MS-DOS 6.22 Background Virus Monitoring with VSAFE

MS-DOS 6.22 includes a built-in terminate-and-stay-resident (TSR) program called VSAFE that provides continuous, real-time protection against computer viruses. While the standard MSAV command executes on-demand file scans, VSAFE loads directly into system memory to actively monitor system behavior, block suspicious operations, and intercept potential infections before they can harm the operating system. This article details what VSAFE is, how it functions, and how to configure it for ongoing virus protection.

What Is VSAFE?

VSAFE is the memory-resident component of the Microsoft Anti-Virus suite included with MS-DOS 6.0 through 6.22, licensed from Central Point Software. Unlike traditional scanners that only examine disks when explicitly run, VSAFE remains active in RAM to intercept common vectors of virus transmission, such as boot sector modifications, executable tampering, and unauthorized low-level disk writes.

How VSAFE Operates

Once executed, VSAFE installs itself as a TSR program. It monitors interrupt vectors—particularly INT 13h (disk operations) and INT 21h (DOS services)—to detect unauthorized attempts to modify files or critical disk structures. If an anomalous action occurs, VSAFE halts the offending process and displays a warning dialog on screen, allowing the user to either allow the action, stop it, or reboot the system.

Key Monitoring Features

VSAFE provides several configurable protection levels, which include:

  • HD Low-Level Format: Warns if a program attempts to perform a low-level format of the hard drive.
  • Resident Program Interception: Alerts when an unauthorized program attempts to stay resident in memory.
  • General Write Protection: Prevents programs from writing directly to disk sectors.
  • Executable Modification: Flags unauthorized alterations to .EXE, .COM, and .OVL files.
  • Boot Sector Protection: Intercepts any program attempting to overwrite the Master Boot Record (MBR) or partition boot sector.
  • Protected Attributes: Alerts if file attributes are changed on critical system executables.

Loading and Configuring VSAFE

To start continuous background monitoring, execute the command from the DOS prompt:

VSAFE

To load VSAFE with specific options, flags can be toggled using numbers 1 through 8 preceded by a plus (+) to enable or a minus (-) to disable:

  • /1+ or /1-: Warns of formatting the hard disk (Default: ON).
  • /2+ or /2-: Warns of an attempt to stay resident (Default: OFF).
  • /3+ or /3-: Prevents writing to disk (Default: OFF).
  • /4+ or /4-: Checks executable files (Default: ON).
  • /5+ or /5-: Checks all disks for boot viruses (Default: ON).
  • /6+ or /6-: Warns of attempts to write to the hard disk boot sector (Default: ON).
  • /7+ or /7-: Warns of attempts to write to floppy boot sectors (Default: OFF).
  • /8+ or /8-: Warns of attempts to modify executable files (Default: OFF).

For automated protection on boot, add the command to the AUTOEXEC.BAT file:

LH VSAFE /1+ /4+ /5+ /6+

Using LH (Load High) places VSAFE into Upper Memory Blocks (UMBs) if available, preserving conventional memory for other applications.

Managing and Unloading the Utility

VSAFE can be managed directly while running:

  • Hot-Key Access: Pressing Alt + V displays the VSAFE status and configuration menu, where options can be toggled interactively.
  • Unloading from Memory: To remove VSAFE from RAM, run: 
    VSAFE /U

VSAFE vs. MSAV

  • MSAV (Microsoft Anti-Virus): An on-demand scanner used to detect, report, and remove existing virus infections across directories and physical drives.
  • VSAFE: A proactive background watchdog that uses TSR architecture to prevent new infections and halt malicious routines before execution.