Copyright: Copyright © 1999, Aladdin Knowledge Systems, Ltd.


Anti-virus overview

eSafe Protect’s anti-virus scan engine searches for existing viruses. The scan engine features all of the following:

•	On-access and on-demand scanners

•	Virus information database

•	Facility for detecting unknown viruses and adding them to its virus information database

•	Facility for inflating archive files until it reaches the core files

•	Comprehensive reporting

The on-access scanner protects you while you work by automatically scanning files when you download or open them.

The on-demand scanner provides an added layer of protection by scanning all files on a floppy, hard disk, network drive or predefined path.

You can fine-tune eSafe Protect’s scan engine by creating multiple on-demand scanning rules to be used under different circumstances. For example, you may want to create a set of scanning rules for a time-consuming scan of all of the files, including those that are not virus prone. With eSafe Protect, you can schedule such a scan to run while you are away from your computer.


On demand scanner module

This module contains 5 tabs for defining scanning rules and the Scan now! button for initiating an anti-virus scan. When you click Scan now!, the on-demand scanner scans for viruses and cleans infected files according to the scanning rules that appears in the Scanning rules drop down menu.

You can select any of the scanning rules defined or create and save new ones.


On-access scanner module

This module configures the anti-virus scanner that constantly scans for viruses as you work. The on-access scanner can either scan all files for known viruses (standard scan method), or create and use integrity files to detect unknown viruses and scan files that have changed for known viruses.

In addition, you can require the scanner to scan file types that it would otherwise ignore, or ignore file types that you feel it should ignore.

The Scanning activities tab lets you redefine what action the scanner should take when it detects a virus or other violation to its scanning rules. To make changes to the settings, you must select Custom in the Setting drop down menu. For detailed information, consult your manual or refer to the online help inside the Scanning activities tab.


Environment module

This module lets you redefine paths, messages, and passwords used by the on-demand and on-access virus scanners. It also contains information on the different viruses and virus types that you are protected against. This information is taken from the anti-virus tables, which you should update regularly. Virus table updates are provided to all registered users for the duration of their subscription periods. For more information on subscriptions you can contact any authorized representative eSafe or Aladdin Knowledge Technologies, or visit our web site at http://www.esafe.com/international .


Scan map

This is a tree for defining which directories to scan. Each set of scanning rules contains its own scan map.

Files/directories with an empty checkbox are not scanned.

Files/directories with a white checkbox selected are scanned.

Directories with a gray checkbox contain some files that are scanned and others that are not.


Scanning rules

This drop down menu selects a set of scanning rules to be run or redefined. It contains a complete list of all currently defined scanning rules.


Save button (AV on-demand)
Save button

Click this button to save changes to the currently selected scanning rules.


Save as button (AV on-demand)
Save as button

Click this button to create a new set of scanning rules using the definitions currently defined.


Remove button (AV on-demand)
Remove button

Click this button to delete the currently selected scanning rules.


Scan map display

This is a tree for defining which directories to scan. Each set of scanning rules contains its own scan map.

Files/directories with an empty checkbox are not scanned.

Files/directories with a white checkbox selected are scanned.

Directories with a gray checkbox contain some files that are scanned and others that are not.


Refresh button

Click this button to refresh the display.


Scan now! button

Click here to initiate an anti-virus scan. The scan is performed according to the scanning rules currently selected and displayed in the On-demand scanner dialog box.


On-demand scanner

The on-demand scanner allows you to initiate a scan of all files in a selected path. It can inflate and scan all of the popular archive files until it reaches the core files. The On-demand scanner dialog box enables you to define scanning rules and initiate a scan.

See also:

On-demand scanner module

Archive files

Scan now!

Scan map

Scan properties

Report file

Response

Schedule


Scan properties tab

The Scan properties tab contains three groups of definition boxes, Scanning method, Files to scan, and Animate the progress display panel.

Scanning method

The eSafe Protect anti-virus scanner can use the standard scan method to scan every file whose type makes it susceptible to viruses, or use the smart scan method only those that have been changed.

The smart scan method is recommended as being more efficient, however it does create integrity files in every directory that it scans. The name of this file is VS.VSN unless you define otherwise in the Environment sub-module.

Remove integrity files deletes integrity files from all directories defined in the scan map for the scanning rules selected.

The Scan and analyze feature can be used with either of the above methods to scan for unknown viruses by checking for code resembling that found in known viruses.

