McAfee Virus Scan User Manual

McAfee VirusScan

VERSION 6.0

GETTING STARTED

© 2001 Networks Associates Technology, Inc and its Affiliated Companies. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Network Associates, Inc.

TRADEMARK ATTRIBUTIONS

Active Security, Activehelp, Activeshield, Antivirus Anyware And Design, Bomb Shelter, Building A World Of Trust, Certified Network Expert, Clean-up, Cleanup Wizard, Cloaking, Cnx, Cnx Certification Certified Network Expert And Design, Cybercop, Cybermedia, Cybermedia Uninstaller, Data Security Letter And Design, Design (Logo), Design (Rabbit With Hat), Design (Stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (In Katakana), Dr Solomon's, Dr Solomon's Label, Enterprise Securecast, Ez Setup, First Aid, Forcefield, Gauntlet, Gmt, Groupshield, Guard Dog, Helpdesk, Homeguard, Hunter, I C Expert, Isdn Tel/scope, Lan Administrature Architecture And Design, Langura, Languru (In Katakana), Lanwords, Leading Help Desk Technology, Lm1, M And Design, Magic Solutions, Magic University, Magicspy, Magictree, Magicword, Mc Afee Associates, Mcafee, Mcafee (In Katakana), Mcafee And Design, Netstalker, Mcafee Associates, Moneymagic, More Power To You, Multimedia Cloaking, Mycio.com, Mycio.com Design (Cio Design), Mycio.com Your Chief Internet Officer & Design, Nai And Design, Net Tools, Net Tools (And In Katakana), Netcrypto, Netoctopus, Netroom, Netscan, Netshield, Netstalker, Network Associates, Network General, Network Uptime!, Netxray, Notesguard, Nuts & Bolts, Oil Change, Pc Medic, Pc Medic 97, Pcnotary, Pgp, Pgp (Pretty Good Privacy), Pocketscope, Powerlogin, Powertelnet, Pretty Good Privacy, Primesupport, Recoverkey, Recoverkey International, Registry Wizard, Reportmagic, Ringfence, Router Pm, Salesmagic, Securecast, Service Level Manager, Servicemagic, Smartdesk, Sniffer, Sniffer (In Hangul), Sniffmaster, Sniffmaster (In Hangul), Sniffmaster (With Katakana), Sniffnet, Stalker, Stalker (Stylized), Statistical Information Retreival (Sir), Supportmagic, Telesniffer, Tis, Tmach, Tmeg, Total Network Security, Total Network Visibility, Total Service Desk, Total Virus Defense, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virus Forum, Viruscan, Virusscan, Vshield, Webscan, Webshield, Websniffer, Webstalker, Webwall, Who's Watching Your Network, Winguage, Your E-business Defender, Zac 2000, Zip Manager are registered trademarks

of Network Associates, Inc. and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. ©2001Networks Associates Technology, Inc. All Rights Reserved.

Issued September 2001 / Getting Started v6.0

McAfee Perpetual End User License Agr eement - United Stat es of America

NOTICE TO ALL USERS: CAREFULLY READ T HE FOLLOWING LEGAL AGR EEMENT ("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") PRODUCED BY NETWORK ASSOCIATES, INC. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY) CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE B UT TON THAT INDICATES THAT YOU DO NOT AC CEPT THE TERMS OF T HIS AGREEMENT AND DO NOT INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE PLACE OF PURCHASE FOR A FULL REFUND.)

1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and conditions of this

Agreement, McAf ee hereby grants to you a non-exclu sive, non-transferable right to u se one copy of the specified version of the Software and the accompanying documentation (the "Documentation"). You may install one copy of the Software on one compute r, work station, person al dig ital assi stant, p ager, "sm art phone " or o ther elec tronic device for which the Software was de signed (each, a "Client Device"). If the Software is li censed as a suite or bundle wi th mo re than one specified Software product, this license applies to all such specified Software products, subject to any restrictions or usage terms specified on the applicable price list or product packaging that apply to any of such Software products individually.

a. Use. The Software is licensed as a single product; it may not be used on more than one Client Device or by

more than one us er at a ti me, except as set f orth in this Sect ion 1. T he Softwar e is "in use" on a C lient De vice when it is loade d into the te mporar y memory (i .e., rando m-acces s memory o r RAM) or ins talled in to the permanent memory (e.g., hard disk, CD-ROM, or other storage device) of that Client Device. This license authorizes you to make one copy of t he Softw are solel y for b ackup or archi val p urposes, provid ed tha t the copy you make contains all of the Softwa re's proprietary notices unaltered a nd unobstructed.

b. Server-Mode Use. You may use the Software on a Client Device as a server ("Server") within a multi-user

or networked environ ment ("Server-Mode") only if such use is p ermitted in the applicable price l ist or product packaging for the Software. A separate license is required for each Client Device or "seat" that may connect to the Server at any time, regardless of whether such licensed Client Devices or seats are concurrently connect ed to, accessi ng or using th e Software . Use of softwar e or hardwar e that reduc es the number of Client De vices or seats directly accessing or utilizing th e Software (e.g., "multiplexing" or "pooling" software or hardware) does not reduce the number of licenses required (i.e., the required number of licenses would equ al the num ber of d istinct input s to the mult iplexing o r pooling software or hardware "front end"). If the number of Client Devices or seats that can connect to the Software can exceed the number of licenses you have ob tained, then yo u must have a reasona ble m echani sm in place to ensure tha t your use of the Softw are do es n ot exce ed the use lim its spe cified f or the lice nses you have obtai ned. Thi s license authorizes you to make or downl oad one copy of the Doc um entation for each Clie nt D ev ic e or seat that is licensed, provided that each such copy contains all of the Documentation's proprietary notices unaltered and unobstr ucted.

c. Volume License Use. If the Soft ware is licen sed with volume license terms specified in th e applicable

product invoicing or product packaging for the Software, you may make, use and install as many additional copies of the Software on the number of Client Devices as the volume license terms specify. You must have a reasonable mech anism in place to ensure that the number of C lient Devices on w hich the Software has been installed does not ex ceed the number of licenses you have obta ined. This license aut horizes you to make or download on e copy of the Documentation for each additional copy authorized by the vol ume license, provided that each such copy contains all of the Documentation's proprietary notices unaltered and unobstructed.

2. Term. This Agreement is effective for an unlimited duration unless and until earlier terminated as set forth herein. This

Agreement will termi nate automa tically i f you fail to comply wi th any of the limitatio ns or othe r requireme nts descri bed herein. Upon any termination or expiration of this Agreement, you must cease use of the Software and destroy all copies of the Software and the Docu mentation.

Getting Started iii

3. Updates. For the time period specified in the applicable product invoicing or product packaging for the Software, you

are entitled to download revisions or updates to the Software when and as McAfee publishes them via its electronic bulletin board system , we bsite or t hro ugh ot her on line ser vice s. For a peri od of n inet y (90) d ay s from t he da te of t he of original pur chase of the So ftwar e, you are enti tled to downlo ad one ( 1) re visio n or upg rade to the Soft ware wh en and as McAfee publishes it via its electronic b ulletin board system , website or throu gh other online servi ces. After the specified time period, you have no further rights to receive any revisions or upgrades without purchase of a new license to the Software.

4. Ownership Rights. The Software is p rotected by United S tates copyright laws a nd international tre aty provisions.

McAfee and its suppliers own and retain all right, title and interest in and to the Software, including al l copyrights, patents, trade secret right s, tradem ark s and o ther i ntelle ctual proper ty rig hts th erein . You r po ssession, in stallatio n, or use of the Software does not transfer to you any title to the intellectual property in the Software, and you will not acquire any rights to the Software except as expressly set forth in this Agreement. All copies of the Software and Documentation m ade hereunder must cont ain the same proprietar y notices that appear on an d in the Software and Documentation.

5. Restrictions. You m ay not sell, lease, licen se, rent, loan or otherwise tr ansfer, with or without c onsideration, the

Software. You shall n ot di sclose the resul ts of an y b enchma rk te st tha t you ma ke of t he Soft ware to any th ird parti es without McAfee' prior written conse nt. Customer agrees not to permit an y third party (other than third parties und er contract with Customer whic h cont ains non disclosure obligat ions no less restr ictive tha n those set forth here in) to use the Licensed Program in any form and shall use all reasonable efforts to ensure that no improper or unauthorized use of the Licensed Program is made. You may not permit third parties to benefit from the use or functionality of the Software via a timesharing, service bureau or other arrangement, except to the extent such use is specified in the applicable list price or product pa ckaging for the Software. You may not tra nsfer any of the rights granted to you under this Agreement. You may not reverse engineer, decompile, or disassemble the Software, except to the extent the foregoing restriction is expressly prohi bited by applicable law. You may not mo dify, or create derivative wo rks ba sed upon, the Software in whole o r in part. You ma y not copy the Softwa re or Documentation except as expressly pe rmitted in Section 1 above. You ma y no t remove any p roprie tary noti ces or la bels on the So ftware . All rig hts not expre ssly set forth hereunder are reserved by McAfee.

6. Warranty and Disclaimer.

a. Limited Warranty. McAfee warrants that for sixty (60) days from the date of original purchase the media

(e.g., diskettes) on which the Software is contained will be free from defects in materials and workmanship.

b. Customer Remedies. McAfee's and its suppliers' entire liability and your exclusive remedy for any breach

of the foregoing war ranty shall be , at McAfe e's option, either (i ) return of t he purchase pri ce paid fo r the license, if any, or (ii) replacement of the defective media in which the Software is contained. You must return the defective media to McAfee at your expense with a copy of your receipt. This limited warranty is void if the defect has re sulted from accident, abuse, or mi sapplication. Any replacement m edia will be warranted for the remainder of the original warranty period. Outside the United States, this remedy is not available to the extent McAfee is subject to restrictions under United States export control laws and regulations.

c. Warranty Disclai mer. Except for the limi ted warra nty set fo rth herei n, THE SOFTWARE IS PROVIDED

"AS IS." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MCAFEE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT WITH RESPECT TO THE SOFTWARE AND THE ACCOMPANYING DOCUMENTATION. YOU ASSUME RESPONSIBILITY FOR SELECTING THE SOFTWARE TO ACHIEVE YOUR INTENDED RESULTS, AND FOR THE INSTALLATION OF, USE OF, AND RESULTS OBTAINED FROM THE SOFTWARE. WITHOUT LIMITING THE FOREGOING PROVISIONS, MCAFEE MAKES NO WARRANTY THAT THE SOFTWARE WILL BE ERROR-FREE OR FREE FROM INTERRUPTIONS OR OTHER FAILURES OR THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS. SOME STATES AND JURISDICTIONS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES, SO THE ABOVE LIMITATION MAY NOT APPLY TO YOU. The foregoing provisions shall be enforceable to the maximum extent permitted by applicable law.

iv McAfee VirusScan

7. Limitation of Liability. UNDER NO C IRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN

TORT, CONTRACT, OR OTHERWISE, SHALL MCAFEE OR ITS SUPPLIERS BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR FOR ANY AND ALL OTHER DAMAGES OR LOSSES. IN NO EVENT WILL MCAFEE BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE LIST PRICE MCAFEE CHARGES FOR A LICENSE TO THE SOFTWARE, EVEN IF MCAFEE SHALL HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILIT Y SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY TO THE EXTENT THAT APPLICABLE LAW PROHIBITS SUCH LIMITATION. FURTHERMORE, SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. T he foregoing provisions shall be enforceable to the maximum extent pe rm it te d by a pplicable law.

8. United States Government. The Software and accompanying Documentation are deemed to be "commercial

computer software" and "commercial computer software documentation," respectively, pursuant to DFAR Section

227.7202 and FAR Se ction 12.212, as ap pli ca bl e. Any use, modifica tion, reproduction, re le a s e, performance, display or disclosure of the Software and ac compan ying Doc umentati on by th e Unite d States Governme nt shall b e govern ed solely by the terms of this Ag reem ent a nd shall be prohib ited e xcep t to the e xtent expre ssly perm itt ed by th e terms of this Agreement.

