantined files is displayed on the right. The list shows the full original name of each file, the reason for its placement in Quarantine (virus name, “suspected virus” message, information that the file was quarantined manually), the file name in Quarantine and its size.

You can select each file by selecting the check box next to its name. To select all files quickly, right-click the list to open a shortcut menu that lets you select all files, unselect all files, or invert selection.

A toolbar with buttons that let you perform operations on selected files is located above the file list.

Click “Delete” to delete selectively one or several selected files. This function is useful for Quarantine cleanup.

Click the “Export files to ZIP” button to create an archive with the selected files. The archive format is fully compatible with a ZIP archive and is automatically protected with the password “virus”. The password is useful when submitting files for analysis, since files without password protection can be blocked by email anti-virus applications. Files are archived by a compression tool built into AVZ (you do not need to install and configure such compression tools as WinZip for this function to work). If during archiving you specify the name of an existing zip-archive, the files are added to the existing archive. Therefore, when you need to place several files from different quarantine folders into a single archive, you can do so by specifying the same archive file in the “Export files to ZIP” dialog box.

Files in Quarantine (and, accordingly, in the archive) are renamed. File names are formed using the avzNNNN.dta convention, where NNNNN is the ordinal number of the file in the folder). For each avzNNNN.dta file, AVZ creates an avzNNNN.ini file containing the file description (original file name and location in the system, quarantine date and time, quarantine causes, and file size).

Click the “Add manually" button to open the Copy files to Quarantine by inputting their list dialog box.

Click the “Add automatically” button to open the Automatic copying to Quarantine dialog box.


Automatic Quarantining

Automatic Quarantining is a built-in AVZ service that automatically quarantines all files that AVZ does not recognize as system components listed in the Microsoft Security Catalog or trusted objects listed in the AVZ Trusted Objects Database. Automatic Quarantining is a very convenient for quickly assembling files on the computer being scanned so that they can be subsequently examined or scanned by several anti-virus applications in a stationary setting.

Automatic Quarantining can be started by clicking “Automatic Quarantining” on the “File” menu or by clicking “Add automatically” in the Quarantine Folder Viewer.

Check boxes in the Automatic Quarantining dialog box let you specify the file categories subject to quarantining. All categories are selected by default.

The Services and drivers category has an additional setting—by default, only active services and drivers are copied to Quarantine. However, you can use the drop-down list to select the "All services and drivers” mode.

Copying to Quarantine begins after you click “Start” and can continue for a long time. Depending on the specific configuration, presence or absence of an anti-virus monitor, and the computer processor capacity, Automatic Quarantining takes between 5-10 seconds and 2-3 minutes. A progress indicator shows the status of the analysis process.

Click “Close” to close the “Automatic copying to Quarantine” dialog box.


Adding lists of files to Quarantine

The service “Copy files to Quarantine by inputting their list” is convenient when you need to quarantine multiple files according to an existing list. To open the “Copy files to Quarantine by inputting their list” dialog box, click “Copy files to Quarantine by inputting their list” on the “File” menu or click “Add manually” in the Quarantine Folder Viewer.

Input the file list in the “File list" field, one file name per line. The mask characters “*” and “?” can be specified in file names. After entering the file list, click “Start” to copy specified files to Quarantine. The log of the file copying procedure appears in the “Log” field.


Registry Search

The Registry Search window includes a search pattern field. Use this field to enter the search pattern, such as the dll-file name or a fragment of the URL that has set itself as the default home page.

Click “Start” to launch the search process. The process itself can last for several minutes, with the search speed depending on computer performance, the number of registry keys, and the application settings. Click “Stop” to abort the search process.

“Log” tab

The “Log” tab contains a log of application operations. The log contains the keys found, service information, and detected keys information. You can copy the log to the clipboard to paste it on the forum site or email it. You can also save the log to a text file by clicking “Save log” on the “File” menu.

“Keys found” tab

The “Keys found” tab contains a table with a list of all keys found, sorted by key name. The table has three columns: “Key”, “Parameter”, and “Value”.

Each table row has a check box that lets you select the row.

There are two buttons under the table:

• “Export selected keys”. Click this button to create a standard reg-file to which the selected registry keys are exported. This function is useful for creating backup copies before deleting keys. It is important to note that only selected keys are exported to a file. If a selected key has settings or subkeys, all of them are exported. Use the Regedit program to perform full export of one or several keys.
• “Delete selected keys”. Click this button to delete selected keys (or key values). Exercise extreme care when deleting keys, because registry corruption can cause the system to crash. Therefore, unless you are certain as to the purpose of the keys being deleted, you must consult experts.

Right-click the table to open a context menu in which you can select all lines, unselect all lines, or invert selection.

“Search parameters” tab

This tab contains search and application settings.

• The “Search in hives” settings group lets you specify the registry branches that contain keys in which you want to perform the search.
• The "Search in” settings group lets you configure the search scope. By default, the search is performed on parameter names and values.


File Search

AVZ has a special built-in service function that is used for searching files on the disk. Click “File search” on the “Service” menu to start this function. File search using AVZ service has several advantages over system search as follows:

• The AVZ file search system is protected by a built-in AVZ rootkit block system. Essentially, this is the basic principle of AVZ’s built-in file search system. Many modern trojans mask memory processes and files on the disk. The masking is usually achieved by intercepting APIs. As a result, system search tools make it impossible to detect masked files on the disk (and, accordingly, make it impossible to copy them to be submitted for analysis).
• The file search system is connected with AVZ Quarantine; any files that are found can be quarantined.
• The search occurs regardless of the file extension, its location, or its attributes. System search tools often do not show all files during the search. This is especially important with regard to such system folders as Downloaded Program Files.

To perform the search, in the “Search scope” tree view select check boxes next to disks or folders you need. Right-click the tree view for quick selection of hard drives, floppy drives, and CD drives. After specifying the search scope, you have to specify the file name or mask. You can specify several file names or masks separated with a space, comma or semicolon. File names and masks can be combined.

Examples:

*.* – All files are searched.

*.exe – Files with the EXE extension are searched.

dialer.exe – A search is conducted for files that are named dialer.exe.

dialer.exe, *.dll, trojan*.sys – The application searches for files named dialer.exe, dll-files that have any name, and files named Trojan<any characters>.sys.

*.exe, *.dll, *.sys, *.ocx – The application searches for files with the specified extensions.

The mask can include the standard symbols “*” (the wildcard character replaces any number of any random characters) and “?” (the question mark replaces any random character in the specified position).

Example:

Trojan.ex? – The files Trojan.exe and Trojan.ex_ match this mask.

The mask is required (to search a file with any name, specify the mask *.*).

You can specify several search conditions besides a mask: size, date created, and date modified. To apply a search condition, select the relevant check box, select the condition type from the list of conditions, and enter the settings in fields. If you enter an invalid setting, it is underscored with a red wavy line, and the search is blocked. Pointing the mouse pointer to the invalid field displays a popup message that explains the cause of the error.

The filter option “Exclude files recognized as system or trusted” merits special attention. Selecting this check box means that every file that meets all the other search conditions is checked against the AVZ database of trusted and system files. Files identified as trusted when checked against the database are excluded from search results. As a rule, this considerably reduces the number of files found. This filtering mode is very convenient when scanning for viruses and spyware. You can specify the search mask "*.exe *.dll", designate a Windows folder, specify the range of dates (as a rule, it makes sense to look for files created in the last month or after the computer problems began), and select the option "Exclude files recognized as system or trusted".

Click the “Start” button to start the search. Click “Stop” to stop the search. The search results are logged on the Log tab and tabulated on the Files found tab. The table shows the basic settings of the files found, and any file can be selected by selecting the check box next to its name. You can copy the selected files to Quarantine or delete them (click the corresponding buttons under the list to perform the relevant operations).

Note: You can right-click the “Files found" tab and then select all the files found, unselect them, or invert the selection.


Cookies Search

Use “Cookies Search” to quickly analyze the content of cookies stored on the computer. This analyzer examines cookies stored by the Internet Explorer and Mozilla Firefox browsers. Click “Cookies Search” on the “Service” menu to open the Cookies Search window. This analyzer lets the user find out which websites save critical information in cookies. Consequently, rules that block cookies from such sites can be created.

A feature of the Cookies Search system is that it can run the search using several text patterns simultaneously, separated with a space or semicolon. The search factors in the fact that cookies can contain data in Base64, UUE, URL encoding, or quoted-printable (QP) formats. You can select the analyzed formats on the “Search parameters” tab. By default, the application tries to search all formats.

To run analysis, in the “Pattern" field, type fragments of the user’s email addresses used for signing in to websites, passwords, fragments of credit card numbers or other details that had been entered in web forms and the leaking of which poses a threat to the user. When entering search patterns, bear in mind that the application actually searches cookies for the patterns, which is why it often suffices to enter merely unique fragments. For example, “newvirus” instead of “newvirus@z-oleg.com” or the last 5 digits of the credit card number instead of the entire number.

After entering the patterns, click “Start” to run the search. The search may take some time, but usually no longer than 10-20 seconds. On completion of the search, on the “Log” tab the application generates a log listing the cookies containing the patterns entered.

On the “Cookies found” tab, you can view the list of cookies found. Click the “View text” button to open the contents of the selected cookie for detailed analysis.

Use the "Search patterns" tab to configure the search. The settings let you specify the types of browsers that store the cookies you want to analyze and types of encodings to be used when analyzing cookie contents.


Process Manager

AVZ has a built-in process manager for a manual search of spyware and trojans.

Click “Process Manager” on the “Service" menu to open it.

The AVZ Process Manager does the following:

• Shows the list of running processes. The list of processes is structured in different ways; in Windows NT, the list of native processes is created using built-in tools, with the help of Native API and the hidden processes search subsystem.
• Shows the list of libraries of each process.

The Process Manager computes MD5 checksums and collects additional information for all objects.

Another feature of AVZ Process Manager is that it can be used in the operation of the rootkit block system. As a result, the AVZ Process Manager is usually able to detect and stop processes masked by rootkits. In addition, if the AVZ Process Manager driver is installed in the system, the data that the driver collects is used by Process Manager, which among other things makes it possible to remove masked processes in KernelMode.

“Processes” tab

On the upper pane the “Processes” tab contains a list of processes. Details of a selected process are presented on tabs on the lower pane. Click the “Refresh” button to refresh the process list.

The “Terminate process” button lets you terminate the current process.

The “Copy to Quarantine” button lets you send a copy of the executable file of the selected process to the “Quarantine” folder. This button is available only if the file has not been found in the AVZ Trusted Objects Database.

The button “Copy to Quarantine all processes not recognized as trusted” lets you send to Quarantine the copies of executable files of all processes not found in the AVZ Trusted Objects Database.

“Save log” button

Click this button to generate an HTML log that is stored on the disk in the user-specified location (the log is saved via a standard Save As window). After the log has been saved, you are prompted to open it (it opens in the default browser).

“Parameters” tab

The “Parameters” tab contains the AVZ Process Manager settings:

• “Compute MD5 checksums for files” check box. Enabling this option activates the calculation of checksums for each file. This process is very resource-intensive, so it takes more time to update the list.
• “Check files against Trusted Objects Database” check box. Enabling this option activates the scanning of executable files and DLLs against the AVZ Trusted Objects Databases. Files recognized as trusted are highlighted in green while you are viewing them. This mode is useful for searching unrecognized processes and DLLs.

Context menu commands of “DLLs used” list

• “Copy to Quarantine”. Copies the selected file to Quarantine (trusted files are not copied to Quarantine).
• “Search Google”. Opens the default browser and sends it a URL string for running a Google search for the file name.
• “Search Yandex”. Opens the default browser and sends it a URL string for running a Yandex search for the file name.
• “Search Rambler”. Opens the default browser and sends it a URL string for running a Rambler search for the file name.
• “Search for the file name in the registry”. Opens the Registry Search window with the name of the selected file entered in the search pattern field.
• “Search for full file path in the registry”. Opens the Registry Search window with the full file path of the selected file entered in the search pattern field.
• “Unload DLL”. Unloads the selected module.

Note: In most cases, unloading a module results in a fatal error of the application from whose address space the DLL was unloaded. In fact, this application will encounter an error the first time the application attempts to call the function of the DLL that has been unloaded in this way.


Services and Drivers Manager

To enable a manual search for spyware and trojans, AVZ has a built-in Services and Drivers Manager. This manager runs only on Windows NT and later systems based on it: Windows 2000, XP.

The Services and Drivers Manager lets you:

• View a list of services and drivers with type (service, driver) and status (active, inactive) filtering.
• Stop and run services (or load and unload drivers).
• Copy files to Quarantine.
• Generate HTML logs.

A feature of the AVZ Services and Drivers Manager is that it can be used in the operation of the rootkit block system.

Click “Services and Drivers Manager” on the “Service" menu to open it.

Filter

The filter lets you manage the information displayed on data tabs. In the “Type” drop-down list select the object type (Service, Driver, All). In the “Status” drop-down list select the current status of the driver or service (Active, Not active, All). When you select the “Services (by registry analysis)” tab, status filtration becomes impossible, and the “Status” filter is automatically set to “All”.

Tabs

The window of the Services and Drivers Manager contains three tabs:

· “Services (by API data)”: Shows services and drivers based on data returned by API.
· “Services (by registry analysis)”: Shows services and (or) drivers based on data in the registry.
· “Parameters”: The Services and Drivers Manager parameters. This tab contains a single check box used to enable or disable file scanning against the AVZ Trusted Objects Database.

Control panel buttons

• “Refresh” button. Updates the list displayed. The list is refreshed automatically when filtering parameters change.
• “Save log” button. Click this button to generate an HTML log that is stored on the disk in the user-specified location (the log is saved via a standard Save As window). After the log has been saved, you will be prompted to open it (it opens in the default browser).
• “Copy to Quarantine”. Click it to copy the selected file to Quarantine. This button is available only for services and drivers not found in the AVZ Trusted Objects Database and the Microsoft Security Catalog.
• “Copy to Quarantine all services/drivers not recognized as trusted”. Click this button to copy to Quarantine all services and drivers that have not been found in the AVZ Trusted Objects Database and the Microsoft Security Catalog.
• “Start service (load driver)”. Click this button to start a service or load a driver.
• “Stop service (unload driver)". Click this button to stop a service or unload a driver.
• “Delete current service / driver”. Click this button to delete the selected service or driver from the list. (This action does not delete the file physically from the disk.)


Kernel Space Modules

The Kernel Space Modules Viewer serves to display modules loaded into the kernel space. Start the Viewer by clicking “Kernel Space Modules Viewer” on the “Service” menu.

The Kernel Space Modules Viewer lets you:

• View the list of modules and sort them by module name, base address, or size in memory.
• Copy to Quarantine modules those are not found in the AVZ Trusted Objects Database.
• Save the dump of any module for subsequent analysis.
• Generate HTML logs.

The Kernel Space Modules Viewer is connected to Automatic Quarantining, System Analysis, and the AVZPM system.


Winsock SPI (LSP, NSP, TSP) Manager

The SPI/LSP Manager lets you view lists of namespace service providers and transport service providers (TSP). You can delete any provider manually. For details on SPI/LSP/TSP/NSP providers, see the Local Service Provider (LSP/SPI) section.

The Winsock SPI Manager window contains three tabs:

• “Namespace providers (NSP)”. Lists libraries registered as NSP providers. For each library, the provider name, status, and full name of the executable file are displayed. You can copy files to Quarantine, or enable, disable, or delete them by using buttons under the list of providers.
• “Transport protocol providers (TSP, LSP)”. Identical to the previous tab, except that only the deletion operation is available for transport protocol providers.
• “Searching for errors”. This tab contains a list of errors in LSP settings, which have been detected during analysis of the settings. This tab includes the “Fix detected errors automatically” button. Click this button to start the automatic process of fixing settings errors.

Note: The error search may operate incorrectly when AVZ is launched from a terminal session.

The automatic fixing of errors can be enabled in the "Restore system settings" dialog box and by using the script language (see the AutoFixSPIcommand). Starting with version 4.26, AVZ automatically backs up settings in the BackUp folder before fixing errors. The backup copy is a standard REG file.


Open TCP/UDP ports

AVZ has a built-in manager that lets you view:

• Open TCP ports
• Active TCP/IP connections
• Open UDP ports

The name of the executable file is displayed for each open port (or connection). However, this feature is available for Windows XP and Windows 2003 only. Additionally, AVZ has a special database describing the purpose of the most widespread ports and the degree of their exposure to danger (dangerous ports are those used by network viruses, trojans and backdoors). An open port used by a dangerous application is highlighted in red, and the description states which malicious programs are able to use this port.

Besides the function that lets you view the list of open ports, AVZ has a built-in automatic check performed during system scanning. As part of this check, AVZ forms a list of open TCP and UDP ports and then compares this list to the database of ports used by trojans and network viruses. When matches are detected, warnings are recorded in the log, specifying the port number, its description, and application name (the application name is shown only in Windows XP and Windows 2003).


Autoruns Manager

The Autoruns Manager shows a list of applications and libraries that are loaded at system startup. The Manager lets you:

• View the list of autorun applications and startup methods.
• Temporarily disable autorun items.
• Delete autorun items.
• Copy files to Quarantine.
• Generate HTML logs.

The Autoruns Manager analyzer is connected to System Analysis and Automatic Quarantining.

The Autoruns Manager window is divided into two parts. The list of autorun categories (autorun folders, registry, Winlogon, MPR Services) is shown in the left pane tree view. To view a specific autorun group, select it in the tree view.


Internet Explorer Extensions Manager

The Internet Explorer Extensions Manager shows a list of extension modules connected to Internet Explorer. Extension modules are browser helper objects (BHOs) and various toolbars.

The Manager lets you:

• View the list of Internet Explorer extension modules.
• Temporarily disable extensions.
• Delete extension modules (the executable file is not deleted; only registration data is deleted from the registry).
• Copy files to Quarantine.
• Generate HTML logs.

The Internet Explorer Extensions Manager analyzer is connected to System Analysis and Automatic Quarantining.


Windows Explorer Extensions Manager

The Windows Explorer Extensions Manager shows a list of extension modules connected to Windows Explorer.

The Manager lets you:

• View the list of Windows Explorer extension modules.
• Temporarily disable extensions.
• Delete extension modules (the executable file is not deleted; only registration data is deleted from the registry).
• Copy files to Quarantine.
• Generate HTML logs.

The Windows Explorer Extensions Manager analyzer is connected to System Analysis and Automatic Quarantining.


Control Panel Applets (CPL) Manager

The Control Panel Applets Manager shows the list of CPL files. A CPL file is a dynamic library that exports certain functions for interaction with the control panel.

The Manager lets you:

• View Control Panel applets.
• Temporarily disable any of the applets.
• Delete applets (this causes the executable CPL file to be deleted).
• Copy files to Quarantine.
• Generate HTML logs.

The analyzer of the Control Panel Applets Manager is connected to System Analysis and Automatic Quarantining.


Printing System Extensions Manager

The Printing System Extensions Manager displays a list of extensions modules of the printing system. There are two kinds of extensions: print monitors and providers.

The Manager lets you:

• View the list of extensions modules of the printing system.
• Temporarily disable extensions.
• Delete extension modules (the executable file is not deleted; only registration data is deleted from the registry).
• Copy files to Quarantine.
• Generate HTML logs.

The analyzer of the Printing System Extensions Manager is connected to System Analysis and Automatic Quarantining.


Task Scheduler Jobs Manager

The Task Scheduler Jobs Manager displays tasks queued by the Task Scheduler or the AT command. Task analysis is useful because some spyware and trojan applications exploit the Task Manager to start themselves or a dropper that restores a deleted spyware component.

The Manager lets you:

• View the list of Task Scheduler jobs
• Remove tasks
• Copy files to Quarantine
• Generate HTML logs

The Task Scheduler Jobs Manager analyzer is connected to System Analysis and Automatic Quarantining.


Injected DLLs Manager

The Injected DLLs Manager lets you view a list of all external DLLs embedded into the AVZ process. AVZ displays additional information for every dll-file, in particular the degree of similarity to a standard interceptor, which is determined by the neural network. The color highlighting of the table is standard for AVZ. Libraries found in the Trusted Objects Database are highlighted in green.

The principal task of the analyzer is to search for the causes of program faults caused by the installation of certain hooks in the system. The analyzer shows all embedded DLLs, whereas the Trojan DLLs and Keylogger scanner shows only suspicious DLLs.

This Manager has the standard functionality of all AVZ managers: copying a selected file or all unrecognized files to Quarantine, and saving an HTML log.


Protocols and Handlers Manager

The Protocols and Handlers Manager shows a list of modules registered in the system as protocol handlers (for example, AP GZIP Encoding/Decoding Filter) or handlers (for example, ftp: Asynchronous Pluggable Protocol Handler or http: Asynchronous Pluggable Protocol Handler).

The Manager lets you:

• View a list of modules registered as handlers.
• Temporarily disable any of the handlers.
• Delete handlers (the executable file is not deleted; only registration data is deleted from the registry).
• Copy files to Quarantine (all unrecognized files can be copied automatically).
• Generate HTML logs.

The analyzer of the Protocols and Handlers Manager is connected to System Analysis and Automatic Quarantining.


Active Setup Manager

The Active Setup Manager shows a list of applications registered as Active Setup installations. Several malicious applications are known to use Active Setup registration for hidden autorun.

The Manager lets you:

• View the list of applications registered in Active Setup.
• Temporarily disable any of the applications.
• Delete Active Setup records (the executable file is not deleted; only registration data is deleted from the registry).
• Copy files to Quarantine (all unrecognized files can be copied automatically).
• Generate HTML logs.

The analyzer of the Active Setup Manager is connected to System Analysis and Automatic Quarantining.


Hosts File Manager

The Hosts File Manager lets you view the contents of the Hosts file and delete any of its strings. In addition to the possibility to delete strings in the Hosts file, there is a button that lets you clear this file, keeping only the "127.0.0.1 localhost" string. This is useful for a fast cleanup of this file after it has been corrupted by trojans.

The analyzer of the Hosts File Manager is connected to System Analysis.


Shared Resources and Network Sessions Manager

This manager performs functions identical to those of the native system utility called Network Inspector. The manager window contains three tabs: “Shared resources”, “Sessions”, and “Opened files”. Information on these tabs is updated automatically every 2 seconds.


System Analysis

System Analysis is a function that lets you analyze the system and generate an HTML protocol that helps detect suspicious files and programs. System Analysis can be used for a quick system analysis and subsequent submission of the log to be analyzed by virus experts.

Click “System Analysis” on the “File” menu to start System Analysis by. The “Results of system analysis” dialog box opens.

Check boxes let you specify what data you want to be collected during System Analysis. By default, all check boxes are selected and maximum data is collected.

System Analysis is influenced by the antirootkit function (because disabling of hooks can cause data masked by a rootkit to be displayed) and by the presence of the AVZPM system advanced monitoring driver in the system.

Group of settings “System areas to be analyzed”

“Running processes” check box

If this check box is selected, a table with the list of processes is included in the System Analysis log.

“DLLs” check box

This check box is available when the “Running processes” check box is selected. If this check box is selected, a table with the list of DLLs used by running processes is included in the System Analysis log. Two kinds of lists are supported: “List of DLLs for each process” and “Process list and DLLs list separately”. The latter is the default option, because the separate DLLs list without repetitions is much more compact (this list contains a column listing PIDs of processes that use the DLL).

“Services and drivers” check box

If this check box is selected, a table with the list of services and drivers of the computer being analyzed is included in the System Analysis log. This function is not supported in Windows 9x.

“Kernel Space Modules Viewer” check box

If this check box is selected, a table with the list of kernel space modules is included in the System Analysis log. This function is not supported in Windows 9x.

“Autoruns" check box

If this check box is checked, a table with the list of autorun applications is included in the System Analysis log. The notes for every autorun item specify how the item is started.

“SPI/LSP settings” check box

If this check box is selected, a table with a list of SPI extension modules (NSP and TSP providers) is included in the System Analysis log.

“TCP/UDP ports” check box

If this check box is selected, a table listing open TCP/UDP ports is included in the System Analysis log (in Windows XP and Windows 2003, information about the application listening on the port is shown).

“IE extensions (BHOs, toolbars…)” check box

If this check box is selected, a table with the list of Internet Explorer extension modules (BHOs, toolbars, etc.) is included in the System Analysis log.

“Windows Explorer extension modules” check box

If this check box is selected, a table with a list of Windows Explorer extension modules (explorer.exe) is included in the System Analysis log. Windows Explorer extension modules are registered in the system registry. There are malicious programs that register themselves as a Windows Explorer extension in order to hide their startup.

“Printing system extensions (print monitors, providers)” check box

If this check box is selected, a table with a list of printing system extension modules (print monitors, providers) is included in the System Analysis log. The extension module is an ordinary DLL library, and there are a number of trojans that exploit this autorun method.

“Parameters” group

“Do not report in the log files recognized as trusted” check box

If this check box is selected, all files found in the Trusted Objects Database are excluded from the System Analysis log. In most cases, enabling this option causes a significant reduction in log size and simplifies log analysis.

“Add text log of the latest AVZ scanning” check box

If this check box is selected, the System Analysis log is supplemented with the current AVZ log generated during the latest scanning. Enabling this option is convenient when you need to submit a log together with the System Analysis results.

“Add System Analysis log to ZIP” check box

When this check box is checked, a ZIP archive containing the analysis log is created in addition to the System Analysis log. This option is convenient when you need to email the log or post it to a forum.

“Add interactive script-generating items to the log” check box

If this check box is selected, the log is supplemented with interactive tools that let you create scripts in a semiautomatic mode. Please note that when this log is opened in Internet Explorer, you may see a security system message to the effect that the document contains active elements. If you do not allow active elements, the log will open, but the interactive functions will be unavailable.

“Create XML log for automatic analysis” check box

When this check box is selected, the application creates an XML file that duplicates the HTML log. The XML file is intended for automatic log analyzers.

“Start” button

Click the “Start” button to launch System Analysis. Before System Analysis is started, you will be prompted to specify the log file name for saving the log. After you have specified the file name, System Analysis is carried out, a log file is generated, and you are prompted to view the log. If you agree, the log opens in the default browser.

“Close” button

Click this button to close the System Analysis window.

Note:

Note that a running anti-virus monitor may slow down System Analysis so that it may take anywhere from 1-2 to 5 minutes. Usually it does not take more than 30 seconds to generate the log. You can view a progress indicator in the lower part of the window while the analysis is in process.

Note:

Before starting System Analysis, it is recommended to perform the following:

1. Close all unused programs.

2. Open the browser. This enables the analyzer to examine libraries loaded in its address space.

While System Analysis is running, it is not recommended to perform starting or closing programs, or use the system in any way, as this may affect analysis results.


System Restore

System Restore is a special AVZ function that restores a number of system functions corrupted by malware.

System Restore microprograms are stored in the anti-virus database and updated as and when necessary.

The database currently contains the following microprograms:

1. Restore startup parameters for .exe, .com, .pif files

This microprogram restores system response to exe, com, pif, scr files.

When to be used: Programs have stopped starting since a virus was removed.

2. Reset Internet Explorer settings of protocol prefixes

This microprogram restores Internet Explorer settings of protocol prefixes.

When to be used: When you type in an address such as www.yandex.ru, it is substituted with an address of the following kind: www.seque.com/abcd.php?url=www.yandex.ru

3. Restore Internet Explorer start page

This microprogram restores the start page in Internet Explorer.

When to be used: The start page has been substituted.

4. Reset Internet Explorer search settings

This microprogram restores the search settings in Internet Explorer.

When to be used: When you click “Search” in Internet Explorer, the browser accesses some unwanted website.

6. Delete all current user Policies

Windows has a mechanism for limiting user actions, which is called Policies. This technology is exploited by many malicious programs, since settings are stored in the registry and are simple to create or modify.

When to be used: Windows Explorer functions or other system functions have been blocked.

7. Delete Winlogon message

Windows NT and later systems in the Windows NT line (2000, XP) let you specify the message to be displayed at startup. This is exploited by a number of malicious programs. Notably, removal of the malicious program does not remove this message.

When to be used: An unwanted message is displayed on system startup.

8. Restore Windows Explorer settings

This microprogram resets a number of Windows Explorer settings (settings modified by malware are reset first).

When to be used: Windows Explorer settings have been changed.

9. Delete all system process debuggers

Registering a system process debugger makes it possible to perform a hidden launch of an application. This is exploited by a number of malicious programs.

When to be used: AVZ has detected unrecognized system process debuggers. Problems arise when starting the system components, in particular, the desktop, disappears after reboot.

10. Restore SafeBoot registry keys

Some malicious programs, such as the Bagle worm, corrupt SafeBoot settings of the system. This microprogram restores the SafeBoot settings.

When to be used: The computer cannot be started in SafeBoot mode. Use this microprogram only when you are experiencing problems with system startup in SafeBoot mode.

11. Unlock Task Manager

Malicious programs lock the Task Manager to protect their processes from detection and removal. Using this microprogram removes the lock.

When to be used: The Task Manager has been locked. When you attempt to run the Task Manager, a message appears: “Task Manager Locked by Administrator”.

12. Clear HijacThis ignore list

The HijackThis utility stores a number of its settings in the registry, in particular the exclusions list. This is a malicious program need only register its executable files in the exclusions list in order to hide from HijackThis. A number of known malicious programs exploit this vulnerability at present. This AVZ microprogram clears the exclusions list of the HijackThis utility.

When to be used: Suspicions that the HijackThis utility does not display all system information.

13. Clear Hosts file

Clearing the Hosts file entails locating the Hosts file, removing all meaningful strings from it, and adding the standard string "127.0.0.1 localhost".

When to be used: Suspicions that the Hosts file has been modified by a malicious program. Typical symptoms: blocking of anti-virus application updates. You can control the contents of the Hosts file by using the Hosts File Manager built into AVZ.

14. Correct SPI/LSP settings automatically

This microprogram analyzes SPI settings and, upon detecting errors, corrects the errors automatically. This microprogram can be launched repeatedly an unlimited number of times. It is recommended to reboot the computer after running this microprogram. Please note: this microprogram must not be launched from the terminal session.

When to be used: Removal of a malicious program resulted in the loss of the Internet connection.

15. Reset SPI/LSP and TCP/IP settings (XP+)

This microprogram runs on Windows XP, Windows 2003 and Vista only. The principle of its operation involves resetting and recreating SPI/LSP and TCP/IP settings using the native Windows utility called “netsh”. For details on the resetting of settings see the Microsoft Knowledge Base: http://support.microsoft.com/kb/299357 Please note: Reset settings only if necessary, when removal of malware has resulted in problems with Internet access that cannot be resolved.

When to be used: Removal of a malicious application resulted in the loss of Internet access, and the microprogram “14. Correct SPI/LSP settings automatically” proved ineffective.

16. Restore Explorer startup registry key

This microprogram restores system keys of the registry responsible for Windows Explorer startup.

When to be used: Windows Explorer does not load on system startup, but explorer.exe can be launched manually.

17. Unlock Registry Editor

This microprogram unlocks the Registry Editor by removing the policy that prevents it from starting.

When to be used: You are unable to start the Registry Editor. Attempts to do so result in messages to the effect that the Registry Editor launch has been blocked by the administrator.

18. Reset SPI settings

This microprogram backs up SPI/LSP settings, deletes them and then recreates them using a template stored in the database.

When to be used: Severe corruption of SPI settings could not be fixed by scripts 14 and 15. Use only when necessary.

19. Clear MountPoints & MountPoints2 keys

This microprogram clears the MountPoints and MountPoints2 database in the registry. This operation can often help when disks do not open in Windows Explorer after infection with a Flash virus.

To perform restoration, check one or several items and click “Execute selected operations”. Clicking OK closes the dialog box.

Note: System Restore is useless when the system is infected with a trojan that is corrupting settings. Remove the malicious program before restoring system settings.

Note: Removing traces of most hijackers requires running three microprograms: “Reset Internet Explorer search settings”, “Restore Internet Explorer start page”, and “Reset Internet Explorer settings of protocol prefixes”.

Note: You can run any microprogram multiple times in a sequence without damage to the system. Exceptions: ”5. Restore desktop settings” (this microprogram resets all desktop settings, so you will have to choose the desktop background color and wallpaper again) and “10. Restore SafeBoot registry keys” (this microprogram recreates registry keys responsible for system startup in SafeMode).


