ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/SWVSAF11.ZIP/MANUAL5.ASC

Text File | 1990-11-21 | 34.7 KB | 841 lines

Section 3:  Installation

SafeWord Virus-Safe is very easy to install.  This  Installation chapter
starts with three parts: Advance preparation, Automated installation
process, and Manual installation process.  All users should carry out the
steps described in Advance preparation, section 3.1.  Most users can then
proceed directly through the Automated installation procedure described in
section 3.2.  For users who are uncomfortable with automated installation
procedures, all the installation steps are fully described in section 3.3,
Manual installation process.

Advanced Preparation

Before installing SafeWord Virus-Safe, there are a few steps you should take
to be fully prepared.  Begin by formatting two blank diskettes.  Consult
your DOS manual for instructions on formatting diskettes.  (To avoid any
possibility of viral contamination of these diskettes, turn your computer
off, then bootstrap from your original DOS diskette.  Use only format
utilities from that original diskette.  Avoid using your hard disk during
this process unless you are sure it is not polluted.) Make at least one of
the formatted diskettes bootable by using the SYS command as described in
your DOS manual, or by formatting using the FORMAT /S option.

README.ASC

Check your distribution diskettes for a file named "README.ASC". If such a
file exists, it contains instructions relevant to your version of SafeWord
Virus-Safe.  Read this file by printing it or using the DOS  TYPE command.
Follow any instructions you find in the READ.ME file before proceeding.

Backing up the distribution diskettee

Make a copy of your SafeWord Virus-Safe distribution diskette using standard
DOS commands or copy utilities.  The distribution diskettes are not copy-
protected, so no special procedure is required.  Consult your DOS manual for
instructions if needed.  For backup purposes, it isn't necessary to use a
bootable diskette. Therefore, if you made only one bootable diskette, save
it for the next step, and use the non-bootable one for backup.  Label this
diskette  "SafeWord Virus-Safe Master Backup".

Make a  bootable SafeWord Virus-Safe diskette

Next, make a  bootable copy of your SafeWord Virus-Safedistribution diskette
using only the commands from your standard DOS diskette.  First create an
AUTOEXEC.BAT file containing only the following entry:

\SWVSAFE\SWVSAFE

Then, create a sub-directory on the new diskette named \SWVSAFE. Copy the
entire contents of the SafeWord Virus-Safe distribution diskette to the sub-
directory SWVSAFE on your new diskette.  The last step for you to perform
before your diskette is ready is to run SWVEDIT.EXE from this new diskette.
SWVEDIT.EXE will give you the opportunity to specify the names of programs
you want examined when SafeWord Virus-Safe is first loaded.  As a minimum,
specify:

DOS.FILES (a special name used only by this package),

C:[path]\SWVSAFE.COM

[path]\SWVEDIT.EXE

Where [path] is the full path to the directory in which you intend to store
SafeWord Virus-Safe on your hard disk (usually \SWVSAFE).  After this, label
the diskette  "SafeWord Virus-Safe sterile kernel" and store it away for
safe keeping.  DO NOT EXECUTE ANY PROGRAMS THAT MIGHT BE VIRALLY
CONTAMINATED WHILE THIS DISKETTE IS IN ANY DISKETTE DRIVE.

This sterile kernel diskette should be used ONLY to bootstrap your computer
periodically and to run SafeWord Virus-Safe (see section4.2).  When not in
use, it should be physically locked up.  Becauseit is physically separated
from your hard disk (and from your day-to-day activity), this diskette
cannot become contaminated by viruses that may infect your other programs.

The sterile kernel diskette will form the last line of defense in the event
your hard disk becomes contaminated.  Whenever you suspect that the key
programs on your hard disk (such as DOS or SafeWord Virus-Safe) may have
become contaminated, you will be able to confidently bootstrap from this
sterile kernel diskette and have those key programs examined from a known
unpolluted environment. YOU CAN HAVE TOTAL CONFIDENCE IN THIS SYSTEM ONLY IF
YOU RELIGIOUSLY AVOID USING THIS STERILE KERNEL DISKETTE FOR ANY OTHER
PURPOSE.

