Copyright: ©1998 Network Associates , Inc. All rights reserved.
Citation: ©1998 Network Associates, Inc. All rights reserved.


About VirusScan
About Scan

The Scan program detects, identifies, and disinfects known DOS and Windows computer viruses. Scan checks memory as well as both the system and data areas of disks for virus infections. If Scan finds a known virus, in most cases it will eliminate the virus and fully repair infected programs or system areas to their original condition.

Scan is designed to check for pre-existing infections of known and unknown viruses on floppy, hard, CD-ROM, and compressed (DriveSpace, SuperStor, Stacker, DoubleSpace, etc.) disks on both stand-alone and networked personal computers, as well as network file servers. If you have a Novell NetWare/386 V3.1x or 4.xx file server, use the NetShield virus prevention software NetWare Loadable Module in conjunction with Scan.


What is a virus
What is a computer virus?

A computer virus is a software program that attaches itself to another program in computer memory or on a disk, and spreads from one program to another. Viruses can damage data, cause computers to crash, display offending or bothersome messages, or lie dormant until such time they are set to "awaken."


Why do I need to scan for viruses?

In today's industry, scanning is no longer considered to be an extravagance - but a necessity. Computer viruses no longer attack your computing environment but all other computing environments which you contact. Computer viruses can attach and later propagate themselves through disks and files. Important information and hardware losses could plague your computing environment should you not take the proper precautions. Network Associates' anti-virus line of products heads up the list of proper precautions. Scheduled periodic scans of your computing environment can offer you that added assurance that you are practicing "safe computing."


Configuring a Scan
To configure a Scan

1.	Select the Where & What tab.

2.	Enter a path in the Scan in field or click Browse to select the desired location.

3.	Select the desired radio button and check boxes.

Tip

To get information on a control, click the right mouse button.

Related Topics


Selecting Detection Actions
To select Actions

1.	Select the Actions tab.

2.	Select an Action from the provided list box.

Tips

Make regular backups and keep original diskettes for all your applications.

If you do not keep backups of your programs, do not select automatic virus removal.

Related Topics


Reporting Scan Results
To report Scan Results

1.	Select the Reports tab.

2.	Select the Display message check box and enter a message in the provided text box.

3.	Select the Sound alert check box to be notified by an electronic beep when VirusScan is complete and a virus is detected.

4.	Select the Log to File check box and enter a log file name in the provided text box or click Browse to locate the desired file.

5.	To limit the log file size, select the corresponding check box and enter a value between 10 and 999 K in the provided field.

Tips

To view or print a log file, launch notepad.

An unlimited log file size can take up valuable disk space.

The log file is appended when viruses are found.

Related Topics


Initiating Scanning from the VirusScan window
To initiate Scanning from the Scan window

1.	Select the Where & What tab.

2.	Specify the desired path and file options.

3.	Select the Actions tab.

4.	Specify the desired  action.

5.	Select the Reports tab.

6.	Specify the desired reporting options.

7.	Click Scan Now.

Tips

To terminate scanning, click Stop.

Scan can be launched in multiple instances to accommodate the need to scan more than one location or file.  Just highlight multiple Drives or Folders, right mouse click, and select Scan for Viruses.

Related Topics


Initiating a Scan from the Context Menu
To initiate a Scan from the Context Menu

1.	Click the right mouse button on the desired Directory or Drive icon to display the context menu.

2.	Choose VirusScan from the context menu.

3.	Select the desired options from the provided tabs.

4.	Click Scan Now.


To start scan from the Startup Folder
To initiate a Scan from the StartUp of Windows

1.	Launch Scan.

2.	Select the desired options from the provided tabs.

3.	Choose Save Settings from the File menu.

4.	Save the settings file to the StartUp Folder.

Tips

To rename a Settings file from within Explorer, select the desired file and choose File | Rename.

To launch Scan from within Explorer, double click on a Settings file.

The StartUp folder is typically located under C:\WINDOWS\Start Menu\Programs.

Related Topics


Cleaning files automatically
To clean files automatically

1.	Select the Actions tab.

2.	Choose Clean infected files from the When virus is found list box.

3.	Click Scan Now.

Note: This procedure is not recommended for those environments which are not backed up on a regular basis.

Tips

To delete infected files, choose Delete infected files.

To be prompted upon virus detection, choose Prompt for action.

To clean virus from the Infected File Info dialog, choose Prompt for action.

Related Topics


Prompting Infection Actions
To clean infected files from a Scan prompt

1.	Select the Actions tab.

2.	Choose Prompt for action from the When virus is found list.

3.	Click Scan Now.

4.	When virus is found, click Clean.

Tips

To display information about the virus, double click on the file name in the list of infected files.

Most infected file operations can be performed by clicking right mouse button on the infected file.

Related Topics


About Network Associates

Founded in 1989, Network Associates Inc. is the leading provider of productive computing tools for DOS, OS/2, and Windows environments. Our anti-virus products are used by more than 16,000 corporations worldwide. Our utility products provide data security, automated version updating, and system inspection and editing. Network Associates is also the pioneer and leading provider of electronically distributed software. All of Network Associates' products can be purchased through dealers or downloaded from bulletin board systems and on-line services around the world.

Network Associates does not stop at developing the world’s best anti-virus and utility products. We back them with the industry's best service and technical support. Product support is provided by a full-time staff of virus researchers, programmers, and support professionals; and delivered directly by Network Associates or our network of more than 150 authorized agent offices in 50+ countries worldwide.


Preventing viruses

Although VirusScan is designed to offer you the highest degree of virus protection, detection and eradication available, no anti-virus program can prevent all computer viruses. Even with frequent updates, new viruses currently appear at a rate of three to four a day, and this number may certainly grow even higher in the future.

Keeping your anti-virus software current is one way to prevent the overwhelming majority of computer viruses from infecting your system. However, by following the steps listed below, you can greatly reduce the chance of becoming infected.

Never boot your PC with a floppy diskette in Drive A:

Although boot viruses only account for approximately 10% of the total number of computer viruses, they account for over 90% of reported virus infections. This is because all formatted diskettes, even data diskettes, contain a boot sector that the computer attempts to execute when started. Even if this attempt is unsuccessful, a virus in the boot sector is read into memory and executed, at which point it can infect the hard disk.

Use software only from reputable sources

When purchasing commercial software, be sure that the software is in its original packaging and has not been previously used and returned.

When using BBSs, check with the Systems Operator about their scanning procedures. Many System Operators scan for viruses before making files available for downloading.

Most commercial electronic services such as CompuServe and America Online scan files for viruses before making them available for downloading.

Scan all incoming disks and files for viruses

You should scan all diskettes and files you receive for viruses before using them. This includes: purchased programs, downloaded programs, demonstration diskettes, diskettes from friends and coworkers, and your diskettes after they have been used in another computer.

Related Topics


Making regular backups

Some viruses may leave certain disks or files unusable even after they are cleaned. Between 10% and 20% of all infections involve files that are corrupted beyond repair.

To increase your chance of recovery, periodically back up all files located on hard disks onto clean backup media. Scan the backup program disk first to ensure that the backup program itself is not infected. Do not run the backup program if it is infected.

Although some of the backed-up files may be infected, it is better to have current copies than none at all. However, do not overwrite previous backup disks or tapes, which may be uninfected.

Related Topics


Saving Settings
To Save Settings

1.	Select desired settings in the provided tabs.

2.	Choose Save Settings from the File menu.

Tips

To rename a Settings file from within Explorer, select the desired file and choose Rename from the File menu.

To launch VirusScan from within Explorer, double click on a Settings file.

To initiate a scan from login, copy or save a Settings file into your StartUp folder.

Related Topics


Printing Log Files
To print Log Files

Do one of the following to print a log file:

Launch Notepad and open desired log file

or

Double click on the desired log file icon in Explorer

Tips

Log files can be viewed or printed from the context menu.


What to do if Scan deleted an infected file

Restore file from backup,

or

Reinstall program containing deleted file from a set of virus free installation diskettes.

Related Topics


Program name, version and serial number can be obtained from the About {Product Name} dialog. Choosing Help |About displays the product-specific dialog.


Brand and model of your computer can be found in your User's Manual or on the back panel of the computer.


Launching MSD

1.	Choose Start | Run.

2.	Type MSD in the provided text box.

3.	Choose OK.

The MSD console is displayed.

4.	Select File | Print Report.

5.	Select the Report All check box.

6.	Select the Print to file check box and enter a file name in the provided text box.

7.	Choose File | Exit to return to your desktop.


Information about your computer and the product can be sent to Network Associates by mail, fax or modem.


Contact Network Associates electronic Bulletin Board System (BBS) at (408) 988-4004.

Our multi-line BBS is accessible 24 hours a day, 365 days a year, except for scheduled downtime and maintenance. All lines run high-performance modems operating from 1,200 bps to 28,800 bps with line settings of 8 data bits, no parity, and 1 stop bit.


People or organizations authorized to provide service, sales, and support for Network Associates products in 50+ countries around the world.

See AGENTS.TXT for a current list of Network Associates agents.


We sponsor the Network Associates Virus Help Forum on CompuServe. To access, type GO MCAFEE at any CompuServe prompt. A free introductory membership is available through CompuServe.


Network Associates provides technical support and product updates through America Online. The keyword for accessing the Network Associates area is MCAFEE. If you have questions, please send e-mail to MCAFEE.


Gathering System Information with Device Manager
To Save system information using Device Manager

1.	Click here [image] to start Device Manager.

2.	Click Print button to print or save information to a file.


temp


Initiates scanning for viruses.


Terminates scanning for viruses.


Resets all options to defaults. If you click this button,  previous scan options will be cleared.


Displays where Scan will begin scanning for viruses. To specify a different location, choose Browse.


Click here to specify where you want Scan to begin its search for viruses.


Selecting this option instructs Scan to search for viruses in all the subfolders within your main folder.


Selecting this option instructs Scan to search for viruses inside every file it finds.


Selecting this option instructs Scan to only search for viruses inside program files.


Instructs the on-demand scanner to search for viruses inside files compressed with PKZIP, PkLite, LHA, LZEXE and Microsoft CAB.


Click here to specify  program file extensions.


Use this field to specify the action to be taken when a virus is found.


Selecting this option instructs Scan to display a custom message upon virus detection.  For the message to be displayed, the Action option must be set to Prompt for action.


Enter the desired message to be displayed upon virus detection.


Selecting this option instructs Scan to sound an alert upon virus detection.  Alert sounds at end of scan.


Selecting this option instructs Scan to log the names of the infected files.


Enter the desired log file in the provided text box.


Selecting this option instructs Scan to create and maintain a log file no larger than the size specified.  Deselect this option for unlimited log file size.


Enter the desired size in the provided spin box.


Select this option to send alerts to the Alert Manager. To configure Alert Manager settings, click Start, point to Programs, then select Alert Manager from the McAfee menu.


