Index
IN-DEFENSE HELP INDEX

Welcome to IN-DEFENSE. Please choose a topic you want to get help on:

Introduction

Quick Installation

Installation Notes

IN-DEFENSE Automated Protection

IN-DEFENSE Alert Messages

Using IN-DEFENSE with Windows

AV-Macro Module for Protection Against Macro-Viruses

Advanced Configuration and Options

More about Viruses

System Requirements

Copyright Information

NOTE: For in-depth technical information, visit our web site:

http://www.in-defense.com

IN-DEFENSE(tm) on-line help - Copyright 1998 TEGAM International. All rights reserved.


INTRODUCTION

Computer viruses are one of the biggest threats to today's computing. Viruses are small, disruptive programs written by people who think it's funny to harm other people's computers. Some viruses are relatively benign and don't damage the data or other programs on your computer. Other truly malicious viruses are designed to destroy data files and the programs stored on your computer's hard drive.

IN-DEFENSE protects your computer, its files, and programs from becoming infected with a computer virus. IN-DEFENSE is the most powerful virus-protection system available because it completely protects all of the system elements that can suffer a virus attack. By using ultimate virus protection methods, IN-DEFENSE can detect and fully remove existing, known viruses, as well as new viruses that haven't even been created yet. After installing IN-DEFENSE, your computer is "vaccinated" and protected against viruses.

IN-DEFENSE's Features

IN-DEFENSE combines several protection modules that form a total vaccination system in which no virus can survive. IN-DEFENSE:

* Prevents viruses from infecting your computer system

* Detects all viruses as soon as they try spreading into your computer's system

* Removes known and unknown viruses, without ever damaging your files and data

* Detects and neutralizes macro viruses, whether known or not

* Guides and helps you always to make the right, safe choice

* Runs all daily and automated checking operations incredibly fast

* Includes numerous methods and techniques to help you cope with special situations

* Recovers a computer from the worst types of virus infection

* Recovers a computer from common damages (such as a CMOS battery loss or damage to a hard drive's partition table)

* Prevents you from restarting the computer with an infected diskette

>> NOTE: For in-depth technical information, visit our web site: http://www.in-defense.com


MORE ABOUT VIRUSES

A virus is simply a program just like any other program. The only difference is that a virus is written by someone who wants it to spread through computer's systems and files. Once a virus infects a system, it can do whatever it wants.

What is a "Known Virus"?

A known virus is one that is recognized by an anti-virus program. The anti-virus program knows the signature and structure of the virus. This is important for traditional, signature-based anti-virus programs that scan computers because they only detect viruses they know, in other words the viruses in their database. IN-DEFENSE, however, does not distinguish between a Known and an Unknown virus - it treats both with its new Change Recognition technology.

What is an "Unknown Virus"?

The term "Unknown Virus" is used by traditional, signature-based anti-viruses. All it means is that the anti-virus does not have this virus in its database, and therefore cannot treat it with the scanner. Therefore, any virus created later than the anti-virus program itself will not be in the anti-virus' database. That's why traditional anti-virus methods require regular and frequent updates in order to recognize new viruses. IN-DEFENSE on the other hand does not require such updates because it treats unknown viruses with the same ease as known viruses.

How do Computer Viruses Spread?

The first and main aim of a computer virus is to spread itself into as many computers as possible. For this to occur, it uses several methods to reproduce itself.

But the first task of a virus program is to make sure the user won't detect it and stop the infection. To avoid this, today's viruses escape detection by making it seem that the computer's activity is not out of the ordinary:

*	speed - user does not experience a slowness in the computer

*	size - the computer's resources do not get used up, the small size of the virus also lets it gain speed in replication

*	stealth - user does not "see" the virus

*	encryption – the virus hides its signature from scanners.

Most common viruses include several of these techniques; some use them all. Thus, detecting a virus is virtually impossible without an anti-virus program.

How Dangerous can a Computer Virus Be?

It depends on the virus. Because a computer virus is a program, it can do anything a computer program can do, including formatting the disk, displaying messages, making screen effects, destroying, modifying or even spying on your data. Many viruses are programmed to do one of these actions on a particular date of the year. Although some viruses don't do anything besides replicating themselves, this doesn't mean they are harmless. All computer viruses decrease system resources because they need such resources to carry themselves, and generally slow down the system and put your computer at the mercy of bugs (programming errors), which can result in data corruption and the computer "freezing" at any time.

Types of Computer Viruses

Computer viruses are divided into several categories:

Boot Sector Viruses - copy themselves over boot or partition sectors, and place the original sector elsewhere on the disk/diskette. These viruses infect your hard drive when you reboot (restart the computer) on a floppy diskette that contains an infected boot sector. Therefore make it a practice to check you’re a: drive for floppies before you boot your machine. IN-DEFENSE will remind you when you leave a floppy in drive A: to remove it before rebooting.

Executable-Files Viruses - infect programs by inserting their own code inside programs. When an infected program is run, the virus contained in it looks for other programs to infect.

Document Macro Viruses - the newest virus family, they spread through document files using the macro commands of specific word processor programs. Although they spread very quickly, these viruses are simple to remove. In fact, these are the only viruses that can be detected and removed without using an anti-virus program. Any computer user can find and delete macro viruses without having particular knowledge about viruses. To protect against such viruses, set the attributes of the file NORMAL.DOT to Read-Only. IN-DEFENSE can detect and remove these viruses, whether they are known or unknown.

More about Macro Viruses

Macro viruses spread themselves through documents or data files that contain macro code. A macro is a sub-program that allows users to personalize and automate some parts of a data-processing program. Macros are supported by programs such as Microsoft Word®). Macro viruses add themselves to other macros.

How Do Macro Viruses Spread ?

A macro infection of Microsoft Word® documents is done in two steps:

1.	When a document that contains a macro virus is opened, the virus generally adds its portion to the default template, which is stored in the file NORMAL.DOT. This allows step 2 to occur.

2.	When a new document is created or an existing document is modified or saved, the virus automatically infects the document by inserting its own macros into it.


Can Macro Viruses Be Dangerous ?

Macro viruses were not thought to be able to do any harm except replicating themselves. Unfortunately, macro virus writers now know how to make macros viruses very offensive. Their ability to destroy or damage data is as great as other types of viruses; macro viruses can now harm data and the hard drive.


IN-DEFENSE'S AUTOMATED PROTECTION

IN-DEFENSE deploys its protections automatically. Some of them are permanently running in memory, and the others are executed on a daily basis.

When you start (boot) your computer, IN-DEFENSE runs a set of programs that check the hard drive and computer system elements to make sure no virus is present.

Start-up Protection

*	The first protection program starts before Windows is loaded and displays a DOS window.

This program checks:

-	Main memory (RAM and CMOS) and then checks the memory settings to detect any viral symptoms. It can even detect and restore CMOS-battery loss. (CMOS memory is battery-powered memory that saves your system's SETUP configuration even while the computer is off.)

-	Boot sectors

-	Master Boot Record

-	And all the other system elements susceptible to viruses

>>  NOTE: If this program detects virus activity, a message tells you that a virus may be present.

*	After the DOS program is finished checking the computer, Windows loads and begins running. The next set of IN-DEFENSE programs run. (By default, these programs run the first time you start your computer in the morning of each day, however, you can set them to run at other times)

This program checks all the executable (.EXE) files on your hard drive and verifies that they are not infected. On the first day of each month, it runs an even more extensive check of the executables.

*	Following the check of the executable files, IN-DEFENSE runs the program that checks for document macro viruses to see if any documents are infected.

*	The memory-resident program is the last automatic IN-DEFENSE program to load. It runs "in the background" while you're working and watches for any virus activity. The icon at the bottom right of the screen tells you the memory-resident program is on the job protecting your computer:


USING IN-DEFENSE WITH WINDOWS

Although IN-DEFENSE's automatic programs check all the necessary aspects of your hard drive, you can also run them manually. IN-DEFENSE has three Windows programs and a DOS program if you want to manually analyze and protect your computer. The program icons are in the ANTIV directory in the Windows Program Files directory.

When you access IN-DEFENSE main menu, you get to the following screen:

Check Executable Files: Checks executable files (.EXE, .COM...) by saving and comparing their snapshots.

Check Document Files: Checks documents for automatic macros.

Advanced Tools: Allows you to access to the AV-Macro module’s menu to check and control your documents for dangerous macros.

Report: Displays a detailed and complete activity log such as the following one:

Checking Memory And System Elements

Avcheck is an essential protection module that has two main tasks:

*	Saving, authenticating, and restoring the most important elements of the system and the hard drive that are susceptible to virus infection or destruction

*	Checking the memory for active viruses.

This program warns you of any suspect modification likely due to a virus. It secures vital zones of the system the first time it is run during IN-DEFENSE installation. Subsequently, it checks that no changes have been made to the system when you start your computer.

When a suspect modification occurs to one of the system or hard drive elements, such as a partition table or total RAM amount, the program analyzes the change and advises you as to the best action to take.

