home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Precision Software Appli…tions Silver Collection 1
/
Precision Software Applications Silver Collection Volume One (PSM) (1993).iso
/
demos
/
pcsmn101.arj
/
PCSMN101.EXE
/
PCSM.DOC
next >
Wrap
Text File
|
1992-11-19
|
55KB
|
1,453 lines
Administrator Guide
PC ScanMasterTM for NetWare
Version 1.01
"The user friendly way to enforce
your PC virus scan policy"
Serial Number: __________________
Documentation Revision 1.10
TABLE OF CONTENTS
Overview 1
Introduction 3
Requirements 4
Diskette Files 5
Quick Start - Installation and Operation Essentials 6
Installation Guide 8
PCSM - PC ScanMaster 8
PC Signature File 11
Configuration File 12
Interval Period 12
Grace Period 12
McAfee SCAN.EXE Options 13
Floppy Scanning 15
Disk Swapping 15
History Logs 16
Virus Notification List 16
Example SCAN.CFG files 17
Customizing Messages 17
PCSMA - Administrator Utility 18
Operation Guide 19
PCSM - PC ScanMaster 19
PCSMA - Administrator Utility 25
Simulating a Virus Detection 31
Troubleshooting 32
Diagnosing Problems 32
Common Questions and Problems 33
Maintenance/Update/Support Programs 34
Overview
A single virus, if spread undetected through your network
can cause untold financial loss and interruption of business
activity. The best insurance against such a disaster is a
regular scan of all PC and Network drives. Prevention
techniques and 'shields' alone, although useful, cannot
insulate today's networks from infection.
This risk to your business dictates that prudent network
administrators build in regular, required virus scans on all
PC and Network drives to assure that their networks are
virus free.
A single source solution is now available for Novell NetWare
network administrators for their virus detection needs.
NetPro Computing offers two virus programs for NOVELL
NetWare, PC ScanMaster and NetShield. PC ScanMaster is a
Virus Scan Manager for NOVELL workstations and NetShield is
a Virus Shield and Scan Manager for NetWare File Servers.
Both work in conjunction with the industry's leading Virus
Scan software from McAfee Associates.
PC ScanMaster assures that PCs logging into a NetWare
network are completely scanned on a regular basis and can
immediately notify administrators via a 25th line message
should a virus be detected. PC ScanMaster also minimizes
the impact on users by limiting how often a scan is
performed and by providing a grace period during which they
can choose the most convenient time to scan.
PC ScanMaster uses a combination of a Username and a
Workstation ID to uniquely identify each PC. This provides
easy recognition of the machines owner with unique
identification of each PC on a network. PC ScanMaster keeps
two databases, one for the current status of each machine,
and one for a chronological history of each machine's
activity and infections. Reporting tools provide
administrators with the ability to observe the quantity of
virus infections and determine their identity.
PC ScanMaster
There are many obstacles that even the most determined
administrators are unable to overcome when attempting to
maintain a virus free network. Some of the most significant
among these are:
Assurance that complete scans are performed on a regular
basis
Minimization of inconvenience to the user and administrator
alike
Immediate notification when a virus is detected
Maintenance of audit logs for scan activities and results
The network administrator must protect the network while not
interfering with normal business activity. PC ScanMaster
provides the balance and flexibility needed for NetWare
Administrators to ensure that virus scans are performed on
every drive of every user's workstation on a regular basis,
while minimizing the impact on normal business activity. In
short, PC ScanMaster is the user friendly way to enforce
your PC virus scan policy.
Introduction
The PC ScanMaster system consists of two separate programs:
1) PCSM.EXE performs and logs the PC virus scan activity
2) PCSMA.EXE is an Administration tool to manage and report
on the PC ScanMaster Logs and set certain configuration
parameters for PC ScanMaster.
PC ScanMaster works in conjunction with, and requires, the
popular PC Virus Scan software (SCAN.EXE) from McAfee
Associates. The McAfee programs are recognized as the
industry leader in virus detection software. They are
available as shareware for personal home use. Businesses,
corporations, organizations, government agencies, and
schools, require a site license to use the McAfee programs.
If you require a license for the McAfee programs, NetPro
Computing can provide site licenses and bundle the McAfee
programs with the NetPro Computing Virus Scan manager for
NetWare.
PC ScanMaster will work in either a login script, or in a
BATCH file called from a login script.
PC ScanMaster and its Administrator utility will:
Scan each PC from the login script entry or any BAT file
Limit scans to every N days with the optional Interval
period
Let users select the best time to scan within the optional
Grace period
Notify Administrators and users when a Virus is detected
Detect and scan all local hard drives
Detect and scan all floppy disk drives
Maintain audit logs of each user's scan record
Maintain a chronological history log of all viruses found
Display custom messages to users based on scan results
Allow quick, easy updates of parameters and messages on
multiple servers
Requirements
PC ScanMaster is designed for use on NOVELL NetWare network
operating systems. Workstations require approximately 250K
free RAM for PC ScanMaster (127K for PCSMA) and MS/PC DOS
3.10 or higher. PC ScanMaster requires the McAfee
Associates SCAN program.
Note: The memory required to run PC ScanMaster is
dependent on the size of SCAN.EXE and whether or not
the SWAP option is used. Before PC ScanMaster invokes
SCAN.EXE, it can swap itself completely out of memory.