Click here to add another program file extension.


Click here to delete the selected extension.


Click here to use Scan default program file extensions.


Click here to clean the virus from the file.


Enter new program file extension here.


Click here to delete infected file.


Click here to move the infected file to another directory.


Displays the filename in MS-DOS format.


Displays the infected file name.


Displays the infected file type.


Displays the virus name(s).


Displays the virus name(s).


Click here to continue scanning.


Displays the infected file size.


Click here to abort scanning.


Displays the size of the virus.


Displays the file location.


Displays what kind of objects the specified virus usually infects.


Displays the date that the file was created.


Indicates the date that the information in this file was last changed.


Indicates the date that this file was last opened.


Indicates whether the selected file is read-only; meaning it cannot be changed or accidentally deleted.


Indicates whether the selected file is hidden; meaning that you cannot see or use it unless you know its name.


Indicates whether the selected file should be archived. Some programs use this option to control which files are backed up.


Indicates whether the selected virus is polymorphic.


Indicates whether the selected file is a system file. System files are required by Windows in order to run properly, and by default are not shown in folder listings. Do not delete system files.


Indicates whether the selected virus can be removed.


Indicates whether the selected virus is memory resident.


Indicates whether the selected virus is encrypted.


Click here to select file to be used for logging.


Adds a notification alert recipient.


Enter the modem’s maximum baud rate.


Opens the Browse dialog box where you can select a computer.


Opens the Browse dialog box where you can select a printer to receive notifications.


Enter the amount of time between dialing the phone number and sending the message.


No help topic is associated with this item.


No help topic is associated with this item.


Lists currently configured alert recipients.


Enter any prefix required to get an outside line (eg: 9).


Selects Pulse dialing.


Enter any necessary suffix (eg: password).


Selects Tone dialing.


Enables SNMP. For more information on SNMP, refer to the operating system user's manual.


Enter the name of the email message sender.


Enter the pager ID.


Enter the Login name for the server.


Enter the message to send on detection of a virus.


Opens the Modem Settings dialog box where you can configure the modem.


Enter the modem brand and model. If your modem is not listed, select a generic modem.


Enter the pager password (if applicable).


Enter the COM port where the modem is attached.


Sets the priority level for the selected alert notification. To set the alert for low, medium, and high priority alerts, select Low. To set the alert for medium and high priority alerts, select Medium. To set the alert for high priority alerts only, select High.


Displays the properties for the selected alert notification item.


Select the type of pager to receive notifications (alphanumeric or numeric).


Enter the e-mail address of the message recipient.


Removes the selected alert notification item.


Enter the amount of time between dialing the phone number and sending the message.


Enter the name of the server.


Enter the pager ID.


Enter a custom message.


Opens the SMTP (Simple Mail Transfer Protocol) configuration dialog box.


Configures SNMP. Refer to Windows NT documentation for more information.


Enter the pager password (if applicable).


Turns the modem speaker off.


Enter the amount of time between dialing the phone number and sending the message.


Sets the priority level for the selected alert notification. To set the alert for low, medium, and high priority alerts, select Low. To set the alert for medium and high priority alerts, select Medium. To set the alert for high priority alerts only, select High.


Enter an E-mail Subject line.


Tests the alert notification.


When selected, the pager receives the default alert message.


When selected, the pager receives the custom message shown below.


Enter the maximum number of characters that can be sent to the pager.


Select the modem parity settings.


 Pager page

The Alert Manager supports the sending of alert notifications to pagers. To send alert notifications to pagers, complete the following procedure:

1	Click Add.

2	Select the type of pager:

  Alphanumeric pager

  Numeric pager

Note

•	To send pager notifications, a modem must be installed in the NetShield server. If the server does not have a modem, send a Forward to a modem-equipped NetShield server.


Alphanumeric pager

To configure an alphanumeric pager:

1	Enter the pager phone number, enter an ID or a PIN number (if applicable), and enter a password (if applicable).

2	To use the standard alert message, click the Use standard alert message option button.

3	To use a custom message, click the Use custom alert message option button and enter a message in the following field.

4	To configure the modem settings, click Modem.

5	To test the pager, click Test.

6	To set the priority level of alert notifications this pager receives, click Priority Level.

7	Click OK.

8	To add another pager to receive notifications, click Add.

9	To configure other notification options, select another property page. To save the changes and exit, click OK. To cancel any changes, click Cancel.


Numeric pager

To configure a numeric pager:

1	Enter the pager phone number.

2	Enter a numeric message.

3	Enter the delay time between dialing and sending the alert message.

4	To configure the modem settings, click Modem.

5	To test the pager, click Test.

6	To set the priority level of alert notifications this pager receives, click Priority Level.

7	Click OK.

8	To add another pager to receive notifications, click Add.

9	To configure other notification options, select another property page. To save the changes and exit, click OK. To cancel any changes, click Cancel.


SMTP Page

Enter the server name as an Internet Protocol (IP) address, as a name your local domain name server can recognize, or in Universal Naming Convention (UNC) notation. Click OK to save your changes and return to the E-Mail Properties dialog box.


SNMP


Summary page

This page lists all alert notification items. To view the properties of an alert notification item, select the item and click Properties. To remove an alert notification item, select the item and click Remove.


Priority Alerts
Priority Level

To configure priority settings for the selected alert, drag the slider to the right to send the destination computer fewer, but higher priority, messages. Drag the slider to the left to send the destination computer more alert messages, including lower priority messages.


Network Message

Alert Manager can send the alert messages that NetShield generates to other computers on your network using a standard Windows NT network message. The alert message appears on the destination computer’s screen and requires the recipient to acknowledge it.

To send alerts via network messages, your NetShield server must have the Alerter and Messenger Windows NT services running. The destination computers running Windows NT must have the Messenger service running to receive alert messages. Those running Windows 95 or Windows 3.1x must also be running the WinPopup utility to receive network messages. WinPopup comes with some Windows versions. See your Windows documentation for details.

Use the Network Message property page to send alert notifications via network messages and follow these steps:

1	Open the Alert Manager Properties dialog box.

2	Click the Network Message tab.

3	To update this list, you can:

•	Remove a listed computer. Select one of the destination computers listed, then click Remove.

•	Add a computer to the list. Click Add to open the Network Message Properties dialog box (Figure 7-7), then enter the name of the destination computer in the text box provided. You can enter the computer name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the computer on the network. To choose additional options, continue with Step 4.

•	Change configuration options. Select one of the destination computers listed, then click Properties. Alert Manager opens the Network Message Properties dialog box (Figure 7-7). Change any of the information you want to change in the Computer text box, then continue with Step 4 to learn how to choose new or different configuration options.

4	Click Priority Leve to specify which types of alert messages the destination computer will receive.

5	Click OK to save your changes and return to the Network Message Properties dialog box.

6	Click Test to send the destination computer a test message. The message will appear instantly on the destination computer’s screen and the recipient will need to click OK to acknowledge it. If your recipient does not receive the message, check the Windows NT Event Viewer for an error message.


DMI alerting

Alert Manager and DMI work together to alert the DMI management console instantly of a virus infection. When a virus is detected, DMI immediately generates an alert message for Alert Manager to display on the DMI management console.

Use the DMI property page to generate DMI alert notifications and follow these steps:

Open the Alert Manager Properties dialog box.

1	Click the DMI tab.

2	Click the Enable DMI Usage checkbox. Enable this option on the NetShield servers.

3	Click Priority Level to specify which types of alert messages the destination computer will receive.

4	Click OK to save your changes and return to the DMI dialog box.


What is DMI

DMI (Desktop Management Interface) is an industry interface for keeping track of and monitoring the status of components, including hardware and software, in the computers on your network. For more information about DMI, refer to your Intel documentation or visit the Desktop Management Task Force website at http:\\www.dmtf.org.


Running a program upon alert

Alert Manager can be configured to launch any program or batch file on alert. For example, if your company is using cc:Mail or a special mail package that is not recognized by Network Associates, you could write a batch file to send notifications to your mail package.

Any program launched from Alert Manager runs in the background without a visible user interface.

To configure NetShield to execute a program on alert, follow these steps:

1	Open the Alert Manager Properties dialog box.

2	Click the Execute Program checkbox.

3	Enter the name and path of the program you want NetShield to run upon detecting a virus. You can enter the program name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the program on the network.

4	To execute the program on the first alert event only, click the First Time option button. To execute the program every time an alert event occurs, click the Every Time option button.

5	Click Priority Level to specify which types of alert messages the destination computer will receive.


Logging alerts

Alert Manager can log the alert messages that NetShield generates to other computers on your network in a standard Windows NT Event Log. The alert message appears on the destination computer’s event log and requires the recipient to acknowledge it.

To configure Alert Manager’s Logging options, follow these steps:

1	Open the Alert Manager Properties dialog box.

2	Click the Logging tab. The Recipient list displays a list of all of the computers you have chosen to receive alert logging. If you have not yet chosen any destination computers, this list will be blank.

3	To update this list, you can:

•	Remove a listed computer. Select one of the destination computers listed, then click Remove.

•	Add a computer to the list. Click Add to open the Logging dialog box, then enter the name of the destination computer in the text box provided. You can enter the computer name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the computer on the network.

•	Change configuration options. Select one of the destination computers listed, then click Properties. Alert Manager opens the Logging Properties dialog box. Change any of the information you want to change in the Computer text box. Enter the computer to receive network messages or click Browse to locate the computer.

4	Click Priority Level to specify which types of alert messages the destination computer will receive.


Audible alerts

Alert Manager can use .WAV files to sound an audible alert on your system when NetShield detects a virus. To use this option, your system must have a sound card.

To configure Alert Manager’s Sound options, follow these steps:

1	Open the Alert Manager Properties dialog box.

2	Click the Sound tab.

3	Click the Enable Audible Alerts checkbox.

4	In the text box provided, enter the name of the sound file you want Alert Manager to run when NetShield detects a virus. The sound file must have a .WAV extension. You can enter the file name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the file on your computer.

5	Leave the text box blank to use the default system sound when NetShield detects a virus.

6	Click Priority Level to specify which types of alert messages the destination computer will receive.


Alerting

In addition to automatically responding to viruses (cleaning, deleting, moving, etc.), NetShield may be configured to run a program on alert, maintain information in an event log, and alert personnel by:

forwarding alert messages

printing alert messages

e-mailing alert messages

generating DMI alerts

sending alerts messages to a pager

SNMP

broadcasting  network messages

audible alerting

Centralized Alerting

logging alert messages

NetShield supports the use of any combination of notification methods and multiples of each.


Using Alert Manager

NetShield uses Network Associates’ Alert Manager utility to notify you or others when it detects a virus or malicious code in files on your servers. Alert Manager gives you a wide variety of notification options that you can use individually or in combinations that suit your needs.

