Multimedia Selection

home *** CD-ROM | disk | FTP | other *** search

/ Multimedia Selection / Multimedia Selection Volume One - CD-ROM / MULTIMEDIA SELECTION____________.ISO / utils / vshild / vshld86.doc < prev

Wrap

Text File | 1992-01-29 | 30.4 KB | 682 lines

VSHIELD Version 4.8B86 VSHIELD1 Version 0.2 CHKSHLD Version 1 Copyright (C) 1989 - 1992 by McAfee Associates. All rights reserved. Documentation by Aryeh Goretsky. McAfee Associates (408) 988-3832 office 4423 Cheeney Street (408) 970-9727 fax Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps U.S.A (408) 988-5138 BBS HST 9600 (408) 988-5190 BBS v32 9600 CompuServe GO VIRUSFORUM Internet mcafee@netcom.com TABLE OF CONTENTS SYNOPSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 - What VSHIELD is, system requirements AUTHENTICITY . . . . . . . . . . . . . . . . . . . . . . . . . .2 - Verifying the integrity of VSHIELD WHAT'S NEW . . . . . . . . . . . . . . . . . . . . . . . . . . .3 - Features, new viruses added in this release OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 - Detailed description of VSHIELD OPERATION. . . . . . . . . . . . . . . . . . . . . . . . . . . .6 - Options to use with VSHIELD EXAMPLES . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 - Samples of frequently-used options INSTALLATION . . . . . . . . . . . . . . . . . . . . . . . . . .9 - How to install VSHIELD on your system EXIT CODES . . . . . . . . . . . . . . . . . . . . . . . . . . .9 - For running VSHIELD from batch files VIRUS REMOVAL. . . . . . . . . . . . . . . . . . . . . . . . . .10 - What to do if a virus is found REGISTRATION . . . . . . . . . . . . . . . . . . . . . . . . . .11 - How to register VSHIELD in the U.S. and abroad TECH SUPPORT . . . . . . . . . . . . . . . . . . . . . . . . . .11 - Information you should have ready when calling APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . . .12 - Creating an exception list for the /CERTIFY option APPENDIX B . . . . . . . . . . . . . . . . . . . . . . . . . . .13 - Implementing and using the CHKSHLD program Page 1 VSHIELD Version 4.8B86 Page 2 SYNOPSIS VSHIELD is a virus prevention program for IBM PC and compatible computers. It will prevent viruses from infecting your system. When VSHIELD first loads it will search the PC for known computer viruses in memory, the partition table, boot sector, system files, and itself and then install itself as a Terminate-and-Stay-Resident (TSR) program. It will then scan all programs before allowing the system to execute them. If any program contains a virus, VSHIELD will refuse to allow it to execute. It will also not allow the system to be warm-booted from any diskette which contains a boot-sector virus. VSHIELD can optionally check files that have been validation coded by the VIRUSCAN (SCAN) program for new, unknown viruses as well as check files for viruses as they are copied or accessed. VSHIELD monitors a system for viruses by checking programs for virus signatures, checking the validation code added by the VIRUSCAN program to a file, or both. Two separate programs are available. The first, VSHIELD.EXE, checks for known viruses, using virus signatures, as well as unknown viruses by checking validation codes added with the SCAN program. The second program, VSHIELD1.EXE, does validation code checking only. The VSHIELD programs monitor all program loads regardless of what disk they occur from, unless otherwise specified. The supplemental CHKSHLD program can be used to check to see if the VSHIELD is resident in memory. VSHIELD optionally provides access control functions to reduce the risk of introducing computer viruses from unknown software. VSHIELD will run on any PC with 256Kb and DOS version 2.0 or greater. VSHIELD1 uses 6Kb of system memory. VSHIELD uses 32.7Kb of system memory in non-swap mode, or 3Kb if swapping-to-disk is specified. VSHIELD can be loaded into high memory, in which case 416 bytes of conventional memory is used. AUTHENTICITY VSHIELD is packaged with the VALIDATE program to ensure the integrity of the VSHIELD.EXE, VSHIELD1.EXE, and CHKSHLD.EXE files. The VALIDATE.DOC instructions tell how to use the VALIDATE program. The VALIDATE program is distributed with VSHIELD and may be used to check all future versions of VSHIELD. The validation results for the VSHIELD Version 4.8B86 and VSHIELD1 Version 0.2 programs should be: FILE NAME: VSHIELD.EXE VSHIELD1.EXE CHKSHLD.EXE SIZE: 37,559 11,323 7,839 DATE: 01-29-1992 02-14-1991 12-10-1991 FILE AUTHENTICATION Check Method 1: AE98 8578 0193 Check Method 2: 1836 03CE 1B2C If your copy of the VSHIELD programs differ, they may have been modified. Always obtain your copy of VSHIELD from a known source. The latest version of VSHIELD and validation codes for VSHIELD.EXE and VSHIELD1.EXE can be