Copyright: © 1999 Computer Associates International, Inc.


Contact Information

The developers of InoculateIT Personal Edition have always aimed to provide software that will operate in the background until a virus attempts to infect and damage your PC.

If you have a technical support question please see the Frequently Asked Questions for immediate answers, and check http://antivirus.cai.com/support_faq.htm for the latest updates. If your question can not be answered in the FAQs then email IPE_Support@cai.com. The vast majority of e-mails will be answered within two business days of email delivery.

If you suspect that you have a file that is infected with a virus that IS NOT detected by InoculateIT Personal Edition (IPE), please email a copy of the file to IPE_Virus@cai.com. The IPE Anti-Virus team will send you an updated DAT file back within 2 business days where possible.

Computer Associates International has offices in the following countries:

Argentina, Australia, Austria, Bahrain, Belgium, Brazil, Canada, Chile, China, Colombia, Czech Republic, Denmark, Finland, France, Germany, Hong Kong, Hungary, India, Indonesia, Ireland, Israel, Italy, Japan, Korea, Malaysia, Mexico, The Netherlands, New Zealand, Norway, Philippines, Poland, Portugal, Russia, Singapore, South Africa, Spain, Sweden, Switzerland, Taiwan, Thailand, Turkey, United Kingdom, United States and Venezuela.

Select an office for additional details. If you are not sure which office serves you, call 1-516-DIAL CAI (342-5224) for information.

ARGENTINA

Computer Associates de Argentina S.A.

Av. Davila 400 - Piso 2

1107 Buenos Aires

Argentina

Tel: (54)(1) 317-1500

Fax: (54)(1) 317-1515

AUSTRALIA

Computer Associates Pty. Ltd.

407 Pacific Highway

Artarmon, NSW, AUS 2064

Tel:(61)(2) 9937-0500

Fax:(61)(2) 9937 0600

AUSTRIA

Computer Associates Ges. m. b. H.

A-1100 Wien

Wienerbergstrasse 3

Tel:(43)(1) 605 80-0

Fax:(43)(1) 605 80-99

BAHRAIN

Computer Associates Middle East

Ground Floor, Diplomat Tower

Building 315

Road 1705, Block 317

Manama

Tel:(97)(3) 537 977

BELGIUM

Computer Associates S.A. - N.V.

34, Boulevard de la Woluwe

Woluwedal

B-1200 Bruxelles

Tel:(32)(2) 773 28 11

BRAZIL

Computer Associates do Brasil Ltda.

Av. Engenheiro Luiz Carlos Berrini

1253 - 1,5,6 andares

04571-010

Tel:(55)11 5503-6000

Fax:(55)11 5503-6001

CANADA

Computer Associates Canada Ltd.

5935 Airport Road

Mississauga, Ontario L4V 1W5

Tel:(1)(905) 676-6700

CHILE

Computer Associates de Chile Ltd.

Av. Andres Bello, 2777

Oficina 1501

Edificio La Industria

Santiago

Tel:(56)(2) 203-3151

Fax:(56)(2) 203-3161

CHINA

Computer Associates (China). Ltd.

Room No. 2307, Capital Mansion

No. 6, Xin Yuan Nan Road

Chao Yang District

Beijing 100004

People's Republic of China

Tel: +86-10-6466 0322/0336

Fax: +86-10-6466 1135

COLOMBIA

Computer Associates Colombia

Avenida 82 No. 12-18

Oficina 305

Tel:(57)(1) 623 7886

CZECH REPUBLIC

Computer Associates Czech Republic

Donska 9

100 00 Praha 10

Czech Republic

Tel:  ++420-2-67206360

Fax: ++420-2-67206363

DENMARK

Computer Associates A/S

Kongevejen 195B

DK-2840 Holte

Denmark

Tel: +45 45 47 41 41

Fax: +45 45 47 41 10

FINLAND

Computer Associates Finland OY

Helsinki SF-00210

Tel:(358) 9 34 84 84

Fax: (358) 9 348 48 585

FRANCE

Computer Associates S.A.

BP 313

92003 Nanterre Cedex, 92003

Tel:(33)(1) 40-97-50-50

GERMANY

CA Computer Associates GmbH

Hauptverwaltung Darmstadt

Marienburgstrasse, 35

64297 Darmstadt

Tel:(49)6151 / 949-0

Fax:(49)6151 / 949-100

HONG KONG

Computer Associates International Ltd.

