home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Shareware 1 2 the Maxx
/
sw_1.zip
/
sw_1
/
VIRUS
/
USING91.ZIP
/
USING91.ASC
Wrap
Text File
|
1992-05-29
|
23KB
|
599 lines
USING MCAFEE ASSOCIATES SOFTWARE FOR SAFE COMPUTING
Version 91 Update.
This text file includes the information needed to augment the book:
" Using McAfee Associates Software For Safe Computing "
to include descriptions of enhancements and new options released following
Version 86. The file also includes corrections to the book itself. For
more information about the book see the end of this file.
The file is structured to be printed as-is on a standard 9-pin dot-matrix
printer. The file begins with the printer control codes to select six
lines per inch and the compressed font, 17 characters per inch. Position
the continuous form paper in your printer so that the print head is at
the left margin of the paper on the first line after the perforations.
Then enter the command:
COPY USING91.UPD LPT1: <Cr>
where LPT1: is your printer device designation.
After the file has been printed, discard this page. Trim off the bottom
and right-hand side of the remaining pages to a 5-1/2" wide by 8" long.
Staple the pages together in the upper left-hand corner and put them in
the back of the book for ready reference.
This file is provided by the publisher as a service to persons who have
purchased the book. All right reserved, 1992.
Using McAfee Software May 29, 1992 UD-1
USING MCAFEE ASSOCIATES SOFTWARE FOR SAFE COMPUTING
Version 91 Update.
Note: Page references like this: "UD-nn" refer to this update document.
Page references like this: "nn" refer to the original book.
McAfee Associates software status.
Key information about the most recently version of the McAfee As-
sociates software is listed below. You can use this list to verify that
you have the latest version of each of the programs installed.
Program Size Release date
CHKSHLD 7,839 12-10-1991
CLEAN 96,570 05-27-1992
NETSCAN 75,118 05-28-1992
VALIDATE 12,197 03-24-1992
VIRUSCAN 75,801 05-27-1992
VSHIELD 41,005 05-27-1992
VSHIELD1 11,323 02-14-1991
Book Update Information:
Page 137: Please changes the telephone numbers listed for Computer
Software Library of New Zealand as follows: Orders: (03) 615-9333
FAX: (03) 615-9303 BBS: (03) 615-9313
Page 138: Add to the description of Jim's Consulting Service the following
BBS number: (313) 741-9529. Chicago office number: (708) 940-0843.
Please note that the firm name has been changed to: James C. Shaeffer and
Associates
Page 142: Update the Options listing in the index. See page UD-6
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-2
New Program Features:
Version 91 Released May 27-28, 1992
Shortly after Version 90 was released it was found to have several minor,
but annoying bugs. Version 91 corrected these bugs, and added the
/NOREMOVE option to VSHIELD.
/NOREMOVE Option
By issuing the command:
VSHIELD /REMOVE <Cr>
one can "uninstall" VSHIELD. In other words, remove VSHIELD from memory.
In some situations the person responsible for operation of the McAfee As-
sociates software may want to disable this feature. The /NOREMOVE option
disables the /REMOVE option.
Version 90 Released May 20, 1992
Validation of Program Files.
The SCAN and NETSCAN programs use two methods to detect virus infections.
One way is to examine program files to see if they include sequences of
bytes that can be associated with specific viruses. The viruses that can
be detected are listed in the file: VIRUS.LST. This file is updated as new
virus signatures are added, so you should always print out the latest ver-
sion of this file when you install a new version of the McAfee software.
SCAN and NETSCAN can also perform a checksum validation of each program
file. When SCAN or NETSCAN is executed with the /AV option, a validation
code is appended to each of the program files included within the scope of
the scan. (See page 58 for more about this.) Later if SCAN or NETSCAN is
executed with the /AV option, the validation code for each program is
recalculated and the result is compared with the appended value. See page
65 of the book for details.
Version 90 adds a second validation technique. If SCAN or NETSCAN is ex-
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-3
ecuted with the new /AF <filename> option, validation codes and generic
disinfection information are placed in the specified file rather than being
appended to the individual program files as is the case with the /AV op-
tion. Later if SCAN or NETSCAN is executed with the new /CF <filename>
option, validation codes are recalculated and compared with the values
stored in the specified file. Of course, the filename used with the /AF
option must be specified when performing the later validation. The new /RF
<filename> option is used with SCAN and NETSCAN to remove validation codes
from <filename>. Note that if <filename> is stored on a diskette, the
validate codes and disinfection information will be available even if a
virus or other exception condition has disabled the fixed disk.
Generic Disinfection.
CLEAN-UP Version 90 has a new option: /GRF <filename> similar in function
to the /GENERIC option introduced with Version 89B except that CLEAN-UP
looks in <filename> for the generic recovery information. The examples
below show how to use this new validation technique.
SCAN C: D: /AF C:\VALCODES.DAT Put validation codes and generic
disinfection information for
drives C and D into a file called
VALCODES.DAT.
SCAN C: D: /CF C:\VALCODES.DAT Validate drives C and D using the
validation codes previously stored
in VALCODES.DAT.
