McAfee VPM80E005RAA, VirusScan Professional User Manual

User Guide

Version 9.0

Copyright © 2004 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the McAfee legal department at: 5000 Headquarters Drive, Plano, Texas 75024, or call +1-972-963-8000.

TRADEMARK ATTRIBUTIONS

ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, ANTIVIRUS ANYWARE AND DESIGN, CLEAN-UP, DESIGN (STYLIZED E), DESIGN (STYLIZED N), ENTERCEPT, ENTERPRISE SECURECAST, ENTERPRISE SECURECAST (AND IN KATAKANA), EPOLICY ORCHESTRATOR, FIRST AID, FORCEFIELD, GMT, GROUPSHIELD, GROUPSHIELD (AND IN KATAKANA), GUARD DOG, HOMEGUARD, HUNTER, INTRUSHIELD, INTRUSION PREVENTION THROUGH INNOVATION, M AND DESIGN, MCAFEE, MCAFEE (AND IN KATAKANA), MCAFEE AND DESIGN, MCAFEE.COM, MCAFEE VIRUSSCAN, NA NETWORK ASSOCIATES, NET TOOLS, NET TOOLS (AND IN KATAKANA), NETCRYPTO, NETOCTOPUS, NETSCAN, NETSHIELD, NETWORK ASSOCIATES, NETWORK ASSOCIATES COLLISEUM, NETXRAY, NOTESGUARD, NUTS & BOLTS, OIL CHANGE, PC MEDIC, PCNOTARY, PRIMESUPPORT, RINGFENCE, ROUTER PM, SECURECAST, SECURESELECT, SPAMKILLER, STALKER, THREATSCAN, TIS, TMEG, TOTAL VIRUS DEFENSE, TRUSTED MAIL, UNINSTALLER, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, VIRUSSCAN (AND IN KATAKANA), WEBSCAN, WEBSHIELD, WEBSHIELD (AND IN KATAKANA), WEBSTALKER, WEBWALL, WHAT'S THE STATE OF YOUR IDS?, WHO'S WATCHING YOUR NETWORK, YOUR E-BUSINESS DEFENDER, YOUR NETWORK. OUR BUSINESS. are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE, INC. OR THE PLACE OF PURCHASE FOR A FULL REFUND.

Attributions

This product includes or may include:

 Software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).  Cryptographic software written by Eric A. Young and

software written by Tim J. Hudson.  Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that McAfee, Inc. provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer.

Apache Software Foundation (http://www.apache.org/). A copy of the license agreement for this software can be found at www.apache.org/licenses/LICENSE-

 Outside In

Thai Open Source Software Center Ltd. and Clark Cooper, © 1998, 1999, 2000. Software copyrighted by Expat maintainers. Software copyrighted by The Regents of the University of California, © 1989.  Software copyrighted by Gunnar Ritter.  Software copyrighted by Sun Microsystems®, Inc.© 2003.  Software copyrighted by Gisle Aas. © 1995-2003. Software copyrighted by Michael A. Chase, © 1999-2000. Software copyrighted by Neil Winton, © 1995-1996.

Koster, © 1995.  Software copyrighted by Brad Appleton, © 1996-1999.  Software copyrighted by Michael G. Schwern, © 2001.  Software copyrighted by Graham Barr, © 1998.  Software copyrighted by Larry Wall and Clark Cooper, © 1998-2000.  Software copyrighted by Frodo Looijaard, © 1997.  Software copyrighted by the Python Software Foundation, Copyright © 2001, 2002, 2003. A copy of the license agreement for this software can be found at www.python.org.

Notre Dame.  Software copyrighted by Simone Bordet & Marco Cravero, © 2002.  Software copyrighted by Stephen Purcell, © 2001.  Software developed by the Indiana University Extreme! Lab (http://www.extreme.indiana.edu/).  Software copyrighted by International Business Machines Corporation and others, © 1995-2003. Software developed by the University of California, Berkeley and its contributors. Software developed by Ralf S. Engelschall <rse@engelschall.com> for use in the mod_ssl project (http://www.modssl.org/). Software copyrighted by Kevlin Henney, © 2000-2002. Software copyrighted by Peter Dimov and Multi Media Ltd. © 2001, 2002.  Software copyrighted by David Abrahams, © 2001, 2002. See http://www.boost.org/libs/bind/

copyrighted by Cadenza New Zealand Ltd., © 2000. Software copyrighted by Jens Maurer, © 2000, 2001. Software copyrighted by Jaakko Järvi (jaakko.jarvi@cs.utu.fi), © 1999, 2000. Walker, © 1999-2001. Software copyrighted by Stephen Cleary (shammah@voyager.net), © 2000. Software copyrighted by Housemarque Oy <http://

Issued October 2004 / McAfee® VirusScan® Professional Edition software version 9.0

Quick Start Card

If you are installing your product from a CD or the web site, print this convenient reference page.

Are you installing your product from a CD?

Yes

1. Insert your product CD into your CD-ROM drive. If the installation does not start automatically, click your Windows desktop, then click

2. In the Run dialog box, type D:\SETUP.EXE (where D is the letter of your CD-ROM drive).

3. Click OK.

Start on

Run.

Are you installing your product from a web site?

Yes

1. Go to the McAfee web site, and click

My Account.

2. If prompted, enter your subscribing e-mail address and password, then

click page.

McAfee reserves the right to change Upgrade & Support Plans and policies at any time without notice. McAfee and

VirusScan are registered trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries.

3. Locate your product in the list, and click the download icon.

User Guide iii

Quick Start Card

For more information

To view the User Guides on the product CD, make sure you have Acrobat Reader installed; if not, install it now from the McAfee product CD.

1 Insert your product CD into your CD-ROM

drive.

2 Open Windows Explorer: Click Start on

your Windows desktop, and click

3 Locate the Manuals folder, and double-click

the User Guide .

PDF you want to open.

Search.

Registration benefits

We recommend that you follow the easy steps within your product to transmit your registration directly to us. Registration ensures that you receive timely and knowledgeable technical assistance, plus the following benefits:

 FREE electronic support  Virus definition (.DAT) file updates for one

year after installation when you purchase VirusScan software

Go to http://www.mcafee.com/ for pricing of an additional year of virus signatures.

 60-day warranty that guarantees

replacement of your software CD if it is defective or damaged

 SpamKiller filter updates for one year after

installation when you purchase SpamKiller software

Go to http://www.mcafee.com/ for pricing of an additional year of filter updates.

 McAfee Internet Security Suite updates for

one year after installation when you purchase MIS software

Go to http://www.mcafee.com/ for pricing of an additional year of content updates.

Technical Support

For technical support, please visit

http://www.mcafeehelp.com/.

Our support site offers 24-hour access to the easy-to-use Answer Wizard for solutions to the most common support questions.

