0.0 What is an FAQ (Frequently Asked/Answered Questions)?
0.1 What is the current version and what system software is it compatible with?
0.2 Changes in 4.0.3-4.0.8.
1.0 Installation questions
1.1 What is the process for updating the SAM Virus Definitions file with a new file?
1.2 How am I protected during a software install if I've disabled SAM?
2.0 Virus Definition Questions
2.1 What is the SAM Virus Definitions file?
2.2 What is the SAM User Definitions file?
2.3 Why are there different icons in the Virus Definitions list?
2.4 Why are some of the virus names duplicated?
2.5 Where does the SAM Virus Definitions file go?
2.6 Do I need more than one SAM Virus Definitions file?
2.7 Do I need my old SAM User Definitions file?
2.8 When I receive a Virus Update Postcard, do I need to enter in the definition,
2.9 Where else can I get the SAM Virus Definitions file?
3.0 General Questions
3.1 What is the difference between the postcard virus update, disk from CS, and the SAV-U program?
3.2 Where is the SAM Virus Help file?
3.3 Do I need the SAM Virus Help file?
3.4 Does the SAM Virus Definitions filename need to be spelled exactly?
3.5 When a new virus is discovered, how will I be notified?
3.6 How to get the latest SAM Virus Definitions file in the future?
3.7 I've downloaded the files from Compuserve but it says that they were not received. Now I have these files on my drive with the correct icon but the names are wrong.
4.0 Technical Questions
4.1 Why am I getting a lot of 'This file is not a valid Resource Fork' errors?
4.2. Why am I getting errors on a lot of compressed files? I thought that SAM could scan inside of these.
4.3 I try to look at the exceptions list but I get a crash or a freeze or it's full of garbage characters.
4.4 After I installed 4.0, I restarted and got a message that said 'The SAM Definitions file is either not in the system folder or it is invalid'.
4.5 Why, during the install, does it ask me to move the Apple Modem Tool?
4.6 I did as custom install and I cannot get the Update Definitions function to work.
4.7 How do I scan a single folder? There is no longer a choice for it under any of the menus?
4.8 I've installed SAM but it's slowing my startup down a lot. What can I do to speed this up?
4.9 How do I have SAM conduct a Shutdown scan like it did in 3.5?
4.10 I keep trying to connect to SAM Central but it won't answer.
4.11 I've just updated a program and SAM say's that it's changed. How do I get rid of this message?
4.12 What else can I do if I've tried everything and SAM still causes problems?
5.0 Telecommunications Questions
5.1 How do I turn on MacBinary?
5.2 Which protocol should I use?
6.0 Patcher Questions.
6.1 What is the SAM408 patcher and what does it do?
6.2 Where can I find the SAM408 patcher?
6.3 What is the exact name of the SAM408 patcher file?
6.4 When I apply the SAM408 patcher, I have problems. What can I do?
6.5 Once I have patched SAM, how do I build a SAM 4.0.8 Decontamination Disk?
7.0 How to reach Symantec
Beginning of the Answers
0.0 What's an FAQ? An FAQ is a compilation of the most common question about a subject and their answers. This is an established technique (adopted from its widespread use on USENet) for reducing the repetition of questions and answers online services (such as BBS' CompuServe and America OnLine).
Our intent is to answer as many questions as possible so you don't have to leave a question and call back to get an answer to something that we've already covered a few times before.
We will be aggressively maintaining these to insure that they always have answers to the most current issues pertaining to a product. Naturally users are encouraged to read the FAQ before posting. Hopefully you'll find your question (and its answer) here (which will save you time and money).
Please note that this is not intended to replace the manual or the built-in help. It is prepared and maintained by our tech support staff so our FAQ's may not have breadth or editorial polish of our official documentation. Hopefully this will answer some questions that our technical writers couldn't foresee.
You may have been referred to this document by one of our technicians or another customer. Please don't take offense to this. We are trying to provide the answers in the best possible way.
0.1 What is the current version and what system software is it compatible with?
SAM 4.0.8 is the current shipping version. It is fully compatible with system 7.5.2 and back to system 6.07.
NOTE: If you have SAM 3.X, and you are using System 7.5, you must upgrade to SAM 4.0 for compatibility.