Note: These two examples also work with NETSCAN.
CLEAN C: D: /GRF C:\VALCODES.DAT Perform a generic disinfection of
drives C and D using the
disinfection information previously
stored in VALCODES.DAT.
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-4
History File of Scans.
The /REPORT <filename> option causes SCAN to create a text file of the mes-
sages generated during its operation. SCAN and NETSCAN Version 90 include
a new option: /HISTORY <filename> which works the same way as the /REPORT
option except that the messages are appended to <filename>. (/REPORT over-
writes <filename> if it already exists.) If the same filename is specified
each time SCAN is executed, the specified file becomes a history of the in-
dividual scans. This can be helpful when researching a virus attack in an
organization. By examining the "history" files of individual PCs, it may
be possible to determine which PC was the first to become infected, and the
time when the infection occurred. This may be enough information to deter-
mine how the infection occurred.
Additional ERRORLEVEL Values.
SCAN generates a value for the DOS ERRORLEVEL to signal its status when it
completes a scan as described on page 71. The ERRORLEVEL value can be
tested by a batch file program to verify correct operation of SCAN and
NETSCAN.
SCAN Version 90 added two additional values as follows:
ERRORLEVEL Interpretation
3 An uncertified program file was detected.
4 The user entered <Ctrl>-C or <Ctrl>-<Break>
to abort the scan.
Note: The two new ERRORLEVEL values also apply to NETSCAN, although they
are not mentioned in the NETSCAN DOC file. Please add these two new values
and their interpretations to the table on page 71 of the book. If you want
to test for these values in a batch file, be sure to put their tests first
as illustrated below:
SCAN C: etc.
IF ERRORLEVEL = 4 GOTO USERBREAK
IF ERRORLEVEL = 3 GOTO UNCERT
IF ERRORLEVEL = 2 GOTO ABORT
IF ERRORLEVEL = 1 GOTO VIRUSES
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-5
Remember that the test is really for "equal to or greater than."
Version 89B Released March 25, 1992.
Note: This version follows Version 86. Version 87 and 88 were passed
over because Trojan Horse versions with these numbers were released to
BBS's by persons unknown.
"Generic" Virus Detection.
Version 89 added a "generic virus" detection feature. (This is not re-
lated to the generic disinfection feature.) McAfee Associates has dis-
covered that a number of viruses share certain common code sequences
that are associated with attempts to modify other programs. If a scanned
program is found to contain these sequences it is identified as being in-
fected, and the virus ID code is given as [GenF]. Testing has shown
that the sequences are quite unique so that the false alarm rate should
be quite low. All the McAfee Version 89B virus detection programs
have this feature. The CLEAN program cannot disinfect programs identified
as infected with the [GenF] virus since details of individual infections
will vary. Instead you must delete the infected programs, and replace
them with copies known to be uninfected. You can use SCAN with the /D
(delete) option to delete the infected files.
Command Line Options Added After Version 86:
Options not described in the book are listed here in alphabetical order.
Each option listing indicates the program(s) to which the option applies,
and the version number of its introduction. See page UD-7 for an index
listing of all the options.
/AF <filename> SCAN and NETSCAN Version 90.
Add validation codes and generic disinfection information of the EXE and
COM files on the drive(s) specified on the command line to <filename>.
/CF <filename> SCAN and NETSCAN Version 90.
Compare current validation codes to the validation codes stored in
<filename>. The /AF option must be used before this option is used.
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-6
/GRF <filename> CLEAN-UP Version 90.
Use the generic disinfection information stored in <filename> to disinfect
the drive(s) specified on the command line. The /AF option must be used
before this option is used.
/HISTORY <filename> SCAN and NETSCAN Version 90.
Append run-time messages to <filename> to maintain a running record
(history) of individual scans.
/NOBREAK VSHIELD Version 86.
The book failed to indicate that this option can be used with the
VSHIELD program. This option disables <Ctrl>-<Break> and <Ctrl>-C during
execution of VSHIELD
/NOCONT VSHIELD Version 89.
If VSHIELD detects a non-certified program (see page 66) when the
/CV option is used, it issues the message: "Proceed Anyway? Y/N." The
/NOCONT option prevents the user from executing the program even if
the user responds Y.
/NOREMOVE VSHIELD Version 91.
Use this option at the time VSHIELD is installed to disable the /REMOVE op-
tion. (See page 42.)
/RECONNECT VSHIELD Version 89.
VSHIELD traps system interrupts to detect when programs are being loaded
for execution. If a network driver is loaded after VSHIELD, it may over-
ride these traps. Use this option to reestablish the traps.
/RF <filename> SCAN and NETSCAN Version 90.
Remove validation codes and generic disinfection information of EXE and COM
file on the drive(s) specified on the command line from <filename>.