If you have Alert Manager installed on other computers on your network, you can also forward alert messages to computers in other domains, which can in turn notify the workstations that they host about infected files on your server.

In large organizations, use Forward to send alerts to centralized notification systems or to MIS departments to keep track of virus statistics and problem areas.


Forwarding alert messages

Alert Manager can forward the alert messages that NetShield generates to other computers on your network. If you have installed Alert Manager on each of the destination computers, they can in turn forward alert messages to the recipients listed in their Alert Manager Summary pages. You might use this feature to pass alert messages across network domains or to construct a hierarchical arrangement for passing alert messages.

To configure Alert Manager’s Forwarding options, follow these steps:

1	Open the Alert Manager Properties dialog box.

2	Click the Forward tab. The Forward page appears with a list of all of the computers you have chosen to receive forwarded messages. If you have not yet chosen any destination computers, this list will be blank.

3	To update this list, you can:

•	Remove a listed computer

•	Add a computer to the list

•	Change configuration options

4	Click Priority Level to specify which types of alert messages the destination computer will receive.

5	Click Test to send the destination computer a test message. The message will appear instantly on the destination computer’s screen and the recipient will need to click OK to acknowledge it. If your recipient does not receive the message, check the Windows NT Event Viewer for an error message.

6	Click OK to return to the Alert Manager dialog box.

Note

•	NetShield must be installed and running on the server receiving forwarded messages.


Remove a listed computer

Select one of the destination computers listed, then click Remove.


Add a computer to the list

Click Add to open the Forward Properties dialog box, then enter the name of the computer that will receive forwarded messages in the text box provided. You can enter the computer name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the computer on the network.


Change configuration options

Select one of the destination computers listed, then click Properties. Alert Manager opens the Forward Properties dialog box. Change any of the information you want to change in the Computer text.


SNMP alerting

The Alert Manager supports the sending of SNMP traps. To enable SNMP, complete the following procedure:

1	Select the Enable SNMP checkbox.

2	To configure SNMP services, click Configure.  The Microsoft NT Network Settings property sheet is displayed.

3	To complete configuration of SNMP services, refer to the network operating system documentation.

4	To configure other notification options, select another property page. To save the changes and exit, click OK. To cancel any changes, click Cancel.


Sending alert messages via e-mail

The Alert Manager supports the sending of email messages. To send alert notifications via email, complete the following procedure:

1	Click Add.

2	Enter an email address, fill out the Subject line, and fill out the From line.

3	To configure SMTP settings, click Configure SMTP and enter the name of the Server and Login.

4	To test the connection, click Test. The message recipient receives a test message.

5	To set the priority level of the messages this email address receives, click Priority Level.

6	Click OK. To add another recipient to receive alert notifications, repeat steps 1 through 5.

To configure other notification options, select another property page. To save the changes and exit, click OK. To cancel any changes, click Cancel.


Modem settings

To configure modem settings, complete the following procedure.

2  Choose the modem brand and model from the drop down list.

3  Select the COM port.

4  Set the maximum baud rate.

5  Select any prefix required to get an outside line.

6  Select tone or pulse dialing.

7	Click OK.


Sending alert messages to a printer

The Alert Manager supports the sending of alert notifications to printers. To send alert notifications to printers, complete the following procedure:

1	Click Add.

2	Click Browse to locate the printer.

3	To test the connection, click Test. The printer prints a test message.

4	To set the priority level of the messages this printer receives, click Priority Level.

5	Click OK.

6	To add another printer to receive alert notifications, repeat steps 1 through 5.

7	To configure other notification options, select another property page. To save the changes and exit, click OK. To cancel any changes, click Cancel.

Note

•	Prior to configuring this notification option, the printer must be configured.


Sending alert messages to a  pager

The Alert Manager supports the sending of alert notifications to pagers. To send alert notifications to pagers, complete the following procedure:

1	Click Add.

2	Select the type of pager:

  Alphanumeric pager

  Numeric pager

Note

•	To send pager notifications, a modem must be installed in the NetShield server. If the server does not have a modem, send a Forward to a modem-equipped NetShield server.


SMTP settings

Enter the server name as an Internet Protocol (IP) address, as a name your local domain name server can recognize, or in Universal Naming Convention (UNC) notation. Click OK to save your changes and return to the E-Mail Properties dialog box.


Viewing the alert summary

The Summary page lists all of the alert methods you’ve told NetShield to use to notify you when it finds a virus or other malicious code on your NetShield server. Click +  next to each listed alert method to display the computers, printers, phone numbers, or e-mail addresses that will receive alert messages from NetShield. To remove an alert method, select it, then click Remove. To change the configuration options for a listed method, select it, then click Properties. Alert Manager will open the same property page you used to configure your options for that alert method.


Centralized Alerting

Centralized Alerting is a powerful feature for alerting the appropriate personnel of workstation virus activity. Once Centralized Alerting is enabled and configured, workstations using Network Associates client antivirus software, such as VirusScan, report virus activity to NetShield servers. NetShield then notifies the appropriate personnel (through pagers, printers, e-mail, fax, etc.) listed in the Alert Manager Summary property page.

See also

  How Centralized Alerting works

  Configuring Centralized Alerting

  Centralized Alerting file format


How Centralized Alerting works

The NetShield server is configured to monitor an Alert Folder where all users have create, write, and delete rights. When a virus event occurs on a workstation, the workstation sends a Centralized Alerting file to the server’s Alert Folder. The server then reads the file and notifies the appropriate personnel specified in Alert Manager.

See also

  Configuring Centralized Alerting

  Centralized Alerting file format


Centralized Alerting file format

The .ALR file is a text file that contains Centralized Alerting virus event variables. Each variable in the file has a name followed by the equal (=) sign and a value.  The following is a line-by-line description of the Centralized Alerting ALR file format:

Variable	Description
[CentralAlert]	Centralized Alerting identifier.
uFileVersion	Type: Integer Centralized Alerting version number.
uStatus	Reserved
szVirusName	Type: String  The name of the virus.
szItemName	Type: String The infected file name and path.
szUserName	Type: String The user name.
szSoftware	Type: String The name of the Network Associates virus application installed on the reporting machine.
szSoftwareVersion	Type: String  The version of the virus application.
szComputerName	Type: String  The name of the machine reporting the event.
uYear	Type: Integer (0000-9999)  The year of the event.
uMonth	Type: Integer (1-12) The month of the event.
uDay	Type: Integer (1-31)  The day of the event.
uHour	Type: Integer (0-23) The hour of the event.
uMinute	Type: Integer (0-59)  The minute of the event.
uSecond	Type: Integer (0-59) The second of the event.


Configuring Centralized Alerting

1	To configure Centralized Alerting, follow these steps:

2	Select Alerts from the Tools menu.

3	Select Enable Centralized Alerting (in most cases, Centralized Alerting is enabled by default).

4	Enter the location of the Alert Folder in the text box provided. You can click Browse to locate the Alert folder on the network. The default Alert folder is located in C:\Program\Mcafee\NetShield\Alert. All users must have create, write, and delete rights to the Alert Folder.

5	Click OK.

6	Configure the desktop machines which will report virus activity. For more information, refer to the documentation which accompanied VirusScan.


Enabling and disabling alerts

To enable and disable alerts, complete the following procedure.

1	Select Alerts from the Tools menu and click the Messages tab.

2	To enable an alert, select its checkbox.

3	To disable an alert, deselect its checkbox.

4	To save the changes and exit, click OK. To exit without saving changes, click Cancel.

See also

  Changing the priority of an alert

  Customizing an alert message

  Alert message variables


Changing the priority of an alert

To change the priority level of an alert, follow these steps:

1	Select Alerts from the Tools menu and click the Messages tab.

2	Highlight an alert and click Edit.

3	Select a priority level.

4	Click OK.

See also

 Customizing an alert message

  Alert message variables

  Enabling and disabling alerts


Customizing an alert message

While an alert message can be customized, the reason for the alert does not change (e.g. when a task starts, the ‘task has started’ message is generated). Be careful not to modify the meaning of the alert message. Otherwise, notifications may become confusing or erroneous.

To customize an alert message, follow these steps:

1	Select Alerts from the Tools menu and click the Messages tab.

2	Highlight an alert and click Edit.

3	Enter a custom message in the text field.

4	Click OK.

See also

  Alert message variables

  Changing the priority of an alert

  Enabling and disabling alerts


Alert Message variables

Alert messages generated by NetShield may contain following variables:

Variable	Description
%FILENAME%	Name of the infected file
%TASKNAME%	Name of the task that detected the virus
%VIRUSNAME%	Name of the virus
%DATE%	Date of the event
%TIME%	Time of the event
%COMPUTERNAME%	Name of the infected computer
%SOTWARENAME%	Name of the software that detected the virus
%USERNAME%	Name of the local user
%SOFTWAREVERSION%	Version number of the software that detected the virus


What is a computer virus?

A software program which attaches itself to another program on a disk or lurks in a computer’s memory and spreads from one program to another.

In addition to self-replication, viruses have the capability to damage data, cause computers to crash, and display offending or bothersome messages.

See also

  Boot virus

  File virus

  Macro virus

  Stealth virus

  Multi-partite virus

  Mutating virus

  Encrypted virus

  Polymorphic virus

  Related Topics


Boot virus
What is a boot virus?

A boot virus copies itself from the boot sector of one drive to another (e.g.: floppy drive to hard drive).


File virus
What is a file virus?

A file virus attaches itself to a program. Whenever the program runs, the virus attaches itself to other programs.


Stealth virus
What is a stealth virus?

A stealth virus hides itself to evade detection. It stealth virus may be a boot virus or a file virus.


Multi-partite virus
What is a multi-partite virus?

A multi-partite acts like a boot virus and a file virus by spreading through boot sectors and files.


Mutating virus
What is a mutating virus?

Mutating viruses change their shape to avoid detection. Many mutating viruses are also encrypted viruses.


Encrypted virus
What is an encrypted virus?

Encrypted viruses encrypt part of their code to avoid detection. Many encrypted viruses are also mutating viruses.


Polymorphic virus
What is a polymorphic virus?

Polymorphic viruses are similar to mutating viruses. Upon each instance of copying itself, it slightly changes its code to avoid detection.


Why do I need to scan for viruses?

In today’s environment, Safe Computing Practices are no longer a luxury - they are a necessity.

Computer viruses no longer attack your computing environment exclusively. They attack all computing environments you are in contact with through diskettes, networks, modems, and even the Word file you gave to a coworker to edit.

Consider the value of the data on your computer. It is probably irreplaceable or would require a significant amount of time and money to replace. Consider the value of the data on all of the computers you contact, the computers those computers contact, and so on.

Viruses are non-discriminatory. They may damaging something as simple as your high score on Solitaire, or something as important as the novel you spent years writing.