Files to scan

Viruses can only be active in certain types of files and number of file types scanned affects the amount of time required to scan files.

The on-demand scanner normally uses file extensions to determine which files to scan. The Files to scan checkboxes allow you to add files susceptible to macro viruses and archive files to the list. It also allows you to require the scanner to scan all files regardless of their extensions, and to enter the Files types to scan dialog box.

Animate the progress display panel

This checkbox defines whether to animate the panel at the top of the scan progression window.


Scanning method

The eSafe Protect anti-virus scanner can use the standard scan method to scan every file whose type makes it susceptible to viruses, or use the smart scan method only those that have been changed.

The smart scan method is recommended as being more efficient, however it does create integrity files in every directory that it scans. The name of this file is VS.VSN unless you define otherwise in the Environment sub-module.

Remove integrity files deletes integrity files from all directories defined in the scan map for the scanning rules selected.

The Scan and analyze feature can be used with either of the above methods to scan for unknown viruses by checking for code resembling that found in known viruses.


Standard scan (scanning method)
Standard scan method

The standard scan method scans all susceptible files for known viruses.


Smart scan

eSafe Protect's smart scan method uses integrity files to detect unknown viruses and determine whether to scan for known viruses. If the directory containing the file does not contain an integrity file, the scanner scans for known viruses and creates an integrity file in the directory. If the directory already contains an integrity file, the scanner compares the file against the integrity file.

If the file is inconsistent with the integrity file, the file is scanned and the integrity file updated. If the file is consistent with integrity file, the scanner does not scan for viruses. Integrity files are named VS.VSN unless you define otherwise in the Environment sub-module.


Remove integrity files

This option deletes integrity files from all directories defined in the scan map for the scanning rules selected.


Scan and analyze

The Scan and analyze feature enables eSafe Protect to detect previously unknown viruses by checking files for code resembling that found in known viruses.


Animated progress display

This checkbox defines whether to animate the panel at the top of the scan progression window.


Files to scan

Viruses can only be active in certain types of files and number of file types scanned affects the amount of time required to scan files.

The on-demand scanner normally uses file extensions to determine which files to scan. The Files to scan checkboxes allow you to add files susceptible to macro viruses and archive files to the list. It also allows you to require the scanner to scan all files regardless of their extensions, and to enter the Files types to scan dialog box.


Archive files

eSafe Protect’s on-demand scanner inflates and scans the following archive files until they reach the core files. The on-access scanner also inflates and scans popular archive files when you use your browser to download them.

•	.ZIP

•	.ARJ

•	.RAR

•	.TAR

•	.GZIP

•	.LHA (LZH)

•	various setup programs and self extract files

You can limit the number of compression levels that you allow eSafe Protect Desktop to scan, and define whether to treat an archive below the defined level as a non-removable virus


Macro files

These are files that can contain MS Word or Excel macro virus. If you select this option in Advanced configuration | On-demand scanner | Scan properties, the on-demand scanner will scan MS Word and Excel files for macro viruses.


All files

If you select this option in Advanced configuration | On-demand scanner | Scan properties, the on-demand scanner will scan all files regardless of their extensions.


File extensions to scan button

This button open the File types to scan dialog box, where you can add or delete extensions to be scanned.


File types to scan

This dialog box allows you to add and delete file types for the on-demand scanner to scan. You can use wildcards to define a range of extensions using some of the same characters.

The number of file types scanned affects the amount of time required to scan files, and you must decide when to trade scan speed for additional security.

To add an extension, click Add, type in the extension, and click OK.

To delete an extension, select the extension from the list, click Delete, and click OK.


File types to scan list

This list contains the extensions of files that the scanner being defined will scan. This list can contain wildcards for a range of extensions using some of the same characters.


File types to scan text entry

This is where you type in an extension to add to the list of file types to be scanned. You can use wildcards to define a range of extensions using some of the same characters.


Add button (File types to scan)
Add button

This adds the extension in the text entry field into the list of files to scan.


Delete button

This deletes the selected extension from the list of files to scan.


Report file tab

This contains definitions for creating a data file for collecting data on the activities of the on-demand scanner. This file is used to generate anti-virus reports.

The Create report file checkbox lets you define whether to create a data file to be used to create on-demand anti-virus reports. The adjacent address box lets you define the complete path and file name for this file.

A full report contains all files scanned, while a brief report contains only those files where the scanner detected a virus or other violation.