If swapping is enabled the memory requirement is the
greater of that required by PC ScanMaster or that
required for the DOS shell plus the current version of
SCAN.EXE. PC ScanMaster and the current version (97)
of SCAN require less than 200K; however, the minimum
requirement is set at 250K if the SWAP option is on and
400K if the SWAP option is off. Note: PCSM does not
stay resident; when scanning is complete, nothing is
left in memory.
Diskette Files
The PCSM Diskette should contain the following files:
PCSM.EXE - PC ScanMaster
PCSMA.EXE - Administrator Utility
\SAMPLES\SCAN.CFG - Sample Configuration File
\SAMPLES\FAILED.MSG - Custom Message on Failed
\SAMPLES\PASSED.MSG - Custom Message on Passed
\SAMPLES\ABORTED.MSG - Custom Message on Abort
\VSIM\VSIM.DAT - Virus Simulation Data
\VSIM\VSIM.EXE - Simulated Infected File
If any of these files are missing, or corrupted please call
NetPro immediately.
Note : VSIM.EXE is not a real executable file and does NOT
contain a virus! The VSIM.DAT and VSIM.EXE can simulate
a virus detection for the purpose of testing without risking
exposure to a real infected file. See the section on
Simulating a Virus Detection for details. NetPro
Computing scans all of its software disks to assure
they are virus free prior to shipping.
Quick Start - Installation and Operation Essentials
For the experienced administrator who wants to get up and
running without reading lots of pages, the following Quick
Start provides the essential information to install and
operate PC ScanMaster.
For fully detailed installation and operation instructions
see the Installation and Operations sections of this manual.
Quick Start Essentials
1) The PC ScanMaster system has two programs; PCSM.EXE for
performing the scan, and PCSMA.EXE for accessing the scan
logs.
2) PC ScanMaster can be run either directly from a login
script or a BATCH file executed from the login script. PC
ScanMaster uses three directories as parameters which can
be separated by a space or a '@'.
#I:\VIRUS\PCSM.EXE I:\VIRUS\DATA@I:\VIRUS\SCAN@I:\VIRUS\CFGS
Or, from a BATCH file,
PCSM.EXE I:\VIRUS\DATA@I:\VIRUS\SCAN@I:\VIRUS\CFGS
Where:
I:\VIRUS\PCSM.EXE the drive\path\filename for PCSM.EXE (Read Only)
I:\VIRUS\DATA the drive\path where PCSM data exists (Read/Write)
I:\VIRUS\SCAN the drive\path where SCAN.EXE exists (Read Only)
I:\VIRUS\CFGS the drive\path where SCAN.CFG exists (Read Only)
3) The SCAN.CFG file can contain 6 parameters to control
the scan process, and up to 25 names to notify when a
virus is detected. The file is in standard ASCII format
as shown below with each value on a separate line; ie,
INTERVAL = 14 -Interval Period
GRACE = 3 -Grace Period
MCAFEE = /A -SCAN.EXE Options
FLOPPY = ON -Scan Floppy Drive
SWAP = ON -Swap PCSM to disk During Scan
HISTORY = FAIL -Save Failed Scans in History
NOTIFY = Joe Admin -1st Name to Send Virus Notice
NOTIFY = Jan Admin -2nd Name to Send Virus Notice
4) Optional custom message files, PASSED.MSG, FAILED.MSG,
and ABORTED.MSG may be placed in the same directory as
SCAN.EXE to customize the messages displayed to the user
when PC ScanMaster exits.
5) PCSMA requires one parameter, the directory of the Scan
Log files; ie,
PCSMA I:\VIRUS\DATA
Installation Guide
PCSM - PC ScanMaster
The PC ScanMaster program (PCSM) can be installed in a
matter of minutes with just three simple steps:
Setup the Directories and Rights Security
Copy the programs to their directories
Put PC ScanMaster in the LOGIN SCRIPT
PC ScanMaster will immediately take effect once these three
steps are complete. You can adjust its optional
configuration parameters and message files at any time
quickly and easily, on one or more servers, once PC
ScanMaster is operational.
There are four directories you must consider when installing
PC ScanMaster:
The directory where PCSM.EXE resides
The directory where the PC ScanMaster Logs will reside
The directory where the McAfee SCAN.EXE program
resides
The directory where the SCAN.CFG file resides
PCSM.EXE and SCAN.EXE can be in the same directory or
separate directories. For simplicity, it is recommended
that they be in same directory. To preclude the infection
of PC ScanMaster or SCAN, users should have READ ONLY access
to these programs. The directory where SCAN.EXE is found
may also contain optional configuration and message files.
The Scan Log directory requires MODIFY Access for everyone
and will generally be a dedicated directory.
Note: As a general rule, the administrator should setup a
separate User account to perform all administrator
activities. This way you cannot infect programs in
directories where you have special MODIFY access not
granted to others.
Step 1 - Setup the Directories and Trustee Rights
Create the directories and setup the Trustee Rights for the
proper access. As an example, you might use:
F:\SM for PCSM.EXE.
Set the rights for READ ONLY Access.
F:\SM\LOGS for the Scan Logs.
Set the rights for MODIFY Access.
F:\SM\SCAN for the SCAN.EXE, SCAN.CFG and any
.MSG files. Set the rights for READ
ONLY Access.
