    VIRWARN
    10/10/97
    by Jan Steunebrink  <http://web.inter.nl.net/hcc/J.Steunebrink>

<<< Boot sector Virus Warning utility for 'Award Modular BIOS' >>>
    Version 1.2

I wrote this utility to have direct control over the Boot sector Virus Warning
feature of the Award ROM BIOS and to be able to install Windows 95.

Some versions of this BIOS have no 'Virus Warning' option in their BIOS
FEATURES SETUP. This may occur because Award gives final control over the
various BIOS features to the manufacturer of the motherboard.
This turns out fine for most features because the manufacturer knows best
about the implementation of the chipset on their motherboards.
But for a general feature like Virus Warning the ability to Disable/Enable
should be the user's.
I guess Award Software never intended their tools to be used in this way.

Anyway there are a number of PCs out there (including mine) that have no
control over the BIOS Virus Warning which is therefore always Enabled or
Disabled. It is the Enabled state which gives problems when installing
Windows 95 because Setup needs to write to the DOS Boot Record.

This 'VIRWARN' program restores your control over the Award BIOS Virus Warning
feature and in addition allows you to test it.
VIRWARN is unable to control the Virus Warning feature on non-Award BIOSes,
but it will allow you to test for an active Virus Warning on all BIOS brands.


The program is started by typing VIRWARN at the command prompt. In this way
the program runs in an interactive mode. It displays the status of the BIOS
Virus Warning feature and allows you to test this.

Be advised that the test may be unsuccessful if a driver has hooked the
harddisk interrupt (Int 13h) and does not pass control back to the BIOS
interrupt handler. (like Disk Manager or the Windows 32-bit diskdriver)
So boot your computer as clean as possible if you want to run the test.
- If you have MS-DOS 6.xx / Win3.xx, hit the F5 key when you see
  'Starting MS-DOS...'. This will bypass CONFIG.SYS and AUTOEXEC.BAT.
- If you have Windows 95 already installed you must select 'Command prompt
  only in save mode' from the Windows 95 Start menu to get the BIOS in
  control and obtain reliable test results.
  (If you have not enabled the Windows 95 Start menu by default, hit the F8
  key when you see 'Starting Windows 95...')
- If you use a disk overlay driver like Disk Manager or EZ-Drive, consult
  the driver documentation on how to make a boot without loading the overlay.
  Note that you have to run VIRWARN and the test from a bootable floppy in
  this case because the files on your harddisk are inaccessible as long as
  the overlay driver is not loaded.

By using the command VIRWARN OFF or VIRWARN ON the program just switches the
Virus Warning Off respectively On and displays the result.
These commands can therefore be used in your AUTOEXEC.BAT.

The program can display the following error messages:

1. <  An 'Award Modular BIOS' could NOT be detected.         >
   <  This program is therefore unable to change or display  >
   <  the Status of the Virus Protection in this BIOS.       >
   As the program only works on the Award Modular BIOSes (like the versions
   4.50, 4.50G, 4.50PG, and 4.51PG), it searches for the above string.
   (You can see this string on the screen just after you power-up your PC.)
   If you have an Award Modular BIOS and still get this error you may have
   software which hides part of the ROM BIOS (like the stealth feature of
   QEMM). Disable these features when using VIRWARN.
   On encountering this error, the program will then allow you to test your
   BIOS for an active Virus Warning by reading and re-writing the Master
   Boot Record of drive C:.

2. <  Virus Protection NOT detected in this Award BIOS.      >
   <  This program is therefore unable to change or display  >
   <  the Status of the Virus Protection in this BIOS.       >
   The program searches the BIOS for a specific instruction and the BIOS data
   area for a specific pointer, both vital for the Virus Warning feature.
   If you get this error you may have software which hides part of the ROM
   BIOS (like the stealth feature of QEMM). Disable these features when using
   VIRWARN. If this error persist, your Award BIOS probably doesn't have
   the Virus Warning feature.
   On encountering this error, the program will then allow you to test your
   BIOS for an active Virus Warning by reading and re-writing the Master
   Boot Record of drive C:.

3. *** The MBR of drive C: could not be read. Test aborted! ***
   This error can only be displayed when running the test.
   If you get this message you probably have trouble already booting from
   drive C:. I am not aware of any software which prevents you from READING
   the Master Boot Record.

4. *** The write operation to drive C: was unsuccessful! ***
   This error can only be displayed when running the test.
   This message is normally displayed when running the test with the BIOS
   Virus Warning ON and typing 'N' on the question to accept or abort in the
   !!! WARNING !!! pop-up window. In all other cases this message indicates a
   real write error to the Master Boot Record. This may be caused by other
   Virus protection software on your system.
   In both cases, the program will display 'Test completed' and ends.