The Overwrite mode causes data from the most recent scan to overwrite the previous data, thereby creating a record of the last scan only.

The Append mode causes the results of each scan to be appended to the file.

The Append up to mode causes the results of each scan to be appended to the file until it reaches the size defined. Once this size is reached the report file is closed and new scan data can no longer be appended to the file.


Create report file

If this checkbox is selected, a file is created for collecting data on the activities of the on-demand scanner, and the other definition boxes in the Report file tab are activated. This file is used to generate anti-virus reports.


Report type

A full report contains data on all files scanned, while a brief report only contains data on those files where the scanner detected a virus or other violation.


Full report (on-demand|report file)
Full report

A full report contains data on all files scanned.


Brief report (on-demand|report file)
Brief report

A brief report only contains data on those files where the scanner detected a virus or other violation.


Report file address

This is the complete path and file name for the data file for recording the results of on-demand scans. This file is used to generate ant-virus reports.


Report update mode

The Overwrite mode causes data from the most recent scan to overwrite the previous data, thereby creating a record of the last scan only.

The Append mode causes the results of each scan to be appended to the file.

The Append up to mode causes the results of each scan to be appended to the file until it reaches the size defined. Once this size is reached the report file is closed and new scan data can no longer be appended to the file.


View the report file

This opens the report file using the Windows NotePad application.


Response tab

The Response tab enables you to determine what action is to be taken when different anti-virus events occur. Responses for each type of anti-virus event are defined separately.

Removable virus allows for four possible actions: Ask user , Notify user , Delete file , and Remove virus .

Nonremovable virus allows for three possible actions: Ask user, Notify user, and Delete file.

File modified refers to cases where smart scan detects that a file has changed, but does not detect a known virus. It allows for three possible actions: Ask user, Notify user, and Recalculate file .

The Write to alert file checkbox defines whether you want the scanner to record the event in the alert file where on-access scanning events are recorded.


Response tab (on-demand scanner)
Response tab

The Response tab enables you to determine what action is to be taken when different anti-virus events occur. Responses for each type of anti-virus event are defined separately.

Removable virus allows for four possible actions: Ask user, Notify user, Delete file, and Remove virus.

Nonremovable virus allows for three possible actions: Ask user, Notify user, and Delete file.

File modified refers to cases where smart scan detects that a file has changed, but does not detect a known virus. It allows for three possible actions: Ask user, Notify user, and Recalculate file.

The Write to alert file checkbox defines whether you want the scanner to record the event in the alert file where on-access scanning events are recorded.

Action to take options

•	Ask user - interrupts the scan and requests that the user decide what action to take.

•	Notify user - scanner displays a warning message notifying the user of the event.

•	Delete file - deletes the infected file.

•	Remove virus - cleans the infected file.

•	Recalculate file - recalculates the integrity file located in the directory of the file that has been modified.


Event detected (on-demand scanner)
Event detected

The Event detected drop down menu contains three different events, each of which are defined separately. Each event definition calls for an action and the option to record occurrence of the event in an alert file.

•	Removable virus

•	Nonremovable virus

•	File modified

Removable virus allows for four possible actions: Ask user, Notify user, Delete file, and Remove virus.

Nonremovable virus allows for three possible actions: Ask user, Notify user, and Delete file.

File modified refers to cases where smart scan detects that a file has changed, but does not detect a known virus. It allows for three possible actions: Ask user, Notify user, and Recalculate file.

The Write to alert file checkbox defines whether you want the scanner to record the event in the alert file where on-access scanning events are recorded.


Action to take (on-demand scanner)
Action to take

Each event definition allows a different choice of actions that the on-demand scanner can take if the event occurs.

Removable virus allows for four possible actions: Ask user, Notify user, Delete file, and Remove virus.

Nonremovable virus allows for three possible actions: Ask user, Notify user, and Delete file.

File modified refers to cases where smart scan detects that a file has changed, but does not detect a known virus. It allows for three possible actions: Ask user, Notify user, and Recalculate file.


Ask user (Action to take)
Ask user

If this is selected, the on-demand scanner interrupts the scan and requests that the user decide what action to take.


Notify user (Action to take)
Notify user

If this is selected, the on-demand scanner displays a warning message notifying the user of the event.


Delete file (Action to take)
Delete file

If this is selected, the on-demand scanner deletes the infected file.


