Mcafee VIRUSSCAN 5.1 User Manual
McAfee VirusScan
User’s Guide
Version 5.1
COPYRIGHT
Copyright © 2000 Network Associates, Inc. and its Affiliated Companies. All Rights Reserved. No part
of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permissio n of Network A ssociates,
Inc.
TRADEMARK ATTRIBUTI ONS
* ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX,
Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr
Solomon’s, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk,
Hunter, ISDN Tel/Scope, LM 1, LA NGuru, Leadin g Help Desk Technolo gy, Magic Solu tions, Magi cSpy,
MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More
Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetSca n, Net Shield, NetShiel d,
NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts,
PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty
Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router
PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer,
SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM,
TeleSniffer, TIS, TMach, TMeg, Tota l Network Security, Total Network Vis ibility, Total Service Desk,
Total Virus Defense, T-POD, Trusted Ma ch, Trusted Ma il, Uninstall er, Virex, Vi rex-PC, Virus Fo rum,
ViruScan, VirusScan, VShi eld, WebScan , Web Shield, W ebS niffer , WebSt alker W ebW all , and ZAC 2000
are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All
other registered and unregistered trademarks in this document are the sole property of their respective
owners.
LICENSE AGREEMENT
NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT
("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") BY
NETWORK ASSOCIATES, INC. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR
INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY)
CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO
NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE BUTTON THAT
INDICATES THAT YOU DO NOT ACCEPT THE TERMS OF THIS AGREEMENT AND DO NOT
INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE
PLACE OF PURCHASE FOR A FULL REFUND.)
1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and
conditions of this Agreement, McAfee hereby grants to you a non-exclusive, non-transferable right
to use one copy of the specified version of the Software and the accompanying documentation (the
"Documentation"). You may install one copy of the Software on one computer, workstation,
personal digital assistant, pager, "smart phone" or other electronic device for which the Software
was designed (each, a "Client Device"). If the Software is licensed as a suite or bundle with more
than one specified Software product, this license applies to all such specified Software products,
subject to any restrictions or usage terms specified on the applicable price list or product packaging
that apply to any of such Software products individually.
Issued July 2000/McAfee VirusScan v5.1
Table of Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii
What happened? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii
Why worry? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii
Where do viruses come from? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii
Virus prehistory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii
Viruses and the PC revolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
On the frontier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xii
Where next? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
How to protect yourself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xv
Chapter 1. About VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Introducing VirusScan anti-virus software . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
How does VirusScan software work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
What comes with VirusScan software? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
What’s new in this release? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
Chapter 2. Installing VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . .31
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Other recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Preparing to install VirusScan software . . . . . . . . . . . . . . . . . . . . . . . . .32
Installation options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Installation steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Using the Emergency Disk Creation utility . . . . . . . . . . . . . . . . . . . . . . .43
Determining when you must restart your computer . . . . . . . . . . . . . . . .48
Testing your installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
Modifying or removing your VirusScan installation . . . . . . . . . . . . . . . .50
Chapter 3. Removing Infections
From Your System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
If you suspect you have a virus... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Deciding when to scan for viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
User’s Guide iii
Table of Contents
Recognizing when you don’t have a virus . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
Understanding false detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
Responding to viruses or malicious software . . . . . . . . . . . . . . . . . . . . . . . . .59
Submitting a virus sample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
Using the SendVirus utility to submit a file sample . . . . . . . . . . . . . . . .71
Capturing boot sector, file-infecting, and macro viruses . . . . . . . . . . . .75
Chapter 4. Using the VShield Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . .81
What does the VShield scanner do? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .81
Why use the VShield scanner? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
Browser and e-mail client support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
Enabling or starting the VShield scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
Using the VShield configuration wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Setting VShield scanner properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93
Using the VShield shortcut menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .149
Disabling or stopping the VShield scanner . . . . . . . . . . . . . . . . . . . . . . . . . .149
Tracking VShield software status information . . . . . . . . . . . . . . . . . . . . . . . .155
Chapter 5. Using the
VirusScan application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
What is the VirusScan application? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
Why use the VirusScan application? . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Starting the VirusScan application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
Configuring the VirusScan Classic interface . . . . . . . . . . . . . . . . . . . . . . . . .164
Configuring the VirusScan Advanced interface . . . . . . . . . . . . . . . . . . . . . .169
Chapter 6. Creating and Configuring Scheduled Tasks . . . . . . . . . . . .187
What does VirusScan Console do? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187
Why schedule scan operations? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187
Starting the VirusScan Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Using the Console window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Working with default tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Working with the VShield task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Working with the AutoUpgrade and AutoUpdate tasks . . . . . . . . . . . .195
Creating new tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Enabling tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
iv McAfee VirusScan
Table of Contents
Checking task status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202
Configuring VirusScan application options . . . . . . . . . . . . . . . . . . . . . . . . . .204
Chapter 7. Using Specialized
Scanning Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Scanning Microsoft Exchange and Outlook mail . . . . . . . . . . . . . . . . . . . . .223
When and why you should use the E-Mail Scan extension . . . . . . . . .223
Using the E-Mail Scan extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Configuring the E-Mail Scan extension . . . . . . . . . . . . . . . . . . . . . . . . .225
Scanning cc:Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
Using the ScreenScan utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .239
Chapter 8. Using VirusScan Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . .247
Understanding the VirusScan control panel . . . . . . . . . . . . . . . . . . . . . . . . .247
Opening the VirusScan control panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247
Choosing VirusScan control panel options . . . . . . . . . . . . . . . . . . . . . . . . . .248
Using the Alert Manager Client Configuration utility . . . . . . . . . . . . . . . . . .251
VirusScan software as an Alert Manager client . . . . . . . . . . . . . . . . . . . . . . .252
Configuring the Alert Manager client utility . . . . . . . . . . . . . . . . . . . . . . . . . .252
Chapter 9. About Safe & Sound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .257
Using Safe & Sound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .258
Protected Volume Files (The Ultimate Backup Protection) . . . . . . . . .258
Why You Should Make Regular Backups With Safe & Sound . . . . . . .258
How Safe & Sound Creates Automatic Backups . . . . . . . . . . . . . . . . . .259
Defining Your Backup Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .259
Where Will You Store the Backup Set? . . . . . . . . . . . . . . . . . . . . . . . . .260
What Files are Important to You? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260
How Often Should You or Safe & Sound Make Backups? . . . . . . . . . .261
Chapter 10. About Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
Using Quarantine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
Reporting New Viruses or Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .264
Submitting Virus Information to Anti-Virus Emergency Response Team . .264
Appendix A. Default Vulnerable and Compressed File Extensions . . 267
User’s Guide v
Table of Contents
Adding file name extensions for scanning . . . . . . . . . . . . . . . . . . . . . . . . . . .267
Current list of vulnerable file name extensions . . . . . . . . . . . . . . . . . . . . . . .268
Current list of compressed files scanned . . . . . . . . . . . . . . . . . . . . . . . . . . .272
Appendix B. Product Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
How to Contact McAfee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .275
Customer service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .276
Technical support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .276
Appendix C. Download Information (License ID #: VSF500R) . . . . . . .279
SecureCast™ (For Windows 95/98 Retail Version): . . . . . . . . . . . . . . . . . . .279
Internet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
Appendix D. Using the SecureCast Service to Get New Data Files . . 281
Introducing the SecureCast service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .281
Why should I update my data files? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .282
Which data files does the SecureCast service deliver? . . . . . . . . . . . .282
Installing the BackWeb client and SecureCast service . . . . . . . . . . . . . . . . .283
System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .283
Troubleshooting the Enterprise SecureCast service . . . . . . . . . . . . . .293
Unsubscribing from the SecureCast service . . . . . . . . . . . . . . . . . . . . .293
Support resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .293
SecureCast service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .293
BackWeb client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294
Appendix E. Understanding iDAT Technology . . . . . . . . . . . . . . . . . . .295
Understanding incremental .DAT files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .295
How does iDAT updating work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .296
What does McAfee VirusScan Software post each week? . . . . . . . . . .297
Best practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .298
Frequently asked questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301
vi McAfee VirusScan
Preface
What happened?