obtained off of McAfee Associates bulletin board system at (408) 988-4004. VSHIELD Version 4.8B86 Page 3 Beginning with Version 72, all McAfee Associates programs for download are archived with PKWare's PKZIP Authentic File Verification. If you do not see the "-AV" message after every file is unzipped and receive the message "Authentic Files Verified! # NWN405 Zip Source: McAFEE ASSOCIATES" when you unzip the files then do not run them. If your version of PKUNZIP does not have verification ability, then the message may not be displayed. Please contact McAfee Associates if your .ZIP file has been tampered with. WHAT'S NEW Version 86-B has been released to fix a bug with the /CERTIFY option.s Two new options, /NODISK and /ACCESS have been added. The /NODISK option allows vshield to be loaded from a file server into workstations that do not have a local hard disk. The /ACCESS option tells VSHIELD to check for viruses any time an executable file is accessed for any reason. This includes Zipping an executable into a compressed file, moving an executable file from one subdirectory to another, or any other access to an executable file. VSHIELD Version 4.8B86 Page 4 OVERVIEW VSHIELD is a memory-resident program that prevents viruses from infecting your computer. VSHIELD does this by checking program files before they are loaded into the computer and executed. VSHIELD can also check for viruses during a copy operation. If a virus is found, or a program does not match its validation check, or a file is not on the /CERTIFY list, then VSHIELD will not allow the file to be executed, preventing the virus from infecting your system. VSHIELD will also check the disk the computer is booting from for boot sector and partition table viruses. In the event that a virus is found, VSHIELD will not allow the system to reboot and will prompt the user to insert a clean, write-protected boot disk and run the VIRUSCAN program to determine the extent of the infection. When VSHIELD is placed in the AUTOEXEC.BAT file, it will install itself each time the system is turned on or rebooted. It will proceed to check the memory, partition table, boot sector, system files, and itself for viruses and then install itself as a Terminate-and-Stay-Resident (TSR) program. It then monitors all program loads for viruses. If a virus is found using Level I protection, a warning message will be displayed stating the name of the modified file. If a virus is found using Level II or III protection, a warning message will be displayed stating the filename and name of the virus. Loading will then be terminated, preventing infection of the system by the infected program. If a program is loaded using the /CERTIFY option that has not been validated or is not on the exception list, then a message will be displayed saying that access has been denied. When the power is turned off and the system is booted (without VSHIELD) off an infected floppy, VSHIELD will detect the infection the next time VSHIELD is executed. VSHIELD level II and III protection will also prevent partition table and boot sector infector viruses from infecting the system during a a warm reboot of the system (Ctrl-Alt-Del). It does this by examining the diskette being booted from and halting the reboot process if a virus is found. VSHIELD has four levels of user-selectable protection: - Level I protection, provided by the VSHIELD1 program, checks the Cyclic Redundancy Check (CRC) validation code values added to programs by the VIRUSCAN program's /AV option. If a program no longer matches its validation code VSHIELD1 will not allow it to execute. VSHIELD1 will also check the partition table and boot sector validation codes, if present. Level I protection provides a minimal degree of protection, and it is recommended that Level II protection or above be used if system resources permit. - Level II protection, provided by the VSHIELD program, checks program files for virus signatures. A virus signature is a piece of code or pattern unique to each computer virus strain. VSHIELD will check the memory, partition table, boot sector, system files, and itself for viruses before installing itself as a TSR program. It will then check programs loaded after it installs itself for computers viruses. If a virus is found, VSHIELD will not allow the program to execute. VSHIELD VSHIELD Version 4.8B86 Page 5 will also not allow a computer to be warm-rebooted from a diskette infected with a partition table or boot sector infector. - Level III protection is a combination of Level I and Level II Protections. - Level IV protection is access control and allows the user to specify which programs can and can not be run. Level IV protection can be set up so that only programs that are listed in a certification file may be run on