Standard scripts

Standard scripts

Standard scripts are designed for automating the main AVZ operations. They are stored in the AVZ database and updated during the automatic update. Click “Standard scripts” on the “File” menu to open the “Standard scripts” dialog box.

To execute one or several standard scripts, select them in the list and click “Execute selected scripts”. The window can be closed only after the last of the selected scripts has been executed. It is needed to block AVZ controls for the duration of standard script execution.

Click “Stop” to perform an emergency stop of the script execution process. Note that the script will not be stopped instantly. Several seconds may elapse after you click the button. This is normal, because some operations cannot be stopped while they are running.

The following operations are currently supported:

1. “Detect and block UserMode and KernelMode hooks”. AVZ runs a rootkit search and blocks all hooks detected.

2. “Advanced System Analysis”, a script collecting data for the Help section on virusinfo.info. This script scans the computer (without repairing) and analyzes the system, after which it creates a LOG folder in the AVZ working folder and copies the log and archive with suspicious files into it.

3. “Advanced System Analysis with malware removal mode enabled”, a script collecting data for the Help section at virusinfo.info. This script scans and repairs the computer and analyzes the system, after which it creates a LOG folder in the AVZ working folder and copies the log and archive with suspicious files into it. 4. “Collecting unrecognized and suspicious files”. This script performs two operations: system scanning with the quarantining of all suspicious files and automatic quarantining with maximum settings. As a result, files found to be suspicious by AVZ or not found in the Trusted Objects Base end up in Quarantine.

5. "Update signature database (default settings). This script updates the database using different settings. This operation is useful when the standard update method fails and an error message is returned.

6. “Delete all AVZ drivers and registry keys”. This script automatically deletes all drivers and registry keys that may have been created in the process of AVZ operation. This is not normally required, because AVZ automatically removes keys and files installed in the system. It is equivalent to toolkit uninstallation and is recommended after you finish using AVZ.

The scripts have unique numbers that do not change following database updates. You can access standard scripts from the user scripts using the ExecuteStdScr function.


Backup

Starting with version 4.16, AVZ supports three types of backup:

• Automatic backup. AVZ performs it automatically when necessary during certain operations, such as changes to LSP settings, file startup settings, security policies, and Internet Explorer and Windows Explorer settings. They are backed up to the Backup\DD-MM-YYYY folder.
• Manual backup. Click “Backup” on the “File” menu to perform it. Backup results are also stored in the Backup\DD-MM-YYYY folder.
• Script-controlled backup. In this case, backup results can be stored in Backup\DD-MM-YYYY folder or in any other folder chosen by the script author.

Click “Backup” on the “File” menu to start the backup dialog box.

To perform backup, select one or several items in the list and click "Start Backup". Click "Stop" to abort the backup process. Backup procedures are stored in the updatable database, which is why the list of settings that can be backed up may be expanded. Following backup, it is recommended to store files created by AVZ in a safe place.

You can restore backup copies by launching the corresponding reg-file. After you do this, the system will prompt you to import the contents of the reg-file into the registry.


Troubleshooting wizard

The troubleshooting wizard is designed to perform automatic system analysis, detect errors and anomalies that can be fixed, and fix them. The troubleshooting wizard is in many ways similar to the AVZ System Restore function. Its principal difference from System Restore is that it searches for problems automatically (in the case of System Restore, the user has to decide which restoration functions to use) and fixes problems in a more precise and flexible manner.

Click "Troubleshooting wizard" on the "File" menu to open dialog box.

To start using the wizard, select the issuetype. Supportedissue types are as follows:

• "System issues”. These include all kinds of registry errors or keys created or modified by malware to disrupt or restrict system functionality.
• “Browser tweaks and settings”. The wizard analyzes browser settings, looks for dangerous settings (such as permission to load ActiveX without asking the user), or suggests changes to settings in order to improve browser safety.
• “Privacy”. The wizard runs a system cleanup to remove traces of user activities (temporary files, cookies, browser cache and logs, all kinds of protocols).
• “System Cleanup”. This category is available in AVZ starting with version 4.32. Its purpose is to locate and remove all kinds of trash: temporary files, protocols, memory dumps, caches. The wizard supports all modern browsers: Internet Explorer, FireFox, Google Chrome, and Safari.

After selecting theissue type, proceed to select the problem danger level. The wizard supports three danger levels: ranging from minor issues to most dangerous issues. Essentially, the danger level is the triggering threshold of the analyzer.

After selecting the danger level, click “Start” and wait for analysis to be completed (the progress indicator in the lower part of the window shows how the process progresses). Issues detected and recommended operations are shown in the form of a list where you can select one or several items. To fix issues, select one or several items on the list and click “Fix selected issues”.

Fixing some settings can adversely affect system performance. For this eventuality, the troubleshooting wizard has a data backup function that enables you to undo changes. To undo changes, select the issue type and proceed to the “Undo changes” tab. This tab shows the undo list. To undo changes, select one or several items and click “Undo selected changes”.

Note: Only registry changes can be undone. Deletion of files (such as cookies or browser caches) cannot be undone.

Note: Rollback system stores changes database in the BackUp folder. If this folder is read-only, the troubleshooting wizard will work successfully, but data for undoing changes will not be stored. When using the troubleshooting wizard to remove private data, also remember to delete the database of the changes rollback system.


About technology

The AVZGuard technology is based on a KernelMode driver that determines how running applications can access the system. The driver runs under systems on the Windows NT platform (starting with NT 4.0 and ending with Vista Beta The AVZGuard technology main purpose is fighting hard-to-remove malware that actively resists the repair process.

Upon activation, all applications are divided into two categories: trusted and untrusted. The driver does not affect trusted applications in any way, while prohibiting untrusted applications from performing the following actions:

• Creating, modifying and deleting registry parameters.
• Creating files with *.exe, *.dll, *.sys, *.ocx, *.scr, *.cpl, *.pif, *.bat, and *.cmd extensions on any disk.
• Accessing \device\rawip, \device\udp, \device\tcp, \device\ip devices.
• Accessing device\physical memory (which blocks operations with the physical memory from UserMode).
• Installing drivers (as a consequence of blocked registry operations).
• Starting processes.
• Opening running processes with a level of access that allows stopping the process or saving data in its address space.
• Opening streams of other processes (at the same time, the untrusted process is not prohibited from opening or stopping its own streams).

Originally AVZ is the only trusted application. However, you can run any application from the “AVZGuard\Run application as trusted” menu. Applications launched in this way acquire trusted status. By default, the principle of trust inheritance applies to trusted applications: all processes launched by trusted applications are also considered to be trusted.

Purpose:

Main system purposes:

• Fighting hard-to-delete trojans that restore registry keys and deleted files, restart terminated processes, or otherwise resist being removed. This is the primary role of the system.
• Protecting trusted applications from untrusted applications. This function protects AVZ and trusted applications launched by it from the influence of running malicious programs.
• Spreading the effect of the AVZ UserMode antirootkit to other processes. Examples: VBA Console scanner, DrWeb Cure IT, HijackThis, and similar utilities do not have rootkit detection and block functions. In this case you can run AVZ, block rootkits affecting its process, and then enable AVZGuard run DrWeb Cure IT as a trusted application. In this case the AVZGuard driver provides protection for the running process, in particular by preventing the rootkit from modifying the process. Naturally, this technology is not a cure-all for all kinds of UserMode rootkits. Yet the major types of rootkits (in particular Hacker Defender) can be blocked in this way.

Recommendations:

• Shut down all applications except AVZ before starting the AVZGuard system. This is important, because all applications running at the time of AVZGuard startup will be considered untrusted, which may block their operation. In reality, it has been proven experimentally that most applications remain functional, because they do not perform actions blocked by the AVZGuard system. In particular, Internet Explorer, Outlook Express and The Bat continue to work normally with the status of untrusted processes.
• A feature of the function that blocks operations with the registry is that while the operation is blocked the application still receives the status of a successfully completed operation and believes that the registry has been changed. This has been done specifically to ensure compatibility with a number of applications that start to malfunction in case of an error writing to registry. The logic of this block can be easily explained with the help of the Regedit application: Start Regedit before running AVZGuard, then disable AVZGuard and use Regedit to edit any registry key. From the viewpoint of Regedit the operation is successful. However, if you update data by pressing F5, you will see that the registry has not changed.
• If system repairs have been performed, reboot the system without disabling AVZGuard. This is important, because malicious DLLs may be loaded in the system and trojan streams and the like may continue to run after system repairs.
• AVZGuard is controlled from the context of the AVZ toolkit. Terminating AVZ causes control over AVZGuard to be lost, and AVZGuard will continue to operate autonomously until reboot.
• You can enable or disable the AVZGuard system repeatedly in the process of using AVZ as and when you need to limit the operation of running processes.

Specifics of shutting down the PC with AVZGuard enabled

• When AVZGuard is active, system shutdown and reboot may take up to 2-3 minutes. This is due to the fact that the system is unable to force the processes closed.
• Upon termination, certain applications may return error messages associated with restrictions on their operations.
• AVZ itself cannot be closed by using Alt-F4 or the button in the window header. To exit AVZ with AVZGuard running, click “Exit” on the “File” menu.

Different applications can behave unpredictably when AVZGuard is active. Therefore it is strongly recommended to exit all applications before turning on AVZGuard, and reboot computer after repairing the system using AVZGuard. Notably, AVZGuard is not a proactive defense system or anti-virus monitor. You should activate it only while attempting to delete hard-to-remove malware.


System control

The AVZGuard system is controlled from the main menu.

Enabling AVZGuard

Click “Enable AVZGuard” on the AVZGuard menu to enable the system. A dialog box reporting successful activation or an error is displayed. The “Enable AVZGuard” item on the menu becomes unavailable after AVZGuard has been launched.

Running trusted applications

Click “Run application as trusted” on the “AVZGuard” menu to launch the selected application as trusted. AVZGuard restrictions do not apply to a trusted application, while the AVZGuard driver protects the trusted application from removal or modification. The application is started from a specialized dialog box.

If the application you are trying to run is stored in a system folder or the path to the application is specified in the PATH field, you can specify only the name of the executable file. The “Command line” field lets you specify the command line of the application you are launching (optional). The button on the right of the “Application” field opens the standard file selection dialog box.

Disabling AVZGuard

Click “Disable AVZGuard” on the "AVZGuard” menu to disable the AVZGuard system. The application will request your confirmation before disabling AVZGuard. After AVZGuard has been disabled, all running applications recover full control of the system, and the driver is unloaded.

Adding a running process to the list of trusted processes

AVZGuard allows adding a running process to the list of trusted processes. This operation is not recommended, because a process launched before activation of AVZGuard may contain trojan streams or rootkit hooks. If still required, this operation can be performed in the AVZ Process Manager: When AVZGuard is enabled, the context menu of the process list contains an item "AVZGuard - trust this process".

Enabling AVZGuard upon AVZ startup

If the system has been infected with a malware program that prevents the operation of AVZ, it is recommended to enable AVZGuard using the command line key “AG=Y”. This key is analyzed at the moment of AVZ startup, before AVZ working windows have been initialized.

Script-enabled control

The functions SetAVZGuardStatus and GetAVZGuardStatus are designed for controlling the AVZGuard subsystem from scripts.


AVZGuard and antirootkit

After AVZGuard is enabled, the KernelMode antirootkit is blocked, and the UserMode antirootkit continues normal operation. A feature of AVZGuard is that it can propagate the effect of the UserMode antirootkit to other processes. Follow this procedure to use this feature:

1. Close all applications.
2. Start AVZ, enable the UserMode and KernelMode rootkit block, and repair the system.
3. Enable AVZGuard (this automatically disables the KernelMode antirootkit).
4. For greater reliability, repair the system again (this essentially means making sure that all UserMode hooks have been removed from AVZ).
5. Use the “AVZGuard\Run application as trusted” menu to run any application you want to launch in rootkit-safe mode. With a high degree of probability, an application launched in this way will not be corrupted by a rootkit.

This feature is useful for running, according to the algorithm described earlier, anti-virus applications that do not block rootkits. It has been experimentally proven that this sequence will let you neutralize HackerDefender and equivalent UserMode rootkits.


About technology

AVZPM technology is based on a KernelMode Boot driver that keeps track of processes started and drivers loaded. The driver was written in strict compliance with MSDN and Microsoft recommendations to reduce its impact on the system and the possibility of conflicts with other anti-virus software.

Purpose:

• Μonitoring of process start / termination.
• Monitoring of driver loading / unloading.
• Keeping lists of processes and loaded kernel space modules that are independent of system modules.

Various AVZ systems use the information collected by this driver:

• The antirootkit uses it during system scanning. If a monitoring driver is available in the system, the data collected by the driver is used to search for hidden processes and drivers as well as distortions in system structures (PID spoofing, module name modification, and so forth).
• The AVZ Process Manager uses data received from the driver to show hidden processes.
• The Kernel Space Modules Viewer uses data received from the driver to show hidden drivers.
• System Analysis uses data received from the driver while generating a log of drivers and kernel space modules.

Using this driver is an effective and documented way to fight many DKOM rootkits. The major challenge in fighting a DKOM rootkit is that it modifies system structures in the memory and feeds false and invalid data into them. A classic example is modification of the process name and PID in the EPROCESS structure, which is practiced by many DKOM rootkits. As a result, while you can succeed in detecting a hidden process, you will be unable to determine where it was started from, what the name of the executable file is, and what the actual PID of its process is. The same is true of drivers: while it is easy to detect a hidden driver in the memory, it is virtually impossible to find out its name, because a properly written rootkit will simply destroy this information in the process of masking the driver. The driver that monitors system events solves this problem: the analyzer is able to rely on its own data, not the data corrupted by a KernelMode rootkit.

Compatibility

The monitoring driver can be used in combination with the antirootkit and the AVZGuard system, and also with third-party anti-virus monitors and HIPS systems.


System control

Installing and enabling AVZPM

To enable AVZPM, click “Install extended monitoring driver” on the "AVZPM” menu. Clicking this item will cause the monitoring driver to be installed in the system, registered in the registry, and loaded. The driver starts operating as soon as it is loaded. However, a reboot is required to get a full picture of all running processes.

After the driver has been installed (or detected upon subsequent launches of AVZ), the menu item “Install extended monitoring driver” will be grayed out automatically, and the menu item “Delete extending monitoring driver” will become active.

Uninstalling and disabling AVZPM

To disable AVZPM, click “Delete extended monitoring driver” on the "AVZPM” menu. Clicking this menu item causes the driver to be unloaded, its keys to be removed from the registry, and its file to be deleted from the disk. Stopping the monitor and unloading the driver may take several seconds. No reboot is required after deleting the driver.

After the driver has been deleted, the menu item “Delete extended monitoring driver” will be grayed out automatically.

Script-enabled control

The functions SetAVZPMStatus and GetAVZPMStatus are designed for controlling the AVZPM subsystem from scripts.


About technology

The Boot Cleaner technology is based on the KernelMode Boot driver that carries out the specified sequence of operations at system startup. The driver self-destructs after performing the specified operations. Its main purpose is fighting hard-to-delete malicious programs that recreate their registry keys and files or block access to them. The Boot Cleaner driver is located in the AV database and is updated during the automatic update.

Purpose:

• File deletion.
• Registry key deletion.
• Driver and service deletion.

The operations listed are performed at system startup.

Boot Cleaner is an alternative to the delayed deletion function for a number of reasons:

1. Boot Cleaner supports the keeping of logs. The log records all operations and the status code (0 - successful, >0 - error code).

2. The Boot Cleaner scenario is performed at the early stage of system loading, making it more effective.

3. Boot Cleaner can delete registry keys (and drivers and services in particular), whereas delayed deletion lets you work with files only.

Compatibility

The Boot Cleaner driver can be used in combination with the antirootkit, the AVZGuard and AVZPM systems, and with third-party anti-virus monitors and HIPS systems.

System control

The system is controlled by means of AVZ script language resources.

The Boot Cleaner control section provides a detailed description of the set of commands and usage examples.

Logs

Boot Cleaner can generate text logs during its operation. The user specifies the log name and location using a command. Consider a sample script (at the time when the script is executed, the PE386 driver is installed and the following file exists in the Windows folder: trojan1.exe):

begin

// Task setting

BC_DeleteSvc('PE386');

BC_DeleteFile('%Windir%\trojan1.exe');

BC_DeleteFile('%Windir%\trojan2.exe');

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Activation

BC_Activate;

// Rebooting

RebootWindows(true);

end.

The following log is generated after the reboot:

-- AVZ Boot cleaner log --

DeleteFile \??\C:\WINDOWS\trojan1.exe - succeeded

DeleteFile \??\C:\WINDOWS\trojan2.exe - failed (0xC0000034)

Delete File \??\C:\WINDOWS\system32:lzx32.sys - succeeded

Delete Service & File PE386 - succeeded

-- End --

The log structure is quite simple: Each string specifies the operation, the name of the object processed during the operation, and the status. Two statuses are possible:

· Succeeded—The operation is successful
· Failed (0xNNNNNNN)—Errors were encountered during the operation, with the error code shown in brackets

Boot Cleaner lets you remove services and drivers the names of which contain characters with code 0 and any Unicode characters. When the log is generated, the character with code 0 is replaced with a wildcard character (*), and characters without equivalents in ANSI Unicode are replaced with a questions mark (?).

Deleting files, registry keys, drivers, and services using Boot Cleaner can cause significant damage to the system. Therefore, use Boot Cleaner only if you are certain that you know what you are doing.


Disk Inspector

The disk inspector built into AVZ follows a classic scenario and performs two operations:

• Examining the files stored on the disk and creating a database containing information about these files.
• Comparing the current disk status with the database. Detailed comparison makes it possible to detect the files or folders that have been created, modified or deleted since the database was created.

The inspector can perform comparison in standard mode (comparing the file size and checksum) and in quick mode (only the file size is compared). Quick mode is convenient for quick disk checking.

Features:

The AVZ disk inspector has several features that distinguish it from similar solutions:

1. The database can be located on any medium and stored anywhere (for example, on a flash disk or in a network folder). Such mobility is achieved by storing all settings needed for comparison in the database.

2. An unlimited quantity of bases can be created for one computer: multiple snapshots of the disk made at different times or with different settings.

3. Once formed, the database is compressed to save space. The database with the results of analysis of the Windows folder in Windows XP takes up approximately 60 KB of disk space, and 50-150 KB on an actual system (averaging at 10 KB of database per 1,000 files). The compact size of the database allows it to be stored on a flash disk.

4. The AVZ disk inspector is connected with the Trusted Objects Database, making it possible to exclude from the comparison log the files identified as being in the AVZ Trusted Objects Database or the Microsoft Security Catalog.

5. The disk inspector is protected by the built-in AVZ antirootkit.

Purpose:

Main purpose of the disk inspector:

1. Searching for modifications on the disk of the protected computer. It lets you determine which files were created, modified, or deleted since the reference database was created. It also registers the instances of folders being created or deleted.

2. Searching for files masked by a rootkit. To perform this operation do the following:

2.1. Create the disk inspector database and include in it the system folder and folders that can potentially contain rootkits. (You can create the database in quick mode to save time).

2.2. Scan the computer with antirootkit enabled.

2.3. Without leaving AVZ, compare the current status with the database created in step 2.1.

3. Creating the contents of a specific folder on two identical computers.

Uses:

1. Periodic inspection of the PC status. This requires creating a system disk database and storing it in a safe place. Afterwards you can compare the current disk status with the database at certain intervals.

2. Rootkit search.

3. Keeping track of changes on PCs of users in a corporate network. In this case the disk inspector databases can be stored centrally either on the server or on the PC of the administrator.


Database creation

To create the database, open the Disk Inspector dialog box by clicking “Disk Inspector” on the "File" menu, and proceed to the "Create database" tab.

The "Search scope” folders tree lets you specify the folders you want to be examined during database creation. By default, the system folder is selected. You can select several folders or the entire disk (or several disks). In doing so, bear in mind that the size of database file and analysis duration directly depend on the number of files analyzed.

In the “File” field, type the name for your database file. By default, the file path points to the “Revizor” folder in the AVZ installation folder, and the name is created from the current date, but you can change this.

“DB creation mode” options

This is a very important option that affects database creation. Two modes are supported:

• "Standard”. This mode is enabled by default. In this mode, the disk inspector calculates the checksum for every file it analyzes. This is a rather lengthy operation. However, the availability of the checksum makes it possible to register changes to the file contents. Besides the checksum, the database stores the file size, its attributes, date, and time.
• “Quick”. In quick mode, only the file size, file attributes, date, and time are recorded. The checksum is not computed. Although this speeds up database creation by 2 or 3 times, you will not be able to keep track of file changes that did not result in file size changes. This mode is recommended for quick analysis only.

“File types” options

The “Potentially dangerous files” option is selected by default. In this case, the Disk Inspector checks only files that have specific extensions (EXE, DLL, OCX, SYS, CAB, INF …), that is, executable files or files that can contain malware installation data or dangerous scripts.

If you select “All files”, the Disk Inspector checks absolutely all files regardless of their extensions. In this mode, the “Include files matching the template” check box is unavailable, because this option is pointless in this case. It is not recommended to select “All files” unless absolutely necessary, as this will slow down database creation and increase its size.

If you select “Files matching user-defined templates”, the application runs the search only using file masks specified in the "Include files matching the template” and “Exclude files matching the template” fields.

“Include files matching the template” check box

The “Include files matching the template” check box lets you include files matching the user-defined mask in the search. This option is pointless in “All files” mode, which is why this check box is automatically unavailable and grayed out when this mode is selected.

“Exclude files matching the template” check box

The “Exclude files matching the template” check box lets you exclude files matching the user-defined mask from the search. This option can be used together with the “Include files matching the template” option or the “All files” mode. Specifying the same items in the inclusion and exclusion lists is not an error. Exclusions take precedence over inclusions. For example, if you specify *.vir files in the inclusion list and *.vir files in the exclusion list at the same time, the exclusion will prevail. Also, an exclusion with a more general file mask prevails over inclusions. For example, if you include trojan*.exe in the search and exclude *.exe files, the file named trojan.exe will be excluded from the search.

Note: Mask fields can contain several masks separated with a comma, space, or semicolon. A mask can include the question mark "?" (any character in the position of the question mark) and asterisk "*" (any characters).

*.* – All files are searched.

*.exe – Files with the EXE extension are searched.

dialer.exe – A search is conducted for files that are named dialer.exe”.

dialer.exe, *.dll, trojan*.sys – The application searches for files named dialer.exe, files with any name and the DLL extension, and files named Trojan<any characters>.sys.

*.exe, *.dll, *.sys, *.ocx – The application searches for files with the specified extensions

To create the database, click “Start”. To terminate database creation abruptly, click “Stop”. (The database file is not created in the event of early termination of the process).

As noted earlier, in the technology description, an unlimited number of databases can be created for a single PC (for different folders and disks, in different database creation modes, and so forth). Naturally, when creating multiple databases, you will have to name the databases differently.


Comparison

To compare the current status of the disk with the database, open the Disk Inspector dialog box by clicking “Disk Inspector” on the "File" menu and proceed to the "Comparison disk <> base" tab.

In the “File” field type the name of an existing database, which contains the Disk Inspector data. Click "Start" to start the comparison. Click "Stop" to stop the comparison (the log is not cleared).

“Settings” tab

This tab contains the comparison settings. You will not be able to specify masks or select directories, because these settings were specified when the Disk Inspector database was created and are stored in the database.

“Comparison mode” options

Mode selection influences the process of disk status comparison with the database. Two modes are supported:

• "Standard”. This mode is enabled by default. In this mode, the checksum is computed for each file, and file size and content are compared. This is a rather lengthy operation. However, the availability of the checksum makes it possible to register changes to the file contents. Besides the checksum, the database stores the file size, its attributes, date, and time.
• “Quick”. In this mode, only file sizes are compared. This mode is recommended for quick analysis only.

Note: It is noteworthy that if the database were created in standard mode, you can perform comparison in either standard or quick mode. If the database was created in quick mode, comparison is possible in quick mode only. If upon loading the database after you click "Start", the Disk Inspector detects that the database was created in quick mode, the comparison mode will be switched to "Quick" automatically regardless of the user choice.

The check boxes “Exclude files recognized as system or trusted" and "Exclude files authorized by Microsoft Security Catalog" make it possible to reduce the size of the comparison results log file by performing the corresponding scans of created and modified files. In some cases (for example, after the installation of updates and service packs), enabling these options significantly reduces the log size.


Viruses

This category includes all malicious programs that do not belong to other categories. In particular:

• Viruses proper, that is, malicious programs that can infect files by adding their executable code, and modify an infected application in a way that gives control to the virus code control when the infected application is launched.
• Network and email worms (I-Worm, Net-Worm, Worm, Email-Worm),
• Trojans (Trojan, Trojan-Spy, Trojan-Downloader, Trojan-Dropper).
• Utilities used for stealthy remote control (backdoor).


AdWare

This category includes programs and modules designed for unauthorized downloading and displaying of advertising information on the user’s PC. Adware comes in the form of independent programs or different browser extension modules.


Spy or SpyWare

As its name suggests, spyware is a spy program. As a rule, this category is closely intertwined with AdWare (in many classifications AdWare is considered a subclass of SpyWare). Formally speaking, this is in fact so. Adware applications “visit” (connect to) websites from which they download advertising information. The logs of these websites record the periodicity of such exchanges and the IP address of the user’s PC. When standard API functions are used in adware for downloading files from the Internet, the request header will specify the version of the user’s browser and other parameters.

The task of spyware is to collect user details and transmit them secretly to the website of spyware authors. It should be noted that unlike trojans, spyware applications do not steal passwords, credit card numbers or other data that could be eventually used to seriously harm the user. As a rule, spyware transmits information about the computer configuration, software installed, websites visited by the user, and queries typed in search engines. In most cases this information is used in marketing research and for targeted advertising (that is, advertising closely matched to the user’s interests).

Many spyware applications are toolbars that expand browser functionality. This solution is very convenient for spying on the user’s Internet usage: Spyware can keep track of URLs visited and interfere with browser operation. At the same time, spyware is not a separate Windows task, and this makes detection more difficult. Moreover, such spyware information exchanges with the Internet are done with the browser, and most firewalls do not block browsers.

Another unpleasant aspect of many spyware and adware programs is that they are able to periodically scan the developer’s website for updates. Upon detecting an update, they download it (using up traffic) and install it without the user’s knowledge.


PornWare and Dialer

The pornware category includes all malware associated with porn sites. The primary example is a dialer (commonly known as a porn dialer)—a program that automatically dials porn sites or reconfigures the existing remote access connections to dial the modem pool of porn site owners instead of the local provider's number.

There have been multiple instances of users receiving hefty bills for paid services or international and long-distance calls—as a result of the work of a porn dialer.

This category also includes a variety of browser toolbars and other applications that install themselves during visits to porn sites.


Hijacker

A hijacker is a program that performs unauthorized reconfiguration of the system (the browser in most cases). Such reconfiguration is performed to change the start page, search engine page, protocol prefix matches, and so forth. The most notorious hijacker is probably Sexque. Additionally, the hijacker category commonly includes registry keys that forward the browser to unwanted websites.


RiskWare

Riskware is a program that is not a virus or malware, but which can still harm the user (personal details, files, and so on) or the operating system.

A typical example is the keystroke logger (commonly known as a keylogger), which are numerous. Most often, keyloggers are commercial products that come complete with an installer, uninstaller, documentation, and Help files. Moreover, many of them are installed and configured only manually. Yet such programs can harm the user considerably. A criminal can buy this product from the developer, install it on your computer, and configure it to operate in stealth mode. Using information obtained with the help of a keylogger, a criminal can inflict severe damage.

Another common example of riskware is the Remote Admin utility, which allows remote control the PC. On the one hand, this is a useful application. On the other, installing a program like this that originated from a criminal can cause information leaks, which turns a useful application into a backdoor.

Conclusion: In most cases, such applications should not be destroyed. You should find out how riskware programs found their way onto your computer and determine whether you need them.

The Kaspersky Lab system of names is used for naming known viruses and malware. The reason for this choice is the competently arranged classification and the availability of an encyclopedia of computer viruses.


What is a Rootkit

The term “rootkit” originated in the world of Unix. It means a set of utilities installed by a hacker on a hacked PC after initial access. As a rule, this set includes various utilities for cleaning up traces of invasion, hacker tools (sniffers, scanners), and trojans that substitute for the major Unix utilities. A rootkit enables the hacker to “take root” in a hacked system and conceal traces of his activity.

In Windows NT/200/XP, a rootkit is commonly understood to mean a program that invades the system and intercepts system functions (API). Interception and modification of low-level API functions primarily enables such an application to hide its presence in the system quite successfully. Moreover, a rootkit can normally mask the presence of any processes, folders, files, and registry keys that are described in its configuration. Many rootkits install their drivers and services in the system (which are naturally also “invisible”).

Detecting a running rootkit can be rather difficult: You cannot see it in the standart task manager, its registry keys are not visible in the Regedit registry editor, its files are invisible in Windows Explorer and other disk viewers.

Rootkits can be detected by using special techniques. Notably, the most difficult part is not detecting a rootkit, but correctly restoring the memory functions corrupted by it without rebooting the system, after which the rootkit can be tracked down and destroyed.

If you are not sure whether a legitimate application has intercepted certain functions, you can try to enable AVZ antirootkit. AVZ will attempt to restore the intercepted functions to their original status without affecting system operations.

AVZ blocks common rootkits. It should be noted, however, that the process of fighting a running rootkit in the memory can cause AVZ, other applications or the entire system to hang up. This is why you should enable the antirootkit function after closing other applications and shutting down the anti-virus monitor and firewall (especially the latter, because anti-virus monitors and firewalls often intercept API functions).

For details on rootkits and API interception methods, please refer to the “Rootkit—operation principles and mechanisms” article, published in Computer Press journal issue No.5.2005, or find more information at Network and data security.


AVZ heuristics analyzer

An anti-virus application searches for viruses and malicious objects by comparing the objects being analyzed with its database of virus signatures. When detecting a match, the anti-virus can remove the virus. Notably, removal rules and techniques are normally stored in the same database.

This database becomes a vulnerable spot of the anti-virus program, because the anti-virus can detect only those viruses that have descriptions in the database. This problem can be partially resolved by a heuristics analyzer—a special anti-virus subsystem that attempts to detect new virus varieties that are not described in the database. Besides viruses, the AVZ heuristics analyzer tries to detect spyware, hijackers, and trojans.

The principle of heuristics analyzer operation is based on searching for features characteristic of viruses and spyware (program code fragments, specific registry keys, files and processes). The heuristics analyzer also attempts to assess the similarity of an object to known viruses.

An heuristics analyzer that analyzes the entire system, not just individual files on the disk, is the most effective when it comes to detecting spyware, rootkits, and hijackers. The analyzer analyzes all data in the registry, files on the disk, processes and libraries in memory, TCP and UDP ports listened to, active services, and loaded drivers.

Heuristic analysis returns a rather high percentage of false positive results.errors. The analyzer can report a suspicious object, but this information has to be checked by virologists. Following the check the object may be recognized as malicious and included in the database, or a false positive is documented and the heuristics analyzer algorithms are amended accordingly.

Most anti-virus applications (AVZ included) let you adjust the sensitivity of the heuristics analyzer. This always leads to a contradiction: while the chances of detection of an unknown malicious object increase with sensitivity, higher sensitivity also raises the probability of false positives. This means that you should look for a “golden mean”.

The heuristics analyzer has several sensitivity levels and two special modes:

• Heuristics analyzer block mode. In this mode, the analyzer is fully disabled. In addition to heuristics analysis sensitivity adjustment, AVZ makes it possible to enable or disable heuristics analysis of the system.
• Paranoid mode. In this mode, maximum sensitivity is enabled, and the slightest suspicion triggers a warning. The large number of false positives makes this mode unacceptable. However, it can be useful at times.