21/F World Trade Centre

280 Gloucester Road

Causeway Bay, Hong Kong

People's Republic of China

Tel:(852)2587-1388

Fax:(852)2587-1018

HUNGARY

Computer Associates Hungary

Kapas u. 11-15

1027 Budapest

Tel: +361 457 91 40

INDIA

Computer Associates India

511/512 Merchant Chambers

98A Hill Road

Bandra, Mumbai 400 050

India

Tel: 91 22 643 4681/82

Fax: 91 22 643 0843

INDONESIA

Computer Associates Indonesia

Wisma 46, Kota BNI

Level 34-05/06

Jl Jend Sudirman Kav. 1

Jakarta - 10220

Indonesia

Tel: 62-21-251-5030

Fax: 62-21-251-5029 / 251-5038

IRELAND

Computer Associates Plc

Embassy House

Ballsbridge

Dublin 4

Ireland

Tel:(353)(1) 478 0800

ISRAEL

C.A. Computer Associates

Israel Ltd.

Debora Hanevia St.

Neve Sharet, Atidim

Tel Aviv 61580

Tel:(972)(3) 6481120

ITALY

Computer Associates S.p.A.

Palazzo Leonardo

Via Francesco Sforza, 3

Milano 3 City

20080 Basiglio Milan

Tel:(39)2 90 464 1

Fax:(39)2 90 464 2501

JAPAN

Computer Associates Japan

Computer Associates Japan, Ltd

Shinjuku Mitsui Bld.

2-1-1 Nishi-Shinjuku, Shinjuku-ku

Tokyo, 163-04 Japan

Tel : +81-3-5320-8080

Fax : +81-3-5320-8095

KOREA

Computer Associates Korea Ltd.

11th Floor, Textile Center Bldg.

944-31, Daechi-Dong

KangNam-Ku

Seoul, Korea

Tel: +82-2-528-4100

Fax: +82-2-528-4111

MALAYSIA

Computer Associates (Malaysia) Sdn. Bhd

Suite 32/03, Level 32

Menara Lion

165, Jalan Ampang

50450 Kuala Lumpur

Malaysia

Tel: +60-3-230-2022

Fax: +60-3-230-6453

MEXICO

Computer Associates Mexico

Insurgentes Sur

1787 - Piso 10

Col. Guadalupe-Innc Morales

Mexico D.F. 11570

Tel:(52)5 327 5210

THE NETHERLANDS

Computer Associates B.V.

Wattbaan 27

3439 ML

Nieuwegein

(31) (30) 604 83 45

NEW ZEALAND

Computer Associates (NZ) Ltd.

Level 11, 34-42 Manners Street

P O Box 997, Wellington, N.Z.

Tel:(64)(4) 801 7654

Fax:(64)(4) 801 7655

NORWAY

Computer Associates Norway AS

Fornebuvn. 7-9

Pb. 450

N-1324 LYSAKER

Norway

Tel. +47 67 52 40 00

Fax +47 67 52 40 01

PHILIPPINES

Philippine Computer Associates International, Inc.

20/F Antel Corporate Center

139 Valerio Street

Salcedo Village, Makati City

Metro Manila

Philippines

Tel: +632-812-1441

Fax: +632-812-8896

POLAND

Computer Associates Poland

Centrum LIM

Al. Jerozolimskie 65-79

00-697 Warszawa

PORTUGAL

Computer Associates International, Inc.

Rua Tomas da Fonseca

Torres de Lisboa, Torre G-3

1600 Lisboa

Tel:(35)(1)727 35 33

Fax:(35)(1)727 35 25

RUSSIA

Computer Associates CIS, Ltd.

Representation Office

Business Center

Tokmakov per.,5

107066, Moscow, Russia

Tel./Fax: +7-095-937-48-50

SINGAPORE

Computer Associates Pte. Ltd.

9 Temasek Boulevard

#10-01/03 Suntec Tower 2

Singapore 038985

Tel: (65) 337 2822

Fax: (65) 337 4822

SOUTH AFRICA

Computer Associates Africa

6 Kikuyu Road

Sunninghill Park

Sunninghill Ext. 56

2157 Sandton

South Africa

Tel.: +27 11 807-5920

Fax: +27 11 807-2151

SPAIN

C.A. Computer Associates S.A

Barcelona 08017

Tel:(34)3 2278100

SWEDEN

Computer Associates Sweden AB

Box 540

Berga Backe 4

182 15 Danderyd

Tel:(46)8-622 22 00

Fax:(46)8-622 58 68

SWITZERLAND

CA Computer Associates AG

Kloten CH-8302

Tel:(41)(1) 814 03 00

TAIWAN

Computer Associates Taiwan Ltd.

6th Floor, 105, Sec. 2, Tun Hwa South Road

Taipei, Taiwan

Tel: +886-2-2700-9218

Fax: +886-2-2700-9318

THAILAND

Computer Associates Pte. Ltd.

33rd Floor, Abdulrahim Place

990 Rama IV Road

Silom, Bangrak

Bangkok 10500

Thailand

Tel: 66-2- 636-2467-9

Fax: 66-2- 636-2470

TURKEY

Computer Associates Ltd. Sti.