F:\SM\ADM for PCSMA.EXE.
Set the rights for Supervisory Access.
For the remainder of this example, we will assume that
PCSM.EXE is in the N:\SM directory, and SCAN.EXE is placed
in the N:\SM\SCAN directory.
Step 2 - Copy the programs to their directories
Copy the PCSM.EXE and SCAN.EXE files to directories created
in Step 1. They can both be in the same directory, or in
separate directories.
Note: If you like, you may also copy the samples of the
optional configuration and message files, SCAN.CFG,
PASSED.MSG, FAILED.MSG, ABORTED.MSG to the F:\SM\SCAN
directory now and edit them later.
Step 3 - Put PC ScanMaster in the LOGIN SCRIPT
Once the directories and programs are in place, modify the
user's login script or BATCH File called from the login
script to include PC ScanMaster.
PCSM.EXE takes a single string as an argument to specify its
needed directories. This string can contain three
directories separated by spaces to specify the directory for
the Scan Log, the directory for SCAN.EXE, and the directory
for the SCAN.CFG and message files as shown below.
PCSM.EXE F:\SM\LOGS@F:\SM\SCAN
Where
F:\SM\LOGS is the directory where the Scan Log is
maintained (MODIFY Access Required) PC
ScanMaster will automatically create
these logs when it is first run.
F:\SM\SCAN is the directory where SCAN.EXE and
SCAN.CFG (READ ONLY Access recommended)
is located.
Note: In this example the SCAN.EXE and the SCAN.CFG
files have been placed in the same directory. The
SCAN.CFG file can be placed in a separate directory, so
that different profiles can call different SCAN.CFG
files.
PCSM.EXE can be executed directly from the login script, or
from a BATCH file which the login script calls. To use it
directly in the login script, the syntax is as follows:
#F:\VIRUS\PCSM.EXE F:\SM\PCSM.EXE F:\SM\LOGS@F:\SM\SCAN
When executing from a BATCH file, the syntax is as follows:
F:\SM\PCSM.EXE F:\SM\LOGS@F:\SM\SCAN
When PCSM.EXE is run for the first time, the Scan Logs will
automatically be created. New workstations are
automatically added to the Scan Log when they first login
after PC ScanMaster has been added to the login script.
First time users will be placed in a 'Grace Mode' to ease
the introduction of a new system by giving users the length
of the grace period to let the scan complete before it is
first forced upon them.
Step 4 - Customize Configuration and Messages ( Optional )
PC ScanMaster's operational parameter file (SCAN.CFG) and
messages can be customized without modifying the login
script command or login script BATCH file anytime after
installation. Keeping this information in external files
allows you to easily and quickly update multiple copies of
PC ScanMaster on large networks as your virus condition
dictates.
PC Signature File
A Signature File, PCSM.SIG, is created on each hard disk to
uniquely identify the hardware being scanned. The signature
file contains two fields which identify a workstation's hard
disk within a PC ScanMaster database, USERNAME and USERADDR.
The signature file is automatically created when PC
ScanMaster is first run from a workstation. The value for
USER is taken from the user's user name. The value for
USERADDR is taken from the network address on each
individual network interface card.
Either value can be changed with an ASCII editor. The USER
field does not have to be a user name, any 64 character
string can be substituted. All log entries include both the
workstation signature values as well as the operator's user
name. The signature file can be placed in any directory you
wish, and defaults to C:\.
Note: The signature file is stored as a read-only hidden
file. To edit it manually, your editor may require
that the hidden attribute be removed in addition to the
read-only attribute.
Setup For Dial-In Users
The LoadPCSM utility has been provided to improve
performance for Dial-In users while retaining centralized
logging and control of parameters at the server. LoadPCSM
works as a small loader program for PCSM, that can execute a
local copy of both PCSM and SCAN.EXE when the user is dialed
in. This precludes a long delay while these files are
loaded from the network. LoadPCSM also performs version
control of the local copies to assure that the most recent
programs are being used.
LoadPCSM uses a DOS environment variable to indicate that
local copies of these programs should be used and what
directory they are to be stored in. If the directory is not
found it will be created. If PCSM.EXE and SCAN.EXE are not
found they will first be copied to the local drive. If
PCSM.EXE and SCAN.EXE are found on the local drive but they
are not the same versions as the ones on the network, they
will be copied over with the versions from the network.
When PCSM.EXE and SCAN.EXE have been found and verified
current, the local copies will be called with the parameters
passed to LoadPCSM (In this case PC ScanMaster will expect
to find SCAN.EXE in the same directory where PCSM.EXE is
located)
If LoadPCSM does not locate the special DOS environment
variable it will call the network version of PCSM.EXE with
the parameters passed to it.
Configuring LoadPCSM
Like PC ScanMaster, LoadPCSM can be run either directly from
a login script or a BATCH file executed from the login
script. Just like PC ScanMaster the following syntax would
be used.
#I:\VIRUS\LOADPCSM.EXE
I:\VIRUS\DATA@I:\VIRUS\SCAN@I:\VIRUS\CFGS
Or, from a batch file,
LOADPCSM.EXE I:\VIRUS\DATA@I:\VIRUS\SCAN@O:\VIRUS\CFGS
Make sure that LOADPCSM.EXE is located in the same network
directory as PCSM.EXE. When LoadPCSM is executed, it looks
for a DOS environment variable called LOCALPCSM, this
environment variable, if present, specifies the local
workstation directory where PCSM.EXE and SCAN.EXE reside.