If you’ve ever lost important files stored on your hard disk, watched in dismay
as your computer ground to a halt only to display a prankster’s juvenile
greeting on your monitor, or found yourself having to apologize for abusive
e-mail messages you never sent, you know first-hand how computer viruses
and other harmful programs can disrupt your productivity. If you haven’t yet
suffered from a virus “infection,” count yourself lucky. But with more than
50,000 known viruses in circulation capable of attacking Windows- and
DOS-based computer systems, it really is only a matter of time before you do.
The good news is that of those thousands of circulating viruses, only a small
proportion have the means to do real damage to your data. In fact, the term
“computer virus” identifies a broad array of programs that have only one
feature in common: they “reproduce” themselves automatically by attaching
themselves to host software or disk sectors on your computer, usually without
your knowledge. Most viruses cause relatively trivial problems, ranging from
the merely annoying to the downright insignificant. Often, the primary
consequence of a virus infection is the cost you incur in time and effort to track
down the source of the infection and eradicate all of its traces.
Why worry?
So why worry about virus infections, if most attacks do little harm? The
problem is twofold. First, although relatively few viruses have destructive
effects, that fact says nothing about how widespread the malicious viruses are.
In many cases, viruses with the most debilitating effects are th e hardest to
detect—the virus writer bent on causing harm will take extra steps to avoid
discovery. Second, even “benign” viruses can interfere with the normal
operation of your computer and can cause unpredictable behavior in other
software. Some viruses contain bugs, poorly written code, or other problems
severe enough to cause crashes when they run. Other times, legitimate
software has problems running when a virus has, inten tionally or otherwise,
altered system parameters or other aspects of the computing environment.
Tracking down the source of resulting system freezes or crashes can drain time
and money from more productive activities.
Beyond these problems lies a problem of perception: once infected, your
computer can serve as a source of infection for other computers. If you
regularly exchange data with colleagues or customers, you could unwittingly
pass on a virus that could do more damage to your reputation or your dealings
with others than it does to your computer.
User’s Guide vii
Preface
The threat from viruses and other malicious software is real, and it is growing
worse. Some estimates have placed the total worldwide cost in time and lost
productivity for merely detecting and cleaning virus infections at more than
$10 billion per year, a figure that doesn’t include the costs of data loss and
recovery in the wake of attacks that destroyed data.
Where do viruses come from?
As you or one of your colleagues recovers from a virus attack or hears about
new forms of malicious softw are appearing in commonly used programs,
you’ve probably asked yourself a number of questions about how we as
computer users got to this point. Where do viruses and other malicious
programs come from? Who writes them? Why do those who write them seek
to interrupt workflows, destroy data, or cost people the time and money
necessary to eradicate them? What can stop them?
Why did this happen to me?
It probably does n’t consol e you much to hear that t he programmer w ho wrote
the virus that erased your hard disk’s file allocation table didn’t target you or
your computer specifically. Nor will it cheer you up to learn that the virus
problem will probably always be with us. But knowing a bit about the history
of computer viruses and how they work can help you better protect yourself
against them.
Virus prehistory
Historians have identified a number of programs that incorporated features
now associated with virus software. Canadian researcher and educator Robert
M. Slade traces virus lineage back to special-purpose utilities used to reclaim
unused file space and perform other useful tasks in the earliest networked
computers. Slade reports that computer scientists at a Xerox Corporation
research facility called programs like these “worms,” a term coined after the
scientists noticed “holes” in printouts from computer memory maps that
looked as though worms had eaten them. The term survives to this day to
describe programs that make copies of themselves, but without necessarily
using host software in the process.
A strong academic tradition of computer prank pl aying most likely
contributed to the shift away from utility programs and toward more
malicious uses of the programming techniques found in worm software.
Computer science students, often to test their program ming abilities, would
construct rogue worm programs and unleash them to “fight” against each
other, competing to see whose program could “survive” while shutting down
rivals. Those same students also found uses for worm programs in practical
jokes they played on unsuspecting colleagues.
viii McAfee VirusScan
Some of these students soon discovered that they could use certain features of
the host computer’s operating system to give them unauthorized access to
computer resources. Others took advantage of users who had relatively little
computer knowledge to substitute their own programs—written for their own
purposes—in place of common or innocuous ut ilities. These unsophisticated
users would run what they thought was their usual software only to find their
files erased, to have their account passwords stolen, or to suffer other
unpleasant consequences. Such “Trojan horse” programs or “Trojans,” so
dubbed for their metaphorical resemblance to the ancient Greek gift to the city
of Troy, remain a significant, and growing, threat to computer users today.
Viruses and the PC revolution
What we now think of as true computer viruses first appeared, according to
Robert Slade, soon after the first personal computers reached the mass market
in the early 1980s. Other researchers date the advent of virus programs to 19 86,
with the appearance of the “Brain” virus. Whichever date has the better claim,
the link between the virus threat and the personal computer is not
coincidental.
The new mass distribution of computers meant that viruses could spread to
many more hosts than before, when a comparatively few, closely guarded
mainframe systems dominated the computing world from their bastions in
large corporations and universities. Nor did the individual users who bought
PCs have much use for the sophisticated security measures needed to protect
sensitive data in those environments. As further catalyst, virus writers found
it relatively easy to exploit some PC technologies to serve their own ends.
Preface
Boot-sector viruses
Early PCs, for example, “booted” or loaded their operating systems from
floppy disks. The authors of the Brain virus discovered that they could
substitute their own program for the executable code present on the boot
sector of every floppy disk formatted with Microsoft’s MS-DOS, whether or
not it included system files. Users thereby loaded the virus into memory every
time they started their computers with any formatted disk in their floppy
drives. Once in memory, a virus can copy itself to boot sectors on other floppy
or hard disks. Those who unintentionally loaded Brain from an infected
floppy found themselves reading an ersatz “advertisement” for a computer
consulting company in Pakistan.
With that advertisement, Brain pioneered another characteristic feature of
modern viruses: the payload. The payload is the prank or malicious behavior
that, if triggered, causes effects that range from annoying messages to data
destruction. It’s the virus characteristic that draws the most attention—many
virus authors now write their viruses specifically to deliver their payloads to
as many computers as possible.
User’s Guide ix
Preface
For a time, sophisticated descendants of this first boot-sector virus represe nted
the most serious virus threat to computer users. Variants of boot sector viruses
also infect the Master Boot Record (MBR), which stores the partition
information your computer needs to figure out where to find each of your
hard disk partitions and the boot sector itself.
Realistically, nearly every step in the boot process, from reading the MBR to
loading the operating system, is vulnerable to virus sabotage. Some of the
most tenacious and destructive viruses still include the ability to infect your
computer’s boot sector or MBR among their repertoire of tricks. Among other
advantages, loading at boot time can give a virus a chance to do its work before
your anti-virus software has a chance to run. Many McAfee VirusScan’s
anti-virus products anticipate th is possibility by allowing you to create an
emergency disk you can use to boot your computer and remove infections.
But most boot sector and MBR viruses had a particular weakness: they spread
by means of floppy disks or other removable media, riding concealed in that
first track of disk space. As fewer users exchanged floppy disks and as
software distribution came to rely on other media, such as CD-ROMs and
direct downloading from the Internet, other virus types eclipsed the boot
sector threat. But it’s far from gone—many later-generation viruses routinely
incorporate functions that infect your hard disk boot sector or MBR, even if
they use other methods as their primary means of transmission.
Those same viruses have also be nefitted from sever al generation s of evolution ,
and therefore incorporate much more sophisticat ed infection and concealment
techniques that make it far from simple to detect them, even when they hide
in relatively predictable places.
File infector viruses
At about the same time as the authors of th e B rain virus found vulnerabilities
in the DOS boot sector, other virus writers found out how to use other
software to help replicate their creations. An early example of this type of virus
showed up in computers at Lehigh University in Pennsylvania. The virus
infected part of the DOS command interpreter COMMAND.COM, which it
used to load itself into memory. Once there, it spread to other uninfected
COMMAND.COM files each time a user entered any standard DOS command
that involved disk access. This limited its spread to floppy disks that
contained, usually, a full operating system.
Later viruses quickly overcame this limitati on, sometimes with fairly clever
programming. Virus writers might, for instance, have their virus add its co de
to the beginning of an executable file, so that when users start a program, the
virus code executes immediately, then transfers control back to the legitimate
software, which runs as though nothing unusual has happened. Once it
activates, the virus “hooks” or “traps” requests that legitimate software makes
to the operating system and substitutes its own responses.
x McAfee VirusScan
Preface
Particularly clever viruses can even subvert attempts to clear them from
memory by trapping the CTRL+ALT+DEL keyboard sequence for a warm
reboot, then faking a restart. Sometimes the only outward indication that
anything on your system is amiss—before an y payload detonates, that
is—might be a small change in the file size of infected legitimate software.
Stealth, mutation, encryption, and polymorphic techniques
Unobtrusive as they might be, changes in file size and other scant evidence of
a virus infection usually gives mos t anti-virus software enough of a scent to
locate and remove the offending code. One of the virus writer’s principal
challenges, therefore, is to find ways to hide his or her handiwork. The earliest
disguises were a mixture of innovative programming and obvious giveaways.
The Brain virus, for instance, redirected requests to see a disk’s boot sector
away from the actual location of the infected sector to the new location of the
boot files, which the virus had moved. This “stealth” capability enabled this
and other viruses to hide from conventional search techniques.
Because viruses needed to avoid continuously reinfecting host systems—
doing so would quickly balloon an infected file’s size to easily detectable
proportions or would consume enough system resources to point to an
obvious culprit—their authors also needed to tell them to leave certain files
alone. They addressed this problem by having the virus write a characteristic
byte sequence or, in 32-bit Windows operating systems, create a particular
registry key that would flag infected files with the software equivalent of a “do
not disturb” sign. Although that kept the virus from giving itself away
immediately, it opened the way for anti-virus software to use the “do not
disturb” sequence itself, along with other characteristic patterns that the virus
wrote into files it infected, to spot its “code signature.” Most anti-virus
vendors now compile and regularly update a database of virus “definitions”
that their products use to recognize those code signatures in the files they scan.
In response, virus writers found ways to conceal the code signatures. Some
viruses would “mutate” or transform their code sign atures with each new
infection. Others encrypted themselves and, as a result, their code signatures,
leaving only a couple of bytes to use as a key for decryption. The most
sophisticated new viruses employed stealth, mutation and encryption to
appear in an almost undetectable variety of new forms. Finding these
“polymorphic” viruses required software engineers to develop very elaborate
programming techniques for anti-virus software.
User’s Guide xi
Preface
Macro viruses
By 1995 or so, the virus war had come to something of a standstill. New viruses
appeared continuously, prompted in part by the availability of ready-made
virus “kits” that enabled even some non-programmers to whip up a new virus
in no time. But most existing anti-virus software easily kept pace with updates
that detected and disposed of the new virus variants, which consisted
primarily of minor tweaks to well-known templates.
But 1995 marked the emergence of th e Concept virus, which added a new and
surprising twist to virus history. Before Concept, most virus researchers
thought of data files—the text, spreadsheet, or drawing documents created by
the software you use—as immune to infection. Viruses, after all, are programs
and, as such, needed to run in the same w ay executable software did in o rder
to do their damage. Data files, on the other hand, simply stored information
that you entered when you worked with your software.
That distinction melted away when Microsoft began adding macro
capabilities to Word and Excel, the flagship applications in its Office suite.
Using the stripped-down version of its Visual Basic language included with
the suite, users could create document templates that would automatically
format and add other features to documents created with Word and Excel.
Other vendors quickly followed suit with their products, either using a
variation of the same Microsoft macro language or incorporating one of their
own. Virus writers, in turn, seized the opportunity that this presented to
conceal and spread viruses in documents that you, the user, created yourself.
The exploding popularity of the Internet and of e-mail software that allowed
users to attach files to messages ensured that macro viruses would spread very
quickly and very widely. Within a year, macro viruses became the most potent
virus threat ever.
On the frontier
Even as viruses grew more sophisticated and continued to threaten the
integrity of computer systems we all ha d come to depend upon, still other
dangers began to emerge from an unexpected source: the World Wide Web.
Once a repository of research papers and academic treatises, the web has
transformed itself into perhaps the most versatile and adaptable medium ever
invented for communication and commerce.
Because its potential seems so vast, the web has attracted the attention and the
developmental energies of nearly every computer-related company in the
industry.
xii McAfee VirusScan
Convergences in the technologies that have resulted from this feverish pace of
invention have given website designers tools they can use to collect and
display information in ways never previously available. Websites soon sprang
up that could send and receive e-mail, formulate and execute queries to
databases using advanced search engines, send and receive live audio and
video, and distribute data and multimedia resources to a worldwide audience.
Much of the technology that made these features possible consisted of small,
easily downloaded programs that interact with your browser software and,
sometimes, with other software on your hard disk. This same avenue served
as an entry point into your computer system for other—less benign—
programs to use for their own purposes.
Java, ActiveX, and scripted objects
These programs, whether beneficial or harmful, come in a variety of forms.
Some are special-purpose miniature applications, or “applets,” written in Java,
a programming language first developed by Sun M icrosystems. Others are
developed using ActiveX, a Microsoft technology that programmers can use
for similar purposes.
Both Java and ActiveX make extensive use of prewritten software modules, or
“objects,” that programmers can write themselves or take from existing
sources and fashion into the plug-ins, applets, device drivers and other
software needed to power the web. Java objects are called “classes,” while
ActiveX objects are called “controls.” The principle difference between them
lies in how they run on the host system. Java applets run in a Java “virtual
machine” designed to interpret Java programming and translate it into action
on the host ma chi ne, while ActiveX cont ro ls run as native Window s software
that links and passes data among other Windows programs.
Preface
The overwhelming majority of these objects are useful, even necessary, parts
of any interactive website. But despite the best efforts of Sun and Microsoft
engineers to design security measures into them, determined programmers
can use Java and ActiveX tools to plant harmful objects on websites, where
they can lurk until visitors unwittingly allow them access to vulnerable
computer systems.
Unlike viruses, harmful Java and ActiveX objects usually don’t seek to
replicate themselves. The web provides them with plenty of opportunities to
spread to target computer systems, while their small size and innocuous
nature makes it easy for them to evade detection. In fact, unless you tell your
web browser specifically to block them, Java and ActiveX obj ects download to
your system automatically whenever you visit a website that hosts them.
User’s Guide xiii
Preface
Instead, harmful objects exist to deliver their equivalent of a virus payload.
Programmers have written objects, for example, that can read data from your
hard disk and send it back to the website you visited, that can “hijack” your
e-mail account and send out offensive messages in your name, or that can
watch data that passes between your computer and other computers.
Even more powerful agents have begun to appear in applications that run
directly from websites you visit. JavaScript, a scripting language with a name
similar to the unrelated Java language, first appeared in Netscape Navigator,
with its implementation of version 3.2 of the Hyper Text Markup Language
(HTML) standard. Since its introduction, JavaScript has grown tremendously
in capability and power, as have the host of other scripting technologies that
have followed it—including Microsoft VBScript and Active Server Pages,
Allaire Cold Fusion, and others. These technologies now allow software
designers to create fully realized applications that run o n web servers, interact
with databases and other data sources, and directly manipulate features in the
web browser and e-mail client software running on your computer.
As with Java and ActiveX objects, significant security measures exist to
prevent malicious actions, but virus writers and security hackers have found
ways around these. Because the benefits these innovations bring to the web
generally outweigh the risks, however, most users find themselves calculating
the tradeoffs rather than shunning the technologies.
Where next?
Malicious software has even intruded into areas once thought completely out
of bounds. Users of the mIRC Internet Relay Chat client, for example, have
reported encountering viruses constructed from the mIRC scripting language.
The chat client sends script viruses as plain text, which would ordinarily
preclude them from infecting systems, but older versions of the mIRC client
software would interpret the instructions coded into the script and perform
unwanted actions on the recipient’s computer.
The vendors moved quickly to disable this capability in updated versions of
the software, but the mIRC incident illustrates the general rule that where a
way exists to exploit a software security hole, someone will find it and use it.
Late in 1999, another virus writer demonstrated this rule yet again with a
proof-of-concept virus called VBS/Bubbleboy that ran directly within the
Microsoft Outlook e-mail client by hijacking its built-in VBScript support. This
virus crossed the once-sharp line that divided plain-text e-mail messages from
the infectable attachments they carried. VBS/Bubbleboy didn’t even require
you to open the e-mail message—simply viewing it from the Outlook preview
window could infect your system.
xiv McAfee VirusScan
How to protect yourself
McAfee VirusScan’s anti-virus software already gives you an important
bulwark against infection and damage to your data, but anti-virus software is
only one part of the security measures you should take to protect yourself.
Anti-virus software, moreover, is only as good as its latest update. Because as
many as 200 to 300 viruses and variants appear each month, the virus
definition (.DAT) files that enable McAfee VirusScan’s software to detect and
remove viruses can get quickly outdated. If you have not updated the files that
originally came with your so ftware, you could risk infection from newly
emerging viruses. McAfee VirusScan’s Software has, however, assembled the
world’s largest and most experienced anti-virus research staff in its Anti-Virus
Emergency Response Team (AVERT)*. This means that the files you need to
combat new viruses appear as soon as—and often before—you need them.
Most other security measures are common sense—checking disks you receive
from unknown or questionable sources, either with anti-virus software or
some kind of verification utility, is always a good idea. Malicious
programmers have gone so far as to mimic the programs you trust to guard
your computer, pasting a familiar face on software with a less-than-friendly
purpose. Neither McAfee VirusScan’s nor any other anti-virus software,
however, can detect when someone substitutes an as-yet unidentified Trojan
horse or other malicious program for one of your favorite shareware or
commercial utilities—that is, until aft er the fact.
Preface
Web and Internet access poses its own risks. VirusScan* anti-virus software
gives you the ability to block dangerous web sites so that users can’t
inadvertently download malicious software from known hazards; it also
catches hostile objects that get downloaded anyway. But having a top-notch
firewall in place to protect your network and implementing other network
security measures is a necessity when unscrupulous attackers can penetrate
your network from nearly any point on the globe, whether to steal sensitive
data or implant malicious code. You should also make sure that your network
is not accessible to unauthorized users, and that you have an adequate training
program in place to teach and enforce security standards. To learn about the
origin, behavior and other characteristics of particul ar viruses, consult the
Virus Information Library maintained on the AVERT website.
McAfee VirusScan Software can provide you with other powerful software in
the Active Virus Defense* (AVD) and Total Virus Defense (TVD) suites, the
most comprehensive anti-virus solutions available. Related companies within
the Network Associates family provide other technologies that also help to
protect your network, including the PGP Security CyberCop product line, and
the Sniffer Technologies network monitoring product suite. Contact your
Network Associates representative, or visit the Network Associates website,
to find out how to enlist the power of these security sol utions on your side.
User’s Guide xv
Preface
xvi McAfee VirusScan
1About VirusScan Software
The VirusScan Central is your main entry poin t in using all of the available
components of McAfee VirusScan. This home screen provides relevant
information such as the last time a virus scan was performed on your
computer; what VShield settings are enabled or disabled (for more
information see Using VShield Scanner; and available DAT information and
when it was created.
Through this user-friendly interface, you can access the main functions of
McAfee VirusScan. Click the appropriate buttons as displayed to start
performing a particular task within McAfee VirusScan (e.g., Scan, Schedule,
Quarantine, etc).
You can also click the Update button to start searching and downloading any
available updates to McAfee VirusScan installed on your computer. Make sure
that you are connected to the Internet prior to using this feature. For more
information and step-by-step instructions, click the Help icon on the upper
right-hand corner of the window. To view available options in customizing
how you want McAfee VirusScan components to work on your PC, click the
Options button.
1
Introducing VirusScan anti-virus softw are
Eighty percent of the Fortune 100—and more than 50 million users
worldwide—choose VirusScan anti-virus software to protect their computers
from the staggering range of viruses and other malicious agents that has
emerged in the last decade to invade co rpora te n etworks a nd cause havo c for
business users. They do so because VirusScan software offers the most
comprehensive desktop anti-virus security solution available, with features
that spot viruses, block hostile ActiveX and Java objects, identify dangerous
websites, stop infectious e-mail messages—and even root out “zombie” agents
that assist in large-scale denial-of-service attacks from across the Internet.
They do so also because they recognize how much value McAfee VirusScan
anti-virus research and development brings to their fight to maintain network
integrity and service levels, ensure data security, and reduce ownership costs.
With more than 50,000 viruses and malicious agents now in circulation, the
stakes in this battle have risen considerably. Viruses and worms now have
capabilities that can cost an enterprise real money, not just in terms of lost
productivity and cleanup costs, but in direct bottom-line reductions in
revenue, as more businesses move into e-commerce and online sales, and as
virus attacks proliferate.
User’s Guide 17
About VirusScan Software
VirusScan software first honed its technological edge as one of a handful of
pioneering utilities developed to combat the earliest virus epidemics of the
personal computer age. It has developed considerably in the intervening years
to keep pace with each new subterfuge that virus writers have unleashed. As
one of the first Internet-aware anti-virus applications, it maintains its value
today as an indispensable business utility for the new electronic economy.
Now, with this release, VirusScan software adds a whole new level of
manageability and integration with other McAfee VirusScan’s anti-virus tools.
Architectural improvements mean that each VirusScan component meshes
closely with the others, sharing data and resources for better application
response and fewer demands on your system. Full support for Network
Associates ePolicy Orchestrator management software means that network
administrators can handle the details of component and task configuration,
leaving you free to concentrate on your own work. A new incremental
updating technology, meanwhile, means speedier and less
bandwidth-intensive virus definition and scan engine downloads—now the
protection you need to deal with the blindingly quick distribution rates of
new-generation viruses can arrive faster than ever before.
The new release also adds multiplatform support for Windows 95, Windows
98, Windows ME, Windows NT Workstation v4.0, and Windows 2000
Professional, all in a single package with a sing le installer, but optimized to
take advantage of the benefits each platform offers. Windows NT Workstation
v4.0 and Windows 2000 Professional users, for example, can run VirusScan
software with differing security levels that provide a range of enforcement
options for system administrators. That way, corporate anti-virus policy
implementation can vary from the relatively casual—where an administrator
might lock down a few critical settings, for example—to the very strict, with
predefined settings that users cannot change or disable at all.
At the same time, as the cornerstone product in the McAfee VirusScan’s Active
Virus Defense and Total Virus Defense security suites, VirusScan software
retains the same core features that have made it the utility of choice for the
corporate desktop. These include a virus detection rate second to none,
powerful heuristic capabilities, Trojan horse program detection and removal,
rapid- response updating with weekly virus definition (.DAT) file releases,
daily beta .DAT releases, and EXTRA.DAT file support in crisis or outbreak
situations. Because more than 300 new viruses or malicious software agents
appear each month McAfee VirusScan Software backs its software with a
worldwide reach and 24-hour “follow the sun” coverage from its Anti-Virus
Emergency Response Team (AVERT).
18 McAfee VirusScan
About VirusScan Software
Even with the rise of viruses and worms that use e-mail to spread, that flood
e-mail servers, or that infect groupware products and file servers directly, the
individual desktop remains the single largest source of infections, and is often
the most vulnerable point of entry. VirusScan software acts as a tireless
desktop sentry, guarding your system against more venerable virus threats
and against the latest threats that lurk on websites, often without the site
owner’s knowledge, or spread via e-mail, whether solicited or not.
In this environment, taking precautions to protect yourself from malicious
software is no longer a luxury, but a necessity. Consider the extent to which
you rely on the data on your computer and the time, trouble and money it
would take to replace that data if it became corrupted or unusable because of
a virus infection. Corporate anti-virus cleanup co sts, by some estimates,
topped $16 billion in 1999 alon e. Bala nce the probability of infection—and
your company’s share of the resulting costs—against the time and effort it
takes to put a few common sense security measures in place, and you can
quickly see the utility in protecting yourself.
Even if your own data is relatively unimportant to you, neglecting to guard
against viruses might mean tha t your computer could play unwitting host to
a virus that could spread to computers that your co-workers and colleagues
use. Checking your hard disk periodically with VirusScan software
significantly reduces your system’s vulnerability to infection and keeps you
from losing time, money an d data unnecessarily.
How does VirusScan software work?
VirusScan software combines the anti-virus industry’s most capable scan
engine with top-notch interface enhancements that give you complete access
to that engine’s power. The VirusScan graphical user interface unifies its
specialized program components, but without sacrificing the flexibility you
need to fit the software into your computing environment. The scan engine,
meanwhile, combines the best features of technologies that McAfee and
McAfee VirusScan researchers developed independently for more than a
decade.
Fast, accurate virus de tection
The foundation for that combination is the unique development environmen t
that McAfee VirusScan researchers constructed for the engine. That
environment includes Virtran, a specialized programming language with a
structure and “vocabulary” optimized for the particular requirements that
virus detection and removal impose. Using specific library functions from this
language, for instance, virus researchers can pinpoint those sections within a
User’s Guide 19
About VirusScan Software
file, a boot sector, or a master boot record that viruses tend to infect, either
because they can hide within them, or because they can hijack their execution
routines. This way, the scanner avoids having to examine the entire file for
virus code; it can instead sample the file at well defined poin ts to look for virus
code signatures that indicate an infection.
The development environment brings as much speed to .DAT file construction
as it does to scan engine routines. The environment provides tools researchers
can use to write “generic” definitions that identify entire virus families, and
that can easily detect the tens or hundreds of variants that make up the bulk of
new virus sightings. Continual refinements to this technique have moved
most of the hand-tooled virus definitions that used to reside in .DAT file
updates directly into the scan engine as bundles of generic routines.
Researchers can even employ a Virtran architectural feature to plug in new
engine “verbs” that, when combined with existing engine functions, can add
functionality needed to deal with new infection techniques, new variants, or
other problems that emerging viruses now pose.
This results in blazingly quick enhancements the engine’s detection
capabilities and removes the need for continuous updates tha t target virus
variants.
Encrypted polymorphic virus detection
Along with generic virus variant detection, the scan engine now inco rpora tes
a generic decryption engine, a set of ro utines that en ables VirusScan so ftware
to track viruses that try to conceal themselves by encrypting and mutating
their code signatures. These “polymorphic” viruses are notoriously difficult to
detect, since they change their code signature each time they replicate.
This meant that the simple pattern-matching method that earlier scan engine
incarnations used to find many viruses simply no longer worked, since no
constant sequence of bytes existed to detect. To respond to this threat, McAfee
VirusScan researchers developed the PolyScan Decryption Engine, which
locates and analyzes the algorithm that these types of viruses use to encrypt
and decrypt themselves. It then runs this code through its paces in an
emulated virtual machine in order to understand how the viruses mutate
themselves. Once it does so, the engine can spot the “undisguised” nature of
these viruses, and thereby detect them reliably no matter how they try to hide
themselve s.
20 McAfee VirusScan
About VirusScan Software
“Double heuristics” analysis
As a further engine enhancement, McAfee VirusScan researchers have honed
early heuristic scanning technologies—originally developed to detect the
astonishing flood of macro virus variants that erupted after 1995 —into a set of
precision instruments. Heuristic scanning techniques rely on the engine’s
experience with previous viruses to predict the likelihood that a suspicious file
is an as-yet unidentified or unclassified new virus.
The scan engine now incorporates ViruLogic, a heuristic technique that can
observe a program’s behavior and evaluate how closely it resembles either a
macro virus or a file-infecting virus. ViruLogic looks for virus-like behaviors
in program functions, such as covert file modifications, background calls or
invocations of e-mail clients, and other methods that viruses can use to
replicate themselves. When the number of these types of behaviors—or their
inherent quality—reaches a predetermined threshold of tolerance, th e engine
fingers the program as a likely virus.
The engine also “triangulates” its evaluation by looking for program behavior
that no virus would display—prompting for some types of user input, for
example—in order to eliminate false positive detections. This double-heuristic
combination of “positive” and “negative” techniques results in an
unsurpassed detection rate with few, if any, costly misidentifications.
Wide-spectrum coverage
As malicious agents have evolved to take advantage of the instant
communication and pervasive reach of the Internet, so VirusScan software has
evolved to counter the threats they present. A computer “virus” once meant a
specific type of agent—one designed to replicate on its own and cause a
limited type of havoc on the unlucky recipient’s computer. In recent years,
however, an astounding range of malicious agents has emerged to assault
personal computer users from nearly every conceivable angle. Many of these
agents—some of the fastest-spreading worms, for instance—use updated
versions of vintage techniques to infect systems, but many others make full
use of the new opportunities that web-based scripting and application hosting
present.
Still others open “back doors” into desktop systems or create security holes in
a way that closely resembles a deliberate attempt at network penetration,
rather than the more random mayhem that most viruses tend to leave in their
wakes.
The latest VirusScan software releases, as a consequence, do not simply wait
for viruses to appear on your system, they scan proactively at the source or
work to deflect hostile agents away from your system. The VShield scanner
that comes with VirusScan software has three modules that concentrate on
agents that arrive from the Internet, that spread via e-mail, or that lurk on
User’s Guide 21
About VirusScan Software
Internet sites. It can look for particular Java and ActiveX objects that pose a
threat, or block access to dangerous Internet sites. Meanwhile, an E-Mail Scan
extension to Microsoft Exchange e-mail clients, such as Microsoft Outlook, can
“x-ray” your mailbox on the server, looking for malicious agents before they
arrive on your desktop.
VirusScan software even protects itself against attempts to use its own
functionality against your computer. Some virus writers embed their viruses
inside documents that, in turn, they embed in other files in an attempt to evade
detection. Still others take this technique to an absurd extreme, constructing
highly recursive—and very large—compressed archive files in an attempt to
tie up the scanner as it digs through the file looking for infections. VirusScan
software accurately scans the majority of popular compressed file and archive
file formats, but it also includes logic tha t keeps it from getting trapped in an
endless hunt for a virus chimera.
What comes with VirusSca n softwa re?
VirusScan software consists of several components that combine one or more
related programs, each of which play a part in defending your computer
against viruses and other malicious software. The components are:
• The VirusScan Central. This is your main entry point in using all of the
available components of McAfee VirusScan. This home screen (see Figure
1-2) provides relevant information such as the last time a virus scan was
performed on your computer; what VShield settings are enabled or
disabled and available DAT information and when it was created.
22 McAfee VirusScan
About VirusScan Software
Figure 1-1. McAfee VirusScan Central screen
Through this user-friendly interface, you can access the mai n functions of
McAfee VirusScan. Click the appropriate buttons as displayed to start
performing a particular task within McAfee VirusScan (e.g., Scan, Schedule,
Quarantine, etc).
You can also click the Update button to start searching and downloading any
available updates to McAfee VirusScan installed on your computer. Make sure
that you are connected to the Internet prior to using this feature. For more
information and step-by-step instructions, click the Help icon on the upper
right-hand corner of the window. To view available options in customizing
how you want McAfee VirusScan components to work on your PC, click the
Options button.
• The VirusScan Console. This component allows you to create, configure
and run VirusScan tasks at times you specify. A “task” can include
anything from running a scan operat ion on a set of disks at a specific time
or interval, to running an update o r upgrade operation. You can also en able
or disable the VShield scanner from the Console window.
The Console comes with a preset list of tasks tha t ensures a minimal level
of protection for your system—you can, for example, immediately scan and
clean your C: drive or all disks on your computer.
User’s Guide 23
About VirusScan Software
• The VShield scanner. This component gives you continuous anti-virus
protection from viruses that arrive on floppy disks, from your network, or
from various sources on the Internet. The VShield scanner starts when you
start your computer, and stays in memory until you shut down. A flexible
set of property pages lets you tell the scanner which parts of yo ur system
to examine, what to look for, which parts to leave alone, and how to
respond to any infected files it finds. In addition, the scanner can alert you
when it finds a virus, and can summarize each of its actions.
The VShield scanner comes with three other specialized modules that
guard against hostile Java applets and ActiveX controls, that scan e-mail
messages and attachments that you receive from the Internet via Lotus
cc:Mail, Microsoft Mail or other mail clients that comply with Microsoft’s
Messaging Application Programming Interface (MAPI) standard, and that
block access to dangerous Internet sites. Secure password protection for
your configuration options prevents others from making unauthorized
changes. The same convenient dialog box controls co nf iguration options
for all VShield modules. See “Using the VShield Scanner” on page 85 of the
VirusScan Us er’s Guide for details.
• Safe & Sound. This component allows you to create backup sets in
protected volume files, which is the safest and preferred type of backup. A
protected volume file is a sectioned-off area of the drive, sometimes called a
logical drive.
• Quarantine. This component allows you to move infected files to a
• The E-Mail Scan extension. This component allows you to scan your
24 McAfee VirusScan
NOTE: Sa fe & Sound is only avai labl e for Wi ndow s 95, 98 and
Windows ME. For more information, read Chapter 10 “About
Safe & Sound”.
quarantine folder. This moves infected files from areas where they can be
accessed and enables you to clean or delete them at your convenience.
NOTE: For more information, read Chapter 11 “About
Quarantine”.
Microsoft Exchange or Outlook mailbox, or public folders to which you
have access, directly on the server. This invaluable “x-ray” peek into your
mailbox means that VirusScan software can find potential infections before
they make their way to your desktop, which can stop a Melissa-like virus
in its tracks.
About VirusScan Software
• A cc:Mail scanner. This component includes technology optimized for
scanning Lotus cc:Mail mailboxes that do not use the MAPI standard.
Install and use this component if your workgroup or network uses cc:Mail
v8.x or earlier.
• The Alert Manager Client configuration uti lity. This component lets you
choose a destination for Alert Manager “events” that VirusScan software
generates when it detects a virus or takes other noteworthy actions. You
can also specify a destination directory for older-style Centralized Alerting
messages, or supplement either method with Desktop Management
Interface (DMI) alerts sent via your DMI client software.
• The ScreenScan utility. This optional component scans your computer as
your screen saver runs during idle periods.
• The SendVirus utility. This component gives you an easy and painless
way to submit files that you believe are infected directly to McAfee
VirusScan’s anti-virus researchers. A simple wizard guides you as you
choose files to submit, include contact details and, if you prefer, strip out
any personal or confidential data from document files.
• The Emergency Disk creation utility. This essential utility helps you to
create a floppy disk that you can use to boot your computer into a
virus-free environment, then scan essential system areas to remove any
viruses that could load at startup.
• Command-line scanners. This component consists of a set of full-featured
scanners you can use to run targeted scan operations from the MS-DOS
Prompt or Command Pro mpt windows, or from pr otected MS-DO S mode.
The set includes:
– FINDVIRU.EXE, a scanner for 32-bit environments only. This is the
primary command-line interface. When you run this file, it first
checks its environment to see whether it can run by itself. If your
computer is running in 16-bit or protected mode, it will transfer
control to one of the other scanners.
– SCANPM.EXE, a scanner for 16- and 32-bit environments. This
scanner provides you with a full set of scanning options for 16- and
32-bit protected-mode DOS environments. It also includes support
for extended memory and flexible memory allocations.
FINDVIRU.EXE will transfer control to this scanner when its
capabilities can enable your scan opera tion to run more efficiently.
– SCAN86.EXE, a scanner for 16-bit environments only. This scanner
includes a limited set of capabilities geared to 16-bit environments.
FINDVIRU.EXE will transfer control to this scanner if your system
runs in 16-bit mode, but without special memory configurations.
User’s Guide 25
About VirusScan Software
All of the command-line scanners allow you to initia te targ et ed scan
operations from an MS-DOS Prompt or Command Prompt window, or
from protected MS-DOS mode. Ordinarily, you'll use the VirusScan
application's graphical user interface (GUI) to perform most scanning
operations, but if you have trouble starting Windows or if the VirusScan
GUI components will not run in your environment, yo u can use the
command-line scanners as a backup.
• Documentation. VirusScan software documentation includes:
– BOOTSCAN.EXE, a smaller, specialized scanner for use primarily
with the Emergency Disk utility. This scanner ordinarily runs from
a floppy disk you create to provide you with a virus-free boot
environment.
When you run the Emergency Disk creation wizard, VirusScan
software copies BOOTSCAN.EXE, and a specialized set of .DAT
files to a single floppy disk. BOOTSCAN.EXE will not detect or
clean macro viruses, but it will detect or clean other viruses that can
jeopardize your VirusScan software installation or infect files at
system startup. Once you identify and respond to those viruses, you
can safely run VirusScan software to clean the rest of your system.
–A printed Getting Started Guide, which introduces the product,
provides installation instructions, outlines how to respond if you
suspect your computer has a virus, and provides a brief product
overview. The printed Getting Started Guide comes with the
VirusScan software copies distributed on CD-ROM discs—you can
also download it as vs51_getstart.PDF from Network Associates
website or from other electronic services.
26 McAfee VirusScan
– This user’s guide saved on the VirusScan software CD-ROM or
installed on your hard disk in Adobe Acrobat .PDF format. You ca n
also download it as vscan51_userguide.PDF from Network
Associates website or from other electronic services. The VirusScan
User’s Guide describes in detail how to use VirusScan and includes
other information useful as background or as advanced
configuration options. Acrobat .PDF files are flexible online
documents that contain hyperlinks, outlines and other aids for easy
navigation and information retrieval.
– An administrator’s guide saved on the VirusScan software
CD-ROM or installed on your hard disk in Adobe Acrobat .PDF
format. The VirusScan Administrator’s Guide describes in detail how
to manage and configure VirusScan software from a local or remote
desktop.
About VirusScan Software
– An online help file. This file gives you quick access to a full range of
topics that describe VirusScan software. You can open this file either
by choosing Help Topics from the Help menu in the VirusScan
main window, or by c licking any of the Help buttons dis p layed in
VirusScan dialog boxes.
The help file also includes extensive context-sensitive—or “What's
This”—help. To see these help topics, right-click buttons, lists, icons,
some text boxes, and other elements that you see within dialog
boxes. You can also click the ? symbol at the top-right corner in most
dialog boxes, then click the element you want to see described to
display the relevant topic. The dialog boxes with Help buttons open
the help file to the specific topic that describes the entire dialog box.
– A LICENSE.TXT file. This file outlines the terms of your license to
use VirusScan software. Read it carefully—by in stalling VirusScan
software you agree to its terms.
– A README.TXT file. This file contains last-minute additions or
changes to the documentation, lists any known behavior or other
issues with the product release, and often describes new product
features incorporated into incremental product updates. You’ll find
the README.TXT file at the root level of your VirusScan software
CD-ROM or in the VirusScan software program folder—you can
open and print it from Windows Notepad, or from nearly any
word-processing software.
What’s new in this release?
This VirusScan release introduces a number of innovative new features to the
product’s core functionality, to its range of coverage, and to the details of its
application architecture. The single most significant change between previous
VirusScan versions and this release, however, is the integration of two
separate VirusScan versions optimized to run on separate Windows platforms
into a single product that runs on both. This single product also takes full
advantage of each platform’s strengths.
The next sections discuss other changes that this VirusScan release introduces.
Installation and distribution features
McAfee VirusScan’s anti-virus products, including VirusScan software, now
use the Microsoft Windows Installer (MSI), which comes with all Windows
2000 Professional systems. This Setup utility offers a wealth of custom
installation and configuration features that make VirusScan software rollout
much easier and more intuitive.
User’s Guide 27
About VirusScan Software
Interface enhancements
This release moves the VirusScan interface for all supported platforms solidly
into the territory VirusScan anti-virus software for Windows 95, Windows 98
and Window ME pioneered with its v4.0.1 release. This adds extensive
VShield scanner configuration options for the Windows NT Workstation v4.0
and Windows 2000 Professional platforms, while reducing the complexity of
some previous configuration options. Alert Manager ser ver configuration, for
example, moves entirely over to the NetShield product line—VirusScan
software now acts strictly as a configurable client application.
This release also adds a new VirusScan control panel, which functions as a
central point from which you can enable and disable all VirusScan
components. This control panel also lets you set a ceiling for the number of
items you can scan in or exclude from a single operation, and can set the
VShield scanner and VirusScan control panel to run at startup. Other changes
include:
• New VShield system tray icon states tell you more about which VShield
modules are active. These states are:
– All VShield modules are active
– The System Scan module is active, but one or more of the other
VShield modules is inactive
• New interface settings for task configuration allow you to tell the
• An updated randomization feature for sch eduled ta sks allows you to set a
• System Scan module action options now include a new Prompt Type
28 McAfee VirusScan
– The System Scan module is inactive, but one or more of the other
VShield modules is active
– All VShield modules are inactive
VirusScan application how you want it to appear as your scheduled task
runs and what you want it to do when it finishes. You can also set a
password to protect individual task settings from changes, or to protect an
entire task configuration at once.
time for the task to run, then set a randomization “window.” The
VirusScan Console then picks a random time within the window to
actually start the task.
configuration option for Windows 95 and Windows 98 systems. This
option lets you determine how the Prompt for user action alert appears.
About VirusScan Software
Changes in product functionality
• A new Alert Manager Client configuration utility allows you to choose an
Alert Manager server installed on your network as an alert message
destination, or to select a network share as a destination for Centralized
Alerting messages. You can also supplement either of these alert methods
with Desktop Management Interface alert messages.
• The Alert Manager server supports Intel Pentium III processor serial
numbers to identify individual machines for virus notification. For more
information about Intel processor serial numbers, consult the Intel FAQ at
http://support.intel.com/support/processors/pentiumiii/psqa.htm.
New update options for your VirusScan software
Even with the majority of the virus definitions it requires now incorporated
directly into its engine in generic routines, VirusScan software still requires
regular .DAT file updates to keep pace with the 200 to 300 new viruses that
appear each month. To meet this need, McAfee VirusScan Software has
incorporated updating technology in VirusScan software from its earliest
incarnations. With this release, that technology takes a quantum leap forward
with incremental .DAT file updating.
The Network Associates SecureCast service provides a convenient method
you can use to receive the latest virus definition (.DAT) file updates
automatically, as they become available, wit hout your having to download
them.
NOTE: To update the McAfee VirusScan software installed on your
computer, click the update button in the McAfee VirusScan main
window. Make sure that your PC is connected to the Internet prior to
performing this task.
User’s Guide 29
About VirusScan Software
30 McAfee VirusScan
Loading...