Kat: 5 No. 108-1

80280 Esentepe - Istanbul

Tel:(90)(212) 27 27 172

UNITED KINGDOM

Computer Associates Plc

Computer Associates House

183-187 Bath Road

Slough

Berkshire SL-14AA

Tel:(44)(1753) 5777 33

UNITED STATES

Computer Associates International, Inc.

One Computer Associates Plaza

Islandia, NY 11788-7000

Tel:(1)516-DIAL CAI (342-5224)

VENEZUELA

Computer Associates (CAI) de Venezuela

Av. Principal de la Castellana Centro

Letonia Torre Ing Bank - Piso 10 - Ofic. 105

Caracas 1060 - Venezuela

Tel: +58 (2) 264-5144 / 264-4744


EICAR
Eicar - A file to test your configuration

This is a program from the European Institute for Computer Anti-Virus Research that can help test the virus detection capabilities of Anti-Virus software.

This is a small .COM file for DOS that simply prints the message

EICAR-STANDARD-ANTIVIRUS-TEST-FILE!

when executed. It has the useful property that it consists entirely of printable ASCII characters, so you can easily email or fax it to someone.

Many anti-virus products will detect this file as if it had a virus. Most will give a special message to make it clear that this is a test file and not a real virus. For example, when the EICAR file is scanned, the following message will be displayed:

Detected the EICAR test string. Not a virus.

The main use of the EICAR test file is to test that your Anti-Virus software is configured and operating as you want it to. For example, it could be used to test that Real-Time protection is active and behaving as you expect.

While this file obviously has absolutely no virus code in it, you should only distribute it to people who have a clear understanding of what it does. Also, do not store it on production machines that run anti-virus software (except as part of a deliberate test), as it will probably trigger whatever alarm bells are in place.

Please refer to the EICAR Standard Anti-Virus Test File web page (www.eicar.org/anti_virus_test_file.htm) for more information.

Here is the EICAR test string, in its entirety:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Welcome to IPE
Welcome to InoculateIT Personal Edition

Congratulations on choosing InoculateIT Personal Edition (InoculateIT PE) to protect your  computer against viruses, trojans and other malicious software.

InoculateIT is a world class range of anti-virus software which can be deployed to suit any business or organisation. InoculateIT PE is a cutting edge, high performance virus package specifically designed to protect small businesses and home users from everyday virus threats.

InoculateIT PE is designed to protect individual computers without having to be installed from a network server. If you wish to install anti-virus protection to many computers in a business environment we recommend you evaluate other anti-virus products in the InoculateIT range.

This high quality anti virus tool comes with FREE software updates to registered users. It also comes with a promise that if you find a virus that InoculateIT PE is unable to detect or clean we will send you an emergency signature update  in approximately  48 hours of receiving a copy of the suspected infected file.

Registered users will also receive FREE Internet E-mail support. The answers  to many  support questions can be found in the online help. From your web browser you can open http://antivirus.cai.com/support_faq.htm where you will find the answers to around 80% of the questions that are asked of our support team.

By registering, you are automatically subscribed to our FREE Virus Threat Notification System as well as our Update Notification Service. Anytime a new virus is found that is actually spreading around the world, this service will send an E-mail to you when a new virus signature update is available.  This handy service will ensure that you are kept up to date so that you are protected against the very latest viruses. The Update Notification Service will only alert you when a new virus signature is posted on the Internet.


Entering the password
Password

The password can be invoked by either selecting Options | Password protect options, or Tools | Emergency.

Options | Password protect options:

This feature is in InoculateIT PE for Windows 95, 98, NT, 2K or ME workstation because many system administrators asked that we provide password protection to stop unauthorised alterations to the InoculateIT PE configuration. The password protection can be enabled by selecting Options | Password Protect Options and entering a password.

The password protection of the Options menu can be disabled by selecting Options | Password Protect Options and entering the correct password. (The password protection for the Tools | Emergency menu is not affected by disabling the Options menu password).

Tools | Emergency:

The re-installation of an old template could cause files to be lost if the drive structure was changed after the template was made. For this reason the ability to re-install templates is protected with a password.

The Emergency Password dialogue will appear when the Tools | Emergency functions menu is selected. It prompts for a password to allow access to the emergency options, and will continue to prompt until the correct password is entered.

NOTE:	The password can be up to 11 printable characters and is case dependant, so an "a" is not the same as an "A".


Skip renamed files
Scan Options (Options | Program | Scan Options)

Include subfolders:	Causes InoculateIT PE to check the subdirectories or subfolders of the current directory or folder.

Skip renamed files:	Causes InoculateIT PE not to check those files which have been renamed by InoculateIT PE during previous scans. Renaming will occur if the default in Options | Program | Scan Options is set to Rename and a suspect file is found. The file extension will be changed so that the first letter will be an underscore. So .exe will become ._xe.

Heuristic Scan:	Heuristic scanning uses a rules base to detect viruses that have not been seen by CA before. So if it looks like a virus, and acts like a virus then it is a virus. This type of scanning for viruses is prone to false alarms.


Scan all files or only executables?
File Types to Scan (Options | Program | File Types)

This dialog allows you to determine which files types will be scanned for viruses.

All files: 	Causes InoculateIT PE to check every file it encounters for viruses. You can choose either All files or Files of these types, but not both.

Files of these types:	Causes InoculateIT PE to check files that it considers to be executable (or 'runable'). By default InoculateIT PE considers files with the bin, com, dll, doc, dot, drv, dvb, exe, hta, htm, html, ini, mdb, mso, ovl, pif, pot, pps, ppt, qpw, scr, shs, sys, vba, vbs, vsd, vss, vst, vxd, xla, xls, xlt extensions to be executable. You can choose either All files or Executable only but not both.

Add, Delete and Default buttons: For more information Click Here

Scan archives (zip): If this option is enabled InoculateIT PE will scan ZIP files.

Compressed archives can contain other compressed archives (this is called nested archives). InoculateIT will scan ten levels deep into any compressed archive that it scans.

Include InoculateIT PE in Windows context sensitive menus for these file types:  If this option is selected and you are using MS explorer (or other navigation tool) you can select a file, directory or drive, right click the mouse button, and InoculateIT PE will scan your selection.

NOTE: When you are upgrading InoculateIT PE and chose Next> to continue past this screen InoculateIT PE will check your current list of file extensions.  If you don't have all of the file extensions that we recommend (as they are susceptible to infection) a dialog will appear and prompt update your extension list.


Add delete default buttons
Add, Delete and Default Buttons

These buttons allow you to change the list of file extensions that InoculateIT considers when determining if a file may be infected.

Add: Allows you to add to the list of file extensions InoculateIT will consider executable. With the advent of Macro language viruses, it is now possible for a file with any extension to contain a virus that can infect your PC.  Selecting this button causes an input window to appear.  You then have the opportunity to enter the new file name extension in the type-in box. If you wish to scan compressed archives we recommend you use the scan compressed archives option rather than adding them to the list of file types to scan.

Delete: If you select a file extension from the displayed list and press this button, the file extension will be removed from the list that InoculateIT considers executable.

Default: Restores the default list of file extensions that InoculateIT considers executable.


Virus actions
Cleaning Options (Options | Program | Cleaning Options)

The following mutually exclusive options are available for actions dealing with infected files.

STOP!  If you chose for files to be Cleaned and a file has been infected with an overwriting virus , IPE will offer to ignore, rename or delete the file, as no disinfection is possible.  By default IPE will offer to delete the file.

Action - Infected files

The following exclusive options will determine what IPE will attempt to do with any infected files.

Report only: Causes IPE to report, but not attempt to clean, infected files.

Clean:  Causes IPE to attempt to disinfect virus-infected files, returning the files to working order. If the file has been infected by an overwriting virus, IPE will Delete the file, as no disinfection is possible

Rename: Causes IPE to change the first letter of the extension of any file infected with a virus to an underscore '_'  (.EXE becomes ._XE).  This allows you to keep the file for further examination, without the risk of accidentally running it.

Delete:  Delete causes IPE to delete irreversibly any file that it finds has been infected with a virus.  The file is first overwritten with 'D's and then set to zero length, so no recovery of the deleted files is possible.
STOP!  Use this option with caution, as there is no possibility of recovering files deleted in this manner.

Action -  Uncleanable Files

The following mutually exclusive options are available for dealing with files which cannot be cleaned.

Report only: Causes IPE to report, but not attempt to clean, infected files.

Rename: Causes IPE to change the first letter of the extension of any file infected with a virus to an underscore '_' (.EXE becomes ._XE).  This allows you to keep the file for further examination, without the risk of accidentally running it.

Delete: Delete causes IPE to delete irrevocably any file that it finds has been infected with a virus.  The file is first overwritten with 'D's and then set to zero length, so no recovery of the deleted files is possible.
STOP!  Use this option with caution, as there is no possibility of recovering files deleted in this manner.


Overwriting Viruses

Most viruses are careful not to destroy the infected file, but overwriting viruses overwrite part of the infected file, so that it will no longer operate.  However, this makes these viruses extremely obvious, so they are unlikely to spread far.

The Zeroto-0, or Australian 403 virus, is of this type.  When an infected file is run, the virus searches for an uninfected .COM file and replaces it with a 403 byte file which only contains the virus.  The original file is destroyed, so infected files appear to run, but do nothing.


How to alarm when a suspected file is found
Reporting (Options | Program | Reporting)

This dialog controls what will be displayed in the Report window and written to the log file.

File names reported

All files scanned:	Causes InoculateIT PE to display on a separate line the name of each file it tests (which in turn causes the name of every file tested to be written to the log file, regardless of whether it had a virus or not).  This is useful in explicitly identifying which files are not infected (InoculateIT PE uses a separate line for each infected file).

Infected files only: 	Causes IPE to report on a separate line the name of each file it finds to be suspected or infected.

The All files scanned and Infected files only options determine which file names are to be listed in the Report window. These two options are mutually exclusive.

Show Warnings: This option causes any cautions or warnings which are generated (during a scan) to be recorded in the log file. This option is only available if the Infected files only option has been selected.

Write log: 	The name of the log file to which all scan results are written is displayed in the type-in box.  The location of the log file can be changed using the Browse button to select an existing file or allow the entry a new file name.

Cumulative report:	If this option is enabled the results of each scan will be stored cumulatively in the log file. If it is NOT enabled the log file will be cleaned and overwritten each time a scan is performed.

Limit log size to:	Once you perform a scan and the file becomes larger than (the default) 32Kb it will automatically be overwritten with the newer information. The log file size can be configured by editing the "limit log file size to" field.

Configure 'Out-of-date' warning

NOTE: As the log file has to be able to be edited in DOS the name MUST NOT contain spaces, unprintable characters or contain sub-directory names longer than eight characters.


Auto Downloads

If you ARE connected to the Internet and you are using MS IE 4.0 or equivalent, Auto Downloads offers an easy way to update your software to detect the latest viruses.

How to use the Auto downloads feature:

1. Open InoculateIT and select Tools | Auto Download

2. The Auto Download dialog will be displayed.

NOTE: If you have not used Auto Downloads in the past another dialog will pop up and ask you to enter the email address of the person who registered their free copy of IPE.

3. The Save As dialog will be displayed and ask where to store the update files. Leave everything as it is and select 'SAVE'. The file will be downloaded to your computer. (This may take a few minutes depending how fast your modem is). A message will be displayed when the files have been successfully downloaded. You will then be asked if you want to install the files. Select 'YES".

4. A message will appear to let you know the Minor Update has completed successfully. Click 'OK'.

If you are NOT connected to the Internet it is not possible to update your computer using this method. If you have access to the Internet but not on the machine that you wish to update, you can download a DAT file update kit from the web site, save it onto a floppy and copy it to other computers.


Configure out of date warning
Configure 'Out-of-date' Warning (Options | Program | Reporting | Configure 'Out-of-date' warning)

Display Out-Of-Date Warning:  This option allows you to enable or disable the out of date warning. This warning will pop up to let you know that it is time to update your copy of InoculateIT.

How often would you like to be reminded to update your templates?

This option and the following radio buttons allow you to select when you would like to be reminded to update the DAT files to detect the latest viruses.


Infected files
Cleaning Options(Options | Program | Cleaning Options)

The following mutually exclusive options are available for dealing with infected files.

Action - Infected Files

Report only:  Causes IPE to report, but not attempt to clean, infected files.

Clean:  Causes IPE to attempt to disinfect virus-infected files, returning the files to working order. By selecting this option you will automatically enable the Advanced Cleaning Options which can be configured by selecting the button below.

Rename:  Causes IPE to change the first letter of the extension of any file infected with a virus to an underscore '_' (.DOC becomes ._OC).  This allows you to keep the file for further examination.

Delete:  Delete causes IPE to delete irreversibly any file that it finds has been infected with a virus.  The file is first overwritten with 'D's and then set to zero length, so no recovery of the deleted files is possible.

NOTE: Use this option with caution, as there is no possibility of recovering files deleted in this manner.

Action - Uncleanable  Files:

Report only:  Causes IPE to report, but not attempt to clean, infected files.

Rename:  Causes IPE to change the first letter of the extension of any file infected with a virus to an underscore '_' (.DOC becomes ._OC).  This allows you to keep the file for further examination.

Delete (use with caution):  Delete causes IPE to delete irrevocably any file that it finds has been infected with a virus.  The file is first overwritten with 'D's and then set to zero length, so no recovery of the deleted files is possible.

Advanced Cleaning


advanced cleaning
Advanced Cleaning(Options | Program | Cleaning Options | Advanced Cleaning)

System Cleaning: These options are used to clean infected operating systems. We recommend that these options are enabled.

Cleaning Registry Some types of viruses require the registry to be cleaned to fully remove the infection.

Clean INI files Some types of viruses write to win.ini. This option allows IPE to clean up the win.ini file when a virus is detected.

Kill processes Sometimes it is difficult to clean up a virus as it is running as a process. This option allows IPE to kill viruses processes during the clean up procedure.

Rebootable clean After cleaning some viruses it is necessary to reboot the computer to completely remove the virus. This option allows IPE to reboot during the cleaning of these types of viruses.