9. Export Controls. You are advised that the So ftware is subj ect to the U .S. Export Adm inistration Regulatio ns. You

shall not export, import or transfer Software contrary to U.S. or other applicable laws, whether directly or indirectly, and will not cause, approve or otherwise facilitate others such as agents or any third parties in doing so. You represent and agrees that neither the United States Bureau of Export Administration nor any other federal agency has suspended, revoked or denied your export privileges. You agree not t o use or transfer the Software for end use rel ating to any nuclear, chemical or biological weapons, or missile technology unless authorized by the U.S. Government by regulation or specific license. Ad ditionally, you acknowledg e that the Software is subject to exp ort control regulations in the European Union and yo u here by decl are a nd ag ree t hat t he Soft ware wil l not be use d for a ny other purpose than c ivil (non-military) purposes. The parties agree to cooperate with each other with respect to any application for any required licenses and approval s, ho w ev er, you acknowledge it is your ultimat e re sponsi bi li ty to comply with any and all export and import laws and that McAfee has no further responsibility after the initial sale to you within the original country of sale.

10. High Risk Activities. The Software is not fault-tolerant and is not designed or intended for use in hazardous

environments requiring fail-safe performance, including without limitation, in the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, weapons systems, direct life-support machines, or any other application in which the failure of the Software could lead directly to death, personal injury, or severe physical or property damage (c oll e ctively, "High Risk Ac t ivi ties"). McAfee expressly di sclaims any express or implied warranty of fitness for High Risk Activities.

11. Miscellaneous. This Agreement is governed by the laws of t he United St ates and the St ate of Californi a, without

reference to conflict of laws principles. The application of the United Nations Convention of C ontracts for the International Sale of Goods is expressly excluded. This Agreement sets forth all rights for the user of the Software and is the entire agreement between the parties. McAfee reserves the right to periodically audit you to ensure that you are not using any Software in violatio n of this Agreement. During your sta ndard business hours and upon prior w ritten notice, McAfee m ay vi sit you an d you wi ll ma ke a vail able to M cAfee or its rep rese ntativ es an y r ecord s pert aini ng to the Software to McAfe e. T he cost of any requested audit will be solely borne by McAfee, unless such audit discloses an underpayment or a m ount due to McAfee in exce ss of five percent (5%) of the initial li ce nse fee for the Software or you are using the Software in an unauthorized manor, in which case you shall pay the cost of the audit. This Agreement supersedes any other co mmuni cations with respect t o the Softw are and Doc ument ation. Thi s Agreeme nt may not be modified except by a written ad dendum issue d by a duly au thorized re presentative of McAfee. No provision here of shall be deemed waived unless such waiver shall be in writing and signed by McAfee or a duly authorized representative of McAfee. If any prov ision of t his Agreem ent i s held i nvali d, th e rem ainder of t his Agreem en t shall c ontin ue in ful l force and effect. The parties confirm that it is the ir wish that this Agreeme nt has be en written in the English la nguage only.

Getting Started v

12. MCAFEE CUSTOMER CONTACT. If you have any questions co ncerning these t erms and conditions, or if you

would like to contact McAfee for any other reason, please call (408) 988-3832, fax (408) 970-9727, or write: Network Associates, Inc., McAfee Software Division, 3965 Freedom Circle, Santa Clara, California 95054. http://www.nai.com.

McAfee Perpetual End User License Agr eement - Canada

NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT ("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") BY NETWORK ASSOCIATES INTERNATIONAL B.V. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY) CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE B UT TON THAT INDICATES THAT YOU DO NOT AC CEPT THE TERMS OF T HIS AGREEMENT AND DO NOT INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE PLACE OF PURCHASE FOR A FULL REFUND.)

1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and conditions of this

Agreement, McAf ee hereby grants to you a non-exclu sive, non-transferable right to us e one copy of the specified version of the Software and the accompanying documentation (the "Documentation"). You may install one copy of the Software on one compute r, work station, person al digit al assistant , pager, "smar t phone" or o th er electro nic de vice for which the Software was d esigned (each, a "Client Device"). If the Software is licensed as a suite or bundle with more than one specified Software product, this license applies to all such specified Software products, subject to any restrictions or usage terms specified on the applicable price list or product packaging that apply to any of such Software products individually which you acknowledge you have received and read.

a. Use. The Software is licensed as a single product; it may not be used on more than one Client Device or by

more than one us er at a ti me, except as set f orth in this Sect ion 1. T he Softwar e is "in use" on a C lient De vice when it is loade d into the t emporar y memory (i .e., rando m-acces s memory or RAM) or ins talled in to the permanent memory (e.g., hard disk, CD-ROM, or other storage device) of that Client Device. This license authorizes you to make one cop y of the Softw are sol ely for b ackup or ar chival p urpo ses, prov ided that t he copy you make contains all of the Software's proprietary notice s unaltered and unobstructed.

b. Server-Mode Use. You may use the Software on a Client Device as a server ("Server") within a multi-user

or networked environ ment ("Server-Mode") only if such use is permitted in the applicable pric e list or product packaging for the Software which you acknowledge you have received and read. A separate license is required for eac h Client De vice or " seat" th at may c onnect to the Serve r at any t ime, reg ardles s of whethe r such licensed Client Devices or seats are concurrently connected to, accessing or using the Software. Use of software or hardware that reduces the number of Client Devices or seats directly accessing or utilizing the Software (e.g., "mul tiplexing" or "pool ing" software or hard ware) doe s not re duce th e number of lice nses required (i.e., the required number of licenses would equal the number of distinct inputs to the multiplexing or pooling software or hardw are "fro nt end" ). If the num ber of C lient Dev ices or sea ts that ca n conne ct to the Software can e xceed the number of licenses you h ave obtained, then you must have a reasonable mechanism in place to ensure that your use of the Software does not exceed the use limits specified for the licenses you have obtained. This license authorizes you to make or download one copy of the Documentation for each Client Device or seat that is l icensed, provided tha t each such copy cont ai ns all of the Documentation's proprietary notices unaltered and unobstructed.

c. Volume License Use. If the Software is licensed with volume license terms specified in the applicable price

list or product p ac ka gi ng for the Software, you may make, use and install as ma ny additional copie s of the Software on the numbe r of Clie nt Devices a s the vol ume lice nse autho rizes. Yo u must have a reason able mechanism in place to ensure that the number of Client Devices on which the Software has been installed does not exceed the number of licenses you have obtained. This license authorizes you to make or download one copy of the Docum entation for each additional cop y authorized by th e volume license , provided that each such copy contains all of the Documentation's proprietary notices unalte red and unobstructed.

2. Term. This Agreement is effective for an unlimited duration unless and until earlier terminated as set forth herein. This

Agreement will termi nate automa tically if you fail to comply wi th any of t he limitat ions or ot her requir ements descr ibed herein. Upon any termination or expiration of this Agreement, you must cease use of the Software and destroy all copies of the Software and the Documentation.

vi McAfee VirusScan

3. Updates. For the time pe riod specified in the ap plicable price list or product packaging for the Software, you a re

entitled to download revisions or updates to the Software when and as McAfee publishes them via its electronic bulletin board system, website or through other online services. For a period of ninety (90) days from the date of the of original purchase of the Software, you are entitled to download one (1) revision or upgrade to the Software when and as McAfee publishes it via its el ectronic bulletin boa rd system, website or thr ough other online services. After the specified time period, you have n o further rights to receive any revisions or upgrades without p urchase of a new license to the Software.

4. Ownership Rights. The Software is p rotected by United S tates copyright laws a nd international tre aty provisions.

McAfee and its suppliers own and retain all right, title and interest in and to the Software, including all cop yrights, patents, trade secret right s, trade mark s and o ther i ntelle ctual proper ty rig hts th erein . You r po ssession, in stallatio n, or use of the Software does not transfer to you any title to the intellectual property in the Software, and you will not acquire any rights to the Software except as expressly set forth in this Agreement. All copies of the Software and Documentation m ade hereunder must cont ain the same proprietar y notices that appear on and in the Software and Documentation.

5. Restrictions. You may not sell, leas e, license, rent, loan or other wise transfer, with or w ithout consideration, the

Software. You shall not discl ose the results o f any b enchm ark t est t hat you m ake of the Softwa re to any th ird pa rties without McAfee's prior written consent. You agree not to permit any third party (other than third parties under contract with you which cont ract contains no ndisclosure obligat ions no less restrictiv e than those set f orth herein) to use t he Software in any form and shall use al l re asonable efforts to ensure that there is no improper or unauthorized use of the Software. You may not permit third parties to benefit from the use or functionality of the Soft w a re via a timesharing, service bureau or other arrangement, except to the extent such use is specified in the applicable list price or product packaging for the Software. You may not transfer any of the rights granted to you under this Agreement. You may not reverse engineer, d ecompile, or disasse mble the Soft ware, except to the extent th e foregoing rest riction is expre ssly prohibited by applicable law. The interface information necessary to achieve interoperability of the Software with independently created compu ter pro gram s will be sup plied by Mc Afee on re quest and on payme nt of suc h reasona ble costs and expenses of McAfee in su pplying tha t information . You may not m odify, or crea te derivat ive works based upon, the Software in whole or in part. You may not copy the Software or Documentation except as expressly permitted in Section 1 above. You may not remove or alter any proprieta ry notices or labels on the Software or D oc umentation. All rights not expressly set forth hereun de r are reserved by McAfee.

6. Warranty and Disclaimer.

a. Limited Warranty. McAfee warrants that for sixty (60) days from the date of original purchase the media

(e.g., diskettes) on which the Software is contained will be free from defects in materials and workmanship.

b. Customer Remedies. McAfee's and it s s upp lier s' ent ire l ia bil ity and y our exc lus ive r em edy fo r an y br eac h

of the foregoing w arranty shall be, at McAfee 's option, eithe r (i) return of the purch ase price pai d for the license, if any, or (ii) replacement of the defective media in which the Software is contained. You must return the defective media to McAfee at your expense with a copy of your receipt. This limited warranty is void if the defect has re sulted from accident, abuse, or mi sapplication. Any replaceme nt media will be warranted for the remainder of the original warranty period. Outside the United States, this remedy is not available to the extent McAfee is subject to restrictions under United States export control laws and regulations.

Getting Started vii

c. Warranty Disclaimer. Except for the limited warran ty se t fo rth he rein , THE SOFTWARE IS

PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MCAFEE DISCLAIMS ALL WARRANTIES, REPRESENATIONS AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT WITH RESPECT TO THE SOFTWARE AND THE ACCOMPANYING DOCUMENTATION. YOU ASSUME RESPONSIBILITY FOR SELECTING THE SOFTWARE TO ACHIEVE YOUR INTENDED RESULTS, AND FOR THE INSTALLATION OF, USE OF, AND RESULTS OBTAINED FROM THE SOFTWARE. WITHOUT LIMITING THE FOREGOING PROVISIONS, MCAFEE MAKES NO WARRANTY, REPRESENTATION OR CONDITION THAT THE SOFTWARE WILL BE ERROR-FREE OR FREE FROM INTERRUPTIONS OR OTHER FAILURES OR THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS. SOME STATES AND JURISDICTIONS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES, SO THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

7. Limitation of Liability. UNDER NO C IRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN

TORT, CONTRACT, OR OTHERWISE, SHALL MCAFEE OR ITS SUPPLIERS BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR FOR ANY AND ALL OTHER DAMAGES OR LOSSES. IN NO EVENT WILL MCAFEE BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE LIST PRICE MCAFEE CHARGES FOR A LICENSE TO THE SOFTWARE, EVEN IF MCAFEE SHALL HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMIT ATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY TO THE EXTENT THAT APPLICABLE LAW PROHIBITS SUCH LIMITATION. FURTHERMORE, SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. Th e foregoing provisions shall be enforceable to the maximum extent pe rm it te d by a pplicable law.