Knowledgeable users can also try our advanced options, which include a Keyword Search and our Help Tree. If a solution cannot be found, you can also access our FREE Chat Now! and E-mail Express! options. Chat and e-mail help you to quickly reach our qualified support engineers through the Internet, at no cost. Otherwise, you can get phone support information at

http://www.mcafeehelp.com/.

iv McAfee® VirusScan® Professional Edition software version 9.0

Contents

Quick Start Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

New features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Testing VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Testing ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Testing Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Using McAfee VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Using ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Enabling or disabling ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Configuring ActiveShield options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

If ActiveShield finds a virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Manually scanning your computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Manually scanning for viruses and potentially unwanted programs . . . . . . . . . . . . . . 25

Automatically scanning for viruses and potentially unwanted programs . . . . . . . . . . 28

If Scan finds a virus or potentially unwanted program . . . . . . . . . . . . . . . . . . . . . . . . 30

Managing quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3 Using Professional Edition Software . . . . . . . . . . . . . . . . . . . . . . 33

Using McAfee SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Working with blocked and accepted messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Using McAfee Shredder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Why Windows leaves some file remnants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

What McAfee Shredder erases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Permanently erasing files in Windows Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Emptying the Windows Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Customizing Shredder settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

User Guide v

Contents

vi McAfee® VirusScan® Professional Edition software version 9.0

Getting Started

Welcome to McAfee VirusScan. The McAfee VirusScan Professional Edition contains McAfee VirusScan, plus McAfee SpamKiller and McAfee Shredder. See

Running H/F 4 to learn more about these additional programs.

NOTE

This is only a brief overview. For detailed information, consult the online help for VirusScan, SpamKiller, or Shredder.

McAfee VirusScan is an anti-virus subscription service offering comprehensive, reliable, and up-to-date virus protection. Powered by award-winning McAfee scanning technology, VirusScan protects against viruses, worms, Trojan horses, malicious scripts, and hybrid attacks.

With it, you get the following features:

ActiveShield — Scan files when they are accessed by either you or your computer.

Scan — Search for viruses and potentially unwanted programs in hard drives,

floppy disks, and individual files and folders.

Quarantine — Encrypt and temporarily isolate infected and suspicious files in the

quarantine folder until an appropriate action can be taken.

Hostile activity detection — Monitor your computer for virus-like activity caused by

malicious scripts and worm-like activity.

New features

This version of VirusScan provides the following new features:

 Scanning for potentially unwanted programs

VirusScan can scan for potentially unwanted programs (including spyware, adware, and dialers) during manual scanning, outbound e-mail scanning, instant messaging (IM), via the Windows Explorer shortcut menu, and via the Microsoft Outlook toolbar icon.

 Scanning of large outbound attachments

To address increased use of broad-band Internet connections and service providers increasing e-mail storage and transmission sizes, VirusScan is now optimized to scan large e-mail attachments without interfering with e-mail program timeout values.

User Guide 7

Getting Started

 E-mail scanning

VirusScan automatically scans inbound (POP3) and outbound (SMTP) e-mail and e-mail attachments for most popular e-mail clients, including Microsoft Outlook, Netscape Mail, Eudora, and Pegasus.

 Instant messenger scanning

VirusScan automatically scans inbound file transfers for most popular instant messaging clients, including Yahoo Messenger, AOL Instant Messenger, and MSN Messenger.

 Hostile activity detection

VirusScan provides ScriptStopperTM and WormStopperTM to detect, alert, and block virus-like activity caused by malicious scripts and worm-like activity.

 Automatic file infection cleaning

VirusScan automatically attempts to clean infected or suspicious files as soon as they are detected.

 Scheduled scanning

You can now schedule automatic scanning at specified intervals to thoroughly check your computer for viruses.

 File quarantine

You can use the Quarantine feature to encrypt and temporarily isolate infected and suspicious files in the quarantine folder until an appropriate action can be taken. Once cleaned, a quarantined file can then be restored to its original location.

 Submit files to AVERT

VirusScan now includes the ability to submit suspicious files directly from the Quarantine feature to the McAfee AntiVirus Emergency Response Team

(AVERT

 Virus Map reporting

) for research.

You can now anonymously send virus tracking information for inclusion in our World Virus Map. You can automatically register for this free, secure feature and view the latest worldwide infection rates via the McAfee SecurityCenter.

System requirements

 Microsoft  Personal computer with Pentium 133 MHz or higher processor  32 MB of RAM

Windows 98, Windows Me, Windows 2000, or Windows XP

 35 MB of free hard disk space (for installation)  Microsoft

NOTE

To upgrade to the latest version of Internet Explorer, visit the Microsoft web site at http://www.microsoft.com/.

8McAfee

VirusScan® Professional Edition software version 9.0

Internet Explorer 5.5 or later

Testing VirusScan

Before initial use of VirusScan, it’s a good idea to test your installation. Use the following steps to separately test the ActiveShield and Scan features.

Testing ActiveShield

To test ActiveShield:

1 Go to http://www.eicar.com/ in your web browser.

2 Click the The AntiVirus testfile eicar.com link.

3 Scroll to the bottom of the page. Under Download, you will see four links.

4 Click eicar.com.

If ActiveShield is working properly, it detects the eicar.com file immediately after you click the link. You can try to delete or quarantine infected files to see how ActiveShield handles viruses. See If ActiveShield finds a virus on page 22 for details.

Testing VirusScan

Testing Scan

Before you can test Scan, you must disable ActiveShield to prevent it from detecting the infected files before Scan does, then download the test files.

To download the test files:

1 Disable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

2 Download the EICAR test files from the EICAR web site:

click

Disable.

a Go to http://www.eicar.com/.

b Click the The AntiVirus testfile eicar.com link.

c Scroll to the bottom of the page. Under Download, you will see these links:

eicar.com contains a line of text that VirusScan will detect as a virus.

eicar.com.txt (optional) is the same file, but with a different file name, for

those users who have difficulty downloading the first link. Simply rename the file “eicar.com” after you download it.

eicar_com.zip is a copy of the test virus inside a .ZIP compressed file (a

WinZip

™

file archive).

eicarcom2.zip is a copy of the test virus inside a .ZIP compressed file,

which itself is inside a .

ZIP compressed file.

User Guide 9

Getting Started

Click each link to download its file. For each one, a File Download dialog

box appears.

e Click Save, click the Create New Folder button, then rename the folder VSO

Scan Folder

f Double-click VSO Scan Folder, then click Save again in each Save As dialog

box.

3 When you are finished downloading the files, close Internet Explorer.

4 Enable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

click

Enable.

To test Scan:

1 Right-click the McAfee icon, point to VirusScan, then click Scan for Viruses.

2 Using the directory tree in the left pane of the dialog box, go to the VSO Scan

Folder

a Click the + sign next to the C drive icon.

where you saved the files:

b Click the VSO Scan Folder to highlight it (do not click the + sign next to it).

This tells Scan to check only that folder for viruses. You can also put the files in random locations on your hard drive for a more convincing demonstration of Scan’s abilities.

3 In the Scan Options area of the Scan for Viruses dialog box, ensure that all

options are selected.

