McAfee VPM80E005RAA, VirusScan Professional User Manual

User Guide

Version 9.0

Copyright © 2004 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the McAfee legal department at: 5000 Headquarters Drive, Plano, Texas 75024, or call +1-972-963-8000.

TRADEMARK ATTRIBUTIONS

ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, ANTIVIRUS ANYWARE AND DESIGN, CLEAN-UP, DESIGN (STYLIZED E), DESIGN (STYLIZED N), ENTERCEPT, ENTERPRISE SECURECAST, ENTERPRISE SECURECAST (AND IN KATAKANA), EPOLICY ORCHESTRATOR, FIRST AID, FORCEFIELD, GMT, GROUPSHIELD, GROUPSHIELD (AND IN KATAKANA), GUARD DOG, HOMEGUARD, HUNTER, INTRUSHIELD, INTRUSION PREVENTION THROUGH INNOVATION, M AND DESIGN, MCAFEE, MCAFEE (AND IN KATAKANA), MCAFEE AND DESIGN, MCAFEE.COM, MCAFEE VIRUSSCAN, NA NETWORK ASSOCIATES, NET TOOLS, NET TOOLS (AND IN KATAKANA), NETCRYPTO, NETOCTOPUS, NETSCAN, NETSHIELD, NETWORK ASSOCIATES, NETWORK ASSOCIATES COLLISEUM, NETXRAY, NOTESGUARD, NUTS & BOLTS, OIL CHANGE, PC MEDIC, PCNOTARY, PRIMESUPPORT, RINGFENCE, ROUTER PM, SECURECAST, SECURESELECT, SPAMKILLER, STALKER, THREATSCAN, TIS, TMEG, TOTAL VIRUS DEFENSE, TRUSTED MAIL, UNINSTALLER, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, VIRUSSCAN (AND IN KATAKANA), WEBSCAN, WEBSHIELD, WEBSHIELD (AND IN KATAKANA), WEBSTALKER, WEBWALL, WHAT'S THE STATE OF YOUR IDS?, WHO'S WATCHING YOUR NETWORK, YOUR E-BUSINESS DEFENDER, YOUR NETWORK. OUR BUSINESS. are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE, INC. OR THE PLACE OF PURCHASE FOR A FULL REFUND.

Attributions

This product includes or may include:

 Software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).  Cryptographic software written by Eric A. Young and

software written by Tim J. Hudson.  Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that McAfee, Inc. provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer.

Apache Software Foundation (http://www.apache.org/). A copy of the license agreement for this software can be found at www.apache.org/licenses/LICENSE-

 Outside In

Thai Open Source Software Center Ltd. and Clark Cooper, © 1998, 1999, 2000. Software copyrighted by Expat maintainers. Software copyrighted by The Regents of the University of California, © 1989.  Software copyrighted by Gunnar Ritter.  Software copyrighted by Sun Microsystems®, Inc.© 2003.  Software copyrighted by Gisle Aas. © 1995-2003. Software copyrighted by Michael A. Chase, © 1999-2000. Software copyrighted by Neil Winton, © 1995-1996.

Koster, © 1995.  Software copyrighted by Brad Appleton, © 1996-1999.  Software copyrighted by Michael G. Schwern, © 2001.  Software copyrighted by Graham Barr, © 1998.  Software copyrighted by Larry Wall and Clark Cooper, © 1998-2000.  Software copyrighted by Frodo Looijaard, © 1997.  Software copyrighted by the Python Software Foundation, Copyright © 2001, 2002, 2003. A copy of the license agreement for this software can be found at www.python.org.

Notre Dame.  Software copyrighted by Simone Bordet & Marco Cravero, © 2002.  Software copyrighted by Stephen Purcell, © 2001.  Software developed by the Indiana University Extreme! Lab (http://www.extreme.indiana.edu/).  Software copyrighted by International Business Machines Corporation and others, © 1995-2003. Software developed by the University of California, Berkeley and its contributors. Software developed by Ralf S. Engelschall <rse@engelschall.com> for use in the mod_ssl project (http://www.modssl.org/). Software copyrighted by Kevlin Henney, © 2000-2002. Software copyrighted by Peter Dimov and Multi Media Ltd. © 2001, 2002.  Software copyrighted by David Abrahams, © 2001, 2002. See http://www.boost.org/libs/bind/

copyrighted by Cadenza New Zealand Ltd., © 2000. Software copyrighted by Jens Maurer, © 2000, 2001. Software copyrighted by Jaakko Järvi (jaakko.jarvi@cs.utu.fi), © 1999, 2000. Walker, © 1999-2001. Software copyrighted by Stephen Cleary (shammah@voyager.net), © 2000. Software copyrighted by Housemarque Oy <http://

Issued October 2004 / McAfee® VirusScan® Professional Edition software version 9.0

Quick Start Card

If you are installing your product from a CD or the web site, print this convenient reference page.