Remove virus (Action to take)
Remove virus

If this action is selected, the on-demand scanner cleans the infected file.


Recalculate file (Action to take)
Recalculate file

If this action is selected, the on-demand scanner recalculates the integrity file located in the directory of the file that has been modified.


Write to alert file

The Write to alert file checkbox defines whether you want the scanner to record the event in the alert file where on-access scanning events are recorded.


Schedule tab

This tab allows you to schedule future on-demand scans using the selected scanning rules.

Frequency	Scheduling instructions
Unscheduled	You must initiate this scan by clicking the Scan now button.
Schedule once	You must define the time and date fields.
Every hour	You must define the minutes field. The scan will be performed that many minutes after the hour.
Every day	You must define the time of day fields.
Every week	You must define the time of day and day of the week fields.
Every month	You must schedule the time of day fields and the date field for day of the month.


Frequency (on-demand schedule)
Frequency

This drop down menu defines how often an on-demand scan is to run automatically using the selected scanning rules.


Start time (on-demand)
 Start time

These definition boxes define the time to start a scheduled scan using the selected scanning rules.


Time (on-demand start time)
Time

This definition box defines the hour and number of minutes after the hour for running a scheduled scan. using the selected scanning rules


Day (on-demand start time)
Day

This definition box defines the day of the week for running a weekly scheduled scan using the selected scanning rules.


Date (on-demand start time)
Date

This definition box defines a calendar date for running a single scheduled scan using the selected scanning rules. The second date definition box defines the day of the month and is used for scheduling monthly scans.


On-access scanner

When an executable file is opened or called, the on-access anti-virus scanner scans the file before allowing it to run. The on-access scanner also inflates and scans popular archive files when you use your browser to download them.

See also:

On-access scanner module

Archive files

Operation modes

Scanning activities

Early-warning anti-vandal scanner


Operation modes tab

The Operation modes tab defines the following:

•	Whether the scanner operates autonomously in the silent mode and hides all anti-virus warnings, or request that the user decide how to handle each infected file

•	Whether the standard or smart scan method is used

•	Which file types are scanned

The standard scan method scans all susceptible files for known viruses and does not create integrity files.

The smart scan method uses integrity files to detect unknown viruses and determine whether scan for known viruses. If the directory containing the file does not contain an integrity file, the scanner scans for known viruses and creates an integrity file in the directory. If the directory already contains an integrity file, the scanner compares the file against the integrity file. If the file is inconsistent with the integrity file, the file is scanned and the integrity file updated.

The Edit button opens the Files to scan dialog box, which allows you to add and delete file types for the on-access scanner to scan. You can use wildcards to define a range of extensions using some of the same characters.


Silent mode (on-access scanner)
Silent mode

In the silent mode, the scanner operates autonomously and hides all anti-virus warnings.


Scan method (on-access)
Scan method

The scanner can scan every file whose type makes it susceptible to viruses, or only those that have been changed. There are two scanning methods, standard and smart scan.

The standard scan method scans all susceptible files for known viruses and does not create integrity files.

The smart scan method uses integrity files to detect unknown viruses and determine whether scan for known viruses. If the directory containing the file does not contain an integrity file, the scanner scans for known viruses and creates an integrity file in the directory. If the directory already contains an integrity file, the scanner compares the file against the integrity file. If the file is inconsistent with the integrity file, the file is scanned and the integrity file updated.


Standard scan method (on-access)
Standard scan method

The standard scan method scans all susceptible files for known viruses and does not create integrity files.


Smart scan (on-access)
Smart scan

eSafe Protect's smart scan method uses integrity files to detect unknown viruses and determine whether to scan for known viruses. If the directory containing the file does not contain an integrity file, the scanner scans for known viruses and creates an integrity file in the directory. If the directory already contains an integrity file, the scanner compares the file against the integrity file.

If the file is inconsistent with the integrity file, the file is scanned and the integrity file updated. If the file is consistent with integrity file, the scanner does not scan for viruses. Integrity files are named VS.VSN unless you define otherwise in the Environment sub-module.


Edit  button (on-access)
Edit button

This button opens the Files to scan dialog box.


File extensions menu (on-access)
Files to scan menu

This dialog box allows you to add and delete file types for the on-access scanner to scan. You can use wildcards to define a range of extensions using some of the same characters.

The number of file types scanned affects the amount of time required to scan files, and you must decide when to trade scan speed for additional security.