Below is the proper syntax used to set this environment
variable.
SET LOCALPCSM = C:\VIRUS
Configuration File
The SCAN.CFG file must be kept in the same directory as
SCAN.EXE. This file is a standard ASCII text file which can
be created with any text editor. It can contain 6
parameters, and up to 25 user names, each on a separate line
. The parameters are Interval, Grace, McAfee, Floppy, Swap
and History. The user names designated by NOTIFY are users
who will be notified in the event a virus is detected.
If the SCAN.CFG or any of its parameters are not found,
default values are assumed. The definition of these
parameters are as follows:
Interval Period
The INTERVAL parameter sets the number of days after
the last complete scan that PCSM will wait before the
next scan is attempted. For example, assume the
Interval Period is 3 days, and the last completed scan
was on Monday morning with no viruses found. On
Tuesday and Wednesday morning a scan will not be
performed, but on Thursday morning when you login to
the network, PC ScanMaster will initiate a scan on your
PC.
The default Interval Period is 7 days.
Grace Period
The GRACE period parameter sets the number of days past
the Interval Period that the user is allowed to abort
the scan with a Ctrl-Break. Once the number of days
since the last complete scan exceeds the Interval
Period plus the Grace Period, the user must complete
the scan in order to login to the network. The Grace
Period is optional. If the Grace Period is 0, then as
soon as the Interval Period expires, the user must
complete the scan to login.
If the Grace Period is in effect when the user logs in,
they will be presented with the message "Scan Required
By MM/DD/YY" representing the day their Grace Period
expires. If the Grace Period has already expired, the
user will be presented with the message "Scan Required
to Login".
For example, assume the Interval Period is 2 days, and
the Grace Period is 2 days. If you last completed a
scan on Monday morning, then Tuesday morning the scan
would not be performed but on Wednesday morning when
you login to the network, a virus scan would be
initiated on your PC. However, since you see that you
have until Friday before the scan is required, you can
elect to scan and have it complete, or postpone until a
more convenient time by aborting the scan with a Ctrl-
Break. If by Friday you have not completed a scan,
when you login the message indicates that a scan is
required to login. Should you press Ctrl-Break when
this message is displayed, the scan simply restarts at
the beginning until you let it complete the scan.
The default Grace Period is 3 days.
McAfee SCAN.EXE Options
The McAfee SCAN.EXE program has numerous options
available. With the MCAFEE parameter in the SCAN.CFG
file, you can specify up to 80 characters of command
line options supported by SCAN.EXE.
Refer to the McAfee Documentation for a complete
description of all the options. Some of the options
you may find useful are:
/A - Scan All Files for Viruses
/M - Scan Memory for All Viruses
/D - Overwrite and delete infected file after
prompt
/EXT - Add external virus detection patterns
The /A option tells SCAN.EXE to scan all files
regardless of their extension. Without the /A option
SCAN.EXE will scan only .BIN, .COM, .EXE, .OV?, .PGM,
.PIF, .PRG, .SYS and .XTP files. This option will
substantially increase scanning time. McAfee
recommends that the /A option be used only after a
virus has already been detected, and additional
protection against re-infection is necessary.
The /M option tells SCAN .EXE to check system memory
for all known computer viruses that can inhabit memory.
SCAN by default only checks memory for critical viruses
which can cause catastrophic damage or spread the
infection during the scanning process. Refer to the
McAfee Documentation for a list of the viruses checked
for without this parameter. We recommend the use of
this option since it takes very little extra time.
The /D option tells SCAN.EXE to prompt the user to
overwrite and delete an infected file when one is
found. If the user selects "Y" the infected file will
be overwritten and deleted. A file erased by the /D
option can not be recovered. Boot sector and partition
table infections can not be removed by the /D option
and require the McAfee CLEAN-UP virus disinfection
program. We do not recommend the use of this option
with PC ScanMaster when you are using the 'User Name to
Notify' option in SCAN.CFG. The "Virus Found" notice
is sent to the user name specified when control is
returned back to PC ScanMaster after a virus has been
detected. Use of this option may preclude control
being returned to PC ScanMaster promptly or at all, and
therefore interfere with the notification process.
The /EXT tells SCAN.EXE the name of a file that
contains additional patterns that, if found, should be
considered to be the sign of a virus. It can be
utilized for simulating a virus detection. See
Simulating a Virus Detection.
Note: If no parameters are specified on the McAfee
line of SCAN.CFG, SCAN.exe will default to
none. The /NOPAUSE and /REPORT parameters are
automatically used by PC ScanMaster. Do not put
these parameters in the McAfee field of SCAN.CFG.
Floppy Scanning
The configuration file parameter, 'FLOPPY = ', is used to
enable the scanning of floppy drives in addition to hard
drives. When 'FLOPPY = ON' is specified, PC ScanMaster
will detect and scan any floppy diskettes that are scannable
and pass those drive letters to the SCAN.EXE in addition to
the hard drive letters. A drive is considered scannable if
the drive door is closed, and a DOS formatted diskette is
installed.
The default floppy scan value is OFF.
Note: When scanning workstations with no hard disk, no
floppy scans will be performed regardless of the value
of the FLOPPY parameter.