4 Click Scan on the lower right of the dialog box.

VirusScan scans the that folder appear in the

VSO Scan Folder. The EICAR test files that you saved to

List of Detected Files. If so, Scan is working properly.

You can try to delete or quarantine infected files to see how Scan handles viruses. See If Scan finds a virus or potentially unwanted program on page 30 for details.

10 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee SecurityCenter

McAfee SecurityCenter is your one-stop security shop, accessible from its icon in your Windows system tray or from your Windows desktop. With it, you can perform these useful tasks:

 Get free security analysis for your computer.

 Launch, manage, and configure all your McAfee subscriptions from one icon.

 See continuously updated virus alerts and the latest product information.

 Get quick links to frequently asked questions and account details at the

McAfee web site.

NOTE

For more information about its features, click Help in the

SecurityCenter dialog box.

While SecurityCenter is running and all of the McAfee features installed on your computer are enabled, a red M icon appears in the Windows system tray. This area is usually in the lower-right corner of the Windows desktop and contains the clock.

Using McAfee SecurityCenter

If one or more of the McAfee applications installed on your computer are disabled, the McAfee icon changes to black .

To open the McAfee SecurityCenter:

1 Right-click the McAfee icon .

2 Click Open SecurityCenter.

To access a VirusScan feature:

1 Right-click the McAfee icon .

2 Point to VirusScan, then click the feature you want to use.

User Guide 11

Getting Started

12 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee VirusScan

Using ActiveShield

When ActiveShield is started (loaded into computer memory) and enabled, it is constantly protecting your computer. ActiveShield scans files when they are accessed by either you or your computer. When ActiveShield detects an infected file, it automatically tries to clean the virus. If ActiveShield cannot clean the virus, you can quarantine or delete the file.

Enabling or disabling ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by the red icon in your Windows system tray) by default as soon as you restart your computer after the installation process.

If ActiveShield is stopped (not loaded) or is disabled (denoted by the black icon), you can manually run it, as well as configure it to start automatically when Windows starts.

Enabling ActiveShield

To enable ActiveShield for this Windows session only:

Right-click the McAfee icon, point to changes to red .

If ActiveShield is still configured to start when Windows starts, a message tells you that you are now protected from viruses. Otherwise, a dialog box appears that lets you configure ActiveShield to start when Windows starts (Figure 2-1 on page 14).

VirusScan, then click Enable. The McAfee icon

User Guide 13

Using McAfee VirusScan

Disabling ActiveShield

To disable ActiveShield for this Windows session only:

1 Right-click the McAfee icon, point to VirusScan, then click Disable.

2 Click Yes to confirm.

The McAfee icon changes to black .

If ActiveShield is still configured to start when Windows starts, your computer will be protected from viruses again when you restart your computer.

Configuring ActiveShield options

You can modify ActiveShield starting and scanning options in the ActiveShield tab of the McAfee icon in your Windows system tray.

VirusScan Options dialog box (Figure 2-1), which is accessible via the

Starting ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by red ) by default as soon as you restart your computer after the installation process.

If ActiveShield is stopped (denoted by black ), you can configure it to start automatically when Windows starts (recommended).

14 McAfee® VirusScan® Professional Edition software version 9.0

Figure 2-1. ActiveShield Options

Using ActiveShield

NOTE

During updates to VirusScan, the Update Wizard might exit ActiveShield temporarily to install new files. When the

Wizard

prompts you to click Finish, ActiveShield starts again.

Update

To start ActiveShield automatically when Windows starts:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

The

VirusScan Options dialog box opens (Figure 2-1 on page 14).

2 Select the Start ActiveShield when Windows starts (recommended) checkbox,

then click

3 Click OK to confirm, then click OK.

Apply to save your changes.

Stopping ActiveShield

WARNING

If you stop ActiveShield, your computer is not protected from viruses. If you must stop ActiveShield, other than for updating VirusScan, ensure that you are not connected to the Internet.

To stop ActiveShield from starting when Windows starts:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

The

VirusScan Options dialog box opens (Figure 2-1 on page 14).

2 Deselect the Start ActiveShield when Windows starts (recommended) checkbox,

then click

3 Click OK to confirm, then click OK.

Apply to save your changes.

Scanning e-mail and attachments

By default, e-mail scanning and automatic cleaning are enabled via the Scan e-mail

and attachments attachments (recommended)

When these two options are enabled, ActiveShield automatically scans and attempts to clean inbound (POP3) and outbound (SMTP) infected e-mail messages and attachments for most popular e-mail clients, including the following:

 Microsoft Outlook Express 4.0 or later  Microsoft Outlook 97 or later

option (Figure 2-1 on page 14) and the Automatically clean infected

option (Figure 2-2 on page 17).

 Netscape Messenger 4.0 or later  Netscape Mail 6.0 or later  Eudora Light 3.0 or later

User Guide 15

Using McAfee VirusScan

 Eudora Pro 4.0 or later  Eudora 5.0 or later  Pegasus 4.0 or later

NOTE

E-mail scanning is not supported for these e-mail clients: Web-based, IMAP, AOL, POP3 SSL, and Lotus Notes. However, ActiveShield scans e-mail attachments when they are opened.

If you disable the

Scan e-mail and attachments option, the

E-mail Scan options (Figure 2-2 on page 17) and the WormStopper options (Figure 2-5 on page 22) are automatically disabled. If you disable outbound e-mail scanning, the WormStopper options are automatically disabled.

If you change your e-mail scanning options, you must restart your e-mail program to complete the changes.

Inbound e-mail

If an inbound e-mail message or attachment is infected, ActiveShield performs the following steps:

 Tries to clean the infected e-mail

 Tries to quarantine or delete an uncleanable e-mail

 Includes an alert file in the inbound e-mail that contains information about the

actions performed to remove the infection

Outbound e-mail

If an outbound e-mail message or attachment is infected, ActiveShield performs the following steps:

 Tries to clean the infected e-mail

 Tries to quarantine or delete an uncleanable e-mail

 Sends an alert file to you in a new e-mail that contains information about the

actions performed to remove the infection

NOTE

For details about outbound e-mail scanning errors, see the online help.

16 McAfee® VirusScan® Professional Edition software version 9.0

Using ActiveShield

By default, ActiveShield scans both inbound and outbound e-mail. However, for enhanced control, you can set ActiveShield to scan only inbound or outbound e-mail.

To disable scanning of inbound or outbound e-mail:

1 Right-click the McAfee icon, point to VirusScan, and then click Options.

2 Click Advanced, then click the E-mail Scan tab (Figure 2-2).

3 Deselect Inbound e-mail messages or Outbound e-mail messages, then click OK.

If your e-mail server is set to only send and receive e-mail while you are at your computer, you can choose to have alerts prompt you to clean infected e-mail by disabling auto-cleaning. Follow the steps below to disable auto-cleaning, then see

Managing infected e-mail on page 23 for details about responding to alerts.

To disable auto-cleaning of infected e-mail:

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the E-mail Scan tab (Figure 2-2). 3 Click Prompt me when an attachment must be cleaned, then click OK.