To add an extension, click Add, type in the extension, and click OK.

To delete an extension, select the extension from the list, click Delete, and click OK.


Current button (on-access)
Current button

Click this button to replace the definitions that appear in the on-access dialog box with the definitions currently in use by the on-access scanner.


Apply button (on-access)
Apply button

Click this button to save the new definitions to the on-access anti-virus scanner configuration and leave the dialog box open.


Browse button (general definition)
Browse button

This opens the standard Windows browse menu for selecting a file or directory.


OK button (general definition)
OK button

Click this button to implement changes and close the current dialog box.


Apply button (general definition)
Apply button

Click this button to implement changes and keep the current dialog box open.


Cancel button (general definition)
Cancel button

Click this button to close the current dialog box without implementing any changes that you may have made.


Save button (general definition)
Save button

The Save button lets you save the currently displayed definitions.


Save as button (general definition)
Save as button

The Save as button lets you save the currently displayed definitions in the eSafe Protect database under another name. This effectively creates a new set of definitions.


Remove button (general definition)
Remove button

The Remove button lets you delete the currently selected definitions from your eSafe Protect database.


Delete button (general definition)
Delete button

Click this button to delete a selection.


Add button (general definition)
Add button

Click this button to open a dialog box for adding an entry


Scanning activities tab

This tab defines activities for the scanner to perform, and reactions to events caused by these activities. The selection boxes are organized from top to bottom, where each selection affects the contents of the selection box below it. The menus are therefore viewed and defined in the following order:

Setting -> Group of activities related to: -> Specific activities to perform -> System reaction

The Setting drop down menu contains three options for setting the scanner: Recommended, Custom and Disengage.

Recommended activates the standard anti-virus settings designed to optimize protection for most users. When this option is selected, you can view settings but not change them.

Custom unlocks the advanced settings to fine-tune the operation of the anti-virus scanner. When selected, this setting enables you to change the definable activities and reactions to events caused by these activities.

Disengage deactivates the on-access scanner.

The Group of activities menu contains four groups, Floppies, Files, Virus-like activities and smart scan. Each group contains a different list of activities.

The Specific activities to perform list box contains activities that you can activate and define a reaction for when Custom is selected in the Setting drop down menu.

The System reaction drop down menu defines how eSafe Protect Desktop reacts to an event resulting from the activity selected and whether it is recorded in the alert file.


Setting (scanning activities)
Setting

The Setting drop down menu contains three options for setting the scanner: Recommended, Custom and Disengage.

Recommended activates the standard anti-virus settings designed to optimize protection for most users. When this option is selected, you can view settings but not change them.

Custom unlocks the advanced settings to fine-tune the operation of the anti-virus scanner. When selected, this setting enables you to change the definable activities and reactions to events caused by these activities.

Disengage deactivates the on-access scanner.


Group of activities related to

The Group of activities menu contains four groups, each of which causes a different list of activities to appear in the list box below.

•	Floppies

•	Files

•	Virus-like activities

•	Smart scan


Group of activities related to floppies

If Custom is selected in the Setting drop down menu, you can set the on-access scanner to scan floppies when they are accessed and/or at shutdown, and to compare the date when the file was last scanned with the date of the current virus tables.

If you set the scanner to scan when you access floppies and a virus is detected at that time, the scanner will cause a warning message to appear. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

If you set the scanner to scan floppies at shutdown and a virus is detected at that time, the scanner stop the current operation. The Write to alert file checkbox cannot be selected for this activity.

If you set the scanner to Check last on-demand scan date and the virus tables were updated after the last time you performed an on-demand scan, the scanner will display a warning to this effect. The Write to alert file checkbox cannot be selected for this activity.

If you change the selection in the Group of activities menu, a different list of activities will appear in the Specific activities to perform list box.


Specific activities to perform (floppies)

If Custom is selected in the Setting drop down menu, you can set the on-access scanner to scan floppies when they are accessed and/or at shutdown.

If you set the scanner to scan floppies when accessed and a virus is detected at that time, the scanner will cause a warning message to appear. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

If you set the scanner to scan floppies at shutdown and a virus is detected at that time, the scanner will stop the current operation. The Write to alert file checkbox cannot be selected for this activity.

If you change the selection in the Group of activities menu, a different list of activities will appear in the Specific activities to perform list box.