Disk Swapping
Prior to execution of the McAfee SCAN.EXE, PCSM.EXE can be
swapped out of memory to a PC hard drive, thus reducing
overall memory requirements. If this option is not
specified PCSM.EXE is automatically swapped to disk. If no
swapping is desired the Swap line in the SCAN.CFG file can
be set to off, or the DOS environment variable PCSMSWAP can
be set to OFF. Since the DOS environment variable is local,
it will assume priority over the option stated in the
SCAN.CFG file. The DOS variable allows individual PCs to
override the prescribed SWAP option, in case of memory or
disk restrictions.
File Service User Workstation Result
PCSM.CFG File DOS SET PCSMSWAP
SWAP=ON SET PCSMSWAP=ON Swap to Disk
SWAP=OFF SET PCSMSWAP=ON Swap to Disk
SWAP=ON SET PCSMSWAP=OFF No Swap
SWAP=OFF SET PCSMSWAP=OFF No Swap
The default Swap option is ON.
History Logs
The History parameter in the SCAN.CFG file tells PCSM what
factors to take into account when data is logged. Rather
than logging all scans performed, PCSM allows the
Administrator to determine when information should be
recorded regarding a particular scan. This status is
determined by editing the History line in the SCAN.CFG file.
The following parameters can be used.
HISTORY=PASS -Passed Scans Only
HISTORY=FAIL -Failed Scans Only
HISTORY=ABORT FAIL -Failed or Aborted Scans Only
HISTORY=PASS FAIL ABORT ERROR -All
HISTORY=ALL -All
HISTORY=NONE -All
The default History option is FAIL.
Virus Notification List
The NOTIFY parameter is used to specify the user names to be
notified if a virus is detected. The names must be valid
user names. Up to 25 NOTIFY entries may be included in the
SCAN.CFG file, each on a separate line. Patterns and
Listnames are not currently supported. If no valid names
are provided, no notification is sent.
If a virus is detected at a user's PC, it is logged in the
scan and history logs, the user's login is halted and a
message is displayed to the user. The message can be a
default message to notify their administrator or a custom
message of your choice. If the SCAN.CFG is present and
names are in the Virus Notification List, those user names
listed will be notified that a virus has been detected on
the users PC. Notification is sent via a 25th line bleep
every 60 seconds until the PC with the infection is
rebooted. The messages will indicate "Virus Found:" and the
user name of the user with the infected PC.
Example SCAN.CFG files
The sample SCAN.CFG file provided contains the following:
INTERVAL = 5
GRACE = 3
MCAFEE = /M
FLOPPY = ON
SWAP = ON
HISTORY = FAIL
NOTIFY = Name1
NOTIFY = Name2
On a network with these parameters, each user's PC will
automatically be scanned every five days. He or she will
have the option of breaking out of this scan for three days
during the grace period. Eight days after the last scan, he
or she will be forced to scan prior to logging in to the
network. The /M option on the McAfee line will provide
additional memory scanning. If there is a floppy disk in a
drive with the door closed, it will be scanned as well.
PCSM will swap itself to disk while the SCAN.EXE program is
executing, this will insure that the PC will have additional
memory to run SCAN.EXE. Since the history parameter is set
for fail, only scans in which a virus has been detected will
be recorded in the history log files. The user names
designated on the NOTIFY lines will be alerted if any
viruses are detected.
Customizing Messages
PC ScanMaster can display custom messages to the user on any
of the three possible exit conditions: PASSED, FAILED, or
ABORTED. Optional text message files called PASSED.MSG,
FAILED.MSG, ABORTED.MSG can be placed in the Scan Log
directory. As PC ScanMaster exits, it looks for the Message
file matching the exit condition and if found, displays it
until the user presses a key.
These message files should only contain text or line draw
characters and be no larger than 79 columns wide and 19 rows
long.
These message files are optional; however, use of the
FAILED.MSG file is recommended to instruct the user
regarding what to do or who to call should a virus be found
on their PC.
PCSMA - Administrator Utility
The PC ScanMaster Administrator utility does not require
installation; however, a BATCH file can be created to
simplify its use. To run PCSMA, you must supply the
directory name of the scan logs that you wish it to view, as
in the following example:
PCSMA F:\SM\LOGS
where F:\SM\LOGS is the drive\path where the Scan
Log files are (This is the same Scan Log
data directory specified in the PC
ScanMaster parameter)
NetPro Computing recommends that the PC ScanMaster
administrator utility (PCSMA) be copied to a local fixed
drive or put in a secure subdirectory in order to restrict
access to its administrator-level functions.
Operation Guide
PCSM - PC ScanMaster
When a user logs onto the NetWare network, PC ScanMaster is
automatically run from the login script. PC ScanMaster
first locates the signature file, reads the SCAN.CFG for
control parameters and then locates the workstation's scan
log record in the database to determine if a scan is needed.
If PCSM.SIG is not found...
and the workstation has a hard disk, the signature file is
created in the directory on C: configured by PCSMA. If the
workstation has no hard disk, no PCSM.SIG file is created
and no scan is performed.
When a Signature file is first created, the values for USER
and WORKSTATION are based on the current user's user name,
and the next unused PC# value in the PC ScanMaster database
for that user name. For example, if a signature file is
being created for 'Bob' and no other signature exists for
this user name, the workstation ID used will be PC1. Now if
'Bob' logs in on a second machine, PC2 will be used to make
that signature unique.