Delete trojan/worm/droppers IPE will attempt to delete these types of files as there is nothing to be recovered from them. If the attempt to delete fails the files will be treated as if they are uncleanable files. For further information on the treatment for uncleanable files Click Here

Delete damaged files Some types of viruses (such as overwriting viruses) destroy parts of the host making it impossible to recover the file. This option allows IPE to delete these types of virus.


Boot sectors and IDE drives
Boot Sectors (Options | Program | Boot Sectors)

This dialog sets up the defaults for the treatment of boot sectors.

Scan boot sectors Allows InoculateIT PE to scan boot sectors.  Turning this option off causes all the other options in this dialog box to become inactive.

Consider a boot sector bad if it contains: The following options tell InoculateIT PE how to define a bad boot sector; The first option gives adequate protection, whilst the last gives an extremely high level of protection. The three levels of protection are mutually exclusive. i.e. only one can be chosen.

Known viruses only Causes InoculateIT PE to consider a boot sector bad only if it contains a known virus.

Invalid boot sector or known virus Causes InoculateIT PE to consider a boot sector bad if it contains an invalid boot sector or a known virus.

Unknown or invalid boot sector, or known virus

STOP! 	Replacing unknown boot sectors may cause problems with some backup programs and copy-protected software. You should only use this setting if you are aware of the potential problems.  Causes InoculateIT PE to consider a boot sector bad if it contains an unknown or invalid boot sector or a known virus.

Replace bad boot sector Causes InoculateIT PE to replace bad boot sectors.  InoculateIT PE will always warn you before replacing a boot sector.

Check for large IDE driver To determine if a large drive is present InoculateIT PE uses direct port I/O to read the Extended Boot sector. This will not work on all PCs. The Check for large IDE driver allows users to disable this test if it causes problems on their system. This option is not available in InoculateIT PE for windows NT.


Real-Time memory checking
Memory (Options | Program | Memory for Windows 95/98 Only)

Enable Memory Scanning

This dialog enables InoculateIT PE to monitor Real-Time memory for viruses.

If another anti-viral program is running it may cause false alarms as virus templates may be detected from the other program.


Proxy servers
Auto Downloads (Options | Program | Auto Downloads)

Proxy Server

A proxy server is the computer that you connect to for access to the Internet. The installation program will automatically try to find these details from your Internet browser. If the installation program is unable to find these details you will need to select the 'Use the following proxy server' option and enter the details yourself.

Do not use a proxy server for Auto Downloads

This allows you to enable or disable the use of a proxy server.

Choose the proxy server automatically (From Control Panel)

This is the default option. Selecting this option will cause InoculateIT PE to automatically search your computer for the proxy server details.

Use the following proxy server:

Try the 'Choose the proxy server automatically' option first. If this does not allow you to update you will need to find your proxy server details and enter them in the fields below.


Proxy server details
How to find your proxy server details

For Internet Explorer:

The 'Choose the proxy server automatically'  option will automatically be able to find your proxy server details if you have Internet Explorer loaded on you machine.

For Netscape:

Please check the instructions that match your version of Netscape. To determine which version you have, open Netscape and select Help | About Communicator.

Netscape 3.x

Open Netscape, select Options | Network Preferences |  Proxies | Manual proxy configuration | View.

You need to copy the details stored next to the 'HTTP Proxy'. You will also need to copy the Port number for the HTTP proxy.

Netscape 4.x

Open Netscape, select Edit | Preferences… | Advanced | Proxies | Manual Proxy Configuration | Configure.

You need to copy the details stored next to the 'HTTP Proxy' . You will also need to copy the Port number for the HTTP proxy.


Start-up scan tab
Start-Up (Options | Program | Start-Up)

This option allows you to configure how InoculateIT PE will perform the scans that are performed when you start or reboot your computer.

Run InoculateIT PE automatically when Windows starts up

This option will enable or disable the Start-up scan option.

Start-up Command

Perform progressive scan (recommended)

This will enable a progressive test which will begin the next test where the last one finished, thus, over a period of days/weeks the entire hard drive will be checked.

Customised Start-up command

This option allows you to configure your own scan using the InoculateIT PE command line switches.

A summary of the option that you have selected will be displayed at the bottom of the dialog.

The Configure Progressive Scan button allows you to modify the way the progressive scan is performed.


Command Line Switches

Command line switches can be used by selecting Start | Run…, typing in the full path and filename (ie. C:\Program Files\InoculateIT PE\VET95, C:\Program Files\InoculateIT PE\VET98 or C:\Program Files\InoculateIT PE\VETNT) and adding any of the command line switches.

For the most up to date list of switches please select Start | Run… and type C:\VetNT /help. (VetNT will need to be changed to Vet95 for Windows 95, or Vet98, VetMe, Vet2k depending on what operating system you are using.)


Progressive scan
Progressive Scan Properties (Options | Program | Start-Up | Configure Prog. Scan)

This dialog allows you to configure how the start-up scan will be performed and what will be reported.