NOTE: SAM 4.0 definitions are different from SAM 3.5 defs. Do not use the 3.5 defs with 4.0 and vice versa.
0.2 Changes in 4.0.3-4.0.8
SAM 4.0.3 now includes an option in the Alert prefs to send a message to an NLM module of NAV for Networks running on a Novell Netware server that a virus has been found.
It also fixed a problem, under 7.5, that occurred when scanning DOS disks.
You can now boot from a CD ROM and run SAM from a locked floppy decontamination disk as SAM will now ask you to locate the Virus Defs file if the defs file is not on the boot disk.
Finally, we've added a Menu Security option that , once set, keeps the SAM intercept and prefs file from being moved out of the system folder, as long as SAM is active.
SAM 4.0.5 Added Virus Definition for the HC 9507 HyperCard virus.
SAM is now compatible with the new Resource Manager, including the Power Macintosh 9500.
Fixes intermittent Trojan Horse alerts on Power PC machines when launching Microsoft Excel or Word.
1.0 Installation Questions
1.1 What is the process for updating the SAM Virus Definitions file with a new file?
The SAM Virus Definitions file should be moved into the System Folder on your normal startup volume (which is usually your hard drive). You should be asked if you wish to replace the current SAM Definitions file; please do so. When you restart your Macintosh the new information will become active. NOTE: If you are not asked to replace the older defs, verify that the name of the replacement file is SAM Virus Definitions and that it is being placed loose in the System Folder.
1.2 How am I protected during a software install if I've disabled SAM?
When installing software and SAM Intercept is running, it is not unusual for a number of Suspicious Activity Alerts to appear as the software is installed. To make installation of software as painless as possible, SAM Intercept will let you temporarily disable these alerts, but if a known virus tries to sneak in during an install, SAM will still detect it, stop it, and alert you of its presence. The Floppy scan should also still be active, unless you've restarted with extensions off, and you'll be able to scan floppies for known viruses as well during the installation process.
2.0 Virus Definition Questions
2.1 What is the SAM Virus Definitions file?
The SAM Virus Definitions file contains information on detection and repair about all the known Macintosh viruses. It is created at Symantec and provided for use by registered owners of SAM. It also allows you to update SAM to see and remove new viruses, virtually bypassing any need to replace the entire product.
2.2 What is the SAM User Definitions file?
The SAM User Definitions file contains virus definition information that is manually typed in from virus alert postcards that arrive in the mail as new viruses are discovered. Alternatively, if the SAM Virus Definitions file is updated instead, any resident SAM User Definitions file may be removed. The SAM User Definitions file contains update information that SAM uses for detection but does not support the repair capabilities that are in the SAM Virus Definitions file.
2.3 Why are there different icons in the Virus Definitions list?
The different icons indicate whether the definition is built into your current SAM Virus Definitions file, or that it was added to the SAM User Definitions file from information you typed in as a result of receiving a Virus Alert postcard. The icon showing a pencil indicates that it belongs to the SAM User Definitions file.
2.4 Why are some of the virus names duplicated?
If a virus name is duplicated, it means that a user definition was added and then a newer Virus Definitions file was added at a later date that also contained the information necessary to detect and repair that virus. To remove the duplicate, simply delete the corresponding User Definition.
2.5 Where does the SAM Virus Definitions file go?
The SAM Virus Definitions file belongs inside of the System Folder of the startup volume, usually a hard drive that the Mac starts up from.
2.6 Do I need more than one SAM Virus Definitions file?
No. Always use the latest available SAM Virus Definitions file which is available from a number of different on-line sources and Symantec Customer Service.
2.7 Do I need my old SAM User Definitions file?
If your SAM User Definitions file contains the definitions that are also part of the SAM Virus Definitions file, then you do not need your older User Definitions file. You can check this by examining the virus definitions list in SAM Virus Clinic.
2.8 When I receive a Virus Update Postcard, do I need to enter in the definition, or can I get an updated Virus Definitions file right away?
The Virus Update postcards are sent out as soon as a new virus is discovered. There is usually a small delay between the time when the postcard is sent out and when a new Virus Definitions file is made available. To be as safe as possible, you should always enter in the information on the postcard, and then install the Virus Definitions file when it is released.