Automated Installation

The install program is also an update program.  If SafeWord Virus-Safe is
found in the directory specified by the user, SWVINST will perform an UPDATE
instead of a complete installation.  This way, the user does not have to
remember what cipher phrase was used for the initial installation.

SWVINST will also assign and maintain a number to be used when you register
your copy of the software, and also and registered user text from the
version being updated, if present.  If this information is NOT present in
the version being updated, SWVINST will compute a registration number. The
registration number is derived from the registered user's name, the cipher
phrase, and the current date / time. The calculation of a registration
number should NOT be confused with the official registration process:
official registration of the product is REQUIRED in order to obtain a waiver
of copyright restrictions permitting your continued use. Official
registration requires that you pay a registration fee as described in other
information accompanying the distribution package. The registration NUMBER
calculated during the installation process is simply an aid in the
installation process which may form a part of the official registration
process.

SWVINST will switch from drive A: to drive B: if the SafeWordVirus-Safe.
program is  not found.  If the program is still not found, an error message
will be issued, asking the user to place the SafeWord Virus-Safe diskette
into drive A:.

Bootstrap your computer in the usual way, and take whatever stepsare
necessary to get to a standard DOS prompt.  Insert yourSafeWord Virus-Safe .
Master Backup diskette into drive A:.

Start by typing:

A:SWVINST

Command Line Options

The following are the command line options available for SWVINST:

/CASEON

/CASEOFF

/CO or /COLOR

/NOEDITOR

/ADDFILES=[drive list]

/DEF=[verification][%][mode][frequency]

/DEFAULTS

/CASEON

CASEON specifies that SWVINST  is to be sensitive to uppercase  or lowercase
in the cipher phrase.

/CASEOFF tells SWVINST to treat all letters in the cipher phraseas
uppercase.  This is the default.

COLOR

COLOR/CO or /COLOR specify color output when the screen is a color monitor.
> The default is black and white.

/NOEDITOR

NOEDITOR specifies that the SWVEDIT program is NOT to be copied to the .
Virus-Safe directory at installation time.  This will allow the installer to
> put Virus-Safe onto a user's machine without giving that user the Editor
program.  See section 3.62 on the Editor for more information.

/ADDFILES

ADDFILES=[drives] tells SWVINST to add files from the specified  drives.
The files that can be added have the extensions: .COM, .EXE, .SYS,
.OV*, & .APP.  The list of drives must immediately follow the  = in
/ADDFILES=, either back-to-back or separated by commas.  A space will
terminate the list of drives. For example:

/ADDFILES=C,DE

will add all files with the listed file extensions from drives C:,D:, & E:.

DEFAULTS

/DEF= or /DEFAULTS= specify what values will be used when adding files,
including the SWVSAFE program, to the Checklist.  Since this option is
actually passed to the Editor for adding files to the Checklist, the format
is the same as for the Editor.  The first value is the algorithm to use (T,
C, I, A).  This is followed by the percentage value.  The time at which the
file is to be checked (L, A) is third.  The frequency is last.  See section
3 for further details.

Installation dialogue

SWVINST will ask a series of questions concerning where you want the
SafeWord Virus-Safe programs and data files to reside, if and how you want
SafeWord Virus-Safe started by DOS, and what phrase to use to help SafeWord
Virus-Safe create signatures of files that will be different from PC to PC.

The keys used when editing the fields on the screen are covered in section
3.7.

Location of SWVSAFE within your file system's directory tree structure

The first question asked by SWVINST is where you want the programs and files
for SafeWord Virus-Safe to be located.  If nothing is changed from what is
shown, the default drive & path will be C:\SWVSAFE.  You may enter a new
drive & path by typing in a new value.  Some of the reasons for choosing a
different drive and/or path include: having more than two diskettes, or
having a security package that ordinarily prevents write access to the C:
drive.

