What does VirusScan software do?

With the growing number of viruses, Trojans and other hazards that can easily infect your computer, protecting your PC has never been more important than now. McAfee VirusScan software acts as a tireless online sentry, guarding your system against attacks from viruses and preventing harm from other malicious software. It combines an advanced background scanner with components that enable you to configure, schedule, run, and manage your own scan operations with precision control.

This control extends to the response options the program gives you when it finds a virus. You can have VirusScan software ask you what it should do with infected files it finds, or you can have it take a range of actions automatically, with no intervention necessary. Still, if you want to monitor what it does, the software provides you with an extensive set of log files, and can alert you in an instant when it finds a virus via any or all of nearly a dozen different methods.

It can also intercept malicious software as it arrives in your e-mail and keep your web browser away from Internet sites that harbor harmful Java and ActiveX objects. Furthermore, since the kind of vigilance that VirusScan software gives you requires constant updating to meet innovative new virus threats, you can have it download and install new virus definitions and even a new scanning engine automatically.

This comprehensive protection comes in a collection of modules and components—some of which you can install separately—that work together on each desktop system you want to protect.

Click the topics displayed below to learn more.

  • VirusScan application

  • VShield scanner

  • E-mail Scan extension

  • VirusScan control panel


Understanding the VirusScan application

McAfee desktop anti-virus products use two general methods to protect your system. The first method, background scanning, operates continuously, watching for viruses as you use your computer for everyday tasks. In the VirusScan product, the VShield scanner performs this function.

The second method puts you in charge. You decide when and where the software should look for viruses, then you tailor and run scan operations that suit your needs.

See also

When and why you should use the VirusScan application


When and why to use the VirusScan application

Maintaining a secure computing environment means scanning for viruses regularly. Depending on the degree to which you swap floppy disks with other users, share files over your local area network, or interact with other computers via the Internet, scanning "regularly" could mean scanning as little as once a month, or as often as several times a day. Other good habits to cultivate include scanning right before you back up your data, scanning before you install new or upgraded software, particularly software you download from other computers, and scanning when you start or shut down your computer each day.

Use the VShield scanner to scan your computer’s memory and maintain a constant level of vigilance between scanning operations. Under most circumstances, this should protect your system’s integrity. Nevertheless, good anti-virus security measures incorporate complete, regular system scans because:

  • Background scanning checks files as they execute. The VShield scanner looks for virus code as executable files run or when you read a floppy disk, but the VirusScan application can check for code signatures in files stored on your hard disk. If you rarely run an infected file, the VShield scanner might not detect the virus until it deploys its payload. The VirusScan application, however, can detect a virus as it lies in wait for an opportunity to run.

  • Viruses are sneaky. Accidentally leaving a floppy disk in your drive as you start your computer could load a virus into memory before the VShield scanner, particularly if you do not have the scanner configured to scan floppy disks. Once in memory, a virus can infect nearly any program, including the VShield scanner.

  • The VShield scanner requires time and resources. Scanning for viruses as you run, copy or save files can delay, though very slightly, software launch times and other tasks. Depending on your situation, this could be time you might rather devote to important system operations. Although the impact is very slight, you might be tempted to disable the VShield scanner if you need every bit of available power for demanding tasks. In that case, performing regular scan operations during idle periods can guard your system against infection without compromising performance.

  • Good security is redundant security. In the networked, web-centric world in which most computer users operate today, it takes only a moment to download a virus from a source you might not even realize you visited. If a software conflict has disabled background scanning for that moment, or if you have not configured background scanning to watch a vulnerable entry point, you could end up with a virus. Regular scan operations can often catch infections before they spread or do any harm.

If you connect to the Internet frequently or download files often, you might want to schedule regular scan operations that sweep your system at set intervals, so that you don’t have to remember to start the VirusScan application.


The Home page

The McAfee VirusScan Home page

The McAfee VirusScan Home page is your central entry point to access and use all of McAfee VirusScan’s tasks, wizards, and components. This screen displays dynamic information about current status and navigation links to all tasks.

Status information

Depending upon your configuration, the Home page displays other helpful information such as:

  • Status of automatic file scanning. This message lets you know if you computer is or is not protected by automatic file scanning. If you are not protected, “Click here to enable automatic file scanning” displays. You can click this message to instantaneously enable automatic file scanning.

  • Update availability. If an update for McAfee VirusScan is available, or if you have not registered this product with McAfee, a message displays describing as such. Additionally, virus definition files (DATs) version information displays here as well. If there is an update to available, Click here to update McAfee VirusScan displays. You can click this message to start McAfee Instant Updater and update this product.

  • The total number of scanning operations performed. The number represented by this status message indicates the total number of scan operations performed since you installed McAfee VirusScan.

The Task pane

The Task pane displays links that allow you to start McAfee VirusScan’s Tasks and Advanced Tasks. Depending upon your configuration, the Task pane displays McAfee, links that allow you start the Home page for any other current McAfee product installed in your computer.

About Tasks

Starting a task is as easy as clicking its link. The Task list allows you to start McAfee VirusScan’s major components. Although the tasks you can perform will vary based upon your computer’s operating system and its configuration, primary tasks include:

  • Scan for viruses now: This task allows perform an on-demand scan. You can scan your entire computer for viruses. You can also choose to scan a specific drive or folder. When the scan is complete, VirusScan scan Summary Report displays.

  • Configure automatic protection settings: Select this task to configure VShield background scan settings.

  • Check for a VirusScan update: This task starts McAfee Instant Updater and checks to see if there is an update to McAfee VirusScan available.

  • Other Tasks: Depending upon your McAfee VirusScan configuration, this task provides you a quick and convenient method to start McAfee VirusScan's shared components.

About Advanced Tasks

Similar to the primary Task list, the Advanced task list may vary depending upon your version of Windows, its configuration, and other software that may be installed in your computer. McAfee VirusScan’s advanced tasks include:

  • Configure and scan my wireless device: Select this task to configure and defend your wireless device against viruses.

  • Manage quarantined files: Select this task to direct VirusScan to manage files infected with a virus. Here you can choose to add, remove, clean, and delete infected and quarantined files.

  • View and edit scheduled scans: This advanced task allows you to schedule scan events. You can use the default settings for scan events or create a custom list of scan events.

  • View VirusScan’s activity logs: Activity logs contains records about VirusScan settings, scan results, and historical records of scans performed. Select this task to view these records.

  • Configure Instant Updater: Instant Updater is the mechanism used to register your product and to communicate with McAfee to check for an update to virus definition files (DATs), the virus scanning engine, and for updates to McAfee VirusScan.

About the McAfee list

The McAfee list displays links to start the Home page to any other supported McAfee product.


Select Location to Scan

Introduction

This screen allows you select the location that you want to scan. To perform the scan, simply identify the specific location that you want to scan and click the Scan button.

This screen allows you to perform an on-demand scan of:

  • The entire contents of your computer.

    To scan the entire contents of your computer, check the check box next to

  • A specific drive.

    For example, to scan your c:\ drive, check the check box next to (C:) and click the Scan button.

    If there is a 3.5 inch floppy disk that you suspect may be infected with a virus, insert the disk into your computer's floppy disk drive, check the check box next to 3 1/2 Floppy (A:) and click the Scan button.

  • A specific folder.

    For example, if you want to scan the contents of your Windows folder, click the [image] next to (C:) to display the contents of drive c:\. Browse to the Windows folder. Check the check box next to Windows and click the Scan button.

When VirusScan completes the on-demand scan operation, a VirusScan Summary window displays. The VirusScan Summary window provides you with the number of files and boot records scanned, infected, cleaned, quarantined, and deleted. Click OK to close the summary window. You can view your settings and the statistical results of a specific scan operation by selecting the View activity logs Advanced Task link. For more information about VirusScan Activity logs, please see VirusScan Activity Logs.

How to use this screen

Use the steps below to perform an on-demand scan operation.

  1. Browse to the drive or folder that you wan to scan. Click the [image] or [image] next to the drive or folder to display or hide its contents respectively.

  2. Check the check box corresponding to the location you want to scan. Please refer to the graphic displayed below.

This graphic demonstrates VirusScan's folder selection hierarchy. As a rule, as you check a check box, VirusScan scans all child folders related to the selected drive or folder. Please note the check boxes selected to left.

  • My Documents: The user selected the My Documents folder. The child folders to My Documents display a black check mark. As VirusScan performs this scan operation, all of the contents of My Documents folders and its child folders will be scanned.

  • The My Documents folder is a subset and child folder to the c:\ drive. Since the c:\ drive maintains a parent relationship to My Documents, it is represented as a check box with a gray check mark.

  • The c:\drive is a child of My Computer. As such, the My Computer check box displays a gray check mark.

  3. Click Scan.

    The VirusScan Summary report displays when the scan is complete.

Other buttons displayed on this screen

  • Refresh: Click Refresh to reset McAfee VirusScan's default scan locations.

  • Scan Settings: When you click this button, the Scan Settings dialog box displays.


VirusScan Progress

The VirusScan Progress screen displays the status of your current scan as well as tools and links that you can use to manage your current scan, infected files, or jump to other VirusScan screens.

The VirusScan Summary displays when the current scan operation is complete.

Currently scanning

  • This region dynamically displays the name and location (path) of the file that VirusScan is currently scanning.

  • Click Stop button to cancel your current scan operation.

Manage detected files

The Manage detected files list displays the following information about your current scan operation:

  • The location (path to) the detected files.

  • The status of each detected file.

Status

Description

Detected

  • VirusScan detected a virus.

Deleted

  • The file was deleted from your computer.

Quarantined

  • The file has been placed in a location where it cannot infect other files in your computer.

Clean

  • The file is not infected with a virus.

Here you can manage infected file by selecting the infected file name an clicking one of the following buttons.

Button

Description

Clean

  • Cleans the infected file.

Delete

  • Deletes the infected file from your computer.

Info

  • Displays the property sheet for selected file.

Quarantine

  • Isolates the infected file so that it cannot infect other files in your computer.

Other tasks you can perform

Scan another location for viruses: Select this task to start a new scan on the same or different location in your computer.

View VirusScan's activity logs: Select this task to view and manage VirusScan's activity log data.


Other Tasks

From this screen you can start any of McAfee VirusScan's integrated components. The tasks that display on this screen and that you can perform depend upon your current installation configuration as well as your computer's operating system.

In general, you can start the following tasks:

  • Check for an update to McAfee VirusScan using McAfee Instant Updater.

  • Start Safe and Sound.

To perform any of these tasks, simply click the name of the component that you want to start. If you require help with any of these McAfee Utilities, please refer their respective online Help systems.


Using Quarantine

Many VirusScan components allow you to move detected files to a quarantine folder. This isolates infected files from areas where they can be accessed and enables you to clean or delete them at your convenience.

To use Quarantine Explorer to work with detected files that were quarantined, follow these steps:

  1. Start the VirusScan from the Windows Start menu.

  2. From the Advanced task list, select Manage quarantined files.

  3. Select an detected file and choose from the following:

Button

Description

Add

  • Select this option to browse to and quarantine a file that you know or suspect is infected.

Clean

  • Select Clean to remove the virus code from an infected file. If the virus cannot be removed, it will notify you.

Restore

  • Select this option to restore a file to its original folder. This option does not clean the file. Make sure the file is not infected before using this option.

Delete

  • Select this option to delete the infected file. Make sure to note the file location so you have a record of the deleted files. You will need to restore deleted files from backup copies.

Refresh

  • Click Refresh to update the quarantine Type for all of your quarantined files.

Quarantine types

Here is a description of the quarantine types that you will see on this screen.

  • Detected: A potentially malicious file.

  • Unknown: The file is in a pre-scanned state; it has not been scanned.

  • Clean: The file is not infected with a virus.

For more information, see also:

  • Connecting to the AVERT anti-virus research site

  • Updating VirusScan Data Files


VirusScan Activity Logs

Manage the VirusScan Activity Log

The Manage the VirusScan Activity Log screen displays detailed statistical information about all of your VirusScan scan sessions.

Interpreting Activity Log details

VirusScan represents scan sessions using a date and time format (e.g., 7/8/2002, 3:31:23 PM). For all of your scan sessions, you can view a scan session summary (statistics) as well as its details and VirusScan settings.

  • VirusScan sorts scan records in reverse chronological order. That is, the most recent scan records display atop the VirusScan Activity Log.

    When you point to and select VirusScan Log, the details of all files VirusScan detected display in the details table. This table provides you with information about each scan session, the file name and type of file VirusScan detected, the name of the virus that VirusScan detected, and the current status of the detected file. Status information includes detected, cleaned, quarantined, or deleted.

  • Click the [image] next to a scan session to display the Scan Settings and Scan Summary logs for the session.

    • Scan settings: Include the details about VirusScan version information including .DATs and Scan engine as well as the settings, such as what and where was the scan performed.

    • Scan Summary: Displays the results of the selected scan session. Details for the scan session include the number of files and boot sectors scanned, detected, cleaned and quarantined.

Configuration

  1. Choose one of the following options.

    • Click Clear to delete the statistical data found in any Scan Settings or Scan Summary logs.

    • The Refresh button allows you to refresh (update) current Activity log data.

    • If you want to print a particular log, select the log from the Activity Log list and click Print. Your computer must be connected to a local or network printer to perform this task.

  2. Configure your activity log settings.

    • Activity log property: The McAfee VirusScan Activity Log Properties properties sheet allows you to save log data to a log file, check the Enable activity logging check box. You may accept the default location of the log file or click Browse to save the log file elsewhere.

    • If you do not want the log file to exceed a specific size, check the Limit log data checkbox and use the kilobytes spin box to identify the maximum allowable size of the VirusScan log file. Please note, the size of the log file may not be less than 10 kilobytes.

  3. When your are finished, click Apply.


Manage Scheduled Tasks

To create a New task, do the following:

  1. From the Manage scheduled tasks screen, click New. The Task Properties property sheet displays.

  2. If it is not already selected, select the Program tab and enter a description for the new task in the Description text box.

  3. Check the Run Minimized check box if you want VirusScan to run minimized while it performs this task.

  4. Click the radio button for the Upon Completion option that identifies how you want VirusScan to Exit as it completes this scheduled scan operation.

  5. Click Configure and the VirusScan Properties properties sheet displays. For help with this properties sheet, please refer to:

  • Detection options for VirusScan scheduled tasks

  • Action options for VirusScan scheduled tasks

  • Report options for VirusScan scheduled tasks

  • Exclusion options for VirusScan scheduled tasks

  1. Select the Schedule tab and check the Enable check box.

  2. Check the check boxes corresponding to the time frames that you want this task to run and the Month, day, year, and time that you want this task to start.

  3. Check the Enable randomization check box if you want VirusScan to perform this task at random intervals.

    The length of time displayed in the Randomize time window text box indicates that the window of time between random scans will not exceed the period of time displayed in this text box.

  4. Select the Status tab to view real-time statistics about the current scheduled task.

Select the scheduled task that you want to remove and click delete. Please note, a delete confirmation dialog does not display after you click the Delete button.

Click Edit to change the characteristics of a scheduled task. For additional information about Schedule setting please refer to the guidelines under creating a New scheduled task.

Click this button to run a scheduled task.

Manage Scheduled Tasks

You can run the VirusScan application to conduct stand-alone scan operations at any time, or you can set up a scan task that runs the application at scheduled intervals. Although each method ultimately starts and uses the same application, the way you configure your scan task settings and the way you use the application to scan your system differs.

This VirusScan screen displays information about your current scan tasks. The Scheduled tasks group box on this page provides you with a Description of the task and the Next time it will run.

Configuration

The following options are available to you on this screen. You can select:

  • New to create and scheduled a new task.

  • Delete to delete a scheduled task.

  • Edit to change the characteristics of scheduled task.

  • Run to run a scheduled task.


Choosing Where & What options

When you first start it, the VirusScan application assumes that you want to scan your C: drive and all of its subfolders, and to examine only those files susceptible to virus infection.

To set or change those options, follow these steps:

  1. Choose a drive or folder on your system or on your network that you want the application to examine for viruses.

Type a path to the target volume or folder in the text box provided, or click Browse to locate a suitable scan target.

  2. Select the Include subfolders checkbox to have the application look for viruses in any folders inside your scan target.

  • Choosing Include subfolders causes the application to scan only those files stored in the subfolders themselves. The application will not scan files stored at the root level of the folder you designate. To scan those files, clear the Include subfolders checkbox.

  3. Specify which types of files you want the application to examine. You can

  • Scan compressed files. Select the Compressed files checkbox to have the application look for viruses in compressed files and file archives. Although this does give you better protection, scanning compressed files and file archives can lengthen a scan operation. To see a list of the types of files and archives that the application scans, click here:

  • Scan all files. Select the All Files checkbox to have the application scan all of the files on the target you specified, whatever their extensions.

  • McAfee recommends that you choose this option for your first scan operation, or periodically thereafter, to ensure that your system is virus-free. You can then limit the scope of later scan operations.

  • Choose file types. Viruses cannot infect files that contain no executable code, whether script, macro, or binary code. You can, therefore, safely narrow the scope of your scan operations to those files most susceptible to virus infection.

To see or designate the file name extensions the application will examine, click Extensions. This opens the Program File Extensions dialog box. To learn about how to change the files listed there, click here:

  4. Next, you can:

  • Click Scan for Viruses Now to start a scan operation with these options.

  • Choose other configuration options.

  • Click the New Scan button or choose Save As Default from the File menu to save your settings so that future scan operations will use them.

  • Choose Save Settings from the File menu to save your settings in a new file that you can use to run future scan operations, or send to other computers for their use. Next, name your file in the dialog box that appears, then click Save.


Configure Your Automatic Protection Settings

To maintain the highest level of defence against viruses, you should always run Automatic File Protection. This screen allows you to select which of VirusScan's Automatic File Protection scanners that you want running in the background.

Configuration

  1. Check the checkbox corresponding to the Automatic Protection setting that you want running while VirusScan runs.

VirusScan

  • Enable System Scanning: VirusScan scans your hard disk as you work. Also known as the "on access scanner," with this setting enabled, VirusScan alerts you when a virus is detected.

  • Enable System Boot Scanning: For computers running Windows 98 (only), VirusScan scans your computer for viruses while it is booting, or as it starts.

  • Enable Outlook E-mail Scanning: Many viruses propagate themselves as an e-mail attachment. With this setting enabled, VirusScan scans Microsoft Outlook e-mail messages and their attachments and alerts you if an infection is detected.

  • Enable HAWK for E-mail: With this Automatic Protection Setting enabled, HAWK warns you if it detects e-mail messages demonstrating virus-like behavior. By detecting virus-like behavior, HAWK prevents viruses from spreading further.

  • Enable HAWK Script Stopper: As script is a sequence of instructions given to and carried out by a different program. HAWK script Stopper detect e-mail message attachments that contain scripts acting in a malicious manner. A malicious script may delete files, make files, access your computer's registry or e-mail address book. If HAWK detects an e-mail message with a script that is attempting to run, HAWK alerts you.

General

  • Enable prompt for loading system scanner: Choose this option if you want be prompted to load the system scanner (if it is not running) as you launch McAfee VirusScan.

  • Enable VirusScan splash screen: Choose this option if you want McAfee VirusScan to display a splash screen as your automation protection setting start.

  2. Click Apply settings to save your settings or click Cancel to exit without making changes.

Advanced Configuration

Click Advanced to further customize VirusScan's Automatic Protection settings. For more information about customization, please see:

  • Configuring System Scan settings

  • Configuring E-mail Scan settings

  • Configuring the HAWK for E-mail settings

  • Configuring HAWK Script Stopper settings


Activating heuristic scanning

Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses the software already knows. To do this, the software looks for "virus-like" characteristics in the files you’ve asked it to scan. The presence of a sufficient number of these characteristics in a file leads the software to identify the file as potentially infected with a new or previously unidentified virus.

Because the software looks simultaneously for file characteristics that rule out the possibility of virus infection, it will rarely give you a false indication of a virus infection. Therefore, unless you know that the file does not contain a virus, you should treat "potential" infections with the same caution you would confirmed infections.

To activate heuristic scanning, follow these steps:

  1. Select the Enable heuristics scanning checkbox. The remaining options in the dialog box activate.

  2. Specify which types of heuristic scanning you want to use. Your choices are:

    • Enable macro heuristics scanning. Choose this option to have the software identify all Microsoft Office and other files that have embedded macros, then compare the macrocode to its virus signature database. The software will identify exact matches with the virus name; code signatures that resemble existing viruses cause the software to tell you it has found a potential macro virus.

    • Enable program file heuristics scanning. Choose this option to have the software locate new viruses in program files by examining their characteristics and comparing them against a list of known virus characteristics. The software will identify files with a sufficient number of these characteristics as potential viruses.

    • Enable macro and program file heuristics scanning. Choose this option to have the software use both types of heuristic scanning. McAfee recommends that you use this option for complete anti-virus protection.

  3. For on demand scans, specify your Additional criteria for scanning (This step applies to on demand scans only).

    • Scan for potentially dangerous programs. Check this check box to direct VirusScan to scan for programs that pose a security threat (such as password crackers) to your computer.

    • Scan for viruses in MIME/UUEncoded files. Check this check box to have the VirusScan application scan for viruses in MIME (Multipurpose Internet Mail Extension) encoded files or UU-Encoded (UNIX to UNIX Encoded) files.

    • Scan all OLE objects. Check this check box to have the VirusScan application scan all Object Linking and Embedding (OLE) objects. OLE objects are files created in one program and embedded into files created with another program. You can, for example, embed a Microsoft Excel spreadsheet inside a Microsoft Word document. Viruses carried inside the embedded object can spread even if the "host" file itself remains uninfected. Please note, McAfee recommends that you enable this option for better anti-virus protection.

  4. Click OK to save your settings and return to the Scan Settings dialog.


VirusScan Windows Explorer Plug-in

McAfee VirusScan provides you with a Windows Explorer Plug-in that allows you to perform on-demand scan operations and View VirusScan statistics directly from Windows Explorer.

To display the VirusScan Windows Explorer Plug-in, do the following:

  1. Start Windows Explorer.

  2. Right-click the Windows Explorer tool bar and select McAfee VirusScan.

VirusScan Plug-in tasks

Task

How to perform this task

Scan for Viruses now.

  1. From Windows Explorer, select the file or files that you want to scan. You can use the keyboard shortcuts Click + Shift + Click to select adjacent files, and Click + Ctrl + Click to select non-adjacent files.

  2. Click the arrow on the VirusScan Plug-in drop-down menu and select Scan for Viruses.

    Result    : VirusScan starts and completes the task.

View VirusScan Status.

From Windows Explorer, click the arrow on the VirusScan Plug-in drop-down menu and select View VirusScan Status.

Result: The VirusScan Status dialog displays.

The VirusScan Status dialog provides you with real-time information about System Scan data, Outlook E-mail Scan data, and HAWK for E-mail Scan data.

TIP: If VirusScan is not running as you select this task, the data element fields appear dimmed.


Choosing Detection options for VirusScan scheduled tasks

When you first open the VirusScan Properties dialog box to configure a task you’ve created, the VirusScan application assumes that you want to scan your C: drive and all of its subfolders, to scan your computer’s memory and hard disk boot sectors, to scan compressed files, and to scan only those files susceptible to virus infection.

To set or change those options, follow these steps:

  1. Choose which parts of your system or your network that you want VirusScan software to examine for viruses. You can:

    • Add scan targets. Click Add to open the Add Scan Item dialog box.

    • You may not use Universal Naming Convention (UNC) notation to specify a network disk as a scan target for scheduled tasks. Doing so will result in an "Invalid Path" error.

    • Change scan targets. Select one of the listed scan targets, then click Edit to open the Edit Item to Scan dialog box.

      The dialog box appears with the existing scan target specified. Choose or enter a new scan target, then click OK to close the dialog box.

    • Remove scan targets. Select one of the listed scan targets, then click Remove to delete it.

  2. Choose special scanning options.

    Boot-sector viruses load themselves into your computer’s memory and conceal themselves in the boot blocks or master boot record on your hard drive. To use this scan task to detect those types of viruses, select the     Scan Memory and Scan boot sectors check boxes.

  3. Specify which types of files you want the application to examine. You can

    • Scan compressed files. Select the Compressed files checkbox to have the application look for viruses in compressed files and file archives. Although this does give you better protection, scanning compressed files and file archives can lengthen a scan operation. To see a list of the types of files and archives that the application scans, click here:

    • Scan all files. Select the All Files checkbox to have the application scan all of the files on the target you specified, whatever their extensions.

    • McAfee recommends that you choose this option for your first scan operation, or periodically thereafter, to ensure that your system is virus-free. You can then limit the scope of later scan operations.

    • To see or designate the file name extensions the application will examine, click Extensions. This opens the Program File Extensions dialog box. To learn about how to change the files listed there, click here:

    • Turn on heuristic scanning. Click Advanced to open the Advanced Scan Settings dialog box. To learn about heuristic scanning and how to activate it, click here:

  4. If you want this task to run in your absence, select Start automatically to tell the VirusScan application to begin scanning as soon as it launches.

    If you do not select this checkbox, the VirusScan application starts, but it will wait for you to click     Scan for Viruses Now to start the task. Leaving the checkbox clear gives you a chance to cancel the scan operation if it will interfere with your work.

  5. Next, you can:

    • Click Apply to save your configuration options without closing the VirusScan Properties dialog box.

    • Choose other configuration options. Click any of these tasks to learn how to configure options in the remaining property page.

      • Action options

      • Alert options

      • Report options

    • Click OK to save your configuration options and return to the Task Properties dialog box. There you can click Run Now to start a scan operation with the options you chose.


Choosing Action options for VirusScan scheduled tasks

When you first create a new task, the VirusScan application assumes that you want it to ask you what it should do with a virus when it detects one. You can continue to have it prompt you for a response, or you can have it automatically take an action that you determine ahead of time.

To set or change the options for this task:

  1. Choose a response from the When a virus is found list.

    The area immediately beneath the list will change to show you additional options for each response. Your choices are:

    • Prompt user for action. Choose this response if you expect to be at your computer when the application scans your disk. It will display an alert message when it detects a virus and offers you a range of response options.

      Choose which response options you want to see in that alert message from the Possible actions area at the bottom of the property page. To learn more about each action, click here:

      If you choose       Prompt user for action from the list, click the Alert tab to specify whether you want the VirusScan application to prompt you with a message, a beep, or both.

    • Quarantine. Choose this response to have the application move detected files to a quarantine folder as soon as it finds them.

    • Clean detected files automatically. Choose this response to tell the application to remove the virus code from the infected file as soon as it finds it. If the application cannot remove the virus, it will note the incident in its log file.

    • Delete detected files automatically. Choose this option to have the application delete every infected file it finds immediately. Be sure to enable the reporting feature so that you have a record of which files the application deleted. You will need to restore deleted files from backup copies. If the application cannot delete an infected file, it will note the incident in its log file.

    • Continue scanning. Use this option only if you plan to leave your computer unattended while the application checks for viruses. If you also activate the reporting feature, the application will record the names of any viruses it finds and the names of detected files so that you can delete them at your next opportunity.

  2. Next, you can:

    • Click Apply to save your configuration options without closing the VirusScan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

    • Detection options

    • Alert options

    • Report options

    • Click OK to save your configuration options and return to the Task Properties dialog box. There you can click Run Now to start a scan operation with the options you chose.


Choosing Report options for VirusScan scheduled tasks

The VirusScan application lists its current settings and summarizes all of the actions it takes during each scan task in a log file called c:\program files\mcafee\mcafee virusscan\vshlog.txt. You can have the application write its log to this file, or you can use any text editor to create a text file for it to use. You can then open and print the log file for later review from within the application or from your text editor.

You can use the c:\program files\mcafee\mcafee virusscan\vshlog.txt file to track virus activity on your system and to note which settings the application used to detect and respond to infections it found. You can also use the incident reports recorded in the file to determine which files you need to replace from backup copies, examine in quarantine, or delete from your computer.

To decide what data the application will record and how large the log file can get, follow these steps:

  1. Select the Log to file checkbox.

    By default, the application writes log information to the file c:\program files\mcafee\mcafee virusscan\vshlog.txt in the VirusScan program directory. You can enter a different name in the text box provided, or click Browse to locate a suitable file elsewhere on your hard disk or on your network. You may use a different file, but the text file must already exist. The application will not create a new file.

  2. Select the Limit size of log file to checkbox to minimize the log file size. If you do not select this checkbox, the log file can grow to as large a size as your disk space permits.

  3. Enter a value for the file size, in kilobytes, in the text box provided.

    Enter a value between 10KB and 999KB. By default, the application limits the file size to 100KB. If the data in the log exceeds the file size you set, the application erases the existing log and begins again from the point at which it left off.

  4. Select the checkboxes that correspond to the information you want the application to record. To learn what each selection means, click here:

  5. Next, you can:

    • Click Apply to save your configuration options without closing the VirusScan Properties dialog box.

    • Choose other configuration options. Click any of these topics to learn how to configure options in the remaining property pages:

      • Detection options

      • Action options

      • Alert options

    • Click OK to save your configuration options and return to the Task Properties dialog box. There you can click Run Now to start a scan operation with the options you chose.


About VShield Scanner

McAfee desktop anti-virus products use two general methods to protect your system. The first method, background scanning, operates continuously, watching for viruses as you use your computer for everyday tasks. In the VirusScan product, the VShield scanner performs this function. A second method allows you to initiate your own scan operations. The VirusScan application generally handles these tasks.

Depending on how you configure it, the VShield scanner can monitor any file that arrives on or leaves your system, whether on floppy disk, over your network, in file attachments that accompany e-mail messages, or from the Internet. The scanner looks for viruses as you open, save, copy, rename or otherwise modify your files, and it probes your computer’s memory during any file activity. The scanner starts when you start your computer, and stays in memory until you shut it or your system down.

The VShield scanner consists of three unique but related modules; each of which has a specialized function and in total provides you with a total virus defence solution. The VShield modules are:

  • System Scanner. This module looks for viruses on your hard disk as you work with your computer. It tracks files as your system or other computers read files from your hard disk or write files to it. It can also scan floppy disks and network drives mapped to your system.

    Additionally, the System Scanner maintains the ability to scan your e-mail message attachments. For example, if you receive a Word file attachment that is infected with a virus, the System Scanner alerts you that it detected a virus before you can open the file and infect your computer.

  • E-mail Scan. This module scans e-mail messages and message attachments that you receive via intraoffice e-mail systems, and via the Internet. It scans your Microsoft Exchange or Outlook mailbox.

  • HAWK: Hostile Activity Watch Kernel (HAWK) monitors your computer for suspicious activity that may indicate a virus is present on your system. As opposed to VirusScan, which cleans the virus, HAWK prevents viruses, worms, and Trojans from spreading further.

    HAWK monitors SMTP and POP3 Internet e-mail, commonly used with e-mail clients such as Outlook Express, Eudora, and Netscape mail. HAWK uses pattern matching to detect suspicious activity. For example, if HAWK detects mass mailings, or several e-mail messages displaying the same subject line, HAWK analyzes the information and alerts you.

  • Script Stopper™ uses HAWK's constant monitoring to detect actions that are often included in script-based viruses, Script Stopper™ alerts you of the attempted activity and will stop the actions that are initiated on your computer without your knowledge. Script Stopper™ detects, alerts, and blocks malicious script actions to keep your computer safe from script-initiated threats.


Compatible web browsers and e-mail clients

  • Netscape Navigator v3.x

  • Netscape Navigator v4.0.x

  • Microsoft Internet Explorer v4.01 SP2

  • Microsoft Internet Explorer v5.x

  • Microsoft Internet Explorer v6.0

  • Microsoft Exchange v4.0, v5.0 and v5.5

  • Microsoft Outlook 97

  • Microsoft Outlook 98

  • Microsoft Outlook 2000

  • Microsoft Outlook XP/2002

  • AOL users should not modify the default setting for System Scan under Automatic File Protection Settings.

  • System scan provides virus protection for AOL email and attachments. The setting for System Scan should remain as ENABLED to ensure that AOL e-mail, attachments, and downloads are protected from malicious threats.

Compatible web browsers and e-mail clients

The VShield scanner works seamlessly with many of the most popular web browsers and e-mail client software available for the Windows platform. To work with your browser, the scanner requires no setup beyond what you have already done to connect your computer to the Internet. You must configure the scanner, however, to work correctly with your e-mail client software. To learn how to do so, click here:

McAfee has tested these web browsers and verified that they work correctly with the VShield scanner:

In order to work with the VShield your e-mail client software must support Microsoft’s MAPI standard. This includes:

NOTES:

McAfee does not certify VShield scanner compatibility with client software not listed above.

The VShield scanning module HAWK (Hostile Activity Watch Kernel) supports the Microsoft Outlook e-mail client.

AOL Integration:


Starting and Stopping the VShield scanner

When the VShield scanner first starts, it displays an icon in the Windows system tray that indicates which of its modules are active.

At first, the scanner enables only its System Scan module, which scans viruses that arrive on your system from floppy disks and other removable media, from local-area network connections, and similar areas. The System Scan module also scans files that arrive via your e-mail system and from the Internet, but to do so, it requires the aid of the E-mail Scan module.

If your computer runs Windows 98, or Windows Me, the scanner loads in a way that mimics a Windows service on that platform. This service is not visible in the Windows user interface.

Starting the scanner automatically

If the VShield scanner does not start automatically, you can set it to do so in the VirusScan control panel. Follow these steps:

  1. Click Start in the Windows taskbar, point to Settings, then choose Control Panel.

  2. Locate and double-click the VirusScan control panel icon to open it.

  3. Select the Load VShield on startup checkbox at the top of the Components property page.

  4. Click OK to close the control panel.

The VShield scanner will start as you start your computer.

TIP: Enabling a module means activating it and loading it into your computer’s memory for use. The VShield scanner can start and remain active in memory even with none of its modules enabled.

To use the Quick Enable method, follow these steps:

  1. Start VirusScan from the Windows Start menu.

  2. On the VirusScan Home page select the Configure automatic protection settings Task.

  3. From the Configure your Automatic Protection settings window, select the VShield component that you wish to enable. A checked check box displays next to the corresponding module.

  4. Click Apply settings.

To disable any or all scanning modules, follow these steps:

  1. Start VirusScan from the Windows Start menu.

  2. On the VirusScan main window, select the Configure automatic protection settings Task.

  3. From the Configure your Automatic Protection settings window, clear the check box next to the VShield component that you wish to disable.

  4. Click Apply settings.

TIP: The VShield properties sheet provides you with additional information in the form of Context Sensitive Help. Click the question mark in the title bar of the VShield property sheet, and then click the text of an item in the property sheet. You can also get Help for an item on the property sheet by right clicking it, and then selecting What’s This?


Dependent and related files for the VShield scanner

The VShield scanner runs as a service Windows 2000 Professional and Windows XP systems, and as a virtual device driver on Windows 98,and Windows Me systems. It requires a number of support files to function, including some that enable its various modules. The following tables lists VShield and related files:

  • Program files

  • Dependent files

  • Temporary files


Dependent and related files for the VShield scanner-Program Files

Program Files

These files run directly as VShield components or are dedicated VShield library or support files.

File | Function | Location
VSTAT.EXE | Handles program communication among VShield components, displays VShield icon | C:\Program Files\McAfee\McAfee VirusScan
VSCONFIG.EXE | Configures VShield settings, displays the VShield Properties dialog box | C:\Program Files\McAfee\McAfee VirusScan
MFLDR.DLL | Library file for use with MAPI e-mail systems; handles access and export functions | C:\Program Files\McAfee\McAfee VirusScan
CONFWIZ.EXE | VShield configuration wizard file | C:\Program Files\McAfee\McAfee VirusScan
VSHWIN32.EXE | Communicates between VSSTAT.EXE and the VShield System Scan module | C:\Program Files\McAfee\McAfee VirusScan
MCSHIELD.EXE | System Scan module. Runs as an NT Service on Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield
NAIEVENT.DLL | Event logging resource. Runs only on a Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield
MCSHIELD.DLL | Resource file for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield\Res09
NAIANN.DLL | Support file for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield
NAIFILTR.SYS | Filter driver for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield
NAIFSREC.SYS | File system redirector for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Winnt\System32\drivers
NTCLIENT.DLL | Support file for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Program Files\McAfee\McAfee VirusScan
SCANSERV.DLL | Support file for System Scan module. Runs only on Windows 2000 Professional and Windows XP systems | C:\Program Files\Common Files\Network Associates\McShield
VSHIELD.VXD | VShield System Scan module. Runs as a Windows virtual device driver only on Windows 98 systems | C:\Windows\System
VSHINIT.VXD | VShield support file. Initializes services for DOS protected-mode interface. Runs only on Windows 98 systems | C:\Windows\System
MCSCAN32.VXD | McAfee scan engine. Runs only on Windows 98 systems | C:\Windows\System
MCUTIL.VXD | Support file for System Scan module. Runs only Windows 98 systems | C:\Windows\System
MCKRNL.VXD | Support file for System Scan module. Runs only on Windows 98 systems | C:\Windows\System
SCANEMAL.DLL | Scans e-mail you receive from the Internet or from your network via MAPI e-mail systems | C:\Program Files\McAfee\McAfee VirusScan


Dependent and related files for the VShield scanner-Dependent Files

Dependent Files

VShield requires these files to run, but these are not VShield program files, or are not dedicated solely to VShield support.

File | Function | Location
AVSYNMGR.EXE | VirusScan management service. Initializes, starts and stops all VirusScan services and components. Must run to enable all VirusScan components. | C:\Program Files\McAfee\McAfee VirusScan
AVSYNCH.DLL | Handles inter-component communication through shared memory | C:\Program Files\McAfee\McAfee VirusScan
SYNCUTIL.DLL | Stores data shared between components | C:\Program Files\McAfee\McAfee VirusScan
VSUTIL.DLL | Provides common utilities for components | C:\Program Files\McAfee\McAfee VirusScan
AVSMCPA.CPL | VirusScan control panel applet | C:\Program Files\McAfee\McAfee VirusScan
RESDLL.DLL | Resource file for all components | C:\Program Files\Common Files\Network Associates\McPal
MCSCAN32.DLL | McAfee Scan engine file | C\:Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx
RWABS16.DLL | Support file for scan engine | C\:Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx
RWABS32.DLL | Support file for scan engine | C:\Program Files\Common Files\McAfee VirusScan VirusScan Engine\4.0.xx
MESSAGES.DAT | Support file for scan engine. Provides virus detection messages to engine | C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx


Dependent and related files for the VShield scanner-Temporary Files

Temporary Files

The VShield scanner and its related files use these files as "memory maps" to store configuration options copied from the Windows registry when the program runs. These files start out with a standard file size and minimal data, and grow or shrink as necessary to accommodate configuration data.