8. United States Government. The Software and accompanying Documentation are deemed to be "commercial

computer software" and "commercial computer software documentation," respectively, pursuant to DFAR Section

227.7202 and FAR Se ction 12.212, as ap pli ca bl e. Any use, modifica tion, reproduction, re l ea s e, performance, display or disclosure of the Software and ac compan ying Doc umentati on by th e Unite d States Governme nt shall b e govern ed solely by the terms of this Agree men t and sha ll be prohib ited except t o the exte nt ex pressly pe rmitt ed by th e terms of this Agreement.

9. Export Controls. You have been ad vised that t he Software is sub ject to th e U.S. Export Administra tion Regula tions

and applicable loca l export contr ol laws. You sh all not export , import or t ransfer Products c ontrary to U.S. or other applicable local laws, whether directly or indirectly, and will not cause, approve or otherwise facilitate others such as agents or any third parties in doing so. If applicable to you, you represent and agree that neither the United States Bureau of Export Administration nor any other federal agency has suspended, revoked or denied your export privileges. You agree not to u se or t ransfer t he Softwa re for e nd use relating to any n ucle ar, chem ical or bi ologica l weapo ns, or missile technology unless authorized by the U.S. Government and any other applicable local authority by regulation or specific license. Additiona lly, you acknowledge that the Software is subject to e xport control regulations in the European Union and yo u here by decl are and ag ree t hat t he Soft ware will not be used f or a ny ot her pu rpose t han c ivil (non-military) purposes. The parties agree to cooperate with each other with respect to any application for any required licenses and approval s, ho w ever, you acknowledge it is your ulti m at e re sponsibility to comply with any and a ll expo rt and import laws and that McAfee has no further responsibility after the initial sale to you within the original country of sale.

viii McAfee VirusScan

10. High Risk Activities. The Software is not fault-tolerant and is not designed or intended for use in hazardous

11. Miscellaneous. This Agreement i s governed by the laws of the Neth erlands. The app lication of the Uni ted Nations

Convention of Contracts for the International Sale of Goods is expressly excluded. Disputes with respect to this Agreement, as well as with respect to its conclusion and execution, will be submitted exclusively to the competent court in Amsterdam. This Agree ment s ets f ort h all rig hts f or the u se r of th e Soft ware a nd is t he en tir e agree ment b et ween th e parties. McAfee reserv es the right to pe riodica lly audi t you t o ensu re tha t you are no t using an y Softwa re in viola tion of this Agreement. During your standard business hours and upon prior written notice, McAfee may visit you and you will make available to McAfee or its representatives any records pertaining to the Software to McAfee. The cost of any requested audit will be solely borne by McAfee, unless such audit discloses an underpayment or amount due to McAfee in excess of five percent (5%) of the initial license fee for the Software or you are using the Software in an unauthorized manor, in which case you shall pay t he cost of the au dit. This Agre eme nt su persed es any ot her co mmu nica tions wi th respect to the Software and Documentation. This Agreement may not be modified except by a written addendum issued by a duly authorized repre sentative of McAfee. No provision he reof shall be deemed waived unless suc h w ai ve r shall be in writing and signed by McAfee or a duly authorized representative of McAfee. If any provision of this Agreement is held invalid, the rem ainde r of this Agre emen t shall c ontin ue in full forc e and e ffect. T he par ties have req uired that this Agreement and all documents relating thereto be drawn up in English. Les parties ont demandé que cette convention ainsi que tous les documents que s'y attachent soient rédigés en anglais.

12. MCAFEE CUSTOMER CONTACT. If you ha ve any questions c oncerning these t erms and conditions, or if you

would like to cont act McAfee for any ot her reason, please call +31 20 586 61 00 or write: McAfe e, Gatwickstraat 25, 1043 GL Amsterdam, Netherlands. You will find our Internet web-site at http://www.nai.com.

Getting Started ix

x McAfee VirusScan

Table of Conte nts

Chapter 1. Welcome to McAfee VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

How Does VirusScan Software Work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

What Comes With VirusScan Software? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Chapter 2. Installing VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Other Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Installation Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Installation Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

Chapter 3. Using McAfee VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

The VirusScan Inductive User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Using VShield Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

VShield Scanning Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

How to Start and Stop VShield Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

What Should You Do When a Virus Is Detected? . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

Using Hostile Activity Watch Kernel (HAWK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Using Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Managing Quarantined Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Using VirusScan With a Wireless Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Data Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

VirusScan for Palm OS ® . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30

VirusScan for Windows ® CE ® and Pocket PC . . . . . . . . . . . . . . . . . . . . . . . . .33

VirusScan for Symbian’s EPOC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35

Using Safe & Sound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36

How Safe & Sound Creates Automatic Backups . . . . . . . . . . . . . . . . . . . . . . . . .36

Defining Your Backup Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36

Safe & Sound Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37

Emergency Disk Creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38

Chapter 4. Removing Infections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

Getting Started xi

Table of Contents

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

Removing Infections Detected Upon Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39

Removing an Infection In Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42

Chapter 5. McAfee Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

About McAfee Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

What Comes With McAfee Firewall Software? . . . . . . . . . . . . . . . . . . . . . . . . . .43

How McAfee Firewall Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

About McAfee Firewall Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

McAfee Firewall On-line Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46

Intrusion Detection System – (IDS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

How to Configure the Intrusion Detection System . . . . . . . . . . . . . . . . . . . . . . .49

McAfee Firewall Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

Chapter 6. Update Your McAfee Product . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Instant Updater . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Why Do You Need to Update? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

How Does the Updating Process Work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Instant Updater Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Appendix A. Product Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

How to Contact McAfee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

Customer Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

www.McAfee-at-Home.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58

Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59

xii McAfee VirusScan

1Welcome to McAfee VirusScan

How Does VirusScan Software Work?

VirusScan software combines the anti-virus industry’s most capable scan

engine with top-notch interface enhancements that give you complete access

to that engine’s power. The VirusScan graphical user interface unifies its

specialized program components, but without sacrificing the flexibility you

need to fit the software into your computing environment. The scan engine,

meanwhile, combines the best features of technologies that McAfee and

McAfee VirusScan researchers developed independently for more than a

decade.

What Comes With VirusSca n Softwar e?

VirusScan software consists of several components that combine one or more

related programs, each of which play a part in defending your computer

against viruses and other malicious software. These components are:

• The VirusScan main window. This is your central entry point in using all of the available components of McAfee VirusScan. The main window provides relevant information such as the last time a virus scan was performed on your computer and your computer’s current VShield settings. The main window also informs you of the availability of updates to your product.

Through this user-friendly interface, you access the main functions of McAfee VirusScan – simply select “Pick a task” to access and use all VirusScan features and components.

For answers to questions about viruses, product support, or to view on-line help, refer to the See Also section of the VirusScan main window.

• On-Demand Scanning (ODS). On-demand scanning enables you to scan at any time. For example, if you suspect you have come in contact with an infected file, but have not accessed the file, you may manually scan the suspect file, folder, drive, etc.

Getting Started 13

Welcome to McAfee VirusScan

• The VShield Scanner. This is an On-Access Scanning (OAS) component that gives you continuous anti-virus protection from viruses that arrive on floppy disks, from your network, or from various sources on the Internet. The VShield scanner starts when you start your computer, and stays in memory until you shut down. A flexible set of property pages lets you tell the scanner which parts of your system to examine, what to look for, which parts to leave alone, and how to respond to any infected files it finds. In addition, the scanner can alert you when it finds a virus, and can summarize each of its actions.

The VShield Scanner comes with specialized modules that guard against hostile Java applets and ActiveX controls, that scan e-mail messages and attachments that you receive from the Internet via Microsoft Mail or other mail clients that comply with Microsoft’s Messaging Application Programming Interface (MAPI) standard, and that block access to dangerous Internet sites. Secure password protection for your configuration options prevents others from making unauthorized changes. The same convenient dialog box controls configuration options for all VShield modules.

• Hostile Activity Watch Kernel. HAWK monitors your computer for suspicious activity that may indicate a virus is present on your system. As opposed to VirusScan, which cleans the virus, HAWK prevents viruses, worms, and trojans from spreading further.

• Safe & Sound. This component allows you to create backup sets in

• Quarantine. This component allows you to move infected files to a

• The SendVirus utility. This feature gives you an easy and painless way to

• The E-Mail Scan extension. This component allows you to scan your

14 McAfee VirusScan

protected volume files, which is the safest and preferred type of backup. A protected volume file is a sectioned-off area of the drive, sometimes called a logical drive.

quarantine folder. This moves infected files from areas where they can be accessed and enables you to clean or delete them at your convenience.

submit files that you believe are infected directly to McAfee anti-virus researchers. A simple wizard guides you as you choose files to submit, include contact details and, if you prefer, strip out any personal or confidential data from document files.

Microsoft Exchange or Outlook mailbox, or public folders to which you have access, directly on the server. This invaluable “x-ray” peek into your mailbox mean s that VirusScan software can find potential infections before they make their way to your desktop, which can stop a Melissa-like virus in its tracks.

Welcome to McAfee VirusScan

• The Emergency Disk creation utility. This essential utility helps you to create a floppy disk that you can use to boot your computer into a virus-free environment, then scan essential system areas to remove any viruses that could load at startup.

• Bootable CD. The VirusScan Installation CD includes a CD version of the emergency startup disk. If your computer is configured to start using its CD drive, then you can use the CD to boot your computer in to a virus-free environment then scan for viruses that load during startup.

• Instant Updater. Enables your computer to automatically communicate with McAfee while you are connected to the internet and inquire of the availability of product updates, updates to anti-virus signature files, and updates to the VirusScan scan engine. You will also use this feature to register your McAfee product.

• Wireless device protection. In addition to total anti-virus protection for your PC, VirusScan protects your wireless device and PC from harmful viruses transferred during the synchronization process.

• Command-line Scanners. This component consists of a set of full-featured scanners you can use to run targeted scan operations from the MS-DOS Prompt or Command Prompt windows, or from protected MS-DOS mode. The set includes:

– SCAN.EXE, a scanner for 32-bit environments only. This is the

primary command-line interface. When you run this file, it first checks its environment to see whether it can run by itself. If your computer is running in 16-bit or protected mode, it will transfer control to one of the other scanners.

– SCANPM.EXE, a scanner for 16-bit and 32-bit environments. This

scanner provides you with a full set of scanning options for 16-bit and 32-bit protected-mode DOS environments. It also includes support for extended memory and flexible memory allocations. SCAN.EXE will transfer control to this scanner when its specialized capabilities can enable your scan operation to run more efficiently.

– SCAN86.EXE, a scanner for 16-bit environments only. This scanner

includes a limited set of capabilities geared to 16-bit environments. SCAN.EXE will transfer control to this scanner if your computer is running in 16-bit mode, but without special memory configurations.

– BOOTSCAN.EXE, a smaller, specialized scanner for use primarily

with the Emergency Disk utility. This scanner ordinarily runs from a floppy disk you create to provide you with a virus-free boot environment.

Getting Started 15

Welcome to McAfee VirusScan

All of the command-line scanners allow you to initiate targeted scan operations from an MS-DOS Prompt or Command Prompt window, or from protected MS-DOS mode. Ordinarily, you'll use the VirusScan application's graphical user interface (GUI) to perform most scanning operations, but if you have trouble starting Windows or if the VirusScan GUI components will not run in your environment, you can use the command-line scanners as a backup.

• Integrated Firewall Solution. McAfee VirusScan adds McAfee Firewall to safeguard your PC's connection to the Internet. Whether you're connected via DSL, cable modem, satellite, or dial-up; the integrated firewall gives you the powerful tools you need to control the communications into and out of your PC. Mcafee Firewall provides Intrusion Detection, color-coded and audible firewall alerts, enhanced graphical display of network activity, and more.

16 McAfee VirusScan

2 Installing VirusScan Software

Before You Begin

McAfee distributes VirusScan software in two ways:

1. As an archived file that you can download from the McAfee website.

2. On CD-ROM.

Although the method you use to transfer VirusScan files from an archive obtained via download differs from the method you use to transfer files from a CD that is placed in your CD-ROM drive, the installation steps followed after that are the same for both distribution types. Review the system requirements shown below to verify that VirusScan software will run on your system.