5. <  You are running Windows 3.x or higher. Shutdown Windows and  >
   <  run the test after a clean reboot, from the command prompt.  >
   <  See the VIRWARN.TXT file for more information.               >
   This error can only be displayed when running the test.
   Because most versions of Windows 3.x or later use a 32-bit protected mode
   driver for disk access, the BIOS disk interface is no longer used.
   Testing for a BIOS Virus Warning is therefore meaningless.
   On encountering this error, the program aborts the test and ends.
   See above for more details about the 'clean boot'.

6. *** Disk C: read Error! ***
   This error can only be displayed when using the command VIRWARN ON.
   To enable the Virus Warning the program needs to know the location of the
   DOS Boot Record of the active partition and it finds this by reading the
   partition table inside the Master Boot Record on drive C:.
   If you get this message you probably have trouble already booting from
   drive C:. I am not aware of any software which prevents you from READING
   the Master Boot Record.
   On encountering this error, the program will not make any changes to the
   Virus Warning and displays its present state.


Some final remarks:
The Boot sector Virus Warning feature of the BIOS will only warn you of write
actions to the Master Boot Record or to the DOS Boot Record on your C: drive.
Programs that write to these areas are a/o Boot Sector Viruses, the Setup
program of Operating Systems, the Install program of Disk Manager/EZ-Drive,
disk repair utilities, and the DOS programs Fdisk and Format.
The BIOS Virus Warning is only intended to protect these vital disk areas
against the mentioned viruses and you should switch it OFF when
(re-)installing a new operating system or harddisk.
Also use other anti-virus software/hardware to protect your system against
other kinds of viruses!
Note that with Windows 95 running the BIOS Virus Warning does not work
because this OS uses its own protected mode diskdriver and the BIOS harddisk
interface is not used anymore (except in safe or compatibility mode).
On the issue of Boot Sector Virus protection in Windows 95 you may like to
read the Microsoft Knowledge Base article: Q143281.

If my program does not work for you there is another way to install Win95
when the BIOS Virus Warning cannot be disabled. Use the undocumented command
 SETUP /ir  to prevent Win95 setup from writing to the boot areas.
Create an Emergency disk during installation (you will be prompted) and boot
from this disk when Setup has finished. From the A:\> prompt give the command
SYS C: and type 'Y' to accept the modification of the boot sectors if the
Virus Warning pops-up. Remove the Emergency disk.
You should now be able to boot and run Windows 95 from your harddisk.
(This workaround is from Microsoft.)


The program comes in a ZIP-file (VIRWRN12.ZIP) which should contain the
following 2 files: VIRWARN.EXE  ;the program
                   VIRWARN.TXT  ;this text file.

The files have a date-time stamp of 10/10/97 - 1:20 am.
The program is written in assembly language and it is freeware.
I tested the program on quite a number of PCs and I believe it will work
on any 486 or Pentium class PC with the Award Modular BIOS.
If you find this program useful or if you have any questions regarding
this program, please send me an E-mail.

J.Steunebrink@net.HCC.nl

------------------------------------------------------------------------------
Virwarn revision history:

Version 1.0 1996.
11/11/96 First release.
Worked only on the 'Award Modular BIOS v4.50G'.

Version 1.1 1997.
04/04/97 First update.
Will work on all versions of the 'Award Modular BIOS v4.50(P)(G)'.
It appears that the problem is not confined to the v4.50G BIOS alone. 
The program is now an .EXE i.s.o. a .COM file because I switched from
debug to assembler.
Also made a small change, to echo the keyboard input, so that you can see on
the screen if you typed a 'Y' or 'N' in response to the (Y/N)? question.
 (Later it appeared that this version didn't work on some v4.50PG BIOSes.)

Version 1.2
10/10/97 Second update.
-VIRWARN should now work on all versions of the 'Award Modular BIOS v4.xx'.
 This includes the v4.50, v4.50G, v4.50PG and v4.51PG BIOSes.
-Added display of the Award BIOS version.
-When the program doesn't detect an Award BIOS or can't find the Virus Warning
 feature, it no longer aborts but allows you to test for active Boot sector
 Virus Protection by reading and re-writing the MBR of drive C:.
 This makes the program also useful for other than the Award BIOSes.
-During the test, the program now checks if Windows 3.x or later is running
 and aborts the test if this is the case.
-Fixed a bug in the Virus Warning status display after a 'Disk C: read Error'.
------------------------------------------------------------------------------