Specific activities to perform (files)

If Custom is selected in the Setting drop down menu, you can set the on-access scanner to scan files during file creation, while reading the file, and/or during file execution.

If you set the scanner to scan a file during file creation, you can set the scanner to react in any of the following three ways:

•	Ask user. This causes the scanner to interrupt file creation and request user input as to whether to delete the file. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

•	Warning. This causes the scanner to display a warning message, but does not delete the file. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

•	Delete. This causes the scanner to delete the infected file. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

If you set the scanner to scan while reading a file and a virus is detected at that time, the scanner will interrupt the read operation. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

If you set the scanner to scan during file execution and a virus is detected at that time, the scanner will interrupt execution of the file. The Write to alert file checkbox lets you define whether to record such a warning in the alert file used to generate reports.

The Drives to scan button opens the Drives to scan dialog box, where you can select/deselect floppy, hard disk and network drives for the activity selected.

If you change the selection in the Group of activities menu, a different list of activities will appear in the Specific activities to perform list box.


Specific activities to perform (virus like activities)

The Write to alert file checkbox for each virus-like activity lets you define whether to record each occurrence of the virus-like activity in the alert file used to generate reports.

If Custom is selected in the Setting drop down menu, you can set the on-access scanner to check for any, and all of the virus-like activities listed in the table below.

Virus-like activity	Possible system reactions
Check illegal name	Ask user, Warning, Access denied, Close DOS box, Boot
Check memory change	Ask user, Warning, Close DOS box, Boot
Check interrupt change	Ask user, Warning, Close DOS box, Boot
Check interrupt tracing	Ask user, Warning, Close DOS box, Boot
Check write to program	Ask user, Warning, Access denied
Check volume lock	Ask user, Warning, Access denied
•	Ask user causes the on-access scanner to interrupt operation and request user input as to how to continue.

•	Warning causes the on-access scanner to display a warning message notifying the user of the virus-like activity.

•	Access denied causes the on-access scanner to interrupt the virus-like activity.

•	Close DOS box causes the on-access scanner to close the DOS box in which the virus-like activity occurs.

•	Boot causes the on-access scanner to reboot the computer.

If you change the selection in the Group of activities menu, a different list of activities will appear in the Specific activities to perform list box.


Specific activities to perform (smart scan)

If Custom is selected in the Setting drop down menu, you can set the on-access scanner to check for any and all of the following, and make a record of any or all such activities in the alert file:

•	The existence of an integrity file

•	An integrity record of the file in the integrity file

•	Recoverable file that has changed (these are usually infected with a virus)

•	Unrecoverable file that has changed (these have usually been changed by an overwrite operation)

If you set the scanner to check for integrity file during a smart scan and an integrity file is missing, you can set the scanner to react in any of the following three ways:

•	Ask user. This causes the scanner to interrupt operation and request user input as to how to continue.

•	Create file automatically. This causes the scanner to create an integrity file in the relevant directory.

•	Ignore. This causes the scanner to ignore the smart scan warning and continue with normal operation.

If you set the scanner to check for integrity record during a smart scan and an integrity file does not contain a record of a file, you can set the scanner to react in any of the following four ways:

•	Ask user. This causes the scanner to interrupt operation and request user input as to how to continue.

•	Create integrity file. This causes the scanner to append a record of the scanned file to the integrity file.

•	Ignore. This causes the scanner to ignore the smart scan warning and continue with normal operation.

•	Cancel operation. This causes the scanner to cancel the operation being performed.

If you set the scanner to check recoverable files and smart scan detect an executable file has changed but can be returned to it s previous state, you can set the scanner to react in any of the following four ways:

•	Ask user. This causes the scanner to interrupt operation and request user input as to how to continue.

•	Recover automatically. This causes the scanner to recover the previous version of the file.

•	Access denied. This causes the scanner to interrupt the operation involving the file being scanned.

•	Continue and update. This causes the scanner to allow the current operation to continue and update the integrity file.

If you set the scanner to check unrecoverable files and smart scan detect an executable file has changed in such a way that it cannot be returned to it s previous state, you can set the scanner to react in any of the following three ways:

•	Ask user. This causes the scanner to interrupt operation and request user input as to how to continue.

•	Warning. This causes the scanner to display a warning message notifying the user that the file has changed.

•	Access denied. This causes the scanner to interrupt the operation involving the file being scanned.

If you change the selection in the Group of activities menu, a different list of activities will appear in the Specific activities to perform list box.