When AV-Check warns you about modification to the system or hard drive, you must choose to either restore it or to accept it. If you're certain that the change is proper (for instance you changed the operating system or added a new hard drive), accept the change. If you aren't sure whether to accept a change or not, do NOT accept it, and ask the person responsible for your computer security.

1.	Double-click on the AV-Check icon to run the program.

The results of the check appear in the window.

2.	Click OK to close the window.

Checking for Macro Viruses

Macro-viruses represent today 80% of computer virus infections. Since most users don't create or even use macros, IN-DEFENSE will check your system for automatic macros (which is the type of macro that viruses are embedded in) and may ask you to confirm some of them as valid. You can control your documents macros using the AV-Macro module.


SYSTEM REQUIREMENTS

System Requirements:

To use IN-DEFENSE, your computer system requires the following:

* Intel-based processor 386 or higher

* Microsoft Windows 95, 3.x, or NT 4.0 (or higher) or DOS

* 8 megabytes (MB) or more of internal memory

* At least 6 megabytes of free hard drive space to install the software


IN-DEFENSE Warning Messages
IN-DEFENSE ALERT MESSAGES

Whenever IN-DEFENSE detects unusual activity on your computer, it displays a warning message. The message can appear at any time, including while you're booting the computer or when working with specific files. This section explains what the messages mean and how to respond to them.

Windows Alert Messages as the Computer is Booting

When executable files are modified, IN-DEFENSE analyzes the modification and then informs you only if the modification is due to a virus.

Virus Detection - the modification is due to a virus. Click the Restore button to clean the file. This sample shows that the FAKE.COM file is infected:

DOS Alert Messages as the Computer is Booting

The DOS portion of IN-DEFENSE's protection checks the computer memory and other essential elements. Messages warn you if anything appears suspicious.

Virus in Memory - When this warning message appears, IN-DEFENSE has detected a virus in the computer's memory. Insert the IN-DEFENSE Rescue Disk that you created when installing the program. Click R to restart the computer. You will now need to clean the hard drive.

Partition Sector Modified or Boot Sector Modified - Either of these messages warn that IN-DEFENSE has detected unusual activity in the partition sector or the boot sector. This could be normal activity due to upgrading the operating system, or installing a utility that loads at boot time, such as an encryption program. If you know that the activity is due to your actions, press A and proceed. If you think it's due to a virus, insert the IN-DEFENSE Rescue Disk that you created when installing the program. Click R to restart the computer. You will now need to clean the hard drive.

Missing Conventional Memory - This message warns that IN-DEFENSE has detected unusual activity in conventional memory. This could be normal activity due to installation of a utility that loads at boot time, such as password protection program or a compression program. If you know that the activity is due to your actions, press A and proceed. If you think it's due to a virus, insert the IN-DEFENSE Rescue Disk that you created when installing the program. Click R to restart the computer. You will now need to clean the hard drive.

CMOS Modification - CMOS memory is a battery-powered memory that saves the computer's configuration setup files even while the main power is off. Normal modification of the setup configuration will change the CMOS memory. However, a loss of battery power or a virus can also affect the CMOS memory. This message warns that IN-DEFENSE has detected unusual activity in CMOS memory. Click R to restore the CMOS to its previous state.

Alert Messages about Macro Viruses

During installation, all of the Microsoft Word® documents in your computer, as well as Microsoft Word®'s main elements (such as the NORMAL.DOT template) were vaccinated to protect against macro viruses. These vaccinated documents and elements are checked automatically when Windows starts up and while you are opening them.

>> IMPORTANT NOTE: Macros not created by you or the document writer should be considered suspicious. If you are not sure whether the new macros have been created by you or not, it is recommended to Eliminate them.

A warning message appears if Microsoft Word®'s main elements are infected.

If infected documents or new suspicious documents are found, an alert message also warns you.

If you are not sure what these macros are, click Eliminate (IN-DEFENSE will always allow you to restore them if you made a mistake).

Alert Messages While You are Working in Windows

File Related Warnings

If a virus attempts to attack your computer, IN-DEFENSE will intercept it and display the following alert message.

IN-DEFENSE has prevented a virus from infecting your executable files and will block further attempts of this virus to spread.

Click Resume to continue using the computer.

Sector Related Warnings

When a floppy disk with an infected boot-sector is inserted, you may see the following message:

Diskette may be Infected - The diskette you just inserted into the disk drive is probably infected with a boot-sector virus. You can clean it by clicking "Clean".

Warnings About Macro Viruses

"Macros Added to a Protected Document" - New macros are being added to a protected document such as NORMAL.DOT. Unless you have created global macros yourself or installed a new software that uses macros, click Eliminate.

Macros being checked - When you open an Microsoft Word® document, IN-DEFENSE checks that the document is vaccinated. If it is, IN-DEFENSE checks that the file corresponds to its original state and structure. If the file is new to your computer, IN-DEFENSE checks to see if it contains suspicious macros and displays a warning message. Click Eliminate if you don't need or don't know the origin of these macros, or click Accept if you have created them or need to use them. The safest thing to do is Eliminate. IN-DEFENSE always allows you to restore the eliminated macros later.

Warning Messages While You are Working in DOS

IN-DEFENSE's memory-resident program is always watching for suspicious activity as you're working in DOS and in Windows.

File Related Warnings

When file related activities occur, you may see one of several messages.

An .EXE Program About to be Modified - This message appears whenever a program (.EXE file) is about to be modified. If you are certain that the modification is correct, you can accept it. Otherwise the modification is probably due to a virus and you should refuse it. Then, check your computer for other viruses.

A Virus is Active in Memory - When a virus is probably active in memory, insert the write-protected Rescue Disk and press Enter. The computer reboots and you can clean the hard drive. If you're certain that the memory activity is not due to a virus, press Escape and continue working (although this is not recommended).

A Program is About to be Modified - This message appears whenever a suspect operation is about to occur. If you are certain that the modification is correct, you can accept it. Otherwise the modification is probably due to a virus and you should refuse it. Then, check your computer for other viruses.

Sector Related Warnings

When boot-infector viruses are detected, you may see one of the following messages.

Diskette is infected - The diskette you just inserted into the disk drive is probably infected with a virus. Press Enter to continue and eject the diskette.

Partition Sector or Boot Sector About to be Modified - These sectors are about to be modified. This could be normal activity due to upgrading the operating system, or installing a utility that loads at boot time, such as an encryption program. If you know that the activity is due to your actions, press A and proceed. If you think it's due to a virus, press R to refuse it. Insert the IN-DEFENSE Rescue Disk that you created when installing the program. Restart the computer. You will now need to clean the hard drive.


Copyright
COPYRIGHT INFORMATION

COPYRIGHT INFORMATION

IN-DEFENSE(tm) for Windows. Copyright ©1993-98 TEGAM International. All rights reserved.

Reproduction, adaptation, or translation without prior written permission is prohibited, except as allowed under the copyright laws.

IN-DEFENSE, Avcheck, Antivdos, and Antiv are all trademarks of TEGAM International. The TEGAM logo is a registered trademark of TEGAM International.

Microsoft, Microsoft Word, Microsoft Excel, Microsoft Access and MS-DOS are U.S. registered trademarks of Microsoft Corporation. Windows, Windows NT and Windows 95 are trademarks of Microsoft Corporation. All other brand names and product names mentioned herein may be trademarks or registered trademarks of their respective companies.

Information is subject to change without notice and does not represent a commitment on the part of TEGAM International. The software described is furnished under a licensing agreement. The software may be used or copied only in accordance with the terms of such an agreement. It is against the law to copy the software on any medium except as specifically allowed in the licensing agreement. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or information storage and retrieval systems, or translated to another language, for any purpose other than the licensee's personal use and as specifically allowed in the licensing agreement, without the express written permission of TEGAM International.

Restricted Rights Legend

Use, duplication, or disclosure is subject to restrictions as set forth in contract subdivision (c)(1)(ii) of the Rights in Technical Data and Computer Software Clause 52.227-FAR14.

TEGAM International's Limited Product Warranty

If you find physical defects in the materials or the workmanship used in making the product described in this document, TEGAM International will repair, or at its option replace the product at no charge to you, provided you return it (postage prepaid, with proof of your purchase from the original reseller) during the 12-month period after the date of your original purchase of the product.

THIS IS TEGAM INTERNATIONAL'S ONLY WARRANTY AND YOUR EXCLUSIVE REMEDY CONCERNING THE PRODUCT, ALL OTHER REPRESENTATIONS, WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, WRITTEN OR ORAL, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT, ARE EXPRESSLY EXCLUDED. AS A RESULT, EXCEPT AS SET OUT ABOVE, THE PRODUCT IS SOLD "AS IS" AND YOU ARE ASSUMING THE ENTIRE RISK AS TO THE PRODUCTS SUITABILITY TO YOUR NEEDS, ITS QUALITY AND ITS PERFORMANCE,

IN NO EVENT WILL TEGAM INTERNATIONAL BE LIABLE FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES RESULTING FROM ANY DEFECT IN THE PRODUCT OR FROM ITS USE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

All exclusions and limitations in this warranty are made only to the extent permitted by applicable law and shall be of no effect to the extent in conflict with the express requirements of applicable law.