System Requirements

To install this product, you require the following:

Desktop and Notebook Computers

• Windows 95B, Windows 98, Windows Me, Windows NT Workstation with Service Pack 4 or later, Windows 2000 Professional, Windows XP Home Edition, or Windows XP Professional.

• 35 megabytes (MB) of hard disk space.

•32 MB of RAM.

• An Intel Pentium-cl ass or compatible processor rated at 100 MHz or higher.

• CD-ROM drive.

• Internet access for product updating.

Additional Requirements for Wireless Devices

Palm OS ® and Palm ™ Requirements

McAfee VirusScan for Palm ™ Desktop with HotSync ® Manager 3.0 will install and run on any IBM PC or PC-compatible computer equipped with Palm ™ Desktop 3.0 or later. The latest version of Palm ™ Desktop and HotSync ® 3.0 is a free download from Palm's site (at www.palm.com). The device-resident portion is quite simple and should work on any device with the Palm OS ®.

Getting Started 17

Installing VirusScan Software

Windows ® CE ® or Pocket PC System Requirements

McAfee VirusScan for Windows ® CE ® or Pocket PC will install and run on any IBM PC or PC-compatible computer equipped with ActiveSync 3.0 or later. Any CE device with ActiveSync 3 will function properly.

Symbian EPOC System Requirements

McAfee VirusScan for Symbian’s EPOC will install and run on any IBM PC or PC-compatible computer equipped with PsiWin 2.3 (or equivalent for non-Psion EPOC devices. All EPOC devices should ship with PsiWin 2.3 /EPOC Connect 5. These include:

• Psion Revo

•Psion Series 5mx

•Psion Series 7

• Psion netBook

• Oregon Scientific Osaris

• Ericsson MC218

•Ericsson R380

If you have an older device but the current PsiWin/EPOC Connect software, McAfee VirusScan for Symbian’s EPOC will function properly, including the Psion HC, the MC series, the Workabout series, all Psion Series 3 models, the Psion Sienna, the Psion Series 5, the Geofox One, and the Phillips Illium.

If you do not have PsiWin 2.3, Symbian offers a free product called EPOC Connect Lite which also works.

Other Recommendations

To take full advantage of VirusScan software’s automatic Instant Updater features, you should have an Internet connection, either through your local-area network, or via a high-speed modem and an Internet service provider.

Installation Options

The “Installation steps” section describes how to install VirusScan software with its most common options on a single computer or workstation. You can choose to do a Typical setup – which installs commonly used VirusScan components – or you can choose to do a Custom setup, which gives you the option to install all VirusScan components.

18 McAfee VirusScan

Installation Steps

æ IMPORTANT: Because Setup installs some VirusScan files as services on

Windows NT Workstation v4.0, Windows 2000 Professional, and Windows XP systems, you must log in to your computer with a user profile having administrative rights to install this product. To run Setup on Windows 95, Windows 98, and Windows Me, you do not need to log in with any particular profile or rights.

McAfee recommends that you first quit all other applications you have running on your system before you start Setup. Doing so reduces the possibility that software conflicts will interfere with your installation.

After inserting the McAfee VirusScan installation CD in your CD-ROM drive, a VirusScan Autorun image should automatically display. To install

VirusScan software immediately, click Install VirusScan, then skip to Step 5

on page 20 to continue with Setup.

Use the steps below to install yo ur VirusScan software .

1. If your computer runs Windows NT Workstation v4.0, Windows 2000 Professional, or Windows XP, log on to your system as a user with administrative rights. You must have administrative rights to install VirusScan software on your system.

Installing VirusScan Software

2. Insert the VirusScan CD in to your computer’s CD-ROM drive. If the VirusScan Installation Wizard do es not automatically display, go to Step 3. Otherwise, skip to Step 4.

3. Use the following procedure if the Autorun installation menu does not display, or, if you obtained your software via download at a McAfee web site.

a. From the Windows Start menu, select Run.

The Run dialog box displays.

b. Type <X>:\SETUP.EXE in the text box provided, then click OK.

Here, <X> represents the drive letter for your CD-ROM drive or the path to the folder that contains your extracted VirusScan files. To search for the correct files on your hard disk or CD-ROM, click Browse.

4. Before proceeding with the installation, Setup first checks to see whether your computer already the Microsoft Windows Installer (MSI) utility running as part of your system software.

Getting Started 19

Installing VirusScan Software

a. If your computer runs Windows XP, Windows Me, or Windows

b. If Setup does not find MSI or an earlier version of MSI is installed in

5. Refer to steps displayed on the VirusScan Installation Wizard to complete your installation.

ë TIP: If your computer does not have the required fonts to view the End

User’s License Agreement (EULA), then you may locate the appropriate EULA on your McAfee software installation CD. You must read and agree to the terms of the agreement to complete your installation.

2000, MSI already exists on your system. If your computer runs an earlier Windows release, you may still have MSI in your computer if you previously installed other software that uses MSI. In either of these cases, Setup will display its first wizard panel immediately. Skip to Step 5 to continue.

your com puter, it installs files necessary to continue the installation,

then prompts you to restart your computer. Click Restart System.

When your computer restarts, Setup will continue from where it left off.

20 McAfee VirusScan

3Using McAfee VirusScan

The VirusScan Induct ive U ser In terface

Under the guidance of the Microsoft Corporation, McAfee introduces a new look to McAfee VirusScan - the Inductive User Interface (IUI).

What is an Inductive User Interface?

An IUI is similar to common web-style design – each screen within the application focuses on a unique, clearly stated, fundamental purpose. An IUI also allows you to easily navigate from one screen to the next.

How will an IUI help me?

IUI simplifies using McAfee VirusScan. On any screen within VirusScan, you can easily determine how to complete a task or how to access another related

or different task. You can easily navigate VirusScan by selecting the Back, Forward and Home icons. These three icons are common to all VirusScan

screens.

How do I use the IUI?

First, start VirusScan from the Windows Start menu.

Figure 3-1. The VirusScan Main Window

Getting Started 21

Using McAfee VirusScan

The VirusScan main window is your central entry point to all VirusScan tasks, features, and components. The main window displays three regions common to all VirusScan screens.

Pick a Task

Select Pick a task to access the primary task screen. From the primary task

screen you can select one of the following tasks:

• Scan my computer for viruses now.

• Scan my wireless device.

• Change my VirusScan settings.

• Manage quarantined files.

• Create an emergency disk.

• View VirusScan ’s activity logs.

ë TIP: After picking a task, simply follow the on-line instructions to

complete the task. If you would like to start a new task, select Pick a task.

Quick Jump

The Quick Jump section allows you access a function or program associated

with McAfee VirusScan (a function or program may include collection of tasks). For example, from the Quick Jump section you can:

• Select Scan for Viruses Now to have the application scan your computer

for viruses with the last configuration options you set, or with default options.

• Select Manage my Firewall P rotection to display the McAfee Firewall

main window and manage your Firewall settings.

• Select Run Safe & Sound to display the Safe & Sound window and

configure your back-up file settings.

• Select Check for VirusScan Update to start McAfee’s Instant Updater.

Instant Updater allows you to download updates to your product, anti-virus signature (DAT) files, and virus scan engine.

Using VShield Scanner

The VShield scanner has unique capabilities that make it an integral part of the VirusScan comprehensive anti-virus software security package. These capabilities include:

• On-access scanning: This means that the scanner looks for viruses in files that you open, copy, save, or otherwise modify, and files that you read from or write to floppy disks and network drives. It therefore can detect and stop viruses as soon as they appear on your system, including those that arrive via e-mail or as downloads from the Internet. This means you can make the VShield scanner both your first line of anti-virus defense, and your backstop protection in between each scan operation that you perform. The VShield scanner detects viruses in memory and as they attempt to execute from within infected files.

Using McAfee VirusScan

• Automatic operation: The VShield scanner integrates with a range of browser software and e-mail client applications. VShield Scanner starts when you start your computer, and stays in memory until you shut it or your system down.

• Malicious object detection and blocking: The VShield scanner can block harmful ActiveX and Java objects from gaining access to your system, before they pose a threat. The scanner does this by scanning the hundreds of obje cts you download as you conn ect to the web or to o ther Internet sites, and the file attachments you receive with your e-mail. It compares these items against a current list of harmful objects that it maintains, and blocks those that could cause problems.

Getting Started 23

Using McAfee VirusScan

• Internet site filtering: The VShield scanner comes with a list of dangerous web- or Internet sites that pose a hazard to your system, usually in t he form of downloadable malicious software. You can add any other site that you want to keep your browser software from connecting to, either by listing its Internet Protocol (IP) address or its domain name.

VShield Scanning Properties

The VShield scanner consists of five related modules, each of which has a specialized function. You can configure settings for all of these modules in the VShield Properties dialog box. The VShield modules are:

• System Scan. This module looks for viruses on your hard disk a s you work with your computer. It tracks files as your system or other computers read file s from your hard disk or write files to it. It can also scan floppy disks and network drives mapped to your system.

• E-Mail Scan. This module scans e-mail messages and message attachments that you receive via interoffice e-m ail systems, and via the Internet. It scans your Microsoft Exchange or Outlook mailbox systems. It works in conjunction with the Download Scan module to scan Internet mail that arrives via Simple Mail Transfer Protocol (SMTP) or Post Office Protocol (POP-3) sources.

• Download Scan. This module scans files that you download to your

• Internet Filter. This module looks for and blocks hostile Java classes and

• Hostile Activity Watch Kernel. HAWK monitors your computer for

• Security. This module provides password protection for the remaining

24 McAfee VirusScan

system from the Internet. If you have enabled the Internet mail option in the E-Mail Scan module, this will include e-mail and file attachments that arrive via SMTP or POP-3 e-mail systems, which include such e-mail client programs as Eudora Pro, Microsoft Outlook Express, Netscape mail, and America Online mail.

ActiveX controls from downloading to and executing from your system as you visit Internet sites. It can also block your browser from connecting to potentially dangerous Internet sites that harbor malicious software.

suspicious activity that may indicate a virus is present on your system. As opposed to VirusScan, which cleans the virus, HAWK prevents viruses, worms, and trojans from spreading further.

VShield modules. You can protect any or all individual module property pages and set a password to prevent unauthorized changes.

ë TIP: To display the VShield Properties window, right–click the VShield

icon displayed in th e window s system tray, point to properties and select the VShield module you wish to view.

How to Start and Stop VShield Scanner

Use the steps below to start and stop VSh ield Scanner.

1. With VShield running, from the Windows taskbar select Start > Settings > Control Panel. The Windows Control Panel displays.

2. Double–click the VirusScan icon. The VirusScan Services dialog box displays.

3. Select the Service tab and Click Stop. VShield Scanner stops.

ë TIP: You can start or re-start the VShield Scanner using the steps

described above.

Using McAfee VirusScan

VShield Scanner is setup to automatically start each time your computer starts To prevent VShield Scanner to run at startup, clear the Load on startup check box.

What Should You Do When a Virus Is Detected?

First of all, don’t panic! Although far from harmless, some viruses that infect your personal computer or wireless device may destroy data or render it unusable.

It can interfere with the normal operation of your computer or wireless device and may also have other undesirable effects. You should take them seriously and be sure to remove them when you encounter them.

McAfee VirusScan makes it easier for you to handle viruses whenever it is detected. Through an alert message dialog box, you are given options that you can perform simply by selecting the desired course of action.

When McAfee VirusScan detects a virus, an alert message is displayed to notify you and provide options on how you would want to proceed.

The following options are available:

•Click Clean if you want McAfee VirusScan to clean the infected file.

Getting Started 25

Using McAfee VirusScan

•Click Delete if you want McAfee VirusScan to delete the file.

•Click Continue if you do not want McAfee VirusScan to take any action and should just continue to scan other files.

•Click Quarantine to isolate the infected file from the other files, programs, and drives in your computer.

•Click Stop to end all running processes.

•Click More Info... if you want additional information about the virus found.

Using Hostile Activity Watch Kernel (HAWK)

Hostile Activity Watch Kernel (HAWK) is a VirusScan option that enables constant monitoring for suspicious activity that may indicate a virus is present on your system. Suspicious activity includes:

• An attempt to forward e-mail to a large portion of your address book.