Network Associates’ virus scanning solutions should top the list of your safe computing practices. Scheduled periodic scans of your computer offers added assurance you are practicing safe computing.

  Related Topics}

{bmc endlogo2.bmp


Major features and benefits of VirusScan
VirusScan Features

Superior detection

•	NCSA-certified scanner assures detection of 100% of viruses found “in the wild.” See the NCSA website, www.ncsa.com .

•	VirusScan employs Hunter engine technology for pinpoint virus identification accuracy.

•	On-access (inbound and outbound) scanning provides real-time identification of both known and unknown viruses upon file access, create, copy, rename, and run; disk access; system startup; and system shut down.

•	On-demand scanning provides for user-initiated detection of known boot, file, mutating, macro, stealth, and encrypted, viruses located within files, drives, and diskettes.

Automated protection

•	VirusScan can be configured for an automated response on virus detection including notification, logging, deletion, isolation, or cleaning

•	Supports Windows NT services and file system

•	Flexible scheduling and immediate scanning options

Administrative ease

•	Advanced alerting features include alphanumeric pager, e-mail via SMTP, SNMP, DMI, and NT event logging

•	Centralized alerting and reporting from workstations

•	Scan Wizard assists users in creating new scan tasks

•	AutoUpdate feature allows for immediate or scheduled updating via a central shared location or FTP download

•	The Service Password command-line utility allows administrators to set or change the user ID and passwords used by McAfee Services on one or more systems

•	Monthly updates of virus signatures are included with the purchase of a Network Associates subscription license to assure the best detection and removal rates.


About Network Associates

Founded in 1989, Network Associates Inc. is the leading provider of productive computing tools for DOS, OS/2, UNIX, and Windows environments. Our anti-virus products are used by more than 16,000 corporations worldwide. Our utility products provide data security, automated version updating, and system inspection and editing. Network Associates is also the pioneer and leading provider of electronically distributed software. All of Network Associates’ products may be purchased through dealers or downloaded from bulletin board systems and on-line services around the world.

Network Associates does not stop at developing the world’s best anti-virus and utility products. We back them with the industry's best service and technical support. Product support is provided by a full-time staff of virus researchers, programmers, and support professionals; and delivered directly by Network Associates or our network of more than 150 authorized agent offices in 50+ countries worldwide.


NetShield server software

NetShield for Windows NT is a client-server application with the NetShield server software composing the server end of the relationship and the VirusScan client software composing the workstation end of the relationship. The NetShield server software runs in the background without any assistance. NetShield provides robust virus protection to users who access file and services on this system.

.


AntiVirus Console

Use the AntiVirus Console to configure the on-access task, on-demand tasks, and AutoUpdate tasks

In addition to configuring task functions, the Console can receive information such as statistics and alarm notifications.

See also

  What are tasks?


Tasks
What are tasks?

Tasks are individually configured jobs which are responsible for virus protection and file

updating activities. Each task appears as a separate entry in the AntiVirus Console window.

There are three types of tasks: the on-access task, on-demand tasks, and AutoUpdate tasks.

   Related topics


On-access scan
What is the on-access scan task?

The on-access task monitors files copied to and from your workstation via network connections and floppy diskettes . Use this task to specify what types of files are scanned and how VirusScan responds to infected files.


On-demand scan
What are on-demand scan tasks?

On-demand tasks are drive-scanning tasks. On-demand tasks can be scheduled to automatically scan workstation drives. You may specify what files are scanned, how often a scan takes place, and how VirusScan responds to infected files.


Scheduled tasks
Scheduled on-demand tasks

A scheduled task is an on-demand task configured to run at times specified by you or your administrator.


Creating an on-demand task
To create an on-demand task

1	Click [image] or select New Task from the Scan menu. A new scan task appears in the Console task window.

2	Type in a new name for the task and press ENTER. The task is created and Task Properties  dialog box appears. You are ready to configure this task.

Tip

To quickly create a new task, use the Scan Wizard. To start the Scan Wizard, click [image] or select Scan Wizard from the Scan menu and follow the instructions.

  Related Topics


Configuring an on-demand task
To configure an on-demand task

1	Highlight the task you want to configure in the AntiVirus Console

2	Click [image] or select Properties from the Edit menu.

The Task Properties dialog box appears with the Detection page displayed. You are ready to configure this task.

See also

  Creating an on-demand task

  Adding files to scan

  Setting VirusScan's response to an infection

  Virus logging and reporting

  Scheduling an on-demand task

  Excluding files, folders, and drives from scanning


Overview: Selecting files to scan

VirusScan offers flexibility in choosing files to scan. By adding drives, folders, or specific files, you can configure a scan to be very focused on a small number of drives or folders that are very susceptible to viruses or you can configure a wide scan to search the entire network.

In addition to searching specific drives, Scan can check all files or only specified file types that are more susceptible to viruses. Setting Scan to check specified file types results in faster scanning.

Tip

•	A good strategy for protecting your network is to focus highly susceptible areas (Intranets, download directories, and areas with a lot of file activity) to frequent scans and perform complete network scans on a more infrequent basis.

  Related Topics


Adding files to scan
To add files to scan

1	Select the detection page from the Task Properties dialog box.

2	Click Add.

3	Select the files to scan.

To scan all local drives, select All Local Drives.
To scan specific drives and folders, select Drive or Folder.

To scan a specific file, select File.

4	Enter the path to the drive, folder , or file to scan or click Browse to navigate to the item. Click OK. The new item appears in the Detection window.

5	Repeat Steps 1 through 4 until all scan items are entered.

6	Select the types of files to scan. To scan all file types, click the All Files radio button. To scan files with specific extensions, click the Program Files Only radio button.

7	To include the scanning of subfolders, check Include Subfolders.

8	To include scanning of compressed files, check the Compressed Files checkbox.

9	To further configure this task, select another properties page. To save the changes and  return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Editing Scan items
To edit a scan item

1	Select the Detection page from the Task Properties  dialog box.

2	Highlight an item and click Edit.

3	Select the files to scan.

To scan all local drives, select All Local Drives.
To scan specific drives and folders, select Drive or Folder.

To scan a specific file, select File.

4	Enter the path to the drive,  folder, or file. Click Browse to navigate to the item.

6	Click OK. The edited item appears in the Detection window.

7	To further configure this task, select another properties tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Deleting Scan items
To delete a scan item

1	Select the Detection page from the Task Properties dialog box.

2	Highlight the Scan item to delete and click Remove.

3	To add items, click Add.

  Related Topics


Setting how VirusScan responds to a virus

1	Select the Action page from the Task Properties dialog box.

2	Set how VirusScan responds to an infected file:

  Move infected files to a folder

  Continue scanning

  Clean infected files automatically

  Delete infected files automatically

  Related Topics


Overview: Setting how Scan responds to a virus

You can configure VirusScan to respond to infected files by prompting you for action, by relocating the infected file to a quarantine folder, continuing to scan and taking no action, by cleaning them, or by deleting them.

Note

•	You may choose only one of these options.

  Related Topics


Continues Scanning
To instruct VirusScan to continue scanning without taking any action

Select Continue Scanning to instruct VirusScan to continue with the scan without taking any action.

Note

•	This is not a recommended option. If used, make sure to use alert notification. Otherwise, VirusScan ignores any viruses encountered.


Cleans the infected file
To instruct VirusScan to automatically clean infected files

1	Select Clean Infected Files.

2	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes, click Cancel.

Note: If this option is selected, VirusScan changes the infected file extension to .VIR. Confirm that report logging is enabled to ensure you have a record of which files were locked so you can clean them or restore them from backups.


Deletes the infected file
To instruct Scan to automatically delete infected files

Select Delete Infected File to configure VirusScan to delete infected files as soon as it detects them. If you select this option, confirm that activity logging is enabled. This will ensure you have a record of which files were deleted, so you can restore them from backups.


Overview: Scheduling a task

Scan offers a very flexible scheduling interface which allows customization of scans to fit your  needs. Scans can be configured to occur one time only, once an hour, once a day, once a week, once a month, or transparently at system startup.

  Related Topics


Scheduling a task
To Schedule a task

1	Select the Schedule page from the Task Properties  dialog box.

2	Check the Enable Scheduler checkbox.

3	Select the type of schedule to configure.

  One time task

  Hourly task

  Daily task

  Weekly task

  Monthly task

  Task that runs at system startup

  Related Topics


One time task
To schedule a one time task

1	Click the Once radio button.

2	Enter the month, day, and time to start the task.

3	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Hourly task
To schedule an hourly task

1	Click the Hourly radio button.

2	Set the task to start X minutes after the hour where X is a number between 0 and 59. For example, to instruct Scan to begin the task 30 minutes after every hour, type in ‘30’.

3	To further configure this task, select another properties page. To save the changes and      return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Daily task
To schedule a daily task

1	Click the Daily radio button.

2	Click the Which Days button. The Select Days dialog box appears.

3	Select which day(s) the task runs (i.e. Sunday, Monday, etc.) and click OK.

4	Enter the time to start the task in the Start At field.

5	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Weekly task
To schedule a weekly task

1	Click the Weekly radio button.

2	Enter the day and time to start the task.

3	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Monthly tasks
To schedule a monthly task

4	Click the Monthly radio button.

5	Enter the day of the month and time to start the task.

6	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Task that runs at Startup
To schedule a task that runs transparently at startup

1	Click the At Startup radio button. This tells VirusScan to perform a scan every time the system is started.

2	    To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the console, click Cancel.


Overview: Excluding files and folders from scanning

Scan may be configured to exclude specified folders or files from scanning.

Tip

•	Configure Exclusions to exclude read-only directories, data files, restricted areas where risk of infection is low, and quarantine areas.

  Related Topics


Adding a file or folders to exclude
To add a file or folder to exclude

1	Select the Exclusions page from the Task Properties  dialog box.

2	To select files or folders to exclude from scanning, click Add. The Exclude Item dialog box appears.

3	Enter the path to the file or folder or click Browse to select a folder.

4	To exclude subfolders from scanning, check the Include Subfolders checkbox.

5	To exclude the item from file scanning, make sure the File Scanning checkbox is checked.

6	To exclude the item from boot record scanning, check the Boot Record Scanning checkbox.

7	Click OK.

8	Repeat Steps 2 through 6 until all exclude items are entered.

9	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Editing an exclude item
To edit an exclude item

1	Select the Exclusions page from the Task Properties  dialog box.

2	Highlight the exclude item and click Edit.

3	Enter a new path to a file or folder or click Browse to select a folder.

4	To exclude subfolders from scanning, check the Include Subfolders checkbox.

5	To exclude the item from file scanning, make sure the File Scanning checkbox is checked.

6	To exclude the item from boot record scanning, check the Boot Record Scanning checkbox.

7	Click OK.

8	To add an exclude item, click Add.

9	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Deleting an exclude item
To delete an exclude item

1	Select the Exclusions page from the Task Properties  dialog box.

2	Highlight the exclude item to delete and click Remove.

3	To add an exclude item, click Add.

4	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Overview: Creating a virus activity log file

If enabled, VirusScan keeps a virus activity log file. The log file keeps records of virus activity such as virus detection, virus cleaning, and infected file deletion. You may also choose to append information to the log such as the session settings, the session summary, the date and time, and the user name.