The main messages of the AVZ heuristics analyzer are as follows:

• "File name >>> suspected virus_name (brief details of the object)". This message is displayed when AVZ detects an object resembling a known malicious object. The details in brackets enable the developer to locate the anti-virus database record that triggered this message.
• "File name >>> PE with a nonstandard extension". This means that a program file has been detected with a nonstandard extension, other than EXE, DLL, or SYS. While this is not dangerous, many viruses hide their PE files behind PIF and COM extensions. This message is shown at any heuristic sensitivity level for PE files with PIF and COM extensions, and only at maximum heuristic sensitivity level for other files.
• "File name >>> Name contains more than 5 spaces". Multiple spaces in the file name are rare. Many viruses use spaces to mask the real extension, creating files with such names as "photo.jpeg .exe".
• "File name >>> Hidden extension detected". This message is shown upon detection of more than 15 spaces in the file name.
• "File name >>> File has no visible name". This message is shown for files that do not have a name (that is, their file names look like this: ".exe" or ".pif").
• "Process file_name can access the network". This message is displayed for processes that use such libraries as wininet.dll, rasapi32.dll, ws2_32.dll, that is, system libraries that contain functions for accessing the network or controlling the process of dialing a number or establishing a connection. This check is performed only with the heuristics sensitivity level set to maximum. Even though the fact of an application using a network library does not make it malicious, it is still worth paying attention to unintelligible processes in this list.

The message can be followed by a number representing the degree of danger in percentage points. You should pay special attention to files with a danger level of more than 30.


Local Service Provider (LSP/SPI)

This section represents the ways in which malware can damage Winsock and the basic theory of malicious programming.

The following figure shows a schematic of Winsock operation:

Winsock 2 has two “mirror sides”: Winsock API and Winsock SPI. Winsock API implements the Windows Open Systems Architecture (WOSA), which possesses standard API interfaces between Winsock and applications using it. SPI is an interface between Winsock and Winsock service providers.

There are two types of SPI service providers:

• Namespace provider (NSP). The task of the namespace service provider is protocol-independent name resolution, that is, conversion of a friendly name into a protocol-dependent address. A classic example is DNS, which converts a user-friendly name www.z-oleg.com into the IP address of the server hosting this website.
• Transport service provider (TSP). TSPs are services providing such functions as establishing connections, transmitting data, managing the stream, processing errors, and the like. There are two kinds of transport service providers: base and layered. Base providers handle specific elements of the network transport protocol (such as TCP/IP), including basic network protocol functions, such as sending and receiving data over a network. Layered providers carry out only high-level communication functions and need a base provider for actual network exchange.

As shown in the figure, there can be multiple NSP and TSP providers (an unlimited number, to be more precise). What is even more interesting, the list of LSPs and TSPs used is stored in a special database (located in the registry). Moreover, Winsock API has functions that enable the application to both receive lists of LSP and TSP providers and to register their own providers.

In terms of physical implementation, an SPI provider is an ordinary DLL developed according to a certain standard: In particular, this DLL must export a number of functions used for interaction with Winsock.

On the one hand, storing the list of providers and their parameters in the database and providing a function for controlling this database is a very smart move: Any application can install its own SPI providers, thereby expanding Winsock capabilities. In doing so, the application does not necessarily have to know which SPI providers provide name resolution and exchange over the network and how exactly they do this. This results in an all-purpose system, and many applications use these capabilities. AVZ can be used to examine SPI settings and see which providers are registered there: The list of providers includes firewalls, anti-virus applications, various anti-spy applications, anti-adware utilities, traffic metering utilities, and so forth.

Now let us have a look at SPI through the eyes of virus and spyware/adware developers. This means that installing 2-3 providers is enough to take over control of all computer exchanges with the network. Using its own namespace service provider, a malicious program can track name resolution requests (for spying purposes) and interfere in this process. Put simply, when you send a request to the www.yandex.ru website, an “alien” NSP will instead issue the IP address for www.unknown-search-engine.com. Similar tricks are possible at the TSP level. Spyware programs most often install their own Layered Service Providers (LSPs). It turns out that the openness and versatility of SPI Winsock becomes its vulnerability: Malware developers know this and actively exploit this vulnerability. There are many examples: Spy.NewDotNet (not-a-virus:AdWare.NewDotNet), Spy.SAHAgent, Spy.WebHancer, Trojan.Riler, Adware.SpywareNuker, Backdoor.Kika . Besides interfering with the operation of Winsock, running a backdoor component in the form of SPI offers many “advantages” — hidden startup, absence of a visible process.

The possibility of malware installing as an SPI provider is only part of the problem. It turns out that Winsock has one more unpleasant characteristic: Any corruption of the registry database with the description of SPI providers causes failures in Winsock operation. (The specific kind of failure depends on the nature of corruption; however, all errors normally have two outcomes for the user—the computer loses Internet access and problems arise during access to the local area network; if you analyze the schematic at the top of this section, such errors become obvious and understandable). There are multiple causes of SPI settings corruption, the most common of them being:

• Deletion of a DLL that is an SPI provider without terminating its registration in the SPI providers database (a DLL can be removed manually, by an anti-virus scanner, an anti-spyware application, or the native uninstaller—the method of deletion does not matter);

• Corruption of the registry database in the process of SPI providers installation / removal or as a result of a manual registry “cleanup”.

Upon detecting an error, Winsock in particular and the entire Windows system in general do not take any steps to eliminate it and do not issue any diagnostic messages. It is worth noting that reinstalling the system on top of the existing system does not fix the SPI settings.


Command-line parameters

AVZ supports command line parameters and profiles (text files containing a set of parameters). Profiles can be used for storing settings and for bypassing command-line restrictions. (In particular, problems can occur when one attempts to use a large number of parameters or folder names with spaces in the command line.)

The default value of main command-line parameters is shown in bold in the list of possible parameter values.

Parameter values are defined as follows:

{} – Required line parameter,

[option|option] – One of the listed options

All settings accessible via command line parameters are duplicated by interface elements. This allows configuring AVZ settings through the command line without starting the scanning process. In this respect, the use of profiles is the most convenient.

Any parameter can be configured by a control script. Notably, repetitive reconfiguration is allowed in the process of script execution. For details see the description of the SetupAVZ command.


Main parameters

SCAN={folder} Adds a folder or disk to the list of objects to be scanned. The path should start with the disk letter, for example, c:\windows. You can specify an unlimited number of SCAN parameters in the command line—all parameters are processed, making it possible to scan multiple folders. Specifying a nonexistent folder is not an error—it will be simply ignored. Repeatedly specifying one and the same folder or a parent folder and its subfolders does not constitute an error either. AVZ will “sum up” all the specified folders, taking into account their hierarchy. Example: SCAN=c:\windows

SCANDRIVE= [HDD|FDD|CDROM] Adds all disks of the specified types to the list of objects to be scanned. Three disk types are supported: HDD—all hard drives are selected; FDD—all floppy drives and Flash drives are selected; CDROM—all CD/DVD drives and disks created by CD emulators are selected. You are allowed to specify several options separated with a comma or a + sign (without spaces before and after the comma or the + sign), for example, SCANDRIVE=HDD+CDROM.

SCANFILE={file name} Scanning of an individual file. There can be several such parameters. The scanning of files is performed in the order of the keys. Specifying a nonexistent file or the same file more than once is not an error. Example: SCANFILE=c:\windows\trojan.exe

NOSCAN={folder} Excludes the specified folder from the list of folders to be scanned. The path should start with the disk letter, for example, c:\windows. You can specify an unlimited number of NOSCAN parameters in the command line—all parameters are processed, making it possible to scan multiple folders. All NOSCAN parameters are analyzed after a list of scanned folders based on SCAN parameters has been created. Specifying a nonexistent folder is not an error—it will be simply ignored. Repeatedly specifying one and the same folder or a parent folder and its subfolders does not constitute an error either. AVZ will “sum up” all the specified folders, taking into account their hierarchy.

Example: SCAN=c:\ NOSCAN=c:\aids — the entire disk C:\ with the exception of folder c:\aids will be scanned.

ScanAllFiles=[Y|N] Scans all files (depending on the extension). The effect of selecting <All files> under the <File types> switch.

ScanFilesMode=[0|1|2] Specifies the scanning mode. 0 — scanning of potentially dangerous files; 1 — scanning of all files; 2 — scanning of files by mask. In Mode 2, the masks have to be specified using the IncludeFiles and ExcludeFiles keys.

IncludeFiles={mask} Specifies the file mask (or a selection of masks) to be scanned. Identical to filling the field <Include files matching the template:> and unchecking the check box of the same name.

ExcludeFiles={mask} Excludes files with names / extensions by mask. Identical to filling the field <Exclude files matching the template :> and unchecking the check box of the same name.

WinTrustLevel=[0|1|2] Mode of file checking against the Microsoft Security Catalog (0 – disabled; 1 – check against catalog; 2 – check against catalog plus comprehensive check of the digital signature of the file itself). Mode 1 is set by default. Enabling Mode 2 increases check reliability, while also prolonging the file check time by 2-3 times.

ScanProcess=[Y|N] Scans processes and DLL loaded into the memory; enabled by default.

ScanSystem=[Y|N] Heuristic system check using heuristic microprograms; enabled by default.

ScanSystemIPU=[Y|N] Heuristic system check using the Potential Vulnerabilities Finder (PVF); enabled by default.

RepGoodFiles = [Y|N] Logs information about files which AVZ considered to be “clean”.

RepGoodCheck = [Y|N] Checks “clean” files against the Trusted Objects Database and the Microsoft digital signatures database, with the check results shown in the log. Using this parameter makes sense only when RepGoodFiles = Y.

CheckArchives=[Y|N] Checks archives and compound files.

UseInfected=[Y|N] Copies deleted files to the ‘Infected’ folder

UseQuarantine=[Y|N] Copies suspicious files to Quarantine.

EvLevel=[0|1|2|3] Heuristics analyzer sensitivity level (0 – disabled; 3 – maximum level).

ExtEvCheck=[Y|N] Extended heuristic check. This parameter makes sense only when the heuristics sensitivity level has been set to 3.

Antirootkit

RootKitDetect=[Y|N] Enables detection of rootkits and API hooks.

AntiRootKitSystem=[Y|N] Enables the antirootkit system (at all available levels). Enabling the antirootkit system automatically enables rootkit detection.

AntiRootKitSystemUser=[Y|N] Enables the antirootkit system only for UserMode rootkits.

AntiRootKitSystemKernel=[Y|N] Enables the antirootkit system only for KernelMode rootkits.

The AntiRootKitSystemUser and AntiRootKitSystemKernel parameters prevail over the AntiRootKitSystem parameter. For example, specifying AntiRootKitSystem=Y AntiRootKitSystemKernel=N will cause the blocking of UserMode rootkits only to be enabled (the first parameter enables all, and the second parameter disables KernelMode rootkit blocking).

CheckLSP=[Y|N] Checks SPI/LSP settings. Enabled by default.

AutoRepairLSP=[Y|N] Automatically repairs errors in SPI/LSP settings. Works only if CheckLSP=Y. Disabled by default.

KeyloggerSearch=[Y|N] Searches for keyloggers and trojan DLLs. Enabled by default.

SearchTrojanPorts=[Y|N] Searches for ports used by trojans. Enabled by default.

AutoFixSysProblems=[Y|N] Automatically fixes system errors detected at step 9 of the system scan (supported starting with version 4.30; disabled by default).

Profile={profile name} Loads the profile stored in the file with the specified name. If you specify an incomplete path, the application will look for a profile in the current folder. You can specify several “Profile” parameters (all profiles will be loaded in the order in which they are specified in the command lime). A profile can in turn contain “Profile” parameters, enabling profiles to refer to one another. Upon loading profiles, the application makes sure to load each profile only once, which enables it to correctly process situations involving cross-references among profiles.

DelVir=[Y|N] Deletes / removes any viruses found.

ModeVirus=[0|1|2] Mode for dealing with viruses (0 – report only, 1 – delete or remove, 2 – ask user).

ModeAdvWare=[0|1|2] Mode for dealing with adware (0 – report only, 1 – delete or remove, 2 – ask user).

ModeSpy=[0|1|2] Mode for dealing with spy and spyware (0 – report only, 1 – delete or remove, 2 – ask user).

ModePornWare=[0|1|2] Mode for dealing with pornware and dialers (0 – report only, 1 – delete or remove, 2 – ask user).

ModeRiskWare=[0|1|2] Mode for dealing with riskware (0 – report only, 1 – delete or remove, 2 – ask user).

ExtFileDelete=[Y|N] Heuristic file deletion. It implies system analysis, search and removal of traces of every file deleted.

Run=[Y|N] Runs the scan automatically. Performed after all the other parameters have been executed.

Processing of parameters without the "=" sign

All AVZ parameters appear as Name=Value. Parameters that do not contain the equal sign (=) are viewed as names of files and folders that need to be scanned. They are subjected to two checks:

1. The parameter is viewed as a folder name. If a folder with this name exists, it is marked for scanning (in this case the operation is equivalent to the key SCAN=<folder>).
2. If a folder with the specified name has not been located at step 1, the application will consider the parameter value to be a file name. If a file with this name exists, it is marked for scanning (in this case the operation is equivalent to the key SCANFILE={file name}).


Specialized keys

Specialized keys are not duplicated with GUI settings items and are mainly intended for system administrators.

Script=<script name>: Loads and executes the specified script. This key is the last to be processed, regardless of its position in the command line.

HiddenMode=[0|1|2|3]: AVZ graphic user interface launch mode:

0 – Standard mode: the window is visible and accessible to the user

1 – The AVZ window is invisible, and the application icon is shown in the system tray. The user can expand the window by clicking the icon. The user can access the icon menu that allows starting and stopping the scanning process.

2 – The AVZ window is invisible, and the application icon is shown in the system tray. However, the icon menu is blocked and the user is unable to expand the AVZ window.

3 – The AVZ window is invisible, and the application icon is not shown in the system tray.

Configuring the operation mode is useful when AVZ is launched to scan user workstations from a logon script or with the help of autorun.

NewDsk=[Y|N]: New desktop launch mode. Specifying the NewDsk=Y parameter will cause AVZ to create a separate desktop with a unique random name and launch an instance of AVZ to work on this desktop. This mode is useful for fighting extortion programs and blockers that block the desktop with their windows.

DetectMailBomb=[Y|N]: A detector of the so-called mail bombs in the archive unpacking system. A mail bomb is a file that is over 10 Mb in size with a compression rate exceeding 100.

Unpack_Archives=[Y|N]: Unpacking of archives and compound files of the MHT type and mail being checked into the “Unpacked” folder in the AVZ work folder. Files are grouped by archive type and name.

Priority=[-1|0|1]: AVZ process priority setting. -1 – low priority, 0 – standard priority, 1 – high priority. Low priority is useful when AVZ is used as a background scan tool.

SleepScanTime=N, where N is time in milliseconds. The scanning of each file is followed by a delay by the specified number of milliseconds. This serves to slow down the scanning process in order to minimize the load on the disks and the processor and is useful for background scanning of folders on a server. For example, specifying the value of 100 will cause 10 files to be checked every second.

ScanAVZFolders=[Y|N]: Allows / blocks the scanning of the AVZ folder and all subfolders. The default parameter is N, meaning that all files within the AVZ work folder are not scanned. In particular, this protects the “Infected” folder from being scanned and repaired repeatedly. However, this is not always convenient.

NQ=[Y|N]: Network quarantine mode. In the network quarantine mode, the name of the quarantine folder includes the network name of the PC in addition to the date. This is done to enable the launch of AVZ from a network folder on a server: In this case every user has an individual quarantine and “Infected” folder, while the administrator can easily trace the quarantined file to the computer where they originate.

QrOnlyEXE=[Y|N]: Management of the quarantine filter. If QrOnlyEXE=Y, only executable files are placed into Quarantine and the “Infected" folder. The MZ signature in the header is controlled; if the signature is absent, Quarantine is blocked. This mode is disabled by default. Enabling it can be useful in the event of centralized launch of AVZ in the network. The filter does not apply to cases when direct reading of the file is used (that is, when something blocks access to the file). The filter applies to all AVZ systems (manager buttons, list-based quarantining, automatic quarantining, script-enabled quarantining).

WebServerMode=[Y|N]: Web server launch mode for an online scan. Disables memory scan, advanced memory analysis, LSP error search, and rootkit search. The purpose of this key is to launch AVZ in the maximally lite mode, which is useful when AVZ used as an online tool for file scanning. A specialty of this mode is that as new kinds of memory and system analysis appear they will be blocked by this key.

AG=[Y|N]: Enables AVZGuard at AVZ startup. This key can be used in the command line only. It is not supported in scripts. The AG is processed at the moment of AVZ startup, before the application initializes and opens windows.

AM=[Y|N]: Enables basic protection against trojans that embed their messages in windows with characteristic headers. Specifying AM=Y causes text to be removed from the AVZ main window and the meaningful name of the application to be deleted. In this mode, the AVZ window will not obey the close command. You can exit AVZ only through the “File\Exit” menu or using the script command. It is supported starting with AVZ version 4.32.

MiniLog=[Y|N]: Enables the mini log mode. In this mode, only significant information is logged (warnings, suspicious objects, error data, textual output of scripts), while other information is suppressed (in particular, information about loaded databases, copyright headers, technical data of the antirootkit, and the like, is not logged). This mode is useful for system administrators who use AVZ to scan the PC in automatic mode: the mini log is much smaller and size and easier to analyze manually or automatically.

ExtUpdates=[Y|N]: Enables the extended update mode for updating the database on web servers. AVZ normally downloads the database, and you can copy the updated database manually to any other folder. However, if you open access to the BASE folder via FTP or HTTP, AVZ will not be able to update itself from it, because the BASE folder does not contain a description of the database contents (avzupd.zip), which is used for incremental updates. Specifying the key ExtUpdates=Y causes this file to be copied to the BASE folder during the update process.

SpoolLog=<file name>: Duplicates the log to the specified text file. A text file will be created, if it does not exist, or updated if it is available. The logging is carried out without caching; the file is opened / closed while each string is logged—this makes it possible to apply this log for error diagnostics when AVZ terminates abruptly.

QuarantineBaseFolder=<folder name>: Specifies the base folder for Quarantine and Infected folders. By default, these folders are located in the AVZ installation folder. This option is useful when you start AVZ from a BootCD or a different read-only medium, such as a network folder.

TempFolder=<folder name>: Specifies the temporary files folder. If a folder with this name does not exist, one will be created automatically. This option makes it possible to move the folder with temporary AVZ files to a folder the in which scanning is blocked in the settings of the anti-virus monitor that is used. Additionally, this key can be used to move the temporary files folder to a virtual drive, thereby accelerating the speed of archive scanning.


Return codes

AVZ uses the following return codes for interaction with other applications:

0 – Suspicious or malicious objects have not been detected during scanning.

1 – Malicious objects have been detected.

2 – Malicious objects have not been detected, but some objects are considered suspect by the file scanner or heuristics analyzer.


Examples

Sample configuration

Command line: avz.exe ScanDrive=HDD profile=exclude.txt DelVir=Y Run=Y

File exclude.txt:

NoScan=c:\VirusTest

NoScan=c:\Virus

NoScan=d:\aids

In this example, upon AVZ startup all HDDs are checked automatically, certain folders are excluded (a profile is used for exclusion parameters), the removal mode is enabled, and scanning is started after all the settings.


Frequently asked questions

This section contains answers to the most common and frequently asked questions. Reading the FAQ section is recommended before requesting assistance.


What to do when AVZ detects a suspected virus or malware?

AVZ Antiviral Toolkit is an application equipped with multiple checkers and analyzers, some of which are bordering on the paranoid. This is meant to be so, because AVZ is often used to analyze a computer after other scan tools prove ineffective.

This is why false positives are possible. For this eventuality, the log uses the wording “Suspected…” regarding specific objects (the ellipsis can be substituted with the malware category and further details).

Follow these recommendations when a suspicious object has been detected:

1. Do not remove suspicious files under any circumstances. The fact that the analyzer considers a file suspicious does not mean that the file is dangerous. Quarantine the suspicious objects and email them to newvirus@z-oleg.com. When you create the archive manually, preferably set a password, or it may be blocked by the email server.

2. Briefly describe the issue and suspicions in the email. Preferably attach the AVZ log.

3. Wait for a reply with the results of analysis.

See the Technical support section for details on contacting technical support.


What to do when AVZ detects a suspected keylogger?

When a suspected keylogger or trojan DLL has been detected, follow the recommendations in the "What to do when AVZ detects a suspected virus or malware?" section. Note that when AVZ reports a suspected keylogger, it does not mean that what it has detected is in fact a keylogger. There are hundreds of known applications that install they own keyboard and mouse event loggers for perfectly legitimate purposes. The most common example is the Lingvo dictionary that installs its “LvHook.dll” for keeping track of hotkey presses. On the one hand, this is a hook and the AVZ analyzer responds to it. On the other hand, it is absolutely innocuous. Following analysis, safe hooks are added to the Trusted Objects Database, and they no longer cause false positives. The current safe-to-harmless ratio is approximately 1 to 10, meaning that there is one malicious module per 10 harmless ones.


What to do when AVZ detects a suspected rootkit?

When AVZ reports a suspected process or file, follow the general recommendations ("What to do when AVZ detects a suspected virus or malware?"). Before submitting the files, preferably send the AVZ log—often the log clears up many issues.

You should understand that the fact of AVZ detecting interception of certain functions does not mean that a rootkit has found its way into the system. It is possible that functions are intercepted by the anti-virus monitor, firewall or other utilities. For example, a fairly useful and handy utility RegMon installs its driver to intercept thirteen KiST functions in order to be able to keep track of operations with the registry. According to available statistics, a malicious program intercepts processes in 1 out of 50-80 cases. In all other cases, these are usually anti-virus applications and firewalls.

When AVZ detects a suspected hidden process, you must find out what kind of process or application it is. Common programs (not to mention system components) do not resort to hiding their processes and files, which makes a stealth process definitely suspicious. Still this is not a definitive verdict. For example, there are a number of known harmless programs that hide their processes and files to protect them against detection and removal by trojans.


What is “TCP 5000 port” and how does one fight it?

AVZ often detects an open TCP 5000 port and reports it. This port belongs to a system service called “SSDP Discovery Service”. If this service is not in use, it is recommended to disable it (a number of vulnerabilities have been discovered in this service).

To disable it:

1. Right-click the “My computer” or “Computer” command, depending on your version of Windows. On the menu that opens, click “Management” or “Manage”, depending on your version of Windows.

2. On the “Computer Management” console that opens, click “Services and Applications”, and then click “Services”.

3. In the list on the right of the window, locate a service called “SSDP discovery service”.

4. Double-clicking the string of this service opens a properties dialog box, where you should select the launch type “Disabled”, then click “Stop” and finally “OK”.

After you disable the SSDP Discovery Service, Port 5000 should not be open. If it is still open, this may be a suspected backdoor exploit.


What to do when AVZ is unable to locate the *.avz file after unpacking?

If after unpacking AVZ reports that a certain file with the AVZ extension is missing (most often it is the file main.avz), you have to make sure the unpacking was performed correctly. The fact is that the AVZ database is stored in the “Base” folder. Certain compression tools incorrectly unpack the archive available from the site, and as a result the "Base" folder is not extracted from the archive.

It is recommended to unpack it with a different compression tool and make sure the “Base” folder has been extracted successfully. For details on the folder structure, see the Program folder structure section.


AVZ has removed malware, but the start page and other browser settings are still corrupted

This is a common situation: AVZ does not know for certain which particular settings were corrupted by malware. Use the "System Restore" function to restore settings. If browser settings continue to change on their own after restoration, this is the primary symptom of a malware-infected computer. In this case you should run System Analysis and analyze the resulting log.


My antivirus monitor reports avz*.tmp as an infected file or malware during scanning

Such messages can be issued by anti-virus monitors. The infected file is detected in the “TEMP” folder and looks like this: avz_XXXX_Y.tmp. These are temporary files created by AVZ while scanning archives, emails, MHT files, and the like. Notably, XXXX represents the PID of the AVZ process, and Y shows the nesting level of the archive. There can also be a differently named file: avz_XXXX_raw.tmp. AVZ creates such files while analyzing objects access to which is blocked by opening them with exclusive access.

This happens because the antivirus scanner and monitor in use were unable to detect viruses / trojans in a particular archive for some reason. There are several common reasons for this:

1. Archive scanning is disabled in the settings of the anti-virus application and anti-virus monitor

2. The anti-virus application is unable to check this type of archive.

3. The archive is located in a folder the scanning of which is forbidden in the anti-virus application and monitor settings

4. At the time when the archive found its way onto the computer, the anti-virus database did not include signatures for malware contained in the archive, causing the monitor to skip this archive and allow it to be saved.

Accordingly, when AVZ extracts a file from the archive, the anti-virus monitor scans it and may detect malware. In this case, the infection report is understandable, and you can respond by:

1. Allowing the anti-virus monitor to “cure” the file

2. Commanding the monitor to check the file

In any case, AVZ is ready for the possibility of being denied access to a temporary file or this file being deleted suddenly, which is why this will not cause a failure in its operation.


What to do when the message “Driver loading error—scan aborted” is displayed?

The message “Driver loading error—scan aborted” may be logged in the event of the "avz" driver loading error. There are several causes of this error, the most common being the following:

1. Insufficient privileges. For the driver to load, AVZ has to be started from under the administrator account or a user account with the privileges to install and load drivers.

2. Proactive defense systems that are running do not have AVZ on their trusted process list. These systems can block the loading or installation of the driver.

3. Malware is blocking the loading of the driver.


What to do when an error is encountered during the database update?

Several solutions are possible:

1. When the “Use Internet Explorer settings” mode is used in the update settings, make sure that the Internet access parameters are configured in the Internet Explorer settings and that Internet Explorer is not in “Work offline” mode (“Work offline” item on the “File” menu in Internet Explorer. This menu item is marked with a check when the “Work offline” mode is active).

2. Click “Standard Scripts” on the “File” menu and execute the script “Update signature database (default settings)”. This script attempts different common combinations of settings. Upon detecting a suitable configuration, the script updates the database.

3. You may try to select a different update source manually and (or) modify settings. For example, you may try the direct connection or a proxy server connection (when you use a proxy server and know its address and port number).

In addition, make sure that:

1. Firewall settings allow AVZ to connect to the Internet. The database is downloaded from the website specified in the website settings via port 80 and the HTTP protocol.

2. You have a reliable Internet connection.

When the automatic database update has failed, you can manually download the archive with the database from the AVZ download page. The size of the manual download will be larger, since automatic update downloads only updated or corrupted files.


What to do when errors are encountered while downloading the archive from AVZ?

Two common situations are possible in this case:

1. The archive with AVZ files fails to download. In this case it can be difficult to pinpoint the problem. The archive is downloaded using a direct link, via the HTTP protocol, and the AVZ download site does not use redirect or anti-link solutions. Download issues may be due to a high load on the server. Following the release of new AVZ versions, the server experiences a DDoS situation for at least a week due to the large number of parallel downloads. In this case using mirrors indicated on the AVZ download page is recommended.

2. The archive is downloaded, but you find out that it contains an old version upon unpacking it. In this case, the problem is associated with incorrect operation of a proxy server used for Internet access. The proxy server caches the old archive version. Theoretically, the proxy server should check whether the file has been updated. If so, it should download the latest version of the file.


During AVZ scan, a text line reading "test" is displayed in the active window

During AVZ scan of the computer, the main window may show a long string (commonly a repeating word “test”). This is caused by the AVZ anti-keylogger, which uses behavioral analyzer in its operation. The analyzer emulates keyboard and mouse events and examines how suspicious objects respond to them. If the AVZ window is active, this process takes place correctly. Otherwise, the situation described above happens.


Some AVZ functions do not work under Windows Vista

The KernelMode components of AVZ do not operate under Windows Vista 64-bit, because AVZ does not support 64-bit platforms. Everything should be functional under Windows Vista 32-bit. Keep in mind, however, that applications are run with limited privileges by default under Windows Vista. To start the application with administrator privileges, select avz.exe in Windows Explorer, open the context menu (by right-clicking it), and select "Run as administrator". The UAC system will ask you to confirm the operation.


Specifics of using AVZ under Windows Server 2003

When running AVZ on a server, exercise special care and enable the repair / auto-removal mode only when you are absolutely certain that this is necessary.

Common problems may be encountered in a number of cases:

1. When AVZ is started from a terminal session, the system will supply it with an invalid path to the system folder—the path returned by the system will point to the user profile. This may cause faults in a number of managers, in particular the SPI error analyzer.

2. Background processes may be periodically started and terminated on the server. This may cause faults in the operation of the anti-rootkit. In particular, it may suspect certain processes as being hidden.

3. Hook blocking in Kernel Model, modification of SPI settings, management of autorun options, and suchlike causes a global impact on the system. Therefore, exercise special care when performing these operations.


What to do when malware blocks AVZ startup?

In this situation you should:

1. Rename the AVZ folder. Use a meaningless name such as X54S or a common name such as Soft or Game.

2. Rename avz.exe to something along the lines of test.exe, game.pif, program.com.

3. Run AVZ with the following key: avz.exe ag=y (in this case AVZGuard is enabled on AVZ startup; see the Specialized keys section for details about the key).


Introduction

As you probably know, AVZ was originally intended as an administrator utility. Running AVZ manually or using the dialog mode is convenient for checking an individual computer. Meanwhile, automation solutions are indispensible when you need to scan a large number of computers quickly or run a regular check at startup. Introducing the support of command-line keys was the first move in this direction. However, although keys make it possible to configure AVZ, they do not offer too much flexibility. This is why versions 3.80 and later support external control scripts that can be created by the administrator.

A script lets you:

• Modify all AVZ settings
• Run a scan and repair selected folders and disks
• Save logs (with the possibility to log explanatory information)
• Run system analysis
• Quarantine selected files or use automatic quarantining
• Search classes with the possibility to quarantine files associated with them
• Block UserMode and KernelMode hooks

The principal feature of a script is the possibility to use conditional operators and cycles, declare variables of different types, and perform operations with numbers and strings. This lets you perform a number of sophisticated tasks that cannot be accomplished using command line keys, such as selective AVZ configuration for each computer, repair of selected folders, and so forth.


Script structure

A basic control script looks like this:

begin

... script commands ...

end.

When you need to declare variables, a section for declaring variables is added:

var

S : string; // Declaring a variable of the “string” type

begin

... script commands ...

end.

As the examples indicate, the syntax is identical to that of the Pascal language. A script can contain comments that do not affect its execution and are designed to disable script fragments temporarily or to comment on operations described in it.

begin

// This is the first kind of comment

{ This is the second kind of comment }

end.

A script supports several types of variables, in particular “string”, “integer” (signed integer), and “double” (a floating-point number).


procedure Sleep

procedure Sleep(AInterval : integer);

Suspends the script (and AVZ altogether) for the specified amount of time. The interval is specified in seconds.

This command is useful at the start of the script when AVZ starts from autorun: a 60-80 second delay is useful to prevent the system boot process from being slowed down.

Example:

AddToLog('Performing a 15 second delay ');

Sleep(15);

AddToLog('15 seconds elapsed, resuming work');


procedure ActivateWatchDog

procedure ActivateWatchDog(Interval : integer);

Activates the watchdog timer. The parameter “Interval” contains the time interval in seconds. The watchdog timer lets you limit the time of AVZ operation and force it closed in the event of an unforeseen interruption.

Example:

// Forcing AVZ closed after 5 minutes

ActivateWatchDog(60 * 5);


procedure SetupAVZ

procedure SetupAVZ(S : String);

Performs AVZ setup. Any command-line parameter is specified as the parameter (only one parameter).

You can execute SetupAVZ multiple times within a single script. Every instance modifies one of the parameters. The parameters are described in detail in the "Command line parameters" section.

Example 1:

SetupAVZ('UseQuarantine=Y'); // Enabling Quarantine

Example 2:

if GetComputerName = 'PUPKIN' then

SetupAVZ('UseQuarantine=Y'); // Enabling Quarantine


procedure RunScan

procedure RunScan;

Runs the scan process. Script execution will continue after the scanning process is completed. Scan settings have to be configured before executing RunScan.


procedure ExitAVZ

procedure ExitAVZ;

Exits AVZ. It is used as the final command in scripts that are meant to be executed automatically.


function GetSystemBootMode

function GetSystemBootMode : integer;

Returns a code corresponding to the Windows boot mode.

Supported codes:

0 – The system has loaded in normal boot mode

1 – The system has loaded in safe boot mode

2 – The system has loaded in safe boot mode with network support

Examples:

begin

AddToLog('System has loaded in boot mode ' +

InttoStr(GetSystemBootMode));

end.

begin

if GetSystemBootMode <> 0 then begin

AddToLog('Scan in safe boot mode is blocked!!')

exit;

end;

end.


function GetEnvironmentVariable

function GetEnvironmentVariable(AName : string):string;

Gets the value of the specified environment variable.

