This is the documentation for the stand alone remover for the
Byway virus (both A and B variants).

The name of the remover is REM-BYWY.EXE.  It must be run on a system
that has been booted from a clean system disk.  The syntax is:

REM-BYWY D: [D: ...]

Where D: is the drive to check and clean.  You can check and clean more
than one drive at a time.  Because the remover uses low level disk routines,
you can't check or clean network drives.  If you have an infected network
drive, you have to clean the drive from the system it is on.

The removers first action is to look for the virus in memory.  If it finds
the virus, it will refuse to run.  This is because attempting to remove
the virus from a disk while the virus is active will cause the disk to
be corrupted beyond repair.

If the remover doesn't find the virus in memory, it attempts to find the
virus on the disks named in the command line.  Because the virus changes
low level structures on the disk in a characteristic way, this is what the
remover looks for.  Thus, you may receive the confusing message that the
remover looked at no files, if it doesn't find the virus.  This is not
entirely accurate.  If the characteristic changes in the low level disk
structures are not found, the remover has no need to look at files on the
disk, because the virus could not be present.

If the remover finds the virus on a disk, it generates a series of status
messages to tell you which files are infected, and which ones it successfully
cleaned.  This ends with a summary that tells you how many files were infected,
disinfected, and deleted.  If the number of infected files is not equal to the
number of disinfected and deleted files, the remover will also print out a
warning about that, and tell you what to do.  The remover will only delete the
file "CHKLIST.MS" (note the spaces in the file name).  This is a file
created by the virus to contain its body.

Finally, after successfully cleaning a hard drive, the system must be rebooted.
(This isn't necessary after cleaning a floppy.)

Caveats:  This remover is not compatible with Windows 95.  If the virus has
infected a Windows 95 machine, it is not removable.  In this case, the only
thing that can be done is to reinstall all software on the system.

If you receive an error message that says "Can't write to the root directory",
or something similar, the remover was unsuccessful, regardless of what the
status summary says.  To insure that the remover ran successfully, run it
again with the same command line.

You can't scan and clean multiple floppies.  Once the remover runs to
completion it exits.  If you have 35 floppies that you think might be infected,
you have to run REM-BYWY 35 times.  Sorry.

If you give the remover an unsupported option, you will receive three lines of
error reports related to it.  For example, if you type in:

REM-BYWY /FOO

You will receive error messages like this:

REM-BYWY.EXE: Unrecognized switch /FOO
Usage: REM-BYWY.EXE [/NOMEM] DRIVE [DRIVE ...]
REM-BYWY.EXE: Can't check drive /FOO

The last message is a bug.  The careful reader will notice that the usage
line purports that REM-BYWY supports a /NOMEM switch.  This switch will
turn off memory checking, and will (very slightly) speed up the scanning of
multiple floppies.  However, I strongly discourage its use, because the virus
will trash the disk if you attempt to remove it while it is active in memory.