If the path you enter does not exist on the specified drive, (and it usually
will not), the SWVINST program will create the path as entered.  For
example, if you entered C:\S\W\V\S\A\F\E as the path, SWVINST would create
as many sub-directories as are necessary to fulfill the request.

Cipher Phrase

The next question will ask for a phrase that will help SafeWord Virus-Safe
create signatures for your PC that will be different from anyone else's PC,
even for the same files.  The reason for having a phrase that will be unique
from PC to PC is to prevent a virus from attacking SafeWord Virus-Safe on
more than one PC.  Even if a virus learns how to attack one machine, it will
still be detected if it spreads to the second PC because the signatures for
that PC's files will be very different.

When entering a phrase remember exactly what you type in.  SWVINST will ask
you to enter the same phrase a second time for verification.  The phrase
that you type in must be at least eight characters long, not including
trailing spaces.

Copying files

After you provide a phrase, SWVINST will copy the SafeWord Virus-Safe
programs to the drive:\path you have specified. While copying the files,
SWVINST will also edit those files by inserting into them the drive and path
of the directory used by SafeWordVirus-Safe.

DOS.FILES

(If there is not a hard disk available, you may skip this next paragraph
dealing with  DOS.FILES.)

DOS.FILES is a special name used by SafeWord Virus-Safe to indicate certain
areas of the hard disk that are used by DOS to control how the disk is set
up.  One of those areas is the partition table. This area is used by DOS to
know how many logical drives you have on the one disk, and which operating
systems.  Normally, this area is not accessible, but to a competent
programmer it is easily available.  If an error were to occur while someone
was modifying the partition table, it would be possible to lose the entire
contents of your hard disk.  Therefore, by specifying DOS.FILES to SafeWord
Virus-Safe, the partition table and other important control areas will be
checked to ensure no one has changed them. SWVINST will ask if you want your
DOS control areas to be checked. If you reply with YES to this question, the
hard disk's partition table and other control areas will be checked by
SafeWord Virus-Safe to ensure no one has changed them.

When checking the DOS control areas, through the reserved entry DOS.FILES,
the signature for DOS.FILES will reflect the followinginformation:

1- the number of  bad clusters in the FAT,

2- the contents of any sectors between the partition table record and the
start of the closest partition,

3- the contents of the partition table records for all logical drives on
physical drive 0 (C:); #1 & #2 above apply here also.

When calculating the signature for DOS.FILES, SWVSAFE & SWVEDIT do not
assume the system files are present.  That is because the disk may be set up
to force a boot from diskette.  Instead, they search the DOS loader record
for an indication of which DOS is on the disk.  Finding IO.SYS says that MS-
DOS is the operating system. If IBMBIO.COM is found, this says IBM's PC-DOS
is the operating system.  Finding DRBIOS.SYS indicates this is DRI's DR-DOS,
this being a PC-DOS compatible operating system, a.k.a.  Compaq DOS 3.31.
After determining which operating system to look for, SWVSAFE & SWVEDIT
search for the appropriate system files in the root directory.  If these two
files are found, their signatures are then added into the signature for
"DOS.FILES".

At this point, SWVINST will invoke the newly transferred SWVEDIT.EXE to
create signatures of the files that were installed. This will cause SafeWord
Virus-Safe to check itself to ensure no one has changed it.

Invoking SWVSAFE

SWVINST will then ask you whether you want to invoke SafeWord Virus-Safe
from CONFIG.SYS or AUTOEXEC.BAT.  Responding with a`C' will tell SWVINST to
use the CONFIG.SYS file.  An `A' response means to use the AUTOEXEC.BAT
file.  If you aren't sure which to choose, start with `A'.

The installation is now just about complete.  If you want DOS to
automatically start SafeWord Virus-Safe you can have it started from either
CONFIG.SYS or AUTOEXEC.BAT.  At present, our testing has shown there are
only a couple of restrictions on where SafeWord Virus-Safe can be placed in
these files.  They are:

1- if you are running with a Novell LAN, SafeWord Virus-Safe must be loaded
AFTER Novell's NetWare software.

2- if you have Sidekick, SafeWord Virus-Safe must be loaded BEFORE Sidekick
to prevent problems.

If you choose to have SWVINST proceed with installing SafeWord Virus-Safe
into either the CONFIG.SYS or the AUTOEXEC.BAT, you will need to respond
with YES when asked for permission to modify the corresponding file.  The
entry to invoke SWVSAFE will be placed at the end of CONFIG.SYS or
AUTOEXEC.BAT.  If this is not where you want it to be, use your favorite
editor afterward to move the SWVSAFE entry to the correct position.

Drive

The last question to appear, assuming you will have SafeWord Virus-Safe
automatically started by DOS, will ask which drive you have DOS load from.
This allows you to have SafeWord Virus-Safe be resident on a drive different
from where DOS is.  One customer has the PC set up to boot only from a
diskette.  By having SafeWord Virus-Safe loaded onto the hard disk, that
customer is able to invoke SWVSAFE.COM at boot time without giving up
precious space on the diskette.  This offers the flexibility of having
SafeWord Virus-Safe loaded and invoked from one drive while DOS loads from
another.

At this point, the installation of SafeWord Virus-Safe is complete. The next
time you boot your PC, it will begin checking your files, assuming it is
started by DOS automatically.  All-in-all, the installation of Virus-Safe is
quite painless, and takes no more than a few minutes to complete.  Having
successfully completed this automated installation, you can now proceed to
Section 3.4.

Manual Installation

If you prefer to do it yourself, this section should allow you to understand
what is involved in the installation of SafeWord Virus-Safe.  Please note:
this section is more for your edification than for practical use because,
through manual installation, theVirus-Safe programs are not made unique for
your particular PC; they will remain as they are on the distribution
diskette.

Copying SafeWord Virus-Safe to your hard disk

Create a subdirectory for SafeWord Virus-Safe.  We recommend it be located
at \SWVSAFE on your boot disk (drive C:).  Copy the entire contents of your
SafeWord Virus-Safe distribution diskette into this directory.

Choosing  .COM or  .SYS implementations

SafeWord Virus-Safe can be executed either as aTerminate-and-Stay-Resident
(TSR) program, or as a  .SYS file from your CONFIG.SYS file.  Decide which
method you prefer based on criteria of your own choosing.

If you decide on the TSR approach, insert an invocation for SWVSAFE.COM into
your AUTOEXEC.BAT file.  Choose the exact location according to your own
priorities.

If you decide on the CONFIG.SYS approach, insert an invocation for
SWVSAFE.COM into your CONFIG.SYS file.  Choose the exact location according
to your own priorities.  Usually it is best to run SWVSAFE as late as
possible within CONFIG.SYS.

Bootstrap your computer.  When SWVSAFE.COM executes, it will display a brief
sign-on message.  Watch for it.  Do not worry if SafeWord Virus-Safe
indicates that the current signatures of files do not match their stored
signatures the first time you run the program.  Once the invocation of
SWVSAFE.COM has been accomplished, you are ready to proceed with Section
3.4.  Should your day-to-day operation of SWVSAFE (as described in Section
4) turn up any incompatibilities or other problems, you can return to these
manual installation procedures and try different command-line options and
locations within AUTOEXEC.BAT or CONFIG.SYS until you find the setup that
works best for you.

Modes of Invocation

SafeWord Virus-Safe can be invoked in two ways: offline or memory-resident.

Offline checkups from a sterile DOS diskette

The most fundamental (and most secure) way to run SafeWord Virus-Safe is to
store it on a separate  boot diskette.  Bootstrapping from this  diskette
automatically invokes SafeWord Virus-Safe, which immediately  works its way
down the entire checklist, testing for changes in every file -listed as
requiring  load time checking.  When the list is exhausted the  operator is
informed of any files in the checklist that have changed since -the last
time this diskette resident copy of SafeWord Virus-Safe was  executed.
Properly handled, this is the most secure way of using SafeWord  Virus-Safe,
because if this diskette is never used for any other purpose, and  if it is
kept physically locked up when not being used, there is no way any virus
can ever spread onto the diskette.

Memory Resident checkups

The other mode for invoking SafeWord Virus-Safe is memory-resident, and,
depending on a flag set for each file in the checklist, can check files when
the PC is booted (i.e. when SafeWord Virus-Safeis first loaded) or just
before files are executed.

When SafeWord Virus-Safe is firstloaded

When SafeWord Virus-Safe is first loaded, it works its way down the
checklist, testing for changes in every file marked as requiringboot-time
checking.  This is very similar to the offline mode, except that SafeWord
Virus-Safe is resident on your hard disk where it could potentially be
attacked and compromised by an insider knowledgeable about the way you have
set up your protection. Because this method checks your files infrequently
and is potentially vulnerable to insider attacks, it is the least secure.
Nevertheless, it still establishes very strong protection against any
attacks that are not specifically targeted at you and launched by an
insider.

Continuous checkups while you work

After SafeWord Virus-Safe has become memory resident, it examines every file
that you execute for an entry in the checklist. If it finds an entry, it
acts according to the instructions it finds for the file.  If it finds no
entry, it asks you for guidance.   This option allows you to specify
automatic examination of your programswhen you use them.

Command-line options

It is possible to modify the operation of SafeWord Virus-Safe by including
options, separated by spaces, on the command line.  For example:

SWVSAFE /DEFAULTS=A,10,A,20/NOLEARN

The following are the command line options available for SWVSAFE:

/COLOR or /CO

/TIMEOUT or /TO

/DEFAULTS or /DEF

/USEDEFAULT or /UD

/SWVPATH or /SP

/TAKEKBD or /TK

/NOLEARN or /NL

/BATCH or /BB

/DISALLOW or /DA

/NOVISUAL or /NV

/NOMISSINGFILEALARMS or /NM

Each of the command line options listed above will now be examined in
greater detail.


COLOR

As in SWVINST, /CO and /COLOR specify to use color output when the screen is
a color monitor.  The default is black and white.

TIMEOUT=

/TO and /TIMEOUT specify how long Virus-Safe will wait for keyboard input,
in seconds, before taking default values.  Valid values are 1 - 3600.
Specifying TIMEOUT but no value defaults to 60 seconds. If TIMEOUT is not
included in the options list, 3600 (1 hour) is the default.  TIMEOUT can be
used if  protected programs access the keyboard by non-standard means, which
may prevent SafeWord Virus-Safe from obtaining users keystrokes.  See
section 3 for further details.

DEFAULTS=

To have SafeWord Virus-Safe use the same values each time a fileis added,
the user should specify /DEF= or /DEFAULTS= on the command line.  This
option  works with the /TIMEOUT option, described above.

V: type of verification to be used, where:

C = CRC,

I = ISO,

A = ANSI,

T = TURBO, and

N = NONE.

%: the sampling percentage.

This is the percent of the file that is checked with either ISO or ANSI.
The remainder of the file will be checked with CRC. This has no effect for
CRC, TURBO, and NONE verification types.

M: Mode, which specifies when files are to be checked.

L = Load.  Files are checked when SafeWord Virus-Safe isloaded, typically
when the PC is booted.

A = Anytime.  FIles are checked whenever they are run.

F = sampling frequency.  The number provided indicates how many times
(either loads or executions) to ignore the file beforere checking it again.

If the DEFAULTS option is not listed, the values C,100,A,1 are automatically
used.

USEDEFAULTS

/USEDEFAULTS and /UD correlate with the /DEFAULTS=C,100,A,1 option.  If
specified, without/DEF=, SafeWord Virus-Safe will not ask the user for any
values when learning about new programs.  Instead, it will use default
valuesof CRC, 100%, verify the program when it is invoked, and check the
program every time it is executed.

SWVPATH=

/SWVPATH= and /SP= can be used to specify the drive & path where SafeWord
Virus-Safe is to keep its Checklist and Audit trail files.  The default
drive & path is the path specified at installation time, or \SWVSAFE on the
current drive if Virus-Safe has NOT been installed yet.

TAKEKBD

If the user is having problems getting keyboard input into SafeWord Virus-
Safe, the user can specify /TK or /TAKEKBD on the SafeWord Virus-Safe
command line.  This tells Virus-Safe to take over the keyboard interrupt and
process the keyboard input directly instead of getting input from the BIOS.
Certain "ill-behaved" programs, such as QuickC from Microsoft, require this
option.

NOLEARN=

Should the user decide that Virus-Safe should no longer learn about new
programs, the /NL or /NOLEARN option can be placed on the command line.  If
certain drives are to be ignored, as far as new programs are concerned, the
user can also list the drives to be ignored.  For example: /NL=A,BFG,HI.
This says to ignore drives A:, B:, F:, G:, H:, and I:.  The only valid
separator between drive letters is the comma.  Any other value between drive
letters acts as the end of option character.

Specifying a drive letter after /NOLEARN= does not stop new programs from
executing from those drives.  Virus-Safe simply does not add anything to the
Checklist for each new program encountered from those drives. The programs
run from those drives are not protected by SafeWord Virus-Safe.

BATCH

If the user wishes to have Virus-Safe only scan the Checklist, the option
/BATCH or B/ can be specified on the command line.  With this option, after
Virus-Safe has finished scanning the Checklist, it will exit back to DOS
without staying resident in memory. This option is intended to help you in
situations where you may run out of memory.

DISALLOW

There is an option in the Virus-Safe driver program to disable the execution
of programs that are not in the Checklist file.  Also, programs will not be
allowed to execute if one of the following conditions arise:

1- the signature does not match the entry in the Checklist,

2- the Checklist's entry is marked for no verification,

3- the Checklist does not exist, or

4- the Checklist is corrupted.

This option is called /DISALLOW or /DA, to disallow the execution of unknown
or suspect programs.  From a virus detection standpoint,if a virus-
contaminated program cannot be executed, the virus will not infect the PC.
With this option, a corporate PC administrator can be assured only company
purchased, "trusted" programs are run on the company's PCs.

NOVISUAL

The /NV and /NOVISUAL options suppress any screen output when SafeWord
Virus- Safe is loaded into memory.  The program will not give any visual
indication  it is doing something, or that it is loaded into memory until an
error  condition occurs, requiring the user's acknowledgement.  These
conditions are:

1- the signature for a file does not match its entry in the Checklist,

2- a file was not found at the time it should have been verified,

3- a new file is being allowed to execute which is not in the Checklist.

NOMISSINGFILEALARMS

If a file is not found when the time comes to verify it, SafeWord Virus-Safe
will alert the user to the fact. To disable the display of this message, the
user should specify /NM or /NOMISSINGFILEALARMS on the command line.

The SafeWord Virus-Safe device driver allows the user to enter at the DOS
prompt: TYPE SWVSVERS.  If the driver is loaded by the CONFIG.SYS, it will
produce a block of text indicating the version, the registration #, and the
registered user's name.  This will work even if /NV is specified on the
Virus-Safe command line. The installation program will also produce a file
by the name SWVSVERS in the Virus-Safe directory that will have the exact
same information.  Having this ability in the driver, and having the same
data in a text file, will allow the user to determine what version is on
their machine easily.

Combining Continuous and Offline Checking

The most powerful way of installing SafeWord Virus-Safe is to setup a system
that uses both modes of operation to maximum advantage. Most program files
can be examined in  continuous mode by a memory-resident copy of SafeWord
Virus-Safe.  Critical data files can be examined in batch mode when SafeWord
Virus-Safe is first loaded, as can the program files and drivers that make
up DOS. Finally, a sophisticated cross-check is periodically performed
offline from a sterile DOS boot diskette.  This sterile cross-check,
resident on a boot diskette, should be set up, using SWVEDIT, to check  the
hard-disk resident programs constituting the working copies of DOS, DOS
drivers, DOS initialization files, and the hard-disk resident copies of -
SafeWord Virus Safe.  Thus the hard-disk resident SafeWord Virus-Safe  setup
continuously checks some files every time they are executed, and checks
other files only at boot time, and every few days a sterile, diskette-
resident copy of SafeWord Virus-Safe checks to see that the hard-disk
resident protection has not been compromised by a sophisticated, insider
attack.

This combination of modes creates a virtually unbreakable security barrier
to viruses, even if they are written by sophisticated insiders who know all
about the security being applied.  If there is no perceived threat from
insiders, then it is not necessary to use all of the modes together.

The checklist file

SafeWord Virus-Safe consults a file called  SWVCHECK.LST forinstructions on
what you want it to do.  In offline mode, or for files to be checked only at
boot time, the only way to add the files to your checklist is with the
checklist editor (see Section3.6.2).  In continuous mode, there are two ways
for you to add your instructions to this file.  The easiest way is to let
SafeWord Virus-Safe build the file for you gradually, by watching you work,
and learning the names of the programs you use.

Learn Mode

This is called "learn mode", and SafeWord Virus-Safe normally starts out in
learn mode.  Whenever you execute a program, SafeWord Virus-Safe checks to
see if the checklist already contains instructions concerning it.  If learn
mode is active and the checklist contains no instructions concerning the
file, your work is briefly interrupted so SafeWord Virus-Safe can ask you a
series of simple questions regarding if and how you want the program checked
for viral contamination.  The questions, if any, should be self-explanatory.
Section 2 of this User Guide presents background information to introduce
you  to some of the newer concepts.  Learn mode will build and manage the
entire  checklist for you, and you may never need to get more deeply
involved than  this.

You can turn off learn mode whenever you want by invokingSafeWord Virus-Safe
with an optional argument as follows:

SWVSAFE /N

or

SWVSAFE /NOLEARN

Whenever you wish to do this, modify the line in your AUTOEXEC.BAT or
CONFIG.SYS file that invokes SWVSAFE to include the /NL option.  Any new
file encountered in this mode will be executed without being added to the
checklist.

By editing this line you can also specify other command line options.  See
Section 3.4.4.

Editing the checklist

The other way to change the contents of your checklist is to edit it using
the special SafeWord Virus-Safe checklist editor, SWVEDIT.EXE.  This is done
from the DOS prompt by typing:

SWVEDIT

Depending on your configuration, you may be asked a series of questions, and
then lead through a very simple editing procedure.

DO NOT ATTEMPT TO EDIT THE SAFEWORD VIRUS-SAFE CHECKLIST WITH ANY OTHER
EDITOR OR UTILITY.

The filename field has had wildcard (* and ?) capability added.

Support for subdirectory searching has also been added.  This means the user
can have all .COM files, for example, from drive C: added to the Checklist.
This is accomplished by typing *.COM in the filename field, C:\ in the
pathname field, and specifying YES to subdirectory searching.  Then,
pressing the ALT-A sequence will add every .COM file to the Checklist.
However, this capability is not limited to only the ADD function.  It works
with each of the other functions as well.

When changing values for an entry, the Editor will now show what the current
values are so the user can decide whether or not to change them.

The Editor now has the ability to PURGE an entry from the Checklist.  This
is especially useful for developers, who routinely have programs come and go
 and change. It also comes in handy when a user has grown tired of a product
and decides to remove that product fromthe machine.

Signature encryption keys

The encryption keys used for generating the signatures will now be derived
from the device driver.  For this to work, the driver (SWVSAFE.COM) must be
placed in the SafeWord Virus-Safe directory with the Checklist file. This
allows the installer to specify /NOEDITOR on the command line of SWVINST.
The installer also does not have to create a diskette with the Editor on it
for each PC. With previous releases of SafeWord VIRUS-Safe, each copy of
had to have a matching Editor because the encryption keys from one
installation to the next were different.  An Editor with the  wrong
encryption keys would produce signatures that would not match the
signatures generated by the driver.  Now, by having the Editor get the keys
from the driver, all the users can have their Checklists updated using
identical copies of the editor, or from a single copy of the editor.

SWVEDIT Command Line Options

The command line options available for SWVEDIT are as follows:

/COLOR or /CO

/TIMEOUT or /TO

/DEFAULTS or /DEF

/USEDEFAULTS or /UD

/SWVPATH or /SP

Each of these SWVEDIT command-line options is discussed in further detail in
 the next few paragraphs.

COLOR

As in SWVINST, /CO and /COLOR specify to use color output when the screen is
a color monitor.  Again, the default is black and white.

TIMEOUT

/TO and /TIMEOUT specifies how long the Editor will wait for keyboard input,
in seconds, before taking default values.  This is described in an earlier
part of section 3 herein.

DEFAULTS=

To have the Editor use the same values each time a file is added to the
Checklist, the user should specify /DEF= or /DEFAULTS= on the command line.

USEDEFAULTS

/UD and /USEDEFAULTS correlates with the /DEFAULTS= option.  If specified,
without /DEF=, the Editor will not ask the user for any values when adding
files to the Checklist, or changing a program's entry.  The Editor will use
default values of CRC, 100%, verify the program when it is invoked, and
check the program every time it is executed.

SWVPATH=

/SP= and /SWVPATH= can be used to specify the drive: and path where the
Editor is to locate the SafeWord Virus-Safe files.  These files are:
SWVSAFE.COM, SWVCHECK.LST, & SWVAUDIT.TRL.  The default drive: \path is the
path specified at installation time, or \SWVSAFE on the current drive if the
Editor has NOT been installed yet.

SWVINST and SWVEDIT editing keys

The SafeWord Virus-Safe installation and editor programs both have fields in
which a string of characters may be entered.  To allow you to edit these
fields, the following keys and key combinations are available.

Basic Editing Keys

Tab     PgDn     Down Arrow

Move to the next field (These three keys all perform the samefunction)

Shift Tab    PgUp    Up Arrow

Move to the previous field (These three keys all perform the same function)

Left Arrow

Move left one character position

Right Arrow

Move right one character position

Home

Move the cursor to the first character position in the field

End

Move the cursor to the end of the data in the field.  If the field is full,
the cursor is moved to the end of the field.

Delete

Delete the current character

Backspace

Delete the previous character

Ctrl End

Delete data from the cursor position to the right

ESC

Restore the field to its value before the latest change

Insert

Allow data to be inserted at the cursor position without overwriting
existing text

Enter

Accept the contents of the field

Advanced Editing Keys

The keys F1 through F5 in SafeWord Virus-Safe have the same functions as
they do on a DOS command line:

F1

Move the cursor to the right one position, without changing the character
beneath the cursor.

F2 [char]

Used with a second key; move the cursor to the next occurrence of the
character [char].

For example:F2 C will move to the next letter `C' to the right of the
cursor.

F3

Move the cursor to the end of the data in the currentfield.

F4 [char]

Used with a second key; delete all data from the cursor to the next
occurrence of [char].

For example: F4 C will delete all data from the cursor to the first letter
`C' to the right of the cursor.

F5

Delete from the cursor position to the right; return the cursor to the
beginning of the field.