• Attempts to forward multiple e-mail messages in rapid succession.

• E-mail attachments containing program files (executable files with an .exe file extension) or scripts that can be used to mask the actual type document transmitted to you.

Although VirusScan does an excellent job detecting known viruses, it cannot detect new viruses without a DAT file update. By monitoring for these typically malicious activities, HAWK notifies you and lets you take action before damage occurs. HAWK can prevent viruses, worms, and trojans from spreading further, while VirusScan cleans the virus to remove it from your computer.

Using Quarantine

Many VirusScan components allow you to move infected files to a quarantine folder. This moves infected files from areas where they can be accessed and enables you to clean or delete them at your convenience.

Managing Quarantined Files

This list describes the options available to you when managing quarantined files:

• Add. Select this option to browse for and quarantine a suspected file.

26 McAfee VirusScan

Using McAfee VirusScan

• Clean. Select this option to remove the virus code from infected file. If the virus cannot be removed, it will notify you in its message area.

• Restore. Select this option to restore a file to its original location.

+ WARNING: This option does not clean the file. Make sure the file is not

infected before selecting Restore.

• Delete. Select this option to delete the infected file. Make sure to note the file location so you have a record of the deleted files. You will need to restore deleted files from backup copies.

• Submit to McAfee. Select this option to submit new viruses to McAfee.

¥ NOTE: McAfee is committed to providing you with effective and

up-to-date tools you can use to protect your system. To that end, we invite you to report any new viruses, Java classes, ActiveX controls, or dangerous web sites that VirusScan does not now detect.

If you have found what you suspect to be a new or unidentified virus, send the infected file to McAfee Labs Anti-Virus Emergency Response Team for analysis, using the Submit to McAfee Wizard. You are given the option of removing your personal data from the file before submitting it.

Network Associat es reserves the right to use any information you supply as it deems appropriate without incurring any obligations whatsoever.

• Properties. Select this option to discover the characteristics of the quarantined file. For example, characteristics include: file type, size, origin of file (not the suspected virus), etc.

• Refresh. Select refresh to update the details of files displayed in the list of quarantined files.

Using VirusScan With a Wireless Device

As the demand for wireless devices continue to grow, it carries with it, the threat of compromising your data against viruses especially whenever you exchange information between your PC and your wireless device.

Getting Started 27

Using McAfee VirusScan

Wireless devices that are currently available in the market today are primarily designed as a more convenient alternative in storing and retrieving information such as personal activities, people’s addresses, telephone numbers, appointments, expenses, etc. Either at work or at home, you can easily keep track of records in all of these areas by simply using your wireless device. You can even set an alarm to alert you of important meetings, events or tasks to do during the day, week or month.

McAfee VirusScan is an application designed to protect your data by scanning the files on your wireless device every time a data exchange or update is performed with your computer. It protects your system from viruses that may have been placed on your wireless device during the use of features such as infrared transfers and wireless transactions. McAfee VirusScan supports most types of wireless devices using Palm OS ®, Pocket PC, Windows ® CE ®, and EPOC operating systems (please refer to the following table).

Operating system Wireless Device Manufacturer

Table 3-1. Examples of wireless devices that McAfee VirusScan

supports

Palm OS ® • Palm ™ Handheld

• Palm ™ VII Series

• Palm ™ V Series

• Palm ™ III Series Palm ™ M Series

•Visor ™

• Visor Edge ™

•Clie Sony

Pocket PC • E-115 Casio

• iPAQ

• iPAQ H3600 Series

•Aero

• Aero 2100 Series

• PPT 2700 Series Symbol Technologies

• Jornada 540

• Jornada 680

• Jornada 720

•E125

•EM500

Palm, Inc.

HandSpring

Compaq

Hewlett-Packard

Cassiopeia

28 McAfee VirusScan

Using McAfee VirusScan

Table 3-1. Examples of wireless devices that McAfee VirusScan

supports

Operating system Wireless Device Manufacturer

Windows ® CE ® • PenCentra 130 Fujitso

• HPW-600 ET Hitachi

• WorkPad z50 IBM

EPOC • Psion Series 5MX

Data Synchronization

Data synchronization is a standard feature of most wireless operating systems wherein information or records are synchronized between a wireless device and a regular PC. This feature has been commonly known, depending on the type of device you are using as: HotSync ® for Palm OS devices; ActiveSync for Pocket PC’s and Windows CE; and Psion Synchronizer for EPOC devices.

As an example, if you add a new entry on your wireless devices' Address List, this new entry is automatically added into the PC platform after performing a data synchronization operation. To reduce the time it takes to complete the synchronization of data on both platforms, it only changes the data that has been modified, updated or added.

In performing a data exchange operation, a data synchronization manager (i.e.: HotSync Manager, ActiveSync or Psion Synchronizer) must be running. This is the application that makes the data synchronization operation possible. It monitors your computer and responds to any data synchronization-related command when initiated from the wireless device.

Psion PLC

• Psion - Revo

•Mako Diamond

¥ NOTE: Depending on the operating system on your wireless device,

please refer to “Additional Requirements for Wireless Devices,” on page

17 to determine the type and version of data synchronization manager

(i.e.: HotSync Manager, ActiveSync) you must have to be able to use McAfee VirusScan.

VirusScan analyzes the data transmitted between your computer and your wireless de vice during data synchronization. If VirusScan detects the presence of infected data, you can treat the infected file in the same manner as you would any other infected file. For more information about this topic, see

“What Should You Do When a Virus Is Detected?,” on page 25.

Getting Started 29

Using McAfee VirusScan

VirusScan for Palm OS ®

About Palm OS ®

Palm OS ® developed by Palm, Inc. is one of the most common types of operating systems used for wireless computing devices. It is designed specifically for mobile information management. Through a wireless device, you can readily access personal or business information synced on at any time, and importantly, in any location.

One of its important components is HotSync ® data conduit synchronization technology that allows you to exchange information between your wireless device and your computer.

McAfee VirusScan for Palm OS ® scans your device for viruses before you can download a virus to your computer. It uses a PC-side component and a device-side component to scan the device during a HotSync ® with the PC.

Starting Palm Anti-Virus Components

Tap the McAfee VirusScan for Palm OS ® icon and several option checkboxes buttons appear on your device. These options are:

• Scan at start of a HotSync.

• Scan at end of HotSync.

• Scan Applications.

• Scan Application Data.

• Modified Records Only.

• Known File Types Only.

• Known Executable Types Only.

• Scan Flash Memory.

Available Options On the Device Component

The available wireless device component options allow you to customize how you want McAfee VirusScan to work on the components of your device. Selecting the option that you need most will help optimize your protection and scanning time.

30 McAfee VirusScan

Using McAfee VirusScan

¥ NOTE: Changing options on either the device or the PC side component

of the application changes both sides on sync. The only files scanned are files that go through the conduit to and from the device.

• Scan at start of a HotSync. This option allows you to scan files at the beginning of the HotSync ®.

• Scan at end of a HotSync. This option scans files at the end of the HotSync ®.

• Scan Applications. This option allows you to scan your applications.

• Scan Application Data. This option allows you to scan your application data.

• Modified Records Only. This option allows you to only scan data records that have been changed since the last HotSync ® operation.

• Known File Types Only. This option allows you to only scan known database type files.

• Known Executable Code Types Only. This option allows you to only scan known executable type files.

• Scan Flash Memory. This option allows to only scan flash memory of your wireless device to detect if a virus is present.

ë TIP: You can select any combination of the above scanning options.

Available Options On the PC Component

¥ NOTE: McAfee VirusScan requires that the PC-side component be

installed on the PC that you will sync the wireless device with for full anti-virus protection. You will not be able to scan your device for viruses if the PC-side component of McAfee VirusScan is not installed.

The available PC component options allow you to customize how you want McAfee VirusScan to work. Selecting the option that you need most will help optimize your protection and scanning time.

Getting Started 31

Using McAfee VirusScan

What to Scan Options

• Scan Applications.

• Scan Application Data.

• Modified Records Only.

• Known File Types Only.

• Known Executable Code Types Only.

• Scan Flash Memory.

This option allows you to scan your applications transferred to your device.

This option allows you to scan application data transferred to your device.

This option allows you to only scan data records that have been changed since the last HotSync ® operation transferred to your device.

This option allows you to only scan known database type files transferred to your device.

This option allows you to only scan known executable type files transferred to your device.

This option allows you scan the flash memory of your wireless device to detect if a virus is present.

¥ NOTE: You can select any combination of the above scans.

When to Scan Options

The following are other available options that can further optimize the way McAfee VirusScan will work on your wireless device.

• At the start of each HotSync.

• At the end of each HotSync.

Other Options

After selecting your scan settings, you can do any of the following:

• Click OK to accept the changes to your scan and update settings.

• Click Cancel to ignore the changes and close the window.

32 McAfee VirusScan

This option allows you to scan your wireless device for viruses at the start of each HotSync ®.

This option allows you to scan your device for viruses at the end of each HotSync ®.

Using McAfee VirusScan

Removing McAfee VirusScan for Palm OS ® Components

Use the steps below to remove McAfee VirusScan from your device-side components.

1. From the main applications screen, tap the clock.

2. From the App menu, choose Delete.

3. Select McAfee VirusScan from the menu, and then tap the Delete button.

4. Tap Yes in the Delete Application window.

5. Tap Done to close the screen.

ë TIP: If you accidentally delete McAfee VirusScan from your Palm device,

a backup file is available in your Palm backup directory. This file is usually listed as Palm \"username"\Backup \PalmAV.PRC, though doing a search for PalmAV.PRC will also find the file. Once you locate the file, double-click it to add it to the Palm Install Tool. The next time you HotSync ® your device, McAfee VirusScan will be restored.

VirusScan for Windows ® CE ® and Pocket PC

¥ NOTE: The features and functionality associated with McAfee VirusScan

for Windows ® CE ® work similarly to those of Pocket PCs. This section applies to both operating systems.

About Windows ® CE ®

Microsoft's ® Windows ® CE ® is an operating system platform that offers a broad range of communications, entertainment and mobile-computing devices. One of its main features is its capability to share information with Windows-based computers. It is a compact and portable operating system used on a variety of communication devices such as wireless PCs, digital information pagers and cellular smart phones.

For more information on wireless products using Windows ® CE ®, visit their Web site at www.pocketpc.com.

Getting Started 33

Using McAfee VirusScan

About Pocket PC

Pocket PCs do not only organize information. In addition to being able to seamlessly link information to your computer, it also allows you to read e-mail messages and browse the Web. Manufacturers of this type of wireless device include companies like Hewlett Packard, Casio Computer Co., Ltd., and Compaq. For examples of Pocket PC wireless devices please visit www.pocketpc.com.

Available Options On the PC Component

The available PC component options allow you to customize how you want McAfee VirusScan to work with your device. Selecting the options that you need most will help optimize your protection and scanning time.

What to Scan Options

• Scan All files. This option allows you to scan all files on your wireless device.

• Program Files Only. This option allows you to only scan those files most frequently used by your wireless device.

• New or Modified Files Only. This option allows you to only scan data records that have been chang ed or been created since the last scan operation.

• Scan files marked as in-ROM. This option allows you to scans files presently flagged as “in-ROM.”

When to Scan Options

The following are other available options that can further optimize the way McAfee VirusScan will work on your wireless device.

• Scan when a CE device connects to this PC. This option allows you to scan any Windows ® CE ® or Pocket PC device that you synchronize to your computer.

Other Options

After selecting your scan settings, you can do any of the following:

• Click OK to accept the changes to your scan and update settings.

• Click Cancel to ignore the changes and close the window.

• Click Update Now to manually begin a check for anti-virus signature updates.

34 McAfee VirusScan

• Click Scan Now to start a virus scan on your wireless device.

VirusScan for Symbian’s EPOC

About EPOC

Symbian is a company that develops mobile wireless operating systems. It makes use of the EPOC operating system capable of delivering applications and communications in a small package (i.e.: wireless devices). For more information, you can visit the company Web site at www.symbian.com.