Display

Progress of the scan: This will display InoculateIT PE and show you the details as the scan is performed.

Nothing unless infected: InoculateIT PE will not appear unless it has found a problem with a file.

Number of Files to Scan

First boot: This is the number of files that will be scanned when you first start your PC for the day.

Reboots: This is the number of files that will be scanned if you re-boot your PC throughout the day.

Log File

Write log file: By selecting this option you can either select the browse button to specify the name of the log file, or you can type in the path and file name that you wish to call the log file.

Allow Cancellation of Progressive Scan

If this option is NOT selected (NOT checked) you will not be able to stop the scan until it is finished.


Virus checking in Real-Time memory (Defaults)
Real-Time Protection

The InoculateIT PE suite includes memory Real-Time programs to automatically check files and floppy disks for viruses. Settings for these programs are controlled by this dialog.

The Real-Time Protection Options dialog is initiated by selecting Options | Real-Time Protection from the menu. Each of the dialogs can be entered by selecting the appropriate tab at the top of the dialogs.

Enabling	More information

Floppy boot sectors 	More information

Virus Monitoring 	More information

Virus action 	More information

Reporting 	More information


Enabling tab
Enabling (Options | Real-Time Protection | Enabling)

Enable Real-Time floppy disk boot sector protection

You can configure the floppy disk protection by selecting Options | Real-Time protection | Floppy Boot Sectors. Real-Time floppy protection settings

Enable Real-Time File Monitor (File & Macro protection)

This will allow InoculateIT PE to automatically check files, documents and spreadsheets for viruses as they are accesses by Windows.

File monitoring

Virus actions

NOTE: Some installation programs recommend that you disable your anti-virus protection before attempting to install their software. Please scan the floppies or CD BEFORE disabling the Real-Time protection as they may be infected with viruses. 'Shrink wrapped' software has been found to be infected in the past.

To "Disable your Anti-Virus software" remove the checks from each of the Options | Real-Time protection | Enabling options, then close InoculateIT PE and save your changes.

NOTE: You MUST open InoculateIT PE and enable these options once you have finished loading the software as the Real-Time protection is the main component of your anti-virus protection.


Floppy boot sector protection
Floppy Boot Sector (Options | Real-Time Protection | Floppy Boot Sector)

This dialog controls the checking of floppy boot sectors for viruses.  You may choose the level of protection required from the three (mutually exclusive) options.  The first option gives adequate protection, whilst the last gives an extremely high level of protection. These options will also contain a message to note if this option is currently loaded.

A known virus  Causes InoculateIT PE to consider a boot sector bad only if it contains a known virus. This is the default level of protection.

An invalid boot, sector or known virus  Causes InoculateIT PE to consider a boot sector bad if it contains an invalid boot sector or a known virus.

An unknown or invalid boot sector, or known virus  This option causes InoculateIT PE to consider a boot sector bad if it contains an unknown or invalid boot sector or contains a known virus.

STOP!	Replacing unknown boot sectors may cause problems with some backup programs and copy-protected software. You should only use this setting if you are aware of the potential problems. Please call the InoculateIT PE support line if you have any questions.

Replace any boot sector considered bad  Causes InoculateIT PE to replace bad boot sectors.  InoculateIT PE will always warn you before replacing a boot sector.


File monitoring tab
Virus Monitoring (Options | Real-Time Protection | Virus Monitoring)

This dialog controls which events will trigger InoculateIT PE's automatic file monitors to scan files.  There are three events where files may be monitored for viruses.  You may enable as many of these options as you wish as they are not mutually exclusive.

An infected file may trigger more than one of the following options. A warning will be issued from each of the options that is activated, so it is possible for a single infected file to create multiple warnings.

Monitor Activation

If the file is infected with a virus it may activate as soon as the file is opened (macro viruses normally infect normal.dot when the infected file is opened). For this reason Opening will automatically be enabled when you select either Executing or Closing if you are using InoculateIT PE for Windows 95 or 98. InoculateIT PE for Windows NT, 2K or ME can be fully configured and will allow any configuration to be set by the user.

Executing  programs  If a virus is found when a Windows application is run the Real-Time protection will prevent the file from running.  If the Real-Time protection only suspects a virus is present you will be given the choice of whether or not to run the file.

Opening files  Files with extensions specified in the File types to scan box of the Options | Program | File types menu are checked for viruses on opening. If a virus is found, you have the option of proceeding.

Closing files  Files with extensions specified in the File types to scan box of the Options | Program | File Types menu are scanned for viruses on closing.  If a virus is found the filename and the name of the virus will appear in the Report window and the log file if it is enabled.

Scan All Files (This option is available for Windows 95 and Windows 98 only)

This option causes IPE to check each file for viruses as the file is used. As each file is used it will be checked for viruses if this option is enabled. If this option is disabled it may take slightly less time for IPE to scan files (as some types of files will not be scanned before use).