Compatibility: AVZ 4.26 and later

Example:

begin

AddToLog('SESSIONNAME = ' + GetEnvironmentVariable('SESSIONNAME'));

end.


function GetComputerName

function GetComputerName : string;

Returns the network name of the computer. The network name is always returned in all uppercase to simplify comparison and analysis.

Usage examples:

1. AddToLog('Computer log '+GetComputerName);

In this example, a string containing the current computer name is added to the log.

2. if GetComputerName = 'PUPKIN' then begin

SetupAVZ('DelVir=Y'); // Enabling removal mode

SetupAVZ('UseQuarantine=Y'); // Using automatic quarantining

end;

In this example, certain individual operations are performed with a computer named PUPKIN (in this case, the removal and quarantining modes are enabled).

3. if pos('ASU_', GetComputerName) = 1 then

ExitAVZ;

In this example, AVZ is immediately exited on all computers that have names starting with ASU_.


function GetComputerComments

function GetComputerComments : string;

Returns a textual description of the computer, which is specified in the “Comments” field of the computer name settings. This function is useful in the corporate network, provided the computer comments contain the details of the computer location and the user responsible for this computer.

Example:

begin

AddToLog('Computer comments = '+GetComputerComments);

end.


function IsNT

function IsNT : boolean;

Returns “true” if the Windows version installed on the computer belongs to an NT platform (NT, W2K, XP, W2K3, Vista) and “false” for a Windows 9x platform.

Compatibility: AVZ 4.26 and later


function IsWow64

function IsWow64:boolean;

Returns “true” if the process is running under WOW64, and “false” in all other cases.

Example:

begin

if IsWOW64 then

AddToLog('WOW64 = true')

else

AddToLog('WOW64 = false');

end.

Compatibility: AVZ 4.30 and later


function GetComputerHash

function GetComputerHash : string;

Returns a meaningless string that identifies this computer. From the technical viewpoint, this string is an MD5 hash of the serial number of the system disk volume and the computer's network name. This hash is recorded in the System Analysis log and can be used to perform the following tasks:

• Blocking the execution of a potentially dangerous script on computers for which it is not intended
• Identifying logs created on one and the same computer

Similar problems were recorded on Virusinfo in cases when one user submitted the same request several times (for example, a network administrator requested assistance with repairing several computers). This often results in confusion: whether the user is sending duplicated logs from a different computer or trying to execute a script on a computer for which the script is not intended.

Example:

begin

if GetComputerHash <> '7269D5B9E6ED44CE74E24AA2976DB130' then begin

ShowMessage('Unfortunately, this script is intended for a different computer');

exit;

end;

// **** Script commands ***

end.

Compatibility: AVZ 4.32 and later


function TranslateStr

function TranslateStr(AMsg : string):string;

Performs string localization according to the current AVZ localization database. The codes of localization expressions look like this: $AVZxxxx, where xxxx is a four-digit expression code.

Compatibility: AVZ 4.34 and later

begin

if MessageDLG(TranslateStr('$AVZ1751'), mtConfirmation, mbYes+mbNo, 0) <> 6 then exit;

end.


procedure ShowMessage

procedure ShowMessage(AMsg : string);

The ShowMessage procedure displays the text message “AMsg” on the screen. Script execution is stopped until the user clicks OK in the message box.

Example:

begin

ShowMessage('Message !!');

end.


function InputBox

function InputBox(ACaption, APrompt, ADefault: string): string;

The InputBox function displays a dialog with an input box on the screen. The dialog header is determined by the ACaption parameter, and the data input prompt—by the APrompt parameter. The ADefault value is entered in the box as a default value. The dialog has two buttons: OK and Cancel. Script execution is stopped until the user clicks OK or Cancel in the input dialog box. Clicking OK causes the function to return the value entered by the user. Clicking "Cancel” returns the default value specified by the ADefault parameter.

Example:

var

txt : string;

begin

txt := InputBox('Dialog header', 'Enter string:', 'Default string');

ShowMessage('Text entered ="'+txt+'"');

end.


function MessageDLG

function MessageDlg(Msg: string; DlgType: TMsgDlgType; Buttons: TMsgDlgButtons; HelpCtx: Longint): Integer;

This function displays a standard dialog box on the screen and returns the code of the button clicked by the user in the dialog. Using this function lets you create interactive scripts.

Parameters:

Msg – text of the message or question shown in the dialog

DlgType – dialog type. A set of constants is available for specifying the dialog type:

• mtWarning – warning
• mtError – error
• mtInformation – information
• mtConfirmation – request for confirmation

From the technical perspective, the dialog box type determines the dialog header and the icon displayed in the dialog box.

Buttons – a code defining the set of buttons to be displayed in the dialog box. A set of constants is available for specifying the button set:

• mbOk – "OK"
• mbCancel – “Cancel”
• mbYes – “Yes”
• mbNo – “No”
• mbAbort – “Abort”
• mbRetry – “Retry”
• mbIgnore – “Ignore”
• If you need to display several buttons, the code of the button set will be a sum of constants (for example, mbYes+mbNo).

HelpCtx – code of the Help system section; it should be set to zero in user scripts

The function returns the clicked button code:

• mbOk – code 1
• mbCancel – code 2
• mbYes – code 6
• mbNo – code 7
• mbAbort – code 3
• mbRetry – code 4
• mbIgnore – code 5

Examples:

var

Res : integer;

begin

Res := MessageDLG('Perform operation ?', mtConfirmation, mbYes+mbNo, 0);

AddToLog('Result code = ' + Inttostr(Res));

end.

Example of code analysis:

var

FileName : string;

begin

FileName := 'c:\trojan.exe';

if MessageDLG('Delete file "'+FileName+'" ?', mtConfirmation, mbYes+mbNo, 0) = 6 then

DeleteFile(FileName);

end.


function ExecuteAVUpdate

function ExecuteAVUpdate : boolean;

Updates the AVZ database online. The function does not require parameters. Updates are downloaded from one of the servers containing updates. The server is selected randomly.

Example:

begin

if ExecuteAVUpdate then

AddToLog('AV database update successful');

end.


function ExecuteAVUpdateEx

function ExecuteAVUpdateEx(AServerURL : string; AConnectMode : byte;

ProxyServer, ProxyUser, ProxyPass : string) : boolean;

Updates the AVZ database online. It is equivalent to ExecuteAVUpdate, except that it performs the update according to the parameters specified, from the URL chosen. Among other things, this lets you update the database from a local network server.

Parameters:

AServerURL – URL of the server from which updates are downloaded. Replacing the URL address with an empty string will cause one of the standard URLs to be selected randomly as the update source (random selection distributes the load among update sources).

AConnectMode – Code of the connection mode:

0 – Connection according to Internet Explorer settings. In this mode, ProxyServer, ProxyUser, ProxyPass parameters are ignored;

1 – Direct connection. Optimum mode for a computer with a direct Internet connection. In this mode, ProxyServer, ProxyUser, ProxyPass parameters are ignored;

2 – Connection using an anonymous proxy server. In this mode, you must specify the ProxyServer through which you will access the Internet. The ProxyUser and ProxyPass parameters will be ignored;

3 – Connection using a proxy server requiring authorization. This mode is identical to Mode 2, except that the ProxyUser, ProxyPass parameters must be entered.

4 – Connection using a proxy server requiring NTLM authorization. This mode is identical to Mode 3.

ProxyServer – Proxy server name or IP address. This parameter is applicable in Modes 2 and 3 only.

ProxyUser – User name for proxy server authorization. This parameter is applicable in Mode 3 only.

ProxyPass – User password for proxy server authorization. This parameter is applicable in Mode 3 only.

Examples:

begin

if ExecuteAVUpdateEx('http://my_server.com/avz_av_update/', 0, '','','') then

AddToLog('AV database update (according to IE settings) successful');

end.

begin

if ExecuteAVUpdateEx('http://my_server.com/avz_av_update/', 1, '','','') then

AddToLog('AV database update (direct connection) successful');

end.

begin

if ExecuteAVUpdateEx('http://my_server.com/avz_av_update/', 2, 'myproxy','','') then

AddToLog('AV database update (via anonymous proxy server) successful');

end.

begin

if ExecuteAVUpdateEx('http://my_server.com/avz_av_update/', 3, 'myproxy','Pupkin','TopSecretPasswd') then

AddToLog('AV database update (via proxy server requiring authorization) successful');

end.


procedure AddToLog

procedure AddToLog(S : String);

Adds the specified string to the log. This function is useful for logging certain information which the script author wishes to add to the log.

Example:

begin

AddToLog('Computer log '+GetComputerName);

end.


procedure SaveLog

procedure SaveLog(S : string);

Saves the log to file. The file can be located on the network. If the path specified in the log file name does not exist, an attempt is made to create this folder before saving the log file. If a file with the same name already exists in the specified folder, it will be overwritten by the log being saved without warning.

Example:

begin

SaveLog('c:\avz_log.txt');

SaveLog('\\my_server\avz_logs\avz_'+GetComputerName+'.txt');

end.


procedure ClearLog

procedure ClearLog;

Clears the log.

Compatibility: AVZ 4.34 and later

Example:

begin

AddToLog('Test 1');

ClearLog;

AddToLog('Test 2');

end.


procedure SaveCSVLog

procedure SaveCSVLog(S : string);

Saves the log in CSV format. A CSV log contains three fields separated with semicolons: file name, event code, and text comment.

Supported event codes:

1 – malware

2 – malicious program suspected by the file scanner

3 – suspicion by the heuristics analyzer

4 – suspicion by the antirootkit

5 – suspicion by the anti-keylogger

Example:

begin

SaveCSVLog('c:\avz_log.csv');

end.


function AddLineToTxtFile

function AddLineToTxtFile(AFileName, S : string) : boolean;

Adds the S string to a text file name AFileName. The file is created when it does not exist, or opened when it exists; the file is closed immediately after the string has been added. This function is convenient for generating consolidated logs and keeping a single log with data for the administrator.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

The function returns “true” when string addition to the file has succeeded or "false" when it has failed.

Example:

1. Simplest example:

begin

AddLineToTxtFile('c:\log.txt', 'Message');

end.

2. Sample generation of a log containing the date, time, and computer name:

begin

AddLineToTxtFile('c:\log.txt',

DateTimeToStr(Now)+' '+GetComputerName+' : '+

'Message');

end.


procedure ExecuteAutoQuarantine

procedure ExecuteAutoQuarantine;

Performs automatic quarantining of files that have not been found in the Trusted Objects Database. All loaded processes / DLLs / drivers / autorun elements end up in this quarantine.

Example:

begin

ClearQuarantine;

end.


function CreateQurantineArchive

function CreateQurantineArchive(AFileName : string) : boolean;

This function creates an archive with files that were quarantined on the current date (that is, all files in the “Infected” folder matching the current date are archived). The archive format is ZIP, protected with the password “virus”. If the folder specified using the “AFileName” parameter does not exist, an attempt will be made to create it before saving the archive.

Example:

begin

// Clearing Quarantine

ClearQuarantine;

// Automatic Quarantining

ExecuteAutoQuarantine;

// Creating an archive with quarantined files

CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');

end.


function CreateInfectedArchive

function CreateInfectedArchive(AFileName : string) : boolean;

This function creates an archive with files that were placed in the “Infected” folder on the current date (that is, all files in the “Quarantine” folder matching the current date are archived). The archive format is ZIP, protected with the password “virus”. If the folder specified using the “AFileName” parameter does not exist, an attempt will be made to create it before saving the archive.

Example:

begin

// Creating archive with the contents of Infected folder

CreateInfectedArchive(GetAVZDirectory+'infected.zip');

// Automatic Quarantining

ExecuteAutoQuarantine;

end.


function QuarantineFile

function QuarantineFile(AFileName, AMsg : string):boolean;

The specified file with the name AFileName is copied to Quarantine. When a file is being quarantined, the text from the AMsg parameter is added to the file comment. If the file is already in Quarantine or has been found in the Trusted Objects Base, file copying to Quarantine is blocked.

If the file has been found and copied to Quarantine successfully, the function returns “true”.

If the file has not been found or the quarantining has been blocked after being found in Trusted Objects Database, the function returns “false”.

The file name may contain macros, in particular:

%WinDir% – Full path in the Windows directory

%System32% – Full path to the System folder (in Win9x) or System32 folder (in NT/W2K/XP ...)

Note: If the QuarantineFile function does not specify the full file name, an attempt is made to find the file. During the search process, in addition to the native search functionality, common file locations are checked. In particular, the "fine name + paths to system folders" possibilities are checked. This is done to increase the probability that the right files needed for analysis will be quarantined.

Example:

QuarantineFile('%System32%\vbsys2.dll',

'Suspicious name, possible Trojan.Agent');

QuarantineFile('%WinDir%\vbsys2.dll',

'Suspicious name, possible Trojan.Agent');

Mask characters “*” and “?” can be specified in file names, for example:

QuarantineFile('%System32%\vbsys*.dll',

'Suspicious name, possible Trojan.Agent');

When a mask is specified, matching files are searched, and all the files found are quarantined.

If necessary, you can move the Quarantine folder to any folder using the command-line key QuarantineBaseFolder. In this case, the Quarantine folder should be configured before operations with Quarantine.

Example:

begin

// Configuring quarantine folder location

SetupAVZ('QuarantineBaseFolder=c:\avz4\');

// Quarantining file

QuarantineFile('%System32%\vbsys2.dll',

'Suspicious name, possible Trojan.Agent');

end.


function QuarantineFileF

function QuarantineFileF(ASearchPath:string;AMaskList:string;

ARecurse : boolean;

AMsg : string;

ASizeMin, ASizeMax : integer;

ADateMin : string = ''; ADateMax : string = '';

ACopyRigth : string = '';

AMD5 : string = ''):integer

Searches for files according to the specified set of conditions and copies the files found to Quarantine.

It is the equivalent of the QuarantineFile function for cases when the exact file name is unknown, but some file data is available (for example, the file size, file creation / modification date, copyrights and MD5 are known).

If any of the files found is already in Quarantine or has been found in the Trusted Objects Base, file copying to Quarantine is blocked.

Parameters

ASearchPath – Path to the folder in which the search is executed. The path may contain macros. This parameter is required.

AMaskList – One or several file name masks. When several masks are specified, they are separated with a comma or a semicolon (,;). For example: "*.dll" or "*.exe;*.dll;xx0????.tmp". The mask may contain standard symbols “*” (replacing any number of random characters) and “?” - one random character in the specified position. This parameter is required. At least one mask has to be specified. Instead of a mask (or as one of the masks in the list), you can specify a file name, for example "*.dll;trojan.exe;virus.exe" – in this case, the condition is met by all files with the DLL extension and files named trojan.exe and virus.exe.

ARecurse – Management of recursive search in subfolders. If the parameter value is "false”, file search is executed in the specified folder only. If the parameter value is “true”, file search is executed in the specified folder and all of its subfolders.

AMsg – Random text that is added to the file comment when the file is quarantined. This parameter is required; a blank string may be specified.

ASizeMin – Minimum file size in bytes. This parameter is required.

ASizeMax – Maximum file size in bytes. This parameter is required; specifying the maximum size of 0 disables maximum size control.

ADateMin – Minimum file date. The date is specified as a string in the DD.MM.YYYY format. During comparison, the file creation date and the last file modification date are checked. If any of the dates comes later than the specified date, the condition is considered fulfilled. This parameter is optional; leave a blank string if minimum date control is not required.

ADateMax – Maximum file date. The date is specified as a string in the DD.MM.YYYY format. During comparison, the file creation date and the last file modification date are checked. If any of the dates comes sooner than the specified date, the condition is considered fulfilled. This parameter is optional; leave a blank string if maximum date control is not required.

ACopyRight – A fragment of file copyrights. An blank string means that copyright control is disabled. If a certain pattern is specified, copyright texts will be searched for it. If it is found, the condition is considered fulfilled. The search is executed without taking into account the registry.

AMD5 – MD5 checksum of the file. A blank string or absence of the parameter disables MD5 control.

Compatibility: AVZ 4.34 and later

Note

Use “ARecurse = true” with care, especially if the folder being scanned contains multiple subfolders. File search in them may take a long time, causing a considerable load on system resources.

Note

When a copyright pattern or the MD5 checksum is specified, operations with the file are required. While reading copyrights uses up relatively insignificant resources, computing MD5 involves reading the entire file on the disk, which adversely affects performance. For this reason, check priorities are set for scanning:

- Size

- Date created and modified

- Copyrights

- MD5

This is why, for example, a search based on size and MD5 will be executed much faster than a search based only on MD5 – owing to the fact that the resource-intensive operation of computing MD5 will be performed for files of a suitable size only.

Examples:

1. Example of file quarantining based on name masks, without taking into account other parameters:

begin

QuarantineFileF('c:\windows', 'avm*.*', false, '', 0, 0);

end.

2. Example of quarantining EXE files with the specified size (very convenient for searching a template with a known size and unknown name):

begin

QuarantineFileF('c:\windows', '*.exe', false,'', 98154, 98154);

end.

3. Example of quarantining EXE and DLL files created or modified within the specified time interval:

begin

QuarantineFileF('c:\windows', '*.exe,*.dll', false,'', 0, 0, '1.06.2010', '3.06.2010');

end.

4. Example of quarantining DLL files based on MD5:

begin

QuarantineFileF('c:\windows', '*.dll', false,'', 0, 0, '', '', '', '91D52886E142ACB998D7539B6EF2040C');

end.

5. Example of quarantining DLL files based on MD5 and size:

begin

QuarantineFileF('c:\windows', '*.dll', false,'', 98154, 98154, '', '', '', '91D52886E142ACB998D7539B6EF2040C');

end.

6. Example of quarantining EXE files based on size and copyright fragments:

begin

QuarantineFileF('c:\windows', '*.exe', false, '', 80000, 12000, '', '', 'cool malware');

end.


function ClearQuarantine

function ClearQuarantine:boolean;

Clears the quarantine. Only the quarantine folder for the current date is cleaned.

Example:

begin

// Clearing Quarantine

ClearQuarantine;

end.


function GetAVZDirectory

function GetAVZDirectory : string;

Returns the full path (with the finalizing '\' at the end) to the folder from which AVZ was launched.

Example:

begin

AddToLog(GetAVZDirectory);

end.

In this example, the full path to the AVZ folder is recorded in the log.


function GetScanPath

function GetScanPath:string;

Returns a list of scanned folders. If several folders are specified for scanning, they are separated with semicolons.

Example:

var

s : string;

begin

setupavz('scan=c:\Program Files');

setupavz('scan=c:\windows');

addtolog('Scanned: ' + GetScanPath);

// Selecting the first scanned folder

s := GetScanPath;

if pos(';', s) > 0 then

s := copy(s, 1, pos(';', s) - 1);

addtolog('First scanned folder = ' + s);

end.


function GetAVZVersion

function GetAVZVersion : double;

Returns the AVZ version as a floating-point number. Keep in mind that it is not recommended to apply the condition "=" to floating-point variables.

Example:

begin

if GetAVZVersion < 4.20 then begin

AddToLog('AVZ version no older than 4.20 is required for script execution');

AddToLog('Current version - '+FormatFloat('#0.00', GetAVZVersion));

exit;

end;

end.


function GetAVZVersionTxt

function GetAVZVersionTxt : string;

Returns the AVZ version in text form. The function returns the string that is published in log copyrights (it contains the version and its release date).

Example:

begin

AddToLog(GetAVZVersionTxt);

end.

This example causes the string "(ñ) Kaspersky Lab, 2008, version 4.30 dated 6.04.2008" to be recorded in the log. Please note that this string is recorded in a localized format corresponding to the current language of the AVZ interface.

Note: In version-critical scripts, version control should be carried out by using the GetAVZVersion function.


function GetAVZSvcName

function GetAVZSvcName(ID : integer) : string;

Returns the name of the AVZ service with the specified ID.

Compatibility: AVZ 4.26 and later


procedure UnLockInterface

procedure UnLockInterface;

Unlocks the interface of the AVZ application for the user. Executing the procedure for the unlocked interface status and repeated executions do not create an error.


procedure LockInterface

procedure LockInterface;

Locks the interface of the AVZ application for the user. Running this procedure repeatedly does not cause an error.


procedure SetStatusBarText

procedure SetStatusBarText(AMsg : string);

Displays the specified text in the status string. This procedure can be used for displaying information about the script execution progress, especially when it takes a long time.


function SetAVZPMStatus

function SetAVZPMStatus(ANewStatus : boolean) : boolean;

Enables or disables AVZPM. ANewStatus is the new status of the AVZPM system. If ANewStatus = true, the AVZPM system is enabled; if false, it is disabled. Repetition of an enable or disable attempt does not cause an error. Enabling involves installing the driver on the disk, registering the driver in the registry, and loading the driver. Disabling involves deleting the registry key and the driver file from the disk.

Value returned: operation success attribute is returned, with “true” signifying a successful operation and “false” – an error.

Example:

if SetAVZPMStatus(True) then

AddToLog('AVZ PM successfully installed and enabled')

else

AddToLog('AVZ PM – error enabling');

Note:

Bear in mind that the AVZPM driver is loaded automatically on system startup. Therefore, after AVZPM has been enabled and the system is rebooted, the driver will load automatically.


function GetAVZPMStatus

function GetAVZPMStatus : boolean;

Returns the current status of AVZPM: true=enabled, false=disabled.

Example:

if GetAVZPMStatus then

AddToLog('AVZ PM active')

else

AddToLog('AVZ PM inactive');


function SetAVZGuardStatus

function SetAVZGuardStatus(ANewStatus : boolean) : boolean;

Enables or disables AVZGuard. ANewStatus is the new status of the AVZGuard system. If ANewStatus = true, the AVZGuard system is enabled; if false, it is disabled. Repetition of an enable or disable attempt does not cause an error.

Value returned: operation success attribute is returned, with “true” signifying a successful operation and “false” – an error.

Example:

if SetAVZGuardStatus(True) then

AddToLog('AVZGuard successfully enabled')

else

AddToLog('AVZGuard – error enabling');

Note: Remember that when you exit AVZ with AVZGuard running, you will lose control over it, which will require rebooting the computer.


function GetAVZGuardStatus

function GetAVZGuardStatus : boolean;

Returns the current status of AVZGuard: true=enabled, false=disabled.

Example:

if GetAVZGuardStatus then

AddToLog('AVZGuard active')

else

AddToLog('AVZGuard inactive');


function BC_Activate

function BC_Activate : boolean;

Enables the system, installs and configures the driver. Before executing BC_Activate, you have to specify the objects to be deleted. This is performed using the commands BC_DeleteFile, BC_DeleteReg, BC_DeleteSvc. The function returns “true” when driver installation and configuration succeeded or "false" when an error is returned.

Example:

begin

// Adding the PE386 driver deletion command to the scenario

BC_DeleteSvc('PE386');

// Enabling the driver

BC_Activate;

// Rebooting

RebootWindows(true);

end.


function BC_DeActivate

function BC_DeActivate : boolean;

Deletes the driver from the disk along with all registry keys and parameters belonging to the driver. Returns “true” when driver deletion succeeds.

See also: BC_Activate, BC_Execute


function BC_Execute

function BC_Execute : boolean;

Installs and configures the driver and then forces the driver loaded, which causes the driver to perform its task immediately, without a reboot. This can be used to delete objects from the kernel mode without rebooting, as well as for debugging purposes. The driver self-destructs after completing the operations successfully, which is why BC_DeActivate is not required.

Execution of BC_Execute does not affect the settings prepared by other commands, which is why it is possible to repeatedly execute BC_Execute or BC_Activate without reconfiguration.

Examples:

begin

// Attempting to delete the PE386 driver from the kernel mode without a reboot

BC_DeleteSvc('PE386');

BC_Execute;

end.

begin

// Deleting the PE386 driver

BC_DeleteSvc('PE386');

BC_Activate;

end.

See also: BC_Activate


function BC_Clear

function BC_Clear : boolean;

Clears the existing settings. This operation is performed automatically at the start of the script.


function BC_LogFile

function BC_LogFile(AFileName : string) : boolean;

This function lets you enable logging and specify the name and location of the log file. Using a blank string to specify the log name disables logging. Logging is disabled by default. Specifying an invalid file name or a valid file name on a disk that is not available when the system is booting does not cause an error—logging is disabled when the attempt to create a log file fails, but the driver will perform all the operations indicated in settings.

Example:

begin

// Adding the PE386 driver deletion command to the scenario

BC_DeleteSvc('PE386');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Enabling the driver

BC_Activate;

// Rebooting

RebootWindows(true);

end.


function BC_QrFile

function BC_QrFile(AFileName : string) : boolean;

Adds a command to quarantine the specified file to the BootCleaner scenario. The file name may contain macros. File quarantining through BootCleaner is useful when malware blocks access to its files by means of rootkit mechanisms that cannot be neutralized by the AVZ antirootkit. Quarantined files are accessible via the AVZ quarantine viewer, but the files are named bcqrXXXXX.dat and bcqrXXXXX.ini

Note: The quarantine command has priority over other commands.

begin

// Adding a file quarantine command to scenario

BC_QrFile('%WinDir%\trojan.exe');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Activation

BC_Activate;

end.


function BC_QrSvc

function BC_QrSvc(ASvcName : string) : boolean;

Adds a command to quarantine the specified service or driver. Quarantined files are accessible via the AVZ quarantine viewer, but the files are named bcqrXXXXX.dat and bcqrXXXXX.ini

begin

// Adding a service quarantine command to scenario

BC_QrSvc('PE386');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Activation

BC_Activate;

end.


function BC_DeleteFile

function BC_DeleteFile(AFileName : string) : boolean;

Adds a command to delete a file with the name AFileName to the BootCleaner scenario. The file name may contain macros.

begin

// Adding a file removal command to scenario

BC_DeleteFile('%WinDir%\trojan.exe');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Activation

BC_Activate;

end.


function BC_CopyFile

function BC_CopyFile(AFromName, AToName : string) : boolean;

Adds the file copying command AFromName -> AToName to the BootCleaner scenario. The file names may contain macros.

Compatibility: AVZ 4.26 and later


function BC_DeleteReg

function BC_DeleteReg(AKeyName : string) : boolean;

Adds a command to delete a registry key with the name AKeyName to the BootCleaner scenario. The registry key name should start with the section name; the following section names are allowed: HKLM, HKCU, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER.


function BC_DeleteSvcReg

function BC_DeleteSvcReg(ASvcName : string) : boolean;

Adds a command to delete a registry key of a driver or service with the name ASvcName to the BootCleaner scenario. It is noteworthy that this function does not delete the executable file on the disk.

The service/driver name may contain Unicode symbols, including symbols with code 0. Unicode symbols are specified using the special convention "\uXXXX", where XXXX represents the symbol code. For example: 'Super\u0000Duper\u0000Driver'


function BC_DeleteSvc

function BC_DeleteSvc(ASvcName : string) : boolean;

Adds a command to delete a driver or service with the name ASvcName to the BootCleaner scenario. Deletion implies searching for and deleting the executable file of the specified service, with subsequent deletion of the corresponding registry key.

The service/driver name may contain Unicode symbols, including symbols with code 0. Unicode symbols are specified using the special convention "\uXXXX", where XXXX represents the symbol code. For example: 'Super\u0000Duper\u0000Driver'


function BC_DisableSvc

function BC_DisableSvc(ASvcName : string) : boolean;

Adds a command to disable a driver or service with the name ASvcName to the BootCleaner scenario. Disabling implies setting Status 4 (disabled) in the corresponding registry key. In this case the remaining registry parameters and the file on the disk are not affected.

The service/driver name may contain Unicode symbols, including symbols with code 0. Unicode symbols are specified using the special convention "\uXXXX", where XXXX represents the symbol code. For example: 'Super\u0000Duper\u0000Driver'

Example:

begin

// Adding the PE386 driver disable command to the scenario

BC_DisableSvc('PE386');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Activation

BC_Activate;

// Rebooting

RebootWindows(true);

end.


function BC_ImportDeletedList

function BC_ImportDeletedList : boolean;

Imports the list of deleted files to Boot Cleaner settings. The list of deleted files is kept automatically and updated every time the DeleteFile function is executed. Additionally, lists can be added manually to the deleted files list with the help of SysCleanAddFile. The list of deleted files is used for heuristic cleaning of the system, which is activated by the ExecuteSysClean command.

Note: Executing the ExecuteSysClean function clears the list of deleted files. Therefore, you should use the ImportDeletedList function before running ExecuteSysClean.

Example:

begin

// Deleting files

DeleteFile('%WinDir%\Trojan1.exe');

DeleteFile('%WinDir%\Trojan2.exe');

DeleteFile('%WinDir%\Trojan3.exe');

// Importing the list of deleted files to Boot Cleaner settings

BC_ImportDeletedList;

// Cleaning up traces of deleted files

ExecuteSysClean;

// Enabling the Boot Cleaner driver

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

BC_Activate;

// Rebooting

RebootWindows(true);

end.


function BC_ImportQuarantineList

function BC_ImportQuarantineList : boolean;

Imports the list of files for which quarantine attempts were made into the Boot Cleaner settings. The list of files is kept automatically and updated every time the QuarantineFile function is executed. The BC_QrFile operation is performed for each file in this list.

Note: If the QuarantineFile does not specify a file name, it adds all possible file name versions to the quarantine list – the result of file search using different methods, file name + path to system folders. This is done to increase the probability that the right files needed for analysis will be quarantined.

Note: Boot Cleaner does not use the AVZ Trusted Objects Database, which is why absolutely any file can be added to Quarantine – the trusted files quarantine block does not apply to Boot Cleaner.

Example:

begin

// Quarantining files

QuarantineFile('%WinDir%\Trojan1.exe', '');

QuarantineFile('%WinDir%\Trojan2.exe', '');

QuarantineFile('%WinDir%\Trojan3.exe', '');

// Importing quarantine list to Boot Cleaner settings

BC_ImportQuarantineList;

// Enabling the Boot Cleaner driver

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

BC_Activate;

// Rebooting

RebootWindows(true);

end.


function BC_ImportALL

function BC_ImportALL : boolean;

Imports all information about operations previously performed using DeleteFile and QuarantineFile into the Boot Cleaner settings. This is used to simplify Boot Cleaner integration with common scripts.

Example:

begin

// Quarantining files

QuarantineFile('%WinDir%\Trojan1.exe', '');

QuarantineFile('%WinDir%\Trojan2.exe', '');

// Deleting files

DeleteFile('%WinDir%\Trojan3.exe', '');

// Importing the list of quarantined and deleted files to Boot Cleaner settings

BC_ImportALL;

// Enabling the Boot Cleaner driver

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

BC_Activate;

// Rebooting

RebootWindows(true);

end.


Common examples

Example 1. You need to delete the file c:\trojan.exe without logging during the reboot.

Solution:

begin

// Adding the PE386 driver deletion command to the scenario

BC_DeleteFile('c:\trojan.exe');

// Enabling the driver

BC_Activate;

// Rebooting

RebootWindows(true);

end.

Example 2. You need to attempt to delete the file c:\trojan.exe from the kernel without with logging and without rebooting. The operations log should be located in the AVZ folder and the log file should be named boot_clr.log.

begin

// Adding the PE386 driver deletion command to the scenario

BC_DeleteFile('c:\trojan.exe');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Starting

BC_Execute;

end.

Example 3. You need to delete the PE386 driver during the reboot. The operations log should be located in the AVZ folder and the log file should be named boot_clr.log.

Solution:

begin

// Adding the PE386 driver deletion command to the scenario

BC_DeleteSvc('PE386');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Enabling the driver

BC_Activate;

// Rebooting

RebootWindows(true);

end.

Example 4. You need to delete the PE386 driver during the reboot after creating its copy in Quarantine. The operations log should be located in the AVZ folder and the log file should be named boot_clr.log.

Solution:

begin

// Adding the PE386 driver quarantine command to the scenario

BC_QrSvc('PE386');

// Adding the PE386 driver deletion command to the scenario

BC_DeleteSvc('PE386');

// Configuring the log

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

// Enabling the driver

BC_Activate;

// Rebooting

RebootWindows(true);

end.


procedure SearchRootkit

procedure SearchRootkit(UserModeLock, KernelModeLock : boolean);

UserModeLock – Controls the blocking of UserMode rootkits (false – analysis only, true – blocking).

KernelModeLock – Controls the blocking of KernelMode rootkits (false – analysis only, true – blocking).


procedure SearchKeylogger

procedure SearchKeylogger;

Searches for keyloggers and trojan DLLs. This operation is performed during scanning, and this function can be performed individually when necessary anywhere in the script. Analysis results are logged.

Compatibility:

AVZ 4.26 and later


procedure ExecuteSysChkEV

procedure ExecuteSysChkEV;

Runs the heuristic system scan (HSS). By default, the heuristic system scan is carried out during the computer scanning process if the "Heuristic system scan" check box is selected in the main window. Scan results are logged.

Compatibility:

AVZ 4.26 and later


procedure ExecuteSysChkIPU

procedure ExecuteSysChkIPU;

Runs a search for vulnerabilities. By default, the search for vulnerabilities is carried out during the computer scanning process if the "Searching for vulnerabilities" check box is selected in the main window. Scan results are logged.

Compatibility:

AVZ 4.26 and later


procedure ExecuteSysCheck

procedure ExecuteSysCheck(AFileName : string);

Carries out system analysis with an HTML log saved to the specified file (the HTML log is created simultaneously with creating an identically named ZIP file that contains it).

Example:

begin

// Run system analysis

ExecuteSysCheck(GetAVZDirectory + 'virusinfo_syscheck.htm');

end.


procedure ExecuteSysCheckEx

procedure ExecuteSysCheckEx(AFileName : string; ACheckMode : dword;

AScanAllSvc : boolean; ARepParams : dword);

It is the expanded analog of ExecuteSysCheck, containing a number of parameters that let you fine-tune system analysis and log generation.

Parameters:

AFileName – File name. The file name should have an HTM extension; XML and ZIP file names are generated from it by substituting the extension.

ACheckMode – a bit mask specifying the check mode. Every bit corresponds to a certain check (bit (weight)):

0 (1) – Processes

1 (2) – Process libraries

2 (4) – Services and drivers

3 (8) – Kernel space modules

4 (16) – Autorun

5 (32) – SPI/LSP providers

6 (64) – Open TCP/UDP ports

7 (128) – Internet Explorer extensions

8 (256) – Windows Explorer extensions

9 (512) – Printing system extensions

10 (1024) – Task Scheduler jobs

11 (2048) – Hosts file

12 (4096) – Protocol handlers

13 (8192) – Downloaded Program Files

14 (16384) – Control panel applets (CPL)

15 (32768) - Active Setup

AScanAllSvc – services and drivers scanning mode. If this parameter equals "true", all services and drivers are logged, if "false" - only active ones.

ARepParams – A bit mask with parameters controlling report generation.

0 (1) – Clean files filtering mode. If this bit is set, clean files are not logged.

1 (2) – If the bit is set, the details of all files are published in the XML report.

2 (4) – If the bit is set, only details of files not found in the Trusted Objects Database are published in the XML report.

3 (8) – Delete the HTML file after creating the archive.

4 (16) – Delete the XML file after creating the archive.

5 (32) – Do not create the ZIP archive.

Compatibility:

AVZ 4.28 and later

Example:

begin

ExecuteSysCheckEX('C:\avz_rep.htm', $FFFFFFFF, true, 1+2+16+32);

end.

In this example, all checks are performed ($FFFFFFFF – all "1" bits); active and inactive services and drivers are analyzed; details of clean files are excluded from the HTML log; the XML report includes information on all files; HTML and XML files are deleted from the disk after archive creation.


function ExecuteWizard

function ExecuteWizard(ADBName : string; ACheckLevel, AFixLevel : integer;

AUseBackup : boolean) : integer;

Runs a system check with the help of the troubleshooting wizard. The parameters let you specify the danger threshold for problems and the danger threshold for automatic removal. The function keeps a rollback database that can be used to undo the changes made.

Parameters:

ADBName – Database name. The following names are allowed:
TSW – Database of the troubleshooting wizard
BT – Database for checking browser and system security settings

PRT – Wizard database for removing system data affecting privacy (logs, reports, cookies, etc.)

SCU – Wizard database for system cleanup (temporary files, all kinds of caches, memory dumps, logs – supported starting with version 4.32)

ACheckLevel – Triggering threshold. Problem severity is measured on a scale of 1 to 3 (1 – minor issues and errors; 2 – problems of average severity; 3 – dangerous errors and issues). Specifying a value outside the 1…3 range will cause an error and the function will not work.

AFixLevel – Triggering threshold for automatic fixing of issues. The problem severity is compared with this threshold; if problem severity level is higher than or equal to the threshold, the problem is fixed automatically. The allowable value range is 1...3; specifying the value “1” disables the automatic fixing system, and the ExecuteWizard function works in data collection mode.

AUseBackup – If this parameter equals “true”, changes performed by the function are saved in the rollback database.

Value returned: The function returns “1” in case of an error. If the function is performed successfully, it returns the number of detected problems with a severity level higher than or equal to the ACheckLevel threshold.

Compatibility:

AVZ 4.28 and later

Examples:

var

X : integer;

begin

X := ExecuteWizard('TSW', 2, -1, false);

AddToLog('Number of problems detected = '+inttostr(X));

end.

This script loads the TSW database (troubleshooting wizard); the triggering threshold equals 2; automatic fixing is disabled.

var

X : integer;

begin

X := ExecuteWizard('TSW', 2, 3, true);

AddToLog('Number of problems detected = '+inttostr(X));

end.

This script loads the TSW database (troubleshooting wizard); the triggering threshold equals 2; automatic fixing threshold equals 3 (only severe errors are fixed); changes are saved in the rollback database.


function ExecuteSysClean

function ExecuteSysClean : boolean;

Performs heuristic system cleanup. Heuristic cleanup involves analyzing the registry and searching for traces of deleted files. By default, the file list is generated automatically and updated each time the DeleteFile function is executed. This list is cleared automatically after heuristic system cleanup.

Execution of this function causes the log to be supplemented with the entry, “Automatic cleanup of traces of programs deleted in the process of repairs". If any registry items are detected or deleted during the cleanup, the corresponding entries are made in the log.

Example:

begin

DeleteFile('%WinDir%\trojan.exe');

DeleteFile('C:\worm.exe');

// Cleaning up traces of deleted files

ExecuteSysClean;

end.

Starting with version 4.34, the heuristic system cleanup uses an additional code stored in the updatable database. It supports new system cleanups without the need to upgrade the AVZ version.


procedure SysCleanAddFile

procedure SysCleanAddFile(AFileName : string);

Adds a file with the name AFileName to the list used by the heuristic system cleanup function ExecuteSysClean. Adding a file to the list using SysCleanAddFile enables automatic deletion of traces of files that had been deleted previously manually or using a different antivirus application.

begin

// Deleting file

DeleteFile('%WinDir%\trojan.exe');

// Adding a file to the manual cleanup list

SysCleanAddFile('C:\worm.exe');

// Cleaning up traces of deleted files

ExecuteSysClean;

end.


procedure SysCleanDelFilesList

procedure SysCleanDelFilesList;

Clears the list of files the traces of which will be searched and deleted by the heuristic system cleanup subsystem. Clearing an empty list (and, accordingly, repeated execution of the function) is not an error.

Note: At the time of script execution, the file list is empty, so additional cleanup of the list by executing SysCleanDelFilesList is not required.

Example:

begin

// Deleting file

DeleteFile('%WinDir%\trojan.exe');

// Adding a file to the manual cleanup list

SysCleanAddFile('C:\worm.exe');

// Cleaning up traces of deleted files

ExecuteSysClean;

end.


procedure SysCleanGetFilesList

procedure SysCleanGetFilesList(AFileList : TStringList);

Returns a list of deleted files (and files forcefully added to the deleted files list by SysCleanAddFile command) in the string list AFileList. The string list should be initialized in advance. This function can be used to implement your own heuristic cleanup procedures for files deleted by the script.

Compatibility:

AVZ 4.34 and later

Example:

var

FileList : TStringList;

i : integer;

begin

DeleteFile('c:\test.txt');

FileList := TStringList.Create;

SysCleanGetFilesList(FileList);

for i := 0 to FileList.Count-1 do

AddToLog(FileList[i]);

FileList.Free;

end.


procedure SysCleanSetFilesList

procedure SysCleanSetFilesList(AFileList : TStringList);

Substitutes the current deleted files list (created in the course of file deletion using the script and execution of SysCleanAddFile) with the string list AFileList. The string list should be initialized and filled out in advance. This function can be used when you implement your own file deletion procedures or jointly with SysCleanGetFilesList.

Compatibility:

AVZ 4.34 and later

Example:

var

FileList : TStringList;

i : integer;

begin

SysCleanAddFile('c:\test1.txt');

SysCleanAddFile('c:\trojan.txt');

SysCleanAddFile('c:\test1.txt');

FileList := TStringList.Create;

SysCleanGetFilesList(FileList);

i := 0;

while i < FileList.Count do begin

if pos('test', LowerCase(FileList[i])) > 0 then FileList.Delete(i)

else inc(i);

end;

for i := 0 to FileList.Count-1 do

AddToLog(FileList[i]);

SysCleanSetFilesList(FileList);

FileList.Free;

end.


function ExecuteRepair

function ExecuteRepair(ID : integer) : boolean;

Executes the system repair microprogram with the specified number. You can view the microprogram numbers in the "System Restore" dialog box. The function returns “true” when microprogram execution has succeeded, or "false" when it returns errors.

Example:

begin

ExecuteRepair(3);

ExecuteRepair(5);

end.


function ExecuteStdScr

function ExecuteStdScr(ID : integer) : boolean;

Executes the script with the specified number from the “Standard scripts” section. You can view the script numbers in the "Standard scripts" dialog box. The function returns “true” when execution has succeeded or "false" when it returns errors.

Example:

begin

ExecuteStdScr(3);

end.


function ExecuteScript

function ExecuteScript(AScriptFile : string) : boolean;

Loads the script text from the text file named AScriptFile and executes it. For the duration of script execution, the operation of the initiating script is suspended. Successful execution returns “true” and failure returns “false” (an error results when the file has not been found or the script contains syntax errors, or when a fatal error occurred during script execution).

Compatibility:

AVZ 4.34 and later

Example:

begin

ExecuteScript('DeleteMalware.txt');

end.

Note:

· Do not create scripts causing infinite recursion (that is, the primary script executes "script 1", "script 1" executes "script 2", which in turn executes "script 1" – resulting in the execution of “script 2” and so forth ad infinitum).
· Scripts executed using the ExecuteScript function use a common quarantine folder and can modify common AVZ settings; however, they keep independent lists of deleted or quarantined files – keep this in mind when using such functions as ExecuteSysClean or BC_Activate.
· This function has been introduced into the script language mostly to organize “manager scripts”, that is, an ideology in which the principal script decides which scripts to run on a specific computer. This is convenient when AVZ is launched centrally on a network.


procedure ShutdownWindows

procedure ShutdownWindows(AForce : boolean);

Shuts down the system. The AForce flag controls the shutdown mode. If it equals “true”, shutdown happens in an accelerated (forced) mode without notifying applications that the system is shutting down. Forced system shutdown can cause the loss of open documents and incorrect termination of running programs.


procedure RebootWindows

procedure RebootWindows(AForce : boolean);

Reboots the system. The AForce flag controls the reboot mode. If it equals “true”, reboot happens in an accelerated (forced) mode without notifying applications that the system is rebooting.

Example:

begin

RebootWindows(false);

end.


function CheckFile

function CheckFile(AFileName : string) : integer;

Checks the specified file using the AV base and AVZ Trusted Objects Database.

Analysis results are determined by the return code:

-1 – File not found or inaccessible

0 – File not found in the Trusted Objects Database and not identified as malicious

1 – File identified as a malicious object

2 – File not found in the Trusted Objects Database and suspected of being a malicious object

3 – File found in the AVZ Trusted Objects Database or the Microsoft Security Catalog

If the function returns code 1 or 2, you can use GetLastCheckTxt to get detailed textual information (malware name and other details).


function GetLastCheckTxt

function GetLastCheckTxt : string;

Returns the textual description of the object detected by the file scanner. It makes sense to use it only after executing CheckFile that returned code 1 or 2. In all other cases, the function returns an empty string.


function CLSIDExists

function CLSIDExists(CLSID : string) : boolean;

Checks whether the specified CLSID exists in the registry. It is recommended to specify CLSID without curly brackets.

If CLSID is detected in the registry, the “true” value is returned. Otherwise, “false” is returned.

Example:

if CLSIDExists('B5F3970B-745E-46AC-B890-E08F69777D80') then

AddToLog('CLSID found !!');


function CLSIDFileExists

function CLSIDFileExists(CLSID : string) : boolean;

Returns “true” if the specified CLSID is in the registry and CLSID analysis made it possible to locate the file associated with CLSID and this file exists on the disk. Returns “false” in any other situation (no CLSID, no CLSID registry record).

Example:

if CLSIDFileExists('B5F3970B-745E-46AC-B890-E08F69777D80') then

AddToLog(CLSIDFileName('B5F3970B-745E-46AC-B890-E08F69777D80')+

' >> '+

'Suspected AdvWare.ToolBar.SearchIt');


function CLSIDFileName

function CLSIDFileName(CLSID : string) : string;

Returns the name of the file corresponding to the specified CLSID or an empty string if CLSID has not been found in the registry or its analysis did not make it possible to find the file name. The function does not check whether or not the file exists on the disk.

Example:

var

S : string;

begin

S := 'B5F3970B-745E-46AC-B890-E08F69777D80';

if CLSIDFileExists(S) then

AddToLog(CLSIDFileName(S)+

' >> '+

'Suspected AdvWare.ToolBar.SearchIt');

end.


procedure DelCLSID

procedure DelCLSID(CLSID : string);

Deletes registration of the class with the specified CLSID from the registry. Absence of a class with the specified CLSID is not an error.

Deletion of registration implies the following operations:

• Deletion of class registration
• Deletion of an interface with the same CLSID (if it exists)
• Deletion of BHOs and Internet Explorer extension toolbars with the specified CLSID
• Deletion of ActiveSetup records with the specified CLSID
• Deletion of Windows Explorer extensions with the specified CLSID
• Deletion of SharedTaskScheduler items

Note that CLSID must be specified without curly brackets.

Example:

begin

DelCLSID('B5F3970B-745E-46AC-B890-E08F69777D80');

end.


function BHOExists

function BHOExists(BHO : string) : boolean;

Checks whether a BHO or a different Internet Explorer extension with the specified CLSID exists. It is recommended to specify CLSID without curly brackets. If a BHO is detected in the registry, the “true” value is returned. Otherwise, “false” is returned.


procedure DelBHO

procedure DelBHO(BHO : string);

Deletes a BHO with the specified CLSID. It is recommended to specify CLSID without curly brackets.


function ServiceExists

function ServiceExists(AName : string) : boolean;

Searches for registration data in the registry. Returns “true” when a service or driver with the specified name AName is registered in the registry.

Example:

begin

if ServiceExists('PE383') then

AddToLog('PE386 rootkit driver detected');

end.


function ServiceAndFileExists

function ServiceAndFileExists(AName : string) : boolean;

Searches for registration data in the registry and the corresponding file on the disk. Returns “true” when a service or driver with the specified name is registered in the registry and the file corresponding to it has been found on the disk.


function StartService

function StartService(AName : string) : boolean;

Starts a service or loads a driver with the specified name.


function StopService

function StopService(AName : string) : boolean;

Stops a service or unloads a driver with the specified name.


function DeleteService

function DeleteService(AName : string; ADelFile : boolean = false) : boolean;

Deletes a service or driver with the name AName from the registry. The function returns “true” when deletion has succeeded or "false" when it has failed. The second parameter, ADelFile (optional and can be omitted), specifies the deletion mode. By default, it equals “false”. As a result, the file on the disk is not deleted when registration data of the driver is deleted from the registry. If ADelFile=true, following data deletion from the registry, an attempt is made to delete the driver file from the disk.

Example:

begin

DeleteService('PE386', true);

end.

Note: Starting with version 4.32, this function automatically executes RegKeyResetSecurity if necessary.


function GetServiceFile

function GetServiceFile(AName : string) : string;

Returns the full name of the executable file of the specified service or driver. If the service or driver with the specified name has not been located, an empty string is returned.


function GetServiceStart

function GetServiceStart(AServiceName: string): integer;

Returns the code of the autorun mode of a service or driver with the name AServiceName.

Autorun codes:

-1 – Error determining the autorun code

1 – Loads during initial system startup

2 – AUTO mode – loads automatically

3 – MANUAL mode – loaded manually (when commanded by the user or an application)

4 – Loading forbidden

Compatibility: AVZ 4.26 and later

Example:

var

ASvc : string;

begin

ASvc := 'RemoteRegistry';

if GetServiceStart(ASvc) < 4 then

AddToLog('>> potentially dangerous service allowed '+

ASvc+' ('+GetServiceName(ASvc)+')');

end.


function SetServiceStart

function SetServiceStart(AServiceName: string; AStart: integer): boolean;

Sets the code of the autorun mode equaling AStart of a service or driver with the name AServiceName. Returns “true” when the autorun mode code has been set successfully or “false” when it has failed.

Autorun codes:

1 – Loads during initial system startup

2 – AUTO mode – loads automatically

3 – MANUAL mode – loaded manually (when commanded by the user or an application)

4 – Loading forbidden

Compatibility: AVZ 4.26 and later

Example:

begin

if SetServiceStart('RemoteRegistry', 4) then

AddToLog('RemoteRegistry service disabled successfully');

end.


function GetServiceName

function GetServiceName(AServiceName: string): string;

Returns the display name of a service or driver with the name AServiceName. The display name is not required and is stored in the registry; it is convenient to use it when generating logs as detailed information. The function returns an empty string in case of an error.

Compatibility: AVZ 4.26 and later

Example:

var

ASvc : string;

begin

ASvc := 'RemoteRegistry';

if GetServiceStart(ASvc) < 4 then

AddToLog('>> potentially dangerous service allowed '+

ASvc+' ('+GetServiceName(ASvc)+')');

end.


procedure DelSPIByFileName

procedure DelSPIByFileName(ALibrary : string; NameCompare : boolean);

Deletes the SPI/LSP provider by the name of the supplier library ALibrary. The NameCompare parameter manages the name comparison algorithm: if it equals “false”, the full names of files are compared. If NameCompare=true, only file names without paths are compared. Files names are compared without taking into account the register; file names are subjected to normalization before comparison.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.


procedure CheckSPI

procedure CheckSPI;

Checks SPI/LSP settings. When errors are detected, information is logged.

Compatibility: AVZ 4.26 and later

Example:

begin

CheckSPI;

end.


procedure AutoFixSPI

procedure AutoFixSPI;

Analyzes SPI/LSP settings and automatically corrects all errors detected. Starting with version 4.26, AVZ automatically backs up settings in the BackUp folder before fixing errors when this function is executed. The backup copy is a standard REG file.

Note: The principle of error search involves deleting references to nonexistent providers. This is why using AutoFixSPI at the end of a file deletion script can cause a situation where AVZ is unable to delete a file while performing DeleteFile and marks it for delayed deletion. Consequently, while executing the AutoFixSPI command, the analyzer will detect the file and will not consider the reference to this file to be an error. You should take this situation into account when deleting files that are SPI providers. A solution to this situation is deleting the SPI provider by file name.

Note: When the analyzer fails to find a file on the disk, it considers the provider libraries to be nonexistent. However, various faults in analyzer operation are possible. For example, when AVZ has been started under a user account without administrator privileges or from a terminal session on a server.

Example:

begin

AutoFixSPI;

end.


procedure DelWinlogonNotifyByFileName

procedure DelWinlogonNotifyByFileName(AFileName : string);

Deletes from the registry the registration of a Winlogon element corresponding to the specified file name. Only a file name or a full file name with the path can be specified as AFileName.

Example:

begin

DelWinlogonNotifyByFileName('1_32bean32_1.dll');

end.


procedure DelWinlogonNotifyByKeyName

procedure DelWinlogonNotifyByKeyName(AKeyName : string);

Deletes a Winlogon element based on a known key name in the registry.

Example:

begin

DelWinlogonNotifyByKeyName('1_32bean32_1reg');

end.


function DelAutorunByFileName

function DelAutorunByFileName(AKeyName : string) : boolean;

Deletes an autorun element by file name. Only a file name or a full file name with the path can be specified as AFileName.

Compatibility: AVZ 4.26 and later

Example:

begin

DelAutorunByFileName('trojan.dll');

end.


function RegKeyExists

function RegKeyExists(ARoot, AName : string) : boolean;

Returns “true” if the registry contains an accessible key with the name AName in the ARoot section, and “false” if the key does not exist or invalid parameters have been specified. The value “false” is also returned when the key exists, but there are not even minimal privileges to access the file.

Example:

begin

if RegKeyExists('HKLM', 'Software\Gator') then

AddToLog('Key registry belonging to Gator found');

end.


function RegKeyExistsEx

function RegKeyExistsEx(ARoot, AName : string) : boolean;

Returns “true” if the registry contains a key with the name AName in the ARoot section, and “false” if the key does not exist or invalid parameters have been specified. This function is identical to RegKeyExists, except that:

1. RegKeyExistsEx is not sensitive to privileges to the key that is sought, provided that at least minimum privileges for the parent key exist.

2. The execution of RegKeyExistsEx is slower than that of RegKeyExists because it searches for the key instead of attempting to open it.

This function is recommended when there are suspicions that the key that is sought has been hidden and protected by removing privileges to this key. In all other cases, RegKeyExists is recommended.

Compatibility: AVZ 4.32 and later

Example:

begin

if RegKeyExistsEx('HKLM', 'Software\Gator') then

AddToLog('Key registry belonging to Gator found');

end.


procedure RegKeyDel

procedure RegKeyDel(ARoot, AName : string);

Deletes the specified registry key. AName is the key name, ARoot is the section name.

An attempt to delete a nonexistent key does not cause an error.


procedure RegKeyCreate

procedure RegKeyCreate(ARoot, AName : string);

Creates a registry key with a unique name. AName is the key name, ARoot is the section name.


function RegKeyParamExists

function RegKeyParamExists(ARoot, AName, AParam : string) : boolean;

Returns “true” if the key with the name AName contains the parameter “AParam”.


procedure RegKeyParamDel

procedure RegKeyParamDel(ARoot, AName, AParam : string);

Deletes the parameter named AParam of the key named AName in the section ARoot. Specifying a nonexistent parameter, key, or section does not cause an error.


function RegKeyStrParamRead

function RegKeyStrParamRead(ARoot, AName, AParam : string) : string;

Reads the text parameter named AParam of the key AName in the section ARoot. Specifying a nonexistent parameter, key, or section is not an error. In this case the function returns an empty string.


function RegKeyIntParamRead

function RegKeyIntParamRead(ARoot, AName, AParam : string) : dword;

Reads the parameter of the REG_DWORD type with the name AParam of the key AName in the section ARoot. Specifying a nonexistent parameter, key, or section is not an error. In this case the function returns 0.


procedure RegKeyStrParamWrite

procedure RegKeyStrParamWrite(ARoot, AName, AParam, AValue : string);

Writes the value AValue to the parameter AParam of the REG_SZ type (string) in the registry key AName in the section ARoot. If the key or parameter do not exist, they will be created automatically.


procedure RegKeyIntParamWrite

procedure RegKeyIntParamWrite(ARoot, AName, AParam : string; AValue : dword);

Writes the value AValue to the parameter AParam of the REG_DWORD type (numerical value) in the registry key AName in the section ARoot. If the key or parameter does not exist, it will be created automatically.


procedure RegKeyBinParamWrite

procedure RegKeyBinParamWrite(ARoot, AName, AParam : string; AValue : dword);

Writes the value AValue to the parameter AParam of the REG_BINARY type (binary value of any length) of the registry key AName in the section ARoot. If the key or parameter does not exist, it will be created automatically.

The binary parameter value is presented in the form of text, per byte. Each byte is encoded in the hexadecimal format, with the comma used as a separator. Preceding zeros in numbers and blanks are ignored.

Example:

begin

RegKeyBinParamWrite('HKEY_LOCAL_MACHINE',

'SOFTWARE\Microsoft\Windows\CurrentVersion',

'Test',

'011,23,5, F2,0E4,1B');

end.


function RegKeyParamWrite

function RegKeyParamWrite(ARoot, AName, AParam : string;

AType, AValue : string) : boolean;

Writes the value AValue to the parameter AParam of the type AType of the registry key AName in the section ARoot. If the key or parameter does not exist, it will be created automatically. The function returns “true” if the writing to the registry succeeded or "false" if the writing of parameters failed.
The type is conveyed in the form of a string, with the following types supported:

• REG_DWORD
• REG_SZ
• REG_EXPAND_SZ
• REG_BINARY
• REG_MULTI_SZ (supported starting with AVZ 4.35)

When the REG_BINARY type is used, the value is specified similarly to the value in the function RegKeyBinParamWrite. If you specify a type different to those listed above, the writing to the registry will not be performed and the function will return “false”. For the REG_DWORD type, the value is conveyed in the form of a string and specified in the decimal form (for example, ‘1234’) or hexadecimal form (two writing formats are supported: '$0F' and '0x0F', with no fundamental difference between 0x and $).

Example:

begin

RegKeyParamWrite('HKEY_LOCAL_MACHINE',

'SOFTWARE\Microsoft\Windows\CurrentVersion',

'Test0',

'REG_BINARY',

'011,23,5, F2,0E4,1B');

RegKeyParamWrite('HKEY_LOCAL_MACHINE',

'SOFTWARE\Microsoft\Windows\CurrentVersion',

'Test1',

'REG_SZ',

'Test string value');

RegKeyParamWrite('HKEY_LOCAL_MACHINE',

'SOFTWARE\Microsoft\Windows\CurrentVersion',

'Test2',

'REG_EXPAND_SZ',

'Test string value, type REG_EXPAND_SZ');

end.

Example of using the REG_MULTI_SZ type. Please note that the string separator in the list is a symbol with the code #0.

begin

RegKeyParamWrite('HKLM',

'SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost',

'test',

'REG_MULTI_SZ',

'st1'#0'st2');

end.


function RegSearch

function RegSearch(ARoot, AName, AValue : string) : boolean;

Scans a key with the name AName in the registry section ARoot and searches for the template AValue. Information about all keys found is logged. If AName equals an empty string, all keys in the section ARoot are scanned. Comparison with the template does not take into account thy register; partial matches are allowed. This function is useful for searching the registry for specific data, for example, references to a file with a known name. The search can take a long time (up to several minutes).

Example:

begin

RegSearch('HKLM', '', 'svchost.exe');

end.

In this example, the function searches the registry and logs information about all instances of 'svchost.exe' in the registry.


function ExpRegKey

function ExpRegKey(ARoot, AName, AFileName : string) : boolean;

Exports a registry key. The key AName is exported from the registry section ARoot to a file with the name AFileName. The file format is a standard REG file; the recommended extension is “.reg”. The exported key can be imported into the registry using the registry editor ("File\Import" menu). By default, the standard system response to the opening of a REG file also involves an attempt to import it. The function returns “true” when execution has succeeded or "false" when it has failed.

Export is recommended as a backup tool for scripts modifying registry keys.

Compatibility: AVZ 4.26 and later

Example:

begin

// Exporting registry key to file

ExpRegKey('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies','policies_backup.reg');

// Deleting registry key

RegKeyDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Policies');

end.


function ExpRegKeyEx

function ExpRegKeyEx(ARoot, AName : string; Lines : TStrings) : boolean;

Exports a registry key. Exports the registry key AName from the registry section ARoot into the string list Lines. The function returns “true” when execution has succeeded or "false" when it has failed. The principle of its operation makes this function identical to the ExpRegKey function, but it is useful when you need to export several different registry keys to a single file.

Export is recommended as a backup tool for scripts modifying registry keys.

Compatibility: AVZ 4.26 and later


function BackupRegKey

function BackupRegKey(ARoot, AName, ABackupName : string) : boolean;

Backs up a registry key. The principle of its operation makes this function analogous to ExpRegKey – it exports a key with the name AName from the registry section ARoot. The difference is that the file with the export results is created in the Backup AVZ folder; the file name consists of the prefix ABackupName and the current date and time. If this file already exists on the disk (that is, the script executed BackupRegKey twice with the same ABackupName in the space of one second, an ordinal number is added to the file name. The prefix makes it possible to give a meaningful name to the file in order to simplify file search on the disk. It is allowed not to specify ABackupName, in which case the file name will contain the date and time only. If the key you are trying to back up does not exist in the registry, the file will not be created on the disk.

Backup is recommended for use in scripts modifying registry keys.

Compatibility: AVZ 4.26 and later

Example:

begin

// Backing up registry key

BackupRegKey('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies','policies');

// Deleting registry key

RegKeyDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Policies');

end.


function RegKeyEnumVal

function RegKeyEnumVal(ARoot, AName : string; AList : TStrings);

Creates a list of subkeys of a registry key with the name AName. The list AList has to be created and initialized before this function is executed.

Compatibility: AVZ 4.28 and later

Example:

var

Lines : TStrings;

i : integer;

begin

Lines := TStringList.Create;

RegKeyEnumVal('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings', Lines);

for i:= 0 to Lines.Count-1 do

AddToLog(Lines[i]);

Lines.Free;

end.


function RegKeyEnumKey

function RegKeyEnumKey(ARoot, AName : string; AList : TStrings);

Creates a list of subkeys of a registry key with the name AName. The list AList has to be created and initialized before this function is executed.

Compatibility: AVZ 4.28 and later

Example:

var

Lines : TStrings;

i : integer;

begin

Lines := TStringList.Create;

RegKeyEnumKey('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache', Lines);

for i:= 0 to Lines.Count-1 do

AddToLog(Lines[i]);

Lines.Free;

end.


function RegKeyResetSecurity

function RegKeyResetSecurity(ARoot, AName : string) : boolean;

Removes all privileges of a registry key with the name AName, making it accessible to all users. This function is useful for deleting registry keys created by malware. Very often, after creating a key, the malicious program changes access privileges for the key, blocking all operations except reading.

Compatibility: AVZ 4.32 and later

Example:

begin

RegKeyResetSecurity('HKLM', 'SYSTEM\CurrentControlSet\Services\TrojanDriverKey');

end.

Note: Starting with version 4.32, the functions RegKeyDel and DeleteService automatically execute RegKeyResetSecurity if necessary.


Section names

The following strings are allowed in naming sections:

'HKEY_LOCAL_MACHINE', 'HKLM' for HKEY_LOCAL_MACHINE

'HKEY_CLASSES_ROOT', 'HKCR' for HKEY_CLASSES_ROOT

'HKEY_CURRENT_USER', 'HKCU' for HKEY_CURRENT_USER

'HKEY_CURRENT_CONFIG', 'HKCC' for HKEY_CURRENT_CONFIG

'HKEY_USERS' for HKEY_USERS

'HKEY_PERFORMANCE_DATA' for HKEY_PERFORMANCE_DATA

'HKEY_DYN_DATA' - for HKEY_DYN_DATA

Please note that a key is specified in relation to the selected section. That is, if you need to work with the key HKEY_LOCAL_MACHINE\Software\TrojanKey, the section name will be 'HKEY_LOCAL_MACHINE', and the key will be "Software\TrojanKey". Section names are not case sensitive.


Managing INI files


function INIStrParamRead

function INIStrParamRead(AFileName, ASectionName, AParamName, ADefVal : string) : string;

Reads a parameter with the name AParamName from the section ASectionName of the file INI with the name AFileName. If this parameter exists, its value is returned; if it does not exist, the default value ADefVal is returned.

Compatibility: AVZ 4.26 and later


function INIStrParamWrite

function INIStrParamWrite(AFileName, ASectionName, AParamName, AParamVal : string) : boolean;

Writes a parameter with the name AParamName to the section ASectionName of the file INI with the name AFileName. If this parameter does not exist, it is created automatically; the same happens with the section and file. The function returns “true” when execution has succeeded or "false" when it has failed.

Compatibility: AVZ 4.26 and later


function INISectionExists

function INISectionExists(AFileName, ASectionName : string) : boolean

Checks whether an INI with the name AFileName contains a section with the name ASectionName. Returns “true” if the section exists and “false” in case of any error or if the section does not exist.

Compatibility: AVZ 4.26 and later


function INIEraseSection

function INIEraseSection(AFileName, ASectionName : string) : boolean

Erases a section with the name ASectionName from an INI file with the name AFileName. Returns “true” if removal succeeded or "false" if it failed.