New workstation signatures are automatically added to the
logs, and a scan is initiated. New workstations start in a
grace period mode. For example, if the grace period is 3
days, then new workstations will be able to break out of the
scan for 3 days before a scan is forced upon them. This is
done to ease the introduction of a new system.
Note: Changing the directory for the PCSM.SIG file using
PCSMA after users have PCSM.SIG files created will
cause a new signature to be created for each
workstation. In this case PC ScanMaster will create a
new signature and file for that workstation, a new
entry in the PC ScanMaster database, and leave any old
PCSM.SIG file in place. For this reason, it is
recommended that the signature file directory value set
in PCSMA not be changed once in production.
If PCSM.SIG is found...
then the USER and WORKSTATION signature values are read and
used to search the database for the scan history of that
workstation.
If that signature is not found in the database, a database
entry is added and a scan is initiated in the Grace Mode.
This may happen if the database is erased, or if a user logs
in at another person's workstation and his login script maps
him to a PC ScanMaster database not normally used by that
workstation.
If SCAN.CFG is not found...
then PC ScanMaster will use the following default settings:
Default SCAN.CFG Parameters
Interval - 7
Grace - 3
Floppy - OFF
McAfee - (None)
Swap - ON
History - FAIL
Virus Notification Names - (None)
If SCAN.CFG is found...
then the parameters listed above will be read from SCAN.CFG
and used by PC ScanMaster. The parameters are interpreted
based upon the label which they follow. If a label is not
present or has a blank entry, the default value for that
parameter is used.
If the Interval Period is 0 days...
then a scan will be initiated every time the user logs into
the network. The scan may or may not be required depending
on the value of the Grace Period and the time of their last
complete scan.
If the Interval Period is not 0 days...
then PC ScanMaster will check to see if the user completed a
virus scan on the workstation within the number of days
specified by the Interval Period. If the number of days
since the last completed scan is equal to or greater than
the Interval Period, a virus scan is initiated. If PC
ScanMaster determines that a virus scan is not needed, it
simply allows the user to login without interruption.
If the Grace Period is 0 days...
then every time a scan is initiated by PC ScanMaster, it
will require the users to complete the scan before they are
allowed to login.
If the Grace Period is not 0 days...
then when a scan is initiated, PC ScanMaster will check to
see if the number of days since the last scan is equal to or
greater than the Interval Period plus the Grace Period. If
the grace period has not expired, a message will be
displayed indicating the date the grace period ends, and
they will be allowed to abort using Ctrl-Break until that
date. If the grace period has expired, then a message will
be displayed indicating that the scan is required to login.
If the Floppy Scan is enabled...
then workstations with hard disks will have their floppy
drives scanned also if a scannable floppy diskette in loaded
in a drive A: or B:. No errors will occur if floppies are
not installed or if un-formatted floppies are installed. If
drive A: or B: assignments are temporarily swapped, the
correct drive letter will be selected.
Note: Only workstations with hard disks can have
floppies scanned due to the need of a Signature to
identify the machine and a swap directory for PCSM.
If the Virus Notification List is blank...
then nobody other than the user at the infected PC will be
notified if a virus is detected. The Virus detection will
still be logged in the Scan Logs regardless of the value of
this field.
If the Virus Notification List is not blank...
then the Users listed will be notified by a 25th line
message indicating the user name of the user with the virus.
These messages will be broadcast to all names on the Virus
Notification List. The 25th line bleep will repeat every 60
seconds until the infected PC is rebooted.
The 25th line message broadcast to the Virus Notification
List is similar to the one below:
Virus Found: Ken Fine
If a Scan is Required...
when the user logs in, they will see a screen like the
following with a message in the PC ScanMaster display window
indicating "Scan Required to Login".
Should the user attempt to abort the scan with a Ctrl-Break,
the Scan will be restarted until the user allows the scan to
complete. If the user reboots, it is logged in the Scan Log
as an aborted scan, and scanning will be required again upon
their next login attempt.
If a Scan is Initiated but not Required...
when the user logs in, they will see a screen like the
following with a message in the PC ScanMaster display window
indicating "Must Scan By MM/DD/YY" where the date specified
is the date that their grace period expires.
If the user aborts the scan with a Ctrl-Break they will be
allowed to login without completing the scan. The Scan Log
will record an aborted scan.
While the Scan is in progress...
the user can watch the activity of the scan. The PC
ScanMaster window will display all drives to be scanned, and
flash the drive letter that it is currently scanning. The
SCAN program will display the files as they are being
scanned, and the names of any files found infected.
Note: If a large number of drive's are scanned, or if
multiple viruses are found, the screen may scroll.
This will not affect the performance of PC ScanMaster.
Messages Displayed after the Scan...
are based on the 3 possible exit conditions with which PC
ScanMaster exits, and the presence of a corresponding custom
message file.
Each Scan that begins, will end in one of the following
conditions:
Passed - Complete and no virus found
Failed - Complete and virus found
Aborted - Aborted with Ctrl-Break during Grace Period
When PC ScanMaster ends it will display a message to the
user appropriate to the result of the scan. If the Scan
Passed or Aborted, the message will be displayed for five
minutes or until the user presses a key. If the Scan
Failed, the message will be displayed and the user will not
be able to continue without rebooting the machine.
The following are the default messages that will be
displayed for the Passed, Failed and Aborted conditions
respectively:
No Viruses Found
Virus Found - Contact Your Network Administrator Immediately!
Virus Scan Aborted
If the custom message file is found matching the exit
condition, its contents are displayed instead of the above
default message.
Scan Results..
can be logged depending on the parameters defined on the
History line of the SCAN.CFG file. Below is the information
that may be logged for each USER/WORKSTATION Signature:
Operator's User Name
Last Successful Scan Date/Time
Last Successful Scan Drives (fixed drives which were scanned)
Last Successful Scan Duration (elapsed time in minutes)
Last Successful Scan Result (Passed)
Last Attempted Scan Date/Time
Last Attempted Scan Drives (fixed drives which were scanned)
Last Attempted Scan Duration (elapsed time in minutes)
Last Attempted Scan Result (Passed, Failed, or Aborted)
Consecutive Aborted Scans
PCSMA - Administrator Utility
The PC ScanMaster Administrator utility, PCSMA, enables the
administrator to view, and modify the scan log database, as
well as generate history reports.
PCSMA.EXE requires as a parameter the name of the directory
where the scan logs reside. The syntax for PCSMA is:
PCSMA F:\SM\LOGS
Where F:\SM\LOGS is the directory where the Scan Logs are
kept.
We recommend that you place the PCSMA utility in a secure
directory or on a local hard drive to preclude unauthorized
access, and create a BATCH file to call it with the
appropriate directory.
When you run the Administrator utility you will see a screen
like the following:
From this screen the administrator can select any of the
options shown, or return to DOS by pressing ESC.
Last Scan Results
This menu choice is used to access and manage details
regarding the last scan of individual users. From the
screen shown below, the operator can execute any of the
entries specified on the top portion of the screen. Users
can be located using the PgUp/PgDn keys or by selecting the
machine or operator name search options.
Each USER/WORKSTATION scan log consists of the following
fields plus a detailed memo of the last scans results:
User Name of USER/WORKSTATION Signature
User Address of USER/WORKSTATION Signature
Last Successful Scan (date, time, drives, result,
elapsed scan time)
Last Attempted Scan (date, time, drives, result,
elapsed scan time)
Consecutive Aborts since last complete scan
Force Next Scan flag
The Last Successful Scan field contains the data of the last
time a complete scan was performed and no virus was found.
The Last Attempted Scan field contains data of the last time
a scan was initiated for that user. If the last attempted
scan was completed and no virus was found, then both fields
will contain identical data. These fields contain the date
and time of the scan, the drives scanned, the result, and
the time required to complete the scan.
The Consecutive Abort field shows how many times the user
has aborted the scan process since their Last Successful
Scan.
The Force Scan Flag is used to force a user to scan on their
next login without regard to the Interval Period, Grace
Period, and Last Complete Scan Date. It can be set manually
on one or all users, and is set if a scan detects a virus.
Scan History Log
The History log which is shown below contains a complete
history of all scan activity for each workstation. The
information that is logged is determined by the history
setting in the SCAN.CFG file. These options are Pass, Fail,
Abort, Error, All, or None.
As with the Last Scan Results entries, these entries can be
selected by either using the PgUp/PgDn keys, or by selecting
the Machine or Operator name search options.
As with the Last Results Log, the Scan History Log records
the User Name, User Address, and Operator Name.
The Scan Date/Time field displays the time that this record
was created. It is based on the starting time of the scan.
The Scan Result field shows whether the scan passed, failed,
aborted, or encountered an error. This result entry is
dependent on the information included on the History line of
the SCAN.CFG file.
Scan Duration represents the time from start to finish that
the scan took to complete.
All drives on any PC whether virtual or physical will be
scanned by PCSM. The drives that were scanned are recorded
on the Scan Drive List entry.
Reports Menu
The Report Menu, which is shown below, allows the operator
to print out reports based on several different criteria.
The reports are determined by Data Source, Report Contents,
and Sort/Order. Using this feature is an excellent way to
store history logs, rather than having to maintain, and view
large amounts of scan history data.
Configure PCSM Installation
The Modify Configuration menu is used to determine what this
PCSM installation will be titled, the location of sig files,
and what type of notification will be used.
The system identification is included in all reports and
25th line messages. The purpose of the System
Identification is to determine which instance of PC
ScanMaster a message or report came from on multi-server
networks.
The Signature File Drive Path parameter allows the
administrator to specify a specific directory where the
Signature File is to be located. The default is the root
directory of drive C.
Note: NetPro recommends that the directory for the PCSM.SIG
file is determined before users have been mapped to PC
ScanMaster and not changed afterward. If this
directory is changed after the PC ScanMaster is in use,
new Signature files will be created for each user.
The last option allows on this menu allow the operator to
determine what type of message will be sent to users
specified in the notify list of the SCAN.CFG file. If the
"Notify by Bleep Message" is set to YES Users on the list
will be sent a 25th line message.
Index PCSM Database Files
This choice on the main menu will rebuild the index files to
the scan log. This is only needed in rare cases should the
scan log's files become corrupted.