Available Options On the PC Component

The available options allow you to customize how you want McAfee VirusScan to work on your wireless device. Selecting the option that you need most will help optimize your protection and scanning time.

What to Scan Options

• Scan All files. This option allows you to scan all files on your wireless device.

• Program Files Only. This option allows you to only scan those files most frequently used by your wireless device.

Using McAfee VirusScan

• New or Modified Files Only. This option allows you to only scan data records that have been changed or have been created since the last scan operation.

When to Scan Options

The following are other available options that can further optimize the way McAfee VirusScan will work on your wireless device.

• Scan when an EPOC device connects to this PC. This option allows you to scan any EPOC device you synchronize to your computer.

• Close all programs on the EPOC device before scanning. This option allows you to close programs before performing a virus scan.

Other Options

After selecting your scan settings, you can do any of the following:

• Click OK to accept the changes to your scan and update settings.

• Click Cancel to ignore the changes and close the window.

Getting Started 35

Using McAfee VirusScan

• Click Update Now to manually begin a check for anti-virus signature updates.

• Click Scan Now to start a virus scan on your wireless device.

¥ NOTE: If you want to find out the versions of the scan engine and

anti-virus signature files (DAT) that McAfee VirusScan is using to detect any problem on your wireless device, click About. This dialog box also displays dates that will allow you to determine if there is a need to update your DAT files to ensure maximum virus protection on your wireless device.

Using Safe & Sound

Safe & Sound is a unique backup utility that automatically creates backup files of your documents as you work on them.

You can configure Safe & Sound to back up to a different drive, across a network connection, or to a protected area within your local (c:\) drive.

If your files become corrupted due to a virus, or your system crashes, or if you lose your files, McAfee’s Safe & Sound utility provides you the ability to recover files using the Safe & Sound Windows or DOS recover utility.

How Safe & Sound Creates Automatic Backups

When you select to have Safe & Sound automatically create a backup set for you, it creates the first backup set while you are stepping through the Safe & Sound Wizard. Thereafter, while the Enable Automatic Backup option is selected, it continues to update your backup set at the time delay you’ve specified. If you chose to make Mirror backups, Safe & Sound updates your backup set at the same time that you re-save the original source files.

Defining Your Backup Strategy

After you decide which backup type you want to use (either a protected volume file or a directory backup set), the most important questions you must answer when defining your own backup strategy are:

Where Will You Store the Backup Set?

In today’s computer marketplace, you may discover that it is as cost effective to acquire a separate backup hard drive where you can keep a current mirror backup copy of one or more other drives that you use on your PC.

36 McAfee VirusScan

In addition, you may want the backup copy to be stored at a remote location, for increased protection. As long as Safe & Sound can access a logical drive mapped on your PC, it can store the backup set there. That is, the backup set can be stored on a shared network drive.

What Files Are Important (Which Files Must Be Backed Up)?

Safe & Sound automatically selects files that are typically important to include in a backup set. However, you can select other files or types of files to include in your backup set.

How Often Should You Or Safe & Sound Make These Backups?

The more recent your backup set, the happier you’ll be if your PC does encounter a problem that compromises the data on your primary drives. However, you may want to keep the default Write-beh ind Delay of 20 minutes to give you time to recover a previous version of a file if you ever need to

Safe & Sound Configuration

The Safe & Sound setup wizards guides you through your initial setup. Please access on-line help for information about Safe & Sound configuration.

Using McAfee VirusScan

Use the steps below to access Sa fe & Sound o n-line help.

1. Start Safe & Sound from the Windows Start menu. The Safe & Sound interface displays.

2. Click Help. The Safe & Sound Help window displays.

3. Click Help Topics. The Contents tabs of the Help Topics: Safe & Sound window displays.

4. Select the desired Help topic.

5. Double-click the help topic or click display to view the contents of the Help topic.

Getting Started 37

Using McAfee VirusScan

Emergency Disk Creation

As it installs itself, VirusScan software will examine your computer’s memory and your hard disk’s boot sectors to verify that it can safely copy its files to your hard disk without risking their infection. During that installation, Setup offers to create an Emergency Disk you can use to start your system in a virus-free environment. Should the VirusScan software itself become infected, or if you want to be sure your computer is clean before you install any other software, create and use an Emergency Disk to start your computer.

VirusScan software comes with an Emergency Disk wizard that makes disk creation simple and fast.

The Emergency Disk you create includes BOOTSCAN.EXE, a specialized, small-footprint command-line scanner that can scan your hard disk boot sectors and Master Boot Record (MBR). BOOTSCAN.EXE works with specialized set of virus definition (.DAT) files that focus on ferreting out boot-sector viruses. If you have already installed VirusScan software with default Setup o ptions, you’ll find these .DAT files in this location on your hard disk:

C:\Program Files\Common Files\McAfee VirusScan\VirusScan Engine\4.0.xx

The special .DAT files have these names:

– EMCLEAN.DAT

–EMNAMES.DAT

–EMSCAN.DAT

McAfee periodically updates these .DAT files to detect new boot-sector viruses. You can download updated Emergency .DAT files from this location:

http://www.mcafeeb2b.com/naicommon/avert/avert-research-center/tools.asp

¥ NOTE: McAfee recommends that you download new Emergency .DAT

files directly to a newly formatted floppy disk in order to reduce the risk of infection.

38 McAfee VirusScan

4Removing Infections

Overview

Although far from harmless, most viruses that infect your machine will not destroy data, play pranks, or render your computer unusable. Even the comparatively rare viruses that do carry a destructive payload usually produce their nasty effects in response to a trigger event. In most cases, unless you actually see evidence of a payload that has activated, you will have time to deal with the infection properly. The very presence of these small snippets of unwanted computer code can, however, interfere with your computer’s normal operation, consume system resources and have other undesirable effects, so you should take them seriously and be sure to remove them when you encounter them.

A second idea to keep in mind is that odd computer behavior, unexplained system crashes, or other unpredictable events might have causes other than virus infections. If you believe you have a virus on your computer because of occurrences such as these, scanning for viruses might not produce the results you expect, but it will help eliminate one potential cause of your computer problems.

The safest course of action you can take is to install VirusScan software, then scan your system immediately and thoroughly.

When you install VirusScan software, Setup starts the VirusScan application to examine your computer’s memory and your hard disk boot sectors in order to verify that it can safely copy its files to your hard disk without risking their infection. If the application does not detect any infections, continue with the installation, then scan your system thoroughly as soon as you restart your computer. File-infector viruses that don’t load into your computer’s memory or hide in your hard disk boot blocks might still be lurking somewhere on your system.

Removing Infections Detected Upon In stallati on

ë TIP: You may use the steps below when an infection has been detected

and you wish to perform a thorough cleaning of your computer.

If the VirusScan application detects a virus during Setup, you’ll need to remove it from your system before you install the program. To learn how to do so, refer to the steps below.

Getting Started 39

Removing Infections

æ IMPORTANT: To ensure maximum security, you should also follow

these same steps if a VirusScan component detects a virus in your computer’s memory at some point after installation.

If VirusScan software found an i nfection duri ng instal lation, fo llow these steps carefully:

1. Quit Setup immediately, then shut down your computer.

Be sure to turn the power to your system off completely. Do not press CTRL+ALT+DEL viruses can remain intact during this type of “warm” reboot.

2. If you created a VirusScan Emergency Disk during installation, then “write-protect” the disk and insert it into your floppy drive. (See TIP.)

ë TIP: The VirusScan Installation CD provides you with a Bootable CD

version of the emergency disk. If you did not create an emergency disk and your computer is configured to start with a bootable CD, then insert the VirusScan Installation CD in your CD-ROM drive before proceeding to the next step.

or reset your computer to restart your system—some

3. Wait at least 15 seconds, then start your computer again.

4. Type

5. Read the notice shown on your screen, then press any key on your

40 McAfee VirusScan

As your computer restarts, the Emergency Disk runs a batch file that leads you through an emergency scan operation. The batch file first asks you whether you cycled the power on your computer.

yyyy to continue, then skip to Step 7 on page 41. If you did not, type n,

then turn your computer completely off and begin again.

The batch file next tells you that it will start a scan operation.

keyboard to continue.

The Emergency Disk will load the files it needs into memory. If you have extended memory on your computer, it will load its database files into that memory for faster execution.

BOOTSCAN.EXE, the command-line scanner that comes with the Emergency Disk, will make four scanning passes to examine your hard disk boot sectors, your Master Boot Record (MBR), your system directories, program files, and other likely points of infection on all of your local computer's hard disks.

Removing Infections

¥ NOTE: McAfee strongly recommends that you do not interrupt the

BOOTSCAN.EXE scanner as it runs its scan operation. The Emergency Disk will not detect macro viruses, script viruses, or Trojan horse programs, but it will detect common file-infecting and boot-sector viruses.

If BOOTSCAN.EXE finds a virus, it will try to clean the infected file. If it fails, it will deny access to the file and continue the scan operation. After it finishes all of its scanning passes, it shows a summary report the actions it took for each hard disk on the screen. The report tells you:

• How many files the scanner examined.

• How many files of that number are clean, or uninfected.

• How many files contain potential infections.

• How many files of that number the scanner cleaned.

• How many boot sector and MBR files the scanner examined.

• How many boot sector and MBR files contain potential infections.

If the scanner detects a virus, it beeps and reports the name and location of the virus on the screen.

6. When the scanner finishes examining your hard disk, remove the Emergency Disk from your floppy drive, then shut your computer off again.

7. When BOOTSCAN.EXE finishes examining your system, you can either:

• Return to working with your computer. If BOOTSCAN.EXE did not find a virus, or if it cleaned any infected files it did find, remove the Emergency Disk from your floppy drive, then restart your computer normally. If you had planned to install VirusScan software on your computer but stopped when Setup found an infection, you can now continue with your installation.

• Try to clean or delete infected files yourself. If BOOTSCAN.EXE found a virus that it could not remove, it will identify the infected files an d tell you that it could not clean them, or that it does not have a current remover for the infecting virus.

As your next step, locate and delete the infected file or files. You will need to restore any files that you delete from backup files. Be sure to check your backup files for infections also. Be sure also to use the VirusScan application at your earliest opportunity to scan your system completely in order to ensure that your system is virus-free.

Getting Started 41

Removing Infections

Removing an Infection In Win dows

When McAfee VirusScan detects a virus, an alert message displays on screen to notify you. The best course of action is to attempt to clean the infected file. Cleaning removes the virus from your personal computer or wireless device and repairs the infected file.

If Clean does not remove the virus from your computer or wireless device, there are other methods of virus cleansing available to you.

1. Delete the file. When you click delete, both the virus and the infected file are removed from your computer.

ë TIP: Choose delete only if a backup copy of the file is available to you.

2. Select Quarantine to isolate the infected file. Once you have quarantined the infected file, use Instant Updater to download the most current anti-virus signature files. Then you can make another attempt to clean the infected file.

You can also attempt to obtain an antidote from A.V.E.R.T.

3. If all else fails, select Stop to stop scanning and use the emergency disk method of repair described in the previous section – “Removing

Infections Detected Upon Installation”.

42 McAfee VirusScan

5McAfee Firewall

About McAfee Fir ewall

Protect yourself while online with the rock solid security of McAfee Firewall. Easy-to-use, yet highly configurable, McAfee Firewall secures your PCs connection to the Internet whether you connect via DSL, cable modem or dial-up. With its new advanced Intrusion Detection System, color coded security alerts, alert messages, detailed logging and application scan for Internet capable applications with learning mode, McAfee Firewall gives you all the power you need to control the communications into and out of your PC ensuring that your online experience will be as safe as it is enjoyable.

McAfee Firewall:

• Stops fileshare and printshare access attempts.

• Shows who is connecting (i.e.: if you allow sharing).

• Stops floods and other attack packets from being received by the Operating System.

• Blocks untrusted applications from communicating over the network.

• Detects hidden programs ("trojans") that can give remote access to your PC or reveal private information (e.g. online banking information).

• Provides detailed information about which sites you have contacted and the type of connection that was made.

• Blocks all traffic while you are away, and your PC is connected 24 hours a day.

What Comes With McAfee Firewall Software?

• Intrusion Detection System - Powerful, yet simple to configure, McAfee Firewall's Intrusion Detection System (IDS) detects common attack types and other suspicious activity. Users are able to easily block all further communication from offenders.

• System Application Scan & Learning Mode - McAfee Firewall can be set to scan a PC for programs that can communicate over the Internet and present a list of such programs to the user. Selecting the programs you want to allow, McAfee Firewall's Learning Mode will build a custom rule for the application the first time you use it when you go online.

Getting Started 43

McAfee Firewall

ë TIP: McAfee Firewall maintains a set of predefined set of rules for

popular Internet applications.

• Color Coded Firewall Alerts - Easily determine the severity of potential security threats affecting outbound traffic with color coded onscreen alerts similar to modern traffic light patterns. From Green for go, to Yellow for proceed with caution, and Red for the strongest warning to stop and take note of the most serious types of threats, you'll quickly know the level of caution appropriate for each situation.

• Customizable Audible Alerts - Don't miss a security or privacy concern just because you happen not to be looking at your computer screen. You'll now be able to hear different sounds that indicate various levels of s everity according to the types of threats your machine is exposed to. Users can also import their own sounds to be used as audible alerts.

• ICS/NAT & Home Networking Compatibility - McAfee Internet Security can be used to protect a single machine or number of machines connected together via a small network. Setting up trust relationships within McAfee Firewall for connected machines is a snap.

• Enhanced Graphical Display of Network Activity & Attacks - McAfee Firewall now makes it easier than ever to determine what type of activity is taking place when you go online

• Easy File Sharing Control - McAfee Firewall takes the mystery out of whether or not you have file sharing active on your system and allows you to control file sharing with ease.

• New OS Support - McAfee Internet Security now supports Windows XP and Windows XP themes.

How McAfee Firewall Works

McAfee Firewall is a simple-to-operate security tool for the non-technical users. It dynamically manages your computing security behind the scenes, so that you do not even have to understand networking protocols. It is custom created at the moment it is needed, and only as needed, as you go on to do something else on your computer.

McAfee Firewall filters traffic at the devices that your system uses - network cards and modems. This means that it can reject inbound traffic before that traffic can reach vital functions in your PC and before it can waste valuable system resources.

44 McAfee VirusScan

It monitors applications that are either trusted or not trusted. When trusted applications need to access a network, it manages everything in the computer to allow that application's traffic. When it detects non-trusted applications trying to access a network, it blocks all traffic to and from that application.

Some network communications are needed to maintain network-based services. These are managed through user defined rules under the SYSTEM button feature of McAfee Firewall. The default SYSTEM settings feature provides protection from hostile threats.

In addition, during the installation process, it will prompt you with some basic questions to set up McAfee Firewall to do specific tasks, according to your needs (e.g. allow sharing of files or not).

About McAfee Firewall Documentation

This Getting Started manual provides the basic information you need to install, setup and use McAfee Firewall. More detailed information on step-by-step instructions on how to perform a task within McAfee Firewall is provided via the Help files which you can access while working within the different windows and dialog boxes. You can also review the Readme.txt file which contain other general information (e.g., frequently asked questions) about the product.

McAfee Firewall

McAfee Firewall On-line Help

To launch Mc Afee Fir ewa ll hel p:

In the McAfee Firewall main screen, click Help menu; then select Contents. The Help contents is displayed.

You can also search for a help topic via the Index or Find tabs.

• Index tab

1. In the text box, type the first few letters of the word or phrase you are looking for.

2. Locate what you are looking for; then double-click the topic or click the Display button.

• Find tab

Clicking the Find tab enables you to launch a full text search. When you search for topics via the Find tab for the first time, a Find Setup Wizard is displayed. Follow the instructions on screen to setup the full text search option. After setup is complete:

Getting Started 45

McAfee Firewall

1. In the text box, type the first few letters of the word or phrase you are looking for. You can also select matching words to narrow your search.

2. Once you have located what you are looking for in the display topic box, click the topic.

Frequently Asked Questions

The following are frequently asked questions that you can briefly review:

How will McAfee Firewall help me?

McAfee Firewall protects your PC at the network level. It acts as a gatekeeper, checking every data packet going in or out of your PC. It allows only what you tell it to allow.

McAfee Firewall has been designed to be easy to use, while providing you with excellent protection. Once you install and run it, it is configured to block known attacks and to ask you before allowing applications to communicate.

How is my PC at risk on the Internet?

When you connect to the Internet, you share a network with millions of people from around the world. While that is a truly wonderful and amazing accomplishment, it brings with it all the problems of being accessible to complete strangers.

When on the Internet, you need to lock down your PC. When you talk to strangers on IRC (Internet Relay Chat), be cautious of files they send you. This is one way the BO (Back Orifice) program spreads, giving people remote control of your PC. Check files you get for viruses.

When on the Internet, others can try to access your fileshares. You should check that they are not available, or else people can read and delete what is on your system.

The data you send can be seen by more people than just the intended receiver. Practically any system that is connected to any part of the network path used to relay your data packets can see what is sent. Also, it is hard to know with absolute certainty that you are talking to whom you think you are talking to.

What other protection do I n eed?

McAfee Firewall provides network level protection. Other important types of protection are:

• Anti-virus programs, such as “McAfee VirusScan” and “McAfee VirusScan

• Logon screens and screen saver passwords to prevent unauthorized access.

46 McAfee VirusScan

Professional”, for application-level protection.

McAfee Firewall

• File encryption or encrypting file systems, such as “McAfee PGP”, to keep information secret.

• Boot-time passwords to stop someone else from starting your PC.

• Physical access to the computer, e.g. stealing the hard drive.

A separate but also important issue is controlling access to information, misinformation and " filth" that is widely available on the Internet. You can use a number of content-filtering programs or services, such as “McAfee Internet Security”, that can filter the contents of data packets or restrict access to certain sites.

Are there any data packets that McAfee Firewall cannot stop ?

Inbound Data: No.

As long as McAfee Firewall supports a network device and is running, it is intercepting all incoming packets and will allow or block according to the way you have it configured. If you choose to block everything, it will.

Outbound Data: Yes and no.

McAfee Firewall intercepts outbound data packets as they are passed to the network device driver. All popular applications communicate this way. A malicious program could communicate by other means, however.

What network devices does McAfee Firewall support?

McAfee Firewall supports Ethernet and Ethernet-like devices on Microsoft Windows 95, Windows 98, Windows NT 4.0 (SP4, SP5, and SP6), Windows Me, Windo ws 2000 and Windows XP. This includes dial-up co nnections, most cable and ISDN modems and most Ethernet cards. It does not support Token Ring, FDDI, ATM, Frame Relay and other networks.

What protocols can McAfee Firewall filter?

McAfee Firewall can filter TCP/IP, UDP/IP, ICMP/IP and ARP. It intercepts all protocols, but others, such as IPX, must be either allowed or blocked - no filtering is done. The Internet uses the IP protocols. No others are sent. Also, IP networks are the most common.

How can I still be harassed, even with McAf ee Firewall?

Many people use McAfee Firewall block the "nukes" that cause their IRC connections to be broken (shown in Figure 1-1). While McAfee Firewall blocks the nukes, there are other ways that attackers can still cause the connections to be broken:

Getting Started 47

McAfee Firewall

• Server-side nuking. This is when the "nukes" are sen t to the IRC server, not to your computer, telling the server that you can no longer be reached. To prevent this, the IRC server needs a firewall.

• Flood blocking a TCP connection. If a flood of packets is sent to you from a higher speed connection, McAfee Firewall can stop the packets, but the flood takes up all your bandwidth. Your system does not get a chance to send anything. Dial-up users are particularly vulnerable since they have the lowest speed connections.

ë TIP: To read about other frequently asked questions, refer to the

Readme.txt file found within your software installation CD.

Intrusion Detection System – (IDS)

Introduction

Firewall’s Intrusion Detection System (IDS) is designed to help the same users that the Personal Firewall feature protects: small offices without a corporate firewall, corporate users working outside the corporate firewall, or home users. It defends isolated machines against many different kinds of attacks (i.e.: port scans and flood attacks).

All unprotected computers can be victimized. For example, attackers can use a TCP port scan to find out what services you are running on your machine. Once this is accomplished, they can try to connect to those services and attack your machine. If the attacker discovers that you are running a TELNET, ftp, or Web server, the attacker can try each of your computer’s ports sequentially, from 1 to 65535, until an open port is found that they can connect to.

Unlike other intrusion detection tools, McAfee Firewall’s powerful IDS feature is simple to configure and activate. Instead of requiring users to learn and understand a complex set of attacks to build their own defense lines against intrusions, Firewall’s development team created a tool that, when activated with the cli ck of a button, detects all common attack typ es as well as suspicious activity.

McAfee Firewall’s IDS feature looks for specific traffic patterns used by attackers. Firewall checks each packet that your machine receives to detect suspicious or known attack traffic. For example, if McAfee Firewall sees ICMP packets, it analyzes those packets for suspicious traffic patterns by comparing the ICMP traffic against known attack patterns. When McAfee Firewall matches packets with a known attack pattern, the software generates an event to warn you of a possible security breach.

48 McAfee VirusScan

When intrusion detection is on, all traffic is checked by the intrusion detection system. When intrusion detection is active and Firewall detects an attack, you can block further communication from the suspected machine’s IP address indefinitely or for a specific time period. When an attack is detected, McAfee Firewall can alert you with a Windows system tray notification.

¥ NOTE: Because Firewall is analyzing packets and looking for patterns of

packets that identify specific types of attacks, this feature may result in a very slight impact on your machine’s performance.

How to Configure the Intrusion Detection System

Use the steps below to configure McAfe e Firewall’s int rusion detectio n feature:

1. Start McAfee firewall from the Windows Start menu. The Firewall main window displays.

ë TIP: Another way to start McAfee Firewall is to right-click the McAfee

Guardian icon displayed in the Windows system tray, point to McAfee Firewall and select Run Firewall.

McAfee Firewall

2. On the McAfee Firewall main window, select Pick a task.

3. Select Advanced Firewall settings.

4. To activate McAfee Firewall’s intrusion detection system, check the Activate Intrusion Detection check box. Conversely, to deactivate the Intrusion detection system, clear the check mark from the Activate Intrusion Detection check box.

5. To block traffic from an attacker’s IP address, check Automatically block attackers.

6. You can control how long McAfee Firewall blocks traffic from the attacker’s IP address:

• To block traffic until you remove the host, click until removed.

• To block traffic from the attacker’s IP address for a specific number of minutes, click For, and enter the number of minutes.

7. To play a sound when attacked, click Play sound when attacked and select a sound from the menu.

Getting Started 49

McAfee Firewall

8. To display a Windows system tray notification, as an attack occurs, click Show tray notification when attached.

9. Click OK.

McAfee Firewall Configurations

The configuration of McAfee Firewall is divided into two parts—application and system. Upon installation, a base set of rules for system services such as ICMP, DHCP and ARP is installed (these are considered default settings). The applications part is personalized. Whenever you run a new program that attempts to communicate over the Internet, McAfee Firewall will prompt and ask you whether you want to trust the program or not.

For example, using Internet Explorer, enter an Internet address or URL (i.e: http://www.macafee-at-home.com) in the address bar of your browser and press ENTER. Internet Explorer will attempt to connect to that URL over the Internet. The first time you do this, McAfee Firewall prompts if you "trust" Internet Explorer. If you say "Yes", McAfee Firewall notes Internet Explorer is allowed and whenever you use Internet Explorer in the future, McAfee Firewall will allow its traffic.

Behind the scenes, McAfee Firewall creates a rule allowing Internet Explorer to communicate to the specific URL you have indicated and then deletes the rule once all traffic is received or once you exit Internet Explorer. Additionally, when trojans on your system try to communicate out from your PC, McAfee Firewall will also prompt you whether you trust them or not, and the decision to stop trojans is easy and instantaneous.