Media for scanning files button

The Media for scanning files button opens the Media for scanning files dialog box, where you can select/deselect floppy, hard disk and network drives for the activity selected in the On-access scanner | Scanning activities tab.


System reaction (on-access)
System reaction

The system reaction drop down menu defines how eSafe Protect Desktop reacts to a specific event resulting from the activity selected. The Write to alert file checkbox defines whether to write the event in the alert file.


Media for scanning files

The Drives to scan dialog box lets you select/deselect floppy, hard disk and network drives for the activity selected in the On-access scanner | Scanning activities tab.


Environment for the anti-virus scanners

The Environment dialog box enables you to define paths, messages and passwords that affect both the on-demand and on-access scanners, and to view information on the virus types scanned. It is divided into three tabs: Paths and messages, Virus information and Password.


Paths and messages tab

The Paths and messages tab contains file names and paths, options virus notification and two buttons.

The Smart scan file definition box defines the name of the integrity file that the smart scan method creates.

The Alert file definition box defines the name and path for the alert file, which is used to create on-access anti-virus reports.

The Copy infected files to checkbox and path definition box defines whether to copy infected files to a Quarantine directory, and the path to that directory.

The Virus notification custom message box lets you define a message of up to 129 characters that notifies users when a virus is detected.

The Sound alarm checkbox lets you choose whether to sound an audible alarm when a virus is detected.

The Reset to default button returns the default settings to the Paths and messages tab.

The Files to ignore button opens a dialog box for creating and editing a list of files to be ignored by the on-access and on-demand scanners. This list contains files known to cause false alarms, and includes files used by the eSafe Protect scanners.


File names and paths

The Paths and messages tab contains file names and paths, options virus notification and two buttons.

The Smart scan file definition box defines the name of the integrity file that the smart scan method creates.

The Alert file definition box defines the name and path for the alert file, which is used to create on-access anti-virus reports.

The Copy infected files to checkbox and path definition box defines whether to copy infected files to a Quarantine directory, and the path to that directory.


Smart scan file (paths and messages)
Smart scan file

The Smart scan file definition box defines the name of the integrity file that the smart scan method creates.


Alert file (paths and messages)
Alert file

The Alert file definition box defines the name and path for the alert file, which is used to create on-access anti-virus reports.


quarantine path

The Copy infected files to path defines the path of a Quarantine directory for storing copies of infected files for evaluation or to send to the eSafe anti-virus specialists at Aladdin Knowledge Systems.


Copy infected files to

The Copy infected files to checkbox and path definition box defines whether to copy infected files to a Quarantine file, and the name and path to that file.


Custom message for virus notification

The Virus notification custom message box lets you define a message of up to 129 characters that notifies users when a virus is detected.


Sound alarm

The Sound alarm checkbox lets you choose whether to sound an audible alarm when a virus is detected.


Reset to default button

The Reset to default button returns the default settings to the Paths and messages tab.


Files to ignore (Environment)
Files to ignore

The Files to ignore button opens a dialog box for creating and editing a list of files to be ignored by the on-access and on-demand scanners. This list contains files known to cause false alarms, and includes files used by the eSafe Protect scanners.


Files to ignore menu (Environment)
Files to ignore menu

The Files to ignore dialog box enables you to edit a list of files to be ignored by the on-access and on-demand scanners. This list contains files known to cause false alarms, and includes files used by the eSafe Protect scanners.


Enter file to ignore

This is where you type in the name of a file to be ignored by the on-access and on-demand scanners. You can use wildcards to define a range of similar files.


Files to ignore list (Environment)
Files to ignore list

This list contains the files to be ignored by the on-access and on-demand scanners. This list contains files known to cause false alarms, and includes files used by the eSafe Protect scanners.


Help button (general definition)
Help button

This causes the online help topic most closely associated with your current location in the software to open.


Virus information list tab

This contains information about known viruses, including virus names, where they operate, their type, and general information about viruses. The information on each virus is contained in a virus definition file created by Aladdin engineers whenever they identify a new virus. When you perform the update operation, eSafe Protect checks for new virus definition files and updates this list.

Information on the virus currently selected on the list is displayed.

The virus list may be filtered using any or the filter in the Virus type drop down menu:

•	Boot Sector viruses modify the first sector of a disk or a diskette in which critical system information is saved.

•	File viruses attach themselves to executable programs, and in some cases modify themselves each time they replicate.