Quick Installation
IN-DEFENSE QUICK INSTALLATION

To install IN-DEFENSE from floppy disks:

•	Insert IN-DEFENSE disk #1 in drive A:

•	Go to the START menu and choose RUN.

•	Type A:\SETUP and click OK.

•	Wait until SETUP loads and then follow the instructions on the screen.

To install IN-DEFENSE from a CD-ROM:

•	Insert the IN-DEFENSE CD into your CD-ROM drive.

•	If your operating system supports the auto-insert notification feature, the installation menu will appear automatically. If not, run CDSETUP from the CD.

Or to install IN-DEFENSE from a directory on your hard-drive:

•	Open Windows Explorer and go the directory where IN-DEFENSE is.

•	Double-click the SETUP program.

•	Wait until SETUP loads and then follow the instructions on the screen.


Installation Notes
IN-DEFENSE IMPORTANT INSTALLATION NOTES

Automatic Macros and Viruses: An automatic macro is a program that’s embedded in a Microsoft Word® or Microsoft Excel® document that automatically runs at certain times, without you invoking it.

Due to the fact that 80% of today’s viruses are embedded in macros, IN-DEFENSE does an extensive check of all the macros on your system.

You may be asked by IN-DEFENSE whether to remove all

Automatic macros from your computer.

If you choose Yes, then your computer will be fully protected against macro-viruses.  Should you discover that you do need a particular macro, you can recover it later with the UNDO function.

If you choose No, then IN-DEFENSE will ask you to decide which macros to Eliminate, and which ones to Accept, on a Case by Case basis.    The screen will look like this:

If you know that you created a specific macro and it appears on the screen with the option to Eliminate or Accept, you may choose Accept. Otherwise, you should choose Eliminate in order to protect your system.

Note: If in doubt, always choose Eliminate. And, if you later discover that you need the macro, IN-DEFENSE will allow you to restore it using the Undo button in the AV-Macro utility at a later time.

Rescue Disk: During installation, IN-DEFENSE will create a rescue disk for your computer. The rescue disk is designed for your computer only and you should keep it in a safe, yet readily accessible place.   Should your computer experience any problems in starting, the rescue disk will enable you to restart it with the original clean set of files.


Advanced Options
IN-DEFENSE ADVANCED OPTIONS

Enhanced configuration screens allow you to customize the way IN-DEFENSE works for protecting your computer against viruses and especially against macro-viruses (today’s biggest threat). This Advanced Options screen can be accessed from any one of the following menus:

-	IN-DEFENSE main menu via Options | Advanced.

-	IN-DEFENSE Real-Time Protection menu (the syringe at the bottom of the screen) – via Options | Advanced.

-	AV-Macro module’s menu.

Document checking mode:

This setting allows you to choose the way IN-DEFENSE checks macros:

•	“ Alert unknown documents with automatic macros”: This mode will check any document coming from an outside source for automatic macros. This is the fastest and most convenient mode – it is the default mode for documents checking.

•	“ Alert any document with automatic macros”: This mode will alert you for every document that contains macros, whether it is new to your computer or not.

•	“ Alert any document with macros”: This mode will alert any document that contains macros – even if the macros are not suspicious.

File extensions to check: This specifies the file extensions of Microsoft® documents that IN-DEFENSE should check.

Report file: Here you can specify the path to where the report file should be created and its limit size.

Daily Usage Options

Units to check automatically: Here you can define which units and paths need to be treated on a daily basis. This is mostly useful in networked environments.

Actions to perform on alert: This allows you to choose whether to perform automatic actions or just display an alert when a virus is intercepted. Again, this is very useful in a networked environment, but can be useful for a stand-alone PC if you don’t want to be alerted or interrupted by any virus warning and just get rid of the virus automatically.

Backup files before making any modification: It is recommended to set this option on, because it allows you to undo some of IN-DEFENSE’s operations later (such as macro elimination) if you want to.


AV-Macro
AV-MACRO MODULE FOR PROTECTION AGAINST MACRO-VIRUSES

AV-Macro is a module designed specifically to protect against macro-viruses:

You can select:

Check: to begin checking document files in the indicated path.

Advanced: to access the Advanced Options screen.

Undo: to re-activate macros that were eliminated by mistake.