Applications

Control Applications

McAfee Firewall monitors network traffic to see which applications are communicating. Depending on your settings, it will allow or block an application's attempt to communicate.

To control which applications may communicate, click the Settings menu item and choose Applications.

If you choose to "Trust al l applications" (putting a check mark in the box), then applications will be added to the "Trusted" list automatically and will be allowed to communicate.

50 McAfee VirusScan

If you do not choose to "Trust all applications", as shown in the figure above, then the first time you run an application and it tries to communicate, you will be prompted and asked if you want that application to communicate. You are only prompted once. Known applications are either allowed or blocked, depending on which list they have been put in.

Default Settings for Applications

When installed, the default setting is to prompt the user before allowing an application to communicate. The first time you run an application that uses the network, you will be prompted.

• Yes: Select Yes to allow the application communicate normally.

• No: Select No to block the application. In all likelihood, an error message such as "Network is unavailable" will display.

If you allow an application the first time you are prompted, you may change this and block it at any time: just select the Settings/Applications menu item. There, you can move applications into either the "Trusted" list or the "Blocked " list.

When you exit McAfee Firewall, your settings are saved and will be the same the next time it is run.

McAfee Firewall

Systems

Control System

The operating system performs many types of network communication without reporting directly to the user. McAfee Firewall lets the user allow or block different system functions explicitly. Settings may be different for each network de vice, since a PC may, fo r example, be on an in ternal network as well as having a dial-up connection to the Internet.

To control System settings, click on the Settings menu item and choose System. Then choose the network device you want to configure.

You can either double-click on the network device or click once and choose Properties.

You can then choose to allow or block NetBIOS over TCP, Identification, ICMP, ARP, DHCP, RIP, PPTP and other protocols (IP and non-IP).

¥ NOTE: For more information, refer to online Help.

Getting Started 51

McAfee Firewall

Default Settings for System Activity

NetBIOS over TCP: Blocked

This will block all fileshare activity over TCP as well as UDP broadcasts. Your system will not appear in anyone's "Network Neighborhood" and theirs will not appear in yours. If your system is configured to support NetBIOS over other protocols, such as IPX or NetBEUI, then filesharing may be allowed if "non-IP protocols" are allowed (see "Other Protocols" below).

Identification: Allowed

This service is often required when getting email and is required by most IRC servers.

ICMP: Blocked

This protocol is often abused as a method of breaking people's network connections (especially on IRC).

ARP: Allowed

ARP is a necessary Ethernet protocol and is not known to be a threat.

DHCP: Allowed if your system uses DHCP

The program looks in your system Registry to see if one of your network devices uses DHCP. If so, then DHCP is allowed for all devices. If not, then it is blocked for all devices. If you have more than one network device and one uses DHCP, you should check the DHCP setting for each device and allow only for the device that uses (most often cable or ADSL modems and some internal networks, not for dial-up).

RIP: Blocked

Allow RIP if your administrator or ISP advises you to.

PPTP: Blocked

This should only be altered by the administrator.

Other Protocols: Blocked

If you are on an IPX network, you should allow "non-IP protocols". If you use PPTP, you should allow "other IP protocols". Ask your network administrator before making any change here.

52 McAfee VirusScan

McAfee Firewall

Password Protection

While McAfee Firewall is designed to protect a Windows computer from unwanted network communication, the security it provides can be undermined if the configuration can be altered. This is especially easy on Windows 95 and 98.

This problem is partially addressed by adding password protection to the configuration file. The protection is only partial because only the operating system can provide access control, such as is found in Linux and Unix.

When you use a password to protect your configuration:

• The settings cannot be changed while McAfee Firewall is running unless the correct password has been entered.

• The tampering of the configuration file will be detected the next time McAfee Firewall is run, if (and when) the password is entered

• If the password has not been entered, new networking applications will be blocked automatically.

Getting Started 53

McAfee Firewall

54 McAfee VirusScan

6Update Your McAfee Produc t

Instant Updater

As technologies advance, we continually provide updates to McAfee software products. To ensure the highest level of protection, you should always obtain the latest version of your McAfee product.

Updating your software is simple using McAfee's Instant Updater. It is a seamless process and requires minimal interaction on your part.

æ IMPORTANT: Instant Updater is also the mechanism used to register

your product with McAfee. In order to obtain product updates, you must register your product with McAfee.

Why Do You Need to U pdate?

• New features may be released for your McAfee product

• Product fixes are periodically available

• New product content is updated periodically

• Updates to anti-virus signature files are frequently available

How Does the Updating Pro cess Work?

Instant Updater allows you to obtain and apply updates to your McAfee products while connected to the Internet. If an update exists, you will receive a notification. At that time, you can download and apply the updates to your products.

Instant Updater Features

• Auto-Inquiry. Auto-inquiry enabled allows you to receive notification of product updates while connected to the Internet. The default setting for Instant Update is Auto-Inquiry enabled. If you do not connect to the Internet on a regular basis, you may want to disable Auto-Inquiry and use the manual update feature.

Getting Started 55

Update Your McAfee Product

ë TIP: We do not recommend Auto-Inquiry enabled if you have slow

internet connection.

• Auto-Update. If you do not want to be bo thered with notificatio n messages regarding updates, you can enable Auto-Update. Auto-Update enabled allows you to download and apply product updates without notification messages. Updates are "silently" downloaded and applied to your McAfee product.

• Manual Updating. If you rarely connect to the Internet, you may prefer to use Manual Updating with your McAfee product. You can manually update while connected to the Internet. To do this, select the UPDATE function from within the individual product.

ë TIP: Manual Updating provides you with explicit control of the updating

process.

Configuration

For additional information regarding auto-inquiry and auto-update settings, please refer to on-line help.

56 McAfee VirusScan

AProduct Support

BEFORE YOU CONTACT McAfee Software for technical support, locate yourself near the computer with the McAfee product installed and verify the information listed below:

• Version number of your McAfee software

ë TIP: From the McAfee VirusScan main window select Help > About to

find this information.

• Windows operating system version number

• Amount of memory (RAM)

• Complete description of the problem

• EXACT error message as on screen

• What steps were performed prior to receiving error message?

• Is the error persistent; can you duplicate the problem

• Model name of hard disk (internal / external)

• Extra cards, boards, or hardware

How to Contact McAfee

Customer Service

To order products or obtain product information, contact the McAfee Customer Service department at (972) 308-9960 or write to the following addresses:

United States: International:

Network Associates 13465 Midway Road Dallas, TX 75244 U.S.A.

Network Associates International B.V. Gatwickstraat 25 1043 GL Amsterdam Nederland +(31) 20 586 6100

McAfee Customer Service P.O Box 898 7301 BC Apeldoorn The Netherlands

Getting Started 57

Product Support

¥ NOTE: (972) 308-9960 is telephone call to the United States of America.

www.McAfee-at-Home.com

McAfee is famous for its dedication to customer satisfaction. We have continued this tradition by making our site on the World Wide Web a valuable resource for answers to your questions about McAfee Consumer Products. We encourage you to visit us at http://www.mcafee-at-home.com and make this your first stop for all of your product support needs.

¥ NOTE: For a status on an existing order, you may send an e-mail

message to salesordersupport@nai.com.

Technical Support

For 24-hour, agent assisted support, please visit http://www.mcafeehelp.com. Our support web site offers 24-hour access to solutions to the most common support requests in our easy-to-use 3 step Answer Wizard. Additionally, you may use our advanced options, which include a Keyword Search and our Help Tree, which have been designed with the more knowledgeable user in mind. If a s olution to your proble m cannot be found, you may al so access our 24-hour FREE Chat Now! and Email Express! options. Chat and E-mail will enable you to quickly reach our qualified support engineers, through the internet, at no cost. Phone support information can also be obtained from our self-help web site at: http://www.mcafeehelp.com.

Support Forums and Telephone Cont act

If you do not find what you need, try one of our automated services at the following locations.

World Wide Web E-commerce Support web site Download web site

CompuServe America Online Microsoft Network

58 McAf ee Viru sScan

www.mcafee-at-home.com http://estore.nai.com http://www.mcafeehelp.com http://www.mcafee-at-home.com/download/de

fault.asp GO MCAFEE keyword MCAFEE mcafee

Index

About McAfee Firewall 43

ARP 52

Auto-Inquiry 55

Automatic backups 36

Auto-Update 56

Backup strategies 36

blocking communications

Personal IDS 49

Bootable CD Scans 15

BOOTSCAN.EXE

use of on Emergency Disk 40

Command Prompt 15

Command-line scanners 15

Configurations 50

configure Personal IDS 48

Control applications 50

Control system 51

Default settings for applications 51

descriptions, of VirusScan program

components 13

DHCP 52

distribution of VirusScan

electronically and on CD-ROM disc 17

Download Scan 24

E-Mail Scan 24

E-Mail Scan extension 14

Emergency Disk

creation utility 15

use of BOOTSCAN.EXE on 40

use of to reboot system 40

End User’s License Agreement 20

Flood blocking a TCP connection 48

HAWK 14, 24, 26

Help 23

Help and Support 23

Hostile Activity Watch Kernel 14

How is my PC at risk on the Internet? 46

How McAfee Firewall works 43

, 26

ICMP 52

Icons 21

Inbound Data 47

Inductive User Interface 21

infected files

removing viruses from 39

Installation

Autorun does not display 19

Obtained software via download 19

Instant Updater 15

, 55

Getting Started 59

Index

Internet Filter 24

Internet site filtering 24

IPX network 52

Malicious object detection and blocking 23

Managing Quarantined Files 26

Manual Updating 56

McAfee Firewall filter 47

McAfee on the Web 23

MS-DOS Prompt 15

MSI 20

NetBIOS over TCP 52

New product content 55

OAS 14

ODS 13

On-Access Scanning 14

On-access scanning 23

On-Demand Scanning 13

online help 23

Outbound Data 47

Palm Anti-Virus components 30

Palm OS 30

On the Device Component 30

On the PC Component Options 31

Removing Components 33

Password Protection 53

Personal IDS

blocking traffic 49

configure 48

Pick a task 22

PPTP 52

Product fixes 55

Product registration 15

protocols 47

Quarantine 14

Quick Jump 22

reasons to run VShield 23

rebooting, with the Emergency Disk 40

responses, default, when infected by

viruses 39

restarting

with the Emergency Disk 40

RIP 52

Safe & Sound 14

Schedule 22

Security Settings 24

McAfee Virus Scan User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

1Welcome to McAfee VirusScan

How Does VirusScan Software Work?

What Comes With VirusSca n Softwar e?

2 Installing VirusScan Software

Before You Begin

System Requirements

Other Recommendations

Installation Options

Installation Steps

3Using McAfee VirusScan

The VirusScan Induct ive U ser In terface

Using VShield Scanner

VShield Scanning Properties

How to Start and Stop VShield Scanner

What Should You Do When a Virus Is Detected?

Using Hostile Activity Watch Kernel (HAWK)

Using Quarantine

Managing Quarantined Files

Using VirusScan With a Wireless Device

Data Synchronization

VirusScan for Palm OS ®

VirusScan for Windows ® CE ® and Pocket PC

VirusScan for Symbian’s EPOC

Using Safe & Sound

How Safe & Sound Creates Automatic Backups

Defining Your Backup Strategy

Safe & Sound Configuration

Emergency Disk Creation

4Removing Infections

Overview

Removing Infections Detected Upon In stallati on

Removing an Infection In Win dows

5McAfee Firewall

About McAfee Fir ewall

What Comes With McAfee Firewall Software?

How McAfee Firewall Works

About McAfee Firewall Documentation

McAfee Firewall On-line Help

Frequently Asked Questions

Intrusion Detection System – (IDS)

How to Configure the Intrusion Detection System

McAfee Firewall Configurations

Applications

Systems

6Update Your McAfee Produc t

Instant Updater

Why Do You Need to U pdate?

How Does the Updating Pro cess Work?

Instant Updater Features

Configuration

AProduct Support

How to Contact McAfee

Customer Service

www.McAfee-at-Home.com

Technical Support

Index