Figure 2-2. E-mail Scan Options

User Guide 17

Using McAfee VirusScan

Scanning inbound instant message attachments

By default, scanning of instant message attachments is enabled via the Scan

inbound instant message attachments

When this option is enabled, VirusScan automatically scans and attempts to clean inbound infected instant message attachments for most popular instant messaging clients, including the following:

If an inbound instant message attachment is infected, VirusScan performs the following steps:

 Tries to clean the infected message

option (Figure 2-1 on page 14).

 MSN Messenger 6.0 or later  Yahoo Messenger 4.1 or later  AOL Instant Messenger 2.1 or later

NOTE

For your protection, you cannot disable auto-cleaning of instant message attachments.

 Prompts you to quarantine or delete an uncleanable message

Scanning all files

If you set ActiveShield to use the default All files (recommended) option, it scans every file type that your computer uses, as your computer attempts to use it. Use this option to get the most thorough scan possible.

To set ActiveShield to scan all file types:

1 Right-click the McAfee icon, point to VirusScan, and then click Options.

2 Click Advanced, then click the ActiveShield tab (Figure 2-3 on page 19).

3 Click All files (recommended), then click OK.

18 McAfee® VirusScan® Professional Edition software version 9.0

Using ActiveShield

Figure 2-3. Advanced ActiveShield Options

Scanning program files and documents only

If you set ActiveShield to use the Program files and documents only option, it scans program files and documents, but not any other files used by your computer. The latest virus signature file (

DAT file) determines which file types that ActiveShield

will scan.To set ActiveShield to scan program files and documents only:

1 Right-click the McAfee icon, point to VirusScan, and then click Options. 2 Click Advanced, then click the ActiveShield tab (Figure 2-3). 3 Click Program files and documents only, then click OK.

Scanning for new unknown viruses

If you set ActiveShield to use the default Scan for new unknown viruses

(recommended)

to the signatures of known viruses, while also looking for telltale signs of unidentified viruses in the files.

To set ActiveShield to scan for new unknown viruses:

option, it uses advanced heuristic techniques that try to match files

1 Right-click the McAfee icon, point to VirusScan, and then click Options.

2 Click Advanced, then click the ActiveShield tab (Figure 2-3).

3 Click Scan for new unknown viruses (recommended), then click OK.

User Guide 19

Using McAfee VirusScan

Scanning for scripts and worms

VirusScan monitors your computer for suspicious activity that might indicate a threat is present on your computer. While VirusScan cleans viruses, ScriptStopper spreading further.

The ScriptStopper and WormStopper protection mechanisms detect, alert, and block malicious activity. Suspicious activity might include the following actions on your computer:

 A script execution that results in the creation, copying, or deletion of files, or

 An attempt to forward e-mail to a large portion of your address book

 Attempts to forward multiple e-mail messages in rapid succession

If you set ActiveShield to use the default Enable ScriptStopper (recommended) and

Enable WormStopper (recommended) options in the Advanced Options dialog box,

ScriptStopper and WormStopper monitor script execution and e-mail activity for suspicious patterns and alerts you when a specified number of e-mails or recipients has been exceeded within a specified interval.

and WormStopperTM prevent viruses, worms, and Trojans from

the opening of your Windows registry

To set ActiveShield to scan for malicious scripts and worm-like activity:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

2 Click Advanced, then click the ScriptStopper tab.

3 Click Enable ScriptStopper (recommended) (Figure 2-4 on page 21).

20 McAfee® VirusScan® Professional Edition software version 9.0

Using ActiveShield

Figure 2-4. ScriptStopper Options

Click the WormStopper tab, click Enable WormStopper (recommended), then click

OK (Figure 2-5 on page 22).

By default, the following detailed options are enabled:

 Pattern matching to detect suspicious activity

 Alerting when e-mail is sent to 40 or more recipients

 Alerting when 5 or more e-mails are sent within 30 seconds

NOTE

If you modify the number of recipients or seconds for monitoring sent e-mails, it might result in invalid detections. McAfee recommends that you click setting. Otherwise, click

Yes to change the default setting to

No to retain the default

your setting.

This option can be automatically enabled after the first time a potential worm is detected (see Managing potential worms on page 24 for details):

 Automatic blocking of suspicious outbound e-mails

User Guide 21

Using McAfee VirusScan

If ActiveShield finds a virus

If ActiveShield finds a virus, a virus alert similar to Figure 2-6 appears. For most viruses, Trojan horses, and worms, ActiveShield automatically tries to clean the file. You can then choose how to manage infected files, infected e-mail, suspicious scripts, and potential worms, and whether to submit infected files to the McAfee AVERT labs for research.

Figure 2-5. WormStopper Options

22 McAfee® VirusScan® Professional Edition software version 9.0

Figure 2-6. Virus Alert

Using ActiveShield

Managing infected files

1 If ActiveShield can clean the file, you can learn more or ignore the alert:

 Click Find out more information to view the name, location, and virus name

associated with the infected file.

 Click Continue what I was doing to ignore the alert and close it.

2 If ActiveShield cannot clean the file, click Quarantine the infected file to encrypt

and temporarily isolate infected and suspicious files in the quarantine directory until an appropriate action can be taken.

A confirmation message appears and prompts you to check your computer for viruses. Click

3 If ActiveShield cannot quarantine the file, click Delete the infected file to try to

remove the file.

Scan to complete the quarantine process.

Managing infected e-mail

1 If you disabled auto-cleaning of e-mail, you can learn more and clean the

e-mail:

a Click Find out more information to view the file name, virus name, infection

status, sender, and subject associated with the infected e-mail.

b Click Clean the infected attachment.

2 If ActiveShield cannot clean the e-mail, click Quarantine the infected attachment

to encrypt and temporarily isolate infected and suspicious files in the quarantine directory until an appropriate action can be taken.

A confirmation message appears and prompts you to check your computer for viruses. Click

3 If ActiveShield cannot quarantine the e-mail, click Delete the infected

attachment

Scan to complete the quarantine process.

to try to remove the file.

Managing suspicious scripts

1 If ActiveShield detects a suspicious script, you can find out more and then stop

the script if you did not intend to initiate it:

a Click Find out more information to view the name, location, and description

of the activity associated with the suspicious script.

b Click Stop this script to prevent the suspicious script from running.

2 If you are sure that you trust the script, you can allow the script to run:

a Click Allow this script this time to let all scripts contained within a single file

to run once.

b Click Continue what I was doing to ignore the alert and let the script run.

User Guide 23

Using McAfee VirusScan

Managing potential worms

1 If ActiveShield detects a potential worm, you can find out more and then stop

2 If you are sure that you trust the e-mail activity, click Continue what I was doing

the e-mail activity if you did not intend to initiate it:

a Click Find out more information to view the recipient list, subject line,

message body, and description of the suspicious activity associated with the infected e-mail message.

b Click Stop this e-mail to prevent the suspicious e-mail from being sent and

delete it from your message queue.

to ignore the alert and let the e-mail be sent.