Compatibility: AVZ 4.26 and later


function INIEraseParam

function INIEraseParam(AFileName, ASectionName, AParamName : string) : boolean;

Erases a parameter with the name AParamName from an INI file with the name AFileName. Returns “true” if removal succeeded or "false" if it failed.

Compatibility: AVZ 4.26 and later


function GetHostsFileName

function GetHostsFileName : String;

Returns the full name of the Hosts file in the system. The function factors in the fact that under NT systems the location of the Hosts file may be configured using the registry.

Example:

begin

AddToLog('Hosts file name = "' + GetHostsFileName + '"');

end.


function ClearHostsFile

function ClearHostsFile : boolean;

Clears the Hosts file. The Hosts file keeps all comments from the original file, and all meaningful strings are deleted, with the only meaningful string added: "127.0.0.1 localhost". The function returns “true” when execution has succeeded or "false" when it has failed.

Example:

begin

ClearHostsFile;

end.


function GetCurrentDirectory

function GetCurrentDirectory : string;

The function returns the current directory. The directory name is normalized and contains a back slash (\) at the end.

Examples:

begin

// Output to current directory log

AddToLog('Current directory = '+GetCurrentDirectory);

end.

begin

// Saving log to current directory

SaveLog(GetCurrentDirectory+'avz_log.txt');

end.


function GetSystemDisk

function GetSystemDisk : string;

The function returns the letter of the disk storing the system (Windows, ProgramFiles folders...). This function is useful for scanning the entire disk that stores system folders.

Example:

begin

// Setting – scan system disk

SetupAVZ('SCAN='+GetSystemDisk+':\');

end.


function GetTempDirectoryPath

function GetTempDirectoryPath : String;

Returns the path to the system folder for temporary files. The returned path includes a back slash at the end, for example, "c:\windows\temp"


function NormalDir

function NormalDir(ADirName : string) : string;

Normalizes the folder name. Normalization implies:

• Removing spaces at the start and the end of the folder name
• Substitutes "/" with "\"
• Removes slash repetitions (for example, C:\\abc). The exception is the paired back slash (\) at the start of the network path.
• Adds a back slash at the end of the path if necessary
• Substitutes macros with their values. For details see the "macros allowed in file names" section.

This function is convenient in different procedures that process folders.

Examples:

NormalDir('c:\test') = 'c:\test\'

NormalDir('c:\\test') = 'c:\test\'

NormalDir('c:\\test/abc/') = 'c:\test\abc\'

NormalDir('%SysDisk%:\\test') = 'c:\test\'


function NormalFileName

function NormalFileName(AName : string) : string;

Returns the full normalized file name. Name normalization implies:

1. Substituting macros with values

2. Processing prefixes of this kind: "\??\", "\System32"

3. Searching for a file when the full path to the file has not been specified


function ExtractFileName

function ExtractFileName(AName : string) : string;

Extracts the file name from the full name. For example, when the function receives the full file name "c:\virus\file.exe", it will return "file.exe".

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Example:

begin

AddToLog(ExtractFileName('c:\windows\virus.exe'));

end.

In this example, the text “virus.exe” will be logged.


function ExtractFilePath

function ExtractFilePath(AName : string) : string;

Extracts the path to the file from the full file name. For example, when the function receives the full file name "c:\virus\file.exe", it will return "c:\virus\".

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Example:

begin

AddToLog(ExtractFilePath('c:\windows\virus.exe'));

end.

In this example, the text “c:\windows\” will be logged.


function ExtractFileExt

function ExtractFileExt(AName : string) : string;

Extracts the file extension from the full or relative file name. For example, when the function receives the full file name "c:\virus\file.exe", it will return ".exe". Please note that the extension is returned together with the preceding point.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Example:

begin

AddToLog(ExtractFileExt('c:\windows\virus.exe'));

AddToLog(ExtractFileExt('virus.exe'));

end.


function DirectoryExists

function DirectoryExists(ADirName : string) : boolean;

Returns “true” if the specified directory exists on the disk. The directory name is normalized automatically, which is why the presence or absence of a back slash (\) at the end of the path, and the presence of spaces at the start or the end of the directory name does not affect the operation of this function.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.


procedure CreateDirectory

procedure CreateDirectory(ADirName : string);

Creates a directory with the specified name on the disk. The directory name returned as the parameter is normalized automatically.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.


procedure DeleteDirectory

procedure DeleteDirectory(ADirName : string);

Deletes an empty directory with the specified name. The directory name returned as the parameter is normalized automatically.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

The absence of a director or inability to delete it is not an error. Use the DirectoryExists function to check whether the operation succeeded. If the directory contains subdirectories or files, it will not be possible to delete it using DeleteDirectory. Before you do so, delete the files and folders contained in it. The DeleteFileMask function can be used in this case for recursive deletion of files and folders.


function FileExists

function FileExists(AFileName : string) : boolean;

The function returns “true” if the specified file has been found on the disk.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.


function GetFileSize

function GetFileSize(AFileName : string) : integer;

Returns the size of the specified file in bytes. In case of an error (file not found, access error), the size “-1” is returned.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Example:

begin

AddToLog(IntToStr(GetFileSize('%System32%\notepad.exe')));

end.


function GetFileVersion

function GetFileVersion(AFileName : string; AInfoType : integer) : string;

Returns the version or copyrights of the specified executable file (if it has the copyrights). AInfoType contains a code indicating which field has to be returned:

1 - CompanyName

2 - FileDescription

3 - FileVersion

4 - InternalName

5 - LegalCopyright

6 - ProductVersion

7 - ProductName

8 - FileLongVersion (in the form of two numbers separated with a point)

9 - ProductLongVersion (in the form of two numbers separated with a point)

10 - VersionNum

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

If the file does not exist, is inaccessible, or does not contain information of the specified type, the function returns an empty string.

Compatibility: AVZ 4.32 and later

Example:

var

i : integer;

begin

for i := 1 to 10 do

AddToLog( inttostr(i)+' = '+GetFileVersion('%System32%\kernel32.dll', i));

end.

Execution of this function will cause the following information to be logged:

1 = Microsoft Corporation

2 = Library of the client Windows NT BASE API

3 = 5.1.2600.5781 (xpsp_sp3_gdr.090321-1317)

4 = kernel32

5 = © Microsoft Corporation. All rights reserved.

6 = 5.1.2600.5781

7 = Operating system Microsoft® Windows®

8 = 327681.170399381

9 = 327681.170399381

10 = 327681


function GetAttr

function GetAttr(AName : string) : integer;

Returns a number with bit-encoded attributes of the specified file or folder. Bit values are described in the "Encoding of file attributes" section.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

In case of an error, a number containing 1 in all digits is returned, i.e. $FFFFFFFF.

Compatibility: AVZ 4.32 and later

Example:

begin

AddToLog(IntToStr(GetAttr('%System32%\')));

AddToLog(IntToStr(GetAttr('%WinDir%\notepad.exe')));

end.


function SetAttr

function SetAttr(AName : string; Attr : integer):boolean;

This function assigns attributes Attr to a file or folder with the name AName. Encoding of attributes is described in the Encoding of file attributes section.

The function returns “true” when execution has succeeded or "false" when it has failed.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Compatibility: AVZ 4.32 and later

Example:

begin

SetAttr('%WinDir%', $10);

end.

In this example, all attributes of the system folder except the “directory” attribute are reset.


function CalkFileMD5

function CalkFileMD5(AFileName : string) : string;

Returns the MD5 checksum of the specified file, or an empty string if the file does not exist or access to it has been blocked.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Compatibility: AVZ 4.28 and later

Example:

begin

AddToLog(CalkFileMD5('%System32%\notepad.exe'));

end.


function DeleteFile

function DeleteFile(AFileName : string) : boolean;

Deletes the specified file. The function returns “true” when deletion has succeeded or "false" when it has failed.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Specifying a nonexistent file or an empty string is not an error.

If ordinary file deletion fails, emergency file deletion is used. The names of deleted files are added automatically to the file list used by the ExecuteSysClean function.

Example:

begin

DeleteFile('%WinDir%\trojan.exe');

end.


function DeleteFileMask

function DeleteFileMask(ADir, AMask : string; ARecurse : boolean; ASDFormula : string := '') : boolean;

Locates and deletes files in the ADir directory, the names of which match the AMask mask. The ARecurse parameter controls the processing of nested folders—if ARecurse = true, a recursive scan of directories will be performed, starting with the specified folder; files will be searched and deleted in each of the folders if match the AMask mask. After the folder has been processed, the algorithm runs a check to make sure there are no files remaining. If no files remain, the folder will be deleted automatically. If ARecurse = false, the file search and deletion will be carried out only in the specified directory.

It is possible to specify one or several masks using the AMask parameter. Where several masks are specified, they are separated with spaces, commas, or semicolons. That is, the following mask entry possibilities are equivalent:

*.exe;*.dll;*.com

*.exe,*.dll,*.com

*.exe *.dll *.com

The ASDFormula parameter defines the algorithm for irreversible file deletion. By default, the algorithm is not specified and the file is deleted as usual. If the algorithm is specified, irreversible deletion of all files matching the mask is carried out by executing the DeleteFileSecure function for each file that needs to be deleted. It is noteworthy that irreversible deletion may be slower than ordinary deletion by several orders of magnitude – the speed of irreversible deletion depends on the algorithm specified.

Note: This function is dangerous and can harm the system severely if invalid parameters are specified. This is why function arguments should be checked thoroughly before using the function.

Compatibility: AVZ 4.28 and later; the ASDFormula parameter appears in version 4.32 and later (the parameter contains the default value and full compatibility with version 4.28 is preserved).

Examples:

begin

// Clearing the TEMP folder

DeleteFileMask('%Tmp%', '*.*', true);

end.

begin

// Clearing the TEMP folder – irreversible deletion

DeleteFileMask('%Tmp%', '*.*', true, '01ARX');

end.


function DeleteFileSecure

function DeleteFileSecure(AFileName, AAlgF : string) : boolean;

This function performs irreversible file deletion using a user-specified algorithm. Ordinary file deletion involves removing the file from the list of files available on the drive and marking clusters occupied by the file as vacant. In this case, the clusters occupied by the file are not vacated physically, and the file information remains on the disk, which allows recovering a deleted file using specialized utilities. Irreversible file deletion implies destroying file contents before the file is deleted using a particular algorithm. There are multiple irreversible deletion algorithms that differ in terms of the set of deletion methods (overwriting with 0, 1, alternating bits, random data, specific byte sequences), their sequence and quantity. The DeleteFileSecure function makes it possible to carry out virtually any algorithm by specifying the “formula” of this algorithm in the AAlgF parameter.

It is possible to specify macros in the file name AFileName. For details see the “macros allowed in file names” section.

Deletion algorithm

The deletion algorithm is specified by a kind of “formula”—a text string in the AAlgF argument. Each string character encodes an operation, spaces, and unsupported characters are ignored, the characters are not case-sensitive. Certain operations can contain arguments specified in parentheses after the operation code. The absence of an opening or closing parenthesis is an error.

Supported operation codes:

E—Runs a file search. If the file is missing, further processing is discontinued.

0—Overwrites file contents with zeroes (bytes with the 0x00 code)

1—Overwrites the file contents with 1s (bytes with the 0xFF code)

5—Overwrites file contents with a sequence of alternating 0s and 1s (bytes with the 0x55 code)

6—Overwrites the file contents with sequence of alternating 1s and 0s (bytes with the 0xAA code)

R—Overwrites the file contents as random characters

B( )—Overwrites the file contents with a specific sequence of characters. The sequence must be specified as an argument, byte-serial, in parentheses, with the comma used as the separator. The absence of an opening or closing parenthesis after Operation B is an error that causes the formula processing to be interrupted. That is, in case of Operation B the minimum structure must look like this: B ( ). The byte values must be specified in a hexadecimal presentation, with the minimum number of bytes being one. In byte descriptions, preceding zeros are not mandatory, meaning that the values “F” and “0F” are equivalent. Operation B is universal; operations "0", "1", "5" and "6" are its particular cases (accordingly, Operation 0 is equivalent to "B(00)", "1" = "B(FF)", "5" = "B(55)", "6" = "B(AA)")A—Adjusts the file size upward to a size divisible by cluster size (in order to ensure guaranteed deletion of the data in the last cluster) by increasing the file size.

Z—An analog of A; it adjusts file size upward to a size divisible by cluster size (in order to ensure guaranteed deletion of the data in the last cluster) by writing additional bytes with 0 code into the file.

N—Inverses all file bytes (“NOT” operator). This operation involves reading the file contents from the drive, inverting the bytes read, and saving them to file.

K—Replaces all file bytes with their additional codes. This operation involves reading the file contents from the disk, computing additional codes for the bytes read, and saving the result to file.

T—Truncates file length to zero size.

C—Creates a zero-size file. If the file exists, its size is truncated to zero (equivalent of T).

D—Deletes the file.

X—Performs the complete procedure of file deletion using AVZ tools, including delayed deletion.

Note:

1. The file will remain on the drive, unless D or X is specified at the end of the algorithm.

2. If the X operator is not specified in the algorithm, the file will not be included in the list of deleted files for the heuristic cleanup.

3. If the file has been blocked or opened by a different application in an exclusive access mode (that is, writing to file is impossible), the procedure specified by the algorithm will not work. This is why it is recommended to use the X operator in any case in order to engage the delayed deletion mechanism.

Compatibility: AVZ 4.32 and later

Examples:

begin

DeleteFileSecure('c:\top_secret.txt', 'E01TX');

end.

In this example, the algorithm checks whether the file exists (E). If it exists, the file is overwritten with zeros (0), with ones (1), is truncated to zero length (T), and then is deleted using AVZ tools (X).

begin

DeleteFileSecure('c:\top_secret.txt', 'EB(AA,55,FF,00)TX');

end.

In this example, the algorithm checks whether the file exists (E). If it exists, the file is overwritten with a recurring sequence of bytes with the codes AA 55 FF 00, is truncated to zero length (T), and is then deleted using AVZ tools (X).

begin

DeleteFileSecure('c:\top_secret.txt', 'ER01ARTX');

end.

In this example, the algorithm checks whether the file exists (E). If it exists, the file is overwritten with random characters (R), zeros (0), ones (1); the file size is adjusted to the cluster size (A), after which the file is overwritten with random characters (R), truncated to zero length (T), and then deleted using AVZ tools (X).

begin

DeleteFileSecure('c:\top_secret.txt', 'E0156RA0156RTX');

end.

In this example, the algorithm checks whether the file exists (E). If the file exists, it is overwritten with zeros (0), ones (1), characters with the codes 0x55 (5) and 0xAA (6); then the file size is adjusted to the cluster size (A), the deletion procedure using the previously described methods is performed (0156R), and then the file is truncated to zero length (T), after which it is deleted using AVZ tools (X).

begin

DeleteFileSecure('c:\top_secret.txt', 'E 01 01 01 01 01 01 01 X');

end.

In this example, the file contents are overwritten 7 times with 0s and 1s before being deleted. In this example the algorithm uses spaces that are ignored, but are shown for the sake of clarity.

Defining the algorithm using the function parameters makes it possible to delete different files using different algorithms within a single script. For example:

begin

// Normal deletion

DeleteFile('c:\top_secret1.txt');

// Irreversible deletion

DeleteFileSecure('c:\top_secret2.txt', 'E RR TX');

DeleteFileSecure('c:\top_secret3.txt', 'E 01 R X');

end.

Where multiple files are deleted using an identical algorithm, it is convenient to use constants:

const

DelAlg = 'E 01 R A R X';

begin

DeleteFileSecure('c:\top_secret1.txt', DelAlg);

DeleteFileSecure('c:\top_secret2.txt', DelAlg);

DeleteFileSecure('c:\top_secret3.txt', DelAlg);

DeleteFileSecure('c:\top_secret4.txt', DelAlg);

end.

Examples of standard algorithms at work

1. Quick irreversible file deletion

begin

DeleteFileSecure('c:\top_secret.txt', 'E 0 TX');

DeleteFileSecure('c:\top_secret1.txt', 'E R TX');

end.

Quick deletion is implemented in different utilities (e.g., Acronis) and comes down to one-pass overwriting of the file contents with zeros or random characters. This operation is sufficient in most cases and can be carried out fairly quickly. This algorithm can be enhanced by adding the operations of deletion and repeated file creation. While these operations have virtually no influence on performance, they complicate the task for automated file recovery utilities.

begin

DeleteFileSecure('c:\top_secret.txt', 'E 0 DCZRT X');

end.

2. Russian standard, GOST R50739-95

begin

DeleteFileSecure('c:\top_secret.txt', 'E R TX');

end.

The Russian State Technical Commission defines 6 classes of protection against unauthorized access. Classes 6 to 4 require overwriting the memory and file contents with zeros (which corresponds to formula “0X”). Meanwhile, classes 3 to 1 require overwriting sectors with a pseudo-random sequence of numbers (“RX” formula). The currently effective state standard GOST R50739-95 has identical requirements to those of

Class 2 protection as defined by the State Technical Commission. According to this standard, all file contents must be overwritten with random characters.

3. Bruce Schneier's algorithm

begin

DeleteFileSecure('c:\top_secret.txt', 'E 10 RRRRR TX');

end.

In his book Applied Cryptography, Bruce Schneier proposes a deletion method comprising 7 operations: overwriting with logical 1s (0xFF), 0s (0x00), and 5 passes of deletion of the file contents using random byte sequences ((implemented easily—the "10RRRRRX" for ordinary and "" for advanced).

4. German standard VSITR

begin

DeleteFileSecure('c:\top_secret.txt', 'E 01 01 01 6 TX');

end.

The German algorithm involves a deletion method comprising 7 operations, during each of which the file contents are overwritten with the following bytes: 0x00, 0xFF, 0x00, 0xFF, 0x00, 0xFF, 0xAA

5. American standard, NAVSO P-5239-26 (MFM)

begin

DeleteFileSecure('c:\top_secret.txt', 'E B(01,00,00,00) B(FF,FF,FF,7F) R TX');

end.

This algorithm performs deletion in three passes: 1st pass—deletion using the 0x01 value, 2nd — 0x7FFFFFFF, 3rd — random sequences of characters.

6. American standard, NAVSO P-5239-26 (RLL)

begin

DeleteFileSecure('c:\top_secret.txt', 'E B(01,00,00,00) B(FF,FF,FF,27) R TX');

end.

This algorithm performs deletion in three passes: 1st pass—deletion using the 0x01 value, 2nd — 27FFFFFF, 3rd — random sequences of characters.

7. American: 5220.22-M

begin

DeleteFileSecure('c:\top_secret.txt', 'RKR TX');

end.

This algorithm performs deletion in three passes: 1st pass—random characters written into each byte of each sector; 2nd pass—additional characters to those written during the 1st pass; 3rd—random characters.

8. Peter Gutmann’s algorithm

This algorithm is very complex and cumbersome, as it involves using 35 (!!) cycles of file contents deletion. The algorithm is described in detail at http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html. It is noteworthy that it has practical uses only for deleting especially valuable data on magnetic data media.

begin

DeleteFileSecure('c:\top_secret.txt', 'E RRRR 56 '+

'B(92,49,24) B(49,24,92) B(24,92,49)'+

'0 B(11)B(22)B(33)B(44)B(55)B(66)B(77)B(88)B(99)B(AA)B(BB)B(CC)B(DD)B(EE) 1'+

'B(92,49,24) B(49,24,92) B(24,92,49)'+

'B(6D,B6,DB) B(B6,DB,6D) B(DB,6D,B6)'+

'RRRR TX');

end.

Multi-pass overwriting of file contents in the algorithms considered here is proposed in order to re-magnetize the drive surface and complicate data retrieval by special technical means (such as taking the HDD apart and placing the drives into a special device). These techniques do not raise the degree of protection when deleting data from flash drives, SSD drives; they may prove ineffective for hybrid HDDs (that is, HDDs containing a non-volatile cache for rapidly changing data), RAID arrays, and network storages (since the latter normally have fairly large caches, as a result of which multi-pass physical deletion of the file may never occur on the drive). This is why for the majority of practical uses it is enough to overwrite the file contents with random data and then delete it:

begin

DeleteFileSecure('c:\top_secret.txt', 'R DCAT X');

end.

In this case, the file contents are deleted by random values, after which the file is deleted, then re-created with a zero length, increased to the cluster size, and then truncated to zero value and deleted. Such file re-creations complicate the work of automated utilities designed for recovering deleted files.

Note: The DeleteFileMask function with the ASDFormula parameter should be used to delete irreversibly all files in a specific directory or files by their mask.


function CopyFile

function CopyFile(AFromName, AToName : string) : boolean;

A file with the name AFromName is copied to a file with the name AToName. Returns “true” if copying succeeded or "false" if it failed.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.


function RenameFile

function RenameFile(AFromName, AToName : string) : boolean;

A file with the name AFromName is renamed to a file with the name AToName. The function returns “true” when renaming has succeeded or "false" when it has failed.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Example:

begin

RenameFile('%WinDir%\trojan.exe', '%WinDir%\trojan.bak');

end.


function GetDriveType

function GetDriveType(ADirName : string) : integer;

Determines the disk type. The ADirName parameter should contain the path to the root directory of the volume. For example, "C:\".

Values returned:

0 – Error; unable to determine disk type

1 – Specified disk does not exist (as an option, incorrectly specified path to the root directory of the volume, such as "C:\Windows")

2 – Removable drive

3 – HDD

4 – Network drive

5 – CD-ROM/DVD-ROM

6 – RAM drive

Compatibility: AVZ 4.26 and later

Example:

begin

AddToLog(Inttostr(GetDriveType('C:\')));

end.


function SearchFiles

function SearchFiles(APath, AMask : string; AFileList : TStrings; AFullPath, AAppendFiles : boolean) : integer;

Searches for files using the mask AMask in the directory APath.

The files found are placed in the list AFileList.

The AFullPath parameter sets the mode of appending the files found. If AFullPath equals “true”, full names of the files found are appended to the list, including the path to them. If it equals “false”, only file names without the path are appended.

The AAppendFiles parameter controls the mode of appending files to the list. It if equals “true”, the files found are appended to the list (from the practical viewpoint, this mode is relevant when AFullPath=false); if it equals “false”, the list is cleared before the search is started.

The function returns the number of files found according to the specified parameters, or 0 in case of an error.

It is possible to specify macros in the path (APath parameter). For details see the “macros allowed in file names” section.

This function is convenient for simple file search tasks. Use the TFileSearch class for more complex tasks. The function has an analog—the SearchFolders function, designed for a quick search of subfolders in the specified folder.

Compatibility: AVZ 4.30 and later

Example:

var

Lines : TStrings;

i : integer;

begin

Lines := TStringList.Create;

SearchFiles('%WinDir%', '*.exe', Lines, true, false);

for i:= 0 to Lines.Count-1 do

AddToLog(Lines[i]+', MD5='+CalkFileMD5(Lines[i])+

', Size='+inttostr(GetFileSize(Lines[i])));

Lines.Free;

end.

In this example, *.exe files are searched in the Windows directory. The files found are appended to the list with full paths, after which they are logged in a cycle. For practical demonstration purposes, in this example the MD5 checksum and size are determined for every file found.


function SearchFolders

function SearchFolders(APath, AMask : string; ADirList : TStrings; AFullPath, AAppendFolders : boolean) : integer;

Searches folders using the mask AMask in the directory APath.

The folders found are placed in the list ADirList.

The AFullPath parameter sets the mode of appending of the folders found. If AFullPath equals “true”, full names of the folders found are appended to the list, including the full path to them. If it equals “false”, only file names of the folders found are added without the path.

The AAppendFolders parameter controls the mode of list creation. It if equals “true”, the folders found are appended to the list (from the practical viewpoint, this mode is relevant when AFullPath=false); if it equals “false”, the list is cleared before the search is started.

The function returns the number of folders found according to the specified parameters, or 0 in case of an error.

It is possible to specify macros in the path (APath parameter). For details see the “macros allowed in file names” section.

This function is convenient for simple folder search tasks. Use the TFileSearch class for more complex tasks. The function has an analog—the SearchFiles function, designed for a quick search of files in the specified folder.

Compatibility: AVZ 4.32 and later

Example:

var

Lines : TStrings;

i : integer;

begin

Lines := TStringList.Create;

SearchFolders('%WinDir%', 'system*', Lines, true, false);

for i:= 0 to Lines.Count-1 do

AddToLog(Lines[i]);

Lines.Free;

end.

In this example, *.exe files are searched in the Windows directory. The files found are appended to the list with full paths, after which they are logged in a cycle.


function FolderIsEmpty

function FolderIsEmpty(AName : string):boolean;

The function returns “true” if the specified folder exists on the disk, or if it exists and is empty (does not contain files and subfolders). If the folder exists and contains at least one object, the function returns "false". This function is very useful for clearing folders containing caches, dumps, logs, and the like.

It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Compatibility: AVZ 4.32 and later

Example:

begin

if FolderIsEmpty('c:\temp') then

AddToLog('c:\temp is missing or empty')

else

AddToLog('c:\temp folder contains files or subfolders');

end.


function FSResetSecurity

function FSResetSecurity(AName : string) : boolean;

Removes all privileges of a file object with the name AName, making it accessible to all users. This function is useful for deleting files and folders created by malware.

Compatibility: AVZ 4.32 and later

Example:

begin

FSResetSecurity('%System32%\trojan.dll');

end.

Note: Starting with version 4.32, the DeleteFile function, when executed explicitly or implicitly, automatically executes FSResetSecurity in the event of unsuccessful file deletion.


Macros allowed in file names

%WinDir% - Path to the Windows directory (without \ at the end)

%SystemRoot%, %System32% - Substituted with the path to the folder System/System32 (without \ at the end)

%SysDisk% - System disk in the format "X:" (without \)

%Tmp% - Path to the system folder for temporary files

%PF% - Path to the Program Files folder on the system disk (without \ at the end)

Supported starting with version 4.26

%SYSTEMDRIVE% - Synonymous with %SysDisk%, system disk in the format "X:"

%Personal% - Path to the "My documents" folder of the current user

%ProfileDir% - Path to the folder containing user profiles

%USERPROFILE% - Path to the folder with the profile of the current user (taken from the environment variable of the same name)

Supported starting with version 4.32

%allusersprofile% - Path to the folder with the AllUsers profile (without \ at the end)

%AppData% - Path to the Application Data folder of the current user (without \ at the end)

%LocalSettings% - Path to the Local Settings folder of the current user (without \ at the end)

%Personal% - Path to the “My documents” folder of the current user (without \ at the end)

Note: Characters in macros are not case sensitive. For example, %SysDisk%, %SYSDISK% and %sysdisk% are equivalent.

Example:

begin

AddToLog(NormalDir('%LocalSettings%'));

end.

See also GetEnvironmentVariable


Encoding of file attributes

File attributes are a bit mask, in which every bit encodes a specific attribute. Working with bits is easy with the help of “OR” and “AND” operators.

Bit 0 (weight 1 = $01) – ReadOnly attribute

Bit 1 (weight 2 = $02) – Hidden attribute

Bit 2 (weight 4 = $04) – SysFile attribute

Bit 3 (weight 8 = $08) – VolumeID attribute

Bit 4 (weight 16 = $10) – Directory attribute

Bit 5 (weight 32 = $20) – Archive attribute

Bit 6 (weight 64 = $40) – SymLink attribute

Therefore, if you need to specify the ReadOnly and Archive attributes, then 1 or 32 = 33. By analogy with attribute checks, it is easy to mask the needed bits using the “AND” operator, for example:

var

FAttr : integer;

begin

FAttr := GetAttr('%System32%\');

if FAttr <> $FFFFFFFF then

if (FAttr and 79) > 0 then

AddToLog('System folder has suspicious attributes');

end.

In this example, mask 79 selects bits 0,1,2,3,6 for checking, and if at least one of these bits is set, the suspicious attribute message is displayed.


TStringList class

For purposes of managing text files and string lists, the script language supports the TStringList class, which is identical to an equivalent class in Delphi. This class allows:

• Creating string lists and processing them
• Searching and sorting strings
• Managing text files
• Perform special processing of string lines of the “name=value” kind

Methods:

constructor Create;

Creates a class copy. An attempt to work with the class copy before it has been created or after it has been destroyed will cause an error.

destructor Free;

Destroys the class copy, frees up all resources occupied by it.

function Add(const S: string): Integer;

Adds a string to the list; the value returned is the item position in the list (the position count starts with 0).

procedure Append(const S: string);

Similar the Add parameter, but does not return the position of the added item.

procedure Clear;

Clears the string list.

procedure Delete(Index: Integer);

Deletes the string with the specified index. Specifying an invalid index causes an error.

procedure Move(CurIndex, NewIndex: Integer); virtual;

Moves the CurIndex item to the NewIndex position. Specifying an invalid index causes an error.

function IndexOf(const S: string): Integer;

Searches for the specified string in the list. If the string has been found, its index is returned; if it has not been found the value -1 is returned.

procedure Insert(Index: Integer; const S: string);

Inserts a string at the specified address (expanding the list). For example, Insert(0, 'First string !') will insert the text 'First string !' at the start of the string list.

procedure LoadFromFile(const FileName: string);

Loads the text file with the name FileName into the string list. Any data in the list is overwritten.

procedure SaveToFile(const FileName: string);

Saves the string list to a text file with the name FileName. Any data in the list is not modified.

Properties

property Count: Integer;

Returns the number of strings in the list. Allows reading only.


Examples

Minimum script that uses lists

var

SL : TStringList;

begin

SL := TStringList.Create;

SL.Free;

end.

Adding list contents to log

// Adding string list to log

procedure PrintStringListToLog(ASL : TStringList);

var

i : integer;

begin

for i := 0 to ASL.Count - 1 do

AddToLog(ASL[i]);

end;

var

SL : TStringList;

begin

SL := TStringList.Create;

SL.Add('111111');

SL.Add('222222');

SL.Add('333333');

PrintStringListToLog(SL);

SL.Free;

end.

Adding, deleting, and moving strings

var

SL : TStringList;

begin

SL := TStringList.Create;

// Adding strings

SL.Add('111111');

SL.Add('222222');

SL.Add('333333');

// Removing the second string

SL.Delete(1);

// Moving strings

SL.Move(0,1);

// Displaying results

PrintStringListToLog(SL);

SL.Free;

end.

Adding, deleting, and moving strings

var

SL : TStringList;

begin

SL := TStringList.Create;

// Adding strings

SL.Add('111111');

SL.Add('222222');

SL.Add('333333');

// Removing the second string

SL.Delete(1);

// Moving strings

SL.Move(0,1);

// Displaying results

PrintStringListToLog(SL);

SL.Free;

end.

Searching for strings

var

SL : TStringList;

begin

SL := TStringList.Create;

// Adding strings

SL.Add('111111');

SL.Add('222222');

SL.Add('333333');

// Removing the second string

AddToLog(IntToStr(SL.IndexOf('111')));

AddToLog(IntToStr(SL.IndexOf('111111')));

AddToLog(IntToStr(SL.IndexOf('333333')));

SL.Free;

end.

In this example, the first search operation will not find the template, and the function will return -1. The search for "333333" and "111111" will succeed and the function will return their indexes.

Managing text files

var

SL : TStringList;

begin

SL := TStringList.Create;

// Adding strings

SL.Add('111111');

SL.Add('222222');

SL.Add('333333');

// Saving to text file

SL.SaveToFile(GetAVZDirectory + '1.txt');

// Loading from text file

SL.LoadFromFile(GetAVZDirectory + '1.txt');

SL.Free;

end.


TFileSearch class

For purposes of file and folder search on the disk, the script language has the TFileSearch class that provides all the requisite search functionality. Notably, the SearchFiles function can be used for simple cases of file search using a mask.

Methods:

constructor Create(AOwner: TComponent);

Creates a class copy. The only parameter AOwner specifies the owner. It is irrelevant in this case and should equal nil. The class copy should be created before it is used. Otherwise, an exception will be caused.

destructor Free;

Destroys the class copy and frees up all resources occupied by it.

function FindFirst(AFileMask : string) : boolean;

Searches for the first file or folder meeting the search conditions. Returns “true” if the first suitable object has been found successfully. AFileMask specifies the file search mask, for example "*.*". It is possible to specify macros in the mask. For details see the “macros allowed in file names” section.

function FindNext : boolean;

Searches for the next file or folder meeting the search conditions. Returns “true” if the next suitable object has been found successfully. The result of the last search operation can be also obtained using the “Found” property.

function FindClose : boolean;

Closes the search, frees up the resources used for the search, but does not destroy the class copy. FindClose is executed automatically when FindFirst and Free are executed.