File | Function | Location
SYNC_MAP.MMF | Memory map file for AVSYNCH.DLL | C:\Program Files\McAfee\McAfee VirusScan
AVCONSOLE.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_CONS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_SCAN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DEXCLDEF.MFF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DSCANDEF.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DVS_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANGEN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANOAS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANODS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan


Viewing VShield scanner statistics

Once you activate and configure the VShield scanner, it operates continuously in the background, watching for and scanning e-mail you receive, files you run or download, or Java and ActiveX objects you encounter.

To see a real-time summary of its progress, right-click the VirusScan tray icon and select View VirusScan Status. The VShield Status dialog displays.

The information each module will report is:

  • System Scan. This module reports the number of files it has scanned, the number of infected files it detected, and the number it cleaned, moved or deleted.

  • Outlook E-mail Scan. This module reports the number of e-mail files scanned, the number of infections it detected, and the number it moved or deleted.

  • HAWK for E-mail. This module reports information about scanned e-mail and their attachments for suspicious activity.

To see a description of each of the items that appears in this page, right click a figure or label, then choose What’s This? from the shortcut menu that appears, or click the ? button in the upper-right corner of the dialog box, then click the item you want described.


Configuring the System Scan module

The VShield System Scan module is at the heart of the VShield scanner. It scans files that come from any source, including those that the other VShield modules direct to it from Internet downloads and e-mail messages. The module can check your system for viruses each time you open, run, copy, save, rename or otherwise modify files on your hard disk, on any removable media attached to your computer, or on network drives mapped to your system. It can also detect viruses each time you read from or write to a floppy disk. As an advanced option, you can activate heuristic scanning, which gives the scanner the capability to detect unidentified or unclassified viruses.

The module can take a variety of automatic actions to respond to any viruses it finds, and can report what it has done either with an alert message when it takes the action or in a log file you can examine at your leisure. You can also set it to ask you what to do when it finds a virus.

Elsewhere in this module, you can choose options that tell the VShield scanner to display a state icon in the Windows taskbar that tells you at a glance, which, if any, VShield modules are active. Another option lets you disable the System Scan module. This option might not be available if you run the VirusScan software in secure mode.

To choose your options, click the System Scan icon at the left side of the System Scan Properties dialog box to display the property pages for this module.

Next, click the topics listed below to learn how to choose options for each property page:

  • Detection options

  • Action options

  • Alert options

  • Report options

  • Exclusion options


Choosing Detection options for the System Scan module

When you first activate it, the System Scan module initially assumes that you want it to scan for viruses each time you work with any file susceptible to virus infection, whether on your hard disk or on floppy disks, and whether you read the file from or write the file to your hard disk. The module will also examine compressed files by default, but will not use heuristic scanning unless you activate it.

To change configuration options, follow these steps:

  1. Verify that the Enable System Scan checkbox is selected.

    Selecting this checkbox activates the remaining options in this property page. Clear this checkbox to disable all configuration options in this page and to prevent the System Scan module from scanning your system.

  2. Tell the module when and where you want it to look for viruses. You can have it:

    • Scan files as you work with them. Each time you open, run, copy, save, rename, or otherwise use files on your hard disk, virus code can execute and spread infections to other files. To prevent this on computers that run Windows 2000 Professional and Windows XP, select both the Inbound files and the Outbound files check boxes. On computers that run Windows 98, select each of the Run, Copy, Create, and Rename check boxes for full coverage.

    • If you have network drives mapped to your computer from which you copy files, or if other network users copy files from your computer, McAfee strongly recommends that you have the VShield scanner installed both on your computer and on the computer that "owns" the network drive. You should also select all check boxes in the Scan area in the Detection page, plus the Network drives checkbox in the What to Scan area.

      Your copy of the System Scan module will then examine files as your computer reads them from your hard disk, then again as it writes them to the destination computer’s hard disk. If the destination computer has its own copy of the System Scan module active, it too will scan the file as you write it to the network drive if that System Scan module has the Inbound files checkbox selected.

      If you tend to copy files from one server that does not copy files from your computer, and if other network users do the same, you might want to configure your computers to scan only files that they write to their hard disks—or only files that they read from their hard disks—in order to prevent two computers from scanning the same file. If you do so, however, you should configure each computer identically. Otherwise, one computer that scans only outbound files could copy an infected file from a server that scans only inbound files.

    • Scan files on floppy disks. Boot-sector viruses can hide in the boot blocks of any formatted floppy disk, then load into memory as soon as your computer reads your floppy drive. Select the Access checkbox to have the System Scan module examine floppy disks each time your computer reads from them or writes to them. Select the Shutdown checkbox to have the module scan any floppy disks that you leave in your drive as you shut down your computer. This ensures that no viruses can load when your computer reads your floppy drive at startup.

  3. Choose VShield scanner management options. These options let you control your interaction with the VShield scanner. You can:

    • Disable the System Scan module at will. Select the System Scan can be disabled checkbox in order to have the option to disable this module. Note that McAfee recommends that you leave the System Scan module enabled for maximum protection. Clearing this checkbox removes the Exit and System Scan items from the VShield shortcut menu and the Disable button from the VShield Status dialog box.

    • Display the VShield icon in the Windows system tray. Select the Show icon in the Taskbar checkbox to have the VShield scanner display this icon in the system tray. Double-clicking the icon opens the VShield Status dialog box. Right-clicking the icon displays a shortcut menu.

  4. Turn on heuristic scanning. Click Advanced to open the Advanced Scan Settings dialog box. To learn about heuristic scanning and how to activate it, please refer to Activating heuristic scanning.

  5. Next, you can:

    • Click Apply to save your configuration options without closing the System Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Action options

      • Report options

      • Exclusion options

    • Click OK to save your configuration options and close the System Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Action options for the System Scan module

When the System Scan module detects a virus, it can respond either by asking you what it should do with the infected file, or by automatically taking an action that you determine ahead of time. Use the Action property page to specify which response options you want the module to give you when it finds a virus, or which actions you want it to take on its own.

To change configuration options, follow these steps:

  1. Choose a response from the When a virus is found list.

    The area immediately beneath the list will change to show you additional options for each response. Your choices are:

    • Prompt for user action. Choose this response to have the System Scan module ask you what to do upon detection—the module will display an alert message and offer you a range of possible responses.

      Choose which response options you want to see in that alert message from the Possible actions area at the bottom of the property page.

      If you choose       Prompt for user action from the list, click the Alert tab to specify whether you want the System Scan module to prompt you with a message, a beep, or both.

      Clean detected files automatically. Choose this response to tell the module to remove the virus code from the infected file as soon as it finds it. If the module cannot remove the virus, it will deny access to the file and note the incident in its log file.

    • Delete detected files automatically. Choose this option to have the module delete every infected file it finds immediately. Be sure to enable the reporting feature so that you have a record of which files the module deleted. You will need to restore deleted files from backup copies. If the module cannot delete an infected file, it will note the incident in its log file.

    • Deny access to detected files and continue. This option tells the module to lock the infected file to prevent any access to it at all, then to continue with its scan session. If you have its reporting options enabled, the module records the incident in its log file.

  2. Select a prompt mode. This option is available only on systems that run Windows 98. With it, you can specify the type of alert message you want the System Scan module to display when it finds a virus. Your options are:

    • BIOS. Click this button to see a full-screen text-mode alert message that offers you a range of response options, including the option to continue without any action against the virus. This mode also brings your system to a complete halt until you choose a response option.

    • GUI. Click this button to see a standard graphical alert message that also offers a range of response options. This range will not include Continue access. As the prompt awaits your choice, your system will continue with normal operations in the background.

  3. Next, you can:

    • Click Apply to save your configuration options without closing the System Scan Properties dialog box.

    • Choose other configuration options. Click any of these topics to learn how to configure options in the remaining property pages:

      • Detection options

      • Alert options

      • Report options

      • Exclusion options

    • Click OK to save your configuration options and close the System Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Report options for the System Scan module

The System Scan module lists its current settings and summarizes all of the actions it takes during each scan session in a log file called VSHLOG.TXT. You can have the module write its log to this file, or you can use any text editor to create a text file for it to use. You can then open and print the log file for later review.

The VSHLOG.TXT file can serve as an important management tool for you to track virus activity on your system and to note which settings you used to detect and respond to the infections the System Scan module found. You can also use the incident reports recorded in the file to determine which files you need to replace from backup copies, examine in quarantine, or delete from your computer.

To decide what data the module will record and how large the log file can get, follow these steps:

  1. Select the Log to file checkbox.

    By default, the module writes log information to the file VSHLOG.TXT in the VirusScan program directory. You can enter a different name in the text box provided, or click Browse to locate a suitable file elsewhere on your hard disk or on your network. You may use a different file, but the text file must already exist. The module will not create a new file.

  2. Select the Limit size of log file to checkbox to minimize the log file size. If you do not select this checkbox, the log file can grow to as large a size as your disk space or file system permits.

  3. Enter a value for the file size, in kilobytes, in the text box provided.

    Enter a value between 10KB and 999KB. By default, the module limits the file size to 100KB. If the data in the log exceeds the file size you set, the module erases the existing log and begins again from the point at which it left off.

  4. Select the check boxes that correspond to the information you want the module to record. To learn what each selection means, click here:

  5. Next, you can:

    • Click Apply to save your configuration options without closing the System Scan Properties dialog box.

    • Choose other configuration options. Click any of these topics to learn how to configure options in the remaining property pages:

      • Detection options

      • Action options

      • Alert options

      • Exclusion options

    • Click OK to save your configuration options and close the System Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Exclusion options for the System Scan module

Many of the files stored on your computer are not vulnerable to virus infection. Having the System Scan module examine these files can take a long time and produce few results. You can reduce the time the System Scan module spends looking at each file you modify by restricting it to examining only susceptible file types. You can also tell the module to ignore entire files or folders that you know cannot become infected.

The exclusion list identifies which disks, folders, or individual files you want to exclude from VShield scan sessions. By default, the System Scan module does not scan the Recycle Bin because Windows will not run items stored there. This item, therefore, will appear in the list when you first open the window.

Each entry in the exclusion list displays the path to the item, notes whether the module will also exclude any nested folders within the target, and explains whether the application will exclude the item when it scans files, when it scans your hard disk boot sector, or both.

Once you use VirusScan software to scan your system thoroughly, you can tell the System Scan module to ignore those files and folders that do not change or that are not normally vulnerable to virus infection.

To do so, follow these steps:

  1. Click Add to exclude a new item.

    This opens the Add Exclude Item dialog box. To learn about how to specify items you want to exclude during scan sessions, click here:

    By default, you can exclude up to 100 unique scan targets. To change this number, open the VirusScan control panel, click the Components tab, then enter a new figure in the Maximum number of exclude items text box.

  2. Select one of the items shown, then click Edit to change the item definition.

    This opens the Edit Exclude Item dialog box. Make the changes you need, then click OK to close the dialog box.

  3. Select one of the items shown, then click Remove to delete an item from the list. This means that the System Scan module will scan the item during this scan session.

  4. Next, you can:

    • Click Apply to save your configuration options without closing the System Scan Properties dialog box.

    • Choose other configuration options. Click any of these topics to learn how to configure options in the remaining property pages:

      • Detection options

      • Action options

      • Alert options

      • Report

    • Click OK to save your configuration options and close the System Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Specifying items to exclude from scan operations

To specify which items you want the VirusScan software to ignore, follow these steps:

  1. Enter a path to a folder or a file name in the text box provided, or click Browse to locate the item you want the application to exclude.

  2. Select the Include subfolders checkbox to tell the software to ignore files stored in any subfolders within the folder you specified in Step 1.

    Choosing Include subfolders causes the software to ignore only those files stored in the subfolders themselves. The software will still scan files stored at the root level of the folder you designate. To exclude the files at the folder root level, clear the Include subfolders checkbox.

  3. Select the File scanning checkbox to exclude the item you specified in Step 1 from scan operations in which the software looks for file-infecting viruses. These viruses usually appear in files stored in the visible portions of your hard disk.

    If you select only this checkbox, the software will still scan the item you excluded if it appears in your hard disk’s boot sector or in memory. To exclude the item in all instances, select the Boot sector scanning checkbox also.

  4. Select the Boot sector scanning checkbox to exclude the item you specified in Step 1 from scan operations in which the software looks for boot-sector viruses.

These viruses usually appear in memory or in files that reside in your hard disk’s boot sector or master boot record. Use this option to exclude system files, such as COMMAND.COM, from scan operations. If you select only this checkbox, the software will still scan the item you excluded if it appears elsewhere on your hard disk. To exclude the item in all instances, select the File scanning checkbox also.

Repeat steps 1 through 4 until you have listed all of the files and folders you do not want scanned.


Configuring the E-mail Scan module

The VShield E-mail Scan module looks for viruses in files attached to e-mail messages that you receive via corporate e-mail systems that adhere to the Messaging Application Programming Interface (MAPI) standard, such as Microsoft Exchange and Microsoft Outlook.

This module pays particular attention to attachments that come with your e-mail, which are the biggest potential source of viruses. Because it can scan e-mail as soon as it appears on your desktop, the module can intercept viruses before they ever have a chance to spread.

When it finds a virus, the module can ask you what you want it to do, or it can take a variety of automatic actions in response. You can have it report what it has done either with an alert message when it takes the action or in a log file you can examine at your leisure. It can even send a message to the person who sent an infected e-mail message, which makes tracking the source of virus infections relatively simple.

To choose your options, click the E-mail Scan icon at the left side of the System Scan Properties dialog box to display the property pages for this module.

Next, click the tasks listed below to learn how to choose options for each property page:

  • Detection options

  • Action options

  • Alert options

  • Report options


Choosing Detection options for the E-mail Scan module

The VShield scanner does not start with the E-mail Scan module enabled by default because it needs to know which e-mail system you use. Once you configure it for use with your regular e-mail client, the module will use your MAPI profile to log on to your mail account whenever it starts a scan session.

If you have already started and logged into your e-mail system, the module will simply work within the session you’ve created. If, however, you have not yet logged into your e-mail system, the module will prompt you to choose a profile or enter account information as soon as a scan session starts, even before you’ve logged into your e-mail account. This also can occur when you start your computer, if you do not have your e-mail client program set to load at startup.

If you switch profiles or log into a different account—perhaps in another domain—the module will ask you to choose the profile you want to use or to supply a new user name and password to log on to the mail system.

To choose configuration options for this page, follow these steps:

  1. Select the Enable Scanning of e-mail attachments in Microsoft Outlook checkbox.

  2. If you select the Enable Scanning of e-mail attachments in Microsoft Outlook checkbox, the Folders area shows All incoming mail, which means that the module will look for viruses in files attached to each e-mail message as it arrives in your MAPI mailbox or via other MAPI services.

  3. Specify the types of e-mail attachments you want the E-mail Scan module to examine. You can:

    • Scan compressed files. Select the Compressed files checkbox to have the module look for viruses in compressed files or in file archives. This option ensures that viruses do not spread from compressed files, but because the module uncompresses these files before it scans them, choosing this option can lengthen the time it takes to scan a given set of files as you work with your computer. To see a list of the types of files and archives that the module scans, please refer to Current list of compressed files scanned.

    • Scan all files. Select the All Files checkbox to have the module scan all of the files that arrive via your e-mail system, whatever their extensions.

      McAfee recommends that you choose this option for a short while after you first install the VirusScan software, or periodically thereafter, to ensure that your system is virus-free. You can then limit what the E-mail Scan module looks for later.

    • Choose file types. Viruses cannot infect files that contain no executable code, whether script, macro, or binary code. You can, therefore, safely narrow the scope of your scan sessions to those files most susceptible to virus infection. To do so, click the Program files only button. To see or designate the file name extensions the module will examine, click Extensions. This opens the Program File Extensions dialog box. To learn about how to change the files listed there, please refer to Adding and removing program extensions.

  6. Turn on heuristic scanning. Click Advanced to open the Advanced Scan Settings dialog box. To learn about heuristic scanning and how to activate it, please refer to Activating heuristic scanning.

  7. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Action options

      • Alert options

      • Report options

    • Click OK to save your configuration options.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Action options for the E-mail Scan module

When the E-mail Scan module detects a virus, it can respond either by asking you what it should do with the infected file, or by automatically taking an action that you determine ahead of time. Use this property page to specify which response options you want the module to give you when it finds a virus, or which actions you want it to take on its own.

The E-mail Scan module can respond to viruses only if you select a corporate e-mail system for it to scan. If you select only Internet Mail, the options here will be unavailable.

To change configuration options, follow these steps:

  1. Choose a response from the When a virus is found list.

    The area immediately beneath the list will change to show you additional options for each response. Your choices are:

    • Prompt for user action. Choose this response to have the E-mail Scan module ask you what to do upon detection—the module will display an alert message and offer you a range of possible responses.

      Choose which response options you want to see in that alert message from the Possible actions area at the bottom of the property page. To learn more about each action, click here:

      If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the E-mail Scan module to prompt you with a message, a beep, or both.

    • Clean detected files. Choose this response to tell the module to remove the virus code from the infected file as soon as it finds it. If the module cannot remove the virus, it will note the incident in its log file.

The E-mail Scan module does not support this option for Lotus cc:Mail v7.x and earlier e-mail systems. The option will not appear here if you selected Lotus cc:Mail in the E-mail Scan Detection page.

    • Delete detected files. Choose this option to have the module delete every infected file it finds immediately. Be sure to enable the reporting feature so that you have a record of which files the module deleted. You will need to restore deleted files from backup copies. If the module cannot delete an infected file, it will note the incident in its log file.

    • Continue scanning. Use this option only if you plan to leave your computer unattended while the module checks for viruses. If you also activate the reporting feature, the module will record the names of any viruses it finds and the names of infected files so that you can delete them at your next opportunity.

  2. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these tasks to learn how to configure options in the remaining property pages:

      • Detection

      • Alert

      • Report

    • Click OK to save your configuration options.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Report options for the E-mail Scan module

The E-mail Scan module lists its current settings and summarizes all of the actions it takes during each scan session in a log file called WEBEMAIL.TXT. You can have the module write its log to this file, or you can use any text editor to create a text file for it to use. You can then open and print the log file for later review.

The WEBEMAIL.TXT file can serve as an important management tool for you to track virus activity on your system and to note which settings you used to detect and respond to the infections the E-mail Scan module found. You can also use the incident reports recorded in the file to determine which files you need to replace from backup copies, examine in quarantine, or delete from your computer.

To decide what data the module will record and how large the log file can get, follow these steps:

  1. Select the Log to file checkbox.

    By default, the module writes log information to the file WEBEMAIL.TXT in the VirusScan program directory. You can enter a different name in the text box provided, or click Browse to locate a suitable file elsewhere on your hard disk or on your network. You may use a different file, but the text file must already exist. The module will not create a new file.

  2. Select the Limit size of log file to checkbox to minimize the log file size. If you do not select this checkbox, the log file can grow to as large a size as your disk space or file system permits.

  3. Enter a value for the file size, in kilobytes, in the text box provided.

    Enter a value between 10KB and 999KB. By default, the module limits the file size to 256KB. If the data in the log exceeds the file size you set, the module erases the existing log and begins again from the point at which it left off.

  4. Select the check boxes that correspond to the information you want the module to record. To learn what each selection means, click here:

  5. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Detection

      • Action

      • Alert

    • Click OK to save your configuration options and close the E-mail Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

  • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Configuring the HAWK for Outlook Module

Hostile Activity Watch Kernel (HAWK) is a VirusScan option that enables constant monitoring for suspicious activity that may indicate a virus is present on your system. Suspicious activity includes:

  • An attempt to forward e-mail to a large portion of your address book.

  • Attempts to forward multiple e-mail messages in rapid succession.

  • E-mail attachments containing program files (executable files with an .exe file extension) or scripts that can be used to mask the actual type document transmitted to you.

Although VirusScan does an excellent job detecting known viruses, it cannot detect new viruses without a DAT file update. By monitoring for these typically malicious activities, HAWK notifies you and lets you take action before damage occurs. HAWK can prevent viruses, worms, and Trojans from spreading further, while VirusScan cleans the virus to remove it from your computer.


Choosing Monitoring Options for HAWK

Choosing HAWK Monitoring Options

Use the following steps to configure HAWK

  1. From the Task list on the VirusScan Home page, select Configure automatic protection settings.

  2. Click Advanced.

  3. Select the HAWK icon.
    The E-mail property sheet displays.

  4. Select the Enable HAWK for Outlook checkbox to alert you if potential e-mail viruses are running. Selecting this check box activates all remaining options displayed on the HAWK property sheet. Clear this checkbox to disable all configuration options and to prevent the HAWK module from examining your Outlook e-mail messages and their attachments.

    All HAWK options are selected, by default. To deactivate an option without deactivating HAWK, clear the check box preceding the option.

  5. Click Apply.

HAWK Options

General

  • Enable pattern monitoring: Select this checkbox to have the HAWK module monitor e-mail subjects and size of the message body.

If more than one message is about to be sent with similar subjects and message body sizes, then an alert message will display and you can choose to either continue or cancel. If you choose to Continue, then all e-mail messages will be sent.

If you choose to Cancel, then all presumed duplicate e-mail messages will be stored in your Outbox for your review. Upon your review, you can choose to either send or delete the message(s).

  • Alert when: Select this checkbox to alert you when there has been an attempt to send 2 to 20 e-mail messages within 3 to 60 seconds. Use the spin box to choose the number and time frame for these settings.

Recipients

  • Alert when an e-mail is at least: Select this checkbox to alert you when there has been an attempt to send e-mail messages to 1% to 100% of your address book; or to 10 to 999 recipients within your address book.

  • Use the spin box to select the percentage or number of address book recipients.

Attachments

  • Enable attachment monitoring: Select this checkbox to enable (e-mail) attachment monitoring.

  • Embedded attachments: Select this checkbox to alert you when you are about to open an e-mail message that contains an Embedded attachment.

    An Embedded Attachment is a file that can be an executable program or application.

  • User Specified files: Select this checkbox to alert you when your are about to open an e-mail attachment that contains a file extension in the list of extensions that you do not allow.

  • Extensions: Click this button to see the current trusted extension list that the HAWK application will use to guide its scan operations.

Use this list to confine your scan operations to those files most susceptible to infection. Doing so speeds up system performance and shortens scan times.


Configuring the HAWK Script Stopper

Many of the fastest spreading viruses, like I Love You, use scripts to infect your computer. VirusScan stops new malicious threats from infecting your system with Script Stopper™. Using HAWK's constant monitoring to detect actions that are often included in script-based viruses, Script Stopper™ alerts you of the attempted activity and will stop the actions that are initiated on your computer without your knowledge. Script Stopper™ detects, alerts, and blocks malicious script actions to keep your computer safe from script-initiated threats.

About Malicious Scripts

First, a "script" executes a group of commands without user intervention. If you are a programmer or "tech-savvy," creating scripts to perform tasks can be very productive. Scripts are built-in functions to several Microsoft programs, such as Word and Excel under the namesake of VBS – Visual Basic Scripting.

Then there are scripts that are not productive or helpful to you. We categorize these types of scripts as malicious in nature. When you encounter a malicious script it may attempt to delete files stored in your computer, open files without your knowledge, access your e-mail client's address book, send multiple e-mail messages, and access your computer's registry. These are examples of the types of malicious activities Script Stopper™ senses.

Configuration

To enable Script Stopper™, do the following:

  1. From the VirusScan Home page, select the Configure automatic protection settings task.

  2. Check the Enable HAWK Script Stopper check box.

  3. Click the HAWK icon.

  4. Click the Script Stopper™ tab.

  5. Check the Enable HAWK Script Stopper™ check box.

Custom Options

To customize your Script Stopper™ options, do the following:

  1. From the Configure your Automatic Protection Settings screen, click Customize your Automatic Protection settings.

    RESULT: The Automatic Protection Settings properties sheet displays – also know as VShield Scanner.

  2. Click the HAWK icon.

  3. Click the Script Stopper™ tab.

  4. Refer to the table below to complete the configuration.,

Option

Description

How to use

Add

Allows you to add a script to your Trusted Script list.

  1. Click Add.

  2. Browse to select the script.

  3. Refer to the on-screen instructions

Remove

Allows you to delete a script from your trusted Script list.

  1. Select the script that you want to remove from the Trusted Script list.

  2. Click Remove.

Clear List

Allows you to delete all scripts from your Trusted Script list.

Click Clear List.

TIP: As HAWK Script Stopper™ detects a potentially harmful script, McAfee VirusScan alerts you. If you trust the script and allow it to run, the script is added to your Trusted Script list.


Choosing Alert Options for VShield Modules

Choosing Alert Options for the VShield Background Scanner Modules

McAfee virus scanning software makes it easy for you to handle a virus when detected. From the VShield Scanner, you can use the default message or create a custom display message and/or an audible alert message to let you know that a potentially dangerous object or virus was detected. Alert notification can be activated (or deactivated) in connection with any or all of the VShield scanning modules supported by this feature.

Alert notification is available for the following scan module:

  • E-mail Scan

To use alert notification for the respective scan module, you must first enable the particular scan module and specify how VShield should react when it detects a harmful object in order to activate alert notification.

Use the steps below to activate alert notification.

  1. From the Task list on the VirusScan Home page, select Configure automatic protection settings.

  2. Click Advanced.

  3. Select the icon of the scan module you wish to enable.

  4. Select the Detection tab.

  5. Check the Enable check box and click Apply.

  6. Select the Action tab.

  7. From the When a potentially harmful object is found drop-down list box, select Prompt for user for action and click Apply.

Use the steps below to choose an alert notification method. Please note, if you did not activate alert notification, then the fields described below display as shaded, unavailable options

  1. For the scan module you wish to configure, select the Alert tab.

  2. To hear a sound or tone, check the Sound audible alert check box.

  3. To display a message, check the Display custom message check box.

  4. If you wish to create a personal alert message, delete the default message from the text box displayed on this tab, and input the message you wish to see.

  5. Click Apply.

  6. To disable an alert message or sound, clear the appropriate check box and click Apply.


Understanding the E-mail Scan extension

VirusScan software provides you with two complementary methods to protect your Microsoft Exchange or Outlook e-mail system:

  • The VShield scanner includes an E-mail Scan module that runs continuous background scan operations on e-mail as it arrives on your server.

  • The E-mail Scan extension allows you to scan your mailbox on the Exchange server at your own initiative, and at times convenient for you.

An unobtrusive plug-in architecture gives you access to the E-mail Scan extension from directly within your Exchange or Outlook client application.

To learn more about the E-mail Scan extension and how to get started with it, click the buttons beside each listed topic:

  • When and why you should use the E-mail Scan extension

  • Starting the E-mail Scan extension

  • Stopping or removing the E-mail Scan extension

  • Configuring E-mail Scan extension settings

  • Advanced: Files necessary for E-mail Scan extension operation


When and why you should use the E-mail Scan extension

Most of the fastest-spreading viruses, worms, and other hostile agents that have emerged in the last few years have proliferated via e-mail. E-mail offers a fast and omnipresent medium that virus writers can use to distribute infected attachments, which they often trick users into opening and activating. Newer viruses, as VBS/BUBBLEBOY demonstrated, might even be able to work without users having to open or read even the e-mail message itself.

The Microsoft Exchange and Outlook e-mail clients are particularly vulnerable to infections of this sort because of their powerful macro and script interpretation capabilities. As with the rest of the Microsoft Office application suite, the Exchange client software makes extensive use of macros, marked-up text, script commands, and similar capabilities that lend themselves to virus attack.

Use the VShield E-mail Scan module to run background scan operations on your e-mail system and to maintain a constant level of vigilance between the scan operations you run with the E-mail Scan extension. Under most circumstances, this should protect your system's integrity.

If you have a large backlog of mail on your server that you have not yet scanned, if you log off from your Exchange server, or if you stop the E-mail Scan module at any point, you should use the E-mail Scan extension to scan your mailbox to ensure system integrity. Viruses could easily remain in old e-mail messages stored on your server or in e-mail messages that arrive during periods you are logged off from your e-mail system.

Good anti-virus security measures incorporate complete, regular scan operations on your mailbox because:

  • Good security is redundant security. The VShield E-mail Scan module looks for virus code as your e-mail arrives on your server, or as executable attachments run after they’ve downloaded to your system. The E-mail Scan extension, however, can scan old e-mail stored on the server that the E-mail Scan module will not see, look for viruses in e-mail that arrives in between times you log in to your Exchange server, or can scan your mailbox if you’ve temporarily disabled the VShield E-mail Scan module.

  • Preventative maintenance means safety. With fast e-mail connections between powerful, web-enabled, scripted client software, it takes only a moment to get infected, sometimes even before you open your mail. Regular scan operations can often catch infections before they spread or do any harm.


Starting the E-mail Scan extension

To use the E-mail Scan Extension, you must install VirusScan software with a Custom installation and choose the E-mail Scan component for installation.

To use the E-mail Scan extension with its default settings:

  1. Start your Microsoft Exchange or Microsoft Outlook client software.

  2. Log on to your mail server as you would normally.

  3. Choose Scan for Viruses from the Tools menu in your client application, or click the Scan for Viruses icon.


Stopping the E-mail Scan extension

Because it functions as an add-in to your Microsoft Exchange or Outlook e-mail client, the E-mail Scan extension is not actually running unless it is in the middle of a scan operation and is actively looking for viruses in your Exchange mailbox. To see what the E-mail Scan extension window looks like with a scan operation in progress, click here:

To pause or stop a scan operation in progress:

  • Click the pause button.

  • To restart the scan operation, click the start button.

  • Click the stop scan button.


Dependent and related files for the E-mail Scan extension

The E-mail Scan extension runs as an add-in to your MAPI E-mail system. If you use a Microsoft Exchange or Outlook client, the extension loads into the client application and appears as menu items in the Tools menu and as buttons in the application toolbar. You can use the extension to run scan operations whenever you wish. The extension requires a number of support files to function, including some related to the McAfee scan engine. This table lists extension and related files:

Program Files
File | Function | Location
SCANEMAL.DLL | Scans E-mail on your Microsoft Exchange server or other MAPI E-mail system. This file runs as an Exchange or Outlook extension that loads into the E-mail client application. This same file provides scan services for the VShield E-mail Scan module. | C:\Program Files\McAfee\McAfee VirusScan
Dependent Files

The E-mail Scan extension requires these files to run at various points, but these are not extension files, or are not dedicated solely to support the E-mail Scan extension.

File | Function | Location
AVSYNMGR.EXE | VirusScan management service. Initializes, starts and stops all VirusScan services and components. Must run to enable all VirusScan components. | C:\Program Files\McAfee\McAfee VirusScan
AVSYNCH.DLL | Handles inter-component communication through shared memory. | C:\Program Files\McAfee\McAfee VirusScan
SYNCUTIL.DLL | Stores data shared between components. | C:\Program Files\McAfee\McAfee VirusScan
VSUTIL.DLL | Provides common utilities for components. | C:\Program Files\McAfee\McAfee VirusScan
AVSMCPA.CPL | VirusScan control panel applet. | C:\Program Files\McAfee\McAfee VirusScan
RESDLL.DLL | Resource file for all VirusScan components. | C:\Program Files\Common Files\McAfee VirusScan \McPal
MCSCAN32.DLL | McAfee Scan engine file. | C:\Program Files\Common Files\Network Associates \VirusScan Engine\4.0.xx
RWABS16.DLL | Support file for scan engine. | C:\Program Files\Common Files\McAfee VirusScan \VirusScan Engine\4.0.xx
RWABS32.DLL | Support file for scan engine. | C:\Program Files\Common Files\Network Associates \VirusScan Engine\4.0.xx
MESSAGES.DAT | Support file for scan engine. Provides virus detection messages to engine. | C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx
Temporary Files

The E-mail Scan extension and its related files use the files listed in this table as "memory maps" to store configuration options copied from the Windows registry when the program runs. These files start out with a standard file size and minimal data, and grow or shrink as necessary to accommodate configuration data.

File | Function | Location
SYNC_MAP.MMF | Memory map file for AVSYNCH.DLL | C:\Program Files\Network Associates\VirusScan
AVCONSOLE.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DAV_CONS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DAV_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DAV_SCAN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DEXCLDEF.MFF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DSCANDEF.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
DVS_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
VSCANGEN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
VSCANOAS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan
VSCANODS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\Network Associates\VirusScan


Choosing Detection options for the E-mail Scan extension

When you first open the E-mail Scan Properties dialog box to configure a scan operation, the E-mail Scan extension assumes that you want it to scan all of the messages in your Exchange mailbox, to scan all message file attachments, to scan compressed files, and to scan only those files susceptible to virus infection.

The E-mail Scan extension does in fact scan the e-mail messages themselves, as Microsoft Exchange files can carry embedded macros, Hyper Text Markup Language (HTML) tags, and VBScript applets, all of which can in turn harbor specialized viruses, worms, or Trojan horse programs.

The E-mail Scan extension connects directly to your mailbox on the Microsoft Exchange mail server to run its scan operations. You can also scan any public folders to which you have access, but the extension does not scan messages stored in Microsoft Outlook personal folders (.PST files) or archived items. Other VirusScan components, however, will scan .PST files during their own regular scan operations unless you specifically exclude them.

To set or change options for this scan operation, follow these steps:

  1. Choose which e-mail messages you want the E-mail Scan extension to examine for viruses. You can scan:

    • All messages in the ‘Inbox’ folder. Click this button to have the extension look for viruses in all e-mail messages stored in your Microsoft Exchange or Microsoft Outlook Inbox, whether you have read them or not.

      If you have a large volume of messages stored in your Inbox, such a scan operation can take considerable time. If, however, you installed the E-mail Scan extension after you have installed and used your mail system for some time, McAfee recommends that you perform at least one such scan operation to ensure that your older mail messages do not contain viruses.

    • All highlighted messages. Click this button to have the extension look for viruses in only those e-mail messages you select from those stored in your Microsoft Exchange or Microsoft Outlook Inbox.

  2. To restrict this scan operation so that it examines only unread messages, select the Scan unread messages only checkbox. Depending on which option you select in Step 1, this means that the extension will scan all unread messages in your Inbox, or all unread messages within the range you’ve selected.

  3. Specify which types of files you want the extension to examine. You can:

    • Scan all file types. Select the Scan all file attachments checkbox to have the E-mail Scan extension scan all of the files that arrive as attachments in your e-mail, whatever their file name extensions.

    • McAfee recommends that you choose this option for your first scan operation, or periodically thereafter, to ensure that your system is virus-free. You can then limit the scope of later scan operations.

    • Choose file types. Viruses cannot infect files that contain no executable code, whether script, macro, or binary code. You can, therefore, safely narrow the scope of your scan operations to those files most susceptible to virus infection. To do so, click the Program files only button.

      To see or designate the file name extensions that the E-mail Scan add-in will examine, click Extensions. This opens the Program File Extensions dialog box. To learn about how to change the files listed there, click here:

    • Scan compressed files. Select the Compressed files checkbox to have the extension look for viruses in compressed files or in file archives. To see a list of the types of files and archives that the extension scans, click here:

    • Turn on heuristic scanning. Click Advanced to open the Advanced Scan Settings dialog box. To learn about heuristic scanning and how to activate it, click here:

  4. Next, you can:

  • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

  • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

    • Action options

    • Alert options

    • Report options

  • Click OK to save your configuration options.

  • Click Cancel to close the dialog box without saving your changes.

  • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Action options for the E-mail Scan extension

When you first create a new task, the E-mail Scan extension assumes that you want it to ask you what it should do with a virus when it detects one. You can continue to have it prompt you for a response, or you can have it automatically take an action that you determine ahead of time.

To set or change the options for this task:

  1. Choose a response from the When a virus is found list.

    The area immediately beneath the list will change to show you additional options for each response. Your choices are:

    • Prompt for user action. Choose this response if you expect to be at your computer when the extension scans your disk. It will display an alert message upon detection and offer you a range of response options.

      Choose which response options you want to see in that alert message from the Possible actions area at the bottom of the property page. To learn more about each action, click here:

      If you choose       Prompt for user action from the list, click the Alert tab to specify whether you want the E-mail Scan extension to prompt you with a message, a beep, or both.

    • Move detected attachment automatically. Choose this response to have the extension move files to a quarantine folder on your Microsoft Exchange server as soon as it finds them.

    • Clean detected attachment automatically. Choose this response to tell the extension to remove the virus code from the detected attachment as soon as it finds it. If the extension cannot remove the virus, it will note the incident in its log file.

    • Delete detected attachment automatically. Choose this option to have the e-mail extension delete detected e-mail attachment it finds immediately. Be sure to enable the reporting feature so that you have a record of which files the extension deleted. If the extension cannot delete an infected file, it will note the incident in its log file.

    • Continue scanning. Use this option only if you plan to leave your computer unattended while the extension checks for viruses. If you also activate the reporting feature, the extension will record the names of any viruses it finds and the names of infected files so that you can delete them at your next opportunity.

  2. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Detection options

      • Alert options

      • Report options

    • Click OK to save your configuration options.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Alert options for the E-mail Scan extension

This section enables you to configure auto-responses to specific users, such as friends and family members, or the e-mail sender when VirusScan detects an e-mail attachment containing a virus.

  1. Check Return reply to e-mail sender check box and click Configure.

  2. Click Cc (carbon copy) to select a specific user from your address book. If the person that you want to send the alert message to is not listed in your address book, type their e-mail address in the Cc text box.

  3. In the Subject text box, enter a subject for the e-mail message. Press the Tab key once and enter a message for your automated response. Click OK to save your settings.

  4. Check the Send alert mail to user check box and click Configure.

  5. Click To if you want to select a specific user from your address book. If the person that you want to send the alert message to is not listed in your address book, type their e-mail address in the To text box. Repeat this process if you want to send a copy to (Cc) a specific individual.

  6. In the Subject text box, enter a subject for the e-mail message. Press the Tab key once and enter a message for your automated response. Click OK to save your settings.

  7. To display a message, check the Display custom message check box. This option is only available if you selected Prompt for action on the Action tab. If you wish to create a personalized alert message, delete the default message from the text box displayed on this tab, and input the message you wish to see.

  8. Check the Sound audible alert check box if you want to hear an alert tone as VirusScan detects an e-mail massage that contains that virus.

  9. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Detection options

      • Action options

      • Report options

    • Click OK to save your configuration options.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Choosing Report options for the E-mail Scan extension

The E-mail Scan extension lists its current settings and summarizes all of the actions it takes during each scan task in a log file called MAILSCAN.TXT. You can have the extension write its log to this file, or you can use any text editor to create a text file for it to use. You can then open and print the log file for later review from your text editor.

You can use the MAILSCAN.TXT file to track virus activity on your system and to note which settings the extension used to detect and respond to infections it found. You can also use the incident reports recorded in the file to determine which files you need to examine in quarantine, or delete from your computer.

To decide what data the extension will record and how large the log file can get, follow these steps:

  1. Select the Log to file checkbox.

    By default, the extension writes log information to the file MAILSCAN.TXT in the VirusScan program directory. You can enter a different name in the text box provided, or click     Browse to locate a suitable file elsewhere on your hard disk or on your network. You may use a different file, but the text file must already exist. The extension will not create a new file.

    If you choose a different     location for your log file on a Windows 2000 Professional or Windows XP system, verify that you choose a location to which you have user-level access. Because the E-mail Scan extension runs with the same access rights that your e-mail client program does, it cannot write to this log file correctly if the file exists in a location that requires Administrator access rights, and you have logged in as a user to run your e-mail client program. Instead, the E-mail Scan extension will give you an "Activity Log Access Error" message when it detects a virus.

  2. Select the Limit size of log file to checkbox to minimize the log file size. If you do not select this checkbox, the log file can grow to as large a size as your disk space permits.

  3. Enter a value for the file size, in kilobytes, in the text box provided.

    Enter a value between 10KB and 999KB. By default, the extension limits the file size to 100KB. If the data in the log exceeds the file size you set, the extension erases the existing log and begins again from the point at which it left off.

  4. Select the check boxes that correspond to the information you want the extension to record. To learn what each selection means, click here:

  5. Next, you can:

    • Click Apply to save your configuration options without closing the E-mail Scan Properties dialog box.

    • Choose other configuration options. Click any of these buttons to learn how to configure options in the remaining property pages:

      • Detection

      • Action

      • Alert

    • Click OK to save your configuration options and close the E-mail Scan Properties dialog box.

    • Click Cancel to close the dialog box without saving your changes.

    • Clicking Cancel will not undo any changes you already saved by clicking Apply.


Understanding the VirusScan control panel

The VirusScan control panel serves as the graphical front end for the VirusScan management service, which initiates and controls the VirusScan On Access Scanner (OAS).

In practical terms, you can use the control panel to:

  • Start and stop the VShield on access scanner with a single button

  • Tell the VShield scanner to load at startup

  • Perform an on-access scan while your computer starts

To open the VirusScan control panel applet, follow these steps:

  1. From the Windows taskbar, select Start > Control Panel (Windows XP). For all other Windows operating systems, select Start > Settings > Control Panel.

  2. Locate and double-click the VirusScan icon to open it.

To learn more about the control panel and how to use it, click the buttons beside each listed topic:

  • Working with the VirusScan control panel

  • Advanced: VirusScan control panel files


VirusScan control panel files

As the initial process for all VirusScan components, the VirusScan management service does not depend on other VirusScan components. It does depend on some Windows system components to run, however.

This table lists VirusScan control panel files and points to where you can find them.

File | Function | Location
AVSYNMGR.EXE | The VirusScan management service. Initializes, starts and stops all VirusScan services and components. Must run to enable all VirusScan components. | C:\Program Files\McAfee\McAfee VirusScan
AVSYNCH.DLL | Handles inter-component communication through shared memory | C:\Program Files\McAfee\McAfee VirusScan
SYNCUTIL.DLL | Stores data shared between components | C:\Program Files\McAfee\McAfee VirusScan
VSUTIL.DLL | Provides common utilities for components | C:\Program Files\McAfee\McAfee VirusScan
AVSMCPA.CPL | VirusScan control panel applet | C:\Program Files\McAfee\McAfee VirusScan

Temporary Files

The VirusScan control panel and its related files use these files as "memory maps" to store configuration options copied from the Windows registry when the program runs. These files start out with a standard file size and minimal data, and grow or shrink as necessary to accommodate configuration data.

File | Function | Location
SYNC_MAP.MMF | Memory map file for AVSYNCH.DLL | C:\Program Files\McAfee\McAfee VirusScan
AVCONSOLE.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_CONS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DAV_SCAN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DEXCLDEF.MFF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DSCANDEF.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
DVS_EXCL.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANGEN.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANOAS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan
VSCANODS.MMF | Memory map file for SYNCUTIL.DLL | C:\Program Files\McAfee\McAfee VirusScan


Working with the VirusScan control panel

To choose VirusScan control panel options, follow these steps:

  1. To stop all active VirusScan components, click Stop.

    If all VirusScan components that normally load into memory are inactive, this button will read Start. Click it to reload inactive VirusScan components. You can also restart the VirusScan application from the Windows Start menu and the VShield system tray icon.

  2. Select the Load on startup checkbox in the VirusScan Service area to start the VirusScan management service (AVSYNMGR.EXE) as soon as you start your computer.

    The management service oversees all communications between VirusScan program components, determines which components must load to accomplish program tasks, and allows you to start or stop all program components at once.

    If your computer runs Windows 2000 Professional or Windows XP, this service appears in the Services dialog box as AvSync Manager. If your computer runs Windows 98 or Windows Me, this service is not directly accessible.

    McAfee strongly recommends that you set the VirusScan management service to load at startup. If you do not, you might not be able to start some VirusScan components, and you will lose the benefit of data sharing between components.

Note: McAfee recommends that you leave this checkbox selected. The VShield on access scanner is your best continuous defense against virus infections.

  3. Click OK to close the VirusScan Control Panel applet.


Understanding what prompt options do

Each of the check boxes you select in the Action page causes an option button to appear in an alert message that the software displays when it finds a virus. Selecting Delete file, here, for example, causes a Delete button to appear in the alert message.

You can choose from these options:

  • Continue. This option tells the software to continue with its scan operation, but not take any other actions. If you have its reporting options enabled, VirusScan software records the incident in its log file.

  • Stop. This option tells the software to stop the scan operation immediately. To continue, you must click Scan for Viruses Now to restart the operation.

  • Clean infection or Clean file. Either of these options tells the software to try to remove the virus code from the infected file. If you have its reporting function enabled, it will record a log event each time it successfully cleans, or fails to clean.

  • Delete. Before actually deleting the infected file, VirusScan makes an attempt to clean the infected file. If unsuccessful, VirusScan will then delete the infected file

  • Quarantine. VirusScan moves the file to the default quarantine folder and continues the scan.

  • Info. Click this button to start your Internet browser and go to the AVERT Web site. Here you may further your investigation about the suspect file.


Understanding what E-mail Scan prompt options do

Each of the check boxes you select in the Action page causes an option button to appear in an alert message that the module displays when it finds a virus. Selecting Delete file here, for example, causes a Delete button to appear in the alert message.

You can choose from these options:

  • Clean file. This option tells the module to try to remove the virus code from the detected file. If you have its reporting function enabled, it will record a log event each time it successfully cleans, or fails to clean, an infected file.

  • Delete file. This option tells the module to delete the detected file immediately.

  • Move file. This option tells the module to move the detected file to a quarantine folder. The alert message will display a Move file to button that allows you to locate a quarantine file to use.

  • Continue scan. This option tells the software to continue with its scan session, but not take any other actions. If you have its reporting options enabled, the E-mail Scan module records the incident in its log file.


Understanding what E-mail Scan extension prompt options do

Each of the check boxes you select in the Action page causes an option button to appear in an alert message that the software displays when it finds a virus. Selecting Delete file, here, for example, causes a Delete button to appear in the alert message.

You can choose from these options:

  • Clean file. This option tells the extension to try to remove the virus code from the detected file. If you have its reporting function enabled, the extension will record an log event each time it successfully cleans, or fails to clean, an infected file.

  • Delete file. This option tells the extension to delete the detected file immediately.

  • Move file. This option tells the extension to move the detected file to a quarantine folder. The alert message will display a Move file to button that allows you to send the infected item to a quarantine folder on your Microsoft Exchange server. You can move detected items to any other folder you’ve created in your Exchange or Outlook mailbox, or to any public folder on the Exchange server to which you have access. The item will remain on the Exchange server until you dispose of it—it will not get downloaded to your computer.

  • Continue scan. This option tells the extension to continue with its scan operation, but not take any other actions. If you have its reporting options enabled, the extension records the incident in its log file.

  • Stop scan. This option tells the extension to stop the scan operation immediately. To continue, you must click scan icon in the Exchange or Outlook toolbar again, or you must choose Scan for Viruses from the Tools menu to restart the operation.


Understanding log file entry options

Each checkbox you select in the Report configuration page for this application or utility will record this information, usually when the scan operation ends, or when you shut your system down:

  • Virus detection. Select this checkbox to have the log file record how many viruses the software finds during each scan operation. Clear the checkbox to leave this information out of the log file.

  • Virus cleaning. Select this checkbox to have the log file record how many infected files the software cleans—or tries to clean—during each scan operation. Clear this checkbox to leave this information out of the log file.

  • Infected file deletion. Select this checkbox to have the log file record how many viruses the software deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

  • Session settings. Select this checkbox to have the log file record the configuration settings you used for this application or utility during each scan operation. Clear this checkbox to leave this information out of the log file.

  • Session summary. Select this checkbox to have the log file summarize the actions that the software took during each scan operation. The log will record:

    • How many files the software examined.

    • How many infected files the software cleaned.

    • How many infected files the software deleted.

    • How many infected files the software moved to a quarantine folder.

    • Your application or utility settings.

Clear the checkbox to leave this information out of the log file.

  • Date and time. Select this checkbox to have the log file record the date and time at which the software starts each scan operation. Clear this checkbox to leave this information out of the log file.

  • User name. Select this checkbox to have the log file record the name of the user logged into the workstation as the software starts each scan operation. Clear this checkbox to leave this information out of the log file.


Understanding System Scan log file entry options

Each checkbox you select in the Report configuration page for the System Scan module will record this information, usually when the scan session ends, or when you shut your system down:

  • Virus Detection. Select this checkbox to have the log file record how many viruses the module finds during each scan session. Clear the checkbox to leave this information out of the log file.

  • Virus Cleaning. Select this checkbox to have the log file record how many infected files the module cleans—or tries to clean—during each scan session. Clear this checkbox to leave this information out of the log file.

  • Infected file deletion. Select this checkbox to have the log file record how many viruses the module deletes during each scan session. Clear this checkbox to leave this information out of the log file.

  • Session settings. Select this checkbox to have the log file record the configuration settings you used for the module during each scan session. Clear this checkbox to leave this information out of the log file.

  • Session summary. Select this checkbox to have the log file summarize the actions that the module took during each scan session. The log will record:

    • How many files the module examined.

    • How many infected files the module cleaned.

    • How many infected files the module deleted.

    • How many infected files the module moved to a quarantine folder.

    • Your System Scan module settings.

Clear the checkbox to leave this information out of the log file.

  • Date and time. Select this checkbox to have the log file record the date and time at which the module starts each scan session. Clear this checkbox to leave this information out of the log file.

  • User name. Select this checkbox to have the log file record the name of the user logged into the workstation as the module starts each scan session. Clear this checkbox to leave this information out of the log file.


Understanding E-mail Scan log file entry options

Each checkbox you select in the Report configuration page for the E-mail Scan module will record this information, usually when the scan session ends, or when you shut your system down:

  • Virus Detection. Select this checkbox to have the log file record how many viruses the module finds during each scan session. Clear the checkbox to leave this information out of the log file.

  • Infected file deletion. Select this checkbox to have the log file record how many viruses the module deletes during each scan session. Clear this checkbox to leave this information out of the log file.

  • Session settings. Select this checkbox to have the log file record the configuration settings you used for the module during each scan session. Clear this checkbox to leave this information out of the log file.

  • Session summary. Select this checkbox to have the log file summarize the actions that the module took during each scan session. The log will record:

    • How many files the module examined.

    • How many infected files the module cleaned (MAPI E-mail systems only).

    • How many infected files the module deleted.

    • Your E-mail Scan module settings.

    • Clear the checkbox to leave this information out of the log file.

  • Virus Cleaning. Select this checkbox to have the log file record how many infected files the module cleans—or tries to clean—during each scan session. Clear this checkbox to leave this information out of the log file.

  • The E-mail Scan module does not support this option for Lotus cc:Mail v7.x and earlier E-mail systems. The option will not appear here if you selected Lotus cc:Mail in the E-mail Scan Detection page.


Introduction to Wireless Device Protection

Wireless Device Protection

Introduction

As the demand for wireless devices continue to grow, it carries with it, the threat of compromising your data against viruses especially whenever you exchange information between your PC and your wireless device.

Wireless devices that are currently available in the market today are primarily designed as a more convenient alternative in storing and retrieving information such as personal activities, people’s addresses, telephone numbers, appointments, expenses, etc. Either at work or at home, you can easily keep track of records in all of these areas by simply using your wireless device. You can even set an alarm to alert you of important meetings, events or tasks to do during the day, week or month.

How VirusScan protects your wireless device

McAfee VirusScan is an application designed to protect your data by scanning the files on your wireless device every time a data exchange or update is performed with your computer. It protects your system from viruses that may have been placed on your wireless device during the use of features such as infrared transfers and wireless transactions. McAfee VirusScan supports most types of wireless devices using Palm OS, Pocket PC, Windows CE, and EPOC operating systems (please refer to the following table).

Examples of wireless devices supported by McAfee VirusScan

Operating System

Wireless Device

Manufacturer

Palm OS

  • Palm VII Series

  • Palm V Series

  • Palm III Series

  • Palm M Series

Palm, Inc.

Palm OS

  • Visor

  • Visor Edge

HandSpring

Palm OS

  • Clie

Sony

Pocket PC

  • E-115

Casio

Pocket PC

  • iPAQ

  • iPAQ H3600 Series

  • Aero

  • Aero 2100 Series

Compaq

Pocket PC

  • PPT 2700 Series

Symbol Technologies

Pocket PC

  • Jornada 540

  • Jornada 680

  • Jornada 720

Hewlett-Packard

Pocket PC

  • E125

  • EM500

Cassiopeia

Windows CE

  • PenCentra 130

Fujitso

Windows CE

  • HPW-600 ET

Hitachi

Windows CE

  • WorkPad z50

IBM

EPOC

  • Psion Series 5MX

  • Psion - Revo

Psion PLC

EPOC

  • Mako

Diamond


Data Synchronization

Data synchronization is a standard feature of most wireless operating systems wherein information or records are synchronized between a wireless device and a regular PC. This feature has been commonly known, depending on the type of device you are using as: HotSync for Palm OS devices; ActiveSync for Pocket PC’s and Windows CE; and Psion Synchronizer for EPOC devices.

As an example, if you add a new entry on your wireless devices' Address List, this new entry is automatically added into the PC platform after performing a data synchronization operation. To reduce the time it takes to complete the synchronization of data on both platforms, it only changes the data that has been modified, updated or added.

In performing a data exchange operation, a data synchronization manager (i.e.: HotSync Manager, ActiveSync or Psion Synchronizer) must be running. This is the application that makes the data synchronization operation possible. It monitors your computer and responds to any data synchronization-related command when initiated from the wireless device.

NOTE: Depending on the operating system on your wireless device, please refer to “Additional Requirements for Wireless Devices,” to determine the type and version of data synchronization manager (i.e.: HotSync Manager, ActiveSync) you must have to be able to use McAfee VirusScan.

VirusScan analyzes the data transmitted between your computer and your wireless device during data synchronization. If VirusScan detects the presence of infected data, you can treat the infected file in the same manner as you would any other infected file.


VirusScan for Palm OS

About Palm OS

Palm OS developed by Palm, Inc. is one of the most common types of operating systems used for wireless computing devices. It is designed specifically for mobile information management. Through a wireless device, you can readily access personal or business information synchronized on at any time, and importantly, in any location.

One of its important components is HotSync data conduit synchronization technology that allows you to exchange information between your wireless device and your computer.

McAfee VirusScan for Palm OS scans your device for viruses before you can download a virus to your computer. It uses a PC-side component and a device-side component to scan the device during a HotSync with the PC.


Starting Palm anti-virus components

Tap the McAfee VirusScan for Palm OS icon and several option check boxes buttons appear on your device.

These options are:

  • Scan at start of a HotSync

  • Modified Records Only

  • Scan at end of HotSync

  • Known File Types Only

  • Scan Applications

  • Scan Flash Memory

  • Scan Application Data

  • Known Executable Types Only


Available options on the device component

The available wireless device component options allow you to customize how you want McAfee VirusScan to work on the components of your device. Selecting the option that you need most will help optimize your protection and scanning time.

NOTE: Changing options on either the device or the PC side component of the application changes both sides on sync. The only files scanned are files that go through the conduit to and from the device.

Task | Description
Scan at start of a HotSync | This option allows you to scan files at the beginning of the HotSync.
Scan at end of a HotSync | This option scans files at the end of the HotSync.
Scan Applications | This option allows you to scan your applications.
Scan Application Data | This option allows you to scan your application data.
Modified Records Only | This option allows you to only scan data records that have been changed since the last HotSync operation.
Known File Types Only | This option allows you to only scan known database type files.
Known Executable Code Types Only | This option allows you to only scan known executable type files.
Scan Flash Memory | This option allows to only scan flash memory of your wireless device to detect if a virus is present.

NOTE: You can select any combination of the above scanning options.


Available options on the PC component

McAfee VirusScan requires that the PC-side component be installed on the PC that you will sync the wireless device with for full anti-virus protection. You will not be able to scan your device for viruses if the PC-side component of McAfee VirusScan is not installed.

The available PC component options allow you to customize how you want McAfee VirusScan to work. Selecting the option that you need most will help optimize your protection and scanning time.

Task | Description
Scan Applications | This option allows you to scan your applications transferred to your device.
Scan Application Data | This option allows you to scan application data transferred to your device.
Modified Records Only | This option allows you to only scan data records that have been changed since the last HotSync operation transferred to your device.
Known File Types Only | This option allows you to only scan known database type files transferred to your device.
Known Executable Code Types Only | This option allows you to only scan known executable type files transferred to your device.
Scan Flash Memory | This option allows you scan the flash memory of your wireless device to detect if a virus is present.

NOTE: You can select any combination of the above scans.


When to scan options

The following are other available options that can further optimize the way McAfee VirusScan will work on your wireless device.

Task | Description
At the start of each HotSync | This option allows you to scan your wireless device for viruses at the start of each HotSync.
At the end of each HotSync | This option allows you to scan your device for viruses at the end of each HotSync.


Other options

After selecting your scan settings, you can do any of the following:

  • Click OK to accept the changes to your scan and update settings.

  • Click Cancel to ignore the changes and close the window.


Removing McAfee VirusScan for Palm OS components

Use the steps below to remove McAfee VirusScan from your device-side components.

  1. From the main applications screen, tap the clock.

  2. From the App menu, choose Delete.

  3. Select McAfee VirusScan from the menu, and then tap the Delete button.

  4. Tap Yes in the Delete Application window.

  5. Tap Done to close the screen.

If you accidentally delete McAfee VirusScan from your Palm device, a backup file is available in your Palm backup directory. This file is usually listed as Palm \"username"\Backup \PalmAV.PRC, though doing a search for PalmAV.PRC will also find the file. Once you locate the file, double-click it to add it to the Palm Install Tool. The next time you HotSync your device, McAfee VirusScan will be restored.


VirusScan for Windows CE and Pocket PC

The features and functionality associated with McAfee VirusScan for Windows CE work similarly to those of Pocket PCs. This section applies to both operating systems.

About Windows CE

Microsoft's Windows CE is an operating system platform that offers a broad range of communications, entertainment and mobile-computing devices. One of its main features is its capability to share information with Windows-based computers. It is a compact and portable operating system used on a variety of communication devices such as wireless PCs, digital information pagers and cellular smart phones.

For more information on wireless products using Windows CE, visit their Web site at www.pocketpc.com.

About Pocket PC

Pocket PCs do not only organize information. In addition to being able to seamlessly link information to your computer, it also allows you to read e-mail messages and browse the Web. Manufacturers of this type of wireless device include companies like Hewlett Packard, Casio Computer Co., Ltd., and Compaq. For examples of Pocket PC wireless devices please visit www.pocketpc.com.


Available options on the pc component

Task | Description
Scan All files | This option allows you to scan all files on your wireless device.
Program Files Only | This option allows you to only scan those files most frequently used by your wireless device.
New or Modified Files Only | This option allows you to only scan data records that have been changed or been created since the last scan operation.
Scan files marked as in-ROM | This option allows you to scans files presently flagged as “in-ROM.”

The following option is available and it can further optimize the way McAfee VirusScan will work on your wireless device.

  • Scan when a CE device connects to this PC: This option allows you to scan any Windows CE or Pocket PC device that you synchronize to your computer.

After selecting your scan settings, you can do any of the following:

  • Click OK to accept the changes to your scan and update settings.

  • Click Cancel to ignore the changes and close the window.

  • Click Update Now to manually begin a check for anti-virus signature updates.

  • Click Scan Now to start a virus scan on your wireless device.

Available options on the PC component

The available PC component options allow you to customize how you want McAfee VirusScan to work with your device. Selecting the options that you need most will help optimize your protection and scanning time.

  • What to scan options

  • When to scan options

  • Other options


VirusScan for Symbian EPOC

Symbian is a company that develops mobile wireless operating systems. It makes use of the EPOC operating system capable of delivering applications and communications in a small package (i.e.: wireless devices). For more information, you can visit the company Web site at www.symbian.com.


Available options on the pc component

Task | Description
Scan All files | This option allows you to scan all files on your wireless device.
Program Files Only | This option allows you to only scan those files most frequently used by your wireless device.
New or Modified Files Only | This option allows you to only scan data records that have been changed or have been created since the last scan operation.

The following are other available options that can further optimize the way McAfee VirusScan will work on your wireless device.

  • Scan when an EPOC device connects to this PC: his option allows you to scan any EPOC device you synchronize to your computer.

  • Close all programs on the EPOC device before scanning: This option allows you to close programs before performing a virus scan.

After selecting your scan settings, you can do any of the following:

  • Click OK to accept the changes to your scan and update settings.

  • Click Cancel to ignore the changes and close the window.

  • Click Update Now to manually begin a check for anti-virus signature updates.

  • Click Scan Now to start a virus scan on your wireless device.

If you want to find out the versions of the scan engine and anti-virus signature files (DAT) that McAfee VirusScan is using to detect any problem on your wireless device, click About. This dialog box also displays dates that will allow you to determine if there is a need to update your DAT files to ensure maximum virus protection on your wireless device.

Available options on the PC component

The available options allow you to customize how you want McAfee VirusScan to work on your wireless device. Selecting the option that you need most will help optimize your protection and scanning time.

What to scan options
When to scan options
Other options


Understanding VirusScan Command Line scanners

VirusScan anti-virus software comes with a set of command-line scanners you can use to run scan operations directly in a command-line environment. This set consists of:

  • SCAN.EXE, a scanner for 32-bit environments only. This is the primary command-line interface. When you run this file, it first checks its environment to see whether it can run by itself. If your computer is running in 16-bit or protected mode, it will transfer control to one of the other scanners.

  • SCANPM.EXE, a scanner for 16- and 32-bit environments. This scanner provides you with a full set of scanning options for 16- and 32-bit protected-mode DOS environments. It also includes support for extended memory and flexible memory allocations. SCAN.EXE will transfer control to this scanner when its specialized capabilities can enable your scan operation to run more efficiently.

  • SCAN86.EXE, a scanner for 16-bit environments only. This scanner includes a limited set of capabilities geared to 16-bit environments. SCAN.EXE will transfer control to this scanner if your computer is running in 16-bit mode, but without special memory configurations.

  • BOOTSCAN.EXE, a smaller, specialized scanner for scanning memory, the Master Boot Record, the boot sector, and the system files on your hard disk. This scanner ordinarily runs from a floppy disk you create to provide you with a virus-free boot environment. BOOTSCAN.EXE will not detect or clean macro viruses, but it will detect or clean other viruses that can jeopardize your VirusScan software installation or infect files at system startup. Once you identify and respond to those viruses, you can safely run VirusScan software to clean the rest of your system, provided you don't run any other programs in the meantime.

All of the command-line scanners allow you to initiate targeted scan operations from an MS-DOS Prompt or Command Prompt window, or from protected MS-DOS mode. Ordinarily, you’ll use the VirusScan application’s graphical user interface (GUI) to perform most scanning operations, but if you have trouble starting Windows or if the VirusScan GUI components will not run in your environment, you can use the command-line scanners as a backup.

To start a scan operation from the command line, follow these steps:

  1. Click Start in the Windows taskbar, point to Programs, and then choose Command Prompt on Windows 2000 Professional and Windows XP systems or MS-DOS Prompt on Windows 98 and Windows Me systems.

  2. Change to the VirusScan Engine directory. If you installed VirusScan software with its default Setup options, you’ll find the directory in this path:

    C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx

    If you add this directory to the path statement for your system, you do not need to change to this directory to run VirusScan Command Line software.

  3. Type this line at the command prompt:

scan [target: drive, path, or filename] /[options]

Here, you can specify your scan target as a drive on your system, C: for example, as a path to a directory you want to scan, or as a particular filename. Precede each of the command options you want to invoke for this scan task with a / character to distinguish them from other parts of the command line. A complete discussion of the command options for the VirusScan Command Line scanner is beyond the scope of this help file, but you can see a summary description of available options. Click here:

The Command Line scanner also returns an error-level code when it finishes its scan operation. The error level summarizes what happened during the scan operation. You can use this code in batch files and other applications to take actions conditioned on the value that the scanner returns. To see the error-level codes that the scanner will return, please refer to Error levels for the VirusScan Command Line scanner.


Options for the VirusScan Command Line scanner

The following table lists options or switches that you can add to the command line when you run the VirusScan Command Line scanner.

Note: Here is the path to the VirusScan Command Line scanner:

C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx\scan.exe

Command-line
Option

Limitations

Description

/? or /HELP

None

Displays a list of VirusScan command-line options, each with a brief description.

/AD

On-demand scanning only

Combines the /ADL and /ADN options to scan all local and network drives

/ADL

On-demand scanning only

Scans all local drives—including compressed drives and PC cards, but not disks—in addition to any other drive specified on the command line.

To scan both local and network drives, use the /AD option.

OS/2: /ADL includes the CD-ROM drive in the scan, when used with /NODDA.

/ADN

On-demand scanning only

Scans all network drives for viruses, in addition to any other drive(s) specified on the command line.

To scan both local drives and network drives, use the /AD option.

/ALERTPATH <dir>

On-demand scanning only

Designates the directory <dir> as a network path for Centralized Alerting alert messages.

/ALL

On-demand scanning only

Overrides the default scan setting by scanning all infectable files—regardless of extension.

Using the /ALL option substantially increases the scanning time required. Use it only if you find a virus or suspect that you have one.

/ANALYZE

On-demand scanning only

Extended memory required.

Sets scanner to use its full heuristics, both program and macro.

/MANALYZE targets macro viruses only.

/PANALYZE targets file-infecting viruses only.

/ANYACCESS

On-access scanning only

Scans:

  • the boot sector whenever a disk is either read or written to

  • executables

  • any newly created files

/APPEND

On-demand scanning only

Appends message text to a report file specified with /REPORT instead of overwriting it.

/BOOT

On-demand scanning only

Scans boot sector and master boot record only.

/BOOTACCESS

On-access scanning only

Scans a disk’s boot sector for viruses whenever the disk is accessed (including read/write operations)

/CLEAN

On-demand scanning only

Removes virus code from all infected files and system areas.

/CLEANDOCALL

On-demand scanning only

Tells SCAN.EXE to clean all macros from infected Microsoft Word and Office documents. SCAN.EXE does this only if it detects at least one macro virus on your system during the scan operation.

This option deletes all macros, including macros not infected by a virus.

/CONTACT <message>

On-access scanning only

Displays specified message when SCAN.EXE detects a virus. This message cannot exceed 255 characters.

/CONTACTFILE <filename>

None

Displays the contents of <filename> when SCAN.EXE finds a virus. Use this to provide contact information and instructions to the user when the scanner finds a virus.

This option is especially useful in network environments, because you can easily maintain the message text in a central file rather than on each workstation.

Any character is valid in a contact message except a backslash (\). Messages beginning with a slash (/)or a hyphen (-) should be placed in quotation marks.

/DAM

On-demand scanning only

Deletes all macros in infected files. If you combine this option with /FAM, the combination will delete all macros in all files, whether infected or not, as soon as the scanner finds an infected file.

/DEL

On-demand scanning only

Deletes infected files permanently.

/EXCLUDE <filename>

On-demand scanning only

Ignores the files listed in <filename>.

Use this option to exclude specific files from a scan operation. List the complete path to each file that you want to exclude on its own line. You may use the wildcards * and ?

/FAM

On-demand scanning only

Finds all macro code inside infected Microsoft Office files, whether the files are infected or not. If you combine this option with /DAM, the combination will delete all macros in all files, whether infected or not, as soon as the scanner finds an infected file.

/FILEACCESS

On-access scanning only

Scans executable files when you modify them in any way, including executing them.

This scan operation will not check the boot sector.

/FREQUENCY <n >

On-demand scanning only

Prevents a new scan operation for <n> hours after the previous scan operation.

In environments where the risk of viral infection is very low or where system resource use is a concern, use this option to prevent unnecessary scan operations.

Note that the greater the scan frequency, the greater your protection against infection.

/HELP or /?

None

Displays a list of VirusScan scanner command-line options, each with a brief description.

/IGNORE <drive(s)>

On-access scanning only

Ignores any files loaded from the specified drive(s).

/LOAD <filename>

On-demand scanning only

Loads scanning options from the named file.

Use this option to start a scan operation you’ve already configured by loading custom settings saved in an ASCII-formatted file. The file simply collects the command-line options you want to use.

/LOCK

None

Halts your system completely when SCAN.EXE finds a virus.

/LOCK is appropriate in highly vulnerable network environments, such as open-use computer labs.

McAfee recommends that you use /LOCK with the /CONTACTFILE option to tell users what to do or whom to contact if VirusScan locks the system.

/MANALYZE

On-demand scanning only

Extended memory required

Sets the scanner’s heuristic scanning features to target macro viruses only.

/PANALYZE targets program viruses only.

/ANALYZE targets both program and macro viruses.

/MAXFILESIZE <xxx.x>

On-demand scanning only

Scans files no larger than <xxx.x> megabytes.

/MEMEXCL

On-demand scanning only

Not available for Windows

Excludes the memory address A000:0000 from scanning.

/MOVE <dir> or *.???

On-demand scanning only

/MOVE <directory>:

Moves all infected files that SCAN.EXE finds during a scan operation to the specified directory, preserving drive letter and directory structure.

This option has no effect if the Master Boot Record or boot sector is infected, since these are not actually files.

/MOVE*.???:

SCAN.EXE will change the extension of infected files, but not move them. For example, using the /MOVE*.BAD option tells the scanner to rename any infected files with the extension .BAD but not to move them to a different directory.

/NOBEEP

On-demand scanning only

Disables the tone that sounds whenever the scanner finds a virus.

/NOBREAK

On-demand scanning only

Disables CTRL-C and CTRL-BREAK during scans.

With this option active, you may not stop scan operations in progress.

/NOCOMP

On-demand scanning only

Extended memory required.

Tells SCAN.EXE not to check self-extracting compressed files created with the LZEXE or PKLite utilities.

This reduces scanning time when you do not need to run a full operation. Otherwise, by default, the scanner checks inside executable, or self-decompressing, files by decompressing each file in memory and checking for virus signatures.

/NODDA

On-demand scanning only

Prevents direct disk access. SCAN.EXE will not scan the boot record.

This feature has been added to allow the scanner to run under Windows NT Workstation v4.0 and Windows 2000 Professional.

You might need to use this option on some device-driven drives.

/NODELETE

On-demand scanning only

Prevents SCAN.EXE from deleting Trojan horse programs it finds. If you use it in conjunction with /DEL, SCAN.EXE still deletes virus-infected files.

/NODISK

On-access scanning only

Ignores the boot sector while the VShield scanner loads.

/NODOC

On-demand scanning only

Ignores Microsoft Office files.

/NOEMS

On-access scanning only

Prevents the VShield scanner from using extended memory (XMS).

/NOEXPIRE

On-demand scanning only

Disables the "expiration date" message that appears if your .DAT files are out of date.

/NOJOKES

None

Prevents SCAN.EXE from issuing an alert message when it finds virus joke or hoax files.

/NOMEM

None

Ignores computer RAM during scan operations.

This can risk infection from memory-resident viruses.

/NOREMOVE

On-access scanning only

Prevents users from removing the VShield scanner from memory with the /REMOVE switch

/NORENAME

On demand scanning only

Prevents SCAN.EXE from renaming files it cannot clean with a different extension.

/NOWARMBOOT

On-access scanning only

Ignores the disk boot sector of the floppy disk in drive A: during a warm boot (system reset or ctrl+alt+del).

/NOXMS

On-access scanning only

Does not use extended memory (XMS).

/ONLY <drive(s)>

On-access scanning only

Checks only files loaded from the specified drive(s).

/PANALYZE

On-demand scanning only

Extended memory required

Sets the VirusScan scanner to use program heuristics.

/MANALYZE targets macro viruses only;

/ANALYZE targets both program and macro viruses.

/PAUSE

On-demand scanning only

Enables screen pause.

The Press any key to continue prompt will appear when the scanner fills a screen with messages. Otherwise, by default, the scanner fills and scrolls a screen continuously without stopping, which allows it to run on PCs with multiple drives or that have severe infections, without needing your input.

McAfee recommends that you omit /PAUSE when you use the report options (/REPORT, /RPTCOR, and /RPTERR)

/PLAD

On-demand scanning only

Preserves the last access dates on Novell NetWare drives.

Normally, proprietary network drives update the last access date when the scanner opens and examines a file. However, some tape backup systems use this last access date to decide whether to back up the file. Use /PLAD to ensure that the last access date does not change as the result of your scan operation.

/RECONNECT

On-access scanning only

Restores the VShield scanner after it has been disabled by certain drivers or memory-resident programs.

/REMOVE

On-access scanning only

Unloads the VShield scanner from memory.

/REPORT <filename>

On-demand scanning only

Creates a report of infected files and system errors, and saves the data to <filename> in ASCII text file format.

If <filename> already exists, /REPORT will overwrite it. To avoid overwriting, use the /APPEND option with /REPORT: The scanner will instead add report information to the end of the file, instead of overwriting it.

You can also use /RPTALL, /RPTCOR, and /RPTERR to add scanned files, corrupted files, modified files, and system errors to the report.

You can include the destination drive and directory (such as D:\VSREPRT\ALL.TXT), but if the destination is a network drive, you must have rights to create and delete files on that drive.

McAfee recommends that you omit /PAUSE if you use any report option.

/RPTALL

On-demand scanning only

Includes the names of all files that SCAN.EXE examines in the /REPORT file.

When used with /REPORT, this option adds the names of corrupted files to the report file.

You can use /RPTCOR with /RPTERR on the same command line.

McAfee recommends that you omit /PAUSE if you use any report option.

/RPTCOR

On-demand scanning only

Includes the names of any corrupted files SCAN.EXE finds in the file you specify with /REPORT. Corrupted files might indicate virus damage.

You can use /RPTCOR with /RPTERR on the same command line.

There may be false readings in some files that require an overlay or another executable file to run properly—that is, files that do not execute on their own.

McAfee recommends that you omit /PAUSE if you use any report option.

/RPTERR

On-demand scanning only

Includes any error messages that SCAN.EXE generates during a scan operation in the file you specify with /REPORT.

Such errors can include problems reading or writing to a disk or hard disk, file system or network problems, problems creating reports, and other system-related problems.

McAfee recommends that you omit /PAUSE if you use any report option.

/SAVE

On-access scanning only

Saves the command-line options you chose for your on-access scan session to the VSHIELD.INI file.

/SILENT

On-demand scanning only

Disables all output to your screen during scan operations. McAfee recommends that you use this option with /REPORT to have some record of what the scan operation accomplished.

/SUB

On-demand scanning only

Scans subdirectories inside a directory.

  • By default, when you specify a directory to scan rather than a drive, the scanner will examine only the files it contains, not its subdirectories.

  • Use /SUB to scan all subdirectories within any directories you have specified. This option ignores files stored at the root level of the target directory.

  • You do not need to use /SUB if you scan an entire drive.

/TIMEOUT <seconds>

None

Sets a maximum time for the scanner to spend examining any one file. This option can prevent an arcane denial-of-service attack that ties up your scanner as it tries to uncompress and scan very large and recursive file archives.

/UNZIP

On-demand scanning only

Extended memory required

Scans inside compressed file archives.

/VIRLIST

On-demand scanning only

Displays the names of virus families that the scanner detects. This list does not include virus variants.

You may use the /PAUSE option on the same command line as /VIRLIST to read the virus list one screen at a time.

To redirect the /VIRLIST output to a text file:

At the command prompt, type

scan /VIRLIST

Because the scanner can detect many viruses, this file will be more than 250 pages long. This is too large for the MS-DOS Edit program to open; McAfee recommends that you use another text editor to open the virus list.

/XMSDATA

On-access scanning only

Loads VShield data files into XMS memory.


Error levels for the VirusScan Command Line scanner

When you run the VirusScan Command Line scanner, it returns an error level code when it completes its scan operation. You can use that code in batch files or in other applications to take different actions that depend on the results of your scan operation.

The VirusScan Command Line scanner can return these error level codes

Error Level | Description
0 | No errors occurred; the scanner found no viruses
1 | File access error. This could mean that your computer is using a system file or another file it refused to permit access to
2 | Data file integrity check failed
3 | Disk access error
4 | Error while reading output from AF
5 | Insufficient memory
6 | A general problem
7 | Error reading internal message MCAFEE.MSG
8 | Could not find a data file
9 | Incompatible options in command line
10 | The scanner found a virus in memory
11 | Internal program error
12 | Missing or corrupted CLEAN.DAT file
13 | The scanner found one or more viruses or hostile objects
14 | .DAT file out of date
15 | The scanner failed its self-check failed; it might be infected or damaged
16 | Drive or file access problem
17 | Scan target not specified
18 | Validated file modified
19 | One or more viruses found, all cleaned
20 | The /FREQUENCY command option prevented the scanner from proceeding
100 | A DOS problem occurred
102 | The user quit via the ESC-X, ^C or Exit key combinations. You can disable this capability by running the scanner with the /NOBREAK command-line option.


Understanding computer viruses

The term "computer virus" identifies a broad range of software that really has only one feature in common: it "reproduces" itself automatically by attaching to host software or disk sectors on your computer, usually without your knowledge. Viruses range widely in their effects, but most viruses cause relatively trivial problems, from the merely annoying to the downright insignificant. Often, the primary consequence of a virus infection is the cost you incur in time and effort to track down the source of the infection and eradicate all of its traces.

Broadly speaking, viruses fall into two general categories: "boot sector" and "file-infecting" viruses. Boot viruses dwell in the boot sector of the hard or floppy disk that carries them. These execute as your computer starts or whenever your computer reads information from an infected floppy disk. Once they copy themselves into your computer’s memory, they can then spread to other disks or other computers on a network, each time leaving copies of themselves that can repeat the cycle.

File-infecting viruses become active only when you execute the program that carries them or, in the case of macro and script viruses, when a program opens a data file that carries them. Typically, such viruses infect files with extensions such as .EXE, .COM, or .DLL, and non-executable files such as Microsoft Word .DOC files or Excel .XLS data and template files. A huge increase in the variety and scope of new viruses over the last few years, however, has expanded this list to cover nearly any type of file—even some plain text files in certain circumstances. Once it executes, the file virus also loads itself into your computer’s memory, replicates, then attaches itself to other executable programs.

In recent years, the line between these two divisions has blurred considerably. Many viruses combine both file-infecting and boot sector infecting features. These often use a variety of tricks and techniques to conceal themselves from anti-virus software. Newer virus types rely partly on unorthodox methods, including user psychology, to help them spread quickly and widely, while some have elements that classify them not as viruses, but under a more general heading of "malicious software" or "hostile code."

Examples of the latter include software that anti-virus researchers classify as "worms" or Trojan horse programs. These agents, because they do not technically reproduce, are not viruses. But they can often have equally harmful effects and spread just as fast, if not faster, than "ordinary" computer viruses. Other agents have worm-like or Trojan-like characteristics, but come in the form of Java applets or ActiveX controls.

McAfee anti-virus software detects these and other forms of malicious software, all at the same time, to provide you with complete protection against harmful software agents.

Click the following terms to learn more about the range of malicious software:

  • ActiveX controls and Java classes

  • Boot sector virus

  • File-infecting virus

  • Macro virus

  • Multi-partite virus

  • Script virus

  • Trojan horse program

  • Worm

Click the following items to learn more about the concealment techniques viruses use to evade detection:

  • Encrypted code signatures

  • Mutating code signatures

  • Polymorphic code signatures

  • Stealth techniques


Why Scan for Viruses?

Not so long ago, individual computer users could avoid virus infections without much thought or planning, simply because they rarely contacted likely virus sources. Today, however, most computer users send messages to each other, share data and transfer files constantly—whether through a modem, via diskettes, or over networks and the Internet. In this same span of time, viruses have come to number in the thousands and now spread more quickly and easily than ever.

In this environment, taking steps to protect yourself from a computer virus infection is no longer a luxury but a necessity. Consider the value of the data on your computer. It would probably require a significant investment of time and money to replace if it became corrupted or unusable because of a viral infection—it may even be irreplaceable. But whether your own data is important to you or not, neglecting to guard against viruses may mean that your computer could play unwitting host to a virus that can spread and attack the data on computers your co-workers and colleagues use.

Scheduling periodic virus scans with VirusScan anti-virus software and other McAfee virus-scanning solutions significantly reduces your vulnerability to infection and prevents unnecessary loss of time, money and data.


Why Scan for ActiveX Controls and Java Classes?

Both ActiveX and Java include safeguards designed to prevent harm to your computer system. Nevertheless, determined programmers have developed Java or ActiveX objects that can read data on your hard disk; pass it back to web sites you visit; compose and send offensive e-mail in your name; corrupt or destroy your data; or cause other damage to your system.

Dangerous objects such as these can often lurk on web sites until you visit and download them to your system, usually without realizing that they exist. Most browser software includes a feature that allows you to block ActiveX controls or Java applets altogether; or to turn on security features that authenticate objects before downloading them to your system. But these approaches can deprive you of the interactive benefits of web sites you visit by indiscriminately blocking all objects, dangerous or not.

McAfee VirusScan software allows a more judicious approach. It uses an up-to-date database of objects that McAfee researchers know can cause harm to screen ActiveX controls and Java classes you encounter as you browse. Potentially harmful objects stay where they are, away from your system, while other objects continue to function.


Common vulnerable file name extensions

VirusScan software initially looks for viruses only in files that are susceptible to infection. It uses a list of file name extensions to keep track of vulnerable files. This list appears in the Program Extensions dialog box, and is something you can edit to suit your own needs. In this list, ? symbols represent wild cards—VirusScan software substitutes any character for the ? so that it scans more than one file type with similar extensions. For example, the software will use the .XL? wild card to look for viruses in Microsoft Excel spreadsheet (.XLS) and template (.XLT) files.

McAfee recommends that you scan your system thoroughly during your first scan operation, or periodically thereafter, without limiting the scope of the scan operation to these file types. This ensures that your system starts in a virus-free condition. You can then use this list of extensions to limit the scope of later scan operations.

    Extension | File Type | File description
<BLANK> | Any | Files with no extension.
.??_ | Compressed | Windows compressed files.
.ARC | Archive | LH ARC files, older version.
.ARJ | Archive | Robert Jung .ARJ compressed archive files.
.ASP | Macro/script | Microsoft Active Server Pages files. These files contain script commands for use with Internet Information Server.
.BAT | Program | DOS batch files.
.CAB | Compressed | Windows Compressed Application Binary or "cabinet" files.
.CDR | Macro | Corel Draw document files. Later versions of Corel Draw include a scripting language that can generate macro viruses.
.CLA | Program | Java class files (truncated from .CLASS).
.COM | Program | Command/binary image files. These common files run as infectable executable programs. DOS and Windows system files frequently make use of this extension.
.CSC | Script/macro | Corel script files. Script files can include viruses or generate macro viruses.
.DL? | Program | Dynamic Link Library file; C++ dialog script files. Dynamic Link Library files are resource files linked to executable program files. Executable files can load viruses stored in them and run them as part of their native code.
.DOC | Macro | Microsoft Word document files. These files can contain Word Basic macros and, therefore, macro viruses.
.DOT | Macro | Microsoft Word document template files. These files can contain Word Basic macros and macro viruses.
.EXE | Program | Executable files. Most software uses this extension to identify files that start their command shell or program kernel.
.GMS | Macro | Corel Global Macro Storage files.
.GZ? | Compressed | UNIX GNU Gzip compressed files.
.HLP | Macro | Windows Help files. These files can contain executable Word Basic or other macrocode.
.HT? | Script/macro | Hyper Text Markup Language and related files; Microsoft Hyper Text template files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ICE | Compressed | ICE compressed files.
.IM? | Program | Image files for creating disk images.
.INI | Program | Windows initialization files. Although these are generally text files, infected .INI files can cause mIRC clients to perform unwanted actions.
.JS? | Script | JavaScript source files. JavaScript files can contain virus code that acts directly on web browsers.
.LZH | Compressed | LHARC compressed files.
.MD? | Macro | Microsoft Access database, add-in, and related files. These files can contain infectable Visual Basic for Applications macros.
.MPP | Macro | Microsoft Project files. These files can contain infectable Visual Basic for Applications macros.
.MPT | Macro | Microsoft Project template files. These files can contain infectable Visual Basic for Applications macros.
.MSG | Macro | Microsoft Mail, Exchange and Outlook message files. These files can contain script commands that can introduce virus infections.
.MSO | Macro | Microsoft Office 2000 files.
.OCX | Program | Microsoft Object Linking and Embedding custom controls. These files are similar to ActiveX controls and can function as harmful software in their own right.
.OLE | Program | Object Linking and Embedding object files. These files are similar to ActiveX controls. They are files created in one application to be embedded into files created by another application
.OV? | Program | Overlay files.
.POT | Macro | Microsoft PowerPoint template files. These files can contain infectable Visual Basic for Applications macros.
.PP? | Macro | Microsoft Powerpoint document and slide show files. These files can contain infectable Visual Basic for Applications macros.
.RAR | Archive | RAR compressed archives.
.RTF | Macro | Rich Text Format files. These files serve as a common text file format for many document files.
.SCR | Program | Windows screen saver files.
.SHS | Program | Windows shell script (scrap object) files. These files can introduce commands that cause unwanted behavior on the host computer.
.SMM | Macro | Lotus AmiPro spreadsheet files. These files include macro capabilities.
.SYS | Program | DOS or Windows system files and device drivers. These executable files frequently start along with or as part of program execution.
.TAR | Archive | UNIX tape archive files.
.VBS | Script | Visual Basic script files and VBScript files. VBScript is an implementation of Microsoft’s Visual Basic programming language. It powers special features on many web pages, and can directly manipulate many functions inside Microsoft Outlook and other software.
.VS? | Macro | Visio drawing and related files. Later Visio versions include infectable scripting extensions.
.VXD | Program | Windows virtual device drivers. These executable files often reside in memory.
.WBK | Macro | Microsoft Word backup files.
.WPD | Macro | Corel WordPerfect document files.
.XL? | Macro | Microsoft Excel worksheet, add-in, toolbar, chart, dialog box, backup, macro, workspace, Visual Basic module, and template files. These files can contain infectable Visual Basic for Applications macros.
.XML | Script/macro | Extensible Markup Language files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ZIP | Archive | WinZip and PKZip compressed archive files.

TIP: To generate a complete list of current vulnerable file name extensions, do the following:

From the DOS prompt (Windows 98 and Windows Me) or the Command prompt (Windows 2000 and Windows XP) enter the following:

C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.xx\scan.exe/extlist and press Enter.

The current list displays.


Current list of compressed files scanned

The VirusScan application and the VShield scanner look for viruses in a range of compressed and archived file formats. Each component uses slightly different technologies for this purpose, however, and therefore treats each file type differently.

For the purpose of this discussion, a "compressed" file means a single file. Compression utilities such as PKLite, LZEXE, and others combine or discard redundant data within these files to reduce their size. An "archived" file means a file that acts as a "wrapper" or an envelope that contains other files within itself. The files within the wrapper can be compressed or uncompressed. Examples of such files include WinZip files, .TAR files, and .ARC files. Most WinZip files compress other files and wrap them in a single archive.

This table summarizes how each VirusScan component treats each file type:

VirusScan component

Archived file

Compressed file

VirusScan application

  • Select the Compressed files checkbox to enable.

  • Opens archives and scans the files within.

  • Specify All Files as your scan target or add the archive’s file name extension to the Program Extensions dialog box to have the application scan the archive as a file.

  • Select the Compressed Files checkbox to enable.

  • Scans the compressed file if you specify All Files as your scan target or add the compressed file’s extension to the Program Extensions dialog box.

VShield scanner

  • The scanner will not open the archive to scan the files within.

  • Specify All Files as your scan target or add the archive’s file name extension to the Program Extensions dialog box, to have the scanner examine the archive as a file.

  • Select the Compressed Files checkbox to enable.

  • Specify All Files as your scan target, or add the compressed file’s extension to the Program Extensions dialog box, to have the scanner look for viruses in the compressed file.

Both VirusScan components include built-in support for a number of compressed and archived file formats. The table below lists each format and describes how each component scans it when you select the Compressed Files checkbox. You may not edit or add items to this list.

Format

Description

VirusScan application support?

VShield scanner support?

.??_

Windows compressed file

  • Scans compressed file if listed in Program Extensions dialog box

  • Scans compressed file if listed in Program Extensions dialog box

.GZ?

UNIX GNU Gzip compressed file

  • Scans compressed file if listed in Program Extensions dialog box

  • Scans compressed file if listed in the Program Extensions dialog box

.TD0

Teledisk compressed file

  • Scans compressed file if listed in Program Extensions dialog box

  • Scans compressed file if listed in Program Extensions dialog box

.ARC

LH ARC file, older version

  • Scans archive

  • Scans files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan files within archive

.ARJ

Robert Jung ARJ compressed file

  • Scans archive

  • Scans compressed files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan compressed files within archive

.CAB

Windows Compressed Application Binary or "cabinet" file

  • Scans archive

  • Scans compressed files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan compressed files within archive

.ICE

ICE compressed file

  • Scans compressed file if listed in Program Extensions dialog box

  • Scans compressed file if listed in the Program Extensions dialog box

.LZH

LHARC compressed file

  • Scans compressed file if listed in Program Extensions dialog box

  • Scans compressed file if listed in Program Extensions dialog box

.RAR

RAR compressed archive

  • Scans archive

  • Scans files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan files within archive

.TAR

UNIX tape archive file

  • Scans archive

  • Scans files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan files within archive

.ZIP

PKZip or WinZip file

  • Scans archive

  • Scans compressed files within archive

  • Scans archive as a file if listed in the Program Extensions dialog box

  • Will not scan compressed files within archive


Adding and removing program extensions

Because viruses ordinarily cannot infect files that contain no executable code, you can have VirusScan software look for them only in files that are susceptible to infection. The software identifies vulnerable files by their extensions, a list of which it keeps in the Program File Extensions dialog box.

Because new viruses continuously find new ways to infect program and data files, this list has grown substantially for this VirusScan release. To see the current list, click here:

To change the extensions shown here, you can:

  • Click Add to include a new extension.

This opens the Add Program File Extension dialog box. Type the three-character extension you want to add in the text box provided. Do not include the dot that normally precedes a file name extension. Next, click OK to return to the Program File Extensions dialog box.

You can add as many unique extensions as you want.

  • Select one of the extensions shown, then click Edit to change its definition.

  • Select one of the extensions shown, then click Remove to delete it from the list.

  • Click Default to restore the original extension entries. This removes any extensions you have added to the list.

When you have finished changing the list, click OK to save your changes and close the dialog box. Click Cancel to close the dialog box without saving your changes.


Connecting to the AVERT anti-virus research site

To keep up with new virus strains and new security threats, McAfee maintains the Anti-Virus Emergency Response Team (AVERT), the world’s premier anti-virus research organization. With a worldwide reach and "follow the sun" coverage policy, McAfee anti-virus researchers can provide leading-edge anti-virus security solutions for your McAfee anti-virus product.

You can take advantage of many of the direct products of this research by visiting the AVERT research site on the Network Associates web site. Click this link to connect directly to the AVERT home page:

http://vil.nai.com

There, you’ll find:

  • Current information and risk assessments on emerging and active virus threats

  • Software tools you can use to extend or supplement your McAfee anti-virus software

  • Contact addresses and other information for submitting questions, virus samples, and other data

  • A complete online virus information library—with complete virus descriptions, prevalence tables, technical documents and white papers. This site lists the most prevalent or riskiest viruses, provides a search engine you can use to search for particular virus descriptions alphabetically, by virus name, and gives you access to technical data you can use to remove viruses from your system. To connect directly to this site, click this link:

  • Virus definition updates—this includes daily beta .DAT file updates, EXTRA.DAT files, current scan engine versions, regular weekly .DAT and SuperDAT updates, and new incremental virus definition files (.UPD)

  • Beta and "first look" software


webimmune

How to submit a file to AVERT's WebImmune research site

AVERT (Anti Virus Emergency Response Team) WebImmune the worlds first Internet virus security scanner that resides on the web. It delivers real-time solutions and answers, and is available 24x7/365 with information and fixes for file submissions that are infected. With WebImmune, the user can submit potentially infected files to AVERT for a complete analysis of the file.

To access the AVERT WebImmune site, click here: http://www.webimmune.net.

NOTE: This is an English language Web site.

Registered Users

  1. Type your e-mail address and password in the appropriate text boxes.

  2. Click Enter.

New Users

To submit a file for research, you must be a registered user. If you are a new user, do the following:

  1. Click New Users Login

  2. Enter the following information:

    • Your first and last name

    • A valid e-mail address

    • Country of residence

    • Password

  3. Click Submit

After you create an account, WebImmune displays a record of your previous scans. Click Analysis ID to view the status (or results) of a previous scan.

To scan a new file

  1. Click Scan New File.

  2. Click Browse to locate the suspect file.

NOTE: If you quarantined the suspect file, browse to C:\Program Files\McAfee\McAfee VirusScan\QUARANT to locate the file.

  3. Complete the questionnaire.

  4. Click Scan.


Anti-Virus Tips

Virus Detection and Prevention Tips

  1. Update your anti-virus software regularly. Over 500 viruses are discovered each month, so you'll want to be protected. These updates should be at the least the products virus signature files. You may also need to update the product's scanning engine as well.

  2. Do not open any files attached to an e-mail message from an unknown, suspicious or untrustworthy source.

  3. Do not open any files attached to an e-mail message unless you know what it is, even if it appears to come from a dear friend or someone you know. Some viruses can replicate themselves and spread through e-mail messages. Better be safe than sorry and confirm that they really sent it.

  4. Do not open any files attached to an e-mail message if the subject line is questionable or unexpected. If the need to do so is there always save the file to your hard drive before doing so.

  5. Delete chain e-mail messages and junk e-mail. Do not forward or reply to any to them. These types of e-mail messages are considered spam, which is unsolicited, intrusive mail that clogs up the network.

  6. Do not download any files from strangers.

  7. Exercise caution when downloading files from the Internet. Ensure that the source is a legitimate and reputable one. Verify that an anti-virus program checks the files on the download site. If you're uncertain, don't download the file at all or download the file to a floppy and test it with your own anti-virus software.

  8. Back up your files on a regular basis. If a virus destroys your files, at least you can replace them with your back-up copy. You should store your backup copy in a separate location from your work files, one that is preferably not on your computer.

  9. When in doubt, always err on the side of caution and do not open, download, or execute any files or e-mail message attachments. Not executing is the more important of these caveats. Check with your product vendors for updates which include those for your operating system web browser, and email . One example is the security site section of Microsoft located at http://www.microsoft.com/security.

  10. If you are not sure about a potential virus related situation, please visit AVERT on the web for more information.


Updating VirusScan Data Files

Updating VirusScan DAT Files

More than 200 new viruses appear each month, as well as harmful ActiveX controls and Java classes. Often, these new viruses and objects cannot be detected by older data files. Network Associates virus researchers are working constantly to update the data files with the most current virus definitions. New data files, or .DAT files, are constantly updated - frequently as often as once per week. You will be notified periodically that it is time to update your data files. For maximum protection, you should update VirusScan .DAT files on a regular basis.

This product includes twelve (12) months of free virus protection updates obtained using Instant Updater. Renewal subscriptions are available at a cost of $14.95 US** or 15,00 EUR** per year. Eleven months after registering your McAfee product, Instant Updater will prompt you to renew your virus protection subscription. You must renew your subscription in order to update your virus protection. Your product will continue to function if you do not renew your subscription.

** Please note: Prices are subject to change without notice.

To update all of your virus protection, select Check for a VirusScan update from the Task list on the VirusScan Home page. This update procedure also includes the option to download any available updates on McAfee VirusScan software installed on your computer.


Customer Service

McAfee is famous for its dedication to customer satisfaction. We have continued this tradition by making our site on the World Wide Web a valuable resource for answers to your questions about McAfee Consumer Products. We encourage you to visit us at McAfee-at-Home.com and make this your first stop for all of your product support needs.

For a complete list of customer support telephone numbers and addresses, please refer to your Product Guide.


Technical Support

For agent assisted technical support, please visit http://www.mcafeehelp.com. Our support web site offers 24-hour access to solutions to the most common support requests in our easy-to-use 3 step Answer Wizard. Additionally, you may use our advanced options, which include a Keyword Search and our Help Tree, which have been designed with the more knowledgeable user in mind. If a solution to your problem cannot be found, you may also access our 24-hour FREE Chat Now! and Email Express! options. Chat and E-mail will enable you to quickly reach our qualified support engineers, through the internet, at no cost. Phone support information can also be obtained from our self-help web site at www.McAfeeHelp.com.


Copyright

© 2002 Networks Associates Technology, Inc. and its Affiliated Companies. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Network Associates, Inc.

TRADEMARK ATTRIBUTION:

ACTIVE SECURITY, ACTIVE SECURITY (IN KATAKANA), ACTIVEHELP, ACTIVESHIELD, ANTIVIRUS ANYWARE AND DESIGN, BOMB SHELTER, CERTIFIED NETWORK EXPERT, CLEAN-UP, CLEANUP WIZARD, CNX, CNX CERTIFICATION CERTIFIED NETWORK EXPERT AND DESIGN, CYBERCOP, CYBERCOP (IN KATAKANA), CYBERMEDIA, CYBERMEDIA UNINSTALLER, DESIGN (STYLIZED N), DISK MINDER, DISTRIBUTED SNIFFER SYSTEM, DISTRIBUTED SNIFFER SYSTEM (IN KATAKANA), DR SOLOMON’S, DR SOLOMON’S LABEL, ENTERPRISE SECURECAST, ENTERPRISE SECURECAST (IN KATAKANA), EZ SETUP, FIRST AID, FORCEFIELD, GMT, GROUPSHIELD, GROUPSHIELD (IN KATAKANA), GUARD DOG, HELPDESK, HOMEGUARD, HUNTER, ISDN TEL/SCOPE, LANGURU, LANGURU (IN KATAKANA), M AND DESIGN, MAGIC SOLUTIONS, MAGIC SOLUTIONS (IN KATAKANA), MAGIC UNIVERSITY, MAGICSPY, MAGICTREE, MCAFEE, MCAFEE (IN KATAKANA), MCAFEE AND DESIGN, MULTIMEDIA CLOAKING, NET TOOLS, NET TOOLS (IN KATAKANA), NETCRYPTO, NETOCTUPUS, NETSCAN, NETSHIELD, NETSTALKER, NETWORK ASSOCIATES, NETXRAY, NOTESGUARD, NUTS & BOLTS, OIL CHANGE, PC MEDIC, PC MEDIC 97, PCNOTARY, PGP, PGP (PRETTY GOOD PRIVACY), PRETTY GOOD PRIVACY, PRIMESUPPORT, RECOVERKEY, RECOVERKEY - INTERNATIONAL, REGISTRY WIZARD, REPORTMAGIC, RINGFENCE, ROUTER PM, SALESMAGIC, SECURECAST, SERVICE LEVEL MANAGER, SERVICEMAGIC, SMARTDESK, SNIFFER, SNIFFER (IN HANGUL), SNIFFMASTER, SNIFFMASTER (IN HANGUL), SNIFFMASTER (IN KATAKANA), SNIFFNET, STALKER, SUPPORTMAGIC, TIS, TMEG, TNV, TVD, TNS, TOTAL NETWORK SECURITY, TOTAL NETWORK VISIBILITY, TOTAL NETWORK VISIBILITY (IN KATAKANA), TOTAL SERVICE DESK, TOTAL VIRUS DEFENSE, TRUSTED MAIL, UNINSTALLER, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, WEBSCAN, WEBSHIELD, WEBSHIELD (IN KATAKANA), WEBSNIFFER, WEBSTALKER, WEBWALL, WHO’S WATCHING YOUR NETWORK, WINGAUGE, YOUR E-BUSINESS DEFENDER, ZAC 2000, ZIP MANAGER are registered trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. © 2002 Networks Associates Technology, Inc. All Rights Reserved.


To customize the Help Viewer

  • There are a few ways to easily change the size and position of the Help Viewer and the panes in the viewer:

  • To resize the Navigation or Topic pane, point to the divider between the two panes. When the pointer changes to a double-headed arrow, drag the divider right or left.

  • To proportionately shrink or enlarge the whole Help Viewer, point to any corner of the Help Viewer. When the pointer changes to a double-headed arrow, drag the corner.

  • To change the height or width of the Help Viewer, point to the top, bottom, left, or right edge of the Help Viewer. When the pointer changes to a double-headed arrow, drag the edge.

  • To reposition the Help Viewer on your screen, click the title bar and drag the Viewer to a new position.

Note: The Help Viewer will appear with the last size and position settings you specified when it is opened again.


To hide or show the Navigation pane

On the toolbar, click Hide or Show to close or display the Navigation pane, which contains the Contents, Index, and Search tabs.

Note: If you close the Help Viewer with the Navigation pane hidden, it will appear that way when you open the Help Viewer again.


To find a help topic

In the Navigation pane, click one of the following tabs:

  • To browse through a table of contents, click the Contents tab. The table of contents is an expandable list of important topics.

  • To see a list of index entries, click the Index tab, and then type a word or scroll through the list. Topics are often indexed under more than one entry.

  • To locate every occurrence of a word or phrase that may be contained in a help file, click the Search tab, and then type the word.

Note: Click the contents entry, index entry, or search results entry to display the corresponding topic.


To find topics using the toolbar buttons

There are five navigational buttons that can be located on the toolbar in the Help Viewer. You can click these buttons to find help topics:

  • Hide/Show alternately hides and shows the Contents pane.

  • Locate synchronizes the contents pane with the currently displayed topic.

  • Back displays the last topic you viewed.

  • Forward displays the next topic in a previously displayed sequence of topics.

  • Print prints the topic displayed in the right pane.

Note: The toolbar in your Help Viewer may not contain all of these navigational buttons.


To use full-text search

  1. Click the Search tab, and then type the word or phrase you want to find.

  2. Click List Topics, select the topic you want, and then click Display.


Getting more out of help

Here are some tips on how to find more information when using the HTML Help Viewer:

  • To link to another topic, a Web page, a list of other topics, or a program, click the colored, underlined words.

  • To view topics that contain related information, click the words, "Related Topics," which may appear at the end of a topic, and then click the title of the topic you want.

  • To see if a word or phrase contained in a topic is in the index, select the word, and then press F1.

  • If you are viewing content from the Web in the Topic pane, you can click Stop or Refresh on the toolbar to interrupt a download or refresh a Web page.


Glossary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

A

Access (to a disk or file)

ActiveX controls and Java classes

Action property page

Alert property page

B

Boot sector

Boot sector virus

C

Code signature

D

.DAT files

Detection property page

E

E-mail client application

E-mail scanner

Encrypted code signatures

Exclusion property page

F

File-infecting virus

G

H

Heuristic scanning

I

Inbound files

Internet Protocol (IP) address

J

Java Classes and ActiveX Controls

K

L

M

Macro virus

Multi-partite virus

Mutating code signatures

N

New Scan button

O

.OCX

On-access scan operation

On-demand scan operation

Outbound files

P

Polymorphic code signatures

Q

R

Report property page

S

Scan session

SCANEMAL.DLL

Script virus

Stealth concealment techniques

System scanner

T

Trojan horse program

U

Uniform Resource Locator

V

.VSC file

VSCONFIG.EXE

W

What's This help

Worm

XYZ


.topic 789
Check this check box to enable VirusScan to scan Microsoft Word, Excel, and PowerPoint documents as you open them.

.topic 0x6d
Enter the path to cc:Mail.

.topic 0x7d
Click this button to stop scanning without taking any action now.

.topic 0x7f
Click this button to delete the detected file.

.topic 0x80
Click this button to move a detected file to a quarantine location designated on the Action property page.

.topic 0x86
Displays the number of bytes occupied by the virus.

.topic 0x8b
Click this button to attempt to clean the virus.

.topic 0xae
Select this checkbox to have the VirusScan application offer you the option to clean any detected items.  When a detection occurs, it will display an alert message. Selecting the Clean file checkbox here causes a Clean button to appear in that message.

.topic 0xb0
Select this checkbox to have the VirusScan application offer you the option to exclude any detected item from the scan operation.  When a detection occurs, it will display an alert message. Selecting the Exclude item checkbox here causes an Exclude button to appear in that message.

.topic 0xc0
Select this checkbox to have the VSCLOG.TXT summarize the actions that the VirusScan application took during each scan operation. The log will record: How many files the application examined. How many detected files the application cleaned. How many detected files the application deleted. How many detected files the application moved to a quarantine folder. Your application settings. The VSCLOG.TXT file records this information when the task finishes. Clear the checkbox to leave this information out of the log file.

.topic 0xd3
Click this button to display the online help topic that discusses this dialog box.

.topic 0xe7
Enter your new password in the text box provided. You may enter a maximum of 20 characters of any type. Be sure to choose a password you will remember.

.topic 0xee
Click this button to configure the properties for this task. This opens the VShield Properties dialog box. Here, you can tell the VShield application where and what to look for as it scans your hard disk, your e-mail and any Internet sites you visit, how to respond to any viruses or malicious software objects it finds, how to notify you when it finds a harmful object, what information to record in its activity log, what items to exclude as it scans, and whether to protect the configuration options you set for the task.

.topic 0xf2
Select this checkbox to run your task exactly once on the date and at the time you specify. Enter the time in the leftmost text box in the Start At area, then select a month from the list to the right. Next, enter the date and the year, in the text boxes provided. To have the task run at a random point within an interval of time you set, click the Enable randomization checkbox. Next, enter a time "window" of up to 480 minutes within which you want the task to run. The window sets a time frame centered on the point at which you’ve scheduled the task to run. The window "opens" before the scheduled time and "closes" after the scheduled time. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30.

.topic 0xf6
Select this checkbox to run your task once each hour as long as your computer is on and the Console is running. Specify in the text box provided in the Start At area how many minutes the Console should wait after each hour to run your task. To have the task run at a random point within an interval of time you set, click the Enable randomization checkbox. Next, enter a time "window" within which you want the task to run. The window sets a time frame centered on the point at which you’ve scheduled the task to run. For hourly tasks, you may set a window of up to 60 minutes only. The window will "open" up to 30 minutes before the scheduled time and "close" up to 30 minutes after the scheduled time.

.topic 0xfc
Select this checkbox to have this task run each Wednesday at the time you set.

.topic 0x10a
This item tells you how many detected items the scan operation moved to a quarantine folder as of the moment you opened the Task Properties dialog box.

.topic 0x116
This item tells you how many detected items the System Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x14d
Click this button to choose a scan target from the list provided. Next, click  to choose your specific scan target. You can have the VirusScan application look for viruses in these targets: My Computer. This tells the application to look for viruses on all mounted or mapped hard disks and removable media. To see the specific targets the application will scan, double-click your My Computer icon. All removable media. This tells the application to look for viruses on floppy disks, CD-ROMs, and other removable media. All fixed disks. This tells the application to look for viruses on all local hard disks. All network drives. This tells the application to look for viruses on all mapped hard disks or other network disks.

.topic 0x153
Click this button to open a dialog box where you can specify a new program extension for the VirusScan application to scan. The Add Program File Extension dialog box will appear.

.topic 0x194
Click this button to run the AutoUpgrade task immediately, with the current task settings. If you have more than one download site defined in the list to the left, the task will try each in turn until it successfully downloads new files or determines that no new files exist.

.topic 0x1a1
Select this checkbox to have the AutoUpgrade utility log on to the FTP site that holds new program files with the user name anonymous and an unspecific password. To use this option, the FTP site must be set to accept anonymous FTP logins. To use a specific account to log on to the FTP site, clear this checkbox, then click FTP login information to enter a user name and password for an account that exists on the site. If your network uses a proxy server to filter FTP connections, select the Use Proxy Server checkbox, then enter the server name and the port it uses in the checkboxes provided.

.topic 0x1b8
Select a site shown in the list to the left, then click this button to move the site lower in the list. The AutoUpdate utility tries to download new files from each site in turn, starting from the top of the list. Moving a site down decreases its priority for the task.

.topic 0x1c3
Clear the Use anonymous FTP login checkbox, then click this button to enter a user name and password that the AutoUpdate utility can use to log on to the FTP site that holds the new .DAT files you want to download. If your network uses a proxy server to filter FTP connections, select the Use Proxy Server checkbox, then enter the server name and the port it uses in the checkboxes provided. Note: The AutoUpdate utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1e4
This item tells you how many detected files the Download Scan module has found during the current scan operation. If the module is not active at the moment, this item tells you how many detected files the module found during its most recent scan operation.

.topic 0x1e6
This item tells you how many detected files the Download Scan module has moved to a quarantine folder during the current scan operation. If the module is not active at the moment, this item tells you how many detected files the module moved to a quarantine folder during its most recent scan operation.

.topic 0x20e
Enter a location into which the E-Mail Scan extension will move any detected files. By default, the E-Mail Scan extension sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x215
Select this checkbox to have the E-Mail Scan extension add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the extension will simultaneously beep as it displays the alert box.

.topic 0x268
Click the arrows to enter the number of seconds the E-Mail Scan module should wait before it checks your cc:Mail

.topic 0x277
Select this checkbox to have the Internet Filter module block your browser software from visiting Internet sites that you designate with an IP address. Click Configure to see or edit the current list of dangerous IP addresses.

.topic 0x284
Select either of the buttons below to specify the type of alert message you want the System Scan to display when it finds a virus. Click the BIOS button to see a full-screen text-mode alert message that offers you a range of response options, including the option to continue without any action against the virus. This mode also brings your system to a complete halt until you choose a response option. Click the GUI button to see a standard graphical alert message that also offers range of response options. This range will not include Continue access. As this prompt awaits your choice, your system will continue with normal operations in the background.

.topic 0x287
Choose an item from this list to specify what you want the E-Mail Scan module to do when it detects a virus. When you choose an item, the area beneath the list will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the E-Mail Scan module to prompt you with a message, a beep, or both.

.topic 0x290
Choose an action from the When a virus is found list to specify what you want the Download Scan module to do when it finds a virus. When you choose an action, this area will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the Download Scan module to prompt you with a message, a beep, or both.

.topic 0x297
Choose an action from the When a potentially harmful object is found list to specify what you want the Internet Filter module to do when it finds a virus. When you choose an action, you’ll see a description here that explains what that action does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the Internet Filter module to prompt you with a message, a beep, or both.

.topic 0x29c
Select this checkbox to have the E-Mail Scan module notify you that it has found a virus. You can have it display a message or play an audible alert tone.

.topic 0x2f2
Click this button to see an online help topic that discusses this dialog box.

.topic 791
Using HAWK's constant monitoring to detect actions that are often included in script-based viruses, Script Stopper alerts you of the attempted activity and will stop the actions that are initiated on your computer without your knowledge. Script Stopper detects, alerts, and blocks malicious script actions to keep your computer safe from script-initiated threats.

.topic 0x77
VirusScan selects this box if the detected file is an archive file. See your operating system documentation for definitions of file attributes.

.topic 0xbc
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application cleans during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xce
Enter a unique password in the text box provided. You may enter a maximum of

.topic 0xe1
Click this button to run this task immediately. The task will run with default configuration options or the configuration options you’ve defined for it. Here’s what happens when you click the button: If you chose a scan task that you have set to start automatically, the task will run immediately. For this to happen, you must have previously selected the Start Automatically checkbox in the VirusScan Properties dialog box. To see this checkbox, click Configure, immediately to the left, then locate the checkbox in the What to Scan area in the Detection property page. If you chose a scan task that you have not set to start automatically, the VirusScan application window appears. Click Scan for Viruses Now in this window to run the task.

.topic 0xe5
Select this checkbox to protect all of the options you set for this task. Doing so locks all of the property pages for this task at once in the Security property page. Clearing this checkbox allows you to click the Security tab, then choose individual property pages that you want to protect.

.topic 0xf5
Select this checkbox to run your task once each week on the day and at the time you specify. Enter the time in the text box provided in the Start At area, then choose a day from the list to the right. To have the task run at a random point within an interval of time you set, click the Enable randomization checkbox. Next, enter a time "window" of up to 480 minutes within which you want the task to run. The window sets a time frame centered on the point at which you’ve scheduled the task to run. The window "opens" before the scheduled time and "closes" after the scheduled time. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30.

.topic 0xfb
Select this checkbox to have this task run each Tuesday at the time you set.

.topic 0xfd
Select this checkbox to have this task run each Thursday at the time you set.

.topic 0x121
This line tells you how many detected items the E-Mail Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x128
This item tells you how many detected items the Download Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13d
This item tells you how many hostile ActiveX controls the VShield Internet Filter module kept away from your computer as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x14e
Click to choose your scan target from this list. You can have the VirusScan application look for viruses in these targets: My Computer. This tells the application to look for viruses on all mounted or mapped hard disks and removable media. To see the specific targets the application will scan, double-click your My Computer icon. All removable media. This tells the application to look for viruses on floppy disks, CD-ROMs, and other removable media. All fixed disks. This tells the application to look for viruses on all local hard disks. All network drives. This tells the application to look for viruses on all mapped hard disks or other network disks.

.topic 0x165
Select this checkbox to have the VirusScan application offer you the option to ignore any of the detected items and continue the scan operation. When the application detects a virus, it will display an alert message. Selecting the Continue scan checkbox here causes a Continue button to appear in that message.

.topic 0x18e
This list shows the upgrade sites you have designated for this task and reports their current status as Enabled or Disabled. You have enabled a site if you have selected the Enabled checkbox in the Automatic Upgrade Properties dialog box. You have disabled a site if you clear this checkbox. This designation does not change whether or not the AutoUpgrade utility can connect with the site. The AutoUpgrade utility can download new program files from any network share or FTP site that you specify. You can designate several sites from which the task can attempt to download new files. The task will try each site in turn, starting from the top of the list, until it successfully downloads new files or determines that no new files exist. To change the contents of this list, you can: Click Add. This opens the Automatic Upgrade Properties dialog box, where you can configure an entirely new site definition and properties. Select one of the listed sites, then click Edit to change any of the site properties. Select one of the listed sites, then click Delete to remove it from the list. Select one of the listed sites, then click Move Up to tell AutoUpgrade to try to download files from this site earlier. Select one of the listed sites, then click Move Down to tell AutoUpgrade to try to download files from this site later. To start the AutoUpgrade task immediately, click Upgrade Now. The task will run with the current settings you have configured for it.

.topic 0x1b4
Click this button to add a new download site to the list shown to the left. This opens the Automatic Update Properties dialog box, where you can configure an entirely new site definition and properties.

.topic 0x1ba
Enter a descriptive name in this text box that identifies the site from which the AutoUpdate utility will download new files. An example might be Internal .DAT File Update Site.

.topic 0x1ce
Select this checkbox to run a program after the AutoUpdate utility installs the new .DAT files it downloaded. Next, enter the path to and the name of the executable file you want to run in the text box provided, or click Browse to locate the program file.

.topic 0x1dd
This item tells you how many detected e-mail message attachments the E-Mail Scan module has deleted during the current scan operation. If the module is not active at the moment, this item tells you how many detected attachments the module found during its most recent scan operation.

.topic 0x1fd
Click this button to have the E-Mail Scan extension look for viruses in all attachments that come with those e-mail messages you’ve asked the extension to examine.

.topic 0x1fe
Click this button to have the E-Mail Scan extension look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those e-mail attachments most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x206
Choose an item from this list to specify what you want the E-Mail Scan extension to do when it detects a virus. When you choose an item, the area beneath the list will display additional options or a method you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt user for action from the list, click the Alert tab to specify whether you want the E-Mail Scan extension to prompt you with a message, a beep, or both.

.topic 0x213
Select this checkbox to warn another user on your network—your system administrator, for example—that your E-Mail Scan extension detected an e-mail attachment. Next, click Configure to compose your own message.

.topic 0x214
Select this checkbox to have the E-Mail Scan extension beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x22a
Select this checkbox to have the MAILSCAN.TXT file record the name of the user logged into the workstation as the E-Mail Scan extension starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x233
Click this button to have the ScreenScan utility look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x23d
If you click the Program files only button in the ScreenScan property page, the utility application will look for viruses only in files that have the extensions shown in this list. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times. To change the extensions shown here, you can: Click Add to include a new extension. You can add as many unique extensions as you want. Select one of the extensions shown, then click Edit to change its definition. Select one of the extensions shown, then click Delete to remove it from the list. Click Default to restore the original extension entries. This removes any extensions you have added.

.topic 0x23e
Click this button to open a dialog box where you can specify a new program extension for the VirusScan application to scan. The Add Program File Extension dialog box will appear.

.topic 0x24d
Select the Security module icon to the left, then click each of these tabs in turn to enable the module and set options for it. The configuration options are: Password. This property page tells the module to lock the settings for all or some of the other VShield scanner property pages. You can also designate a password of up to 20 characters to keep others from tampering with your settings. System Scan. This property page lets you designate which of the System Scan module’s property pages you want to protect with the password you set. E-Mail Scan. This property page lets you designate which of the E-Mail Scan module’s property pages you want to protect with the password you set. Download Scan. This property page lets you designate which of the Download Scan module’s property pages you want to protect with the password you set. Internet Filter. This property page lets you designate which of the Internet Filter module’s property pages you want to protect with the password you set.

.topic 0x26a
Click this button to have the E-Mail Scan module look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions.  Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x281
Select this checkbox to have the System Scan module offer you the option to continue the scan operation without taking any action against any detected items the module finds. This option leaves the file intact and in its original location on your computer and does not prevent you from opening, copying, renaming, or otherwise modifying the file in the future. Use this option only when you know positively that the file the System Scan module flagged is not detected. To preserve files as virus samples, McAfee recommends moving detected files to a quarantine folder instead. The option is available only on computers that run Windows 95 or Windows 98. It works in conjunction with the Prompt mode buttons. If you select the GUI prompt option there, this option is not available. The System Scan module will display its standard graphical alert message, with a range of response options that does not include Continue access. If you select the BIOS prompt mode, this option is available. When the module finds a virus, it will display a full-screen text-mode alert message that offers you a range of response options, including the option to continue without any action against the virus.

.topic 0x28b
Select this checkbox to have the E-Mail Scan module offer you the option to move any detected items to a quarantine folder.When the module finds a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0x2a4
Select this checkbox to have the Download Scan module notify you that it has found a virus. You can have it display a message or play an audible alert tone.

.topic 0x2c0
Select this checkbox to have the WEBEMAIL.TXT file record how many viruses the E-Mail Scan module moves to a quarantine file during each scan operation.Clear this checkbox to leave this information out of the log file.

.topic 0x2cd
Select this checkbox to have the WEBINET.TXT file summarize the actions that the Download Scan module took during each scan operation. The log will record: How many files the module examined.  How many detected files the module deleted. How many detected files the module moved to a quarantine folder. Your Download Scan module settings. The WEBINET.TXT file records this information when you stop the scanner or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2d8
Click this button to open a dialog box where you can specify a new program extension for the VShield scanner to include in scan operations.The Add Program File Extension dialog box will appear.

.topic 0x2e9
Click this button to add a new Internet Protocol (IP) address to the Banned IP Addresses list.The Add IP Address dialog box will appear.

.topic 0x2f0
Select an item in the Banned URLs list, then click this button to delete it.

.topic 797
Click this button to have VirusScan look for viruses with the default file extensions defined by your version of the VirusScan scan engine and DAT files. For example, default files are usually program and application files that are most succeptible to viruses.

.topic 795
To remove a script from your Trusted Script list, select the script that you want to remove and click Remove.

.topic 0x85
Displays the kinds of files susceptible to this virus.

.topic 0x87
VirusScan selects this box if the virus is retained in memory after it runs, continuing to affect other files.

.topic 0x8e
VirusScan selects this box if the detected file is a system file. See your operating system documentation for definitions of file attributes.

.topic 0x9c
Click this button to have the VirusScan application look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x9d
Click this button to see the current extension list that the VirusScan application will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0xa0
Click this button to start an immediate scan operation with the existing configuration options.

.topic 0xa7
Click this button to locate a particular scan target on your computer. To activate this option you must first click the Select drive or folder to scan button. You may also type the path and filename for the scan target in the text box provided.

.topic 0xa8
If you click the Program files only button in the Detection tab, the VirusScan application will look for viruses only in files that have the extensions shown in this list. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times. To change the extensions shown here, you can: Click Add to include a new extension. You can add as many unique extensions as you want. Select one of the extensions shown, then click Edit to change its definition. Select one of the extensions shown, then click Remove to delete it from the list. Click Default to restore the original extension entries. This removes any extensions you have added.

.topic 0xba
Click this button to locate an existing text file to use for the VirusScan application log. By default, the VirusScan application records log data in the file VSCLOG.TXT. You may have the module record log data in a different file, but the text file must already exist. The application will not create a new file.

.topic 0xc4
Click this button to add an entry to the exclusion list. The Add Exclude Item dialog box will appear.

.topic 0xc8
Select this checkbox to tell the VirusScan application to ignore files stored in any subfolders within the folder you exclude from scan operations. Note: Choosing Include subfolders causes the application to ignore only those files stored in the subfolders themselves. The application will still scan files stored at the root level of the folder you designate. To exclude the files at the folder root level, clear the Include subfolders checkbox.

.topic 0xd0
Re-enter your password exactly as you typed it in the previous text box.

.topic 0xd1
Click this button to assign your password and close the dialog box. The password you choose will protect all of the property pages you choose in the Password Protection dialog box.

.topic 0xd8
Use this text box to specify options, command switches, and similar parameters that will govern how your scan task will run. You may leave this text box blank, or you can specify options that the VirusScan application will use to shape the scope and results of its scan operation.

.topic 0xf3
Select this checkbox to run your task once each day at the time you specify. Enter the time in the text box provided in the Start At area, then select the checkboxes for each day that you want the task to run. To have the task run at a random point within an interval of time you set, click the Enable randomization checkbox. Next, enter a time "window" of up to 480 minutes within which you want the task to run. The window sets a time frame centered on the point at which you’ve scheduled the task to run. The window "opens" before the scheduled time and "closes" after the scheduled time. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30.

.topic 0x10c
This item tells you how many files the scan operation examined as of the moment you opened the Task Properties dialog box.

.topic 0x118
This item tells you how many files the System Scan module examined as of the moment you opened the Task Properties dialog box. This item does not distinguish between.

.topic 0x119
This page shows you what results the E-Mail Scan module produced when it last ran. The E-Mail Scan module runs from the time you enable it until you stop it. It does not start by default – you must first configure by choosing an e-mail system and supplying other necessary information. To do so, click the Program tab in this dialog box, then click Configure to open the VShield Properties dialog box. As it runs, the module records how many files it scanned in total, how many of those it found viruses in, and how many of those detected files it cleaned, deleted, or moved to a quarantine folder. These figures do not, however, update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figures there will change to reflect your actions as you receive e-mail.

.topic 0x11c
This item tells you how many detected items the E-Mail Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12b
This line tells you how many detected items the Download Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x141
This list shows a default scan target, or identifies which disks or folders you’ve picked as scan targets for the VirusScan application. Each entry lists a path to the target and notes whether the application will also scan any nested folders within the target. If you click "Run" in the Task Properties dialog box, the VirusScan application will scan the targets shown here. To change the list: Click Add to include a new target. You can add up to 100 unique scan targets.  Select one of the items shown, then click Edit to change the target definition. Select one of the items shown, then click Remove to delete a target from the list.

.topic 0x142
Click this button to add an entry to the target list. The Add Scan Item dialog box will appear.

.topic 0x146
Select this checkbox to have the VirusScan application look for viruses in your hard disk boot sector as it runs this scan task. Note: McAfee recommends that you select this checkbox. Many viruses hide in the hard disk boot sector, then load themselves into memory, which allows them to infect other executable files you might run on your computer.

.topic 0x152
If you click the Program files only button in the Detection tab, the VirusScan application will look for viruses only in files that have the extensions shown in this list. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times. To change the extensions shown here, you can: Click Add to include a new extension. You can add as many unique extensions as you want. Select one of the extensions shown, then click Edit to change its definition. Select one of the extensions shown, then click Remove to delete it from the list. Click Default to restore the original extension entries. This removes any extensions you have added.

.topic 0x16f
Select this checkbox to limit the size of the VSCLOG.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 100K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the VirusScan application first clears it, then starts the log again from where it left off.

.topic 0x177
Select this checkbox to have the VSCLOG.TXT summarize the actions that the VirusScan application took during each scan operation. The log will record: How many files the application examined. How many detected files the application cleaned. How many detected files the application deleted. How many detected files the application moved to a quarantine folder. Your application settings. The VSCLOG.TXT file records this information when the task finishes. Clear the checkbox to leave this information out of the log file.

.topic 0x19a
Select this checkbox to activate this site for the AutoUpgrade utility to use. Clearing this checkbox causes the utility to skip this site when it tries to download new program files from those listed in the Automatic Upgrade dialog box.

.topic 0x1b2
Click this button to open a dialog box where you can enter a password that will protect this task. If you have not yet entered a password for this task, this will open the Specify Password dialog box. If you have already set a password for this task and want to change it, click this button to open the Change Password dialog box. To remove a password entirely in order to enter a new one, clear the Password protect this task checkbox, then select it again. VirusScan will ask for the password you set each time you or someone else tries to open this Task Properties dialog box.

.topic 0x1b6
Select a site shown in the list to the left, then click this button to delete it from the list.

.topic 0x1bd
Click this button to tell the AutoUpdate utility to look for new .DAT files on an FTP site you designate. Next, enter in the text box labeled Enter an FTP computer name and directory the Uniform Resource Locator (URL) or path to the particular directory on the FTP site that holds the new files you want to download. By default, the utility will download new files from the Network Associates FTP site, which accepts anonymous FTP logins. You can click Default to specify this site at any time. To use a different FTP site, you must either have the site set for anonymous FTP login, or you must designate the user name and password for an account on the site. To have the utility use an anonymous login, select the Use anonymous FTP login checkbox. To specify an account, clear the Use anonymous FTP login checkbox, then click FTP login information to enter account data. If your network uses a proxy server, select the Use proxy server checkbox, then enter the server name and the port it uses in the text boxes provided.

.topic 0x1c4
Select this checkbox to have the AutoUpdate utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server, together with the port number it uses, in the text boxes provided. Note: The AutoUpdate utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1d2
This line tells you how many files the System Scan module has examined during the current scan operation. If the scanner is not active at the moment, this line tells you how many files the scanner examined during its most recent scan operation.

.topic 0x1de
This item tells you how many detected e-mail message attachments the E-Mail Scan module has moved to a quarantine folder during the current scan operation. If the module is not active at the moment, this item tells you how many detected attachments the module moved during its most recent scan operation.

.topic 0x202
Click this button to open a dialog box where you can specify a new program extension for the E-Mail Scan extension to use in scan operations. The Add Program File Extension dialog box will appear.

.topic 0x217
If this button is unavailable, the E-Mail Scan extension will send this message directly to the person who sent you the detected attachment. Otherwise, click this button to open your e-mail server address book, where you can choose recipients—your system administrator, for example—who will receive an alert message from the E-Mail Scan extension when it finds a virus. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan extension will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x21f
Select this checkbox to limit the size of the MAILSCAN.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 100K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the E-Mail Scan extension first clears it, then starts the log again from where it left off.

.topic 0x226
Select this checkbox to have the MAILSCAN.TXT file record how many viruses the E-Mail Scan extension moves to a quarantine file during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x245
Select one of the module icons in this list, then click each of the tabs that appear to the right to enable that module and set options for it. The modules are: System Scan. This module looks for viruses in any file that your computer reads from or writes to your hard disk or any floppy disk in your drive. It runs continuously in the background to give you a first line of anti-virus defense. E-Mail Scan. This module looks for viruses carried in e-mail attachments that arrive via your corporate mail system or from the Internet. Download Scan. This module looks for viruses in files you download from the Internet, including attachments that arrive via Internet mail. Internet Filter. This module blocks hostile Java and ActiveX objects from damaging your system, and also keeps your browser from visiting potentially dangerous Internet sites. Hostile Activity Watch Kernel. HAWK monitors your computer for suspicious activity that may indicate a virus is present on your system. As opposed to VirusScan, which cleans the virus, HAWK prevents viruses, worms, and Trojans from spreading further.

.topic 0x246
Click this button to save the changes you made and to close this property page or dialog box.

.topic 0x252
Select this checkbox to have the System Scan module look for viruses whenever you or another user renames a file stored on your hard disk. McAfee strongly recommends that you select this and all other checkboxes in the Scan Files On area to ensure maximum protection.

.topic 0x254
Select this checkbox to have the System Scan module look for viruses whenever your computer or another computer opens, reads, or copies a file from your hard disk.

.topic 0x262
Click this button if you use a Lotus cc:Mail v6.0 or v7.0 e-mail system. Note: If you use America Online, Eudora Light, Netscape, or any other POP-3 or proxy mail client, select the Internet Mail checkbox below, then configure the Download Scan module. You may configure both modules to work at the same time, but you cannot have the E-Mail Scan module scan two types of corporate e-mail systems.

.topic 0x266
Because some newer viruses can now run directly from e-mail messages, the E-Mail Scan module checks all mail you receive via Microsoft Exchange, Microsoft Outlook, or another MAPI client. You can restrict the range of file attachments that the module examines, however. Select the Program files only checkbox, then click Extensions to specify the file name extensions the module should examine.

.topic 0x26b
Click this button to see the current extension list that the E-Mail Scan module will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x271
Click this button to see the current extension list that the Download Scan module will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens download and scan times.

.topic 0x298
Select this checkbox to have the System Scan module notify it has found virus. You can have it display a message or play an audible alert tone.

.topic 0x2a0
Select this checkbox to warn another user on your network—your system administrator, for example—that your E-Mail Scan module detected an e-mail attachment. Next, click Configure to compose your own message.

.topic 0x2a5
Select this checkbox to have the Download Scan module beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x2a8
Select this checkbox to have the Internet Filter module notify you when it finds a hostile Java or ActiveX object, or when it blocks a dangerous Internet site. You can have it display a message or play an audible alert tone.

.topic 0x2ad
Select the Log to file checkbox to summarize the actions that the System Scan module took during each scan operation in the file VSHLOG.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file. The System Scan module will record its actions as soon whenever you stop the scanner or when you shut your system down.

.topic 0x2af
Click or type a size limit, in kilobytes, for the VSHLOG.TXT log file or another log file you specify. When the file reaches the maximum size you set, the System Scan module first clears it, then starts the log again from where it left off.

.topic 0x2b4
Select this checkbox to have the VSHLOG.TXT file record how many viruses the System Scan module moves to a quarantine file during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2d1
Click or type a size limit, in kilobytes, for the WEBFLTR.TXT log file or another log file you specify. When the file reaches the maximum size you set, the Internet Filter module first clears it, then starts the log again.

.topic 0x2e1
Enter a subject line for the message you want to send. Note: McAfee recommends that you choose a distinctive subject that describes the message’s purpose—Virus alert!, for example.

.topic 0x2fa
Use this setting to specify how many scan targets the VirusScan application can examine at one time. This setting sets a maximum number of items that can appear as scan targets for any default scan task—or any task you configure—from within the VirusScan main window. By default, 100 items can appear in the list. If you add more than 100 unique items to the scan items list, the VirusScan application might affect your system performance. You may not set the value here to fewer than five items.

.topic 0x304
For supported Microsoft Outlook  versions, check this checkbox to have HAWK alert you when there has been an attempt to send e-mail messages to 1% to 100% of your address book; or to 10 to 999 recipients within your address book.

.topic 0x306
Select this checkbox to alert you when you are about to open an e-mail message that contains an Embedded attachment. NOTE: An Embedded Attachment is a file that can be an executable program or application.

.topic 0x6f
Describes the file type of the detected file.

.topic 0x75
Displays the date the detected file was last opened, copied or run.

.topic 0x96
Select this checkbox to summarize the actions that the VirusScan application took during each scan operation in the file VSCLOG.TXT. The application will record its actions whenever it finishes a scan task or when you shut your system down. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0xa3
Click this button to choose a scan target from the list provided. Next, click  to choose your specific scan target. You can have the VirusScan application look for viruses in these targets: My Computer. This tells the application to look for viruses on all mounted or mapped hard disks and removable media. To see the specific targets the application will scan, double-click your My Computer icon. All removable media. This tells the application to look for viruses on floppy disks, CD-ROMs, and other removable media. All fixed disks. This tells the application to look for viruses on all local hard disks. All network drives. This tells the application to look for viruses on all mapped hard disks or other network disks.

.topic 0xa9
Click this button to open a dialog box where you can specify a new program extension for the VirusScan application to scan. The Add Program File Extension dialog box will appear.

.topic 0xaf
Select this checkbox to have the VirusScan application offer you the option to delete any detected items. When the application detects a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0xb1
Select this checkbox to have the VirusScan application offer you the option to ignore any of the detected items and continue the scan operation. When the application detects a virus, it will display an alert message. Selecting the Continue scan checkbox here causes a Continue button to appear in that message.

.topic 0xb2
Select this checkbox to have the VirusScan application offer you the option to stop the scan operation immediately. When the application detects a virus, it will display an alert message. Selecting the Stop scan checkbox here causes a Stop button to appear in that message.

.topic 0xb8
Select this checkbox to summarize the actions that the VirusScan application took during each scan operation in the file VSCLOG.TXT. The application will record its actions whenever it finishes a scan task or when you shut your system down. VSCLOG.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0xc2
Select this checkbox to have the VSCLOG.TXT file record the name of the user logged into the workstation as the VirusScan application starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xcd
Click this button to display the online help topic that discusses this dialog box.

.topic 0xd4
Click this button to save the changes you made and to close this property page or dialog box.

.topic 0xd6
Use this dialog box to name your task, specify how it should run and with what options, determine what it should do after it completes a scan operation, and protect the configuration options you set. Right-click each button, list, or checkbox for more information.

.topic 0x104
This item tells you how many items the scan operation detected as of the moment you opened the Task Properties dialog box.

.topic 0x110
This item tells you how many items the System Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x11f
This line tells you how many items the E-Mail Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x123
This line tells you how many files the E-Mail Scan module examined as of the moment you opened the Task Properties dialog box.  This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x147
Select this checkbox to have the VirusScan application look for viruses in compressed files or file archives. Although it does give you better protection, scanning compressed files or file archives can lengthen each operation slightly, especially if your computer is processing a large volume of files.

.topic 0x174
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x188
Click this button to configure the properties for this task. This opens the Automatic Upgrade dialog box. Here, you can tell the Automatic Upgrade task where to look for new program files, which transfer protocols to use to download new files, which account information to use to log on to servers or FTP sites that hold new files, and what to do with the files the task downloads.

.topic 0x1a5
Select the Use Proxy Server checkbox to have the AutoUpgrade utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server in the text box to the left, and the port number it uses here. Note: The AutoUpgrade utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1b7
Select a site shown in the list to the left, then click this button to move the site higher in the list. The AutoUpdate utility tries to download new files from each site in turn, starting from the top of the list. Moving a site up increases its priority for the task.

.topic 0x1cf
Select the Run a program after a successful update checkbox, then enter the path to and the name of the executable file you want to run in the text box provided, or click Browse to locate the program file.

.topic 0x1d6
This line tells you how many detected files the System Scan module has moved to a quarantine folder during the current scan operation. If the scanner is not active at the moment, this line tells you how many detected files the scanner moved to a quarantine folder during its most recent scan operation.

.topic 0x1d9
Click this button to close the System Scan Status dialog box.

.topic 0x20a
Select this checkbox to have the E-Mail Scan extension offer you the option to move any detected item to a quarantine folder. When the extension finds a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0x20c
Select this checkbox to have the E-Mail Scan extension offer you the option to stop the scan operation immediately. When the extension finds a virus, it will display an alert message. Selecting the Stop scan checkbox here causes a Stop button to appear in that message.

.topic 0x210
Select the Return reply mail to sender checkbox to send an alert message as a reply to the person who sent you the detected e-mail attachment. Next, click this button to compose your own reply.

.topic 0x22d
Click this button to add an entry to the target list. The Add Scan Item dialog box will appear.

.topic 0x241
Type the three-character extension that identifies the file type you want the ScreenScan utility to look for during scan operations. Do not include the dot that normally precedes a file name extension.

.topic 0x27a
Click this button to see or edit the current list of dangerous URLs that the Internet Filter module will block.

.topic 0x285
Click this button to choose a quarantine folder into which the System Scan module will move any detected files. You can also enter the path to the quarantine folder you want to use in the text box provided. By default, the System Scan module sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x289
Select this checkbox to have the E-Mail Scan module offer you the option to clean any detected items. When the application detects a virus, it will display an alert message. Selecting the Clean file checkbox here causes a Clean button to appear in that message. Note: This checkbox appears only if you click the Microsoft Exchange (MAPI) button in the Detection property page.

.topic 0x29a
Select this checkbox to have the System Scan module add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0x29b
Select Display custom message, then use this text box to enter the custom alert message you want the System Scan module to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x2b7
Select this checkbox to have the VSHLOG.TXT file record the date and time at which the System Scan module starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2ec
Type the subnet mask associated with the IP address you want to add to the Banned IP Addresses list here. Be sure to format the address with periods between each number group.

.topic 0x2f1
Type the Uniform Resource Locator (URL) you want to add to the Banned URLs list here. To ban a website, you can enter just the domain name— www.domain.com, for example. To ban other types of Internet sites, add the protocol identifier—ftp://ftp.domain.com, for example.

.topic 0x2fe
Click the top and bottom arrows or enter a figure in the text box provided to specify how many scan tasks can appear in the VirusScan Console window. By default, 50 items can appear in the list. If you add more than 50 items, task execution might affect your system performance. You may not set the value here to fewer than five items.

.topic 0x305
Select this checkbox to enable (e-mail) attachment monitoring. NOTE: HAWK only examines Microsoft Outlook incoming e-mail with attachments.

.topic 0x30b
The total number of suspicious e-mail messages scanned during your current e-mail session.

.topic 0x72
Displays the file name based on the DOS convention of eight characters plus a three-character extension. Long file names are truncated.

.topic 0x79
Displays the name of the detected file.

.topic 0x7e
Click this button to attempt to clean the virus.

.topic 0x88
VirusScan selects this box if the virus encrypts part of its code signature to avoid detection.

.topic 0x91
Displays the name of the file attached to the e-mail message.

.topic 0xa5
Click this button to have the VirusScan application look for viruses on a particular disk or in a particular folder on your system. Next, type in the text box provided the drive letter or the path to the folder you want scanned, or click Browse to locate the scan target on your computer.

.topic 0xac
Type the three-character extension that identifies the file type you want the VirusScan application to look for during scan operations. Do not include the dot that normally precedes a file name extension.

.topic 0xb9
Select this checkbox to limit the size of the VSCLOG.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 100K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the VirusScan application first clears it, then starts the log again from where it left off.

.topic 0xc3
This list identifies which disks, folders, or individual files you want to exclude from scan operations. By default, the VirusScan application does not scan the Recycle Bin, so this item will appear in the list when you first open the window. Each entry lists a path to the item, notes whether the application will also exclude any nested folders within the target, and explains whether the application will exclude the item when it scans files, when it scans your hard disk boot sector, or both. If you click Scan for Viruses Now, the application will scan the targets shown here. To change the list: Click Add to exclude a new item. You can exclude up to 100 unique scan targets.  Select one of the items shown, then click Edit to change the item definition. Select one of the items shown, then click Remove to delete an item from the list. This means that the VirusScan application will scan the item during its next operation.

.topic 0xc9
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the VirusScan application looks for file-infecting viruses. These viruses usually appear in files stored in the visible portions of your hard disk. If you select only this checkbox, the application will still scan the item you excluded if it appears in your hard disk’s boot sector or in memory. To exclude the item in all instances, select the Boot sector scanning checkbox also.

.topic 0xcb
Select each of the VirusScan application property pages that you want to protect from unauthorized changes.You may select any or all of the property pages in this list. Protected pages display a

.topic 0xda
Click this button to open a dialog box where you can enter a password that will protect this task. If you have not yet entered a password for this task, this will open the Specify Password dialog box. If you have already set a password for this task and want to change it, click this button to open the Change Password dialog box. To remove a password entirely in order to enter a new one, clear the Password protect this task checkbox, then select it again. VirusScan will ask for the password you set each time you or someone else tries to open this Task Properties dialog box.

.topic 0xfe
Select this checkbox to have this task run each Friday at the time you set.

.topic 0x131
This page shows you what results the Internet Filter module produced when it last ran. The Internet Filter module runs from the time you enable it until you stop it. Ordinarily, it will start when you start your computer and stop when you restart or shut down your computer. As it runs, the module records how many Java classes, ActiveX controls, and Internet sites it scanned in total, how many of those it determined to be hostile objects or sites, and how many of those hostile objects or sites it blocked.  These figures do not, however, update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13a
This item tells you how many hostile Java classes or applets the VShield Internet Filter module kept away from your computer as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x155
Click this button to restore the original file name extension entries. This will remove any file name extensions you have added.

.topic 0x15a
Select this option to have the VirusScan application use heuristic scanning when it looks for macro viruses. Macro viruses usually appear in document files that include macros written in a scripting language, such as Visual Basic. Examples include Microsoft Office files and files from some versions of Corel Draw. Selecting this option often enables the module to detect previously unidentified or unclassified macro viruses.

.topic 0x15b
Select this option to have the VirusScan application use heuristic scanning when it looks for viruses in program files.

.topic 0x178
Select this checkbox to have the VSCLOG.TXT file record the date and time at which the VirusScan application starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x17d
Select an entry shown in the exclusion list, then click this button to delete that entry.

.topic 0x17f
Select this checkbox to tell the VirusScan application to ignore files stored in any subfolders within the folder you exclude from scan operations. Note: Choosing Include subfolders causes the application to ignore only those files stored in the subfolders themselves. The application will still scan files stored at the root level of the folder you designate. To exclude the files at the folder root level, clear the Include subfolders checkbox.

.topic 0x183
Select this checkbox to ensure that your security settings will appear by default in any task that you create by copying the settings for this task.

.topic 0x199
Enter a descriptive name in this text box that identifies the site from which the AutoUpgrade utility will download new files. An example might be Internal Anti-Virus Software Upgrade Site.

.topic 0x1a7
Select this checkbox to save the new program files the AutoUpgrade utility downloads for future use. Next, enter the location where you want the utility to save the files it downloads, or click Browse to locate a suitable directory.

.topic 0x1a8
Select the Save the Upgrade files for later usage checkbox, then enter in this text box the location where you want the utility to save the files it downloads. You can also click Browse to locate a suitable directory.

.topic 0x1c8
Select this checkbox to download new .DAT files now, then wait to run the update operation at a later time. If you select this checkbox, the AutoUpdate utility automatically selects Save the Update files for later usage lower down on this property page. Enter the location where you want the utility to save the files it downloads, or click Browse to locate a suitable directory. Selecting this checkbox also makes the Backup the existing DAT files, the Force Update, and the Reboot system, if needed, after a successful update checkboxes unavailable.

.topic 0x1d7
Click this button to enable or disable this module. If the module is active, the button reads Disable. If the module is idle, the button reads Enable.

.topic 0x1df
Click this button to enable or disable this module. If the module is active, the button reads Disable. If the module is idle, the button reads Enable.

.topic 0x205
Type the three-character extension that identifies the file type you want the E-Mail Scan extension to look for during scan operations. Do not include the dot that normally precedes a file name extension.

.topic 0x225
Select this checkbox to have the MAILSCAN.TXT file record how many viruses the E-Mail Scan extension deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x227
Select this checkbox to have the MAILSCAN.TXT file record your E-Mail Scan extension settings when you quit your e-mail application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x235
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0x242
Slide this control toward High to give a higher priority for system resources and time to the ScreenScan utility than to other background activities, such as disk defragmentation operations, that operate during otherwise idle periods on your computer. This causes the other activities to run more slowly. Slide the control toward Low to give the other background tasks higher priority than you do to the ScreenScan utility. This causes the ScreenScan utility to run more slowly.

.topic 0x24e
Select this checkbox to have the System Scan module lookfor viruses on your system. Selecting this checkbox activates the remaining options in this property page. These options control which activities on your computer will trigger a scan operation. You can set the System Scan module to remain in memory and run continuous background scan operations each time you open, run, save, or modify files on your hard disk, and each time you read from or write to a floppy disk. Note: McAfee recommends that you enable all scan options on this property page to ensure complete anti-virus protection.Clear this checkbox to disable all configuration options in this page and to prevent the System Scan module from scanning your system.

.topic 0x257
Click this button to have the System Scan module examine any file written to or read from your hard disk, whatever its extension. This option might slow system operations down if your computer is processing a large volume of files, but it will ensure that your computer is virus-free.

.topic 0x26d
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0x273
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0x278
Click this button to see or edit the current list of dangerous IP addresses that the Internet Filter module will block.

.topic 0x27b
Choose an item from this list to specify what you want the System Scan module to do when it detects a virus. When you choose an item, the area beneath the list will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does.

.topic 0x27c
Select this checkbox to have the System Scan module offer you the option to clean any detected files. When the application detects a virus, it will display an alert message. Selecting the Clean file checkbox here causes a Clean button to appear in that message.

.topic 0x27d
Select this checkbox to have the System Scan module offer you the option to delete any detected items. When the module finds a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0x2b9
Select this checkbox to summarize the actions that the E-Mail Scan module took during each scan operation in the file WEBEMAIL.TXT. The module will record its actions as soon as you quit your e-mail application or when you shut your system down. WEBEMAIL.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x2c7
Click or type a size limit, in kilobytes, for the WEBINET.TXT log file or another log file you specify. When the file reaches the maximum size you set, the Download Scan module first clears it, then starts the log again.

.topic 0x2d5
Select an entry shown in the exclusion list, then click this button to change the definition for that entry. The Edit Exclude Item dialog box will appear.

.topic 0x2e0
Enter the e-mail addresses for those recipients to whom you want to send a copy of the alert message the E-Mail Scan module sends when it finds a virus. To choose recipients from your e-mail server address book, click the Cc: button to the left. The recipients you choose will appear in this text box. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan module will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x2f4
Click the button to the right to start or stop all VirusScan program operations, including the VirusScan application, and the VShield background scanner. If all VirusScan program components are active, this button will read Stop. If no VirusScan components are active, this button will read Start. You can also restart the VirusScan application from the Windows Start menu.

.topic 0x2f8
Use this setting to specify how many items can appear in the VShield System Scan module’s exclusion list. This setting also determines how many items can appear in the exclusion list for any VirusScan application scan task or any scan task you configure from within the VirusScan main window. By default, 100 items can appear in the list. You may not set the value here to fewer than five items.

.topic 0x74
Displays the date the detected file was last modified.

.topic 0x95
Select this checkbox to have the VirusScan application look for viruses in any subfolders inside the folder you specified as your scan target. Note: Choosing Include subfolders causes the application to scan only those files stored in the subfolders themselves. The application will not scan files stored at the root level of the folder you designate. To scan those files, clear the Include subfolders checkbox.

.topic 0xb3
Select this checkbox to have the VirusScan application offer you the option to move any detected item to a quarantine folder. When the application detects a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0xdb
Choose the degree of control you want to have over this scan task as it runs, and specify how you want it to appear. Your choices are: Normal Scan Mode. This displays the VirusScan application main window during scan operations. This allows you or the user on whose computer the task runs to see—but not change—the configuration options the task uses as it runs, to see the results of the scan operation, or to stop the operation at any time. You can also choose any of the commands from the main window’s menus. Select the Run Minimized checkbox to start the window out as a minimized button in the Windows taskbar. Choose any of the options in the Upon Completion area to tell the application what to do when it finishes the task. Scan only mode. This displays a minimal window that indicates that the task is running. You can stop, pause, or resume the task at any point. Select the Run Minimized checkbox to start the window out as a minimized button in the Windows taskbar. Choose any of the options in the Upon Completion area to tell the application what to do when it finishes the task. Hidden mode. This displays no interface as the scan task runs. You cannot pause or stop the task unless you have VirusScan or the Task Properties dialog box active. The VirusScan application will still notify you when it finds a virus, if you have configured any local alerting options for the task. This task always quits the application when the task finishes.

.topic 0xdc
Select this checkbox to specify that you want the VirusScan application to begin running in a minimized state, as a button in the Windows taskbar. This option governs only the window’s initial state—you can change the window size after the program starts. If you choose Hidden Mode from the Interface type list, this checkbox will be unavailable—the task will display no interface at all as it runs.

.topic 0xe2
Click this button to stop a scan operation in progress.

.topic 0xf4
Select this checkbox to run your task once each time you start your computer and VirusScan. Specify in hours and minutes how long after startup—if at all—you want the Console to wait before it runs your task. You may not randomize this schedule.

.topic 0xf7
Select this checkbox to run your task once each month on the day and at the time you specify. Enter the time in the text box provided in the Start At area, then enter the day of the month on which you want the task to run in the text box to the right. To have the task run at a random point within an interval of time you set, click the Enable randomization checkbox. Next, enter a time "window" of up to 480 minutes within which you want the task to run. The window sets a time frame centered on the point at which you’ve scheduled the task to run. The window "opens" before the scheduled time and "closes" after the scheduled time. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30.

.topic 0xfa
Select this checkbox to have this task run each Monday at the time you set.

.topic 0x100
Select this checkbox to have this task run each Sunday at the time you set.

.topic 0x102
This line identifies the last file, complete with pathname, that the scan operation examined before you opened the Task Properties dialog box.

.topic 0x107
This line tells you how many detected items the scan operation deleted as of the moment you opened the Task Properties dialog box.

.topic 0x10e
This line identifies the last file, complete with pathname, that the System Scan module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x113
This line tells you how many detected items the System Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12a
This item tells you how many detected items the Download Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x140
This item tells you how many potentially dangerous Internet sites the VShield Internet Filter module blocked as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x149
Click this button to have the VirusScan application look for viruses in any file on your hard disk, whatever its extension. This option might slow system operations down if your computer must scan a large volume of files, but it will ensure that your computer is virus-free.

.topic 0x14f
Click this button to have the VirusScan application look for viruses on a particular disk or in a particular folder on your system. Next, type in the text box provided the drive letter or the path to the folder you want scanned, or click Browse to locate the scan target on your computer.

.topic 0x15c
Select this option to have the VirusScan application use heuristic scanning when it looks for both macro- and file-infecting viruses. Note: McAfee recommends this option for better anti-virus protection.

.topic 0x15f
Click this button to save the heuristic settings you chose and close this dialog box.

.topic 0x16a
Select this checkbox to have the VirusScan application beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x18c
Click this button to open a dialog box where you can enter a password that will protect this task. If you have not yet entered a password for this task, this will open the Specify Password dialog box. If you have already set a password for this task and want to change it, click this button to open the Change Password dialog box. To remove a password entirely in order to enter a new one, clear the Password protect this task checkbox, then select it again. VirusScan will ask for the password you set each time you or someone else tries to open this Task Properties dialog box.

.topic 0x1db
This item tells you how many e-mail message attachments the E-Mail Scan module has examined during the current scan operation. If the module is not active at the moment, this item tells you how many attachments the module examined during its most recent scan operation.

.topic 0x1e8
Click this button to open the VShield Properties dialog box. There you can configure scan, response, alert, report, and other options for each VShield module.

.topic 0x1ec
This item identifies the last ActiveX control that the Internet Filter module has examined during the current scan operation. If the module is not active at the moment, this line tells you which control the module last examined during its most recent scan operation.

.topic 0x201
If you click the Program files only button in the Detection tab, the E-Mail Scan extension will look for viruses only in files that have the extensions shown in this list. Use this list to confine your scan operations to those files most susceptible to infection. Doing so speeds up system performance and shortens scan times. To change the extensions shown here, you can: Click Add to include a new extension. You can add as many unique extensions as you want. Select one of the extensions shown, then click Edit to change its definition. Select one of the extensions shown, then click Remove to delete it from the list. Click Default to restore the original extension entries. This removes any extensions you have added.

.topic 0x211
Select the Send alert mail to user checkbox to warn another user on your network—your system administrator, for example—that your E-Mail Scan extension detected an e-mail attachment. Next, click this button to compose your own message.

.topic 0x22f
Select an entry shown in the target list, then click this button to delete that entry.

.topic 0x231
Select this checkbox to have the ScreenScan utility look for viruses in any subfolders inside the folder you chose as your scan target. Note: Choosing Include subfolders causes the application to scan only those files stored in the subfolders themselves. The utility will not scan files stored at the root level of the folder you designate. To scan those files, clear the Include subfolders checkbox.

.topic 0x236
Select this checkbox to have the ScreenScan utility resume any scan operation that it halted in response to a mouse movement or keypress at the point where it left off. This prevents the utility from scanning the same items repeatedly, and allows you to complete an entire scan operation, even with interruptions, at some later point. Clearing the checkbox causes the utility to start its scan operation over from the beginning.

.topic 0x240
Click this button to restore the original file name extension entries. This will remove any file name extensions you have added.

.topic 0x243
Select this checkbox to have the ScreenScan utility summarize the actions it took as it ran. The utility will record its actions in the file SCREENSCAN ACTIVITY LOG.TXT whenever you stop the task or when you shut your system down. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The ScreenScan utility will not generate a text file—it will write only to an existing file.

.topic 0x244
Click this button to locate an existing text file to use for the ScreenScan activity log. By default, the ScreenScan utility records its activity in the file SCREENSCAN ACTIVITY LOG.TXT. You may have the utility record log data in a different file, but the text file must already exist. The utility will not create a new file.

.topic 0x249
Select the System Scan module icon to the left, then click each of these tabs in turn to enable the module and set options for it. The configuration options are: Detection. This property page tells the module what events should trigger a scan operation and where to look for viruses on your system. It also governs what sorts of files to look for and allows you to set general behaviors for the scanner. Action. This property page tells the module what to do when it finds a virus. You can have the module give you options to choose on the fly, or you can have it dispose of the infection automatically by cleaning the detected file, deleting the file, moving the file to a quarantine folder, or simply denying access to it without otherwise taking action. Alert. This property page tells the module how to notify you that it has found a harmful object or dangerous site. You can have it send a message or play an audible alert message. Report. This property page tells the module what information to record in its log file. You can also designate a text file to serve as the log file. Exclusion. This property page tells the module what not to scan.

.topic 0x24c
Select the Internet Filter module icon to the left, then click each of these tabs in turn to enable the module and set options for it. The configuration options are: Detection. This property page tells the module whether to look for harmful Java and ActiveX objects and whether to block potentially dangerous Internet sites. Action. This property page tells the module what to do when it finds a harmful object or dangerous Internet site. You can have the module give you options to choose on the fly, or you can have it block access to the object or site automatically. Alert. This property page tells the module how to notify you that it has found a harmful object or dangerous site. You can have it send a message or play an audible alert message. Report. This property page tells the module what information to record in its log file. You can also designate a text file to serve as the log file.

.topic 0x25e
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0x26f
Click this button to have the Download Scan module examine any file or e-mail attachment that arrives from the Internet, whatever its extension. This may slow e-mail and file downloads down if you download large volumes at once, but it will ensure that your computer is virus-free.

.topic 0x28a
Select this checkbox to have the E-Mail Scan module offer you the option to delete any detected items. When the module finds a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0x28e
Click this button to choose a quarantine folder into which the E-Mail Scan module will move any detected files. You can also enter the path to the quarantine folder you want to use in the text box provided. By default, the E-Mail Scan module sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x2b2
Select this checkbox to have the VSHLOG.TXT file record how many viruses the System Scan module cleans during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2c3
Select this checkbox to have the WEBEMAIL.TXT file record how many viruses the E-Mail Scan module cleans during each scan operation. This option appears only if you have selected Microsoft Exchange (MAPI) in the Detection property page. Clear this checkbox to leave this information out of the log file.

.topic 0x2da
Click this button to restore the original file name extension entries. This will remove any file name extensions you have added.

.topic 0x2e6
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the System Scan module looks for file-infecting viruses. These viruses usually appear in files stored in the visible portions of your hard disk. If you select only this checkbox, the application will still scan the item you excluded if it appears in your hard disk’s boot sector or in memory. To exclude the item in all instances, select the Boot sector scanning checkbox also.

.topic 0x2e8
This list identifies which Internet Protocol (IP) addresses you want the Internet Filter module to block whenever you or someone else tries to connect to them. By default, the list includes two sites that download hostile Java or ActiveX objects to your machine as soon as you connect.  Each address consists of four numeric groups of one to three digits each, formatted in this manner: 123.123.123.123 Each group of numbers can range between zero and 255. The first number series is the banned site’s domain address—the number you use to find it on the Internet—and the second is a "subnet mask." A subnet mask is a way to "remap" a range of computer addresses within an internal network. The module lists a default subnet mask of 255.255.255.255. In most circumstances, you will not need to change this number. To change the list: Click Add to enter a new address in the Add IP Address dialog box. Select one of the items shown, then click Delete to remove the item from the list.

.topic 0x2f6
Select this checkbox to start the VirusScan management service module as soon as you start your computer. The management service module oversees all communications between VirusScan program components, determines which components must load to accomplish program tasks, and allows you to start or stop all program components at once. McAfee recommends that you leave this checkbox checked.

.topic 792
Select this check box to enable HAWK Script Stopper.Script Stopper warns you if it detects a program or script that uses Microsofts' Scripting Layer to perform harmful activities.

.topic 0x89
VirusScan selects this box if the virus avoids detection by changing its code signature slightly each time it copies itself.

.topic 0x8a
VirusScan selects this box if the virus can be cleaned.

.topic 0x93
To have the VirusScan application look for viruses on a particular disk or in a particular folder on your system, type the drive letter or the path to the folder you want scanned in this text box, or click Browse to locate the scan target on your computer.

.topic 0xbf
Select this checkbox to have the VSCLOG.TXT file record your VirusScan application settings when you quit the application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0xd7
This text names your task so that you can distinguish it in the VirusScan task list. Enter a unique description that will identify the task for later reference—perhaps a summary of the task target or scope—then click Apply. To see the task description change in the Console window or to see a new task appear there, click OK. Click Configure to set detection, response, alerting, logging, exclusion, and security options for this task. Note: VirusScan does not permit you to rename its two default tasks, Scan My Computer and Scan Drive ‘C’. The Description text box for these tasks is unavailable.

.topic 0xf8
Select this checkbox to have the task run at a random point within an interval of time you set. Next, enter a time "window" within which you want the task to run. The window "opens" before you’ve scheduled the task to run and "closes" after the task runs.. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30. You can set a window of up to eight hours, except for tasks that run hourly. In that case, the maximum window is one hour. You can randomize any task schedule except one set for startup.

.topic 0x11e
This item tells you how many detected items the E-Mail Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x122
This item tells you how many detected items the E-Mail Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12d
This line tells you how many detected items the Download Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x137
This column tells you how many hostile Java or ActiveX objects and how many Internet sites the VShield Internet Filter module kept away from your computer before you opened the Task Properties dialog box. These figures do not update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x139
This item tells you how many Java classes or applets the VShield Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x15d
Check this check box to have the VirusScan application scan all Object Linking and Embedding (OLE) objects. OLE objects are files created in one program and embedded into files created with another program. You can, for example, embed a Microsoft Excel spreadsheet inside a Microsoft Word document. Viruses carried inside the embedded object can spread even if the "host" file itself remains undetected. Note: McAfee recommends that you enable this option for better anti-virus protection.

.topic 0x162
Select this checkbox to have the VirusScan application offer you the option to clean any detected items. When the application detects a virus, it will display an alert message. Selecting the Clean infection checkbox here causes a Clean button to appear in that message.

.topic 0x181
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the VirusScan application looks for boot-sector viruses. These viruses usually appear in memory or in files that reside in your hard disk’s boot sector or master boot record. If you select only this checkbox, the application will still scan the item you excluded if it appears elsewhere on your hard disk. To exclude the item in all instances, select the File scanning checkbox also.

.topic 0x1a4
Select the Use Proxy Server checkbox to have the AutoUpgrade utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server here, and the port number it uses, in the text box to the right. Note: The AutoUpgrade utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1ae
Click this button to configure the properties for this task. This opens the Automatic Update dialog box. Here, you can tell the AutoUpdate utility where to look for new .DAT files, which transfer protocols to use to download new files, which account information to use to log on to servers or FTP sites that hold new files, and what to do with the files the task downloads.

.topic 0x1b9
Click this button to run the AutoUpdate task immediately, with the current task settings. If you have more than one download site defined in the list to the left, the task will try each in turn until it successfully downloads new files or determines that no new files exist.

.topic 0x1c0
Select this checkbox to have the AutoUpdate utility log in to the server that holds new .DAT files with the same user name and password you used to log on to your network. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, selecting this checkbox has slightly different effects. If you’ve scheduled your file update, the AutoUpdate utility will use its own service account to log on to the update server and download new files. If you click Upgrade Now, the AutoUpdate utility will use the same account you used to log on to your network to connect to the update server. To use a different account to log on to the server, clear this checkbox, then click UNC login information to enter a user name and password for the new account.

.topic 0x1c1
Clear the Use Logged In Account checkbox, then click this button to enter a user name and password that the AutoUpdate utility can use to log on to the server that holds the new .DAT files you want to download.

.topic 0x1c5
Select the Use Proxy Server checkbox to have the AutoUpdate utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server here, and the port number it uses, in the text box to the right. Note: The AutoUpdate utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1c6
Select the Use Proxy Server checkbox to have the AutoUpdate utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server in the text box to the left, and the port number it uses here. Note: The AutoUpdate utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1ea
This item identifies the last Java class or applet that the Internet Filter module examined before you opened the Task Properties dialog box. If the module is not active at the moment, this line tells you which class or applet the module last examined during its most recent scan operation.

.topic 0x204
Click this button to restore the original file name extension entries. This will remove any file name extensions you have added.

.topic 0x207
Choose an action from the When a virus is found list to specify what you want the E-Mail Scan extension to do when it finds a virus. When you choose an action, this area will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the E-Mail Scan extension to prompt you with a message, a beep, or both.

.topic 0x216
Select Display custom message, then use this text box to enter the custom alert message you want the E-Mail Scan extension to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x22b
Use this property page to choose scan targets for the McAfee ScreenScan utility, to determine how inclusive to make your scan operations, to enable the utility to run as a background operation when your screen saver starts, and to configure related options. The ScreenScan utility will detect viruses lurking on your system, but it will not take any action against them. To see what the utility found during its scan operation, view the SCREENSCAN ACTIVITY LOG.TXT file. The file will record the names of any detected files and related information that you can use to dispose of any viruses on your system. Note: McAfee recommends strongly that you do not depend on the ScreenScan utility for all of your virus scanning requirements. Use this utility as a supplement to regular scan operations that you run with other VirusScan components. Right-click each button, list, or checkbox for more information.

.topic 0x24f
Select this checkbox to have the System Scan module look for viruses whenever your computer or another computer runs a file from your hard disk. McAfee strongly recommends that you select this and all other checkboxes in the Scan Files On area to ensure maximum protection.

.topic 0x255
Select this checkbox to have the System Scan module look for viruses on floppy disks each time your computer reads from them or writes to them. The module will pay particular attention to floppy disk boot sectors during this scan operation in order to block a common source of infection.

.topic 0x276
Select this checkbox to have the Internet Filter module look for and block harmful Java classes, or applets written in Java. The Internet Filter module will compare the objects you encounter as you visit Internet sites with an internal list of objects it knows can cause harm, and will alert you if it finds a match.

.topic 0x280
Select this checkbox to have the System Scan module offer you the option to exclude any of the detected items from this and future scan operations. When the module finds a virus, it will display an alert message. Selecting the Exclude file checkbox here causes an Exclude button to appear in that message.

.topic 0x294
Click this button to choose a quarantine folder into which the Download Scan module will move any detected files.  You can also enter the path to the quarantine folder you want to use in the text box provided. By default, the Download Scan module sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x2a7
Select Display custom message, then use this text box to enter the custom alert message you want the Download Scan module to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x2a9
Select this checkbox to have the Internet Filter module beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x2b6
Select this checkbox to have the VSHLOG.TXT file summarize the actions that the System Scan module took during each scan operation. The log will record: How many files the module examined. How many detected files the module cleaned. How many detected files the module deleted. How many detected files the module moved to a quarantine folder. Your System Scan module settings. The VSHLOG.TXT file records this information when you stop the scanner or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2be
Select this checkbox to have the WEBEMAIL.TXT file record how many viruses the E-Mail Scan module detects during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2c4
Select this checkbox to summarize the actions that the Download Scan module took during each scan operation in the file WEBINET.TXT. The module will record its actions as soon as you stop the scanner or when you shut your system down. WEBINET.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x2d4
Click this button to add an entry to the exclusion list. The Add Exclude Item dialog box will appear.

.topic 0x2f5
Click this button to start or stop all VirusScan program operations, including the VirusScan application, and the VShield background scanner. If all VirusScan program components are active, this button will read Stop. If no VirusScan components are active, this button will read Start. You can also restart the VirusScan application from the Windows Start menu.

.topic 0x301
Check this checkbox to have the HAWK module alert you if potential e-mail viruses are running. Selecting this checkbox activates the remaining options in this property page.

.topic 0x6e
Enter your cc:Mail password.

.topic 0x9a
Select an entry shown in the target list, then click this button to delete that entry.

.topic 0xf9
Select the Enable randomization checkbox, then enter in the text box provided a time "window" within which you want your task to run. This causes the task to run at a random point within the window, which "opens" before you’ve scheduled the task to run and "closes" after the task runs. Setting the task schedule to 1:00 and the interval to three hours, for example, would cause the task to run at any time between 11:30 and 14:30. You can set a window of up to eight hours, except for tasks that run hourly. In that case, the maximum window is one hour. You can randomize any task schedule except one set for startup.

.topic 0x106
This item tells you how many detected items the scan operation cleaned as of the moment you opened the Task Properties dialog box.

.topic 0x112
This item tells you how many detected items the System Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x125
This page shows you what results the Download Scan module produced when it last ran. The Download Scan module runs from the time you enable it until you stop it. Ordinarily, it will start when you start your computer and stop when you restart or shut down your computer. As it runs, the module records how many files it scanned in total, how many of those it found viruses in, and how many of those detected files it cleaned, deleted, or moved to a quarantine folder. These figures do not, however, update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figures there will change to reflect your actions as you download files from the Internet.

.topic 0x135
This item identifies the last ActiveX control that the Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13b
This line tells you how many ActiveX controls the VShield Internet Filter module examined and, of those, how many hostile controls the module kept away from your computer before you opened the Task Properties dialog box. The figures in this line do not update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13c
This item tells you how many ActiveX controls the VShield Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x151
Click this button to locate a particular scan target on your computer. To activate this option you must first click the Select drive or folder to scan button. You may also type the path and filename for the scan target in the text box provided.

.topic 0x157
Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses the software already knows. To do this, the software looks for "virus-like" characteristics in the files you’ve asked it to scan. The presence of a sufficient number of these characteristics in a file leads the software to identify the file as potentially dangerous with a new or previously unidentified virus. Because the software looks simultaneously for file characteristics that rule out the possibility of virus infection, it will rarely give you a false indication of a virus infection. Therefore, unless you know that the file does not contain a virus, you should treat "potential" infections with the same caution that you would confirmed infections. To enable this protection, select the Enable heuristics scanning checkbox, then choose which files you want the software to scan with heuristic technology. Right-click other elements in this dialog box to learn more about them.

.topic 0x158
Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses the software already knows. To do this, the software looks for "virus-like" characteristics in the files you’ve asked it to scan. The presence of a sufficient number of these characteristics in a file leads the software to identify the file as potentially dangerous with a new or previously unidentified virus. Because the software looks simultaneously for file characteristics that rule out the possibility of virus infection, it will rarely give you a false indication of a virus infection. Therefore, unless you know that the file does not contain a virus, you should treat "potential" infections with the same caution you would confirmed infections. To enable this protection, select the Enable heuristics scanning checkbox, then choose which files you want the software to scan with heuristic technology. Right-click other elements in this dialog box to learn more about them.

.topic 0x160
Click this button to close this dialog box without saving the heuristic settings you chose.

.topic 0x173
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application cleans during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x182
Select each of the VirusScan application property pages that you want to protect from unauthorized changes. You may select any or all of the property pages in this list. Protected pages display a  icon to the left of the page name.

.topic 0x195
Select this checkbox to have the AutoUpgrade or the AutoUpdate utility summarize the actions it took as it ran. The utility will record its actions in the file UPDATE UPGRADE ACTIVITY LOG.TXT whenever you stop the task or when you shut your system down. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. Neither the AutoUpgrade nor the AutoUpdate utility will generate a text file—these utilities will write only to an existing file.

.topic 0x19f
Select this checkbox to have the AutoUpgrade utility log in to the server that holds new program files with the same user name and password you used to log on to your network. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, selecting this checkbox has slightly different effects. If you’ve scheduled your file upgrade, the AutoUpgrade utility will use its own service account to log on to the upgrade server and download new files. If you click Upgrade Now, the AutoUpgrade utility will use the same account you used to log on to your network to connect to the upgrade server. Either account must have Administrator rights on your local computer—or, in other words, be a part of the Local Administrators group—to install new scan engine or any program files that replace existing VirusScan services. To use a different account to log on to the server, clear this checkbox, then click UNC login information to enter a user name and password for the new account.

.topic 0x1b1
Select this checkbox to have VirusScan ask for a password each time you or someone else tries to open this Task Properties dialog box. This prevents anyone else from making unauthorized changes to your scan task settings. Click Password to open a dialog box where you can specify the password you want to use to protect this task. The password you set will protect only this task.

.topic 0x1e0
Click this button to open the VShield Properties dialog box. There you can configure scan, response, alert, report, and other options for each VShield module.

.topic 0x219
Click this button to open your e-mail server address book. You can then choose additional recipients—your system administrator, for example—for the alert message the E-Mail Scan extension sends when it finds a virus. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan extension will send the message you enter here to the recipients you specify here each time it finds a virus. The extension will not give you an opportunity to edit the message at the time it sends it.

.topic 0x23c
Click this button to locate a particular scan target on your computer. To activate this option you must first choose Drive or folder from the Item to Scan list. You may also type the path and filename for the scan target in the text box provided.

.topic 0x250
Select this checkbox to have the System Scan module look for viruses whenever your computer or another computer copies a file to or from your hard disk. McAfee strongly recommends that you select this and all other checkboxes in the Scan Files On area to ensure maximum protection.

.topic 0x258
Click this button to have the System Scan module look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x26e
Select this checkbox to have the Download Scan module look for viruses in files you download from the Internet. This module also scans e-mail messages and attachments you receive via POP-3 or SMTP e-mail clients, including Eudora Light, America Online, and NetScape mail. This module does not scan mail you receive via corporate e-mail systems such as Microsoft Exchange or Outlook, or Lotus cc:Mail. To scan messages from those systems, you must configure the options shown in the E-Mail Scan property page. Selecting this checkbox activates the remaining options in this property page. Clear this checkbox to disable all configuration options in this page and to prevent the Download Scan module from looking for viruses in files you download.

.topic 0x286
Type a path here that designates the quarantine folder into which you want the System Scan module move any detected files. By default, the System Scan module sends detected files to a folder called \Infected, located inside the VirusScan program directory. You can also click Browse to locate a suitable folder on your hard disk or elsewhere on the network.

.topic 0x291
Select this checkbox to have the Download Scan module offer you the option to move any detected items to a quarantine folder. When the module finds a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0x292
Select this checkbox to have the Download Scan module offer you the option to delete any detected items.  When the module finds a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0x2ce
Select this checkbox to summarize the actions that the Internet Filter module took during each scan operation in the file WEBFLTR.TXT. The module will record its actions as soon as you stop the scanner or when you shut your system down. WEBFLTR.TXT will record such data as the name of the user logged in to the workstation during any scan operations, the IP addresses or URLs the module blocked, and similar information. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x2d7
If you click the Program files only button in the Detection tab, the VShield scanner will look for viruses only in files that have the extensions shown in this list. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times. To change the extensions shown here, you can: Click Add to include a new extension. You can add as many unique extensions as you want. Select one of the extensions shown, then click Edit to change its definition. Select one of the extensions shown, then click Remove to delete it from the list. Click Default to restore the original extension entries. This removes any extensions you have added.

.topic 0x2ed
Click this button to see an online help topic that discusses this dialog box.

.topic 0x2f7
Select this checkbox to have the VShield background scanner start as soon as you start your computer. Note: McAfee recommends that you leave this checkbox selected. The VShield scanner is your best continuous defense against virus infections.

.topic 0x30a
The total number of alert messages displayed during your current e-mail session.

.topic 0x73
Displays the date the detected file was created.

.topic 0x83
Indicates the current disposition of the virus.

.topic 0x9e
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0xa2
Click this button to have the VirusScan application run all future scan operations with the settings you chose. The application will ask you to confirm that you want to change your settings. Click OK.

.topic 0xab
Click this button to restore the original file name extension entries. This will remove any file name extensions you have added.

.topic 0xbd
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xcc
Click this button to open a dialog box where you can enter a password.

.topic 0xde
Click this button to tell the VirusScan application to quit automatically if it has not detected any viruses during this scan task. If the application does find a virus, it will remain open to display its scan results. If you run the task in normal scan mode, it will also allow you to dispose of any viruses it detects, if you have not already set the application to dispose of them automatically.

.topic 0xec
This text names your task so that you can distinguish it in the VirusScan task list. Because you may not rename the VShield task, this text box is unavailable. Click Configure to set detection, response, alerting, logging, exclusion, and security options for this task.

.topic 0xf0
Click this button to stop the VShield scanner. This will stop all scanning operations and remove the scanner from memory. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, this will stop the McShield service. If the VShield scanner is not running, this button will read Enable. If the scanner is running, this button will read Disable. To enable or disable the scanner, you can also select the item in the VirusScan task list, then click the Start or the Stop button, as appropriate.

.topic 0xf1
Select this checkbox, then click the button in the Run area that corresponds to how often you want this task to run. Clear the checkbox to prevent this task from running. When you select the checkbox, the schedule options activate. Depending on which interval you select in the Run area, the Start At area gives you a different set of choices for your task schedule. Your choices are: To run a task once, enter a date, time, and year. Choose the month in which you want to run the task from the provided list. To run a task each hour, enter the number of minutes you want VirusScan to wait after each hour before it begins a scan task. To run a daily task, specify a time, then select the checkboxes beside each day on which you want the task to run. To run a weekly task, specify a time, then specify the day of the week on which you want the task to run. To run a monthly task, specify a time, then specify the day of the month on which you want the task to run. Note: Enter clock times based on a 24-hour clock. If you want the task to run at 9:30 p.m., enter 21:30. Unless you’ve set it to run at startup, you can also have this task run at a random point within a time "window" that starts before the time at which you’ve scheduled the task to begin. If, for example, you set this task to run daily at 15:00, then you selected Enable randomization and specified a time window of one hour, the task would run at any point in the period between 14:30 and 15:30. You may set a window of up to 480 minutes, or eight hours. This feature allows you to reduce network traffic and other system overhead that might result from many computers running scan or update operations at the same time.

.topic 0x124
This item tells you how many files the E-Mail Scan module examined as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12f
This line tells you how many files the Download Scan module examined as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x14b
Click this button to see the current extension list that the VirusScan application will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x164
Select this checkbox to have the VirusScan application offer you the option to exclude any detected item from the scan operation. When the application detects a virus, it will display an alert message. Selecting the Exclude file checkbox here causes an Exclude button to appear in that message.

.topic 0x166
Select this checkbox to have the VirusScan application offer you the option to stop the scan operation immediately. When the application detects a virus, it will display an alert message. Selecting the Stop scan checkbox here causes a Stop button to appear in that message.

.topic 0x167
Select this checkbox to have the VirusScan application offer you the option to move any detected item to a quarantine folder. When the application detects a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0x1a2
Clear the Use anonymous FTP login checkbox, then click this button to enter a user name and password that the AutoUpgrade utility can use to log on to the FTP site that holds the new program files you want to download. If your network uses a proxy server to filter FTP connections, select the Use Proxy Server checkbox, then enter the server name and the port it uses in the checkboxes provided. Note: The AutoUpgrade utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x247
Click this button to close this property page or dialog box without saving any changes you have made.

.topic 0x261
Click this button if you use an e-mail system that sends and receives mail via Microsoft’s Messaging Application Programming Interface (MAPI), a Windows mail standard. Examples include: Microsoft Exchange, Microsoft Outlook 97, Outlook 98, Outlook 2000, and Outlook XP.

.topic 0x264
Click this button to have the E-mail Scan module look for viruses with the default file extensions defined by your version of the VirusScan scan engine and DAT files. For example, default files are usually program and application files that are most succeptible to viruses.

.topic 0x2ba
Select the Log to file checkbox to summarize the actions that the E-Mail Scan module took during each scan operation in the file WEBEMAIL.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file. The module will record its actions as soon as you quit your e-mail application or when you shut your system down.

.topic 0x2cb
Select this checkbox to have the WEBINET.TXT file record how many viruses the Download Scan module moves to a quarantine file during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x30c
The total number of suspicious e-mail attachment alert messages displayed during your current e-mail session.

.topic 0x30e
Click this button to close the HAWK for Outlook Status dialog box.

.topic 790
Choose this option to direct VirusScan to restart (after shutdown) without your intervention. You can configure VirusScan to wait from 10 minutes to 360 minutes (6 hours). Use the spin box to specify the number of minutes that you want to allow to elapse before VirusScan restarts. The default setting is 60 minutes.

.topic 0x97
This list shows a default scan target, or identifies which disks or folders you’ve picked as scan targets for the VirusScan application. Each entry lists a path to the target, notes whether the application will also scan any nested folders within the target, and describes the target type as a fixed or removable disk, a folder, or as part of the My Computer local disk set. If you click Scan for Viruses Now, the application will scan the targets shown here. To change the list: Click Add to include a new target. You can add up to 100 unique scan targets.  Select one of the items shown, then click Edit to change the target definition. Select one of the items shown, then click Remove to delete a target from the list. To have the VirusScan application run all future scan operations with the settings you choose here, click New Scan. The application will ask you to confirm that you want to change your settings. Click OK. To leave the current VirusScan application settings as is, but to save the settings you chose in a separate file for later retrieval, choose Save Settings from the File menu. Give your settings file a unique description so that you can locate the file in order to run the operation you’ve configured.

.topic 0xaa
Select one of the file name extension entries shown in the list, then click this button to delete that entry.

.topic 0xd9
Select this checkbox to have VirusScan ask for a password each time you or someone else tries to open this Task Properties dialog box. This prevents anyone else from making unauthorized changes to your scan task settings. Click Password to open a dialog box where you can specify the password you want to use to protect this task. The password you set will protect only this task.

.topic 0xe3
Enter a unique password in the text box provided. You may enter a maximum of 20 characters of any type. Be sure to choose a password you will remember.

.topic 0xe6
Enter the password you last used to protect this task in this text box. VirusScan does not allow you to alter an existing password without first confirming that you know it.

.topic 0xef
Click this button to start the VShield scanner. This will load the scanner into memory and begin the background scanning task. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, this will start the McShield service. If the scanner is already running, this button will read Disable. If not, this button will read Enable. To enable or disable the scanner, you can also select the VShield icon in the VirusScan task list, then click the Start or the Stop button, as appropriate.

.topic 0x127
This line tells you how many detected items the Download Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x132
This line identifies the last Java class or applet that the Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x16c
Select Display custom message, then use this text box to enter the custom alert message you want the VirusScan application to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x175
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application moves to a quarantine file during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x186
This text names your task so that you can distinguish it in the VirusScan task list. Because you may not rename the AutoUpgrade task, this text box is unavailable. Click Configure to set detection, response, alerting, logging, exclusion, and security options for this task.

.topic 0x1a0
Clear the Use Logged In Account checkbox, then click this button to enter a user name and password that the AutoUpgrade utility can use to log on to the server that holds the new program files you want to download.

.topic 0x1b5
Select a site shown in the list to the left, then click this button to change its definition or properties. This opens the Automatic Upgrade Properties dialog box, where you can change the configuration options you set earlier.

.topic 0x1f0
This item tells you how many hostile Java classes or applets the Internet Filter module kept away from your computer before you opened the Status dialog box. If the module is not active at the moment, this item tells you how many hostile classes or applets the module examined during its most recent scan operation.

.topic 0x218
If this text box is unavailable, the E-Mail Scan extension will send this message directly to the person who sent you the detected attachment. Otherwise, enter the e-mail addresses for those recipients to whom you want to send an alert message when the E-Mail Scan extension finds a virus. To choose recipients from your e-mail server address book, click the To: button to the left. The recipients you choose will appear in this text box. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan extension will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x21e
Select the Log to file checkbox to summarize the actions that the E-Mail Scan extension took during each scan operation in the file MAILSCAN.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The extension will not generate a text file—it will write only to an existing file. The extension will record its actions as soon as you quit your e-mail application or when you shut your system down.

.topic 0x223
Select this checkbox to have the MAILSCAN.TXT file record how many viruses the E-Mail Scan extension finds during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x25d
Select this checkbox to display a VShield icon in the Windows system tray.

.topic 0x279
Select this checkbox to have the Internet Filter module block your browser software from visiting Internet sites that you designate with a URL or domain name. Click Configure to see or edit the current list of dangerous URLs.

.topic 0x28d
This item specifies where the E-Mail Scan module will move any detected files that. You’ll find the \Infected directory within the VirusScan program directory.

.topic 0x2ab
Select Display custom message, then use this text box to enter the custom alert message you want the Internet Filter module to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x2b8
Select this checkbox to have the VSHLOG.TXT file record the name of the user logged into the workstation as the System Scan module starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2c8
Click this button to locate an existing text file to use for the Download Scan module log. By default, the Download Scan module records log data in the file WEBINET.TXT. You may have the module record log data in a different file, but the text file must already exist. The module will not create a new file.

.topic 0x2e5
Select this checkbox to tell the System Scan module to ignore files stored in any subfolders inside the folder you exclude from scan operations. Note: Choosing Include subfolders causes the application to ignore only those files stored in the subfolders themselves. The application will still scan files stored at the root level of the folder you designate. To exclude the files at the folder root level, clear the Include subfolders checkbox.

.topic 0x81
Click this button to prohibit application of a potentially damaging ActiveX or Java object, or access to a potentially dangerous website.

.topic 0x84
Displays the name of the virus infecting the file.

.topic 0x8c
Click this button to delete the detected file.

.topic 0x9f
Select this checkbox to have the VirusScan application look for viruses in compressed files and file archives. Although it does give you better protection, scanning compressed files and file archives can lengthen each operation slightly, especially if your computer is processing a large volume of files.

.topic 0xad
Choose an item from this list to specify what you want the VirusScan application to do when it detects a virus. When you choose an item, the area beneath the list will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt user for action from the list, click the Alert tab to specify whether you want the VirusScan application to prompt you with a message, a beep, or both.

.topic 0xbe
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application moves to a quarantine file during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xcf
Click this button to have the Download Scan module look for viruses with the default file extensions defined by your version of the VirusScan scan engine and DAT files. For example, default files are usually program and application files that are most succeptible to viruses.

.topic 0xd5
Click this button to close this property page or dialog box without saving any changes you have made.

.topic 0xe0
Click this button to configure the properties for this task. This opens the VirusScan Properties dialog box. Here, you can tell the VirusScan application where and what to look for during this scan operation, how to respond to any viruses it finds, how to notify you when it finds a virus, what information to record in its activity log, what items to exclude from scan tasks, and whether to protect the configuration options you set for the task.

.topic 0xe4
Re-enter your password exactly as you typed it in the previous text box.

.topic 0xeb
Use this dialog box to specify how this task should run and with what options, determine what it should do after it completes a scan operation, and protect the configuration options you set. Note: You may not rename the VShield task. The description text box is unavailable on this property page. Right-click each button, list, or checkbox for more information.

.topic 0x11b
This line tells you how many detected items the E-Mail Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13e
This line tells you how many Internet sites the VShield Internet Filter module examined and, of those, how many potentially dangerous sites the module blocked before you opened the Task Properties dialog box. The figures in this line do not update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x145
Select this checkbox to have the VirusScan application look for viruses in your computer’s random-access memory (RAM) as it runs this scan task. Note: McAfee recommends that you select this checkbox. Many viruses can load themselves into memory and thereby infect other executable files you might run on your computer.

.topic 0x14a
Click this button to have the VirusScan application look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x154
Select one of the file name extension entries shown in the list, then click this button to delete that entry.

.topic 0x159
Select this checkbox to enable VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. To do this, the program looks for certain "virus-like" characteristics in the files you’ve asked it to scan. The presence of a sufficient number of these characteristics in a file leads the module to identify the file as potentially dangerous with a new or previously unidentified virus. Selecting this checkbox activates the options in the Heuristics Scan Settings area. Click one of the buttons shown to tell the module when you want it to use heuristic scanning. Note: McAfee recommends that you enable both macro and program file heuristic scanning for better anti-virus protection.

.topic 0x179
Select this checkbox to have the VSCLOG.TXT file record the name of the user logged into the workstation as the VirusScan application starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x18a
Click this button to stop the AutoUpgrade task as it runs.

.topic 0x18b
Select this checkbox to have VirusScan ask for a password each time you or someone else tries to open this Task Properties dialog box. This prevents anyone else from making unauthorized changes to your scan task settings. Click Password to open a dialog box where you can specify the password you want to use to protect this task. The password you set will protect only this task.

.topic 0x190
Select a site shown in the list to the left, then click this button to change its definition or properties. This opens the Automatic Upgrade Properties dialog box, where you can change the configuration options you set earlier.

.topic 0x196
Select the Log activity into the Activity Log File checkbox to have the AutoUpgrade utility summarize the actions it took as it ran. The AutoUpgrade utility will record its actions in the file UPDATE UPGRADE ACTIVITY LOG.TXT whenever you stop the task or when you shut your system down. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The AutoUpgrade utility will not generate a text file—it will write only to an existing file..

.topic 0x198
Click this button to locate an existing text file to use for the AutoUpgrade activity log. By default, the AutoUpgrade utility records its activity in the file UPDATE UPGRADE ACTIVITY LOG.TXT. You may have the module record log data in a different file, but the text file must already exist. The utility will not create a new file.

.topic 0x19e
Click this button to locate the server you want the AutoUpgrade utility to use to download new files. When you locate the server, the path appears in the text box to the left. If you click the FTP from a remote network computer button, the Browse button becomes unavailable.

.topic 0x1b0
Click this button to stop the AutoUpdate task as it runs.

.topic 0x1bb
Select this checkbox to activate this site for the AutoUpdate utility to use. Clearing this checkbox causes the utility to skip this site when it tries to download new .DAT files from those listed in the Automatic Update dialog box.

.topic 0x1be
Use this text box to enter the UNC pathname or the FTP site URL for the server you want the AutoUpdate utility to use to download new .DAT files. To enter a UNC pathname, you can also click Browse to locate a server on your network. When you locate the server, the path appears here. Click Default to tell the AutoUpdate utility to download new files from the McAfee VirusScan FTP site.

.topic 0x1e2
This line identifies the last file that you have downloaded and that the Download Scan module has examined during the current scan operation. If the module is not active at the moment, this line tells you which file the module last examined during its most recent scan operation.

.topic 0x21b
Enter a subject line for the message you want to send. Note: McAfee recommends that you choose a distinctive subject that describes the message’s purpose—Virus alert!, for example.

.topic 0x239
Select this checkbox to have the ScreenScan utility start its scan operation with the options you’ve chosen in this property page as soon as your screen saver next starts. The ScreenScan utility will detect viruses lurking on your system, but it will not take any action against them. To see what the utility found during its scan operation, view the SCREENSCAN ACTIVITY LOG.TXT file. The file will record the names of any detected files and related information that you can use to dispose of any viruses on your system. Note: McAfee recommends strongly that you do not depend on the ScreenScan utility for all of your virus scanning requirements. Use this utility as a supplement to regular scan operations that you run with other VirusScan components.

.topic 0x25c
Select this checkbox in order to have the option to disable the System Scan module. McAfee recommends that you have the System Scan module enabled at all times for maximum protection. Clearing this checkbox removes the disable command from the VShield shortcut menu in the Windows system tray and the disable button from the VShield Status dialog box.

.topic 0x267
Enter the number of seconds the E-Mail Scan module should wait before it checks your cc:Mail Inbox for new mail. By default, the module checks once every minute. Be sure to set an interval shorter than the interval you set to receive your e-mail so that module has an opportunity to detect any viruses before they reach your computer.

.topic 0x274
Select this checkbox to have the Internet Filter module keep hostile Java applets and ActiveX controls away from your computer and block access to dangerous Internet sites. Selecting this checkbox activates the remaining options in this property page. Clear this checkbox to disable all configuration options in this page and to prevent the Internet Filter module from blocking hostile software objects or dangerous Internet sites.

.topic 0x295
Type a path here that designates the quarantine folder into which you want the Download Scan module move any detected files. By default, the Download Scan module sends detected files to a folder called \Infected, located inside the VirusScan program directory. You can also click Browse to locate a suitable folder on your hard disk or elsewhere on the network.

.topic 0x29d
Select the Return reply mail to sender checkbox to send an alert message as a reply to the person who sent you the detected e-mail attachment. Next, click this button to compose your own reply.

.topic 0x2a1
Select this checkbox to have the E-Mail Scan module beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x2aa
Select this checkbox to have the Internet Filter module add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0x2ac
Select this checkbox to summarize the actions that the System Scan module took during each scan operation in the file VSHLOG.TXT. The module will record its actions whenever you stop the scanner or when you shut your system down. VSHLOG.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x2bc
Click or type a size limit, in kilobytes, for the WEBEMAIL.TXT log file or another log file you specify. When the file reaches the maximum size you set, the E-Mail Scan module first clears it, then starts the log again.

.topic 0x2d2
Click this button to locate an existing text file to use for the Internet Filter module log. By default, the module records log data in the file WEBFLTR.TXT. You may have the module record log data in a different file, but the text file must already exist. The module will not create a new file.

.topic 0x2d3
This list identifies which disks, folders, or individual files you want the System Scan module to exclude from scan operations. By default, the module does not scan the Recycle bin. This item, therefore, will appear in the list when you first open the window. Each entry lists a path to the item, notes whether the application will also exclude any nested subfolders within the target, and explains whether the application will exclude the item when it scans files, when it scans your hard disk boot sector, or both. To change the list: Click Add to exclude a new item. You can exclude up to 100 unique scan targets.  Select one of the items shown, then click Edit to change the item definition. Select one of the items shown, then click Remove to delete an item from the list. This means that the System Scan module will scan the item during its next operation.

.topic 0x2dc
Click this button to see the help topic that discusses this dialog box.

.topic 0x2ef
Click this button to add a new Uniform Resource Locator (URL) to the Banned URLs list. The Add URL dialog box will appear.

.topic 0x2fb
Click or enter a figure in the text box provided to specify how many scan targets the VirusScan application can examine at one time. This setting sets a maximum number of items that can appear as scan targets for any default scan task—or any task you configure—from within the VirusScan Console. By default, 100 items can appear in the list. If you add more than 100 unique items to the scan items list, the VirusScan application might affect your system performance. You may not set the value here to fewer than five items.

.topic 0x308
Click this button to see the current trusted extension list that the HAWK application will use to guide its scan operations.  Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 794
Click Add to display a Browse dialog and add a script to your Trusted Script list. Common scripts display a .vbs, .wsf, or .wsh file extension.

.topic 793
This list box diplays your Trusted Scripts - scripts that you will allow to run. Common scripts display a .vbs, .wsf, or .wsh file extension.

.topic 0x6c
Enter your cc:Mail password.

.topic 0x94
Click this button to locate a particular disk or in a particular folder on your system that you want the VirusScan application to scan for viruses. The file name and path for the location you choose will appear in the text box to the left.

.topic 0xb7
Select this checkbox to have the VirusScan application add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0xbb
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application finds during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xc5
Select an entry shown in the exclusion list, then click this button to change the definition for that entry. The Edit Exclude Item dialog box will appear.

.topic 0xc7
Click this button to locate the file or folder you want the VirusScan application to exclude from scan operations. The name and path to the item you select will appear in the text box to the left.

.topic 0xd2
Click this button to close the dialog box without assigning a password.

.topic 0x11a
This line identifies the last file, complete with pathname, that the E-Mail Scan module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12c
This item tells you how many detected items the Download Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x12e
This item tells you how many detected items the Download Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x138
This line tells you how many Java classes or applets the VShield Internet Filter module examined and, of those, how many hostile classes or applets the module kept away from your computer before you opened the Task Properties dialog box. The figures in this line do not update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x13f
This item tells you how many Internet sites the VShield Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x169
Select this checkbox to have the VirusScan application notify you it has detected a virus or harmful object.

.topic 0x17b
Click this button to add an entry to the exclusion list. The Add Exclude Item dialog box will appear.

.topic 0x191
Select a site shown in the list to the left, then click this button to delete it from the list.

.topic 0x19d
Use this text box to enter the UNC pathname or the FTP site URL for the server you want the AutoUpgrade utility to use to download new files. You can also click Browse to locate a server on your network. When you locate the server, the path appears here. The Browse button becomes unavailable if you click the FTP from a remote network computer button. You must type the URL for the FTP site.

.topic 0x1a6
Select this checkbox to download new program files now, then wait to run the upgrade operation at a later time. This tells the AutoUpgrade utility not to run Setup to install the new files. If you select this checkbox, the AutoUpgrade utility automatically selects Save the Update files for later usage. Enter the location where you want the utility to save the files it downloads, or click Browse to locate a suitable directory.

.topic 0x1ac
This text names your task so that you can distinguish it in the VirusScan task list. Because you may not rename the AutoUpdate task, this text box is unavailable. Click Configure to set detection, response, alerting, logging, exclusion, and security options for this task.

.topic 0x1b3
This list shows the update sites you have designated for this task and reports their current status as Enabled or Disabled. You have enabled a site if you have selected the Enabled checkbox in the Automatic Update Properties dialog box. You have disabled a site if you clear this checkbox. This designation does not change whether or not the AutoUpdate utility can connect with the site. The AutoUpdate utility can download new program files from any network share or FTP site that you specify. You can designate several sites from which the task can attempt to download new files. The utility will try each site in turn, starting from the top of the list, until it successfully downloads new files or determines that no new files exist. To change the contents of this list, you can: Click Add. This opens the Automatic Update Properties dialog box, where you can configure an entirely new site definition and properties. Select one of the listed sites, then click Edit to change any of the site properties. Select one of the listed sites, then click Delete to remove it from the list. Select one of the listed sites, then click Move Up to tell AutoUpdate to try to download files from this site earlier. Select one of the listed sites, then click Move Down to tell AutoUpdate to try to download files from this site later. To start the AutoUpdate task immediately, click Update Now. The task will run with the current settings you have configured for it.

.topic 0x1bc
Click this button to tell the AutoUpdate utility to use your standard network configuration to look for new .DAT files on your local computer or on a computer elsewhere on your network. Next, use Universal Naming Convention (UNC) notation to enter in the text box labeled Select a computer and directory where the AutoUpdate utility can find the new files you want to download. You can also click Browse to locate the directory you want. To use UNC notation, you must either use the same account you used to log into your network, or specify a user name and password to log into your network. To use the current account, select the Use Logged In Account checkbox. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, selecting the Use Logged In Account checkbox has slightly different effects. If you’ve scheduled your file update, the AutoUpdate utility will use its own service account to log on to the update server and download new files. If you click Upgrade Now, the AutoUpdate utility will use the same account you used to log on to your network to connect to the update server. To use a different account, clear the Use Logged In Account checkbox, then click UNC login information to enter account data.

.topic 0x1c2
Select this checkbox to have the AutoUpdate utility log on to the FTP site that holds new .DAT files with the user name anonymous and an unspecific password. To use this option, the FTP site must be set to accept anonymous FTP logins. To use a specific account to log on to the FTP site, clear this checkbox, then click FTP login information to enter a user name and password for an account that exists on the site. If your network uses a proxy server to filter FTP connections, select the Use Proxy Server checkbox, then enter the server name and the port it uses in the checkboxes provided.

.topic 0x1ca
Select this checkbox to restart your system automatically when the AutoUpdate utility finishes installing new .DAT files. In most cases, you will not need to restart in order for VirusScan to use new .DAT files, but some systems will require that you do so in order for the new files to activate. If you want to restart your system at a more convenient time, clear this checkbox.

.topic 0x1d0
Select the Run a program after a successful update checkbox, then click this button to locate the executable file you want to run, or enter the path to and the name of the file in the text box to the left.

.topic 0x1da
This line identifies the last e-mail message attachment that the E-Mail Scan module examined before you opened the Task Properties dialog box. If the module is not active at the moment, this line tells you which attachment the module last examined during its most recent scan operation.

.topic 0x1dc
This item tells you how many detected e-mail message attachments the E-Mail Scan module has found during the current scan operation. If the module is not active at the moment, this item tells you how many detected attachments the module found during its most recent scan operation.

.topic 0x1e5
This item tells you how many detected files the Download Scan module has deleted during the current scan operation. If the module is not active at the moment, this item tells you how many detected files the module deleted during its most recent scan operation.

.topic 0x1e9
Click this button to close the Download Scan Status dialog box.

.topic 0x1f7
Click this button to enable or disable this module. If the module is active, the button reads Disable. If the module is idle, the button reads Enable.

.topic 0x1fb
Click this button to have the E-Mail Scan extension look for viruses in only those e-mail messages you select from those stored in your Microsoft Exchange or Microsoft Outloook Inbox. To restrict this scan operation so that it examines only unread messages within the range you select, select the Scan unread messages only checkbox. The E-Mail Scan extension scans the messages themselves, as Microsoft Exchange files can carry embedded macros, Hyper Text Markup Language (HTML) tags, and VBScript applets, all of which can in turn harbor specialized viruses, worms, or Trojan horse programs. The extension will also automatically scan any file attachments included with each message according to the configuration options you set elsewhere in this property page. Note: The E-Mail Scan extension connects directly to the Inbox on your Microsoft Exchange mail server to run its scan operations. It does not scan messages stored in Microsoft Outlook personal folders (.PST files) or archived items. Other VirusScan components, however, will scan .PST files during their own regular scan operations unless you specifically exclude them.

.topic 0x1ff
Click this button to see the current extension list that the E-Mail Scan extension will use to guide its scan operations. Use this list to confine your scan operations to those e-mail attachments most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x200
Select this checkbox to have the E-Mail Scan extension look for viruses in compressed files and file archives. Although it does give you better protection, scanning compressed files and file archives can lengthen each operation slightly, especially if your computer is processing a large volume of files.

.topic 0x21c
Type the message you want to send to the recipients you specified above. The E-Mail Scan extension will precede your message with a brief report, shown as <Virus Information> in the dialog box, that describes the virus and names the file in which it appeared.

.topic 0x22e
Select an entry shown in the target list, then click this button to change the definition for that entry. The Edit Scan Item dialog box will appear.

.topic 0x23f
Select one of the file name extension entries shown in the list, then click this button to remove that entry.

.topic 0x270
Click this button to have the Download Scan module look for viruses only in files that have certain file name extensions. To see the current extension list, click Extensions. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens download and scan times.

.topic 0x282
Click this button to have the System Scan module display a full-screen text-mode alert message when it finds a virus. The text-mode alert message will offer you a range of response options, including the option to continue without any action against the virus, provided you have chosen Prompt for user action as your response and selected the Continue access checkbox in the Possible actions area. In order to prevent any further infection risk, this alert message brings your system to a complete halt until you choose one of the available response options.

.topic 0x2bd
Click this button to locate an existing text file to use for the E-Mail Scan module log. By default, the E-Mail Scan module records log data in the file WEBEMAIL.TXT. You may have the module record log data in a different file, but the text file must already exist. The module will not create a new file.

.topic 0x2c1
Select this checkbox to have the WEBEMAIL.TXT file record your E-Mail Scan module settings when you quit your e-mail application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2c2
Select this checkbox to have the WEBEMAIL.TXT file summarize the actions that the E-Mail Scan module took during each scan operation. The log will record: How many files the module examined. How many detected files the module cleaned. This information appears only if you have selected Microsoft Exchange (MAPI) in the Detection property page. How many detected files the module deleted. How many detected files the module moved to a quarantine folder. Your E-Mail Scan module settings. The WEBEMAIL.TXT file records this information when you quit your e-mail application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2cf
Select the Log to file checkbox to summarize the actions that the Internet Filter module took during each scan operation in the file WEBFLTR.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file. The module will record its actions as soon as you stop the scanner or when you shut your system down.

.topic 0x2d9
Select one of the file name extension entries shown in the list, then click this button to delete that entry.

.topic 0x2dd
If this button is unavailable, the E-Mail Scan module will send this message directly to the person who sent you the detected attachment. Otherwise, click this button to open your e-mail server address book, where you can choose recipients—your system administrator, for example—who will receive an alert message from the E-Mail Scan module when it finds a virus. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan module will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x70
Shows the path to the detected file.

.topic 0x71
Shows the number of bytes in the detected file.

.topic 0x82
Click this button to view additional information about the virus identified.

.topic 0x8d
Click this button to select a quarantine location for the detected file.

.topic 0x92
Displays the name of the virus infecting the e-mail attachment. For more information about the virus, click Info.

.topic 0xb5
Select this checkbox to have the VirusScan application notify you it has detected a virus or harmful object.

.topic 0xea
Click this button to close this property page or dialog box without saving any changes you have made.

.topic 0xff
Select this checkbox to have this task run each Saturday at the time you set.

.topic 0x103
This line tells you how many items the scan operation detected as of the moment you opened the Task Properties dialog box.

.topic 0x10f
This line tells you how many items the System Scan module detected as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x115
This line tells you how many detected items the System Scan module moved to a quarantine folder as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x120
This item tells you how many detected items the E-Mail Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x134
This item identifies the last ActiveX control that the Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x144
Select an entry shown in the target list, then click this button to delete that entry.

.topic 0x168
Click this button to choose a quarantine folder into which the VirusScan application will move any detected files. You can also enter the path to the quarantine folder you want to use in the text box provided. By default, the VirusScan application sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x17a
This list identifies which disks, folders, or individual files you want to exclude from scan operations. By default, the VirusScan application does not scan the Recycle Bin, so this item will appear in the list when you first open the window. Each entry lists a path to the item, notes whether the application will also exclude any nested folders within the target, and explains whether the application will exclude the item when it scans files, when it scans your hard disk boot sector, or both. If you click Run Now in the Task Properties dialog box, the application will scan the targets shown here. To change the list: Click Add to exclude a new item. You can exclude up to 100 unique scan targets.  Select one of the items shown, then click Edit to change the item definition. Select one of the items shown, then click Remove to delete an item from the list. This means that the VirusScan application will scan the item during its next operation.

.topic 0x17c
Select an entry shown in the exclusion list, then click this button to change the definition for that entry. The Edit Exclude Item dialog box will appear.

.topic 0x189
Click this button to start the AutoUpgrade task. This will run the task with default settings or with the settings you choose. To change the settings for this task, click Configure. To set a schedule for this task, click the Schedule tab.

.topic 0x192
Select a site shown in the list to the left, then click this button to move the site higher in the list. The AutoUpgrade task tries to download new files from each site in turn, starting from the top of the list. Moving a site up increases its priority for the task.

.topic 0x19b
Click this button to tell the AutoUpgrade utility to use your standard network configuration to look for new files on your local computer or on a computer elsewhere on your network. Next, use Universal Naming Convention (UNC) notation to enter in the text box labeled Select a computer and directory where the AutoUpgrade utility can find the new files you want to download. You can also click Browse to locate the directory you want. To use UNC notation, you must either use the same account you used to log into your network, or specify a user name and password to log into your network. To use the current account, select the Use Logged In Account checkbox. On Windows NT Workstation v4.0 and Windows 2000 Professional systems, selecting the Use Logged In Account checkbox has slightly different effects. If you’ve scheduled your file upgrade, the AutoUpgrade utility will use its own service account to log on to the upgrade server and download new files. If you click Upgrade Now, the AutoUpgrade utility will use the same account you used to log on to your network to connect to the upgrade server. Either account must have Administrator rights on your local computer—or, in other words, be a part of the Local Administrators group—to install new scan engine or any program files that replace existing VirusScan services. To use a custom account, clear the Use Logged In Account checkbox, then click UNC login information to enter account data.

.topic 0x1ad
Use this text box to specify options, command switches, and similar parameters that will govern how your scan task will run. You may leave this text box blank, or you may specify options that the AutoUpdate utility will use to run its update operation.

.topic 0x1bf
To enter a UNC pathname to locate the server you want the AutoUpdate utility to use to download new .DAT files, click this button when it reads Browse. When you locate the server, the path or the site URL appears in the text box to the left. To tell the AutoUpdate utility to download new files from the McAfee VirusScan FTP site, click this button when it reads Default.

.topic 0x1cb
Select this checkbox to save the new .DAT files the AutoUpdate utility downloads for future use. Next, enter the location where you want the utility to save the files it downloads, or click Browse to locate a suitable directory.

.topic 0x1d1
This line identifies the last file, complete with pathname, that the System Scan module examined during the current scan operation. If the scanner is not active at the moment, this line identifies the last file the scanner examined during its most recent scan operation.

.topic 0x1ee
This row tells you how many Java classes or applets the Internet Filter module examined before you opened the Task Properties dialog box and, of those, how many it kept away from your computer. If the module is not active at the moment, this row tells you how many classes or applets the module scanned and how many it blocked during its most recent scan operation.

.topic 0x1ef
This item tells you how many Java classes or applets the Internet Filter module has examined during the current scan operation. If the module is not active at the moment, this line tells you how many classes or applets the module examined during its most recent scan operation.

.topic 0x1fa
Click this button to have the E-Mail Scan extension look for viruses in all e-mail messages stored in your Microsoft Exchange or Microsoft Outlook Inbox, whether you have read them or not. If you have a large volume of messages stored in your Inbox, such a scan operation can take considerable time. If, however, you installed the E-Mail Scan extension after you have installed and used your mail system for some time, McAfee recommends that you perform at least one such scan operation to ensure that your older mail messages do not contain viruses. To restrict this scan operation so that it examines only unread messages, select the Scan unread messages only checkbox. The E-Mail Scan extension scans the messages themselves, as Microsoft Exchange files can carry embedded macros, Hyper Text Markup Language (HTML) tags, and VBScript applets, all of which can in turn harbor specialized viruses, worms, or Trojan horse programs. The extension will also automatically scan any file attachments included with each message according to the configuration options you set elsewhere in this property page. Note: The E-Mail Scan extension connects directly to the Inbox on your Microsoft Exchange mail server to run its scan operations. It does not scan messages stored in Microsoft Outlook personal folders (.PST files) or archived items. Other VirusScan components, however, will scan .PST files during their own regular scan operations unless you specifically exclude them.

.topic 0x1fc
Click this button to have the E-Mail Scan extension look for viruses only in messages you have not yet read. The extension will examine unread messages within the range you specify elsewhere in the Messages to Scan area—either all messages in your Inbox or a range of messages that you select. This includes any messages that you merely preview in the Outlook message window, until you open them or mark them as read. Note: The E-Mail Scan extension connects directly to the Inbox on your Microsoft Exchange mail server to run its scan operations. It will not scan unread messages stored in Microsoft Outlook personal folders (.PST files) or archived items. Other VirusScan components, however, will scan .PST files during their own regular scan operations unless you specifically exclude them.

.topic 0x203
Select one of the file name extension entries shown in the list, then click this button to delete that entry.

.topic 0x21d
Select this checkbox to summarize the actions that the E-Mail Scan extension took during each scan operation in the file MAILSCAN.TXT. The extension will record its actions as soon as you quit your e-mail application or when you shut your system down. MAILSCAN.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x221
Click or type a size limit, in kilobytes, for the MAILSCAN.TXT log file or another log file you specify. When the file reaches the maximum size you set, the E-Mail Scan extension first clears it, then starts the log again.

.topic 0x229
Select this checkbox to have the MAILSCAN.TXT file record the date and time at which the E-Mail Scan extension starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x24a
Select the E-Mail Scan module icon to the left, then click each of these tabs in turn to enable the module and set options for it. The configuration options are: Detection. This property page tells the module which e-mail system you have so that it can scan incoming mail for viruses. It also governs what sorts of files to look for. Action. This property page tells the module what to do when it finds a virus. You can have the module give you options to choose on the fly, or you can have it dispose of the infection automatically by deleting the file, moving the file to a quarantine folder, or simply continuing the scan operation without taking action. Alert. This property page tells the module how to notify you that it has found a virus. You can have it display a message or an audible alert tone. You can also have it send an e-mail reply to the person who sent you the detected attachment, or an e-mail warning to others on your network. Report. This property page tells the module what information to record in its log file. You can also designate a text file to serve as the log file.

.topic 0x25a
Select this checkbox to have the System Scan module look for viruses in compressed files and file archives. Although it does give you better protection, scanning compressed files or archives can lengthen each operation slightly, especially if your computer is processing a large volume of files.

.topic 0x260
Select this checkbox to have the E-Mail Scan module scan mail attachments you receive via a mail system that runs within your office network. Usually such systems use a proprietary mail protocol and have a central mail server to which you send mail for delivery. Often such systems send and receive Internet mail, but they usually do so through a gateway application. The E-mail Scan module supports two types of corporate e-mail systems: MAPI and Lotus cc:Mail v6.0 and v7.0.

.topic 0x263
Select this checkbox to have the Download Scan module scan Internet mail attachments that you send and receive via Post Office Protocol (POP-3) or Simple Mail Transfer Protocol (SMTP) mail services. Choose this option if you work from home or through a dial-up Internet service provider with such software as Qualcomm’s Eudora Pro, Microsoft’s Outlook Express, or Netscape Mail. Note: To have VShield look for viruses that arrive via POP-3 or SMTP mail, you must configure your settings in the Download Scan property page.

.topic 0x26c
Select this checkbox to have the E-Mail Scan module look for viruses in compressed files and file archives. Although it does give you better protection, scanning compressed files or file archives can lengthen each operation, especially if your computer must process a large volume of mail.

.topic 0x272
Select this checkbox to have the Download Scan module look for viruses in compressed files or file archives. Although it does give you better protection, scanning compressed files and file archives can lengthen download times, especially if your computer must process a large file volume.

.topic 0x275
Select this checkbox to have the Internet Filter module look for and block harmful ActiveX and .OCX controls. The Internet Filter module will compare the objects you encounter as you visit Internet sites with an internal list of objects it knows can cause harm, and will alert you if it finds a match.

.topic 0x27e
Select this checkbox to have the System Scan module offer you the option to move any detected items to a quarantine folder. When the module finds a virus, it will display an alert message. Selecting the Move file checkbox here causes a Move file to button to appear in the alert message. Click that button to specify a destination for the detected item.

.topic 0x296
Choose an item from this list to specify what you want the Internet Filter module to do when it finds a hostile Java class or applet, ActiveX control, or potentially dangerous Internet site. You can either have the module prompt you to permit or deny access to the hostile object or site, or you can have the module automatically block the object or site. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the Internet Filter module to prompt you with a message, a beep, or both.

.topic 0x2b3
Select this checkbox to have the VSHLOG.TXT file record how many viruses the System Scan module deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2b5
Select this checkbox to have the VSHLOG.TXT file record your System Scan module settings when you stop the scanner or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2cc
Select this checkbox to have the WEBINET.TXT file record your Download Scan module settings when you stop the scanner or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x2fc
Select this checkbox to have the VirusScan Console start as soon as you start your computer. The Console must be running in order to execute any tasks you have scheduled, including scan tasks, AutoUpgrade tasks, and AutoUpdate tasks. You do not need to start the Console to start the VShield scanner, however.

.topic 0x2fd
Use this setting to specify how many scan tasks can appear in the VirusScan Console window. By default, 50 items can appear in the list. If you add more than 50 items, task execution might affect your system performance. You may not set the value here to fewer than five items.

.topic 0x30d
The total number of suspicious e-mail messages blocked during your current e-mail session.

.topic 0x7b
This area displays the warning message defined on the Alert property page.

.topic 0x8f
Displays the identification of the person who sent the e-mail message.

.topic 0xa1
Click this button to stop a scan operation in progress.

.topic 0xa4
Click  to choose your scan target from this list. You can have the VirusScan application look for viruses in these targets: My Computer. This tells the application to look for viruses on all mounted or mapped hard disks and removable media. To see the specific targets the application will scan, double-click your My Computer icon. All removable media. This tells the application to look for viruses on floppy disks, CD-ROMs, and other removable media. All fixed disks. This tells the application to look for viruses on all local hard disks. All network drives. This tells the application to look for viruses on all mapped hard disks or other network disks.

.topic 0xca
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the VirusScan application looks for boot-sector viruses. These viruses usually appear in memory or in files that reside in your hard disk’s boot sector or master boot record. If you select only this checkbox, the application will still scan the item you excluded if it appears elsewhere on your hard disk. To exclude the item in all instances, select the File scanning checkbox also.

.topic 0xe8
Re-enter your password exactly as you typed it in the previous text box.

.topic 0x108
This item tells you how many detected items the scan operation deleted as of the moment you opened the Task Properties dialog box.

.topic 0x109
This line tells you how many detected items the scan operation moved to a quarantine folder as of the moment you opened the Task Properties dialog box.

.topic 0x10d
This page shows you what results the System Scan module produced when it last ran. The System Scan module runs from the time you enable it until you stop it. Ordinarily, it will start when you start your computer and stop when you restart or shut down your computer. As it runs, the module records how many files it scanned in total, how many of those it found viruses in, and how many of those detected files it cleaned, deleted, or moved to a quarantine folder. These figures do not, however, update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figures there will change to reflect your actions as you perform normal system activity.

.topic 0x114
This item tells you how many detected items the System Scan module deleted as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x129
This line tells you how many detected items the Download Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x130
This item tells you how many files the Download Scan module examined as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x163
Select this checkbox to have the VirusScan application offer you the option to delete any detected items. When the application detects a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0x16b
Select this checkbox to have the VirusScan application add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0x176
Select this checkbox to have the VSCLOG.TXT file record your VirusScan application settings when you quit the application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x185
Use this dialog box to specify how this task should run and with what options, determine what it should do after it completes a scan operation, and protect the configuration options you set. Note: You may not rename the AutoUpgrade task. The description text box is unavailable on this property page. Right-click each button, list, or checkbox for more information.

.topic 0x187
Use this text box to specify options, command switches, and similar parameters that will govern how this task will run. You may leave this text box blank, or you may specify options that the AutoUpgrade utility will use to determine how it will run its upgrade operation.

.topic 0x1aa
Select this checkbox to restart your system automatically when Setup finishes installing new program files. Some systems require you to restart in order for the new files to activate, but if you want to restart your system at a more convenient time, clear this checkbox.

.topic 0x1cd
Select the Save the Upgrade files for later usage checkbox, then click this button to locate a suitable directory. When you locate the directory, the path will appear in the text box to the left.

.topic 0x1e1
Click this button to close the E-Mail Scan Status dialog box.

.topic 0x1f2
This item tells you how many ActiveX controls the Internet Filter module has examined during the current scan operation. If the module is not active at the moment, this item tells you how many controls the module examined during its most recent scan operation.

.topic 0x1f3
This item tells you how many hostile ActiveX controls the Internet Filter module kept away from your computer before you opened the Status dialog box. If the module is not active at the moment, this item tells you how many hostile controls the module examined during its most recent scan operation.

.topic 0x20d
Click this button to choose a quarantine folder into which the E-Mail Scan extension will move any detected files. By default, the E-Mail Scan extension sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0x220
Click or type a size limit, in kilobytes, for the MAILSCAN.TXT log file or another log file you specify. When the file reaches the maximum size you set, the E-Mail Scan extension first clears it, then starts the log again.

.topic 0x228
Select this checkbox to have the MAILSCAN.TXT file summarize the actions that the E-Mail Scan extension took during each scan operation. The log will record: How many files the extension examined. How many detected files the extension cleaned. How many detected files the extension deleted. How many detected files the extension moved to a quarantine folder. Your extension settings. The MAILSCAN.TXT file records this information when you quit your e-mail application or when you shut your system down. Clear this checkbox to leave this information out of the log file.

.topic 0x238
Click Configure to open a dialog box where you can set a relative priority for ScreenScan operations with respect to other system operations, and where you can specify the log file in which the utility will record its results.

.topic 0x23a
Click to choose your scan target from this list. You can have the ScreenScan utility look for viruses in these targets: All local drives. This tells the utility to look for viruses on all local hard disks and any removable media currently mounted on your system. Drive or folder. This tells the utility to look for viruses on a particular drive or in a particular folder that you specify. Enter the path the drive or folder in the text box provided, or click Browse to locate a suitable scan target. All fixed drives. This tells the application to look for viruses on all local hard disks. The utility will not scan any removable media.

.topic 0x248
Click this button to save your settings without closing the property page or dialog box. Note: Once you click this button to save your settings, clicking Cancel will not undo your changes.

.topic 0x253
Select this checkbox to have the System Scan module look for viruses whenever your computer or another computer creates, copies, modifies, renames, or saves a file on your hard disk.

.topic 0x265
This section identifies the e-mail folders in your computer that the E-mail Scan module looks at for Viruses.  Example: .pst file.

.topic 0x27f
Select this checkbox to have the System Scan module offer you the option to stop a scan operation immediately, but deny further access to any detected item. This option leaves the file intact and in its original location on your computer, but it prevents you from opening, copying, renaming, or otherwise modifying the file. When the module finds a virus, it will display an alert message. Selecting the Stop access checkbox here causes a Stop button to appear in the alert message.

.topic 0x283
Click this button to have the System Scan module display a standard graphical alert message when it finds a virus. The graphical alert message offers a range of response options that does not include Continue access. Your system will continue with normal operations in the background as it awaits your response.

.topic 0x28c
Select this checkbox to have the E-Mail Scan module offer you the option to ignore any of the detected items and continue the scan operation. When the module finds a virus, it will display an alert message. Selecting the Continue scan checkbox here causes a Continue button to appear in that message.

.topic 0x293
Select this checkbox to have the Download Scan module offer you the option to ignore any of the detected items and continue the scan operation. When the module finds a virus, it will display an alert message. Selecting the Continue scan checkbox here causes a Continue button to appear in that message.

.topic 0x29e
Select the Send alert mail to user checkbox to warn another user on your network—your system administrator, for example—that your E-Mail Scan module detected an e-mail attachment. Next, click this button to compose your own message.

.topic 0x29f
Select this checkbox to send an alert message as a reply to the person who sent you the detected e-mail attachment. Next, click Configure to compose your own reply.

.topic 0x2a3
Select Display custom message, then use this text box to enter the custom alert message you want the E-Mail Scan module to display when it finds a virus. If you select Prompt for user action in the Action property page, your custom alert message will appear in a dialog box that offers you response options. If you do not select Prompt for user action, you may not edit the custom message.

.topic 0x2b0
Click this button to locate an existing text file to use for the System Scan module log. By default, the System Scan module records log data in the file VSHLOG.TXT. You may have the module record log data in a different file, but the text file must already exist. The module will not create a new file.

.topic 0x2bf
Select this checkbox to have the WEBEMAIL.TXT file record how many viruses the E-Mail Scan module deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2c6
Select this checkbox to limit the size of the WEBINET.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 256K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the Download Scan module first clears it, then starts the log again from where it left off.

.topic 0x2db
Type the three-character extension that identifies the file type you want the VShield scanner to look for during scan operations. Do not include the dot that normally precedes a file name extension.

.topic 0x2e3
Enter the filename and path for the item you want the System Scan module to exclude from scan operations. You can also click Browse to locate the file or folder you want to exclude.

.topic 0x2e4
Click this button to locate the file or folder you want the System Scan module to exclude from scan operations. The name and path to the item you select will appear in the text box to the left. You can also type the path and filename for the item you want to exclude in the text box to the left.

.topic 0x2ee
This list identifies which Uniform Resource Locators (URLs) you want the Internet Filter module to block whenever you or someone else tries to connect to them. By default, the list includes two sites that download hostile Java or ActiveX objects to your machine as soon as you connect.  URLs specify the name and location of a computer on the Internet, usually together with the "transport protocol" you want to use to request a resource from that computer. A complete URL for a website, for instance, would look like: http://www.domain.com To add a site to this list, you can enter either the domain name itself, since the module will assume you mean the Hyper Text Transport Protocol (HTTP), or you can add the complete domain name, including the protocol. Use this option to designate sites that require different protocols, such as File Transfer Protocol (FTP) sites. Choose either of these options to change the list: Click Add to enter a new address in the Add URL dialog box. Select one of the items shown, then click Delete to remove the item from the list.

.topic 0x2f9
Click the top and bottom arrows or enter a figure in the text box provided to specify how many items can appear in the VShield System Scan module’s exclusion list and in the exclusion list for any VirusScan application scan task or any scan task you configure from within the VirusScan main window. By default, 100 items can appear in the list. You may not set the value here to fewer than five items.

.topic 0x303
Select this checkbox to alert you when there has been an attempt to send 2 to 20 e-mail messages within 3 to 60 seconds.

.topic 0x307
Select this checkbox to alert you when your are about to open an e-mail attachment that contains a file extension in the list of extensions that you do not allow.

.topic 0
This area displays the name of the detected file and the name of the detected virus.

.topic 0x7c
Click this button to proceed with scanning without taking any action now.

.topic 0x98
Click this button to add an entry to the target list. The Add Scan Item dialog box will appear.

.topic 0xc1
Select this checkbox to have the VSCLOG.TXT file record the date and time at which the VirusScan application starts each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0xe9
Click this button to save the changes you made and to close this property page or dialog box.

.topic 0x101
This page shows you what results this scan task produced when it last ran. As it runs, the task records how many files it scanned in total, how many of those it found viruses in, and how many of those detected files it cleaned, deleted, or moved to a quarantine folder. Each task displays these results for its own operations, which allows you to track the effectiveness of each scanning configuration you create.

.topic 0x117
This line tells you how many files the System Scan module examined as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x11d
This line tells you how many detected items the E-Mail Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the E-Mail Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x133
This line identifies the last Java class or applet that the Internet Filter module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x150
Select this checkbox to have the VirusScan application look for viruses in any subfolders inside the folder you chose as your scan target. Note: Choosing Include subfolders causes the application to scan only those files stored in the subfolders themselves. The application will not scan files stored at the root level of the folder you designate. To scan those files, clear the Include subfolders checkbox.

.topic 0x161
Choose an item from this list to specify what you want the VirusScan application to do when it detects a virus. When you choose an item, the area beneath the list will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt user for action from the list, click the Alert tab to specify whether you want the VirusScan application to prompt you with a message, a beep, or both.

.topic 0x180
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the VirusScan application looks for file-infecting viruses. These viruses usually appear in files stored in the visible portions of your hard disk. If you select only this checkbox, the application will still scan the item you excluded if it appears in your hard disk’s boot sector or in memory. To exclude the item in all instances, select the Boot sector scanning checkbox also.

.topic 0x184
Click this button to open a dialog box where you can enter a password to secure your configuration options for this task.

.topic 0x18f
Click this button to add a new download site to the list shown to the left. This opens the Automatic Upgrade Properties dialog box, where you can configure an entirely new site definition and properties.

.topic 0x193
Select a site shown in the list to the left, then click this button to move the site lower in the list. The AutoUpgrade utility tries to download new files from each site in turn, starting from the top of the list. Moving a site down decreases its priority for the task.

.topic 0x1a9
Select the Save the Upgrade files for later usage checkbox, then click this button to locate a suitable directory. When you locate the directory, the path will appear in the text box to the left.

.topic 0x1af
Click this button to start the AutoUpdate task. This will run the task with default settings or with the settings you choose. To change the settings for this task, click Configure. To set a schedule for this task, click the Schedule tab.

.topic 0x1c7
Select this checkbox to have the AutoUpdate utility copy and store the .DAT files you have installed on your system before it downloads new files.

.topic 0x1e7
Click this button to enable or disable this module. If the module is active, the button reads Disable. If the module is idle, the button reads Enable.

.topic 0x1eb
This item identifies the last Java class or applet that the Internet Filter module examined before you opened the Task Properties dialog box. If the module is not active at the moment, this line tells you which class or applet the module last examined during its most recent scan operation.

.topic 0x1f6
This item tells you how many potentially dangerous Internet sites the Internet Filter module blocked during the current scan operation. If the module is not active at the moment, this item tells you how many potentially dangerous sites the module blocked during its most recent scan operation.

.topic 0x1f8
Click this button to open the VShield Properties dialog box. There you can configure scan, response, alert, report, and other options for each VShield module.

.topic 0x208
Select this checkbox to have the E-Mail Scan extension offer you the option to clean any detected items. When the extension finds a virus, it will display an alert message. Selecting the Clean file checkbox here causes a Clean button to appear in that message.

.topic 0x209
Select this checkbox to have the E-Mail Scan extension offer you the option to delete any detected items. When the extension finds a virus, it will display an alert message. Selecting the Delete file checkbox here causes a Delete button to appear in that message.

.topic 0x212
Select this checkbox to send an alert message as a reply to the person who sent you the detected e-mail attachment. Next, click Configure to compose your own reply.

.topic 0x21a
Enter the e-mail addresses for those recipients to whom you want to send a copy of the alert message the E-Mail Scan extension sends when it finds a virus. To choose recipients from your e-mail server address book, click the Cc: button to the left. The recipients you choose will appear in this text box. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan extension will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x25f
Select this checkbox to have the E-Mail Scan module look for viruses in e-mail file attachments you receive. Selecting this checkbox activates the remaining options in this property page. Clear this checkbox to disable all configuration options in this page and to prevent the E-Mail Scan module from examining your e-mail.

.topic 0x2a6
Select this checkbox to have the Download Scan module add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0x2b1
Select this checkbox to have the VSHLOG.TXT file record how many viruses the System Scan module detects during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2bb
Select this checkbox to limit the size of the WEBEMAIL.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 256K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the E-Mail Scan module first clears it, then starts the log again from where it left off.

.topic 0x2c5
Select the Log to file checkbox to summarize the actions that the Download Scan module took during each scan operation in the file WEBINET.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file. The module will record its actions as soon as you stop the scanner or when you shut your system down.

.topic 0x2d0
Select this checkbox to limit the size of the WEBFLTR.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 256K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the Internet Filter module first clears it, then starts the log again from where it left off.

.topic 0x2e2
Type the message you want to send to the recipients you specified above. The E-Mail Scan module will precede your message with a brief report, shown as <Virus Information> in the dialog box, that describes the virus and names the file in which it appeared.

.topic 0x2e7
Select this checkbox to exclude the item you specified at the top of this dialog box from scan operations in which the System Scan module looks for boot-sector viruses. These viruses usually appear in memory or in files that reside in your hard disk’s boot sector or master boot record. If you select only this checkbox, the application will still scan the item you excluded if it appears elsewhere on your hard disk. To exclude the item in all instances, select the File scanning checkbox also.

.topic 0x309
This section provides you with the subject of the last e-mail message scanned during your current e-mail session.

.topic 799
Check this check box to have the VirusScan application scan for viruses in MIME (Multipurpose Internet Mail Extension) encoded files or UU-Encoded (UNIX to UNIX Encoded) files.

.topic 796
Click Clear List to remove all of the scripts diplayed in the Trusted Scripts list box.

.topic 0x6b
Enter your cc:Mail user identification.

.topic 0x78
VirusScan selects this box if the detected file is a hidden file. See your operating system documentation for definitions of file attributes.

.topic 0x90
Displays the subject of the e-mail message.

.topic 0xa6
Select this checkbox to have the VirusScan application look for viruses in any subfolders inside the folder you chose as your scan target. Note: Choosing Include subfolders causes the application to scan only those files stored in the subfolders themselves. The application will not scan files stored at the root level of the folder you designate. To scan those files, clear the Include subfolders checkbox.

.topic 0xc6
Select an entry shown in the exclusion list, then click this button to delete that entry.

.topic 0xdd
Click this button to tell the VirusScan application to always quit immediately after it completes this scan task. If you choose Hidden Mode in the Interface Type list, this is your only option.

.topic 0xed
Use this text box to specify options, command switches, and similar parameters that will govern how your scan task will run. You may leave this text box blank, or you may specify options that the VShield scanner will use to shape the scope and results of its scan operation.

.topic 0x10b
This line tells you how many files the scan operation examined as of the moment you opened the Task Properties dialog box.

.topic 0x136
This column tells you how many Java or ActiveX objects and how many Internet sites the VShield Internet Filter module examined before you opened the Task Properties dialog box. These figures do not update dynamically. To see dynamically updating figures, double-click the VShield icon in the Windows taskbar, then click the Internet Filter tab. The figures there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x16e
Select the Log to file checkbox to summarize the actions that the VirusScan application took during each scan operation in the file VSCLOG.TXT. If you would prefer to log this data to a different text file, enter its path and filename here, or click Browse to locate the file. The application will not generate a text file—it will write only to an existing file. The application will record its actions whenever it finishes a scan task or when you shut your system down.

.topic 0x171
Click this button to locate an existing text file to use for the VirusScan application log. By default, the VirusScan application records log data in the file VSCLOG.TXT. You may have the module record log data in a different file, but the text file must already exist. The application will not create a new file.

.topic 0x172
Select this checkbox to have the VSCLOG.TXT file record how many viruses the VirusScan application finds during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x19c
Click this button to tell the AutoUpgrade utility to look for new files on an FTP site you designate. Next, enter in the text box labeled Enter an FTP computer name and directory the Uniform Resource Locator (URL) for the FTP site that holds the new files you want to download. Using an FTP server allows you to download files from a much wider range than you might be able to reach on your local area network. To use an FTP site, you must either have the site set for anonymous FTP login, or you must designate the user name and password for an account on the site. To have the utility use an anonymous login, select the Use anonymous FTP login checkbox. To specify an account, clear the Use anonymous FTP login checkbox, then click FTP login information to enter account data. If your network uses a proxy server, select the Use proxy server checkbox, then enter the server name and the port it uses in the text boxes provided.

.topic 0x1a3
Select this checkbox to have the AutoUpgrade utility connect through your network’s proxy server to the FTP site you designated. Next, enter the path to and name of the proxy server, together with the port number it uses, in the text boxes provided. Note: The AutoUpgrade utility will not allow proxy connections that require challenge-response proxy authentication.

.topic 0x1c9
Select this checkbox to tell the AutoUpdate utility to install the .DAT files it downloads, even if they have the same version number as those you already have installed. Ordinarily, the utility will not download .DAT files that have the same version number, or an older number, than the .DAT files already installed on your system. In some circumstances, however, you might want to download .DAT files with the same or an older version number. If your .DAT files have become corrupted and you want to replace them, for example, or if you want to revert to an earlier .DAT file version, select this checkbox to force the utility to install the files it downloads.

.topic 0x1cc
Select the Save the Upgrade files for later usage checkbox, then enter in this text box the location where you want the utility to save the files it downloads. You can also click Browse to locate a suitable directory.