2.9 Where else can I get the SAM Virus Definitions file?
Currently, Symantec posts this file on the following on-line services when a new virus is discovered: Compuserve, America Online, AppleLink, and the Symantec BBS. It is also available on disk from Customer Service and it can be received automatically via the SAV-U program. If you have a modem, you can also use the SAM Automatic Update tool. This is found under the Tools menu as Update Virus Definitions.
3.0 General Questions
3.1 What is the difference between the postcard virus update, disk from CS, and the SAV-U program?
The postcard virus update is sent to all registered users anytime a new virus is discovered. A disk containing the latest SAM Virus Definitions file can be obtained from Symantec Customer Service for $12. Alternately, for $45 per year, the SAV-U program will automatically send out a disk containing the latest SAM Virus Definitions file anytime a new virus is found. NOTE: The postcard information allows for detection only. The Virus Definition file is necessary for removal of the new infection, should it be found.
3.2 Where is the SAM Virus Help file?
The SAM Virus Help file is located within the System Folder of the hard disk your Mac started from.
3.3 Do I need the SAM Virus Help file?
For SAM to protect you from viruses, the SAM Virus Help file is not necessary, but for information on what each of the Macintosh viruses does, this file should be present.
3.4 Does the SAM Virus Definitions filename need to be spelled exactly?
Yes.
3.5 When a new virus is discovered, how will I be notified?
When a new Macintosh virus is discovered, Symantec sends a postcard containing the new virus definition information to all registered users of SAM. This information can be entered through SAM Virus Clinic to obtain complete protection and detection capabilities for the new virus.
The postcard also serves as notification for those who have access to a modem to download the updated SAM Virus Definitions file. Messages and announcements describing the new virus are also posted on America Online, AppleLink, CompuServe, and the Symantec BBS. The new definitions can also be downloaded via the automatic SAM Central Server system.
Since Symantec's customer service department (800-441-7234) maintains the registered user database, they should be contacted when your current mailing address changes. This will ensure that the postcards are received promptly.
3.6 How to get the latest SAM Virus Definitions file in the future
If you have access to a modem, the latest SAM Virus Definitions file is available for downloading from the following sources:
America Online:
- Keyword: Symantec
- enter the New Virus Information area
- Open the New Virus Definitions library
- look for the file named: SAM Virus Definitions
AppleLink:
- path: Third Parties
3rd Party Demos/Updates
Software Updates
Companies S-Z
Symantec
- file name: SAM Virus Definitions
CompuServe:
- Go: SYMVIRUS
- enter library 2
- file name: SAMDEF or keyword SAMDEF (as the name may not always be the same)
Symantec BBS:
- (541) 484-6699 300,1200,2400 baud
- (541) 484-6669 9600 baud
- Type /go SAM at any prompt to bring you to the SAM area
- enter the SAM file library
- look for file name: SAMDEF or keyword SAMDEF (as the name may not always be the same)
One final option for obtaining the latest SAM Virus Definitions file is to order it on a diskette for $12 from Symantec's customer service department at 800-441-7234.
3.7 I've downloaded the files from Compuserve but it says that they were not received. Now I have these files on my drive with the correct icon but the names are wrong.
There is in an intermittant problem with downloading the files from Compuserve that causes the files to be transferred with the right icon but with the wrong name. The usually end up keeping the SAMDEF.BIN and SAMVHP.BIN names and these must be changed to SAM Virus Definitions and SAM Virus Help respectively.
4.0 Technical Questions
4.1 Why am I getting a lot of 'This file is not a valid Resource Fork' errors?
This error is usually nothing to worry about. A lot of programs (ours included) "vise" some of the code. This means that it is compressed and only accessible by the program. Something to watch for is if other programs that did not show these errors on one scan start to show them on future scans. Otherwise, this is a normal situation.
4.2. Why am I getting errors on a lot of compressed files? I thought that SAM could scan inside of these.
SAM can only scan inside of several types of compression formats. If you have a newer format or a different program than SAM can scan inside of, you may get a lot of errors for files compressed with that program.