Tip

•	To limit the size of the log file, select the limit log file size option and set the maximum size.

  Related Topics


Creating a virus activity log file
To create a virus activity log file

1	Select the Reports page from the Task Properties  dialog box.

2	Check the Log to File checkbox. The default log file location is C:\Win32app\VirusScan\ActivityLog.txt. Click Browse to choose a different location.

3	To limit the size of the log file, check the Limit Size checkbox and enter the maximum file size (in kilobytes).

4	Choose the type of activity to include in the log file. To include an activity, check its checkbox.

5	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Creating the on-access task
To create the on-access task

The on-access task appears in the Console window and is preceded by a shield( [image]). The on-access task cannot be created or deleted. To configure the on-access task, see Configuring the on-access task.

  Related Topics


Configuring the on-access task
To configure the on-access task

1	Highlight the on-access task.

2	Click [image] or select Properties from the Edit menu.

The VirusScan Properties dialog box appears with the Detection page displayed. You are ready to configure this task.

  Related Topics


Overview: Selecting files and file types to scan

When configuring the on-access task, be sure to check both Inbound and Outbound checkboxes.

Tip

•	To improve scan performance, configure VirusScan to only check specified file types which are likely to be infected (.EXE, .COM, DO?, .XL?, .SYS, .BIN, .RTF, .OBD).

  Related Topics


Selecting files and file types to scan
To select files and file types to scan

1	Select the Detection page from the VirusScan Properties dialog box.

2	Check the Inbound Files and the Outbound Files checkboxes.

3	Select the types of files to scan:
To scan all files, click the All Files radio button.
To scan files with specific extensions, click the Program Files Only radio button.

4	To include checking of compressed files, check the Compressed Files checkbox.

5	Select the Enable On-Access Scanning at System Startup checkbox to tell VirusScan to automatically start scanning each time the computer is started.

Note: To manually start or stop the VirusScan service, use the Services Manager located in the Control Panel. For more information, refer to the documentation that accompanied Microsoft NT. Select the Users Are Allowed To Disable VirusScan checkbox to allow disabling of the on-access task from the AntiVirus Console.

6	Select the Enable File Scan Caching checkbox to improve over-all on-access scanning performance of VirusScan. When this option is enabled, VirusScan will only scan files the first time they are accessed after the system or Task Manager is restarted. If a file in the cache is modified, VirusScan will rescan the file.

7	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Program Files

Program files are file types which are most susceptible to viruses. By default, program files include files with the following extensions:

.EXE

.COM

.SYS

.DO?

.XL?

.SYS

.BIN

.ODB

.RTF

Note: It uses the extensions .DO?, and .XL? to identify Microsoft Word and Excel document and template files, which can contain macro viruses. The ? character is a wildcard.

1	To add additional file types, click the Program Files Only radio button and click Program Files.

2	Click Add.

3	Enter a new extension to scan and click OK.


Overview: Setting how VirusScan reponds to a virus
Overview: Setting how VirusScan responds to a virus

VirusScan can prevent the spread of an infection by automatically cleaning, deleting, relocating or denying access to infected files.

Note

•	You may choose only one of these options.

  Related Topics


Setting how VirusScan reponds to a virus
To set how VirusScan reponds to a virus

1	Select the Action page from the VirusScan Propertiesdialog box.

2	Select how VirusScan responds to an infected file.

  Cleans the infected files

  Deletes the infected files

  Moves the infected files to a folder

  Denies access to the infected files

  Related Topics


VirusScan cleans the infected files
To clean infected files

Select this option to clean infected files automatically. If a virus cannot be removed from a file or the file is damaged beyond repair, VirusScan automatically denies access to the file. If this occurs, delete the file and restore the original from backups.

  Related Topics


VirusScan deletes the infected files
To delete infected files

Choose this option to tell VirusScan to delete infected files as soon as it detects them. If you select this option, confirm that activity logging is enabled. This will ensure you have a record of which files were deleted, so you can restore them from backups.

  Related Topics


VirusScan moves the infected files to a folder
To move infected files to a folder

Select this option to tell VirusScan to move infected files to a “quarantine” folder. Enter the name of the quarantine folder that will receive forwarded messages in the Folder To Move To text box. You can enter the folder name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the folder on the network.

  Related Topics


VirusScan denies access to the infected files
To deny access to infected files

This option is recommend for systems left unattended. If this option is selected, VirusScan denies user access to the infected files existing on the workstation and appends infected files written to the workstation with a .VIR extension.

Confirm that report logging is enabled. This will ensure you have a record of which files were locked, so you can clean them or restore them from backups.

  Related Topics


Overview: Excluding files from scanning

Scan may be configured to exclude specified folders or files from scanning.

Tip

•	If you set VirusScan to move infected files to a folder, exclude the folder from scanning.

  Related Topics


Excluding files from scanning
To add a file or folder to exclude from scanning

1	Select the Exclusions page from the VirusScan Properties dialog box.

2	To select files or folders to exclude from scanning, click Add. The Exclude Item dialog box appears.

3	Enter the path to the file or folder or click Browse to select a folder.

4	To exclude subfolders from scanning, check the Include Subfolders checkbox.

5	Be sure the Inbound Files and Outbound Files checkboxes are checked.

6	Click OK.

7	Repeat Steps 2 through 6 until all exclude items are entered.

8	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Editing an exclude item
To Edit an exclude item

1	Select the Exclusions page from the VirusScan Properties dialog box.

2	Highlight the exclude item and click Edit.

3	Enter a new path to a file or folder or click Browse to select a folder.

4	To exclude subfolders from scanning, check the Include Subfolders checkbox.

5	Be sure the Inbound Files and Outbound Files checkboxes are checked.

6	Click OK.

7	To add an exclude item, click Add.

8	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Deleting an exclude item
To delete an exclude item

1	Select the Exclusions page from the VirusScan Properties dialog box.

2	Highlight the exclude item to delete and click Remove.

3	To add an exclude item, click Add.

4	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Overview: Creating a virus activity log file

If enabled, VirusScan keeps a virus activity log file. The log file keeps records of virus activity such as virus detection, virus cleaning, infected file deletion, and infected file move. You may also choose to append information to the log, such as: the session settings, session summary, date and time, and the user name.

Tip

•	To limit the size of the log file, select the limit log file size option and select the maximum size.

  Related Topics


Creating a virus activity log file
To create a virus activity log file

1	Select the Reports page from the VirusScan Properties dialog box.

2	Check the Log to File checkbox. The default log file location is C:\Program Files\McAfee\VirusScan\VirusScanActivityLog.txt. Click Browse to choose a different location.

3	To limit the size of the log file, check the Limit Size checkbox and enter the maximum file size (in kilobytes).

4	Choose the type of activity to include in the log file. To include an activity, check its checkbox.

5	To further configure this task, select another properties page. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Setting VirusScan to load at startup

This option automates virus protection. When enabled, the McAfee Task Manager Service automatically starts at system startup.

1	Select the Detection page from the VirusScan Properties dialog box.

2	Check the Enable On-access Scanning at System Startup checkbox.


To allow disabling of the on-access task

Normally, the on-access task cannot be disabled from the Console. To allow disabling of the task:

1	Select the Detection page from the ScanConfig properties sheet.

2	Check the Users are Allowed to Disable VirusScan checkbox.


Viewing the status of a scan
To view the status of a scan

Choose a task to view and double-click the task.

The Statistics screen appears. From this screen you can watch the status of a scan including information on the number of files scanned and the number of infected files encountered.


Copying tasks to another computer

To quickly configure multiple computers and save time, VirusScan supports the copying and pasting of tasks. To copy a task to another computer, complete the following procedure.

1	Highlight the task you want to copy and click the Copy button or select Copy from the Edit menu.

2	Connect to the computer where you want to copy the task.

3	Click [image] or select Paste from the Edit menu.
The task is copied and appears as New Scan Task in the Console window.

4	Enter a name for the task and press ENTER.
The Task Properties  dialog box appears.

5	Make any necessary changes to the task and click OK.

Note

•	Only on-demand tasks may be copied. The on-access task cannot be copied.

  Related Topics


Starting a task on another computer
To start a task on another computer

1	Connect to another computer.

2	Highlight a task and click [image] or select Start from the Scan menu.
“Running” appears under “Status” in the Console window.

3	To watch the progress of the Scan, double-click the task or select Statistics from the Scan menu.
The Statistics screen appears.

  Related Topics


Overview: Using AutoUpdate to keep VirusScan updated

Network Associates’ AutoUpdate program is a powerful updating utility that can ensure you have the latest VirusScan files installed. AutoUpdate can automatically retrieve the latest VirusScan files from Network Associates’ FTP site or a local network computer and overwrite old VirusScan files on your network. Use the AutoUpdate tasks to automate and customize the updating process.

Network Associatesoffers two AutoUpdate tasks to keep your VirusScan files up-to-date:

Automatic DAT Update

Automatic Product Upgrade

Both AutoUpdate tasks appear in the Console task window preceded by [image].

  Related topics


Obtaining Updates from Network Associates

New viruses are discovered at a rate of more than 200 a month. Often, these viruses are not detected using older versions of virus detection products or virus signature (DAT) files. The DAT files that came with your copy of VirusScan may not detect a virus that was discovered after you bought the product. As new viruses are discovered, Network Associatesupdates these data files to detect new viruses on a monthly basis. Network Associatesrecommends that you update your data files and product on a regular basis to prevent infection from new viruses.

To update your VirusScan files regularly and conveniently, use any of the following methods:

AutoUpdate. Use Network Associates’ automatic update utility to update your files automatically and invisibly. To learn more, click here

Network Associates electronic services. Connect to any of the electronic services, including the Network Associates Web Site and Network Associates BBS to update your files. To learn more, click here

  Related Topics


Obtaining Updates from distribution points
To obtain Updates from distribution points

1	    Select AutoUpdate from the Tools menu.The AutoUpdate dialog box appears with the Update Options page appears.

2	Click the Copy from a Local Network Computer radio button. Then enter the name of the computer that AutoUpdate will copy the files from in the text box provided. You can enter the computer name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the computer on the network.

3	   To perform the update now, click Update Now.

4	   To schedule this script, click the Schedule tab.

  Related Topics


Scheduling AutoUpdate tasks

1	Select AutoUpdate from the Tools menu.

2	Configure the AutoUpdate options on the Update Options or Upgrade Options page.

3	Click the Schedule button.

4	Check the Enable Scheduler checkbox.

5	Determine how often the AutoUpdate task will run.

  One time update

  Hourly update

  Daily update

  Weekly update

  Monthly update

  Update that runs at system startup

  Related Topics


To schedule a one time update

1	Click the Once radio button.

2	Enter the month, day, and time to start the update.

3	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


To schedule a hourly update

1	Click the Hourly radio button.

2	Set the update to start X minutes after the hour where X is a number between 0 and 59. For example, to instruct Scan to begin the update 30 minutes after every hour, type ‘30’.

3	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


To schedule a daily update

1	Click the Daily radio button.

2	Click the Which Days button.The Select Days dialog box appears.

3	Select which day(s) the update runs (ie: Sunday, Monday, etc.) and click OK.

4	Enter the time to start the task in the Start At field.

5	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


To schedule a weekly update

1	Click the Weekly radio button.

2	Enter the day and time to start the update.

3	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


To schedule a monthly update

1	Click the Monthly radio button.

2	Enter the day of the month and time to start the update.

3	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


To schedule an update that runs transparently at Startup

1	Click the At Startup radio button. This tells AutoUpdate to download VirusScan files every time the Network Associates service is started.

2	For further configuration, click the Update Location tab. To save the changes and return to the Console, click OK. To cancel any changes and return to the Console, click Cancel.

  Related Topics


Viewing the Summary page

The Summary page lists all alert notification items.

From this page, view the properties or remove an alert notification item.

  Related Topics


Online access to updates

Approximately once a month, Network Associates updates VirusScan to add new virus detectors, new options, and fix reported bugs. To distribute these new versions, a multi-line bulletin board system, a forum on CompuServe, and an Internet node are available.

  Network Associates bulletin board system (BBS)

  Network Associates Forum on CompuServe

  Internet Access


Network Associates bulletin board system (BBS)

Our multi-line BBS is accessible 24 hours a day, 365 days a year, except for scheduled downtime and maintenance. All lines run high-performance modems operating from 1,200 bps to 28,800 bps with line settings of 8 data bits, no parity, and 1 stop bit. The Network Associates BBS phone number is (408) 988-4004.


Network Associates Forum on CompuServe

We sponsor the Network Associates Virus Help Forum on CompuServe. To reach it, type GO MCAFEE at any CompuServe prompt. A free introductory membership is available. For more information, please read the enclosed COMPUSER.TXT file.


Internet Access

The latest versions of Network Associates’ anti-virus software are available by anonymous ftp (file transfer protocol) over the Internet from the site ftp.mcafee.com. Enter anonymous or ftp as your user ID and your own e-mail address as the password. Programs are located in the pub/antivirus directory. If you have questions, please send e-mail to support@mcafee.com.

Network Associates’ anti-virus software is also available on the SimTel Software Repository at Oak.Oakland.EDU in the simtel/msdos/virus directory and its associated mirror sites:

wuarchive.wustl.edu (US).

ftp.switch.ch (Switzerland).

ftp.funet.fi (Finland).

src.doc.ic.ac (UK).

archie.au (Australia).


Preventing viruses

Although VirusScan is designed to offer the highest degree of virus protection, detection and eradication available, no anti-virus program can stop all computer viruses. Even with frequent updates, new viruses currently appear at a rate of three to four a day, and this number may grow even higher in the future.

Keeping your anti-virus software current is one way to prevent the overwhelming majority of computer viruses from infecting your system. However, following the steps listed below can greatly reduce the chance of becoming infected.

Never boot your PC with a floppy diskette in Drive A:

Although boot viruses only account for approximately 10% of the total number of computer viruses, they account for over 90% of reported virus infections. All formatted diskettes, even data diskettes, contain a boot sector the computer attempts to execute when started. Even if this attempt is unsuccessful, a virus in the boot sector is read into memory and executed, at which point it can infect the hard disk.

Use software only from reputable sources

When purchasing commercial software, be sure the software is in its original packaging and was not previously used and returned.

When using BBSs, check with the Systems Operator about their scanning procedures. Many System Operators scan for viruses before making files available for downloading.

Most commercial electronic services such as CompuServe and America Online scan files for viruses before making them available for downloading.

Scan all incoming disks and files for viruses

Scan all diskettes and files you receive for viruses before using them. This includes: purchased programs, downloaded programs, demonstration diskettes, diskettes from friends and coworkers, and your diskettes after they have been used in another computer.

  Related Topics


Making regular backups

Some viruses may leave certain disks or files unusable even after they are cleaned and some infections involve files which are corrupted beyond repair.

To increase your chance of recovery, periodically back up all files located on hard disks onto clean backup media. Scan the backup program disk first to ensure the backup program itself is not infected. Do not run the backup program if it is infected.

Although some of the backed-up files may be infected, it is better to have current copies than none at all. However, do not overwrite previous backup disks or tapes, which may be uninfected.

  Related Topics


Using Windows 95 to administer NetShield

The Console component is designed to run on Windows 95, Windows NT Server,  or Windows NT Workstation.  From Windows 95, you can administer NetWare Servers running VirusScan and/or workstations running VirusScan.

To administer VirusScan from Windows 95:

1	Install the VirusScan Console. See the VirusScan User’s Manual.

2	Select the Console icon in the VirusScan Group.

 3	When prompted, enter the system to administer or click Browse.


VirusScan found a virus

If VirusScan locates a virus, DO NOT panic! VirusScan will react automatically or prompt you to determine the next step, depending on how you set the Actions property page. In most cases, VirusScan will quickly and easily disinfect your system to the next step.

  Clean infected file

  Delete infected file

  Move infected file to a folder

  Continue scanning


Virus found: Clean infected file

Automatically attempts to clean the contaminated file. If a virus cannot be removed from a file or the file is damaged beyond repair, VirusScan automatically denies access to the file. If this occurs, delete the file and restore the original from backups.

Tips

•	To customize notification methods, see Overview: Alert Manager.

•	To learn more about your virus, see the Virus Information Library .


Virus found: Delete infected file

Automatically deletes the contaminated file and records this action in the log file. After deletion, you must obtain the original file (possibly from backup). We recommend scanning your backup copy to ensure your file will not be re-corrupted.

Tip

•	To learn more about your virus, see the Virus Information Library .


Virus found: Move infected file to a folder

Automatically moves the infected file to a folder and records this action in the log file. The path to the file is duplicated in the quarantine folder.

Tips

•	Exclude the quarantine folder from scanning on the Exclusions properties page.

•	To prevent re-infection, deny access to this folder.

•	To learn more about your virus, see Network Associates’ Virus Information Library.


Virus found: Prompt for action

If a virus is found and the Action property page is set to Prompt for Action, you will be given several options on how to react.

•	Choose Continue to scan the remainder of your selection.

•	Choose Stop to end the scan session.

•	Choose Clean to disinfect the file.

•	Choose Delete to erase the file.

Tips

•	To learn more about your virus, see Network Associates’  Virus Information Library .


Virus found: Continue scanning

If you selected this option, it will continue scanning until it found all viruses and searched all specified file locations.

Note

•	This is not a recommended option. If used, make sure to use alert notification . Otherwise, VirusScan ignores any viruses encountered.

Tip

•	To learn more about your virus, see Network Associates’ Virus Information Library .


Boot sector is infected

Boot sector viruses can only be passed through booting from a floppy disk. If a system has a boot sector virus infection, it is unlikely the system will reboot.

To clean a boot sector virus, reboot the system using the Emergency Recovery diskette.

Tip

•	To learn more about your virus, seeNetwork Associates’ Virus Information Library .


Unable to connect to another computer

VirusScan utilizes Windows NT’s built-in security. If you are ability to administer remote systems with native NT tools, you can remotely administer NetShield.

If you are having problems in connecting, check the following:

•	Confirm VirusScan is installed on the remote system.

•	Use Microsoft's Registry Editing tool, REGEDT32.EXE, to view/edit the remote system's registry.  If you can view the registry, VirusScan should be able to connect to the remote system.

•	Check network protocols and confirm they are consistent on both the local and the remote system.


Books on virus protection and security
We recommend the following books

•	Ferbrache, David. A Pathology of Computer Viruses. London: Springer-Verlag, 1992. (ISBN 0-387-19610-2)

•	Hoffman, Lance J. Rogue Programs: Viruses, Worms, and Trojan Horses. Van Nostrand Reinhold, 1990. (ISBN 0-442-00454-0)

•	Jacobson, Robert V. The PC Virus Control Handbook, 2nd Ed. San Francisco: Miller Freeman Publications, 1990. (ISBN 0-87930-194-0)

•	Jacobson, Robert V. Using Network Associates Associates Software for Safe Computing. New York: International Security Technology, 1992. (ISBN 0-9627374-1-0)

In addition, the following sources may provide useful information about viruses:

•	National Computer Security Association (NCSA) 10 South Courthouse Avenue, Carlisle, PA 17013

•	CompuServe VIRUSFORUM

•	America Online MCAFEE

•	Internet comp.virus newsgroup


Commandline options
Command-line options

Usage

SCAN32 [<switches>] [<scanitem>]

SCAN32 <config.VSC> [<override_switches>] [<override_scanitem>]

SCAN32 [/SERVER <servername>] /TASK <taskid> [<override_switches>] [<override_scanitem>]

Command Line Switches	Description
/[NO]SPLASH Default: /SPLASH	Displays initial splash screen.
/[NO]AUTOSCAN	Scan32 automatically initiates scanning when started.  Default: <depends on UI type>
/[NO]AUTOEXIT	Scan32 automatically exits if no viruses are found. If viruses are found, Scan32 does not exit (see /ALWAYSEXIT).  Default: <depends on UI type>
/[NO]ALWAYSEXIT	Scan32 automatically exits when scan is complete. Scan32 exits even if viruses are detected (see /AUTOEXIT).  Default: <depends on UI type>
/[NO]SUB	Use this switch to scan all subfolders. Default: /SUB
/[NO]ALL	Scans all files, regardless of their file extension. Default: /NOALL
/[NO]COMP	Scans compressed files and ZIP files.  Default: /COMP
/UICONFIG | /UIEXONLY | /UINONE	Specifies the type of graphical user interface displayed: Default: /UICONFIG • UICONFIG  -  A fully-configurable interface which allows the user to specify which items to scan • UIEXONLY  -  An "execution-only" interface which takes all options from the command line, registry or VSC file. This value implies /AUTOSCAN and /AUTOEXIT. • UINONE    -  No visible user interface. All options must be taken from the command line, registry or VSC file. Activity logging should be used to obtain the scan results. This value implies /AUTOSCAN and /ALWAYSEXIT.
/CONTINUE | /PROMPT | /CLEAN | /DELETE | /MOVE <FOLDER>	Specifies what action to take when a virus is detected: Default: /CONTINUE • CONTINUE – Logs information about the infection and continue scanning. • PROMPT- Pauses the scan to ask the user which action to take (see /MSG). • CLEAN- Attempts to clean the infected item and continue with the scan. • DELETE - Attempts to delete the infected item and  continue with the scan. • MOVE - Attempts to move the infected files and continue scanning.
/[NO]MSG <message>	Default: /NOMSG  Displays a custom message when the /PROMPT option is specified and a virus is detected.
/[NO]BEEP	Default: /BEEP  Plays an audible tone on completion of a scan if infected items were found.
/RPTSIZE <n>	Default: /RPTSIZE 100 Specifies the maximum size of the activity log file (in kilobytes). When the file exceeds this size, it is truncated to zero bytes.
/[NO]MEM	Default: /MEM  Performs a memory scan.
/[NO]BOOT	Default: /BOOT Performs a boot record scan. The Master Boot Record (MBR) is scanned and the Boot Sector of each drive where a scan item resides is scanned.
/EXT extensions	Default: /EXT "EXE COM BIN SYS DO? OVL DLL APP CMD" List the file extension types to scan, unless the /ALL option is specified. To modify this list, the entire list must be entered with each entry separated by a space, for example: /EXT "EXE COM SYS ZIP".
/DEFEXT extensions"	Default: /DEFEXT "EXE COM BIN SYS DO? OVL DLL APP CMD PRG”  A list of program extensions to default to when user selects "New Scan" from the configurable (see /CONFIG) user interface. The entire list must be quoted and each entry separated by a space, for example: /DEFEXT "EXE COM SYS ZIP".
/PRIORITY <n>	Default: /PRIORITY 3 Set the priority of the scan process using a value between 1 and 5.
/TASK <taskid>	Default: (none) Specifies: (a) configuration data should be read from the registry • The taskid is a registry key found under: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VirusScan\Tasks. • This parameter may be used with or without the /SERVER option. If /SERVER is omitted, the local registry is used. (b) when used with the /CANCEL option, the task is terminated.
/SERVER <servername>	Default: none  Specifies configuration data should be read from the registry on the specified server. The /TASK option must be used with this parameter.
/CANCEL	Default: (none) Specifies a running task should be canceled. The /TASK parameter must be used with this option to specify which task is to be canceled.
/[NO]LOG [<logfile>]	Default: /LOG "VirusScan Activity Log.txt" Enables activity logging and optionally, changes the name of the log file.
/LOGALL	Default: /LOGALL  Specifies all scan activity is logged and it is equivalent to specifying /LOGDETECT /LOGCLEAN /LOGDELETE /LOGMOVE /LOGSETTINGS /LOGSUMMARY /LOGDATETIME /LOGUSER
/[NO]LOGDETECT	Default: /LOGDETECT  Logs the detection of infected items.
/[NO]LOGCLEAN	Default: /LOGCLEAN Logs the results of attempts to clean infected items.
/[NO]LOGDELETE	Default: /LOGDELETE  Logs the results of attempts to delete infected items.
/[NO]LOGMOVE	Default: /LOGMOVE  Logs the results of attempts to move infected items.
/[NO]LOGSETTINGS	Default: /LOGSETTINGS  Logs the list of configuration settings used for each scan.
/[NO]LOGSUMMARY	Default: /LOGSUMMARY Logs a summary of the completed scan.
/[NO]LOGDATETIME	Default: /LOGDATETIME Timestamps each entry in the log file.
/[NO]LOGUSER	Default: /LOGUSER  Stamps each entry in the log file with the name of the user who executed the scan.


Scan
Overview: Scan

Scan is a standalone virus scanner which is useful for running simple virus scans.

To start Scan, double-click the Scan icon in the VirusScan program group.

  Related Topics


Scan: Selecting files to scan
To select files to scan

1	Select the Where and What page from the Scan properties sheet.

2	Enter the path to the file or folder to scan or click Browse to choose a folder. Click OK. The location appears in the Scan In window.

3	To include the scanning of subfolders, check Include Subfolders.

4	Select the types of files to scan. To scan all file types, click the All Files radio button. To scan files with specific extensions, click the Program Files Only radio button.

5	To include scanning of compressed files, check the Compressed Files checkbox.

6	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.

  Related Topics


Scan: Selecting how Scan responds to infected files
To set how Scan responds to infected files

1	Select the Actions page from the Scan properties sheet.

2	Set how Scan responds to an infected file:

  Prompts you for action

  Continues scanning without taking any action

  Automatically moves infected files to a folder

  Automatically cleans infected files

  Automatically deletes infected files

Note

•	You may only choose one of these options.

  Related Topics


Scan: prompts you for Action
To instruct Scan to prompt you for Action

1	Select Prompt for Action.

2	Enable the Sound Alert and Display Message options on the Reports page.

3	To instruct Scan to display a custom message, check the Display Message checkbox and insert a custom message.

4	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.


Scan: continues without taking any action

1	Select Continue Scanning.

2	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.

Note

•	This is not a recommended option. If used, make sure to use alert notification. Otherwise, VirusScan ignores any viruses encountered.


Scan: automatically cleans infected files
To instruct Scan to automatically clean infected files

1	Select Clean Infected Files.

2	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.


Scan: automatically deletes infected files
To instruct Scan to automatically delete infected files

1	Select Delete Infected Files.

2	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.


Scan: moves infected files to a folder
To instruct Scan to move infected files to a folder

1	Select Move Infected Files to a Folder

2	Enter a folder for the infected files or click Browse to choose a folder. Click OK.

3	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.

Tip

•	To help keep track of virus origination, the path to the file is duplicated in the quarantine folder.


Scan: Selecting how Scan reports virus activity
To select how VirusScan reports virus activity

1	Select the Reports page from the Scan properties sheet.

2	To send a display message on virus detection, check the Display Message checkbox and enter a message.

3	To sound an alert on virus detection, check the Sound Alert checkbox.

4	To log virus activity in a log file, check the Log to File checkbox. The default log file location is C:\Win32app\VirusScan\ActivityLog.txt. Click Browse to choose a different location.

5	To limit the size of the log file, check the Limit Size checkbox and enter the maximum file size (in kilobytes).

6	To further configure this task, select another properties page. To run this scan now, click Scan Now. To save these settings to run later, select Save Settings from the File menu.

Note

•	The Display Message option is only available if Prompt for Action is selected on the Actions page.

  Related Topics


VCS file format
VSC file format

The VSC file is a configuration text file, formatted similarly to the Windows INI file, which outlines VirusScan’s settings. Each variable in the file has a name followed by the equal (=) sign and a value. The values define which settings were selected for the configuration.

The variables are arranged in five groups: ScanOptions, AlertOptions, ActivityLogOptions, Scheduler, and TaskDefinitions. To edit the VSC file, right-click the filename and select Edit.

ScanOptions

Variable	Description
SzProgramExtensions	Type: String Defines extensions to be used as program extensions during scan  Default value: EXE COM DLL SYS DO?
SzDefaultProgramExtensions	Type: String Defines extensions to be used as default program extensions during scan configuration  Default value: EXE COM SYS DO? XL? BIN RTF OBD
BIncludeSubFolders	Type: Boolean (1/0) Instructs scanner to search for viruses inside subfolders  Default value: 1
BScanAllFiles	Type: Boolean (1/0) Instructs program to scan inside all files Default value: 0
bScanCompressed	Type: Boolean (1/0) Instructs program to scan inside compressed files (PkLite, LHA, LZEXE, ZIP, Microsoft CAB)  Default value: 1
uScanAction	Type: Integer (1-5) Defines what action will be taken upon virus detection: 1 - Prompt for Action  2 - Continue Scanning  3 - Move Infected File   4 - Clean Infected File  5 - Delete Infected File Default value: 1
BautoStart	Type: Boolean (1/0) Defines if scan will be started immediately upon launch  Default value: 0
BAutoExit	Type: Boolean (1/0) Defines if scanner will be unloaded when  scan is finished  Default value: 0
nPriority=0	Type: Integer (0-5) Defines the priority at which scan is to be executed Default value: 3
szScanItem=C: \	Type: String Defines item to be scanned Default value: C:\

AlertOptions

Variable	Description
BDisplayMessage	Type: Boolean (1/0)Defines if custom message should be displayed upon virus detectionDefault value: 1
SzCustomMessage	Type: StringDefines custom message to be displayed upon virus detectionDefault value: Your custom message here!
BSoundAlert	Type: Boolean (1/0)Defines if audible alert should be made upon virus detectionDefault value: 1

ActivityLogOptions

Variable	Description
BLogToFile	Type: Boolean (1/0) Defines if scan results should be logged into log file Default value: 1
BLimitSize	Type: Boolean (1/0 )Defines if size of the log file should be limited Default value: 1
uMaxKilobytes	Type: Integer Defines maximum size of the logfile Default value: 100
SzLogFileName	Type: String Defines log file name Default value: VirusScanActivity Log.txt
BLogDetection	Type: Boolean (1/0) Defines if scan results should be logged Default value: 1
BLogClean	Type: Boolean (1/0) Defines if clean results should be logged Default value: 1
BLogDelete	Type: Boolean (1/0) Defines if infected file delete operations should be logged. Default value: 1
BLogMove	Type: Boolean (1/0) Defines if infected file move operations should be logged. Default value: 1
BLogSettings	Type: Boolean (1/0 Defines if session settings should be logged. Default value: 1
bLogSummary	Type: Boolean (1/0) Defines if session summary should be logged Default value: 1
BLogDateTime	Type: Boolean (1/0) Defines if time and date of an event should be logged. Default value: 1
bLogUserName	Type: Boolean (1/0) Defines if user name should be logged Default value: 1

TaskDefinition

Variable	Description
SzTaskName	Type: String Defines task name Default value: New Scan Task
WTaskAttrib	Type: Integer Contains task attributes Do not modify
WTaskType	Type: Integer Contains task type Do not modify

Scheduler

Variable	Description
BSchedEnabled	Type: Boolean (1/0) Enables scheduling for the task. Default value: 0
WFlags	Type: Integer Contains task flags. Do not modify.
WTime	Type: Integer Defines time when task is to be launched. Do not modify.
WDate	Type: Integer Defines date when task is to be launched. Do not modify.


Message variables
Alert Message variables

Alert messages generated by VirusScan may contain following variables:

Variable	Description
%FILENAME%	Name of the infected file
%TASKNAME%	Name of the task that detected the virus
%VIRUSNAME%	Name of the virus
%DATE%	Date of the event
%TIME%	Time of the event
%COMPUTERNAME%	Name of the infected computer
%SOTWARENAME%	Name of the software that detected the virus
%SOFTWAREVERSION%	Version number of the software that detected the virus
Note

•	Use these variables to create custom alert messages.


Task Properties
Task Properties Dialog Box

The Task Properties dialog box is where on-demand scan tasks are configured.

