
                          Anti-STEALTH V2.00
                          ;

  This program allows you to search for stealth viruses. (Stealth viruses are
viruses, that try to hide themselves. Most modern & successfull viruses are
stealth. If stealth virus attacks file, and expands it by 500 bytes, after dir
you will not see that change - virus is hidden. This is dangerous because most
antivirus programs are not able to find them if they don't know them. And if
virus is new, no antivirus program knows it!)

  How does it work? Anti-STEALTH reads every file's size 2 (or 3, depending
on options) times.  First time it behaves like convencional DOS appliaction
(like dir). Second time it reads true size (through Int 13h and directly
through IDE) of that file.  If they differs, virus is there, and you know what
to fight against.

  This means, that virus can be detected only if it is already active in
memory and some files on hard-drive are infected. So you cann't check floppies
by Anti-STEALTH.

  This also means, that if virus is able to compress file (so it can keep
original size), it may not be detected (fortunately, most viruses are not able
to do that, OneHalf is probably exception).

  By default, Anti-STEALTH uses only FindFirst to scan for files by DOS (you
can disable this by /F-).  You can force it to open every file and get its
size by option /O+, but it may be dangerous, because some viruses infect every
opened file. You also may want to disable reading through IDE (compatibility
reasons), use switch /I- in this case. You need to use /I- if you hard disk is
SCSI.

  Reading through IDE is safe, its extremely hard to intercept it (QEMM is
powerfull enough to intercept it, but QEMM has 100KB). And 100KB virus would
be probably too big to be efficient.

  Final note: If AntiSTEALTH will find some problem, it will wait for you to
press a key, co it's safe to run it from batch files.

                                Compatibility
                                
  This program expects C: to be first partition of first harddisk, D: second
partition of first hard... So it cann't check second harddrive and will not be
compatible with DoubleSpace or Stacker, if drives are swapped. It's not
problem to corect this, contact me if it is problem for you.

  Windows say, that this program is not compatible with their 32-bit disk
acces techniques, so don't use this under Windows, when 32-bit disk acces is
in use. (Anyway, any program scaning for viruses under Windows is *very*
unreliable, because if virus were clever enough, it could bypass anything
easily.)

                              Revision history:
                              
1.00 First version, had bug causing it to work only under limited number of
     bioses

1.01 Bug has been corected

2.00 Added reading directly through IDE, which is SAFE


                                  Shareware
                                  
This program is shareware, please register after 21-days testing period.
Registration fee is $5 (or 50Kc for people from Czech/Slovak republic).

My adress:
           Pavel MACHEK
           Volkova 1131
    198 00 Praha 9
           Czech republic

My phone:  +42-2-866 233
My e-mail: machek@troja.fjfi.cvut.cz