24 McAfee® VirusScan® Professional Edition software version 9.0

Manually scanning your computer

The Scan feature lets you selectively search for viruses and potentially unwanted programs on hard drives, floppy disks, and individual files and folders. When Scan finds an infected file, it automatically tries to clean the file, unless it is a potentially unwanted program. If Scan cannot clean the file, you can quarantine or delete the file.

Manually scanning for viruses and potentially unwanted programs

To scan your computer:

1 Right-click the McAfee icon, point to VirusScan, then click Scan for Viruses.

The Scan for Viruses dialog box opens (Figure 2-7).

2 Click the drive, folder, or file that you want to scan.

3 Select your Scan Options. By default, all of the Scan Options are pre-selected to

provide the most thorough scan possible (Figure 2-7):

 Scan subfolders — Use this option to scan files contained in your

subfolders. Deselect this checkbox to allow checking of only the files visible when you open a folder or drive.

Figure 2-7. Scan for Viruses

User Guide 25

Using McAfee VirusScan

Example:

Scan subfolders checkbox. The folders and their contents are not scanned.

The files in Figure 2-8 are the only files scanned if you deselect the

To scan those folders and their contents, you must leave the checkbox selected.

Figure 2-8. Local Disk Contents

 Scan all files — Use this option to allow the thorough scanning of all file

types. Deselect this checkbox to shorten the scanning time and allow checking of program files and documents only.

 Scan within compressed files — Use this option to reveal hidden infected

files within . prevent checking of any files or compressed files within the compressed file.

Sometimes virus authors plant viruses in a . into another . detect these viruses as long as you leave this option selected.

ZIP and other compressed files. Deselect this checkbox to

ZIP file, then insert that .ZIP file

ZIP file in an effort to bypass anti-virus scanners. Scan can

 Scan for new unknown viruses — Use this option to find the newest viruses

that might not have existing “cures.” This option uses advanced heuristic techniques that try to match files to the signatures of known viruses, while also looking for telltale signs of unidentified viruses in the files.

This scanning method also looks for file traits that can generally rule out that the file contains a virus. This minimizes the chances that Scan gives a false indication. Nevertheless, if a heuristic scan detects a virus, you should treat it with the same caution that you would treat a file that you know contains a virus.

This option provides the most thorough scan, but is generally slower than a normal scan.

26 McAfee® VirusScan® Professional Edition software version 9.0

Manually scanning your computer

 Scan for potentially unwanted programs — Use this option to detect

spyware, adware, dialers, and other programs that you did not intend to install on your computer.

NOTE

Leave all options selected for the most thorough scan possible. This effectively scans every file in the drive or folder that you select, so allow plenty of time for the scan to complete. The larger the hard drive and the more files you have, the longer the scan takes.

4 Click Scan to start scanning files.

When the scan is finished, a scan summary shows the number of files scanned, the number of files detected, the number of potentially unwanted programs, and the number of detected files that were automatically cleaned.

5 Click OK to close the summary, and view the list of any detected files in the

Scan for Viruses dialog box (Figure 2-9).

NOTE

Scan counts a compressed file (.ZIP, .CAB, etc.) as one file within the scanned can vary if you have deleted your temporary Internet files since your last scan.

Figure 2-9. Scan Results

Files Scanned number. Also, the number of files

User Guide 27

Using McAfee VirusScan

Scanning via Windows Explorer

VirusScan provides a shortcut menu to scan selected files, folders, or drives for viruses and potentially unwanted programs from within Windows Explorer.

To scan files in Windows Explorer:

1 Open Windows Explorer.

2 Right-click the drive, folder, or file that you want to scan, and then click Scan

If Scan finds no viruses or potentially unwanted programs, click Back to select another drive or folder to scan, or click

Close to close the dialog box.

Otherwise, see If Scan finds a virus or potentially unwanted program on page 30.

for Viruses

The

Scan for Viruses dialog box opens and starts scanning files. By default, all

of the default

Scan Options are pre-selected to provide the most thorough scan

possible (Figure 2-7 on page 25).

Scanning via Microsoft Outlook

VirusScan provides a toolbar icon to scan for viruses and potentially unwanted programs in selected message stores and their subfolders, mailbox folders, or e-mail messages containing attachments from within Microsoft Outlook 97 or later.

To scan e-mail in Microsoft Outlook:

1 Open Microsoft Outlook.

2 Click the message store, folder, or e-mail message containing an attachment

that you want to scan, and then click the e-mail scanning toolbar icon .

The e-mail scanner opens and starts scanning files. By default, all of the default

Scan Options are pre-selected to provide the most thorough scan possible

(Figure 2-7 on page 25).

Automatically scanning for viruses and potentially unwanted programs

Although VirusScan scans files when they are accessed by either you or your computer, you can schedule automatic scanning in Windows Scheduler to thoroughly check your computer for viruses and potentially unwanted programs at specified intervals.

To schedule a scan:

1 Right-click the McAfee icon, point to VirusScan, then click Options.

The

VirusScan Options dialog box opens.

28 McAfee® VirusScan® Professional Edition software version 9.0

Click the Scheduled Scan tab (Figure 2-10 on page 29).

Manually scanning your computer

Figure 2-10. Scheduled Scan Options

3 Select the Scan My Computer at a scheduled time checkbox to enable automatic

scanning.

4 Specify a schedule for automatic scanning:

 To accept the default schedule (8PM every Friday), click OK.

 To edit the schedule:

a. Click

b. Select how often to scan your computer in the then select additional options in the dynamic area below it:

Daily - Specify the number of days between scans.

Weekly (the default) - Specify the number of weeks between scans as well

as the names of the day(s) of the week.

Monthly - Specify which day of the month to scan. Click Select Months to

specify which months to scan, and click

Edit.

Schedule Task list, and

OK.

Once - Specify which date to scan.

User Guide 29

Using McAfee VirusScan

NOTE

These options in Windows Scheduler are not supported:

At system startup, When idle, and Show multiple schedules. The

last supported schedule remains enabled until you select from among the valid options.

c. Select the time of day to scan your computer in the

Start time box.

d. To select advanced options, click Advanced.

The

Advanced Schedule Options dialog box opens.

i. Specify a start date, end date, duration, end time, and whether to stop the task at the specified time if the scan is still running.

ii. Click click

5 Click OK to save your changes and close the dialog box. Otherwise, click

Cancel.

6 To revert to the default schedule, click Set to Default. Otherwise, click OK.

OK to save your changes and close the dialog box. Otherwise,

Cancel.

If Scan finds a virus or potentially unwanted program

For most viruses, Trojans, and worms, Scan automatically tries to clean the file. You

can then choose how to manage detected files, including whether to submit them to the McAfee AVERT labs for research. If Scan detects a potentially unwanted program, you can manually try to clean, quarantine, or delete it (AVERT submission is unavailable).

To manage a virus or potentially unwanted program:

1 If a file appears in the List of Detected Files, click the checkbox in front of the

file to select it.

NOTE

If more than one file appears in the list, you can select the checkbox in front of the

File Name list to perform the same

action on all of the files. You can also click the file name in the

Scan Information list to view details from the Virus

Information Library.

2 If the file is a potentially unwanted program, you can click Clean to try to clean it.

3 If Scan cannot clean the file, you can click Quarantine to encrypt and

temporarily isolate infected and suspicious files in the quarantine directory until an appropriate action can be taken. (See Managing quarantined files for details.)

30 McAfee® VirusScan® Professional Edition software version 9.0

If Scan cannot clean or quarantine the file, you can do either of the following:

 Click Delete to remove the file.

 Click Cancel to close the dialog box without taking any further action.

If Scan cannot clean or delete the detected file, consult the Virus Information Library at http://us.mcafee.com/virusInfo/default.asp for instructions on manually deleting the file.

If a detected file prevents you from using your Internet connection or from using your computer at all, try using a Rescue Disk to start your computer. The Rescue Disk, in many cases, can start a computer if a detected file disables it. See “Creating a Rescue Disk” in the online help for details.

For more help, consult McAfee Customer Support at http://www.mcafeehelp.com/.

Managing quarantined files

The Quarantine feature encrypts and temporarily isolates infected and suspicious files in the quarantine directory until an appropriate action can be taken. Once cleaned, a quarantined file can then be restored to its original location.

Managing quarantined files

To manage a quarantined file:

1 Right-click the McAfee icon, point to VirusScan, then click Manage Quarantined

Files

A list of quarantined files appears (Figure 2-11).

Figure 2-11. Manage Quarantined Files

User Guide 31

Using McAfee VirusScan

Select the checkbox next to the file(s) you want to clean.

NOTE

If more than one file appears in the list, you can select the checkbox in front of the

File Name list to perform the same

action on all of the files. You can also click the virus name in

Status list to view details from the Virus Information

the Library.

Or, click list, click

3 Click Clean.

4 If the file is cleaned, click Restore to move it back to its original location.

5 If VirusScan cannot clean the virus, click Delete to remove the file.

6 If VirusScan cannot clean or delete the file, and if it is not a potentially

Add, select a suspicious file to add to the quarantine

Open, then select it in the quarantine list.

unwanted program, you can submit the file to the McAfee AntiVirus

Emergency Response Team (AVERT

a Update your virus signature files if they are more than two weeks old.

b Verify your subscription.

c Select the file and click Submit to submit the file to AVERT.

) for research:

VirusScan sends the quarantined file as an attachment with an e-mail message containing your e-mail address, country, software version, OS, and the file’s original name and location. The maximum submission size is one unique 1.5-

7 Click Cancel to close the dialog box without taking any further action.

MB file per day.

32 McAfee® VirusScan® Professional Edition software version 9.0

Using Professional Edition Software

The McAfee VirusScan Professional Edition contains McAfee VirusScan, plus additional software, McAfee SpamKiller and McAfee Shredder.

NOTE

This is only a brief overview. For detailed information, consult the online help for VirusScan, SpamKiller, or Shredder.

Using McAfee SpamKiller

McAfee SpamKiller software helps stop spam from entering your e-mail Inbox.

NOTE

McAfee SpamKiller filters MSN/Hotmail, but currently does not filter AOL, Yahoo, or other web-based e-mail accounts.

Overview

During installation, you configured one or more e-mail accounts to block unwanted messages from. You also imported e-mail address books to your Friends List to prevent messages from known senders from being blocked.

To manage spam:

1 Open your e-mail program as usual to view, send, and receive e-mail

messages.

2 Open SpamKiller:

Right-click the McAfee icon , point to

, View Summary, View Friends List, or Settings. The corresponding page

Mail

appears.

NOTE

If the Logon dialog box appears, enter your SpamKiller logon password, and then click

OK.

SpamKiller, then click View Blocked

User Guide 33

Using Professional Edition Software

Summary page

Click the Summary tab to open the Summary page, which provides the following information:

 Status indicates if filtering is enabled, when a Friends List was last

updated, and the number of spam messages you received today. From here, you can disable or enable SpamKiller filtering, update Friends Lists, and open the Blocked E-mail page.

 Recent Spam shows the latest spam messages that SpamKiller blocked

(messages removed from your Inbox). To put a message back in your Inbox, click the

 E-mail Overview displays the total number of e-mail, spam (blocked

messages), and percentage of total spam you have received.

 Recent Spam provides a breakdown of the type of spam you received in the

past 30 days.

Microsoft Outlook and Outlook Express integration

Rescue icon next to the message.

You can access core SpamKiller features from directly within Outlook Express 6.0, Outlook 98, Outlook 2000, and Outlook XP. You can block spam, add people to your Friends List, and view quarantined e-mail by clicking buttons directly integrated into the Outlook and Outlook Express toolbars:

 Click the Block Message icon to remove the selected message from

your Microsoft Outlook Inbox and put the message in the SpamKiller Blocked E-mail folder.

 Click the View Blocked Messages icon to view messages that were

blocked from your Microsoft Outlook account and moved to the SpamKiller Blocked E-mail folder.

 Click the Add Friend icon to add the sender’s e-mail address to your

Personal Friends List.

A SpamKiller toolbar appears to the right of the default toolbars in Outlook and Outlook Express. If the toolbar is not visible, expand the e-mail application window or click the arrows to see more toolbars.

When the SpamKiller toolbar first appears in your e-mail application, you can only use the toolbar commands on new messages. Existing spam e-mail must be deleted.

34 McAfee® VirusScan® Professional Edition software version 9.0

Working with blocked and accepted messages

Click the Messages tab to access your blocked and accepted messages. The Blocked E-mail and Accepted E-mail pages have similar features.

Blocked E-mail page

Click the Blocked E-mail tab in the Messages page to view blocked messages.

NOTE

You can also access blocked messages from your Microsoft Outlook account by opening your Outlook Inbox, and then clicking in the Microsoft Outlook or Outlook Express toolbar.

Blocked messages are messages that SpamKiller identified as spam, removed from your Inbox, and placed in the Blocked E-mail folder.

The Blocked E-mail page displays all spam messages that were removed from your e-mail accounts. To view blocked e-mail for a specific account, click the down arrow located on the

Blocked E-mail tab, and then select the account to view.

Using McAfee SpamKiller

The top message pane lists spam messages and are sorted by date. The most recent message appears first. The bottom preview pane contains the message text for the selected message.

NOTE

If your computer runs Windows 2000 or Windows XP, multiple users have been added to SpamKiller, and you are logged on to SpamKiller as a limited user, the message contents do not appear in the bottom preview pane.

The middle pane shows message details. Click the down arrows to expand the message details pane and view the message text and headers in native format, including any HTML formatting tags. following:

The message details pane shows the

 Action describes how SpamKiller processed the spam message. Action is

associated with the action of the filter that blocked the message.

 Reason explains why SpamKiller blocked the message. You can click the

reason to open the filter editor and view the filter. The filter editor displays what the filter looks for in a message, and the action that SpamKiller takes against messages found by the filter.

 From shows the sender of the message.

 Date shows the date the message was sent to you.

 To shows to whom the message was sent.

 Subject shows the topic that appears in the message subject line.

User Guide 35

Using Professional Edition Software

The left column contains icons next to messages if manual complaints or error messages have been sent:

A complaint was sent about the message.

An error message was sent to the reply address in the spam message.

Both a complaint and error message were sent.

Accepted E-mail page

Click the Accepted E-mail tab in the Messages page to view accepted messages.

The Accepted E-mail page displays all Inbox messages in all of your e-mail accounts. However, for MAPI accounts, the Accepted E-mail page does not contain internal e-mail. To view accepted e-mail for a specific account, click the down arrow on the

NOTE

SpamKiller is designed to accept legitimate e-mail. However, if legitimate e-mail appears in the Blocked E-mail list, you can move the messages back to your Inbox (and the Accepted E-mail list) by selecting the messages, and then clicking

Rescue this message.

Accepted E-mail tab, and then select an account to view.

Like the Blocked E-mail page, the top message pane lists messages that are sorted by date. The bottom preview pane contains the message text of the selected message.

The middle pane explains if a message was sent by someone on a Friends List, or if the message fits the criteria of a filter, but the filter action was set to either

Mark as Possible Spam. Click the down arrows to expand the message details

pane, and view the message text and headers in native format, including any HTML formatting tags.

The message details pane shows the following:

 Action describes how SpamKiller processed the message.

 Reason explains why SpamKiller flagged the message.

 From shows the sender of the message.

 Date shows the date the message was sent to you.

 To shows to whom the message was sent.

 Subject shows the topic that appears in the message subject line.

36 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee SpamKiller

One of the following icons appears next to an accepted message:

SpamKiller detected that a sender of the message is on a Friends List.

The message matches a filter with an action set to

A complaint was sent about the message.

An error message was sent to the reply address on the spam message.

Both a complaint and error message were sent.

Mark as Possible Spam.

Tasks for Blocked E-mail and Accepted E-mail

The right pane on the Blocked E-mail and Accepted E-mail pages lists tasks you can perform:

 Block this message removes a message from your Inbox and puts it in the

SpamKiller Blocked E-mail folder. (This option appears on the Accepted E-mail page only.)

 Rescue this message puts a message back in your Inbox and opens the

Rescue Options dialog box. (This option appears on the Blocked E-mail page only.) You can automatically add the sender to your Friends list and rescue all messages from the sender.

 Delete this message removes a selected message.

 Add a friend adds the sender’s name, e-mail address, domain, or a mailing

list to a Friends List.

 Add a filter creates a filter.

 Report to McAfee informs McAfee of specific spam messages you receive.

 Send a complaint about spam to the administrator of the sender’s domain

or to another e-mail address you enter.

 Send an error to the reply address of a spam message.

Rescuing messages

If the Blocked E-mail page contains legitimate mail, you can put those messages back in your Inbox.

To rescue a message:

1 View your blocked e-mail messages:

 In SpamKiller, click the Messages tab, then click the Blocked E-mail tab.

 In your Microsoft Outlook or Outlook Express Inbox, click to open the

Blocked E-mail page for that account.

The Blocked E-mail page appears.

User Guide 37

Using Professional Edition Software

Select a message, then click Rescue this message.

The Rescue Options dialog box appears with these default options selected:

 Add Friend

 Rescue all from same sender

3 Click OK. The sender is added to your Friends List, and all messages from this

sender are put back in your Inbox and the Accepted E-mail folder.

Blocking messages

Block spam messages that are currently in your Inbox. When you block a message, SpamKiller automatically creates a filter to remove that message from your Inbox. You can block Inbox messages from the Accepted E-mail page, or from Microsoft Outlook or Outlook Express.

To block a message from the Accepted E-mail page:

1 Click the Messages tab, then click the Accepted E-mail tab. The Accepted E-mail

page appears and displays messages that are currently in your Inbox.

2 Select a message, then click Block this message. The message is removed from

your Inbox and the Accepted E-mail page, and a copy of the message appears in the Blocked E-mail folder.

To block a message from Microsoft Outlook:

1 Open your Microsoft Outlook or Outlook Express Inbox. You can only block

external messages (messages coming from an Internet server).

2 Select a message, then click . A copy of the message is put in the Blocked

E-mail folder.

Deleting messages

By default, when SpamKiller finds spam, SpamKiller removes it from your Inbox and puts it in the SpamKiller Blocked E-mail folder. SpamKiller automatically removes blocked messages from the Blocked E-mail folder after 15 days. You can change how often SpamKiller automatically removes blocked messages or you can remove messages manually.

SpamKiller does not automatically remove messages from the Accepted E-mail folder because the folder reflects the messages currently in your Inbox.

Instead of moving spam messages to the Blocked E-mail folder, SpamKiller can tag the e-mail subject line with “[spam],” or with a tag or your choice, and keep the message in your Inbox. Tagging messages can be useful if you want to move the tagged messages to another folder in your e-mail client, such as a “junk” folder. You can move the tagged messages by creating a rule in your e-mail client so that it searches for messages with the “[spam]” tag and puts the messages in the folder you indicate.

38 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee SpamKiller

To change the setting for the automatic removal of blocked messages:

1 Click the Settings tab, then click the Filtering Options icon.

2 Select how SpamKiller handles spam messages:

 Put spam in Blocked E-mail—Spam messages are removed from your Inbox

and put in the SpamKiller Blocked E-mail folder.

 Keep blocked e-mail for ____ days—Blocked messages remain in the

Blocked E-mail folder for the duration you specify.

 Tag spam and keep in inbox—Spam messages remain in your Inbox, but the

subject line of the message includes “[spam]” or the tag you enter.

3 Click OK.

To delete a message manually:

1 View your blocked e-mail messages:

 In SpamKiller, click the Messages tab, and then click the Blocked E-mail tab.

 In your Microsoft Outlook or Outlook Express Inbox, click to open the

Blocked E-mail page for that account.

The Blocked E-mail page appears.

2 Select a message to delete, then click Delete this message. A confirmation

dialog box appears.

3 Click Yes to delete the message.

Reporting spam to McAfee

You can report spam to McAfee for analysis used in creating filter updates.

To report spam to McAfee:

1 Click the Messages tab, then click the Blocked E-mail or Accepted E-mail tab.

The Blocked E-mail or Accepted E-mail page appears.

2 Select a message, then click Report to McAfee. A confirmation dialog box

appears.

3 Click Yes to automatically send the message to McAfee.

User Guide 39

Using Professional Edition Software

Sending complaints manually

Send a complaint to prevent a sender from sending you more spam. See “Sending Complaints and Error Messages” in the online help for details.

To send a complaint manually:

1 Click the Messages tab, then click the Blocked E-mail or Accepted E-mail tab. A

list of messages appears.

2 Select a message to complain about, then click Send a complaint. The Send

Complaint dialog box appears.

3 Select whom you want to send the complaint to.

WARNING

In most cases, you should not select Sender. Sending a complaint to the sender of the spam validates your e-mail address, which can increase the number of spam you receive from that sender.

4 Click Next, then follow the instructions on the dialog boxes that appear.

Sending error messages

Send an error message to prevent a sender from sending you more spam. See “Sending Complaints and Error Messages” in the online help for details.

To send an error message manually:

1 Click the Messages tab, then click the Blocked E-mail or Accepted E-mail tab. A

list of messages appears.

2 Select a message, then click Send error. An error message is sent to the reply

address in the spam message.

40 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee Shredder

McAfee Shredder protects your privacy by quickly and safely erasing unwanted files.

Deleted files can be recovered from your computer even after you empty your Recycle Bin. When you delete a file, Windows merely marks that space on your disk drive as no longer being in use, but the file is still there.

Why Windows leaves some file remnants

To permanently delete a file, you must repeatedly overwrite the existing file with new data. If Microsoft Windows securely deleted files, every file operation would be very slow. Shredding a document does not always prevent that document from being recovered because some programs make temporary hidden copies of open documents. If you only shred documents that you see in Explorer, you could still have temporary copies of those documents. We recommend that you periodically shred the free space on your disk drive to insure that these temporary copies are permanently deleted.

NOTE

With computer forensics tools, tax records, job resumes, or other documents that you had deleted, could be obtained.

Using McAfee Shredder

What McAfee Shredder erases

With McAfee Shredder, you can securely and permanently erase:

 One or more files or folders

 An entire disk

 The trails that your web surfing leaves behind

Permanently erasing files in Windows Explorer

To shred a file via Windows Explorer:

1 Open Windows Explorer, then select the file or files that you want to shred.

2 Right-click your selection, point to Send To, then click McAfee Shredder.

Emptying the Windows Recycle Bin

If files are in your Recycle Bin, McAfee Shredder offers a more secure method of emptying your Recycle Bin.

To shred the contents of the Recycle Bin:

1 On your Windows desktop, right-click the Recycle Bin.

2 Select Shred Recycle Bin, then follow the on-screen instructions.

User Guide 41

Using Professional Edition Software

Customizing Shredder settings

You can customize your Shredder Settings:

 Specify the number of shredding passes.

 Show a warning message when you shred files.

 Check your hard disk for errors before shredding.

 Add McAfee Shredder to your Send To menu.

 Place a Shredder icon on your Windows desktop.

To customize Shredder settings, open McAfee Shredder, click Properties, then follow the on-screen instructions.

42 McAfee® VirusScan® Professional Edition software version 9.0

Index

Accepted E-mail page

blocking messages overview tasks

ActiveShield

cleaning a virus default scan setting disabling enabling scan options scanning all file types scanning all files scanning e-mail and attachments scanning for new unknown viruses scanning for scripts and worms scanning inbound instant message

attachments

scanning program files and documents

only starting stopping testing

alerts

for infected e-mail for infected files for potential worms for suspicious scripts for viruses

AVERT, submitting suspicious files to

, 36

, 37

, 14

, 13

, 19

, 15

, 9

, 22

, 38

, 22

, 15, 18 to 21

, 14

, 18

, 23

, 24

, 23

, 15

, 20

, 32

, 19

configuring

VirusScan

ActiveShield

, 25

Scan

, 13

e-mail and attachments

auto-cleaning cleaning deleting disabling auto-cleaning quarantining scanning

, 15

, 23

, 17

, 23

, 15

getting started with VirusScan, 7

inbound instant message attachments

auto-cleaning scanning

, 18

list of detected files (Scan), 27, 30

McAfee SecurityCenter, 11 Microsoft Outlook

, 28

Blocked E-mail page

blocked message icons deleting blocked messages overview rescuing messages sending error messages tasks

, 35

, 37

, 36

, 38

, 37

, 40

new features, 7

User Guide 43

Index

potentially unwanted programs

cleaning deleting detecting quarantining

, 30

, 31

, 30

Quarantine

adding suspicious files cleaning files deleting files deleting suspicious files managing suspicious files restoring cleaned files submitting suspicious files

Quick Start Card

, 31 to 32

, 31

, iii

, 31

, 32

, 31

, 31 to 32

, 32

Rescue Disk, 31

Scan

automatic scanning cleaning a virus or potentially unwanted

program deleting a virus or potentially unwanted

program manual scanning manual scanning via Microsoft Outlook

toolbar manual scanning via Windows Explorer quarantining a virus or potentially unwanted

program Scan all files option Scan for new unknown viruses option Scan for potentially unwanted programs

option Scan subfolders option Scan within compressed files option testing

Scan all files option (Scan) Scan for new unknown viruses option (Scan)

, 30

, 31

, 28

, 30

, 27

, 9 to 10

, 28

, 25

, 26

, 25

, 26

, 28

, 26

Scan for potentially unwanted programs option

, 27

(Scan)

scan options

ActiveShield

, 25

Scan Scan subfolders option (Scan) Scan within compressed files option (Scan) scanning

all files

compressed files

for new unknown viruses

for scripts and worms

program files and documents only

scheduling automatic scans

subfolders

via Microsoft Outlook toolbar

via Windows Explorer scheduling scans scripts

, 23

alerts

allowing

stopping ScriptStopper Shredder

emptying Windows Recycle Bin

erasing files in Windows Explorer

options

overview

types of erased files

Windows file remnants SpamKiller

Accepted E-mail page

Blocked E-mail page

blocked message icons

blocking messages

deleting blocked messages

reporting spam to McAfee

rescuing messages

sending complaints manually

sending error messages submitting suspicious files to AVERT system requirements

, 14, 18 to 19

, 25

, 26

, 18, 26

, 26

, 20

, 19

, 28

, 25

, 28

, 23 , 23 , 20

, 41

, 42

, 41

, 33

, 36

, 35

, 36

, 38

, 39

, 37

, 40

, 32

, 8

44 McAfee® VirusScan® Professional Edition software version 9.0

technical support, 31 testing VirusScan Trojans

, 22

alerts detecting

, 9

, 30

Update Wizard, 15

viruses

, 22

alerts allowing suspicious scripts cleaning cleaning infected e-mail attachments deleting deleting infected e-mail attachments deleting infected files detecting detecting with ActiveShield quarantining quarantining infected e-mail attachments quarantining infected files stopping potential worms stopping suspicious scripts

VirusScan

getting started scanning via Microsoft Outlook toolbar scanning via Windows Explorer scheduling scans testing

, 22, 30

, 30

, 22, 30

, 7

, 28

, 9

, 23

, 22

, 23

, 24

, 23

Index

, 23

, 28

Windows Explorer, 28 worms

, 22, 24

alerts detecting stopping

WormStopper

, 22, 30

, 24

, 20

User Guide 45

For more information on

products, worldwide services,

and support, contact your

authorized McAfee sales

representative or visit us at:

McAfee

5000 Headquarters Drive

Plano, TX 75024

(972) 963-8000

www.mcafee.com

NAI-675-0010-1

McAfee VPM80E005RAA, VirusScan Professional User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual