
F - S C R I P T
F-Secure Script Viruses Detector and Eliminator
Version 1.6
Copyright (C) 1998-99 Data Fellows Corp.



OVERVIEW

F-SCRIPT is a DOS program that scans *.HTM, *.HTML, *.INF, *.VBS, *.JS, *.HTT,
*.HTA, *.ASP, *.WBT, *.VBE and *.WSH files for known script viruses, trojans,
worms and exploits. F-SCRIPT is able to disinfect them by removing virus code
from the infected files and to delete files with malicious code inside
(trojans, worms and exploits).


TECHNOLOGY

The F-SCRIPT scanning and disinfection technology was developed by Data Fellows
Corp.


USAGE

General command line is: F-SCRIPT <path> <<option1>> <<option...n>> The <path>
option allows to specify location for scanning. Scanning path should contain a
valid drive letter. To scan current directory the '.' option should be
specified. If no parameters are specified the help screen is output. Then any
drive scanning is offered. If a valid drive letter is input the corresponding
drive is scanned with options obtained from command line with disinfection and
log options set by default. If no drive letter is specified the control is
returned to the system.


COMMAND LINE OPTIONS

 /A or /AUTO    - automatic scan mode
 /- or /DISINF  - disinfect infected files
 /D or /DELETE  - delete infected files
 /E or /RENAME  - rename infected files
 /O or /LIST    - display OK for clean files
 /V or /VIRLIST - display the list of currently detected viruses
 /L or /REPORT  - create log file F-SCRIPT.LOG
 /* or /DUMB    - scan all files (slow mode)
 /R or /NOSUB   - do not scan subdirectories
 /? or /HELP    - help screen
 /B             - create backup copies for disinfected files
 /Y             - do not ask for confirmation on delete/disinfect
 /HARD          - scan all available hard drives
 /FREEZE        - confirm each delete/disinfect
 /INTER         - force interactive mode


NOTE:

The '/E', '/D' and '/B' parameters can't be used together.

EXAMPLES:

     F-SCRIPT .
     F-SCRIPT C:
     F-SCRIPT D:\WINNT /- /Y
     F-SCRIPT D:\TOOLS\ /* /O /E /R


F-SCRIPT returns following errorlevels:

	0:  Normal program termination
	1:  Incorrect command line parameter
	2:  Too long command line parameter
	3:  Log file creation error
	4:  Incompatible options specified
	5:  Error opening database file 'F-SCRIPT.DEF'
	6:  Incompatible or corrupted database file 'F-SCRIPT.DEF'
	7:  Error reading database file 'F-SCRIPT.DEF'
	8:  Error manipulating database file pointer
	9:  Not enough memory for database loading
	10: Not enough memory for service areas
	11: Not enough memory on startup

	other: Abnormal program termination.


VIRUS LIST ATTRIBUTES

Attributes of viruses in currently detected viruses list are given below. The
general attribute output format is: NNN...

  First attribute - type of infected files
    H = HTML, V = VBS, I = INF, J = JS, W - WBT

  Second attribute - type of infection
    V = virus, T = trojan, D = dropper, I = intended, W = worm

  Third attribute - type of virus (if a virus entry)
    O = overwriting, A = appending, P = prepending, I = inserting,
    C = companion


PRODUCT NOTES

F-SCRIPT does NOT disinfect anything by default. You need to turn disinfection
on by specifying the /- parameter. If you want all infected files to be renamed
or deleted use /E or /D parameter respectively.

We recommend you make a backup copy of important files before disinfecting
them, just to be safe. You can specify /B option and disinfected files will be
automatically backuped by F-SCRIPT.

If you want to scan all files (not only *.HTM, *.HTML, *.INF, *.VBS, *.JS,
*.HTT, *.HTA, *.ASP, *.WBT, *.VBE and *.WSH), use the /* parameter to switch
all files scanning mode. Note that this mode is slow.

IMPORTANT: If you find a new variant of a script virus, trojan, worm or
exploit, please send a suspected sample for closer analysis to Data Fellows.
See the SUPPORT part below for more information.


SUPPORT AND VIRUS SAMPLES

For F-Script technical support and virus-related inquiries please contact:
<F-SCRIPT-Support@DataFellows.com>. To send samples of new viruses or suspected
files please use <Samples@DataFellows.com> address or upload them to our FTP
site and send a note to 'samples':

        ftp://ftp.Europe.DataFellows.com/incoming


UPDATES AND NEW VERSIONS

Updates and new versions, when available, can be downloaded from the Data
Fellows web and ftp sites at these locations:

Web:
 http://www.DataFellows.com/download-purchase/
 http://www.europe.DataFellows.com/download-purchase/

Ftp:
 ftp://ftp.datafellows.com/pub/anti-virus/tools/f-script.zip
 ftp://ftp.europe.datafellows.com/pub/anti-virus/tools/f-script.zip

Normally only the F-SCRIPT.DEF definition file is updated. The latest
F-SCRIPT.DEF is always inside the F-SCRIPT.ZIP file and can be also downloaded
separately.

The Data Fellows web site always has up-to-date descriptions on the operation
and effects of viruses, see:

 http://www.datafellows.com/vir-info/
 http://www.europe.datafellows.com/vir-info/


HISTORY

1.0a:	The first version of F-Script is released. It is able to detect all
        known at the moment of release HTML, VBS, JS and INF viruses, droppers
        and trojans. The first polymorphic VBS virus is detected at 100% rate.
        Disinfection capabilities include deletion of overwriting viruses,
        droppers and trojans or renaming of all infected files.

1.0b:	Currently detected viruses list output added. Delete files key added.

1.1b:	Disinfection of appending and prepending viruses added.

1.2b:	Disinfection of companion viruses added. More command line parameters
        added. F-PROT or/and AVP command line parameters can be specified.

1.3b:   Minor bugs fixed. /HARD scan mode output info added.

1.4:    *.ASP files scanning added. Interface messages output modified.

1.5:	Worm object type scanning added, exact detection routines optimized.

1.6:	Detection, disinfection, file format recognition and directory tree
        scan routines were improved. Database format was changed (now 1.1) and
        a new F-Script database was created, database version check routine was
        added. The *.VBE, *.WBT and *.WSH files scan was added. Clean files
        number output was added into report generation routine. Minor bugs were
        fixed.


LEGAL NOTES

F-SCRIPT is protected by international copyright laws. F-SCRIPT is (C) 1998-99
Data Fellows Corp., and it is not in public domain or freeware but you are free
to use and share this software with no charges. You can not get the source code
of this program. You are not allowed to decompile and reuse the program code of
this application. You are not allowed to resell this software for your own
profit (normal copying costs excluded) or claim to hold rights to this
software. Although you may have the right to use F-SCRIPT, it will remain the
exclusive property of Data Fellows. Data Fellows does not warrant that the
software is error free and we will not cover any costs created by function or
malfunction of this program. Data Fellows also disclaims liability for possible
consequential damages. Please redistribute F-SCRIPT only with this
documentation. If you cannot agree to these restrictions, you should not use
F-SCRIPT.

Copyright (C) 1998-99 Data Fellows Corp., Finland