•	In the Wild viruses are the most prevalent viruses. More than 98% of all infections develop from viruses included in this list.

•	All viruses.


Virus type

This drop down menu lets you filter the list of viruses to display. The filters are:

•	Boot Sector viruses modify the first sector of a disk or a diskette in which critical system information is saved.

•	File viruses attach themselves to executable programs, and in some cases modify themselves each time they replicate.

•	In the Wild viruses are the most prevalent viruses. More than 98% of all infections develop from viruses included in this list.

•	All viruses.


Virus list

This contains information about known viruses, including virus names, where they operate, their type, and general information about viruses. The information on each virus is contained in a virus definition file created by Aladdin engineers whenever they identify a new virus. When you perform the update operation, eSafe Protect checks for new virus definition files and updates this list.

Information on the virus currently selected on the list is displayed.

The virus list may be filtered using any or the filter in the Virus type drop down menu:

•	Boot Sector viruses modify the first sector of a disk or a diskette in which critical system information is saved.

•	File viruses attach themselves to executable programs, and in some cases modify themselves each time they replicate.

•	In the Wild viruses are the most prevalent viruses. More than 98% of all infections develop from viruses included in this list.

•	All viruses.


Search file (Virus information)

If you know the name of a virus, you can enter it into the Search box to cause the details on that virus to be displayed.


Virus infects

This displays the type of files that the selected virus infects.


Virus type checkboxes

This displays the virus classifications under which the selected virus falls.


General (Virus information)

This contains information on the last time the virus tables were updated, and the number of known viruses and mutations contained in your virus tables. If the date displayed is not recent, you should update your virus tables.


COM/Macro virus

This indicates that the selected virus infects regular executable files or files created by Microsoft Word, Excel, and other Microsoft Office applications.


EXE file virus

This indicates that the selected virus infects executable files to enable the execution of the virus code. Once the virus code is executed, the virus becomes active in memory and effective.


Master boot virus

This indicates that the selected virus infects the Master Boot Record (MBR), which is the first physical section on the Hard disk executed when booting the computer. Master Boot viruses infect the computer when booting from an infected disk. The Master Boot Record is a common place for viruses to hide in order to ensure that they will be loaded into memory.


DOS boot virus

This indicates that the selected virus infects the sector that loads DOS in order to ensure the dispersion of the virus.


Destructive virus

This virus causes damage to data in files, random sectors, or system areas of the disk.


Trojan horse

Trojan horse programs pretend to do one thing when actually they do something else that may be destructive. Unlike traditional viruses these programs don’t infect other files. However, they can cause severe damage


Stealth virus

Stealth viruses attempt to hide their presence in the computer. For example, a stealth boot virus uses stealth techniques intended to cause the original uninfected boot sector to appear during an anti-virus scan while the virus is active in memory. With file viruses, file size/date/contents and other virus signs, appear to most scanners as normal while the stealth virus is active in memory.

eSafe anti-stealth techniques are designed to bypass the stealth virus and detect its presence while it is active. However, to be absolutely sure that your computer is virus-free, you should perform an anti-virus scan after booting you computer from your original anti-virus diskette.


Resident virus

This virus installs itself in memory. Once in memory, these viruses can infect boot sectors and executed files.


Encrypted virus

This virus uses encryption to conceal itself. Many polymorphic viruses utilize this technique.


Common virus

This is the most prevalent type of virus and causes98% of virus infections. This is also known as an “In the Wild” virus.


Password tab

The Password tab enables you to password protect the anti-virus module.

The checkbox determines whether to use password protection. If it is selected, the three fields for changing the password are activated. Asterisks are displayed in place of each password character entered.


Password protection (general)
Password protection

Password protection requires that a password be used to perform prevent specific operations or view sensitive information.


Change password (general)
Change password

When the Password protection checkbox is selected, the change password definition boxes become active. To change a password, you must first enter the old password, then enter the new password twice; once to define and the second time to confirm.


Enter old password (general)
Enter old password

Enter your current password. Asterisks will appear in place of each character. This is required to prevent strangers from changing your password.


Password protection checkbox (general)
Password protection checkbox

When this is selected, password protection is enabled.


Enter new password (general)
Enter new password

Enter the new password. Asterisks will appear in place of each character.


Verify new password (general)
Verify new password

Enter the new password again. Asterisks will appear in place of each character.