.topic 0x1d3
This line tells you how many detected files the System Scan module has found during the current scan operation. If the scanner is not active at the moment, this line tells you how many detected files the scanner found during its most recent scan operation.

.topic 0x1e3
This item tells you how many downloaded files the Download Scan module examined during the current scan operation. If the module is not active at the moment, this item tells you how many downloaded files the module examined during its most recent scan operation.

.topic 0x1ed
This item identifies the last ActiveX control that the Internet Filter module has examined during the current scan operation. If the module is not active at the moment, this line tells you which control the module last examined during its most recent scan operation.

.topic 0x1f5
This item tells you how many Internet sites the Internet Filter module examined before you opened the Status dialog box. If the module is not active at the moment, this item tells you how many sites the module examined during its most recent scan operation.

.topic 0x1f9
Click this button to close the Internet Filter Status dialog box.

.topic 0x222
Click this button to locate an existing text file to use for the E-Mail Scan extension log. By default, the E-Mail Scan extension records log data in the file MAILSCAN.TXT. You may have the module record log data in a different file, but the text file must already exist. The extension will not create a new file.

.topic 0x224
Select this checkbox to have the MAILSCAN.TXT file record how many viruses the E-Mail Scan extension cleans during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x232
Click this button to have the ScreenScan utility look for viruses in any file on your hard disk, whatever its extension. This option might slow system operations down if your computer must scan a large volume of files, but it will ensure that your computer is virus-free.

.topic 0x24b
Select the Download Scan module icon to the left, then click each of these tabs in turn to enable the module and set options for it. The configuration options are: Detection. This property page tells the module to scan files you download from the Internet. It also governs what sorts of files to look for. Action. This property page tells the module what to do when it finds a virus. You can have the module give you options to choose on the fly, or you can have it dispose of the infection automatically by deleting the file, moving the file to a quarantine folder, or simply continuing the scan operation without taking action. Alert. This property page tells the module how to notify you that it has found a virus or dangerous object. You can have it display a message or play an audible alert tone. Report. This property page tells the module what information to record in its log file. You can also designate a text file to serve as the log file.

.topic 0x251
Select this checkbox to have the System Scan module look for viruses whenever your computer or another computer creates or writes a new file on your hard disk. McAfee strongly recommends that you select this and all other checkboxes in the Scan Files On area to ensure maximum protection.

.topic 0x256
Select this checkbox to have the System Scan module look for viruses on any floppy disks that you leave in your drive as you shut down your computer. This scan operation ensures that no viruses can load when your computer reads the floppy disk at startup.

.topic 0x259
Click this button to see the current extension list that the System Scan module will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x288
Choose an action from the When a virus is found list to specify what you want the E-Mail Scan module to do when it finds a virus. When you choose an action, this area will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the E-Mail Scan module to prompt you with a message, a beep, or both.

.topic 0x28f
Choose an item from this list to specify what you want the Download Scan module to do when it finds a virus. When you choose an item, the area beneath the list will display additional options or a text box you can use to enter a directory path. If no options exist for the item, you will see a description of what it does. If you choose Prompt for user action from the list, click the Alert tab to specify whether you want the Download Scan module to prompt you with a message, a beep, or both.

.topic 0x2ca
Select this checkbox to have the WEBINET.TXT file record how many viruses the Download Scan module deletes during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2de
If this text box is unavailable, the E-Mail Scan module will send this message directly to the person who sent you the detected attachment. Otherwise, enter the e-mail addresses for those recipients to whom you want to send an alert message when the E-Mail Scan module finds a virus. To choose recipients from your e-mail server address book, click the To: button to the left. The recipients you choose will appear in this text box. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan module will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x2ea
Select an item in the Banned IP Addresses list, then click this button to delete it.

.topic 0x2f3
Use this property page to: Tell the VShield background scanner to start when you start your computer Set the maximum number of items you can add to the VirusScan application’s scan target list Set the maximum number of items that can appear in the VirusScan application’s exclusion list Tell VirusScan to start when you start your computer Set the maximum number of items that can appear in the VirusScan task list Click Apply to save the changes you make to these settings without closing the control panel. Click OK to save your changes and close the control panel. Click Cancel to close the control panel without saving your changes. Note: The VirusScan management service module must restart itself and all active VirusScan components in order to implement any changes you make.

.topic 798
Check this check box to direct VirusScan to scan for programs that pose a security threat (such as password crackers) to your computer.

.topic 0x76
VirusScan selects this box if the detected file is a read-only file. See your operating system documentation for definitions of file attributes.

.topic 0x99
Select an entry shown in the target list, then click this button to change the definition for that entry. The Edit Scan Item dialog box will appear.

.topic 0x9b
Click this button to have the VirusScan application look for viruses in any file on your hard disk, whatever its extension. This option might slow system operations down if your computer must scan a large volume of files, but it will ensure that your computer is virus-free.

.topic 0xb4
Click this button to choose a quarantine folder into which the VirusScan application will move any detected files it finds. You can also enter the path to the quarantine folder you want to use in the text box provided. By default, the application sends detected files to a folder called \Infected, located inside the VirusScan program directory.

.topic 0xb6
Select this checkbox to have the VirusScan application beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0xdf
Click this button to specify that you want the VirusScan application to always remain open after it completes this scan task. If you run the task in normal scan mode, it will display the results of the scan operation and allow you to dispose of any viruses it detected, if you have not already set it to dispose of them automatically. You can then run the task again immediately, if you wish.

.topic 0x105
This line tells you how many detected items the scan operation cleaned as of the moment you opened the Task Properties dialog box.

.topic 0x111
This line tells you how many detected items the System Scan module cleaned as of the moment you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the System Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x126
This line identifies the last file, complete with pathname, that the Download Scan module examined before you opened the Task Properties dialog box. This figure does not update dynamically. To see a dynamically updating figure, double-click the VShield icon in the Windows taskbar, then click the Download Scan tab. The figure there will change to reflect your actions as you visit sites or download objects from the Internet.

.topic 0x143
Select an entry shown in the target list, then click this button to change the definition for that entry. The Edit Scan Item dialog box will appear.

.topic 0x148
Select this checkbox to have this task run immediately at its scheduled start time. If you clear this checkbox, the VirusScan application window appears at the time the task should start. You must then click Scan for Viruses Now in this window to run the task.

.topic 0x14c
Click this button to open a dialog box where you can enable and configure heuristic scanning. Heuristic scan technology enables VirusScan software to recognize new viruses based on their resemblance to similar viruses that the module already knows. The module looks simultaneously for file characteristics that rule out the possibility of virus infection, so it will rarely give you a false indication of a virus infection.

.topic 0x156
Type the three-character extension that identifies the file type you want the VirusScan application to look for during scan operations. Do not include the dot that normally precedes a file name extension.

.topic 0x15e
Click this button to see an online help topic that discusses this dialog box.

.topic 0x16d
Select this checkbox to summarize the actions that the VirusScan application took during each scan operation in the file VSCLOG.TXT. The application will record its actions whenever it finishes a scan task or when you shut your system down. VSCLOG.TXT will record the data you specify in the What to Log area below. If you would prefer to log this data to a different text file, enter its path and filename in the text box provided, or click Browse to locate the file. The module will not generate a text file—it will write only to an existing file.

.topic 0x170
Click or type a size limit, in kilobytes, for the VSCLOG.TXT log file or another log file you specify. When the file reaches the maximum size you set, the VirusScan application first clears it, then starts the log again from where it left off.

.topic 0x17e
Click this button to locate the file or folder you want the VirusScan application to exclude from scan operations. The name and path to the item you select will appear in the text box to the left.

.topic 0
This option is unavailable for this task. By default, setting a password for this task protects all task options.

.topic 0x197
Select this checkbox to limit the size of the VirusScan Activity Log. By default, the log file can increase to 100K (kilobytes) in size. However, the log file may not be less than 10K.

.topic 0x1ab
Use this dialog box to specify how this task should run and with what options, determine what it should do after it completes a scan operation, and protect the configuration options you set. Note: You may not rename the AutoUpdate task. The description text box is unavailable on this property page. Right-click each button, list, or checkbox for more information.

.topic 0x1d4
This line tells you how many detected files the System Scan module has cleaned during the current scan operation. If the scanner is not active at the moment, this line tells you how many detected files the scanner cleaned during its most recent scan operation.

.topic 0x1d5
This line tells you how many detected files the System Scan module has deleted during the current scan operation. If the scanner is not active at the moment, this line tells you how many detected files the scanner examined during its most recent scan operation.

.topic 0x1d8
Click this button to open the VShield Properties dialog box. There you can configure scan, response, alert, report, and other options for each VShield module.

.topic 0x1f1
This row tells you how many ActiveX controls the Internet Filter module examined before you opened the Task Properties dialog box and, of those, how many it kept away from your computer. If the module is not active at the moment, this row tells you how many classes or applets the module scanned and how many it blocked during its most recent scan operation.

.topic 0x1f4
This row tells you how many Internet sites the Internet Filter module examined before you opened the Task Properties dialog box and, of those, how many it blocked. If the module is not active at the moment, this row tells you how many classes or applets the module scanned and how many it blocked during its most recent scan operation.

.topic 0x20b
Select this checkbox to have the E-Mail Scan extension offer you the option to ignore any of the detected items and continue the scan operation. When the extension finds a virus, it will display an alert message. Selecting the Continue scan checkbox here causes a Continue button to appear in that message.

.topic 0x20f
Select this checkbox to have the E-Mail Scan extension notify it has detected a virus or harmful object.

.topic 0x22c
This list shows a default scan target, or identifies which disks or folders you’ve picked as scan targets for the ScreenScan utility. Each entry lists a path to the target and notes whether the utility will also scan any nested folders within the target. If you select the Enable scanning while in screen saver mode checkbox, the utility will scan the targets shown here as a background operation, as soon as your screen saver starts. To change the list: Click Add to include a new target. Select one of the items shown, then click Edit to change the target definition. Select one of the items shown, then click Remove to delete a target from the list. The ScreenScan utility will detect viruses lurking on your system, but it will not take any action against them. To see what the utility found during its scan operation, view the SCREENSCAN ACTIVITY LOG.TXT file. The file will record the names of any detected files and related information that you can use to dispose of any viruses on your system. Note: McAfee recommends strongly that you do not depend on the ScreenScan utility for all of your virus scanning requirements. Use this utility as a supplement to regular scan operations that you run with other VirusScan components.

.topic 0x230
Select this checkbox to have the ScreenScan utility look for viruses in compressed files and file archives. Although it does give you better protection, scanning compressed files and file archives can lengthen each operation slightly, especially if your computer is processing a large volume of files.

.topic 0x234
Click this button to see the current extension list that the ScreenScan utility will use to guide its scan operations. Use this list to confine your scan operations to those files most susceptible to detection. Doing so speeds up system performance and shortens scan times.

.topic 0x237
Click this button to open a dialog box where you can set a relative priority for ScreenScan operations with respect to other system operations, and where you can specify the log file in which the utility will record its results.

.topic 0x23b
Type the drive letter or the path to the folder you want scanned in the text box provided, or click Browse to locate a scan target on your computer.

.topic 0x25b
Select this checkbox to have the System Scan module look for viruses on any drives mapped to your system that you use in any way. This might slow your system down considerably, but will ensure that mapped drives do not spread viruses to your computer.

.topic 0x269
Click this button to have the E-Mail Scan module examine any attachment that arrives with any e-mail message, whatever its extension. This may slow e-mail processing down if you receive a large volume of e-mail, but it will ensure that your mail is virus-free.

.topic 0x299
Select this checkbox to have the System Scan module beep when a detection occurs. You can change the setting for this option only if you select Prompt for user action in the Action property page. Otherwise, the checkbox will display and use the setting it had when you last chose the Prompt for user action item. The "beep" will be the standard system warning beep or .WAV file you have your computer set to play. The module will simultaneously display an alert message that offers you response options. If you select the Display custom message checkbox, you can add a custom warning message to the alert box. Clear this checkbox to prevent the module from beeping when it finds a virus.

.topic 0x2a2
Select this checkbox to have the E-Mail Scan module add a custom message to the alert box it displays when a detection occurs. You can change the setting for this option only if you choose Prompt for user action in the Action property page. Otherwise, the checkbox will display the setting it had when you last chose the Prompt for user action item. If you do not choose the Prompt for user action item, no alert box will appear and you will not see a custom message even if this checkbox is selected. Enter the message you want the module to display in the text box provided. If you select the Sound audible alert checkbox, the module will simultaneously beep as it displays the alert box.

.topic 0x2ae
Select this checkbox to limit the size of the VSHLOG.TXT log file or another log file you specify in the text box provided. By default, the log file can grow to 100K in size. Enter the maximum size you prefer, in kilobytes, in the text box provided, or click  to set a size. If you clear this checkbox, the log file can grow until disk space or file system limitations stop it. When the file reaches the maximum size you set, the System Scan module first clears it, then starts the log again from where it left off.

.topic 0x2c9
Select this checkbox to have the WEBINET.TXT file record how many viruses the Download Scan module detects during each scan operation. Clear this checkbox to leave this information out of the log file.

.topic 0x2d6
Select an entry shown in the exclusion list, then click this button to delete that entry.

.topic 0x2df
Click this button to open your e-mail server address book. You can then choose additional recipients—your system administrator, for example—for the alert message the E-Mail Scan module sends when it finds a virus. Note: This dialog box allows you to set up an alert message "template." The E-Mail Scan module will send the message you enter here to the recipients you specify here each time it finds a virus. The module will not give you an opportunity to edit the message at the time it sends it.

.topic 0x2eb
Type the Internet Protocol (IP) address you want to add to the Banned IP Addresses list here. Be sure to format the address with periods between each number group.

.topic 0x302
Select this checkbox to have the HAWK module monitor e-mail subjects and size of the message body. If more than one message is about to be sent with similar subjects and message body sizes, then an alert message will display and you can choose to either continue or cancel. If you choose to Continue, then all e-mail messages will be sent. If you choose to Cancel, then all presumed duplicate e-mail messages will be stored in your Outbox for your review. Upon your review, you can choose to either send or delete the message(s).


Access (to a disk or file)

With reference to VShield scan operations, this means any modification you or some system process makes to a file. This could include opening, running, copying, saving, renaming, or otherwise changing the file.


Action property page

This set of configuration options lets you specify how the E-mail Scan extension will respond when it finds a virus. You can have it ask you what it should do, or take any of four different actions automatically.


ActiveX controls and Java classes

As the popularity of the Internet has grown, web-site design has become much more sophisticated. Many sites now include interactive elements such as scripts, forms, search engines, animations, and a host of other multimedia features that make web browsing more useful and more exciting. Much of the technology that makes these features possible comes from small, easily downloaded programs that interact with your browser software to exchange information, to display multimedia files, to formulate database queries, and to perform other tasks. Web-site designers and programmers use Java and ActiveX, among other tools to write these types of programs.

The Java programming language, which originated with Sun Microsystems, allows designers to write small, special-purpose applications, or "applets," that run on a Java "virtual machine" incorporated into your browser software, either directly or as a plug-in module. A Java "class" is a pre-written software module that programmers can modify for their own use.

Programmers use Microsoft ActiveX technology for similar purposes. ActiveX differs from Java primarily in how it runs—where Java runs in a virtual machine built specifically to interpret Java applets, ActiveX serves as a sophisticated software bridge between existing programs, or between other programs and Windows itself. An ActiveX "control" is a software module that links programs and allows them to share data without either having to know anything about how the other operates.

Java classes and ActiveX controls are, collectively, "objects."


Alert property page

This set of configuration options lets you tell the E-mail Scan extension to notify you when it finds a virus. VShield uses a variety of methods to notify you when this event occurs.


Boot sector

The boot sector is the first logical division of a hard disk or floppy disk. When you start a computer, its BIOS looks here for information it needs to load your operating system and related files.


Boot sector virus

A boot sector virus infects the hard disk or floppy disk boot sector and loads into memory as soon as your computer starts. From there, it can copy itself from disk to disk, usually from a floppy disk to a hard disk, then back to a floppy disk.

Brain, one of the first true viruses that infected personal computers, is a boot sector virus. Both Brain and its later descendants pioneered stealth and related techniques that allow them to evade detection. Although far less popular or prevalent than before, largely because floppy disks have declined as a transmission medium, boot sector viruses still represent a significant infection threat. The more sophisticated boot sector viruses can infect your computer's master boot record (MBR), or have evolved into multi-partite viruses.


Code signature

A code signature is a unique series of bytes that distinguishes virus code from other portions of a file or data. That signature could be a data pattern within the virus, an encryption or decryption routine, or another identifying characteristic. Most anti-virus software searches for traces of this signature in order to locate infected files. Some viruses use a distinctive signature to hang a sort of "do not disturb" sign on files they infect—if not for this signature, the virus might infect a file often enough to cause the file’s size alone to raise suspicion.

Much of the virus writer’s effort goes into finding ways to conceal the presence of this signature. Relatively ordinary viruses might employ such techniques as encryption, mutation, polymorphism, and stealth to conceal themselves or misdirect anti-virus software.


.DAT files

Virus definition, or .DAT, files contain up-to-date virus signatures and other information that McAfee anti-virus products use to protect your computer against the thousands of computer viruses in circulation. McAfee releases new .DAT files regularly to provide protection against the hundreds of new viruses that appear each month. To ensure that your anti-virus software can protect your system against the latest virus threats, download and install the latest .DAT files.


Detection property page

This set of configuration options lets you specify which e-mail messages you want the extension to scan, whether you want the extension also to scan attachments and compressed files, and whether you want it to use heuristic scanning.


E-mail Scanner

This VShield module scans e-mail you receive from corporate e-mail systems, usually over a local area network. The module can scan two general types of corporate e-mail systems: MAPI-based systems such as Microsoft Exchange and Microsoft Outlook.


E-mail client application

This means the application you run to send and retrieve your e-mail. The E-mail Scan extension works only with client applications that adhere to MAPI standards. This includes Microsoft Exchange and Microsoft Outlook.


Encrypted code signatures

Most anti-virus software relies, in part, on the presence of a code signature to find certain types of viruses. The code signature is a unique series of bytes that distinguishes virus code from other portions of a file or data. That signature could be a data pattern within the virus, an encryption or decryption routine, or another identifying characteristic. Some viruses use a distinctive signature to hang a sort of "do not disturb" sign on files they infect—if not for this signature, the virus might infect a file often enough to cause the file’s size alone to raise suspicion.

Some viruses can encrypt this signature to evade detection. Many such viruses also mutate or develop polymorphic variations for their code signatures or their encryption routines. This makes finding even the distinctive signature for the encryption routine, to say nothing of the virus itself, very difficult.

The encryption techniques they use can range from the simple to the very sophisticated. As with other concealment techniques, code signature encryption is not specific to one type of virus.


Exclusion property page

This set of configuration options lets you choose which items you want the VirusScan application to ignore during a scan operation. By default, you can specify up to 100 items in this property page.


File-infecting virus

File-infecting viruses attach themselves to executable programs, often encrypting their code or using other techniques to conceal their presence. A file-infecting virus hijacks the executable command that you use to start its host program in order to run itself. It will then often return control to the host program, in order to make your system operations appear normal.

When the virus runs, it can perform a number of operations, but most often it replicates itself and attaches itself to other executable files on your system, leaving a code signature to mark its presence so it does not try to infect the same file. The virus can also encrypt or mutate the code signature to make its detection difficult.

The infamous W32/CIH.SPACEFILLER virus is a sophisticated file-infecting virus with a dangerous payload that can overwrite your computer’s BIOS. It uses a number of tricks to conceal itself, including splitting itself into pieces and hiding within unused spaces inside the files it infects.


Heuristic scanning

This scanning technique looks for certain "virus-like" characteristics in files to see if they fit the profile for how viruses behave. If the application finds enough suspicious characteristics in a file, it flags the file as a potential virus. This technique allows the application to detect previously unidentified or unclassified viruses.

The technique also works in reverse to eliminate "false positive" virus detections. Here, the application looks for file characteristics that no virus could have or could plant into a target.


Inbound files

These are files that your computer or another system on the network saves or writes to local hard disks attached to your computer or to any network hard disks you have mapped to your system. To scan inbound files, you must select the Inbound files checkbox in the Detection property page for the System Scan module. To include network drives mapped to your system for a scan session, you must also select the Network drives checkbox. ]

Your system can receive data from your computer’s memory, from a floppy disk in your computer’s floppy drive, from other systems, from e-mail, or from other sources, then write that data to a file on your hard disk. The VShield scanner treats all such data as "inbound."


Internet Protocol (IP) address

An Internet Protocol (IP) address is a series of decimal numbers that identify an Internet site or resource. Computers connected to the Internet use this address to route messages to one another via the Internet Protocol, a series of common and widely understood rules that govern Internet traffic flow.

IP addresses consist of a group of four numbers separated by periods. Each number group can range in value from zero to 255. A legal IP address can be, for example, 128.128.128.0.

Although IP addresses are the "real" underlying address that identifies Internet resources, most people enter domain names or URLs into their browsers to locate those resources. A local or Internet-wide Domain Name System matches the URL to the corresponding IP address.


Java Classes and ActiveX Controls

Java classes and ActiveX controls are small, special-purpose programs written in the Java programming language developed by Sun Microsystems, or developed using Microsoft ActiveX technology. These programs, or "objects," often work as building blocks for constructing larger programs, or serve to add capabilities to existing programs. Many Web sites use Java classes or ActiveX controls to display animations or forms, run queries, and manipulate data.

Both technologies include safeguards designed to protect you from data loss or other types of harm. Nevertheless, determined programmers can exploit Java or ActiveX features to learn about the contents of your hard disk or corrupt your data. VirusScan software includes a database of classes and controls known to cause harm, and can block their actions.


Macro virus

Macro viruses arose shortly after some software vendors began incorporating macro languages in their products and allowing those products to produce "data" files that carried macro commands. The Microsoft Office product suite, for example, includes a variation of the Microsoft Visual Basic programming language that gives Microsoft Word and Microsoft Excel the ability to automate template and document creation. Concept, the first macro virus, appeared almost as soon as the Microsoft Word version that introduced macro capability.

Macro capabilities have since appeared in a number of software packages and have attracted legions of virus writers. Macro and script viruses now account for the overwhelming majority of circulating viruses and have only recently begun to give ground to late-generation worms, which spread via e-mail and Internet connections.

Script viruses differ from macro viruses mainly in that script viruses can often run in multiple product environments. A common language like VBScript can run routines in web servers and browsers, in Microsoft Outlook e-mail clients, and in other products that can interpret it. Scripting languages also tend to be more open-ended than macro languages, which can offer virus writers significant control over infected computers.


Messaging Application Programming Interface (MAPI)

MAPI is a Microsoft standard that governs how communications applications pass data back and forth between themselves. To install and work with MAPI-compliant applications, you must first set up Microsoft Messaging, a standard Windows component. To learn more, consult the documentation for Microsoft Exchange.


Multi-partite virus

A multi-partite virus acts both as a boot sector virus and as a file-infecting virus. It can travel via infected files, and can load itself into your hard disk’s or a floppy disk’s boot sector when it executes, where it can repeat the cycle. Very few modern viruses use only one of these infection methods—most use both methods, and a number of others besides.


Mutating code signatures

Most anti-virus software relies, in part, on the presence of a code signature to find certain types of viruses. The code signature is a unique series of bytes that distinguishes virus code from other portions of a file or data. That signature could be a data pattern within the virus, an encryption or decryption routine, or another identifying characteristic. Some viruses use a distinctive signature to hang a sort of "do not disturb" sign on files they infect—if not for this signature, the virus might infect a file often enough to cause the file’s size alone to raise suspicion.

Some viruses can change or "mutate" this signature under certain circumstances to try to evade detection. Many such viruses also encrypt their executable code to avoid detection, which makes them very difficult to find. But they often will leave traces of the decryption routine they use to "uncloak" themselves, which makes them vulnerable to good anti-virus software.

As with stealth techniques, code signature mutation is not specific to one type of virus.


New Scan button

This button makes the options you configured for this scan operation the default options that will govern future scan operations. This does not prevent you from making any changes—you can change your settings whenever you want, then click this button again to make your new settings the default settings.


.OCX

An .OCX file is a custom ActiveX control that incorporates a user interface.


On-access scan operation

VirusScan software provides two complementary methods you can use to scan your e-mail for viruses. The VShield E-mail Scan module is an on-access scanner, which means that it examines your e-mail as it downloads to your system and writes to your hard disk. It also looks for viruses whenever you or a system process opens, copies, saves, renames, or otherwise modifies a file attachment from an e-mail message. The E-mail Scan module loads into your computer’s memory and run continuously in the background, waiting for one of these events to occur. The module stops only when you stop it or when you restart your system.


On-demand scan operation

The E-mail Scan extension that loads along with your Microsoft Exchange, Outlook, or other supported e-mail client allows you to scan your Inbox yourself, at a time convenient for your needs. Unlike the VShield module’s on-access scan operations, the E-mail Scan extension’s on-demand scan operation runs until it has scanned the items in your Inbox that you asked it to examine.


Outbound files

These are files that your computer or other systems on the network read from local hard disks attached to your system or from network disks mapped to your system. To scan outbound files, you must select the Outbound files checkbox in the Detection property page for the System Scan module. To include network drives mapped to your system for a scan session, you must also select the Network drives checkbox. Whenever your computer or another system reads data from a file stored on a local hard disk attached to your system or a network disk mapped to your system, the System Scan module treats that data as "outbound."


Polymorphic code signatures

Most anti-virus software relies, in part, on the presence of a code signature to find certain types of viruses. The code signature is a unique series of bytes that distinguishes virus code from other portions of a file or data. That signature could be a data pattern within the virus, an encryption or decryption routine, or another identifying characteristic. Some viruses use a distinctive signature to hang a sort of "do not disturb" sign on files they infect—if not for this signature, the virus might infect a file often enough to cause the file’s size alone to raise suspicion.

Some viruses can change or mutate this code signature repeatedly, each time they copy themselves, to avoid detection. Some viruses employ code signature encryption to appear polymorphic, since encryption will change their distinctive code signatures.

An example of an advanced virus of this type is Hare which, though now rare, could travel via a floppy disk boot sector or as part of an infected file. It loaded itself into memory when it executed, and could overwrite part of the hard disk master boot record (MBR). Hare used polymorphic techniques regularly to avoid detection.


Report property page

This set of configuration options lets you specify what items each VShield scanner will record in its log file. This property page is available for all VShield modules except the Security module.


Scan session

A scanning session lasts for that period of time that the VShield scanner remains active in your computer's memory. A scanning session ends when you stop the scanner or restart your computer.


SCANEMAL.DLL

The actual executable file name for both the E-mail Scan extension, or "on-demand" scanner, and the E-mail Scan module, or "on-access" scanner. The extension and the module both hook into the MAPI client application to scan e-mail on the server and as it arrives on your computer.


Script virus

Script viruses rely on a particular scripting language to function, and require host software or an environment that can correctly interpret the commands embedded in the scripting language. The actual infecting agent can consist of a plain text file, as it does with an mIRC script virus, provided that the host environment understands the language and can execute its instructions.

Script viruses differ from macro viruses mainly in that script viruses can often run in multiple product environments. A common language like VBScript can run routines in web servers and browsers, in Microsoft Outlook e-mail clients, and in other products that can interpret it. Scripting languages also tend to be more open-ended than macro languages, which can offer virus writers significant control over infected computers.

VBS/Bubbleboy, an experimental, proof-of-concept virus, can run directly from an e-mail message. It relies on the Outlook client's ability to interpret VBScript directly.


Stealth concealment techniques

Viruses that use stealth techniques hide themselves to evade detection. These techniques can consist of simple redirection functions that display a false picture of the information you expect to see when you look at a disk sector, while the virus conceals itself in the real location you meant to examine. It can also mean a much more advanced combination of techniques that allows viruses to hide within files, in unused or unformatted space on your hard disk, or in other areas the operating system normally cannot see.

Any virus type can employ some stealth techniques, but boot sector and file-infecting viruses tend to make the most use of them.


System scanner

This VShield module scans your hard disk, network disks mapped to your system, floppy disks in your floppy drive, and any file that you open, run, save, copy, rename or otherwise modify on your system. This module is the heart of the VShield, or on-access, scanner.


Trojan horse program

Trojan horse programs generally are harmful or destructive programs that wear the superficial "clothing" of legitimate software. Because they don’t include native replication routines, they are not viruses.

Trojan horse programs rely, more than most types of malicious software, on user psychology—their writers spend almost as much time on crafting the right strategy to get you to run their software as they do on the software itself. These strategies can range from the extremely simple—giving a file a plausible name and planting it in the right context can often be enough—to the very elaborate. Some Trojan horse programs can mimic the environment in which they run in order to deploy their payload or gather needed information.

A number of Trojan horse programs try to steal subscriber and account information from such widely used services as America Online or Compuserve. These programs masquerade under such names as BUDDYLIST.EXE or WINSAVER.EXE. Others collect lists of Internet sites you’ve visited and transmit them, or perform other unwelcome functions.


Uniform Resource Locator

A Uniform Resource Locator (URL) is a combination of a distinctive domain name and a protocol designation that identifies an Internet site or resource. The domain name is a series of often-arbitrary characters that identify the site or resource—familiar examples include www.domain.com or ftp.getfiles.org. The protocol designation tells other computers on the Internet how to go about finding the site or resource, and often takes an abbreviated form, such as http:// or ftp://.

A local or Internet-wide Domain Name System matches the URL to a particular Internet Protocol (IP) address, which enables browsers and other Internet agents to use the URL to find nearly any site or resource.


.VSC file

This file name extension denotes a VirusScan application settings file. You can save a settings file from the VirusScan application, then use these settings in future scan operations. You can also copy this file to other computers and use it to run a scan operation with exactly the same settings there.


VSCONFIG.EXE

The executable file name for the VShield configuration utility. This file displays the VirusScan Properties dialog box and saves your configuration settings.


What's This help

This type of context-sensitive help appears whenever you right-click a button, checkbox, list, or other item inside a dialog box, then choose What’s This from the shortcut menu that appears. You can also see the same help topics when you click the ? button that appears in the upper-right corner in many dialog boxes.


Worm

A worm is a malicious software agent that spreads by indirect means, instead of reproducing itself. Some worms hijack e-mail systems and send copies of themselves out to the world, others appear on high-traffic sites for downloading, and still others use both these and other techniques to spread.

Worms can be just as destructive and spread just as, if not more, rapidly than viruses. Worm writers often play on user psychology to entice people to download and run them.

W97M/MELISSA, the notorious "Melissa" virus, is a worm that used an e-mail system to spread at a spectacularly rapid rate. Its unprecedented pace brought many mail servers down with hundreds of infections and caused a massive cleanup effort.


Running an Emergency Disk scan operation

To start your computer and scan your hard disk in a virus-free environment, follow these steps:

  1. Shut your computer down normally, then turn the power off completely. Do not reset or restart your computer.

  2. Insert your locked Emergency Disk in your floppy drive, wait at least 15 seconds, then switch the power on.

    • If you have your computer’s BIOS configured to look for its boot code first on your C: drive, you should change your BIOS settings so that your computer looks first on your A: or B: drive. Consult your hardware documentation to learn how to configure your BIOS settings.

  3. After it starts your computer, the Emergency Disk runs a batch file that leads you through an emergency scan operation. The batch file first asks you whether you cycled the power on your computer. Type y to continue.

  4. The batch file tells you that it will start a scan operation. Read the notice shown on your screen, then press any key on your keyboard to continue.

The Emergency Disk loads the files it needs to conduct the scan operation into memory. If you have extended memory on your computer, it will load its database files into that memory for faster execution. BOOTSCAN.EXE, the command-line scanner that comes with the Emergency Disk, will make four scanning passes to examine your hard disk boot sectors, your Master Boot Record (MBR), your system directories, program files, and other likely points of infection on all of your local computer’s hard disks.

  • McAfee strongly recommends that you do not interrupt the BOOTSCAN.EXE scanner as it runs its scan operation.

The Emergency Disk will not detect macro viruses, script viruses, or Trojan horse programs, but it will detect common file-infecting and boot-sector viruses.

If BOOTSCAN.EXE finds a virus, it will try to clean the infected file. If it fails, it will deny access to the file and continue the scan operation. After it finishes all of its scanning passes, it shows a summary report the actions it took for each hard disk on the screen. The report tells you:

  • How many files the scanner examined

  • How many files of that number are clean, or uninfected

  • How many files contain potential infections

  • How many files of that number the scanner cleaned

  • How many boot sector and MBR files the scanner examined

  • How many boot sector and MBR files contain potential infections

If the scanner detects a virus, it beeps and reports the name and location of the virus on the screen.

When the scanner finishes examining your hard disk, remove the Emergency Disk from your floppy drive, and then shut your computer off again. When you restart, use the VirusScan application at your earliest opportunity to scan your system completely in order to ensure that your system is virus-free.


Understanding the Emergency Disk creation utility

As it installs itself, VirusScan software will examine your computer’s memory and your hard disk’s boot sectors to verify that it can safely copy its files to your hard disk without risking their infection. During that installation, Setup offers to create an Emergency Disk you can use to start your system in a virus-free environment. Should the VirusScan software itself become infected, or if you want to be sure your computer is clean before you install any other software, create and use an Emergency Disk to start your computer.

The Emergency Disk you create includes BOOTSCAN.EXE, a specialized, small-footprint command-line scanner that can scan your hard disk boot sectors and Master Boot Record (MBR). BOOTSCAN.EXE works with specialized set of virus definition (.DAT) files that focus on ferreting out boot-sector viruses. If you have already installed VirusScan software with default Setup options, you’ll find these .DAT files in this location on your hard disk:

C:\Program Files\Common Files\McAfee VirusScan\VirusScan Engine\4.0.xx

The special .DAT files have these names:

  • EMCLEAN.DAT

  • EMNAMES.DAT

  • EMSCAN.DAT

McAfee periodically updates these .DAT files to detect new boot-sector viruses. You can download updated Emergency .DAT files from this location:

http://www.mcafeeb2b.com/naicommon/avert/avert-research-center/virus-4e.asp

  • McAfee recommends that you download new Emergency .DAT files directly to a newly formatted floppy disk in order to reduce the risk of infection.

The Emergency Disk you create will also include the boot files necessary to start your computer. If you computer runs Windows 98 and you have a disk formatted as a FAT-16 partition, you can use Windows system files to start your computer. If your computer runs Windows 2000 Professional or Windows XP, you must use proprietary NAI-OS operating system files with the Emergency Disk, as system files for these operating systems will not fit on a single floppy disk.

VirusScan software comes with an Emergency Disk wizard that makes disk creation simple and fast. To learn more about the Emergency Disk utility and about how to use the wizard, click the topics displayed below:

  • Using the Emergency Disk creation wizard

  • VirusScan Emergency Disk files

  • Running an Emergency Disk scan operation


Using the Emergency Disk creation wizard

The VirusScan Setup utility gives you the opportunity to create an Emergency Disk during installation, if you wish. You can also create a new Emergency Disk at any point thereafter, should you lose the one you created.

To create your Emergency Disk, follow these steps:

  1. Click Start in the Windows taskbar, point to Programs, then to McAfee VirusScan. Next, choose Create Emergency Disk. The first Emergency Disk wizard panel displays.

  2. Click Next to continue.

  3. If your computer is running Windows 2000 Professional or Windows XP, the wizard will tell you that you must format your Emergency Disk with the proprietary NAI-OS. Click Next> to continue, then skip to Step 5.

  4. If your computer runs Windows 98 or Windows Me, the wizard will offer to format your Emergency disk either with the NAI-OS or with Windows startup files. Choose which operating system files you want to use, then click Next> to continue.

  5. Insert an unlocked and unformatted 1.44MB floppy disk into your floppy drive. McAfee recommends that you use a completely new disk that you have never previously formatted to prevent the possibility of virus infections on your Emergency Disk.

  6. Click Next> to continue.

    The Emergency Disk wizard will copy its files from a disk image stored in the VirusScan program directory. As it does so, it will display its progress in a wizard panel.

  7. Click Finish to quit the wizard when it has created your disk. Next, remove the disk from your floppy drive, lock it, label it McAfee Emergency Boot Disk and store it in a safe place.


VirusScan Emergency Disk files

The Emergency Disk wizard will copy files you need to start your computer and scan your hard disk for boot-sector viruses. These files include a reduced-footprint command line scanner, a set of emergency virus definition (.DAT) files, and boot files that enable you to start your computer from the Emergency Disk.

This table lists the files that appear on the Emergency Disk when you create it:

File | Function | Location
AUTOEXEC.BAT | MS-DOS batch file. This file leads you through an immediate scan operation, as soon as the Emergency Disk finishes starting your computer | A:\
BIOS.SYS | System file | A:\
BOOTSCAN.EXE | McAfee command-line scanner. This file conducts the scan operation on your hard disk | A:\
CLEAN.DAT | McAfee virus definition file. This file is a smaller, specialized version of the CLEAN.DAT file that other VirusScan components use. You may not use a CLEAN.DAT file from the VirusScan program directory for the Emergency Disk. | A:\
COMMAND.COM | Command interpreter. This file is a command shell that responds to command-line input | A:\
GETREPLY.EXE | Application file. This file processes output from the scan operation | A:\
KERNEL.SYS | System file | A:\
LICENSE.DAT | McAfee License file. The command-line scanner uses this to track use eligibility for this product | A:\
MESSAGES.DAT | McAfee resource file. This file stores application messages for use during scan operations | A:\
NAMES.DAT | McAfee virus definition file. This file is a smaller, specialized version of the NAMES.DAT file that other VirusScan components use. You may not use a NAMES.DAT file from the VirusScan program directory for the Emergency Disk | A:\
SCAN.DAT | McAfee virus definition file. This file is a smaller, specialized version of the NAMES.DAT file that other VirusScan components use. You may not use a NAMES.DAT file from the VirusScan program directory for the Emergency Disk | A:\


VShield modules

  • System Scan. This module looks for viruses on your hard disk as you work with your computer. It tracks files as your system or other computers read files from your hard disk or write files to it. It can also scan floppy disks and network drives mapped to your system.

  • E-mail Scan. This module scans e-mail messages and message attachments that you receive via interoffice e-mail systems, and via the Internet. It scans your Microsoft Exchange or Outlook mailbox. It works in conjunction with Internet mail that arrives via Simple Mail Transfer Protocol (SMTP) or Post Office Protocol (POP-3) sources.

  • HAWK: Hostile Activity Watch Kernel (HAWK) monitors your computer for suspicious activity that may indicate a virus is present on your system. As opposed to VirusScan, which cleans the virus, HAWK prevents viruses, worms, and Trojans from spreading further.


Welcome

McAfee VirusScan