Force All To Scan
This choice on the main menu will set the Force Next Scan
Flag to ON for all USER/WORKSTATIONS in the database after
first prompting for confirmation.
Simulating a Virus Detection
It is sometimes desirable to simulate a Virus detection to
test your message file or notification process. The McAfee
SCAN.EXE program has a facility which makes simulating a
Virus detection easy and safe.
The SCAN.EXE searches files for byte patterns that indicate
known viruses. One of the SCAN.EXE options is /EXT allowing
you to specify an external file with additional byte
patterns which should be considered an indication of a
virus. By using this option, we can add a byte pattern of a
known string and create a file containing that string.
SCAN.EXE will then detect that file as containing a possible
virus.
Two files on the distribution diskette, VSIM.DAT and
VSIM.EXE, are provided for simulating a virus detection.
VSIM.DAT is a data file which can be used by SCAN.EXE to add
the pattern 'Fake!Virus' to the list of byte patterns that
it considers to be an indication of a virus. VSIM.EXE is a
text file containing only that string. It is renamed to an
EXE so that SCAN.EXE will scan it.
To simulate virus detection with PC ScanMaster, add a line
similar to the following to the SCAN Options line (3rd line)
of the SCAN.CFG file:
/EXT N:\SM\VSIM.DAT
Where: N:\SM is the path where you have placed VSIM.DAT
Place the VSIM.EXE on your C: drive. When PC ScanMaster is
run, it will detect the file VSIM.EXE as being infected and
report "Found Fake Virus". PC ScanMaster will act as though
a real virus has been detected.
NOTE: This works by telling SCAN.EXE to recognize the byte
pattern "Fake!Virus" as an indication of a virus we have
named "Fake Virus". The VSIM.EXE is a simple ASCII file
containing the string "Fake!Virus". When scanned, it is
considered infected. Simply remove the /EXT option or
change the string in VSIM.EXE to disable the simulation.
Troubleshooting
Diagnosing Problems
In order to help diagnose problems that might be encountered
while using PCSM, NetPro has provided a means for logging
PCSM's status by setting a DOS environment variable. To set
this variable, at a DOS prompt type....
SET PCSMLOG=ON
When PCSM.EXE is executed, diagnostic data will be recorded
in a file called PCSM.LOG located on the C: drive in the
root directory. Below is a sample PCSM.LOG file...
03/20/92 13:56:31 Program expires NEVER
03/20/92 13:56:31 From command line, SCAN.EXE path is: F:\PUBLIC\PCSM
03/20/92 13:56:31 From command line, PCSM data path is: F:\PUBLIC\PCSM\LOGS
03/20/92 13:56:31 From command line, home path is: F:\
03/20/92 13:56:31 From SCAN.CFG, interval period is: 0
03/20/92 13:56:31 From SCAN.CFG, grace period is: 1
03/20/92 13:56:31 From SCAN.CFG, McAfee parameters are: /M
03/20/92 13:56:31 From SCAN.CFG, floppy switch is ON
03/20/92 13:56:32 From SYST32.SMD, system name is PCSM from NetPro Computing
03/20/92 13:56:32 From SYST32.SMD, workstation path is C:
03/20/92 13:56:32 SET PCSMLOCAL is false
03/20/92 13:56:32 PCSM.SIG hidden attribute removed
03/20/92 13:56:32 PCSM.SIG read-only attribute removed
03/20/92 13:56:32 Username found in PCSM.SIG is ROSS HOLEMAN
03/20/92 13:56:32 User ID found in PCSM.SIG is PC2
03/20/92 13:56:32 PCSM.SIG hidden attribute set
03/20/92 13:56:32 PCSM.SIG read-only attribute set
03/20/92 13:56:35 Detected hardware local drives => CD
03/20/92 13:56:51 Swapped to drive C: for SCAN
03/20/92 13:56:52 C:\PCSM.RPT erased
Common Questions and Problems
Question: Will logging into the network at a different
machine affect PCSM?
Answer: As long as you are mapped to the PCSM database
everything will be handled properly according to
the PC signature. However if the users profile
maps them to a PCSM database other than the one
normally used by that PC, PCSM will use the 2nd
database to determine if a scan is needed.
Generally this will mean a scan is initiated in
the Grace mode as it will treat you as a new user.
Problem: PCSM aborts abnormally on a few machines.
Answer: If the SWAP option is off the PC may be running
out of memory, try turning the SWAP option on.
If the SWAP option is on, verify that the machine
has at least 210K of free disk space.
Problem: PCSM can't find SCAN.EXE file.
Answer: Check the command line and verify that the only
parameters passed to PCSM are valid directories for
SCAN.EXE and the Log files. One common mistake is
to specify the filenames as well as the directories.
Problem: PCSM is running but does not perform as configured
in SCAN.CFG.
Answer: Make sure that SCAN.CFG uses the proper syntax
(See page 15 for example) and the labels,
Interval, Grace, etc. are included. Earlier
versions of PCSM did not require the Labels in
SCAN.CFG. Use the PCSMLOG environment variable
to see the parameters the PCSM is actually using.
For more information, please contact:
NetPro Computing, Inc.
8655 East Via de Ventura, Suite E155
Scottsdale, AZ 85258
(800) 998-5090 - Sales
(602) 998-5008 - Voice
(602) 998-5076 - FAX
(602)998-5093 - BBS
70524,2670 - CIS