4.3 I try to look at the exceptions list but I get a crash or a freeze or it is full of garbage characters.
The error in the Exceptions list is caused by a corrupted SAM prefs file. However, the prefs are becoming corrupted due to some init that is causing a Remember problem on your Mac. Do you get any messages at boot time that SAM flags each time but that it is not Remembering? If so, rename that init so that it loads before SAM, delete the SAM prefs that are in the system folder:Preferences folder, and then restart.
Another solution is to update to the latest version of SAM (now 4.0.3) This version shouldn't have this problem. If you do receive the update, you will want to delete the SAM prefs file as described above.
4.4 After I installed 4.0, I restarted and got a message that said 'The SAM Definitions file is either not in the system folder or it is invalid'.
This is most often due to an older version of SAM (3.0 or 3.5) being left somewhere in the system folder and looking for an older defs file (old SAM's can't use the 4.0 defs file). This is doubly likely if you are able to open the SAM 4.0 application, which won't open if it cannot find a valid defs file. Look in the system folder, the control panels fold, and the extensions folder for an old copy of SAM Intercept or a renamed copy.
However, there is also the possibility that you are using System 7.0.0. In this case, the problem is caused because of a bug in the system software that is fixed with an upgrade to 7.0.1.
4.5 Why, during the install, does it ask me to move the Apple Modem Tool?
This not a conflict but a need to move and replace an item that is in use. Easy solution is to move the Apple Modem tool that is in the extensions folder to the trash and then restart. Then try the install again.
4.6 I did as custom install and I cannot get the Update Definitions function to work.
If you did a custom install, the Communications Toolbox items are not installed unless you select them. The Apple Modem Tool and the Prefs that come with SAM 4.0 MUST be used. Just do another custom install for these items and you should be fine.
4.7 How do I scan a single folder? There is no longer a choice for it under any of the menus?
The scanning of single folders under SAM 4.0 is part of the Hot Key set up window. There are two ways to do this. You can either set up a hot key folder scan if you have a single folder that you often scan or you can set up a hot key prompt. The prompt will bring up a standard file dialog, alowing you to locate the folder in question. You can also do this in the SAM window by choosing to view the window By Name. This will give you the system 7 triangles to the left of the icons, allowing you to open the icons and show contained folders. Either will allow for what you're trying to do.
4.8 I have installed SAM but it is slowing my startup down a lot. What can I do to speed this up?
Try this: Open the SAM application. Click on the Preferences button on the right. Choose the Scan option. In the top box, make sure that 'Use Quick Scan' is enabled. Restart. It may take the same amount of time for the first re-scan to occur as SAM creates the Quickscan file. Now restart again. It should take a significantly shorter time to restart now.
4.9 How do I have SAM conduct a Shutdown scan like it did in 3.5?
The scanning of of a drive at shutdown under SAM 4.0 is now part of the Scheduler window. Open the Scheduler from the SAM application Tools menu. Now select New and name this Schedule Shutdown scan (or what ever you'd like to call it). Choose what you would like to have scanned from the Event Type button. Choose Shutdown from the When button and Always from the How Often button. Hit Done and you're done. It's saved and should begin to scan at shutdown from now on.
4.10 I keep trying to connect to SAM Central but it won't answer.
Try selecting the Hayes Compatible or the Generic 2400 setting from the list and a slower connection speed and see if that helps.
4.11 I've just updated a program and SAM say's that it's changed. How do I get rid of this message?
Try the following and see if it helps. NOTE: This will work only if you have had the Quick Scan option on.
1. Open the SAM application.
2. From the file menu, select "Delete File". Search to the root level of your hard disk and select the otherwise invisible file "SAM QuickScan file". ( This "clears" SAM's memory of previously scanned files.)
3. Restart your computer and SAM will install a new "QuickScan" file.
4.12 What else can I do if I've tried everything and SAM still causes problems?
One thing to try. Corrupted desktop files can sometimes cause SAM some problems.
Note: you will need to have either NUM or some other program that allows you to see and change invisible file attributes. Start by deleting the SAM preferences file in the System folder: Preferences folder.
Next, you should delete your desktop file(s) and let the Finder create new ones . To delete them, open Norton Utilities and at the main menu type an 'e' (key shortcut for the disk editor). Then open the volume that had the problem. After the drive is analyzed, you will see a 'Directory' window. Look down that window until you see the file called 'Desktop'(you may see Desktop DB, Desktop DF if you use system 7). Click on the first desktop file once to highlight it. Hit the Edit Info button at the top. In the information window that appears, uncheck "Invisible" and add the word Old to the beginning of the file's name. Repeat this for the other desktop files if they exist.