File virus actions tab
Virus Actions (Options | Resident Protection | Virus Actions)

Action - Infected Files

Report only:  Causes IPE to report, but not attempt to clean, infected files.

Report & deny access:  Causes IPE to report when an infected file is detected and to lock the file so that it may not be used by other programs.

Clean file:  Causes IPE to attempt to disinfect virus-infected files, returning the files to working order. If the file has been infected by an overwriting virus, IPE will delete the file, as no disinfection is possible

Action - Uncleanable Files

Report only:  Causes IPE to report, but not attempt to clean, infected files.

Report & deny access:  Causes IPE to report when an infected file is detected and to lock the file so that it may not be used by other programs.


Reporting tab
Reporting (Options | Real-Time Protection | Reporting)

Write log file

Selecting this option will cause a log file to be written when suspect or infected files are detected by the Real-Time file protection. The log file will record the filename and path of any infected files, and results of InoculateIT PE's attempt to clean the files.


Alerting tab
Alerting (Options | Alerting)

This dialog allows to enable/disable the displaying of a message when a virus is detected.

Display message box when virus found

By selecting (checking) the "Display message box when virus found" option you will be notified if a virus is detected by the Real-Time protection as you go about your daily tasks.


Confirm configuration settings;
Confirm Configuration Selections

This dialog will display a list with all of the options that the installation intends to install InoculateIT PE with. If you wish to change the settings; click the <Back button until you see the dialog with the option that you wish to change, modify the option and then click Next> until the Confirm Configuration Sections dialog is once again displayed. Click the Finish button to accept the configuration and complete the installation.


Display the readme.hlp file
'Read-me' Help File

Setup can display a 'Read-me' help file, which will include late-breaking information that has not made it into the manual. The 'Read Me' help file will also give a summary of all the changes that have been made since the last version of InoculateIT PE.

By clicking the Yes please display the 'Read Me' file the Readme help file will be displayed during the installation of InoculateIT PE.


Customer Number
User Identification

During registration on the CAI site you will be issued a Customer Number. InoculateIT PE can successfully be installed without entering your customer number at this point, but, by entering the Customer Number you will be able to use the AutoDownload feature. This feature is an easy way for you to regularly update InoculateIT PE to detect the very latest viruses.

By entering your Customer Number during installation you will also be able to find the number (by selecting Help | About) if you want to e-mail us with a question.

The Customer Number can be entered after you have finished installation by starting InoculateIT PE and selecting Options | Options Wizard and moving through the dialogs until the User Identification dialog is displayed.


InoculateIT PE
InoculateIT PE Program Directory

This is the directory that InoculateIT PE will be installed into. By default InoculateIT PE is installed into C:\Program Files\InoculateIT PE\, if InoculateIT PE has already been installed onto your PC the directory that it has already been installed to will be displayed instead.

If you wish to install InoculateIT PE to a different directory click the Browse button and choose another directory.


Desktop options
InoculateIT PE Desktop Options

By accepting the defaults a InoculateIT PE short-cut will be added to the Tray area (bottom left of your screen, next to the clock if you have one). Once the icon is installed to the Tray you can easily determine in the real-time protection is loaded and active by moving the cursor over the icon (and a summary of which components of real-time protection are loaded will pop-up)

It is possible to remove the InoculateIT PE icon from the tray by opening InoculateIT PE and selecting Options | Options Wizard… and changing the defaults on the Desktop Options Dialog.


Readme help file
'Read-Me' Help File

Setup can display a 'Read-me' help file, which will include late-breaking information that has not made it into the manual. The 'Read Me' help file will also give a summary of all the changes that have been made since the last version of InoculateIT PE.

Select an option and then click Next> to proceed.


Boot Sector Templates

Setup will offer to record a template (or copy) of the local hard drive boot sectors. These are used to check if the boot sector has been changed. Select the drive(s) that you wish to make templates for. We recommend templates are made for all local drives. (It is not appropriate to make templates for CD-ROM drives)


Make a reference disks
Reference Disk

The wizard will offer to make a reference disk which will hold a template for each of the local drives. We recommend creating a reference disk, you will need a blank disk with no other files on it. Click Next> to proceed.

If you choose to make a reference disk, the "Make a reference disk"  dialog will be displayed. Enter a line of text so that you can uniquely identify your PC, insert a freshly formatted floppy, and click OK. When InoculateIT PE has finish creating the reference disk, label it as the "Reference Disk".

If you do not wish to create a reference disk click Next> to proceed.


Scan Hard Disk

By enabling this option the users PC will be scanned once InoculateIT PE has finished loading. This is recommended as each version of InoculateIT PE can only detect those types of viruses that where known about when that version was made. By scanning with a later version you may detect recent discovered types of viruses that have not been detected in the past.