Are you installing your product from a CD?

Yes

1. Insert your product CD into your CD-ROM drive. If the installation does not start automatically, click your Windows desktop, then click

2. In the Run dialog box, type D:\SETUP.EXE (where D is the letter of your CD-ROM drive).

3. Click OK.

Start on

Run.

Are you installing your product from a web site?

Yes

1. Go to the McAfee web site, and click

My Account.

2. If prompted, enter your subscribing e-mail address and password, then

click page.

McAfee reserves the right to change Upgrade & Support Plans and policies at any time without notice. McAfee and

VirusScan are registered trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries.

3. Locate your product in the list, and click the download icon.

User Guide iii

Quick Start Card

For more information

To view the User Guides on the product CD, make sure you have Acrobat Reader installed; if not, install it now from the McAfee product CD.

1 Insert your product CD into your CD-ROM

drive.

2 Open Windows Explorer: Click Start on

your Windows desktop, and click

3 Locate the Manuals folder, and double-click

the User Guide .

PDF you want to open.

Search.

Registration benefits

We recommend that you follow the easy steps within your product to transmit your registration directly to us. Registration ensures that you receive timely and knowledgeable technical assistance, plus the following benefits:

 FREE electronic support  Virus definition (.DAT) file updates for one

year after installation when you purchase VirusScan software

Go to http://www.mcafee.com/ for pricing of an additional year of virus signatures.

 60-day warranty that guarantees

replacement of your software CD if it is defective or damaged

 SpamKiller filter updates for one year after

installation when you purchase SpamKiller software

Go to http://www.mcafee.com/ for pricing of an additional year of filter updates.

 McAfee Internet Security Suite updates for

one year after installation when you purchase MIS software

Go to http://www.mcafee.com/ for pricing of an additional year of content updates.

Technical Support

For technical support, please visit

http://www.mcafeehelp.com/.

Our support site offers 24-hour access to the easy-to-use Answer Wizard for solutions to the most common support questions.

Knowledgeable users can also try our advanced options, which include a Keyword Search and our Help Tree. If a solution cannot be found, you can also access our FREE Chat Now! and E-mail Express! options. Chat and e-mail help you to quickly reach our qualified support engineers through the Internet, at no cost. Otherwise, you can get phone support information at

http://www.mcafeehelp.com/.

iv McAfee® VirusScan® Professional Edition software version 9.0

Contents

Quick Start Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

New features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Testing VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Testing ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Testing Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Using McAfee SecurityCenter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Using McAfee VirusScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Using ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Enabling or disabling ActiveShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Configuring ActiveShield options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

If ActiveShield finds a virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Manually scanning your computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Manually scanning for viruses and potentially unwanted programs . . . . . . . . . . . . . . 25

Automatically scanning for viruses and potentially unwanted programs . . . . . . . . . . 28

If Scan finds a virus or potentially unwanted program . . . . . . . . . . . . . . . . . . . . . . . . 30

Managing quarantined files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

3 Using Professional Edition Software . . . . . . . . . . . . . . . . . . . . . . 33

Using McAfee SpamKiller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Working with blocked and accepted messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Using McAfee Shredder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Why Windows leaves some file remnants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

What McAfee Shredder erases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Permanently erasing files in Windows Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Emptying the Windows Recycle Bin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Customizing Shredder settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

User Guide v

Contents

vi McAfee® VirusScan® Professional Edition software version 9.0

Getting Started

Welcome to McAfee VirusScan. The McAfee VirusScan Professional Edition contains McAfee VirusScan, plus McAfee SpamKiller and McAfee Shredder. See

Running H/F 4 to learn more about these additional programs.

NOTE

This is only a brief overview. For detailed information, consult the online help for VirusScan, SpamKiller, or Shredder.

McAfee VirusScan is an anti-virus subscription service offering comprehensive, reliable, and up-to-date virus protection. Powered by award-winning McAfee scanning technology, VirusScan protects against viruses, worms, Trojan horses, malicious scripts, and hybrid attacks.