Properties:

property Found : boolean;

Result of the last FindFirst or FindNext operation. The presence of this property simplifies the organization of the search cycle.

property ISDir : boolean;

Returns “true” if the current object found is a folder; “false” if it is a file.

property FileName : string;

Returns the file name of the current object found (important: only the name, without the path).

property FileAttr : byte;

Returns the attributes of the last object found (attribute codes).

property FileTime : TDateTime;

Returns the creation date and time of the last object found.


Search examples

File search cycle can be organized in two basic ways. Let us consider both (they are identical in term of speed).

Option 1. Cycle “repeat… until”

var

FS : TFileSearch;

begin

FS := TFileSearch.Create(nil);

if FS.FindFirst('c:\*.*') then

repeat

if FS.IsDir then

AddToLog('Directory found: '+FS.FileName)

else

AddToLog('File found: '+FS.FileName)

until not(FS.FindNext);

FS.Free;

end.

Option 2. Cycle “while”

var

FS : TFileSearch;

begin

FS := TFileSearch.Create(nil);

FS.FindFirst('c:\*.*');

while FS.Found do begin

if FS.IsDir then

AddToLog('Directory found: '+FS.FileName)

else

AddToLog('File found: '+FS.FileName);

FS.FindNext;

end;

FS.Free;

end.

Example of recursive scanning of folders

// Processing the file found

Procedure ScanFile(AFileName : string);

begin

SetStatusBarText(AFileName);

end;

// Scanning the directory

Procedure ScanDir(ADirName : string; AScanSubDir : boolean);

var

FS : TFileSearch;

begin

ADirName := NormalDir(ADirName);

FS := TFileSearch.Create(nil);

FS.FindFirst(ADirName + '*.*');

while FS.Found do begin

if FS.IsDir and AScanSubDir and (FS.FileName <> '.')

and (FS.FileName <> '..') then

ScanDir(ADirName + FS.FileName, AScanSubDir)

else

ScanFile(ADirName + FS.FileName);

FS.FindNext;

end;

FS.Free;

end;

begin

ScanDir('c:\', true);

end.


function ExecuteFile

function ExecuteFile(FileName, Params : string;

Mode : integer; WaitTime : integer;

Terminate : boolean) : boolean;

Executes the specified file.

FileName – File name. It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

Params – Parameters. An empty string is included in the absence of parameters. It is also allowed to specify parameters after the name of the file being started, separating them with a comma.

Mode – Code of the display mode of the program that is being started. Supported codes:

0 – The application is started with the SW_HIDE flag; the application window is not visible to the user.

1 – Standard presentation of the window of the application being started.

2 – The window of the application being started is minimized.

3 – The window of the application being started is expanded to full screen.

WaitTime – Time in milliseconds during which the script waits for the running program to end. Specifying a zero value will cause the script to continue to run without waiting for the running program to end. Minimum delay – 100 ms; specifying a shorter delay will cause the delay to be set to 100 ms automatically. The wait ends after one of the two events: the specified delay time elapses or the running application ends.

Terminate – Forced termination of the running application after the period specified in the WaitTime parameter has elapsed. When WaitTime=0, this parameter is irrelevant and therefore ignored. Operation logic: if WaitTime has elapsed, Terminate=true, and the application is still running, it will be forced closed.

Note: If AVZGuard is running at the time of process startup, the process will be started as a trusted process and AVZGuard restrictions will not apply to it.

Examples:

begin

ExecuteFile('notepad.exe', '', 1, 10000, true);

end.

In this example, the notepad is started, after which the script waits for it to end. If the process is running for more than 10 seconds, it will be closed by force.


function RefreshProcessList

function RefreshProcessList:boolean;

Refreshes the list of processes. This function should be executed before work with the list of processes starts. The function returns “true” if the list has been created successfully. Usage example: example


function GetProcessCount

function GetProcessCount:integer;

Returns the number of processes in the created list by using RefreshProcessList. Executing GetProcessCount before successful execution of RefreshProcessList is not an error; in this case, 0 will be returned.


function GetProcessName

function GetProcessName(Indx : integer):string;

Returns the name of the executable file of the process with the index “Indx”. Please note: The index is counted starting with zero. Therefore, process list analysis cycle should start from 0 to GetProcessCount-1. Specifying an index outside the allowable range is not an error. In this case the function will return an empty string.


function GetProcessPID

function GetProcessPID(Indx : integer):dword;

Returns the process PID with the index “Indx”. Please note: The index is counted starting with zero. Therefore, process list analysis cycle should start from 0 to GetProcessCount-1. Specifying an index outside the allowable range is not an error. In this case the function will return an empty string.


function TerminateProcess

function TerminateProcess(PID : dword):boolean;

Terminates the process with the specified PID. The function returns “true” if the process with the specified PID has been found and terminated successfully. When using this function, bear in mind that after a system reboot or process restart, its PID changes. This is why it is recommended to use this function together with the functions that enable process list analysis – see example.

Example:

begin

TerminateProcess(1056);

end.


function TerminateProcessByName

function TerminateProcessByName(AName : string):boolean;

Terminates all processes the names of which contain a value specified for the AName parameter. Exercise this function with reasonable care, because if the AName parameter is “.exe”, it will terminate all processes and cause a system crash.

Example:

begin

TerminateProcessByName('iexplore.exe');

end.


Example

var

i : integer;

begin

// Refreshing process list

RefreshProcessList;

AddToLog('Number of processes = '+IntToStr(GetProcessCount));

// Resulting list analysis cycle

for i := 0 to GetProcessCount - 1 do begin

// Showing process PID and name

AddToLog(IntToStr(GetProcessPID(i)) + ' '+ GetProcessName(i));

// Conditional process termination

if pos('trojan.exe', LowerCase(GetProcessName(i))) > 0 then

TerminateProcess(GetProcessPID(i));

end;

end.

This example illustrates the use of all the preceding functions for managing processes. First, the RefreshProcessList function is used to refresh the process list. Then the list is viewed in a cycle, with information recorded in the log.

Then processes with the text “trojan.exe” in the names of their executable files are terminated.


function LoadFileToBuffer

function LoadFileToBuffer(AFile : string) : boolean;

Loads the file with the specified name to buffer for subsequent analysis. The function returns "true" if the operation succeeds and "false" if it fails. Repeated execution is not an error. Before the operation is executed, the buffer selected during the previous execution is cleared automatically. It is possible to specify macros in the file name. For details see the “macros allowed in file names” section.

See also: LoadFileToBufferEx, FreeBuffer, GetBufferSize, GetBufferByte, GetBufferWord, GetBufferDWord, GetBufferStr, SearchSign

Example: see in the "Example of signature search implementation"


function LoadFileToBufferEx

function LoadFileToBuffer(AFile : string; ARel : integer; ALen : integer) : boolean;

Loads the file with the specified name to buffer for subsequent analysis. This function is similar to LoadFileToBuffer, except that it allows loading the file partially. It is possible to specify macros in the file name AFile. For details see the “macros allowed in file names” section.

The function returns "true" if the operation succeeds and "false" if it fails. Repeated execution is not an error. Before the operation is executed, the buffer selected during the previous execution is cleared automatically.

ARel – Offset within the file. If ARel equals 0, the loading starts with the start of the file. The negative value of ARel is viewed as an offset from the end of the file. Specifying a negative offset value that exceeds the file size will cause the file to be loaded from the beginning. Specifying a positive offset value in excess of the file size is an error. In this case the file is not loaded.

ALen – Size of the buffer being loaded. Specifying a zero value is interpreted as “load from the specified offset to the end of the file”. Specifying a size whereby the point ARel + ALen goes outside the file boundary is not an error. The value ARel is fixed automatically to ensure that the loading occurs from ARel to the end of the file.

See also: LoadFileToBuffer, FreeBuffer, GetBufferSize, GetBufferByte, GetBufferWord, GetBufferDWord, GetBufferStr, SearchSign

Example: see in the "Example of signature search implementation"


function FreeBuffer

function FreeBuffer : boolean;

Frees up memory allocated during successful execution of LoadFileToBuffer. Repeated execution is not an error. In the absence of the buffer in memory, the function will consider the cleanup a success.

See also: LoadFileToBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


function GetBufferSize

function GetBufferSize : integer;

Returns buffer size in bytes. This function can be used when organizing nonstandard buffer analysis algorithms in a cycle. When the buffer is not present in the memory (that is, data has not been loaded yet or FreeBuffer was executed), the value 0 is returned.

See also: LoadFileToBuffer, FreeBuffer

Example: see in the "Example of signature search implementation"


function GetBufferByte

function GetBufferByte(ARel : integer) : byte;

Returns the byte at the specified offset. Specifying an invalid offset will not cause an error, but the function will return the value 0.

See also: LoadFileToBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


function GetBufferWord

function GetBufferWord(ARel : integer) : word;

Returns a word (two-byte integer) at the specified offset. Specifying an invalid offset will not cause an error, but the function will return the value 0.

See also: LoadFileToBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


function GetBufferDWord

function GetBufferDWord(ARel : integer) : dword;

Returns a DWORD (four-byte integer) at the specified offset. Specifying an invalid offset will not cause an error, but the function will return the value 0.

See also: LoadFileToBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


function GetBufferStr

function GetBufferStr(ARel : integer; ALen : integer) : string;

Returns a string of symbols starting from the specified ARel shift. Negative offsets are viewed as offsets relative to the end of the buffer. The string length is specified by the parameter ALen, but the actual length is determined automatically based on the following criteria:

• When the point ARel + ALen goes outside the buffer boundaries, the length ALen is reduced automatically to ensure that data is copied from this position and until the buffer end.
• When the point ARel goes beyond the left boundary of the buffer, ARel = 0; beyond the right boundary – an empty string is returned.
• When a symbol with the code – is detected in the string, the string is truncated to this position.

See also: LoadFileToBuffer, FreeBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


function SearchSign

function SearchSign(ASign : string; ARel : integer; ALen : integer) : integer;

This is the principal function of the analyzer. Searches for the signature ASign starting with the offset ARel in the zone with the length ALen.

ARel – Offset of the point from which the search starts. The offset is calculated from zero; specifying a negative offset is considered an offset from the end of the file.

ALen – Length. Specifying a zero length means searching from the point ARel to the end of the buffer.

ASign – Signature. The signature is specified as a text string describing the signature search rules. The signature consists of items separated with spaces. Spaces at the start and at the end of the signature are ignored.

The following signature element types are supported:

xx – Byte has to equal xx, where xx represents the byte value in hexadecimal form

Example: "55 AA 45 21"

!xx – Byte does not equal xx, where xx represents the byte value in hexadecimal form

Example: "55 AA !45 21"

? - The byte can have any value (in fact, this means skipping the byte during analysis). Specifying this item at the start or at the end of the signature is meaningless, even though this is not an error.

Example: "55 ? AA ? ? 45 21"

?nn - Skips nn bytes during analysis (essentially, the condition is "nn bytes are a random value"), where nn is the number of bytes skipped in hexadecimal form. Example: 55 AA ?5 45 21 – this signature is identical to the signature 55 AA ? ? ? ? ? 45 21

*xx – Skips several bytes (from zero until the boundary of the analyzed area) until a byte matching xx is detected. Example: 55 AA *FF 25 14

~xx,yy – Shecks the condition <buffer byte> AND yy = xx. This operation makes it possible to compare the bits specified in the byte instead of the entire byte. Spaces in this structure (before and after the comma) are inadmissible, since a space acts as a separator of items in a signature.

Example: "55 ~0A,0F" – in this case the signature is deciphered as "the first byte equals 55, and the smaller tetrad of the second byte equals 0A" (the smaller tetrad is selected by the operation "byte AND 0F")

See also: LoadFileToBuffer, FreeBuffer, GetBufferSize

Example: see in the "Example of signature search implementation"


Example of signature search implementation

// Adding a message to log

Procedure AddAlarm(AFileName, AMsg : string);

begin

AddtoLog('>>>>> '+AFileName+' suspected '+AMsg);

end;

// Scanning a file

Procedure ScanFile(AFileName : string);

begin

SetStatusBarText(AFileName);

LoadFileToBuffer(AFileName);

if SearchSign('2E 61 64 2D 77 2D 61 2D 72 2D 65 2E 63 6F',-20000, 0) >= 0 then

AddAlarm(AFileName, 'Adware.Look2me');

FreeBuffer;

end;

// Scanning a folder (with recursive search)

Procedure ScanDir(ADirName : string; AScanSubDir : boolean);

var

FS : TFileSearch;

begin

ADirName := NormalDir(ADirName);

FS := TFileSearch.Create(nil);

FS.FindFirst(ADirName + '*.*');

while FS.Found do begin

if FS.IsDir then begin

if AScanSubDir and (FS.FileName <> '.') and (FS.FileName <> '..') then

ScanDir(ADirName + FS.FileName, AScanSubDir)

end else

ScanFile(ADirName + FS.FileName);

FS.FindNext;

end;

FS.Free;

end;

begin

ScanDir('c:\', true);

end.


Managing System Analysis results

System Analysis collects all kinds of information about the computer being scanned and stores it in two formats: HTML (with interactive elements) and XML (for automated analysis). A number of tasks may require analyzing the data collected and performing certain actions on the basis of such analysis. To resolve this task, the AVZ script language incorporates a set of commands that let you load an XML file with the data of the last analysis from the memory or any random XML from the disk for subsequent processing.


function SC_INIT

function SC_INIT(AFileName : string = '') : boolean;

Initializes the system that processes analysis results. The function returns "true" if the operation succeeds and "false" if it fails. System analysis has to be performed before executing SC_INIT. If a script contains several instances of SC_INIT execution, during the operation of this function the function SC_FREE will be executed automatically if necessary.

The AFileName parameter is optional and absent by default. Specifying this parameter will specify the name of the XML file that should be loaded for analysis. Using this parameter lets you analyze any system analysis log, not just the last analysis log created on this computer.

Note: The primary purpose of the system is analyzing XML logs of system analysis using scripts. However, theoretically this set of functions enables the script to load and process any XML file.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

begin

Res := SC_INIT('C:\avz4\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else

AddToLog('Log loading and parsing error ');

end.

In this example, an existing system analysis log with a fixed name is loaded, and the loading results are reflected in the log.

var

Res : boolean;

begin

// System Analysis

ExecuteSysCheck('test.htm');

// Loading and analyzing System Analysis results

Res := SC_INIT;

if Res then

AddToLog('Log parsing completed successfully')

else

AddToLog('Log parsing error');

end.

In this example, System Analysis is performed and the collected results are loaded into the parser for analysis; the loading results are reflected in the log.


function SC_FREE

function SC_FREE : boolean;

Frees up resources allocated in the process of executing SC_INIT. It is recommended to execute this function after completing analysis of data collected during System Analysis.

Note: After script execution ends, AVZ automatically executes SC_FREE if necessary.

Compatibility: AVZ 4.28 and later

Example:

begin

// System Analysis

ExecuteSysCheck('test.htm');

// Initializing the system that processes analysis results

SC_INIT;

... processing of analysis results ...

// Freeing up resources

SC_FREE;

end.


function SC_SelectNode

function SC_SelectNode(ANode : string) : boolean;

Selects one of the XML tags with the specified name. The name is specified as "AVZ\name_node"; the name is not case-sensitive. For example, to manage the running processes date you have to specify the name 'AVZ\Process' with Explorer extensions "AVZ\ExplorerExt".

The function returns “true” if the requested data has been located successfully. If the requested data has not been located, the analyzer has not been initialized, and analysis has not been performed, the function returns “false”.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

begin

Res := SC_INIT(GetAVZDirectory + 'LOG\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else begin

AddToLog('Log loading and parsing error ');

exit;

end;

if SC_SelectNode('AVZ\KERNELOBJ') then

AddToLog('Tag KERNELOBJ found');

end.


function SC_GetItemsCount

function SC_GetItemsCount : integer;

Returns the number of embedded data tags in the current tag of the XML database. If no tag has been selected, the function returns 0.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

begin

Res := SC_INIT(GetAVZDirectory + 'LOG\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else begin

AddToLog('Log loading and parsing error');

exit;

end;

if SC_SelectNode('AVZ\KERNELOBJ') then

AddToLog('Tag KERNELOBJ found')

else begin

AddToLog('Tag KERNELOBJ not found');

exit;

end;

// Getting the count of embedded tags

AddToLog('SC_GetItemsCount = '+inttostr(SC_GetItemsCount));

end.


function SC_GetParamVal

function SC_GetParamVal(AIndx : integer; AName, ADefVal : string) : string;

Returns the value of the parameter with the name AName of the tag with the number AIndx. The item count starts with 0. Specifying the name of a nonexistent parameter or index outside the range is not an error. In this case, the function returns the value ADefVal. The value ADefVal is also returned when the tag with the index AIndx does not have a parameter with the name AName.

For the function to read the parameters of the current tag (parent tag for data tags), specify the index of -1.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

i : integer;

begin

Res := SC_INIT(GetAVZDirectory + 'LOG\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else begin

AddToLog('Log loading and parsing error');

exit;

end;

if SC_SelectNode('AVZ\KERNELOBJ') then

AddToLog('Tag KERNELOBJ found')

else begin

AddToLog('Tag KERNELOBJ not found');

exit;

end;

// Getting the count of embedded tags

AddToLog('SC_GetItemsCount = '+inttostr(SC_GetItemsCount));

// Data output in cycle

for i := 0 to SC_GetItemsCount - 1 do

AddToLog('['+inttostr(i)+'] File= "'+SC_GetParamVal(i, 'File', '')+'"');

end.

In this example, an existing analysis log is loaded from the folder LOG located in the AVZ work folder, and the values of File parameter are output in the cycle of items for all tags for which the current tag is a parent tag selected using SC_SelectNode.


function SC_GetTagName

function SC_GetTagName(AIndx : integer) : string;

Returns the tag name with the index AIndx. The name is returned in uppercase. The index of -1 is used to get the name of the parent tag. When an invalid tag has been specified or in case of an error, the function returns an empty string.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

i : integer;

begin

Res := SC_INIT(GetAVZDirectory + 'LOG\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else begin

AddToLog('Log loading and parsing error');

exit;

end;

if SC_SelectNode('AVZ\KERNELOBJ') then

AddToLog('Tag KERNELOBJ found')

else begin

AddToLog('Tag KERNELOBJ not found');

exit;

end;

// Getting the number of embedded tags

AddToLog('SC_GetItemsCount = '+inttostr(SC_GetItemsCount));

for i := 0 to SC_GetItemsCount - 1 do

if SC_GetTagName(i) = 'ITEM' then

AddToLog('['+inttostr(i)+'] File= "'+SC_GetParamVal(i, 'File', '')+'"');

end.


function SC_SearchItem

function SC_SearchItem(AName, AVal : string; AFullComp : boolean) : integer;

Searches for an item by its value. The search takes place in the current tag of the XML database; parameter values with the names AName and AVal; comparison is not case sensitive. AFullComp – a parameter that controls the comparison mode. If it equals “true”, the script performs a full comparison of the template with the parameter named AName; if it equals "false", the script searches for inclusions of AVal in values of the parameter named AName.

If the search is successful, the function returns the index of the first located entry; in case of no match or error, the value returned is "-1".

Note: This function is meant for basic search. To run a more complex search (using several parameters, etc.), you should organize a cycle of 0 to SC_GetItemsCount-1, and check any conditions in this cycle by getting parameter values using SC_GetItem. However, if the search can be performed using SC_SearchItem, you should use it, because the SC_SearchItem search works faster by an order of magnitude than parsing of items in a cycle.

Compatibility: AVZ 4.28 and later

Example:

var

Res : boolean;

i : integer;

begin

Res := SC_INIT(GetAVZDirectory + 'LOG\avz_sysinfo.xml');

if Res then

AddToLog('Log loading and parsing successful')

else begin

AddToLog('Log loading and parsing error');

exit;

end;

if SC_SelectNode('AVZ\KERNELOBJ') then

AddToLog('Tag KERNELOBJ found')

else begin

AddToLog('Tag KERNELOBJ not found');

exit;

end;

// Getting the number of embedded tags

AddToLog('SC_GetItemsCount = '+inttostr(SC_GetItemsCount));

// Tag search

i := SC_SearchItem('File', 'AnyDVD', false);

if i >= 0 then

AddToLog('Driver AnyDVD found - ['+inttostr(i)+'] File= "'+SC_GetParamVal(i, 'File', '')+'"');

end.


function GetSuspCount

function GetSuspCount:integer;

Returns the number of suspicious files detected during the last scan.

Example:

begin

// Use quarantine

SetupAVZ('UseQuarantine=Y');

// Run scan

RunScan;

// Something suspicious ?

if GetSuspCount > 0 then begin

// Execute system analysis

ExecuteSysCheck(GetAVZDirectory + 'syscheck.htm');

// Save archive with quarantine files

CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');

end;

end;


function GetDetectedCount

function GetDetectedCount:integer;

Returns the number of malicious files detected during the last scan.


function GetParamCount

function GetParamCount:integer;

Returns the number of parameters entered by the user in the command line. The usage of functions is demonstrated in the example.


function GetParamStr

function GetParamStr(AParamId:integer) : string;

Returns a parameter with the specified number, or an empty string if the parameter number is outside the range. The numbering of parameters starts with 1; the parameter of 0 returns the full name of the AVZ executable file. The usage of functions is demonstrated in the example.


function GetParamByName

function GetParamByName(AParamName:string) : string;

Returns the value of the parameter found by name. To use this function, you need to specify parameters in the “name=value” format. If the parameter has not been found, an empty string is returned. If several parameters with the same name are in the queue, the function returns the value of the first one of them.

Compatibility: AVZ 4.26 and later

Example:

begin

AddToLog(GetParamByName('test'));

end.

Note: This function is convenient for creating conditional code sections in scripts: it lets you change script behavior without modifying the script code.


Example of parameter processing

Sample script that logs all parameters of the AVZ command line:

var

i : integer;

begin

AddToLog('ParamCount = ' + IntToStr(GetParamCount));

for i := 1 to GetParamCount do

AddToLog(' Param[' + IntToStr(i) + '] = "' + GetParamStr(i) + '"');

end.


function StringReplace

function StringReplace(S, OldPattern, NewPattern: string) : string;

Returns the string “S” in which all instances of OldPattern are substituted with NewPattern. During the OldPattern search, comparison is not case sensitive.

Example:

begin

AddToLog(StringReplace('The pope had a cat', 'cat', 'dog'));

end.


function Pos

function Pos(SubStr, S: String): Integer;

Returns the position of the substring “substr” in the string “S”. Substring search is case sensitive. If the substring search is successful, the number of the first symbol of the first instance of SubStr in the string S is returned. If the search has failed, the function returns 0.

begin

AddToLog(IntToStr(Pos('cat', 'The pope had a dog')));

AddToLog(IntToStr(Pos('dog', 'The pope had a dog' )));

end.


procedure Insert

procedure Insert(S: String; var S2: String; pos: Integer);

Inserts the string “S” in the position “pos” of string “S2”.

Example:

var

S : string;

begin

S := 'The pope had a dog';

Insert('had ', S, 8);

AddToLog(S);

end.


procedure Delete

procedure Delete(var s: String; from, count: Integer);

Deletes several symbols from the string “S” starting with the position “from”; the number of symbols deleted is specified by the parameter “count”.

var

S : string;

begin

S := 'The pope had a cat or a dog';

Delete(S, 12, 10);

AddToLog(S);

end.


function Copy

function Copy(s: String; from, count: Integer): String;

Returns a fragment of the string “S” that is “count” symbols long starting with the position “from”. Specifying invalid “from” and “count” values causes an empty string to be returned.

Example:

begin

AddToLog(Copy('The pope had a cat or a dog', 13, 5));

end.


function Length

function Length(s: string): Integer;

Returns the length of the string “s”.

Example:

begin

AddToLog(InttoStr(Length('The pope had a dog')));

end.


function Trim

function Trim(s: String): String;

Returns the string "s" with all spaces and special symbols deleted at the start and at the end.


function Chr

function Chr(CharCode: Integer): Char;

Returns a symbol with the ASCII code “CharCode”.


function Ord

function Ord(ch: Char): Integer;

Returns the ASCII code of the specified symbol.


function IntToStr

function IntToStr(i: Integer): String;

Converts an integer into a string.

Example:

begin

AddToLog(IntToStr(10)); // Returns string "10"

end.


function IntToHex

function IntToHex(Value: Integer; Digits: Integer): string;

The function converts an integer into a string in HEX format; the parameter “Digits” specifies the count of digits during number formatting. If you specify "Digits" as equaling zero or count smaller than required for correct presentation of the number in the HEX format, the function will use the quantity of digits required for correct conversion of the number into a string.

Example:

begin

AddToLog(IntToHEX(12345, 8));

AddToLog(IntToHEX(12345, 0));

end.

Executing this script will cause strings "00003039" and "3039" to be logged.


function FloatToStr

function FloatToStr(e: Extended): String;

Converts a numeral with a floating point into a string.

Example:

begin

AddToLog(FloatToStr(123.67)); // Returns string "123.67"

end.


function DateToStr

function DateToStr(e: Extended): String;

Converts a date into a string. The standard system format mask is used when forming the date.

Examples:

begin

AddToLog('Scan completion date: '+DateToStr(Now));

end.

begin

SaveLog(GetAVZDirectory+'\LOG\'+GetComputerName+'_'+

DateToStr(Now)+'_log.txt');

end.


function TimeToStr

function TimeToStr(e: Extended): String;

Converts time into a string. The standard system format mask is used when forming the time.

Example:

begin

AddToLog('Scan completion time: '+TimeToStr(Now));

end.


function DateTimeToStr

function DateTimeToStr(e: Extended): String;

Converts date/time into a string. The standard system format mask is used when forming the time and time.

Example:

begin

AddToLog('Scanning completed: '+DateTimeToStr(Now));

end.


function FormatFloat

function FormatFloat(Fmt: String; Value: Extended): String;

Formats the value “Value” according to the mask “Fmt”. Specifying an empty mask is not an error. The function will work with the format mask by default and will be equivalent to FormatFloat. Instead of one mask, you can specify three masks, separating them with a semicolon—for formatting positive, negative, and nil values.

The following symbols are allowed in a mask:

0 – One numeral of the number. If there is no numeral in the given character space during formatting, “0” is shown in this position.

# - One numeral of the number. If there is no numeral in the given character space during formatting, nothing is shown in this position.

, - Thousands separator

. - Decimal point

Example:

begin

AddToLog( FormatFloat('#', 1234.567) ); // Displays "1235"

AddToLog( FormatFloat('#.00', 1234.567) ); // Displays "1234.57"

AddToLog( FormatFloat('00000000.00', 1234.567) ); // Displays "00001234.57"

AddToLog( FormatFloat('00000000', 1234.567) ); // Displays "00001235"

AddToLog( FormatFloat('###,###,###.##', 1234.567) ); // Displays "1,234.57"

end.


function FormatDateTime

function FormatDateTime(Fmt: String; DateTime: TDateTime): String;

Formats date and time according to the format mask “Fmt”. The following symbols are allowed in the format mask:

d – Day without preceding zeros

dd – Day with preceding zeros

ddd – Short symbol name of the day of the week in the current localization (two-letter abbreviation, such as “Mo”)

dddd – :ong symbol name of the day of the week in the current localization (for example, "Monday")

m – Month without preceding zeros (1, 2 ... 12)

mm – Month with preceding zeros (01, 02 ... 12)

mmm – Short name of the month in the current localization (three-letter abbreviation, for example, “Jul”)

mmmm – Long name of the month in the current localization (for example, “July”)

yy – The final two numerals of the year

yyyy – The year in the four-digit format (for example, 2009)

h – Hour without preceding zeros (1, 2 ... 24)

hh – Hour with preceding zeros (01, 02 ... 24)

m – Minutes without preceding zeros (1, 2 ... 59)

nn – Minutes with preceding zeros (01, 02 ... 59)

s – Seconds without preceding zeros (1, 2 ... 59)

ss – Minutes with preceding zeros (01, 02 ... 59)

z – Milliseconds without preceding zeros (1, 2 ... 999)

zzz – Milliseconds with preceding zeros (001, 002 ... 999)

a/p – Not displayed; however, including this constant in the mask switches the time readout to a 12-hour format, adding the AM/PM suffix

/ - Displays the system date separator

: - Displays the system time separator

"x" – Symbols in quotation marks (one or several) are not considered part of the mask and are displayed "as is"

Example:

begin

AddToLog(FormatDateTime('dd.mm.yyyy',now));

AddToLog(FormatDateTime('dd mmmmm yyyy',now));

AddToLog(FormatDateTime('hh:mm',now));

AddToLog(FormatDateTime('"date: "dd mmmmm yyyy", time: "hh:mm:ss',now));

end.


function StrToInt

function StrToInt(S: String): Integer;

Converts a string into an integer. If an invalid symbol presentation of the numeral has been specified, script execution will be aborted due to an error. This is why it is recommended to use the construction "try-except” or the ValidInt function.

Example:

begin

AddToLog(IntToStr(StrToInt('12345')));

end.


function StrToFloat

function StrToFloat(S: String): Extended;

Converts a string into a numeral with a floating point. If an invalid symbol presentation of the numeral has been specified, script execution will be aborted due to an error. This is why it is recommended to use the construction "try-except” or the ValidFloat function.

Example:

begin

AddToLog(IntToStr(StrToInt('12345')));

end.


function ValidInt

function ValidInt(S: String): Boolean;

Returns “true” if the string “S” contains a valid symbol presentation of an integer.

Example:

begin

if ValidInt('123.55') then AddToLog('true') else AddToLog('false');

if ValidInt('123') then AddToLog('true') else AddToLog('false');

end.


function ValidFloat

function ValidFloat(S: String): Boolean;

Returns “true” if the string “S” contains a valid symbol presentation of a numeral with a floating point.

Example:

begin

if ValidFloat('123.55') then AddToLog('true') else AddToLog('false');

if ValidFloat('123 55') then AddToLog('true') else AddToLog('false');

end.


function ValidDate

function ValidDate(S: String): Boolean;

Returns “true” if the string “S” contains a valid symbol presentation of the date.

Example:

begin

if ValidDate('1.02.2005') then AddToLog('true') else AddToLog('false');

if ValidDate('32.02.2005') then AddToLog('true') else AddToLog('false');

end.


function Round

function Round(e: Extended): Integer;

Performs rounding to an integer according to rounding rules.

Example:

begin

AddToLog(IntToStr(Round(125.67))); // Returns "126"

end.


function Trunc

function Trunc(e: Extended): Integer;

Returns the integral part of a numeral. Notably, unlike rounding, this function truncates the fractional part without using rounding rules. It is equivalent to the “Int” function.

Example:

begin

AddToLog(IntToStr(Trunc(125.67))); // Returns "125"

end.


function Int

function Int(e: Extended): Integer;

Returns the integral part of a numeral. Notably, unlike rounding, this function truncates the fractional part without using rounding rules.

Example:

begin

AddToLog(IntToStr(Int(125.67))); // Returns "125"

end.


function Frac

function Frac(X: Extended): Extended;

Returns the fractional part of a numeral.

Example:

begin

AddToLog(FloatToStr(Frac(125.67))); // Returns "0.67"

end.


function Sqrt

function Sqrt(e: Extended): Extended;

Returns a square root of the specified numeral.

Example:

begin

AddToLog(FloatToStr(Sqrt(16))); // Returns "4"

end.


function Abs

function Abs(e: Extended): Extended;

Returns the absolute value of a numeral.

Example:

begin

AddToLog(FloatToStr(abs(10))); // Returns "10"

AddToLog(FloatToStr(abs(-10))); // Returns "10"

end.


procedure Inc

procedure Inc(var i: Integer; incr: Integer = 1);

Performs the increment of the integer variable “i”. By default, the increment value is 1; however, any other increment value may be specified.

Example:

var

i : integer;

begin

inc(i);

inc(i, 5);

end.


procedure Dec

procedure Dec;

Performs the decrement of the integer variable “i”. By default, the decrement value is 1; however, any other decrement value may be specified.

Example:

var

i : integer;

begin

dec(i);

dec(i, 5);

end.


procedure Randomize

procedure Randomize;

Initializes the random number generator. This operation is not required, as it is performed automatically before script execution.

Example:

begin

Randomize;

AddToLog(FloatToStr(Random));

end.


function Random

function Random: Extended;

Generates a random number in the range of 0 to 1. If random integers need to be generated, the rounding and multiplication functions should be used.

Example:

begin

Randomize;

AddToLog(FloatToStr(Random));

AddToLog(IntToStr(Round(Random*10000)));

end.


Sending a message to the administrator


function SendNetMessage

function SendNetMessage(AHost, AFromSt, AToSt, AMessageSt: string) : boolean;

Sends a network message; equivalent to NET SEND.

Parameters:

• AHost – Name of the host to which the message is sent
• AFromSt – The “From” field
• AToSt – The “To” field
• AMessageSt – Message text.

The values of the parameters AFromSt, AToSt, AMessageSt may contain Russian text. However, in this case it cannot be guaranteed that the message will be displayed correctly.

Example:

begin

// Run scan

RunScan;

// Something suspicious ?

if (GetSuspCount > 0) or (GetDetectedCount > 0) then begin

SendNetMessage('Monitoring', 'AVZ', 'Admin',

'Report from computer "' + GetComputerName + '" '+

'SuspCount = ' + InttoStr(GetSuspCount) + ', '

'DetectedCount = ' + InttoStr(GetDetectedCount)

);

end;

end.


function SendSyslogMessage

function SendSyslogMessage(AHost, AMessageSt: string) : boolean;

Sends a message to the standard service Syslog (port 514 UDP) on the specified service; convenient for registering different events.

Example:

begin

// Run scan

RunScan;

// Something suspicious ?

if (GetSuspCount > 0) or (GetDetectedCount > 0) then begin

SendSysLogMessage('172.20.97.28',

'Report from computer "' + GetComputerName + '" '+

'SuspCount = ' + InttoStr(GetSuspCount) + ', '

'DetectedCount = ' + InttoStr(GetDetectedCount)

);

end;

end.


function SendEmailMessage

function SendEmailMessage(AServer, AFrom, ARecipients, ASubject,

AMessageSt: string; AIdentification : boolean; ALogin, APasswd : string;

AAttachFile1, AAttachFile2, AAttachFile3 : string) : boolean;

This function sends a script-controlled message.

Function parameters:

AServer – Name or IP address of the mail server via which the message is sent

AFrom – Value of the “From" field

ARecipients – List of recipients

ASubject – Message subject

AMessageSt – Message text; can contain line feed symbols

AIdentification – Authentication mode. If “false” is sent, server authentication is not performed, and the values of the parameters “ALogin” and “APasswd” are ignored. If “true” is sent, server authentication is performed, and the values of the parameters “ALogin” and “APasswd” should be specified.

ALogin – User name for mail server authentication

APasswd – User password for mail server authentication

AAttachFile1, AAttachFile2, AAttachFile3 – Names of files that need to be attached to the email. An empty name means that no attachments are required.

Example:

begin

// Use quarantine

SetupAVZ('UseQuarantine=Y');

// Run scan

RunScan;

// Something suspicious ?

if (GetSuspCount > 0) or (GetDetectedCount > 0) then begin

// Execute system analysis

ExecuteSysCheck(GetAVZDirectory + 'syscheck.htm');

// Create archive with quarantine files

CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');

// Send mail

SendEmailMessage('mail.my_mail_server.ru', 'AVZ', 'my_mail@mail.ru',

'AVZ email alert',

'Report from computer "' + GetComputerName + '" '+#13 +

'SuspCount = ' + InttoStr(GetSuspCount) + #13 +

'DetectedCount = ' + InttoStr(GetDetectedCount) ,

false, '', '',

GetAVZDirectory + 'syscheck.zip',

GetAVZDirectory + 'quarantine.zip',

''

);

end;

end.


Internet access


function DownloadFile

function DownloadFile(AURL, ASaveName : string;

ADownloadMode : integer = 0;

AProxyServer : string='';

AProxyLogin : string='';AProxyPasswd : string='');

Downloads a file from the Internet. Parameters (the first two are required; the others are optional):

AURL – download URL, including the protocol http://www.myserver.ru/myfile.txt

ASaveName – name under which the file is saved on the disk after a successful download. This parameter is required; the disk must be open for writing, and the specified folder must exist on the disk. The file name may contain macros.

ADownloadMode – code of the file download mode. An optional parameter; the default value is 0. The following codes are supported:

0 – Download using Internet Explorer settings

1 – Direct Internet access; Internet Explorer settings are ignored

2 – Download using an anonymous proxy server. For this mode to operate correctly, specify the proxy server in the “AProxyServer” parameter.

3 – Download using a proxy server requiring authorization. For this mode to operate correctly, specify the proxy server in the “AProxyServer” and specify the login name and password in the "AProxyLogin” and “AProxyPasswd” parameters.

4 – Download using a proxy server requiring NTLM authorization. For this mode to operate correctly, specify the proxy server in the “AProxyServer” and specify the login name and password in the "AProxyLogin” and “AProxyPasswd” parameters.

The proxy server for modes 2-4 must be specified in the format IP_address:port.

The function returns “true” when the download has succeeded or "false" when it has failed.

Compatibility: AVZ 4.34 and later

Example:

Download with a default setting:

begin

DownloadFile('http://www.yandex.ru', 'c:\ya_ru.txt');

end.

Download using an anonymous proxy server:

begin

DownloadFile('http://www.yandex.ru', 'c:\ya_ru.txt', 2, '192.168.1.1:8080');

end.

Note:

1. This function can be used for transmitting some data (such as statistics) using the GET method; the parameters are specified in the URL – this is convenient for using in a corporate network. For example:

begin

DownloadFile('http://192.168.1.1/stat.php?SuspCount='+inttostr(GetSuspCount), 'result.txt');

end.

In this example, the file “result.txt” will contain the response from the script. You can load the file from the disk to analyze the response and then delete it.

2. The function ties to perform the download without caching in order to rule out the possibility of getting an older version of the file from the cache. However, this does not always work, because certain proxy servers and traffic optimizers ignore applications of the “no-cache” type. This can be resolved by adding a meaningless parameter to the URL, for example:

begin

DownloadFile('http://www.my_server.ru/my_file.txt?anti_cache='+inttostr(round(random*1000000)), 'c:\my_file.txt');

end.


function FTPSendFile

function FTPSendFile(AFileName, AServer, APath, ASaveName : string;

APassiveMode : boolean = false;

ALogin : string='';

APasswd : string='') : boolean;

Sends the specified file to the server using the FTP protocol. Parameters (the first 4 parameters are required):

AFileName – Full name of the file being uploaded to the FTP server

AServer – Server name or IP address

APath – Path to a folder on the FTP server, into which you need to place the file. Specifying an empty path means that the file should be placed in the current folder that opens after connection to the server. If the path is specified, a successful connection attempt is followed by an attempt to make the specified folder current. If this fails, the sending of the file is blocked. The path can be relative or absolute: an absolute path must start with “c /”.

ASaveName – Name of the file saved on the server. If the ASaveName parameter contains an empty string, the file name will be taken from AFileName. This parameter is useful for dynamic file naming, for example, including the date or PC name into the file name.

APassiveMode – Mode of operation with the FTP server. If APassiveMode=true, passive mode is enabled.

ALogin, APasswd – login name and password for server authorization. They should be specified in pairs. If the login name is not specified, the value “anonymous” is used as the login and 'anonymous@anonymous.com' as the password.

For details on the FTP protocol and passive mode, see http://ru.wikipedia.org/wiki/FTP and http://tools.ietf.org/html/rfc959.

Compatibility: AVZ 4.34 and later

Example:

begin

// Run system check (creates files syscheck.htm, syscheck.xml and syscheck.zip by default)

ExecuteSysCheck(GetAVZDirectory + 'syscheck.htm');

// Send quarantine to server

FTPSendFile(GetAVZDirectory+'syscheck.zip',

'192.168.0.100', '/avz', GetComputerName+'_syscheck.zip' ,

false, 'avz', 'top_secret');

// Exit AVZ

ExitAVZ;

end.

In this example, the system analysis log is sent to a server with IP address 192.168.0.100; the log is placed in an AVZ folder under the name formed from the PC name and the '_syscheck.zip' suffix. The passive mode is not used. Server authentication is carried out with the login name “avz” and password “top_secret”.


Startup parameters

1. AVZ startup and execution of the Test1.txt script.

avz.exe Script=Test1.txt

2. AVZ startup in hidden mode and execution of the Test2.txt script.

avz.exe HiddenMode=3 Script=Test2.txt

3. AVZ startup in hidden mode (with the icon shown in the tray) and execution of the Test3.txt script; quarantine mode – network.

avz.exe nw=Y HiddenMode=2 Script=Test3.txt


Computer scanning

begin

// abort scan if it does not end in 10 minutes

ActivateWatchDog(10*60);

// Configure AVZ

SetupAVZ('UseQuarantine=Y'); // Enable Quarantine

SetupAVZ('Priority=-1'); // Low priority

// Run scan

RunScan;

// Exit AVZ

ExitAVZ;

end.

This example illustrates the simplest script that configures AVZ using the SetupAVZ function and starts the scan using RunScan.


Conditional scanning block

begin

// Do not scan computers with names starting with 'ASU'

if pos('ASU', GetComputerName) = 1 then

ExitAVZ;

// abort scan if it does not end in 10 minutes

ActivateWatchDog(10*60);

// Configure AVZ

SetupAVZ('UseQuarantine=Y'); // Enable Quarantine

SetupAVZ('Priority=-1'); // Low priority

// Run scan

RunScan;

// Exit AVZ

ExitAVZ;

end.

In this example, blocking is performed using the computer name obtained with the help of GetComputerName.


Scanning and automatic quarantining

begin

ActivateWatchDog(5*60);

// Configure AVZ

SetupAVZ('UseQuarantine=Y'); // Enable Quarantine

SetupAVZ('Priority=-1'); // Low priority

SetupAVZ('nw=Y'); // Network mode

// Run scan

RunScan;

// Add computer name data

AddToLog('---------------');

AddToLog('Computer log '+GetComputerName);

// Save log

SaveLog('AVZ_LOG\'+GetComputerName+'_log.txt');

// Automatic Quarantining

ExecuteAutoQuarantine;

// Exit AVZ

ExitAVZ;

end.

For this example to work, you need to create the AVZ_LOG folder in the AVZ work folder. The key NW=Y switches AVZ to network mode. This is manifested in the fact that a new level (computer name) is created in the Quarantine and Infected folder when a file is quarantined. This helps avoid duplication of quarantined files when AVZ is running on multiple computers.


Conditional repair of selected folders

begin

ActivateWatchDog(5*60);

// Configure AVZ

SetupAVZ('UseQuarantine=Y'); // Enable Quarantine

SetupAVZ('Priority=-1'); // Low priority

if GetComputerName = 'PUPKIN' then begin

SetupAVZ('Scan=C:\'); // Scan disk C:\

SetupAVZ('Scan=D:\Virus'); // Scan specified folder

SetupAVZ('DelVir=Y'); // Enable deletion mode

end;

// Run scan

RunScan;

// Add computer name data

AddToLog('---------------');

AddToLog('Computer log '+GetComputerName);

// Save log

SaveLog('AVZ_LOG\'+GetComputerName+'_log.txt');

// Exit AVZ

ExitAVZ;

end.


Automatic quarantining and collecting of suspicious files from the PC

begin

// ********* Configure AVZ ********

SetupAVZ('UseQuarantine=Y'); // Enable quarantining of suspicious objects

SetupAVZ('Priority=-1'); // Low priority

SetupAVZ('EvLevel=3'); // Maximum heuristics sensitivity

SetupAVZ('ExtEvCheck=Y'); // Extended analysis enabled

// Watchdog timer activated for 15 minutes

ActivateWatchDog(60 * 15);

// Run scan

RunScan;

// Add computer name data

AddToLog('---------------');

AddToLog('Computer log '+GetComputerName);

// Automatic Quarantining

ExecuteAutoQuarantine;

// Generate archive with collected files

CreateQurantineArchive('c:\AVZ_Qurantine.zip');

// Save log

SaveLog('c:\AVZ_Qurantine.log');

// Exit AVZ

ExitAVZ;

end.

For executing the script, it is convenient to create a BAT file “CollectFiles.bat” containing the following command:

avz.exe HiddenMode=1 Script=CollectFiles.avz

It is presumed that the script is stored in the CollectFiles.avz file. This file and CollectFiles.bat are in the same folder with avz.exe.


File search on the disk

The task is to scan the disk for a file with the specified name. This is accomplished by using the following script.

// Scanning a folder (with recursive search)

Procedure ScanDir(ADirName : string; AScanSubDir : boolean);

var

FS : TFileSearch;

begin

ADirName := NormalDir(ADirName);

FS := TFileSearch.Create(nil);

FS.FindFirst(ADirName + '*.*');

while FS.Found do begin

SetStatusBarText(ADirName + FS.FileName);

if FS.IsDir then begin

if AScanSubDir and (FS.FileName <> '.') and (FS.FileName <> '..') then

ScanDir(ADirName + FS.FileName, AScanSubDir)

end else

if LowerCase(FS.FileName) = 'trojan.dll' then

AddToLog('File found '+ADirName + FS.FileName);

FS.FindNext;

end;

FS.Free;

end;

begin

ScanDir('c:\', true);

end.

In this example, the ScanDir function is used for a recursive search of folders. The function gets two parameters: the name of the folder to be scanned and the AScanSubDir parameter that indicates whether or not to scan subfolders.


Network scan script template

A template of a common script for scanning multiple PC in the network:

begin

// Check – startup blocks

if pos('first letters in the name', GetComputerName) = 1 then ExitAVZ;

if GetComputerName = 'name1' then ExitAVZ;

if GetComputerName = 'name2' then ExitAVZ;

// A 50-second pause not to hinder automatic loading

Sleep(50);

// Configure AVZ

SetupAVZ('UseQuarantine=Y'); // Enable Quarantine

SetupAVZ('nw=Y'); // Quarantine in network mode

SetupAVZ('Priority=-1'); // Low priority

SetupAVZ('EvLevel=3'); // Maximum heuristics sensitivity

SetupAVZ('ExtEvCheck=Y'); // Extended analysis enabled

SetupAVZ('DelVir=Y'); // Enable deletion mode

// Watchdog timer activated for 15 minutes

ActivateWatchDog(60 * 15);

// Run scan

RunScan;

// Add computer name data

AddToLog('---------------');

AddToLog('Computer log '+GetComputerName);

AddToLog('Path to AVZ = ' + GetAVZDirectory);

// Automatic Quarantining

ExecuteAutoQuarantine;

// Save log

SaveLog(GetAVZDirectory+'\LOG\'+GetComputerName+'_ log.txt');

// Exit AVZ

ExitAVZ;

end.

In this case, the AVZ startup parameters are as follows:

\\my_server\AVZ\avz.exe Priority=-1 nw=Y nq=Y HiddenMode=2 Script=\\my_server\AVZ\netscan.avz

It is presumed that AVZ is located in the folder \\my_server\AVZ, and that the script is stored in the file “netscan.avz”.

Some comments on the script and startup parameters:

• Priority=-1 – AVZ starts with low priority in order not to affect computer performance. This key is duplicated in the script and in the command line. In principle, it is unnecessary when scanning modern PCs.
• nw=Y – Also duplicated in the command line and in the script (duplicating it is not required; it is sufficient to have it in one place). This key switches Quarantine to “network mode”: in network mode, another level (defined by the computer name) appears in the Quarantine folder.
• HiddenMode=2 – AVZ starts in hidden mode; the AVZ icon is visible in the tray for the duration of this mode; user access to AVZ controls is blocked. The Quarantine folder has to be created in advance, and users have to be granted privileges to write to it.
• SaveLog(GetAVZDirectory+'\LOG\'+GetComputerName+'_ log.txt'); - In this case, the log is stored in the AVZ work folder; the log name contains the computer name. The LOG folder has to be created in advance, and users have to be granted privileges to write to it.
• Execution of ExecuteAutoQuarantine; a comment should be added in the usual scanning mode – This function collects all files in the memory or autorun that have not been identified as safe or system files. Collection of such files is convenient for their subsequent scanning by several antivirus applications.
• Such checks as "if pos('first letters of the name', GetComputerName) = 1 then ExitAVZ;" and "if GetComputerName = 'name2' then ExitAVZ;" are naturally optional and make it possible to exclude computers with the specified network names from scanning. This is convenient for disabling daily scanning of the computers of network administrators and IT specialists (at the same time, they have AVZ in autorun, so whenever necessary the filter can be removed and their computers can be included in the scan).


Database update with logging

Task: Run database update in quiet mode (without displaying the GUI) with the logging of operation success. Among other things, this is convenient when AVZ is located on a server. In this case, the database update procedure can be included in the Task Scheduler. As a result, the server will have AVZ with an up-to-date database.

The script looks as follows:

var

S : string;

begin

// Database update

if ExecuteAVUpdate then S := 'Update successful'

else S := 'AVZ database update error';

// Logging

AddLineToTxtFile(GetAVZDirectory + 'avz_upd.log', DateTimeToStr(Now)+' '+S);

// Exit AVZ

ExitAVZ;

end.

In this case, AVZ should be started with the following parameters:

avz.exe HiddenMode=1 script=update.txt

In this case, it is presumed that the script is stored in the AVZ folder in a file named “update.txt”. The parameter HiddenMode=1 commands AVZ to run minimized in the tray. As an improvement, this script can use the function ExecuteAVUpdateEx.


Example of a known trojan removal

Task:

The administrator knows that the user’s computer is infected with a trojan and its executable file has the name c:\windows\system32\trojan.dll. This program aggressively protects itself from deletion.

Solution:

begin

// **** Step 1. Enable AVZGuard

if SetAVZGuardStatus(True) then

AddToLog('AVZGuard successfully enabled')

else

AddToLog('AVZGuard – error enabling');

// **** Step 2. Delete file

DeleteFile('c:\windows\system32\trojan.dll');

// *** Step 3. Clean up references to the deleted file

ExecuteSysClean;

// *** Step 4. Save log

SaveLog('del_trojan.log');

// *** Step 5. Reboot system

RebootWindows(true);

end.

The script shown above can be improved by enabling the Boot Cleaner system, thus significantly improving the chances of file deletion:

begin

// **** Step 1. Enable AVZGuard

if SetAVZGuardStatus(True) then

AddToLog('AVZGuard successfully enabled')

else

AddToLog('AVZGuard – error enabling');

// **** Step 2. Delete file

DeleteFile('c:\windows\system32\trojan.dll');

// **** Step.3 Import list of deleted files to Boot Cleaner settings

BC_ImportDeletedList;

// *** Step 4. Clean up references to the deleted file

ExecuteSysClean;

// **** Step 5. Save log

SaveLog('del_trojan.log');

// **** Step 6. Enable the Boot Cleaner driver

BC_LogFile(GetAVZDirectory + 'boot_clr.log');

BC_Activate;

// **** Step 7. Reboot system

RebootWindows(true);

end.

In the examples described, the script ends with the RebootWindows command, which causes automatic rebooting of the computer with the running AVZ Guard system.


Suspicious object search by name

File search by name is ineffective when fighting modern malware. However, it can be useful as one of the forms of heuristics. The merit of this technique is the high speed of search and simplicity of implementation. Let us consider several ways in which this search can be implemented using AVZ scripts.

Example 1. Basic search by name

// Find file with specified name

function CheckByName(Fname : string) : boolean;

begin

Result := FileExists(FName) ;

if Result then

AddToLog('File '+FName+' has a suspicious name');

end;

begin

// File scan

CheckByName('%WinDir%\cservv32.exe');

CheckByName('%WinDir%\services.exe');

CheckByName('%WinDir%\lsass.exe');

end.

In this example, the CheckByName function is declared. Its objective is to scan the disk for a file with the specified name. When this file is detected, the function returns “true” and makes a record in the log using the AddToLog function. The shortcoming of this function is that the file list as such does not exist. Instead of it, repetitive CheckByName executions are used. In a more difficult example, the search can be improved by placing a list of names in a separate file, which will act as a database.

Example 2. Search by name using a loaded file list

// Find file with specified name

function CheckByName(Fname : string) : boolean;

begin

Result := FileExists(FName) ;

if Result then

AddToLog('File '+FName+' has a suspicious name');

end;

var

SuspNames : TStringList; // List of names of suspicious files

i : integer;

begin

// File check against an updatable database

if FileExists(GetAVZDirectory + 'files.db') then begin

SuspNames := TStringList.Create;

SuspNames.LoadFromFile('files.db');

AddToLog('Name database loaded – number of records = '+inttostr(SuspNames.Count));

// Search cycle

for i := 0 to SuspNames.Count - 1 do

CheckByName(SuspNames[i]);

end else

AddToLog('Error loading list of file names');

end.

This example uses the CheckByName already familiar from example 1, which is executed in a cycle. The TStringList class is used for working with a file list. It is presumed that the file list is stored in the text file “files.db” placed in the AVZ folder (the path to this folder is determined using GetAVZDirectory).

Example 3. Search by name using a loaded file list and AV database of AVZ

// Find file with specified name

function CheckByName(Fname : string) : boolean;

var

S : string;

begin

Result := FileExists(FName) ;

if Result then begin

S := '';

case CheckFile(FName) of

-1 : S := ', access to file blocked';

1 : S := ', detected as Malware ('+GetLastCheckTxt+')';

2 : S := ', suspected by file scanner ('+GetLastCheckTxt+')';

3 : exit; // Safe files are ignored

end;

AddToLog('File '+NormalFileName(FName)+' has a suspicious name'+S);

end;

end;

var

SuspNames : TStringList; // List of names of suspicious files

i : integer;

begin

// File check against an updatable database

if FileExists(GetAVZDirectory + 'files.db') then begin

SuspNames := TStringList.Create;

SuspNames.LoadFromFile('files.db');

AddToLog('Name database loaded – number of records = '+inttostr(SuspNames.Count));

// Search cycle

for i := 0 to SuspNames.Count - 1 do

CheckByName(SuspNames[i]);

end else

AddToLog('Error loading list of file names');

end.

This example includes another improvement: the CheckByName function checks the file detected by its name against the AVZ database. The CheckFile function is used to this end (it is supported starting with AVZ version 4.23). Analysis of file scan results makes it possible to exclude trusted files and files identified as safe in the Microsoft Security Catalog from the log. The CheckFile function is used together with the GetLastCheckTxt function to get the name of the malicious application when it is detected or suspected. Another feature is usage of the NormalFileName function for normalizing the file name (in particular, this function involves substitution of macros used in AVZ). For additional information about file search, see the "File and folder search" section.


Blocking scripts from repeated execution in a single day

When AVZ is used for automatic scanning of computers on a network, the task of blocking repeated execution of the same script in a single day may be required. This is useful for blocking repeated AVZ startups after each PC reboot or for ensuring one-time database updates in a single day. The solution of this task is quite simple and involves making a registry mark containing the time of the last scan.

var

LastScanDate, CurrentDate : string;

begin

LastScanDate := RegKeyStrParamRead('HKEY_CURRENT_USER', 'Software\AVZ', 'LastScanDate');

CurrentDate := DateToStr(Now);

if LastScanDate = CurrentDate then begin

AddToLog('Blocking of repeated execution. Script was executed already '+LastScanDate);

ExitAVZ;

exit;

end;

RegKeyStrParamWrite('HKEY_CURRENT_USER', 'Software\AVZ', 'LastScanDate', CurrentDate);

// script continuation ....

end.

The principle of operation of this script involves reading the parameter 'LastScanDate' stored in the key 'HKEY_CURRENT_USER\Software\AVZ' (naturally, you can specify any parameter name or key). If the value that has been read contains the current date, script execution is aborted and AVZ exits. Otherwise, a mark with the current date is recorded in the registry.


Scanning and emailing scan results

Task:

Scanning of disk C: needs to be performed. Then an email containing the scan log, system analysis results, and quarantined files have to be sent to the specified address.

begin

// Allow quarantine usage

SetupAVZ('UseQuarantine=Y');

// Scan disk C

SetupAVZ('Scan=C:\');

// Run scan

RunScan;

// Execute system analysis

ExecuteSysCheck(GetAVZDirectory + 'syscheck.htm');

// Create archive with quarantine files

CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');

// Send mail

SendEmailMessage('mail.my_mail_server.ru', 'AVZ', 'my_mail@mail.ru',

'AVZ email alert',

'Report from computer "' + GetComputerName + '" '+#13 +

'SuspCount = ' + InttoStr(GetSuspCount) + #13 +

'DetectedCount = ' + InttoStr(GetDetectedCount) ,

false, '', '',

GetAVZDirectory + 'syscheck.zip',

GetAVZDirectory + 'quarantine.zip',

''

);

// Exit AVZ

ExitAVZ;

end.

In this example, system analysis is performed after scanning, which is why the scan log is included into the system analysis log.


Example of creating a simple antimalware scanner using a self-developed database

 Home Previous

Network administrators often ask if it would be possible to use AVZ as a basis for self-developed databases for removing unwanted software, trojans, or malicious programs on user PCs. This is doable and can be implemented using the script language.

Let us consider a common example:

var

SignDB : TStrings; // Signature database

MalwareCnt : integer; // Detected malware counter

DelMalwareCnt : integer; // Deleted malware counter

DeleteMalware : boolean; // Attribute determining what to do with detected malware

// Processing the file found

Procedure ScanFile(AFileName : string);

var

FMD5 : string;

begin

SetStatusBarText(AFileName);

// Computing the MD5 checksum

FMD5 := CalkFileMD5(AFileName);

// Searching for MD5 in the database

if (FMD5 <> '') and (SignDB.IndexOf(FMD5) >= 0) then begin

AddToLog('Malware detected, file = '+AFileName);

inc(MalwareCnt);

if DeleteMalware then begin

DeleteFile(AFileName);

inc(DelMalwareCnt);

end;

end;

end;

// Scanning the directory

Procedure ScanDir(ADirName : string; AScanSubDir : boolean);

var

FS : TFileSearch;

begin

ADirName := NormalDir(ADirName);

FS := TFileSearch.Create(nil);

FS.FindFirst(ADirName + '*.*');

while FS.Found do begin

// Depending on type: either scan the subfolder or examine the file

if (FS.FileName <> '.') and (FS.FileName <> '..') then

if FS.IsDir and AScanSubDir then

ScanDir(ADirName + FS.FileName, AScanSubDir)

else

ScanFile(ADirName + FS.FileName);

FS.FindNext;

end;

FS.Free;

end;

begin

// Scan mode

DeleteMalware := false;

// Reset malware counter

MalwareCnt := 0; DelMalwareCnt := 0;

// Load signature database

SignDB := TStringList.Create;

SignDB.LoadFromFile('my_sign_db.txt');

AddToLog('Signature database loaded, number of signatures = '+inttostr(SignDB.Count));

// Enable antirootkit

SearchRootkit(true, true);

// Disk and (or) folder scan

ScanDir('c:\', true);

ScanDir('d:\MyFolder\', false);

// Remove traces of malware (if any)

if DelMalwareCnt > 0 then begin

SaveLog('scan_result.txt');

// Enable AVZGuard – it will prevent malware from restoring itself

SetAVZGuardStatus(true);

// Activate BootCleaner

BC_ImportALL;

BC_Activate;

// Heuristic cleanup

ExecuteSysClean;

// Rebooting

RebootWindows(true);

end;

end.

A signature database is required for this example to work. In our case, the role of signature is performed by the MD5 checksum of the file. Using it is extremely inconvenient in actual situations (since changes in at least one byte of the file cause the MD5 of the file to change). However, this approach is convenient for a basic scanner, as it is very easy to compute MD5 of any file. For example, in AVZ this is done by clicking "Service\Compute MD5 hash of a file". Database records are simple: one MD5 checksum per each line, without spaces before or after the checksum. For example, you can create the database my_sign_db.txt consisting of a single entry: 44D88612FEA8A8F36DE82E1278ABB02F.

This is the MD5 checksum of the file EICAR – a test “virus” that can be downloaded anywhere. For example, here: http://support.kaspersky.ru/downloads/eicar/eicar.zip (remember to unpack it, as our example does not scan archives).

The operation of this example is quite simple. Let us examine it step by step:
1. The script declares the SignDB class for working with string lists of the TStringList kind.
2. The database is loaded. Errors in the script are not processed, which is why AVZ will abort script execution and return an error message in case of an error.
3. SearchRootkit is used to neutralize rootkits. This step is not obligatory. However, a rootkit can be hiding malware files or blocking access to them, complicating detection.
4. The search is conducted using the specified function ScanDir. This function has two parameters: the starting folder and the subfolder scanning mode. If the second parameter is “true”, the specified folder and all of its subfolders are scanned. If it is “false”, subfolders are not scanned. In particular, this is convenient for searching for files in the disk root. ScanDir can be executed several times.
5. The count of the DelMalwareCnt counter is checked. If the count is more than one, malware was deleted with the help of the specified database. In this case, the scan log is saved, AVZGuard is activated using SetAVZGuardStatus, and BootCleaner is configured, which is followed by a heuristic system cleanup and reboot using RebootWindows. The specific set of operations is determined by a specific task. At a minimum, the following can be kept:

if DelMalwareCnt > 0 then begin

// Heuristic cleanup

ExecuteSysClean;

end;

The ScanDir procedure in the given script is responsible for the recursive search of directories on the disk and file search. There is nothing particularly notable about its work. It uses the TFileSearch class described in the AVZ help files.

The ScanFile procedure is responsible for the most interesting part – analyzing the file. It performs the following operations:

1. Displays the name of the scanned file in the status bar using SetStatusBarText. This is a purely “cosmetic” operation that slows down script execution, letting you observe the scanning process. You can exclude it from an actual script.

2. CalkFileMD5 is used to compute the MD5 checksum of the file.

3. If MD5 has been computed successfully (in which case CalkFileMD5 returns a string with the MD5 checksum) and this MD5 checksum has been found in the database, operations are performed with the located file – a record is made in the log and the file is deleted on the condition that DeleteMalware = true. In this case, if DeleteMalware = true, we get the “removal mode”; if “false”, we get the "scanner mode" (this parameter is specified at the start of the script).

This may give rise to a reasonable question: What to do if there is a collection of malware numbering hundreds of files. It is hardly feasible to get the MD5 checksums of such files for this database manually. To this end, you can write a simple script that will generate a signature database:

var

SignDB : TStrings; // Signature database

// Processing the file found

Procedure ScanFile(AFileName : string);

var

FMD5 : string;

begin

SetStatusBarText(AFileName);

// Computing the MD5 checksum

FMD5 := CalkFileMD5(AFileName);

// Adding to the database without repetitions

if (FMD5 <> '') and (SignDB.IndexOf(FMD5) < 0) then

SignDB.Add(Trim(FMD5));

end;

// Scanning the directory

Procedure ScanDir(ADirName : string; AScanSubDir : boolean);

var

FS : TFileSearch;

begin

ADirName := NormalDir(ADirName);

FS := TFileSearch.Create(nil);

FS.FindFirst(ADirName + '*.*');

while FS.Found do begin

// Depending on type: either scan the subfolder or examine the file

if (FS.FileName <> '.') and (FS.FileName <> '..') then

if FS.IsDir and AScanSubDir and then

ScanDir(ADirName + FS.FileName, AScanSubDir)

else

ScanFile(ADirName + FS.FileName);

FS.FindNext;

end;

FS.Free;

end;

begin

// Initializing signature database

SignDB := TStringList.Create;

SignDB.LoadFromFile('my_sign_db.txt');

AddToLog('Signature database loaded, number of signatures = '+inttostr(SignDB.Count));

// Scanning folder with malware samples

ScanDir('c:\MalwareSamplesDir\', true);

// Saving database

AddToLog('Database updated, number of signatures = '+inttostr(SignDB.Count));

SignDB.SaveToFile('my_sign_db.txt');

SignDB.Free;

end.

Obviously, this script is similar to the previous one: Recursive scanning of folders with the malware collection is performed. However, instead of the database search, a database update is performed. Once updated, the database is stored. When new MD5 hashes are added to the database, it is checked for repetitions. This is why this check can be performed multiple times: It loads the current database and, if necessary, updates it with new signatures.


function LowerÑase

function LowerCase(s: String): String;

Returns the string “s” in the lower case.


function UpperÑase

function UpperÑase(s: String): String;

Returns the string “s” in the upper case.