The other chapters in this manual are meant to tell you clearly and concisely how to use the VirusScan software. Still, you may have questions or encounter confusing situations. This chapter contains two kinds of advice:
1 Tips for getting the most out of VirusScan.
1 Common problems and how to solve or avoid them.
If this information doesn't help resolve your question or problem, contact McAfee (see "Technical support" in Chapter 1).
Tips
Detecting new and unknown viruses
There are two ways of dealing with new and unknown viruses that may infect your system:
1 Update VirusScan regularly.
1 Store and check validation and recovery information about your files.
Update VirusScan regularly
Most likely, McAfee will see new viruses long before you do. We update the VirusScan programs oftenùusually monthly, but more often if many new viruses have appeared. Each new version may detect and eradicate as many as 60 to 100 new viruses or more, and may fix bugs that have been reported.
Updating VirusScan regularly is probably all you need to do to protect against new viruses. See the instructions for obtaining new versions in "Updating VirusScan regularly" in Chapter 2.
Use the validation and recovery options
If your environment is highly vulnerable to viruses, or you require unusual security against them, you can use VirusScan's validation and recovery options. Scan checks for new or unknown viruses by comparing files against previously recorded validation data. If a file has been modified, it no longer matches the validation data, and Scan reports that the file may have become infected. Scan has two levels of validation, which are stored in two separate ways:
1 It can store the enhanced code in a separate recovery file, which can be stored off-line (for example, on a diskette) for recovery purposes (/AF, /CF, and /RF switches). This is the preferred method because it stores the data for files, the boot sector, and the master boot record (MBR) of a disk in the recovery file.
1 It can append a simple 98-byte validation code to .COM and .EXE files (/AV,
/CV, and /RV switches). This method applies to the files you specified only. It does not store data for the boot sector and master boot record (MBR).
Once the validation codes are stored, both Scan and VShield can use the /CV and /CF options to detect changes to the files. More importantly, if you have stored the recovery information with /AF, Scan can use it to restore infected files, master boot records (MBR), and boot sectors.
All of these options require continuing effort to store and maintain the codes. For example, if you install new programs or upgrade old ones, you should use the /RV or /RF options to remove all codes, then /AV or /AF to restore them.
If you want to use one of these methods, which should you use? We recommend the "F" optionsù/AF, /CF, and /RFùover the "V" options. /AF stores the validation and recovery information in a separate file, instead of modifying the program files themselves. This has three advantages:
1 You can store the recovery file off-line (on your clean anti-viral startup diskette, for example, or on a network drive or tape drive) and access it on demand to check for, and recover from, infection by unknown viruses. Use the procedure below to create a recovery diskette.
1 This method keeps self-checking files (usually copy-protected programs) from reporting that they have been tampered with.
1 If you use this method, you don't need an exception list. However, it's important that you run Scan with the /RF option on individual self-modifying files, such as Lotus 1-2-3, to remove the validation codes for those programs from the validation file.
The "V" options are primarily useful for companies that distribute software to their customers or employees, and want to incorporate an additional level of virus protection.
Creating a recovery diskette\x14To store the recovery file on the clean startup -diskette you created in "Making a clean start-up diskette" in Chapter 2, tem-porarily remove write-protection from the diskette and insert it in drive A. Run Scan on your hard disks with the /AF option. For example:
scan /adl /af a:\scancrc.crc
scans the local hard disk drives for known viruses and creates SCANCRC.CRC, a file containing recovery data and validation codes, on the diskette. After Scan finishes, write-protect the diskette.
To check for virus infection, turn your computer off, insert the recovery diskette in drive A, and turn the power back on. The PC will now start from the diskette. At the DOS prompt, type:
scan /adl /cf a:\scancrc.crc
to compare the local hard disk drives against the recovery data stored on the diskette in the SCANCRC.CRC file.
If you detect an unknown virus, to disinfect your system, turn your PC off, insert the recovery diskette, and turn the power back on. The PC will start from the floppy disk. At the DOS prompt, type:
scan /adl /cf a:\scancrc.crc /clean
to restore local hard disk drives with the recovery data stored in SCANCRC.CRC on the diskette.
If you install new software, or upgrade your DOS version, remember to up-
-date your recovery file. See "Application note 1: Updating validation codes" in Chapter 4.
Interacting with your network
Many personal computers are interconnected through a local area network (LAN). VirusScan is highly compatible with most networks. Here are some ways of using the VirusScan software with your network:
Run Scan on network drives\x14Run from a workstation (PC) on the network,
Scan checks network drives for viruses just as it does local drives. For convenience, the /ADN option scans all network drives to which the workstation is connected.
Use VShield and CheckVShield\x14By activating VShield as part of every work-station's AUTOEXEC.BAT file, you can prevent the workstations from introducing viruses into the network. Network administrators can ensure that VShield is active on each workstation by running CheckVShield as part of the network login script, before actual login.
Use NetShield\x14NetShield provides continuous virus protection on a NetWare server. NetWare network administrators can use it to check for both known and unknown viruses and to monitor all network activities. On other kinds of networks, you can use Scan to check network servers.
Develop a network security program, as described in the next tip.
Develop a security program
VirusScan has been shown to be an effective virus-preventive measure when
used in a conscientiously applied program of network security and regular
professional care.
VirusScan is one important element of a comprehensive computing security program that includes a variety of safety measures, such as regular backups, meaningful password protection, user training, and awareness. Even with VirusScan, some virusesùnot to mention theft or fireùcan render a disk -unrecoverable without a recent backup. Although outlining such a security -program is beyond the scope of this manual, see "Other sources of information" in Chapter 1 for suggestions.
If you are a network administrator, we urge you to implement a security program to safeguard your organization's data and productivity. If you are a network user, please support and comply with such a program.
Troubleshooting
General abnormalities
Using VirusScan with other anti-virus software
When you run more than one anti-virus program, you risk strange results and false alarms. For example, some anti-virus programs store their "virus signature strings" unprotected in memory. Running VirusScan may "detect" them falsely as a virus.
TSR conflicts
Some "terminate-and-stay-resident" (TSR) software may conflict with VirusScan programs, especially VShield (which is itself a TSR). To check whether this is the problem, "comment out" the other TSR files in your AUTOEXEC.BAT file and restart your system. If the errors disappear, the TSR conflict caused them.
Slow disk access, program locks
Running VShield will slow your system slightly as described in Chapter 5, especially if you use either the /ANYACCESS or /SWAP options. If you experience very slow disk access, or if programs lock or freeze while using Windows 3.1, you may be using a disk cache program that interferes with program operation, or you may need to increase the number of BUFFERS in your CONFIG.SYS file.
Troubleshooting Scan
False alarms
Scan may incorrectly report viruses in the boot sector or master boot record (MBR) of certain copy-protected diskettes. Contact technical support if you're unsure (see "Technical support" in Chapter 1).
Troubleshooting VShield
Program locks with /SWAP
When VShield is running with the /SWAP option, certain programs may lock up the computer. These programs may use memory without allocating it first, including older versions Lotus 1-2-3, pfs:Write and Professional Write, OfficeWrite, and DisplayWrite4. To correct, restart your computer and run VShield without the /SWAP option.
Unable to remove VShield
If the /REMOVE option doesn't successfully remove VShield from memory, you have probably loaded other terminate-and-stay-resident (TSR) programs after VShield. VShield can't be removed until the other TSRs are removed. If you need to unload VShield often, load it last.