Rebooting from your hard disk, your Mac will rebuild the desktop automatically. Let it do that. You can then delete the "Old" files that are now visible.
5.0 Telecommunications Questions
5.1 How do I turn on MacBinary?
MacBinary is a form of encoding a Macintosh file so that it can easily be sent over a modem and stored on another computer. Most terminal communications software automatically uses this and it is unnecessary to turn it on, but if not, refer to your telecommunications users manual for assistance.
5.2 Which protocol should I use?
The protocol to use when downloading a file from an on-line service varies from service to service. Some use their own proprietary protocol, while others present the user with a list to choose from. Generally, the best one to pick, is that which is supported by your terminal communications software and the on-line service and provides the fastest method of getting the file. Unfortunately, there are a number of different protocols, and the best one to use depends on the software being used and the on-line service. Some common protocols are xmodem, ymodem, zmodem, and CIS-B. Refer to your telecommunications manual and the on-line service's technical support for more help.
6.0 Patcher Questions.
6.1 What is the SAM408 patcher and what does it do?
Symantec has provided a patcher which will update any version of SAM 4.0 or later to SAM 4.0.8.
6.2 Where can I find the SAM408 patcher?
The SAM408 patcher is available through all of the following on-line services; AOL, CompuServe, the Symantec BBS, the Symantec FTP Site, and on AppleLink. Please check the Symantec software libraries on each of the services for the patcher.
6.3 What is the exact name of the SAM408 patcher file?
The name of the file should appear as: SAM408up.sea.
6.4 When I apply the SAM408 patcher, I have problems. What can I do?
Please try removing all of SAM (refer to the SAM Read Me Document for specifics), restart with extensions off (To temporarily boot with your extensions off: restart while holding down the shift key. You will see the "Welcome to Macintosh" splash screen which will read "Extensions off." At this point, you can release the shift key). Re-install SAM from the original disks. Re-apply the 4.0.8 patch. Restart.
6.5 Once I have patched SAM, how do I build a SAM 4.0.8 Decontamination Disk?
You need a floppy with the patched SAM 4.0.8 and the 4.0.8 virus defs from the System folder. Then, boot from the machines System CD ROM and run SAM from the floppy. You will be asked to locate the virus defs, but should be able to run fine.
or,
1. Make sure your Decontamination Disk is unlocked and insert it in the floppy
drive.
2. Double-click on the floppy and drag the SAM Virus Definitions to the trash.
3. Open your System Folder on the hard drive and drag the newly updated SAM
Virus Definitions to the floppy disk.
4. Re-lock the floppy and put away for safekeeping.
5. In a virus emergency, start your computer from the Decontamination Disk and
run SAM. Have it repair or delete any infected files.
6. If you have Word Macro viruses that you wish to repair, don't worry, first
delete or repair files infected with any other type of virus or trojan horse
while started up off your Decontamination Disk. Then start up your computer
normally and run SAM 4.0.8 off of your hard drive to repair or delete any Word
Macro virus infected files.
7.0 How to reach Symantec
If you have questions after consulting the SAM User manual, Help system, or Read Me file, call our Technical Support Team. If you are located in the USA, please refer to pages CSP-3 and CSP-5 of your manual and have all the requested information ready before calling. If you are outside the USA, please refer to pages CSP-3, CSP-4, and CSP-5, or contact your local Symantec dealer for information about obtaining technical support.
Symantec Corporation
Technical Support phone line: (541) 465-8420, 7:00 AM to 4:00 PM Pacific Time
Symantec Corp.
175 W. Broadway
Eugene, OR. 97401-3003
We can also be reached through electronic mail on the following on-line services:
America Online: Keyword: SYMANTEC
Compuserve: GO SYMVIRUS
The Symantec BBS
2400/1200/300 baud: (541) 484-6699
9600 baud: (541) 484-6669
AppleLink: NORTON.TECH
Symantec's international partners are located throughout the world. Please call our Customer Service Center in Oregon at (800) 441-7234 for the name, address, and phone number of the international office closest to you.