With it, you get the following features:

ActiveShield — Scan files when they are accessed by either you or your computer.

Scan — Search for viruses and potentially unwanted programs in hard drives,

floppy disks, and individual files and folders.

Quarantine — Encrypt and temporarily isolate infected and suspicious files in the

quarantine folder until an appropriate action can be taken.

Hostile activity detection — Monitor your computer for virus-like activity caused by

malicious scripts and worm-like activity.

New features

This version of VirusScan provides the following new features:

 Scanning for potentially unwanted programs

VirusScan can scan for potentially unwanted programs (including spyware, adware, and dialers) during manual scanning, outbound e-mail scanning, instant messaging (IM), via the Windows Explorer shortcut menu, and via the Microsoft Outlook toolbar icon.

 Scanning of large outbound attachments

To address increased use of broad-band Internet connections and service providers increasing e-mail storage and transmission sizes, VirusScan is now optimized to scan large e-mail attachments without interfering with e-mail program timeout values.

User Guide 7

Getting Started

 E-mail scanning

VirusScan automatically scans inbound (POP3) and outbound (SMTP) e-mail and e-mail attachments for most popular e-mail clients, including Microsoft Outlook, Netscape Mail, Eudora, and Pegasus.

 Instant messenger scanning

VirusScan automatically scans inbound file transfers for most popular instant messaging clients, including Yahoo Messenger, AOL Instant Messenger, and MSN Messenger.

 Hostile activity detection

VirusScan provides ScriptStopperTM and WormStopperTM to detect, alert, and block virus-like activity caused by malicious scripts and worm-like activity.

 Automatic file infection cleaning

VirusScan automatically attempts to clean infected or suspicious files as soon as they are detected.

 Scheduled scanning

You can now schedule automatic scanning at specified intervals to thoroughly check your computer for viruses.

 File quarantine

You can use the Quarantine feature to encrypt and temporarily isolate infected and suspicious files in the quarantine folder until an appropriate action can be taken. Once cleaned, a quarantined file can then be restored to its original location.

 Submit files to AVERT

VirusScan now includes the ability to submit suspicious files directly from the Quarantine feature to the McAfee AntiVirus Emergency Response Team

(AVERT

 Virus Map reporting

) for research.

You can now anonymously send virus tracking information for inclusion in our World Virus Map. You can automatically register for this free, secure feature and view the latest worldwide infection rates via the McAfee SecurityCenter.

System requirements

 Microsoft  Personal computer with Pentium 133 MHz or higher processor  32 MB of RAM

Windows 98, Windows Me, Windows 2000, or Windows XP

 35 MB of free hard disk space (for installation)  Microsoft

NOTE

To upgrade to the latest version of Internet Explorer, visit the Microsoft web site at http://www.microsoft.com/.

8McAfee

VirusScan® Professional Edition software version 9.0

Internet Explorer 5.5 or later

Testing VirusScan

Before initial use of VirusScan, it’s a good idea to test your installation. Use the following steps to separately test the ActiveShield and Scan features.

Testing ActiveShield

To test ActiveShield:

1 Go to http://www.eicar.com/ in your web browser.

2 Click the The AntiVirus testfile eicar.com link.

3 Scroll to the bottom of the page. Under Download, you will see four links.

4 Click eicar.com.

If ActiveShield is working properly, it detects the eicar.com file immediately after you click the link. You can try to delete or quarantine infected files to see how ActiveShield handles viruses. See If ActiveShield finds a virus on page 22 for details.

Testing VirusScan

Testing Scan

Before you can test Scan, you must disable ActiveShield to prevent it from detecting the infected files before Scan does, then download the test files.

To download the test files:

1 Disable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

2 Download the EICAR test files from the EICAR web site:

click

Disable.

a Go to http://www.eicar.com/.

b Click the The AntiVirus testfile eicar.com link.

c Scroll to the bottom of the page. Under Download, you will see these links:

eicar.com contains a line of text that VirusScan will detect as a virus.

eicar.com.txt (optional) is the same file, but with a different file name, for

those users who have difficulty downloading the first link. Simply rename the file “eicar.com” after you download it.

eicar_com.zip is a copy of the test virus inside a .ZIP compressed file (a

WinZip

™

file archive).

eicarcom2.zip is a copy of the test virus inside a .ZIP compressed file,

which itself is inside a .

ZIP compressed file.

