Best viewed with Notepad with wordwrap turned on.


Why do we need a renamer?
=========================
F-Prot (most notably) names viruses based on their extensions.  IMG files are "image files", etc.  Misnamed files make a mess for collectors that are trying hard to keep a clean collection.



What does it do?
================
"RenExts" was written to rename files back to their original extensions.  It does this by checking the contents of the file and matching those contents to known formats.  It is HIGHLY accurate.  I use this program EXCLUSIVELY on my collection.

The program scans all the files in the current subdirectories and recurses into any other directories.  As it goes it writes output to the screen, to a file called "BadList.Lst" and to a batch file named "RenF.Bat".

The theory is this: run the program in the directory that you want checked.  Look at the "badlist.lst", if you agree with the results run "RenB.Bat".  If you do NOT agree with the results, send me a copy of the files and why you disagree.



Why a stupid batch file?
========================
I can EASILY eliminate the batch file from the coding, however to keep as much control as possible to the user, the batch file is created.



COM2EXE Files
=============
For the purpose of this discussion, mis-linked (mis-compiled) files are considered COM2EXE'd.  Incorrectly Com2Exe'd files are a problem to any serious virus collector.  You can com2exe ANY FILE (TEXT, Documents, ANYTHING).  F-Prot identifies a virus that is in a filetype that that virus is not known to detect as a dropper.  For example if a virus only infects .COM files and someone com2exe's that file into an .EXE file, it will be listed as a dropper.  Up until now there were only three choices.  Try to manually exe2com every file that you came across, do bad trades for false droppers, or not trade droppers at all.  Most serious collectors want REAL droppers in their collection.

RenExts determines a file to be incorrectly com2exe'd if ALL the following conditions are true:

	No Stack Segment    (SS=0)
	No Relocation Items (=0)
	No Code Segment     (CS=0)
	IP is equal to 100h (IP=100h)
	Headersize <> 0     (HS<>0)
	Size of data < 65536
	
If ALL of those conditions are met, the file is determined to be an incorrectly COM2EXE'd file.  Renexts does not modify any program that it considers to be a valid COM2EXE file.  AVP will still see COM2EXE'd files in your collection after running RenExts.  This is normal.  If the filetype "under" the COM2EXE'd file is not determined, it is set to COM.  Also, if you do not run the batch file after the completion of RenExts /FIX you will still have the original .EXE file (meaning if you run RenExts again, it will still find the COM2EXE'd files)  SO RUN THE BATCH FILE!!



USAGE:
======
RenExts [/?] [/UNK] [/FIX] [/VIR]


RenExts will run in the directory you are currently in and will recurse the directory.

/?	List the options
/DEBUG	Copy the files to a directory named \DEBUG\ (with the new extensions)
/FIX	Fix com2exe'd files that have detected non-COM filetypes underneath.
/GOAT	Replaces "Special bait/goat file for ...." with nulls.
/STRIP	Remove ALL Com2Exe headers (dangerous).
/UNK	List unidentified files
/VIR-	Don't rename unidentified files to .VIR



NOTES:
======
Com2Exe'd files are only fixed if you specify /FIX.

Com2Exe'd files are not deleted until you run the RENF.BAT file.

/GOAT	Directly modifies the file.  Looks through the ENTIRE file for "Special goat for" and "$pecial bait for" strings and replaces then with nulls.  Will not modify read-only files.  Files are logged.  Is slower due to reading the entire file, start to end.  I am only interested in removing strings that show the identity of the person that the file was given to in the beginning (i.e. NOT just strings that say it's a goat).  Is designed very carefully to be safe.  Files with multiple strings are listed multiple times in the log.  THIS IS SAFE!



There are currently the following known problems:
=================================================
COM files.  I am only able to look for several COM compressors and the three most common starting instructions.

IMG files.  Image files, bah....


What formats does it support?
=============================
??_ :	InstallShield archive.
??_ :	MicroSoft Compress 5.0 archive.
777 :	777 archive.
A86 :	ASM source code.
ANS : 	Ansi file.
AR  :	AR archive.
AR7 :	AR7 archive.
ARJ :	ARJ archive.
ARQ :	ARQ archive.
ASM :	Assembly language file.
BAT :	Dos batch file.
BIN :	Binary image of a boot sector.  Sometimes these files have multiple sectors.  They 
	are ALWAYS even multiples of 512 bytes.  THEY ARE NOT .COM FILES!
BMP :	Windows bitmap graphic.
BOA :	BOA archive.
BS2 :	BS2 archive.
BSN :	BSN archive.
BZ  :	BZip archive
C   :	C source code.
CAB :	Microsoft archive.
CHM :	Windows help CHM.
CHZ :	CHZ archive.
CLS :	Microsoft Word Class file.
CNT :	Windows help contents file.
COM :	DOS executable (very limited support).
CPP :	Detected as C.
CSC :	Corel script file.
DBF :	DataBase file (FlagShip/DBase 3,4,5/FoxBase/FoxPro/Clipper).
D86 :	ASM source code.
DLL :	Dynamic Link Library (Detected as .EXE).
DOC :	Microsoft Word/WinWord 2.
DOT :	Microsoft Word.
DPA :	Dirk's Packer - DPA archive.
DWC :	DWC archive.
ELF :	Linux executable.
ESP :	ESP arvhive.
EXE :	Dos/Windows executable.
GIF :	Graphic file.
GZ  :	GZipped archive.
H   :   Detected as C.
HA  :	HA archive.
HEX :	Bin2Hex compressed file.
HLP :	Windows help file.
HPA :	HPA archive.
HTM :	HTML file.
HYP :   HYPer archive.
ICE :	LHIce archive.
IFF :	IFF graphic file.
IMG :	Image file, (limited support).
INI : 	mIRC initialization file.
JAR :	Jar archive.
JAV :	Java (HTML takes precedence).
JPG :	Jpeg graphic file.
JRC :	JRC archive.
JS  :	JavaScript (HTML takes precedence).
LHA :	LHA/LHArc archive.
LIM :	LIM archive.
LZH :	LZH archive.
MAP :	Compiler MAP file.
MDB :	Access database.
OBJ :	Compiler object files.  Need to be linked in order to be executables.
PAC :	CrossePAC archive.
PAS :	Pascal source code (limited).
PAK :	PAK archive.
PHP :	PHP archive.
PL  :	Perl Language file.
PNG :	PNG graphic file.
PPS :	PowerPoint.
PPT :	PowerPoint.
Q   :	Quantum archive.
RAR :	RAR archive.
RAX :	RAX archive.
REG :	Registry file.
RNC :	ProPak archive.
RTF :	Rich text file.
SAM :	AmiPro.
SH  :	Unix baSH shell script.
SIT :	Archive.
SMM :	AmiPro.
SQZ :	Squeeze archive.
SWG :	SWAG archive.
SYS :	System Drivers (Limited Support).
TAR :	TAR archive.
TD  :	TeleDisk image.
TD0 :	TeleDisk image.
TGZ :	Tarred GZIP archive.
TPU :	TurboPascal unit.
TTC :	TTC archive.
UC2 :	UltraCompressorII archive.
UFA :	UFA compressor.
URL :	Internet Shortcut.
UUE :	UUEncoded.
VBS :	Visual Basic Script (HTML takes precedence).
WBT :	WinBatch command file.
WMF :	Windows metafile graphic.
WPD :	WordPerfect document.
WPG :	WordPerfect graphic.
XIE :	msXIE archive.
XL  :	XLink archive.
XLM :	Microsoft Excel.
XLS :	Microsoft Excel.
ZIP :	ZIP archive.
ZOO :	ZOO archive.
ZPK :	ZPK archive.


What are those messages saying?
===============================

"unknown"

If an extension is one of major detected types but doesn't appear to be that type or any other recognized type, the extension is changed to ".VIR" in the batch file (unless you specify "/UNK-" on the command line).



"(garbage file, fixed)"

If a Com2Exe'd file is detected AND another filetype is detected: The Com2Exe'd file is converted back to a regular file.  The original file is then deleted in the batch file.



"bad ext for type:"

If an extension does not match it's contents, it is renamed in the batch file to the detected extension.




How can you help?
=================
Give me suggestions, ideas etc.  If you find a file that is renamed improperly or not detected, e-mail it to me.  If you get any runtime errors, send me the error.  Help me figure out OLE/COM files.

MOST IMPORTANTLY, USE THE PROGRAM!


Phage
donnyj@home.com
http://members.home.com/phagevirusexchange/



CREDITS:
========
Daniel 	Debugging.  Helping with COM files.  Ideas for new formats.
Evul	Com2Exe files!!!!!!!!!!
G-Nome  That incredibly useful NW.  PL/SH Detection.
HS|ice  Support.  All the great VX tools.  Requester and HSW are the BEST!
JTR     BetaTesting and encouragement.
LysKov	Those pesky CLASS files.
Polt	Encouragement, beta testing and TECHNICAL INFORMATION!
RoadKil	Debugging.  Being the #VXTRADER enforcer. IMG files.
Secret	Those pain in the butt BMP/BAT files.
Spooky	Chk4Obj and Chk4Txt.
Spyda	MDB files.
Tally	Debugging.  Ideas.  Support.  Author of my favorite collection tool, VK.
VEiN	Explaining BIN file format to me 1,000 times.
Zulu	For helping me with my stupid Com2Exe'd OBJ files.
VB      For StripLog (used extensively when testing types).

Your name supposed to be on that list?  e-mail me!  Want to get on the list?  HELP!


Revisions:
==========
1.00 - First public release.
1.01 - Fixed LHIce file extension (.LHI -> .ICE).
1.02 - Changed .DOC detections, so that if it is not ID'd, rename to .TXT.
1.03 - Added *.CO_ to list of extensions to rename to *.COM.
1.04 - Removed .IMG from list of extension to rename to .VIR if undetected.
1.05 - Removed type .XIE, found a false alarm.
1.06 - Fixed flaw in renaming MS Compress and InstallShield files.
1.07 - Removed 7 archive formats that only used 2 characters to identify them. (False alarms).
1.08 - Removed "Erase RenF.Bat" from the end of the batch file (Thanks Tally.)
1.09 - Modified SH/PL detection.  (Thanks [G]-Nome).
1.10 - Forgot to remove renaming of unidentified .DOC files to .TXT (Thanks [G}-Nome).
1.11 - Modified rename command in the batch file to preserve LFN (Thanks Polt!).
       Added SEVERAL music formats: 669, CMF, DMF, FAR, IT, MID, MOD, MTM, S3M, VOC, WAV, XM (for JTR).
       Cleaned up the text output.
       Fixed Read-Only files (Thanks JTR).
1.12 - Changed the "by extension" COM file detection.  (Thanks JTR)
       Removed 669 detection.  (Too unreliable)
       TOTALLY REWROTE Script/Batch/HTML/Text code.
       Added .ASM format.
       Added /DEB command.
       Added /ZER command.  (Thanks JTR)
       Fixed .MDB format.
1,13 - Added filename collision avoidance (Thanks JTR)  If the destination exists, changes to VS0000???.ext
1.14 - Fixed /ZER command.  (Thanks JTR)
1.15 - Fixed filename collision avoidance (Thanks JTR)
1.16 - Fixed a CRITICAL error in /FIX coding (Thanks Tally)
1.17 - Fixed detection of a certain .BAT/.COM combo virus (Thanks Perikles)
       Modified C, JS, HTML, INI, BAT detection.
       Modified INI detection. (Thanks Zulu)
       Fixed COMPRESS/.COM endless loop error.
       Added .ANS file type.
       Added .MSG file type. (Outlook message format) (Thanks Zulu)
       Removed detection of STI.
       Added .DAT file type (Bablylonian Plug-In) (Thanks Zulu)
       Added detection of .TXT files named .DOC.  (If no high-ascii, renamed to .TXT, else .VIR)
1.18 - Added "/VIR-" switch (Thanks Polt/JTR).  If used, files are NOT renamed to .VIR.
1.19 - Modified .RAR detection to allow .R## and .S## file extensions (Thanks JTR)
1.20 - Modified .JPG detection (Thanks JTR)
       Addes SHS file type (Scrap/Document Shortcut) (Thanks Zulu)
1.21 - Fixed ANS/BAT problem.
1.21 - Added .CLA (Java Class) files (Thanks Zulu)
       Modified .BAT/COM detection (Thanks Tally)
       ***********************************
       IMPORTANT CHANGE: Combined .IMG and .BIN detection.  These filetypes are the same anyways.  F-Prot pre-pends "image file" to the virusname of "*.IMG" files, thus enabling better control over your collection.
       ***********************************
1.22 - Added .PIF format (Thanks DEL).
1.23 - Added /GOAT - Replaces "Special bait/goat file for ...." with nulls.  See Goat note above!!!!
       Modified .BAT detection (Thanks Tally).
       Repaired a bug in JAV detection (Thanks Tally).
       Updated parts of this documentation.
       Modified .IMG detection.
       Fixed ".COM based on extension only" bug.
       If an OLE files is found and no filetype is determined, it is renamed to "*.DOC".
1.24 - Was erroneously calling .SIT files .HQX, fixed now (Thanks Spooky)
1.25 - Was erroneously calling .HQX files .HEX, fixed now (Thanks Spooky)
       Increased the file area searched for .HQX files.
       More COM/BAT file ID's added.
1.26 - Com2Exe TOTALLY, 100% rewritten. SEE COM2EXE above!!!! (Thanks Evul, Polt, Spooky, Ralph Brown, PastolVX, Tally, JTR)
       If a file has an extension of "EXE" and is not identified as an EXE or anything else, it is renamed to .COM (Thanks Polt) 
1.27 - Com2Exe detection expanded to include incorrectly TLink'ed files.
1.28 - Fixed filename collision.
1.29 - The com2exe tools were created before "new" executables existed, rewrote Com2Exe code to ignore them.
1.30 - Internal ALPHA
1.31 - Reworked Com2Exe code.  /FIX now only removes the Com2Exe header if an underlying non-COM format is found.
       /STRIP added to force RenExts to remove ANY Com2Exe header it finds (dangerous).
       Improved .ASM detection.
       Modified .ANS detection.
1.32 - Modified .ASM detection to NOT rename .A86 and .D86 files that are detected as .ASM (thanks JTR).       


PLEASE REGULARLY CHECK FOR UPDATES!!!!!
       
       
       
What's next????
===============
I am working on more ways to identify .IMG files.  These files are very hard to ID because there is not a set format or filesize etc.  They are simply raw sector dumps.