a given system. It may also be set up so that only those programs that have been validated by VIRUSCAN may be run. Each level of protection has its advantages and disadvantages. The Level I protection, VSHIELD1, requires the least amount of system overhead, using 6Kb of system memory. It provides minimal protection, however. The Level II, III, and IV protections requires 32.7Kb of system memory, but this can be reduced to 3Kb by using the /SWAP option or 416 bytes with the /LH option. The /SWAP option leaves a VSHIELD kernel in memory that swaps the main body of the program in and out of memory as needed. VSHIELD will add an average of three seconds to each program load, and six seconds to each reboot. Using the /SWAP option adds an additional 600 milliseconds to each program load. VSHIELD will not degrade the performance of the system in any way once a program has been loaded, unless the /ACCESS or /COPY options are chosen. VSHIELD1 will add an average of 1 second to each program load. NOTE: VSHIELD and VSHIELD1 should not be used simultaneously. Either one or the other should be selected. The CHKSHLD program is run to check if VSHIELD is resident in memory. A general check can be performed to see if the program is resident, or a detailed check can be performed to see if a specific version is in memory--this feature can be used to update a workstation if it is running an outdated version of the VSHIELD program. OPERATION IMPORTANT NOTE: CREATE A BACKUP DISK BY COPYING THE VSHIELD PROGRAMS TO A BLANK FLOPPY AND WRITE-PROTECTING IT BEFORE RUNNING THE PROGRAMS. THIS WILL GIVE THE USER A VALID BACKUP IN CASE THE PROGRAMS BECOME INFECTED. VSHIELD and VSHIELD1 will monitor your system for attempts to load an infected program. If an infected program is loaded, VSHIELD will display a message stating the name of the file, the virus infecting it, and will prevent the file from being executed; and VSHIELD1 will display a message stating the name of the file, the fact that it has been modified, and will prevent the file from being executed. CHKSHLD can be used to determine if the VSHIELD program is in memory and also check for a specific version. A Note On Using Options: VSHIELD is designed to provide very high protection even without the use of any of the options listed below. Placing VSHIELD in the the AUTOEXEC.BAT file without any options will provide sufficient protection for all but the most extreme environments. In some cases, where available memory is a problem, the Load High option (/LH) or the swapping option (/SWAP) should be used to minimize memory usage. The /CONTACT option, which displays a custom contact message in the event that a virus is found, should be used in corporate environments where central control over infection occurences is desired. All other options should be used only if required to customize VSHIELD to a unique environment or to unique security needs. The /COPY and /ACCESS options (which prevent copying a virus onto a system and notify a user whenever an infected file is accessed), for example, require additional system overhead, yet provide only marginally increased protection. Copying a virus onto a system does NOT infect the system. The infected program must still be executed for infection to take place. Running VSHIELD with no options will still prevent the virus from infecting the system. VSHIELD provides many options that allow for flexibility in meeting corporate, networking, and secure environment needs, but the trade-offs in system overhead or user constraints should be carefully weighed in your choice of options. VSHIELD Version 4.8B86 Page 6 To run VSHIELD type: VSHIELD /ACCESS /CERTIFY filename /CHKHI /CONTACT message /COPY /CV /F pathname /IGNORE d1:...d12: /LH /LOCK /M /NB /NODISK /NOBREAK /NOMEM /SWAP pathname /WINDOWS /ONLY d1:...d12: Options are: /ACCESS - Check for viruses whenever file is opened /CERTIFY filename - Enable access control with exception list /CHKHI - Check memory from 0-1088Kb for viruses /CONTACT message - Display message when virus is found /COPY - Check for viruses during COPY operations /CV - Check validation codes added by VIRUSCAN /IGNORE d1...d26 - Ignore program loads from drives d1:...d26: /LH - Load VSHIELD Into High Memory (DOS 5.0 Only) /LOCK - Halt and freeze system when virus is found /M - Scan memory for all viruses during install (see restrictions below) /NB - Disable boot sector checking /NOBREAK - Disable Ctrl-C / Ctrl-Brk during installation /NODISK - Allow load onto diskless workstation from file server /NOMEM - Skip memory checking /ONLY d1...d26 - Only check program loads from specified drives /REMOVE - Uninstall VSHIELD from memory /SWAP pathname - Install VSHIELD kernel as memory-resident /F pathname - Required parameter for DOS 2.0 or earlier /WINDOWS - Enable checking of DOS processes under Windows The /ACCESS option causes VSHIELD to check programs for viruses any time that a program file is Opened for access for any reason. This option should only be used in high virus risk environments or by software developers. It will, for example, prevent a developer from zipping a virus infected file into an archive for distribution. The /ACCESS option will slow down program start-up processes under WINDOWS and may slow down file copies using DOS Shell routines. Using the /CV option with the /ACCESS option is not recommended since the combined overhead of the two functions may substantially slow down program loads. /ACCESS cannot be used with the /SWAP option. The /CERTIFY option allows a system administrator to control access to executable files. This can be used to prevent unauthorized software from running that could introduce a computer virus. When run with the /CV option, /CERTIFY allows only files that have had validation codes inserted into them with the VIRUSCAN program to execute. An exception list of "trusted" files can also be made to allow files on the exception use to be executed. if /CERTIFY is used wothout the /CV option, then only those programs in the exception list will be allowed to run on the system. For instructions on how to create an exception list, refer to Appendix A. NOTE: Running /CERTIFY without /CV option or an exception list will prevent all programs other than DOS internal commands from being run. The /CHKHI option checks the memory above 640Kb that can be used on AT (286) and 386 systems for computer viruses. This includes the 384Kb Upper Memory Area from 640Kb to 1024Kb, and the 64Kb High Memory Area from 1024Kb to 1088Kb. On XT systems with extended memory cards installed, this will cause the first 64K of RAM to be scanned again. This option can not be used with the /NOMEM option. The /CONTACT option displays a contact name and phone number when a virus is found. The name and number message can be fifty (50) characters long, and can contain any characters. If the message begins with a slash "/" or a hyphen "-" then the message must placed in quotation marks. The /COPY option allows VSHIELD to check files for viruses as they are copied using the DOS COPY command. The boot sector of the first bootable floppy drive will also be checked for viruses during copy and directory operations. This option can not be used with the /SWAP option. VSHIELD Version 4.8B86 Page 7 The /CV option checks validation codes inserted by the VIRUSCAN program to provide Level III protection as defined above. If a file no longer matches its validation code, VSHIELD will report that the file has been modified, that viral infection may have occurred, and will not allow the program to execute. If the /CV option is not specified, VSHIELD will provide Level II (virus signature) checking only. For information about the installation of CRC validation codes, please refer to the VIRUSCAN program documentation. The /F option is required if the user wishes to use the /SWAP command and is running DOS 2.0 or earlier. The /F option tells VSHIELD where it has been loaded from. The complete pathname must be specified. The /IGNORE option will specify which drive(s) to ignore program loads off of. Drives which are ignored will NOT be checked for viruses. Up to twenty-six drives may be ignored. This option is for use with network operating systems that have existing virus protection and is not recommend for use on stand-alone PC's or networks which have no anti-viral features in use. The /LH option causes VSHIELD to load into High Memory on 386 systems running MS-DOS 5.0 or above. The /LOCK option will halt the system if a virus is found so that processing cannot continue. The /M option tells VSHIELD to check system memory for all known computer viruses that are memory resident before installing itself. By default, VSHIELD only checks memory for critical and "stealth" viruses, which are viruses that can cause damage or spread during the scanning process. If a critical or "stealth" virus is found, VSHIELD will stop the system and advise the user to cold boot the machine from a clean copy of DOS and scan the system for viruses. For a listing of critical viruses, please refer to the VIRUSCAN documentation. The /NOBREAK option disables Control-C and Control-Brk from stopping VSHIELD during installation. The /NOMEM option is used to turn off all memory checking for viruses during installation. It should only be used when a system is known to be free of viruses. This option can not be used with the /M option. The /NB option will tell VSHIELD not to look at the partition table and boot sector. The /ONLY option tells VSHIELD which drives to check program loads off of. All other drives will be ignored. This option can not be used with the /IGNORE option. The /REMOVE option will uninstall the VSHIELD program and remove it from memory. If other memory-resident programs prevent VSHIELD from being uninstalled an error message will appear. The /SWAP option tells VSHIELD to install only its kernel as memory resident. The VSHIELD program will then be swapped in and out of memory as needed from a hard disk or RAM disk. The placement of a path after the /SWAP command is optional, and should only be used if VSHIELD is to be swapped from other than the path from which it is being executed. The /SWAP option can not be used with the /COPY or /ACCESS options. VSHIELD Version 4.8B86 Page 8 NOTE: The /SWAP parameter should only be used if the computer has a limited amount of system memory available for memory-resident programs. It is recommended that VSHIELD be used without the /SWAP option whenever memory permits. The /WINDOWS option should be used when running Windows 3.0. It will allow VSHIELD's messages to be displayed properly. If the /WINDOWS option is used without running Windows, it will have no effect. To run VSHIELD1 type: VSHIELD1 /NB /REMOVE Options are: /NB - Bypass boot sector checking /REMOVE - Uninstall VSHIELD1 from memory The /NB option will tell VSHIELD not to look at the partition table and boot sector. This option should only be used if VSHIELD1 continually reports that the boot sector has been modified. This occurs on some old Hewlett Packard and Zenith systems because they modify the boot sector each time the system is booted. Check your system's manual to determine if your system contains self-modifying boot code. The /REMOVE option will uninstall the VSHIELD1 program and remove it from memory. If other memory-resident programs prevent VSHIELD1 from being uninstalled an error message will appear. To run CHKSHLD type: CHKSHLD /DEBUG /Q /V xxxxx /? /H /HELP Options are: /DEBUG - Display version and errorlevel on screen /Q - Quiet mode (display no messages on screen) /V xxxxx - Check to see if version 'xxxxx' of VSHIELD is installed /? /H /HELP - Display help screen The /DEBUG option will display the version of VSHIELD installed (if resident) in memory and the errorlevel returned on the screen. The /Q option will prevent any information from being displayed when CHKSHLD is run. The /V xxxxx switch will check to see if Version "xxxxx" of VSHIELD is in memory, for example, "4.3V84" for VSHIELD 4.3V84. The /?, /H, or /HELP switches will display a help screen. CHKSHLD's ERRORLEVELS CHKSHLD will set the DOS ERRORLEVEL to one of the following values when run: ERRORLEVEL | DESCRIPTION -----------+-------------------------------- 0 | VSHIELD is resident in memory, or if /V is used, the | version specified is resident in memory. 1 | VSHIELD is resident in memory but doesn't match /V 2 | VSHIELD is NOT resident in memory 3 | Abnormal termination (program error) EXAMPLES The following examples are shown as they would be typed in on the command line. VSHIELD To install VSHIELD (Level II protection) VSHIELD /CV To install VSHIELD (Level III protection) VSHIELD /CV /CERTIFY EXCPTN.LST To Install VSHIELD (Level IV protection) with CRC and exception list checking. VSHIELD /SWAP To install VSHIELD kernel only as memory resident and swap from root directory of disk on DOS 3.0+ system VSHIELD /SWAP /F C:\VSHIELD.EXE To install VSHIELD kernel only as memory resident and swap from root directory of disk on DOS 2.0 system VSHIELD /CV /CONTACT "Please Contact the PC Help Desk" To install VSHIELD using Level III protection, and display a message if virus is found. CHKSHLD /V 4.3V84 /Q To check for VSHIELD 4.3V84 in memory and not display any messages on the screen. VSHIELD Version 4.8B86 Page 9 INSTALLATION VSHIELD and VSHIELD1 should normally be placed at the end of the AUTOEXEC.BAT file. The exception to this is any AUTOEXEC.BAT that contains a menu program, such as MS-DOS's DOSSHELL program, PC Tool's PC Shell, or Norton Commander. If using such a program, VSHIELD or VSHIELD1 should be loaded before it. CHKSHLD should normally be used in the batch file used to log a user into a LAN. The program will return an errorlevel which can be used to determine if VSHIELD is resident or an old version of VSHIELD is installed on the PC, in which case it can be updated from the current version stored on the file server. If network drivers are being used, VSHIELD *MUST* be loaded AFTER the network drivers, preferably at the end of the AUTOEXEC. This is because network drivers replace normal DOS functions in a manner that prevents VSHIELD from recognizing program loads if VSHIELD is loaded first. Running VSHIELD after network drivers have been loaded will ensure proper virus protection. It is recommended that VSHIELD be used in non-swap mode if free memory permits. Use of the /SWAP option may cause conflicts with programs that fail to allocate memory properly. If conflicts do occur, remove the /SWAP option and reboot the machine. If there is not enough memory to load VSHIELD in non-swap mode, than the VSHIELD1 program should be used instead. ERROR LEVELS VSHIELD will set the following DOS ERRORLEVELS prior to going resident: VALUE | DESCRIPTION ------+-------------------------- 0 | No viruses found 1 | One or more viruses found 2 | Abnormal termination (program error) VSHIELD Version 4.8B86 Page 10 VIRUS REMOVAL What do you do if a virus is found? You can contact McAfee Associates for help with removing viruses by BBS, CompuServe, FAX, telephone, or InterNet. There is no charge for support calls to McAfee Associates. The CLEAN-UP universal virus disinfection program is available and will disinfect the majority of reported computer viruses. It is updated with each release of the SCAN program to remove new viruses. The CLEAN-UP program can be downloaded from McAfee Associates BBS, our Computer Virus Help Forum on CompuServe, the SIMTEL20 archives on the Internet, or from the agents listed in the AGENTS.TXT file. It is strongly recommended that you get experienced help in dealing with viruses, especially critical viruses that can damage or destroy data [for a listing of critical viruses, see the /M option under OPTIONS, above] and partition table or boot sector infecting viruses, as improper removal of these viruses could result in the loss of all data and use of the disk(s). For qualified assistance in removing a virus, please contact McAfee Associates directly or check the enclosed AGENTS.TXT file for an Authorized McAfee Associates Agent in your area. Agents may charge McAfee Associates normal support rates for their services. TECHNICAL SUPPORT In order to facilitate speedy and accurate support, please have the following information ready when you contact McAfee Associates: - Program name and version number. - Type and brand of computer, hard disk, plus any peripherals. - Version of DOS you are running, plus any TSRs or device drivers in use. - Printouts of your AUTOEXEC.BAT and CONFIG.SYS files. - The exact problem you are having. Please be as specific as possible. Having a printout of the screen and/or being at your computer will help also. McAfee Associates can be contacted by CompuServe Forum, BBS, or FAX twenty-four hours a day, or call our business office at (408) 988-3832 Monday through Friday, 8:00AM to 5:00PM Pacific Standard Time. McAfee Associates (408) 988-3832 office 4423 Cheeney Street (408) 970-9727 fax Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps U.S.A (408) 988-5138 BBS HST 9600 (408) 988-5190 BBS v32 9600 CompuServe GO VIRUSFORUM InterNet mcafee@netcom.com VSHIELD Version 4.8B86 Page 12 APPENDIX A: Creating an Exception List for the /CERTIFY Option The Exception List data file should be created with an editor or word processor and saved as an ASCII text file. Be sure each line ends with a CR/LF pair. NOTE: The /CERTIFY option is intended for use in environments where there is significant risk of viral infection due to the use of unauthorized software. It is not intended for use in an environment where new software is introduced on a continuous basis. When /CERTIFY is run with the /CV option, only files that have been validated by the VIRUSCAN program will be allowed to run. When run with an Exception List, only files in that list will be allowed to run. Running /CERTIFY with both the /CV option and an exception list will allow both files that have been validated with the VIRUSCAN program and files on the exception list to be run. The Exception List uses the following format: d:\pathnam1\filenam1.ext *comment . . d:\pathnam1\filenam2.ext *more comments Where "d:" is the name of the drive, "\pathnam1\" is the name of the path, and "filename.ext" is the name of the file, including the extension. Up to 1,000 characters worth of filenames can be specified. Comment lines are preceded with an asterisk "*" and are ignored by VSHIELD. Running /CERTIFY without /CV option or an exception list will prevent all programs other than DOS internal commands from being run. VSHIELD 4.8B86 Page 13 APPENDIX B: Miscellaneous Application Notes DOS 5 AND VIRUSCAN VALIDATION CODES If you have installed DOS 5.0 on your system, and had been running VIRUSCAN or VSHIELD with the check validation codes /CV option, you will need to reinstall validation codes to the DOS 5.0 files with the add validation codes /AV option of VIRUSCAN. The quickest way to update the validation codes is to remove all validation codes from the hard disk using the /RV option and then add them back on by running VIRUSCAN with the /AV options.