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-7
Options Index Page 142
<d:>\, 58 NB, 40, 45
@<filename>, 57 NLZ, 61
A, 59, 82 NOBREAK, 64, UD-6
ACCESS, 39 NOCONT, UD-6
AF <filename>, UD-5 NODISK, 94
AG, 33, 65 NOMEM, 40, 61
AV, 33, 65, 73 NOPAUSE, 64, 84
BELL, 62 NOREMOVE, UD-6
CERTIFY, 44, 67, 73 NPKL, 61
CF <filename>, UD-5 NUL, 59
CG, 67 Q, 51
CHKHI, 62 RECONNECT, UD-6
CONTACT, 41 REMOVE, 42, 45
COPY, 39 REPORT, 64, 84
CV, 43, 67, 73 RF <filename>, UD-6
D, 62 RG, 67
DATE, 63 RV, 67, 73
DEBUG, 51 SAVE, UD-2
E <.xxx>, 59, 83 SHOWDATE, 65, 73
EXT <d:filename>, 60 SP, 65, 84
F, 41 SWAP, 34, 42
FAST, 60 SUB, 61
for CLEAN program, 81 UNATTEND, 73
for NETSCAN program, 73 V,51
for SCAN program, 56 WINDOWS, 43
for VSHIELD program, 37
for VSHIELD1 program, 44
FR, 63, 83
GENERIC 79
GRF <filename>, UD-6
HELP, 52, 63
HISTORY <filename>, UD-6
IGNORE, 39
LH, 34, 41
LOCK, 42
M, 40, 60
MAINT, 63, 73
MANY, 64, 73, 83
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-8
Information about the book:
"Using McAfee Associates Software for Safe Computing"
follows for the benefit of those reading this file who do not have a copy.
If you are printing this file to update your copy of the book, you can dis-
card this and the following pages.
- - - - - - - - - - - - - - - - - - -
" Using McAfee Associates Software for Safe Computing "
is a valuable new book for users of the McAfee VSHIELD, SCAN, NETSCAN, and
CLEAN programs. The book was written by Robert V. Jacobson with a
Foreword by John McAfee. The publisher is:
International Security Technology, Inc.
515 Madison Avenue, Suite 3200
New York, NY 10022.
Telephone: (212) 288-3101.
FAX (212) 644-6828.
See the end of this file for ordering information.
"Using McAfee Associates Software for Safe Computing" is organized as fol-
lows: Chapter One - The virus threat. Complete details about how the two
basic infection techniques: insertion, and linking, work, and how viruses
use these techniques to infect PC's. Chapter Two - How to structure a
reasonable virus control program for a single user, a small group, or a
large organization. Detailed instructions for setting up a virus-free
environment are included. Chapter Three - Proven, practical virus preven-
tion techniques you can use to lower your risk of infection.
The next four chapters describe how to use the SCAN, NETSCAN, VSHIELD,
VSHIELD1, CHKSHLD and CLEAN programs and how they are related to one
another. Details of the Version 86 command line options, examples of the
run-time messages, and sample batch files are included. Chapter Four -
Virus interception using VSHIELD, and VSHIELD1. How to use the ERRORLEVEL
feature and CHKSHLD. Chapter Five - Virus detection using SCAN and
NETSCAN. Chapter Six - Using CLEAN to disinfect including the new
------------------------------Cut--Here-----------------------------------
Using McAfee Software May 29, 1992 UD-9
"/GENERIC" option, and five basic disinfection guidelines.
Chapter Seven - Using the McAfee NETSCAN program to protect LANs with a
detailed discussion of how viruses can and cannot infect LANs and specific
suggestions for other security measures LAN administrators can use to
block virus infections. Example Novell-compatible script and batch files
are included.
The next two chapters are particularly useful to people who are new to the
world of shareware and downloading. Chapter Eight - How to get technical
support from McAfee Associates and the McAfee agents. Details of the
Homebase BBS and the CompuServe virus forum. Services available from the
McAfee agents. Chapter Nine - How to obtain the McAfee software including
details of downloading and validating program files.
Chapter Ten - Descriptions of the ten most common viruses and a list of
the critical viruses.
Appendix A - Supporting software sources.
You can use the order form below to purchase a copy of this book.
------------------------------Cut--Here-----------------------------------
Date: _______________
From: ________________________________________
________________________________________
________________________________________
________________________________________
Telephone: _____________________________
To: International Security Technology, Inc.
Please enter our order for your book:
"Using McAfee Associates Software For Safe Computing"
as follows:
_______ copies at $_______ each: $_________
If more than three copies, call for discount info.
If not for resale, include sales tax if shipping
to CT, NJ, NY, or OH.
Sales tax (CT, NJ, NY, & OH) @ ____% $_________
Ship by ___________________________ $_________
Handling charge (each order): $ 5.00
----------
Total: $_________
Form of payment (please select one of the following):
1) Check in US Dollars drawn on a US bank:
Please mail your order to:
International Security Technology, Inc.
515 Madison Avenue - Suite 3200
New York, NY 10022
2) VISA or Master Card:
Please telephone, mail or FAX your order to our distribution center:
BookMasters, Inc.
P.O. Box 159
Ashland, Ohio 44805
Telephone: (800) 247-6553
or (419) 281-1820
FAX: (419) 281-6883
Card Number:________________________________ Exp Date___/___
Card Holder Name:____________________ Sig: ______________________