To configure an on-demand scan task, highlight the task and click [image] or select Properties from the Edit menu.


Acrobat Error Message

You must have Adobe Acrobat to view this file.


Safe Computing Practices

Safe computing practices include:

•	Virus protection

•	Regular backups

•	Meaningful password protection

•	Training and awareness


Inbound Files

Inbound Files are files copied to the workstation.


Outbound Files

Outbound Files are files copied from the workstation.


Removing a Notification Item

To remove an alert notification item, highlight the item and click Remove.


Viewing notification item properties

To view the properties of an alert notification item, highlight the item and click Properties.


To view the log file

Open the log file using any text editor.


To open the Application Log

Click [image] or select Event Log from the Tools menu.


To configure the modem

1  Click Modem. The Modem Configuration page is displayed.

2  Choose the modem brand and model from the drop down list.

3  Select the COM port.

4  Set the maximum baud rate.

5  Select any prefix required to get an outside line.

6  Select tone or pulse dialing.

7  Click OK


To start VirusScan

Double-click the Scan icon in the VirusScan program group.


Macro virus
What is a macro virus

Macro viruses infect Microsoft Word and Excel files by using their embedded macro functionality. Microsoft incorporated macro functionality into their Word and Excel products to automate repetitive tasks and combine multiple commands. Although the intentions were good, it was eventually discovered that macros could be used for nefarious purposes.


Launching the AntiVirus Console

To start the AntiVirus Console, do one of the following:

•	In Windows NT 3.51, open the VirusScan group in the Program Manager, and double-click the AntiVirus Console icon [image].

•	In Windows NT 4.0, click Start, select VirusScan in the Programs menu, and select AntiVirus Console.


What are the AutoUpdate tasks?

The AutoUpdate tasks automatically download updates and upgrades from an FTP site or network distribution site. After the VirusScan files are downloaded, AutoUpdate can either post them to a distribution site for downloading by other computers or automatically apply the new files to your VirusScan machines.

Use the AutoUpdate tasks to automate and customize the updating process. Network Associates offers two AutoUpdate tasks to keep your VirusScan files up-to-date:

•	Automatic DAT Update task

•	Automatic Product Upgrade

Both tasks appear in the AntiVirus Console task window preceded by [image] .

See also

  Configuring the Automatic DAT Update task

  Configuring the Automatic Program Upgrade task


DAT file
What is a DAT file

The files CLEAN.DAT, NAMES.DAT, SCAN.DAT, and MCALYZE.DAT all provide virus information to the VirusScan software and make up the VirusScan virus signature (DAT) files.

Network Associates updates the DAT files approximately once a month with new virus detectors, cleaners, and fixes to reported bugs.

Network Associates upgrades the VirusScan program periodically with new features, enhancements, and functionality to provide you with the latest antivirus technology.


To configure an Automatic DAT Update task

Use the AutoUpdate Properties dialog box to configure an Automatic DAT Update task.

1	Select AutoUpdate from the Tools menu.

2	Click the Update Options tab.

3	Select the transfer method in which you want to receive the files. Your options are:

•	Copy from Local Computer.

•	FTP from a Remote Network computer.

4	Click the FTP Login Information button to enter your FTP access information, such as username and password or select the Use Anonymous FTP Login checkbox. If this option is selected, AutoUpdate will automatically assign “Anonymous” as your user name and assign your e-mail address as your password.

Note: Use anonymous when connecting to Network Associates’ FTP site.

5	Select the Use Proxy Server checkbox if your network uses a proxy server or gateway to direct ftp commands. Enter the name and port number of the proxy server. If you are unsure if your network uses a proxy server or if you do not know the port number, check with your system administrator.

6	Select the Log Activity into the VirusScan Activity Log File checkbox to record the AutoUpdate history.

7	To update the DAT files now, click the Update Now button.

8	To perform scheduled DAT file updates, click the Schedule button.

9	Click the Advanced button to configure AutoUpdate to perform special actions during or after the updating process.

See also

  Scheduling AutoUpdate tasks

  Additional AutoUpdate options

  Configuring the Automatic Product Upgrade task


Additional updating options

The AutoUpdate tasks and can also perform services during and after the updating process. You can configure the AutoUpdate tasks to automatically:

  Backup existing VirusScan files

  Retrieve the updated VirusScan files without performing the update

  Save the update for later use

  Run a program after updating the VirusScan files


Backup existing DAT files

To back up existing VirusScan files automatically, click the Advanced button on the Update Options property page. Then, select the Backup the Existing DAT Files checkbox.


Retrieve the update but do perform the update

To retrieve the updated files without performing the update, click the Advanced button on the Update Options property page. Then, select the Retrieve the Update File but do Not Perform the Update checkbox to save new files on your workstation without applying them. Click OK.

Note: If this option is selected, you must select the Save the Update for Later Use checkbox and specify the location in which the file can be retrieved.


Save the update file for later use

After retrieving an update, AutoUpdate can store the update module in a location accessible by all computers running VirusScan for Windows NT. To configure AutoUpdate to store update modules for distribution, click the Advanced button on the Update Options property page. Then, select the Save the Update File for Later Use checkbox to save the new DAT files in special location. Enter a location in which you want to store the update. Click OK.


Run a program after updating

To run a program after AutoUpdate retrieves the update, click the Advanced button on the Update Options property page. Then, select the Run a Program After a Successful Update checkbox to automatically execute a program or script upon downloading the update. Enter the complete path to the file that will be run or click Browse to navigate to the program. Click OK.


Compressed file scanning option

Select this option if you want VirusScan to scan files compressed with PKLITE, LZEXE, LHA, WinZip, Microsoft CAB.


VirusScan Properties

The VirusScan Properties dialog box is where on-access scan tasks are configured.

To configure an on-access scan task, highlight the task and click [image] or select Properties from the Edit menu.


Task Properties

The Task Properties dialog box is where VirusScan tasks are configured. To configure a scan task, highlight the task and click [image] or select Properties from the Edit menu.


Copy from local computer

Choose this option to copy files from a designated local computer. Then enter the name of the computer that AutoUpdate will copy the files from in the text box provided. You can enter the computer name in Universal Naming Convention (UNC) notation, or you can click Browse to locate the computer on the network.


FTP from a remote network computer

Choose this option to download files from a designated network computer. Then Enter the FTP computer name and directory in which the files will be downloaded from. The default FTP computer name and directory is ftp.web.mcafee.com/pub/antivirus/datafiles/3.x.


VirusScan Activity Log File

The VirusScan Activity Log File lists the each step made by AutoUpdate during the updating process. The log file will also include a specific error message if any of these steps fail.


Configuring the Automatic Program Upgrade task

To configure the Automatic Product Upgrade task to acquire the most current version of VirusScan, follow these steps:

1	Select AutoUpdate from the Tools menu.

2	Click the Upgrade Options tab.

3	Select the transfer method in which you want to receive the files. Your options are:

Copy from Local Computer

FTP from a Remote Network computer.

4	Click the FTP Login Information button to enter your FTP access information, such as username and password or select the Use Anonymous FTP Login checkbox. If this option is selected, AutoUpdate will automatically assign “Anonymous” as your user name and assign your e-mail address as your password.

Note: Use anonymous when connecting to Network Associates’ FTP site.

5	Select the Use Proxy Server checkbox if your network uses a proxy server or gateway to direct ftp commands. Enter the name and port number of the proxy server. If you are unsure if your network uses a proxy server or if you do not know the port number, check with your system administrator.

6	Select the Log Activity into the VirusScan Activity Log File checkbox to record the AutoUpdate history.

7	To upgrade VirusScan now, click the Upgrade Now button.

8	To perform scheduled upgrades, click the Schedule button.

9	Click the Advanced button to configure AutoUpdate to perform special actions during or after the updating process.


Automatic DAT Update task

Create an Automatic DAT Update task to automatically retrieve and install DAT files.


Automatic Product Upgrade task

Create an Automatic Product Upgrade task to automatically retrieve and install the latest VirusScan program files.


Scan compressed files

VirusScan's on-access scanner can scan files compressed with PKLITE and LZEXE.


Send Message to User

To configure VirusScan to send a disconnect message to the infected computer, select the Send Message to User checkbox and enter a custom message in the text box provided.


Contacting Network Associates

Network Associates maintains a support staff with expertise in the each of the areas listed below. Click any of these topics for more information:

  Network Associates training

  Technical support


Customer Care

To order Network Associates products or obtain product information, we invite you to contact our Customer Care department at (408) 988-3832 or at the following address:

McAfee, Inc.
2805 Bowers Avenue
Santa Clara, CA  95051-0963
U.S.A.

See also

  Network Associates training

  Technical Support


Network Associates Training

To learn about scheduling on-site training for any Network Associates product, call (800) 338-8754.

See also

  Customer Care

 Technical Support


Technical Support

Network Associates is famous for its dedication to customer satisfaction. We have continued this tradition by making our site on the World Wide Web a valuable resource for answers to technical support issues. We encourage you to make this your first stop for answers to frequently asked questions, for updates to Network Associates software, and for the latest news and information. Click the website address shown below to link directly to Network Associates’ site.

World Wide Web	http://www.networkassociates.com Click here to link to the Network Associates Web Site.
If you do not find what you need or do not have Web access, try one of Network Associates’ automated services:

Automated Voice and Fax Response System	(408) 988-3034
E-mail	support@mcafee.com
Network Associates dial-up Bulletin Board System	(408) 988-4004 1200 bps to 28,800 bps 8 bits, no parity, 1 stop bit 24 hours, 365 days a year
CompuServe	GO MCAFEE
America Online	Keyword MCAFEE
If the automated services do not have the answer you need, contact Network Associates at one of the following numbers Monday through Friday between 6:00 a.m. and 6:00 p.m. Pacific time.

For corporate-licensed customers:

Phone	(408) 988-3832
Fax	(408) 970-9727
For retail-licensed customers:

Phone	(972) 278-6100
Fax	(408) 970-9727
To provide the answers you need quickly and efficiently, the Network Associates technical support staff needs some information about your computer and software. Please have this information ready before you call:

•	Product name and version number

•	Computer brand and model

•	Any additional hardware or peripherals connected to your computer

•	Operating system type and version numbers

•	Network type and software version numbers

•	Contents of your AUTOEXEC.BAT file, your CONFIG.SYS file, and your system LOGIN script

•	Specific steps to reproduce the problem, if applicable

See also

  Customer Care

  Network Associates training


The Virus Information Library

The Virus Information Library is a comprehensive database containing more than 250 technical documents and information about more than 1000 viruses. The library offers detailed information concerning computer viruses, their methods of infection, their effect on computers, instructions on removing viruses, and methods to prevent virus infection.

The Virus Information Library is available through the Network Associates Web Site.

The Virus Information Library is continuously updated to offer the most comprehensive, up-to-date information available.

  Click here to go to the Virus Information Library.