User Guide 9

Getting Started

Click each link to download its file. For each one, a File Download dialog

box appears.

e Click Save, click the Create New Folder button, then rename the folder VSO

Scan Folder

f Double-click VSO Scan Folder, then click Save again in each Save As dialog

box.

3 When you are finished downloading the files, close Internet Explorer.

4 Enable ActiveShield: Right-click the McAfee icon, point to VirusScan, then

click

Enable.

To test Scan:

1 Right-click the McAfee icon, point to VirusScan, then click Scan for Viruses.

2 Using the directory tree in the left pane of the dialog box, go to the VSO Scan

Folder

a Click the + sign next to the C drive icon.

where you saved the files:

b Click the VSO Scan Folder to highlight it (do not click the + sign next to it).

This tells Scan to check only that folder for viruses. You can also put the files in random locations on your hard drive for a more convincing demonstration of Scan’s abilities.

3 In the Scan Options area of the Scan for Viruses dialog box, ensure that all

options are selected.

4 Click Scan on the lower right of the dialog box.

VirusScan scans the that folder appear in the

VSO Scan Folder. The EICAR test files that you saved to

List of Detected Files. If so, Scan is working properly.

You can try to delete or quarantine infected files to see how Scan handles viruses. See If Scan finds a virus or potentially unwanted program on page 30 for details.

10 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee SecurityCenter

McAfee SecurityCenter is your one-stop security shop, accessible from its icon in your Windows system tray or from your Windows desktop. With it, you can perform these useful tasks:

 Get free security analysis for your computer.

 Launch, manage, and configure all your McAfee subscriptions from one icon.

 See continuously updated virus alerts and the latest product information.

 Get quick links to frequently asked questions and account details at the

McAfee web site.

NOTE

For more information about its features, click Help in the

SecurityCenter dialog box.

While SecurityCenter is running and all of the McAfee features installed on your computer are enabled, a red M icon appears in the Windows system tray. This area is usually in the lower-right corner of the Windows desktop and contains the clock.

Using McAfee SecurityCenter

If one or more of the McAfee applications installed on your computer are disabled, the McAfee icon changes to black .

To open the McAfee SecurityCenter:

1 Right-click the McAfee icon .

2 Click Open SecurityCenter.

To access a VirusScan feature:

1 Right-click the McAfee icon .

2 Point to VirusScan, then click the feature you want to use.

User Guide 11

Getting Started

12 McAfee® VirusScan® Professional Edition software version 9.0

Using McAfee VirusScan

Using ActiveShield

When ActiveShield is started (loaded into computer memory) and enabled, it is constantly protecting your computer. ActiveShield scans files when they are accessed by either you or your computer. When ActiveShield detects an infected file, it automatically tries to clean the virus. If ActiveShield cannot clean the virus, you can quarantine or delete the file.

Enabling or disabling ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by the red icon in your Windows system tray) by default as soon as you restart your computer after the installation process.

If ActiveShield is stopped (not loaded) or is disabled (denoted by the black icon), you can manually run it, as well as configure it to start automatically when Windows starts.

Enabling ActiveShield

To enable ActiveShield for this Windows session only:

Right-click the McAfee icon, point to changes to red .

If ActiveShield is still configured to start when Windows starts, a message tells you that you are now protected from viruses. Otherwise, a dialog box appears that lets you configure ActiveShield to start when Windows starts (Figure 2-1 on page 14).

VirusScan, then click Enable. The McAfee icon

User Guide 13

Using McAfee VirusScan

Disabling ActiveShield

To disable ActiveShield for this Windows session only:

1 Right-click the McAfee icon, point to VirusScan, then click Disable.

2 Click Yes to confirm.

The McAfee icon changes to black .

If ActiveShield is still configured to start when Windows starts, your computer will be protected from viruses again when you restart your computer.

Configuring ActiveShield options

You can modify ActiveShield starting and scanning options in the ActiveShield tab of the McAfee icon in your Windows system tray.

VirusScan Options dialog box (Figure 2-1), which is accessible via the

Starting ActiveShield

ActiveShield is started (loaded into computer memory) and enabled (denoted by red ) by default as soon as you restart your computer after the installation process.

If ActiveShield is stopped (denoted by black ), you can configure it to start automatically when Windows starts (recommended).

14 McAfee® VirusScan® Professional Edition software version 9.0

Figure 2-1. ActiveShield Options

+ 32 hidden pages

McAfee VPM80E005RAA, VirusScan Professional User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual