McAfee DR SOLOMON S ANTI-VIRUS 8.5 User manual

Dr Solomon’s Anti-Virus
User’s Guide
Version 8.5

COPYRIGHT
Copyright © 2000 Network Associates, Inc. and its Affiliated Companies. All Rights Reserved. No part
of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of Network Associates,
Inc.
TRADEMARK ATTRIBUTIONS
* ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX,
Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr
Solomon’s, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk,
Hunter, ISDN Tel/Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy,
MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More
Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetScan, Net Shield, NetShield,
NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts,
PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty
Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router
PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer,
SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM,
TeleSniffer, TIS, TMach, TMeg, Total Network Security, Total Network Visibility, Total Service Desk,
Total Virus Defense, T-POD, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virex-PC, Virus Forum,
ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000
are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All
other registered and unregistered trademarks in this document are the sole property of their respective
owners.
LICENSE AGREEMENT
NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT
("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") BY
NETWORK ASSOCIATES, INC. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR
INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY)
CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO
NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE BUTTON THAT
INDICATES THAT YOU DO NOT ACCEPT THE TERMS OF THIS AGREEMENT AND DO NOT
INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE
PLACE OF PURCHASE FOR A FULL REFUND.)
1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and
conditions of this Agreement, McAfee hereby grants to you a non-exclusive, non-transferable right
to use one copy of the specified version of the Software and the accompanying documentation (the
"Documentation"). You may install one copy of the Software on one computer, workstation,
personal digital assistant, pager, "smart phone" or other electronic device for which the Software
was designed (each, a "Client Device"). If the Software is licensed as a suite or bundle with more
than one specified Software product, this license applies to all such specified Software products,
subject to any restrictions or usage terms specified on the applicable price list or product packaging
that apply to any of such Software products individually.
Issued May 2000/ Dr Solomon’s Anti-Virus v8.5

(i.e., the required number of licenses would equal the number of distinct inputs to the
multiplexing or pooling software or hardware "front end"). If the number of Client Devices or
seats that can connect to the Software can exceed the number of licenses you have obtained, then
you must have a reasonable mechanism in place to ensure that your use of the Software does not
exceed the use limits specified for the licenses you have obtained. This license authorizes you to
make or download one copy of the Documentationfor each Client Device orseat that is licensed,
provided that each such copy contains all of the Documentation's proprietary notices.
c. Volume Licenses. If the Software is licensed with volume license terms specified in the
applicable price list or product packaging for the Software, you may make, use and install as
many additional copies of the Software on the number of Client Devices as the volume license
authorizes. You must have a reasonable mechanism in place to ensure that the number of Client
Devices on which the Software has been installed does not exceed the number of licenses you
have obtained. This license authorizes you to make or download one copy of the Documentation
for each additional copy authorized by the volume license, provided that each such copy contains
all of the Documentation's proprietary notices.
2. Term. This Agreement is effective for an unlimited duration unless and until earlier terminated as
set forth herein. This Agreement will terminate automatically if you fail to comply with any of the
limitations or other requirements described herein. Upon any termination or expiration of this
Agreement, you must destroy all copies of the Software and the Documentation. You may
terminate this Agreement at any point by destroying all copies of the Software and the
Documentation.
3. Updates. For the time period specified in the applicable price list or product packaging for the
Software you are entitled to download revisions or updates to the Software when and as McAfee
publishes them via its electronic bulletin board system, website or through other online services.
For a period of ninety (90) days from the date of the original purchase of the Software, you are
entitled to download one (1) revision or upgrade to the Software when and as McAfee publishes it
via its electronic bulletin board system, website or through other online services. After the
specified time period, you have no further rights to receive any revisions or upgrades without
purchase of a new license or annual upgrade plan to the Software.
4. Ownership Rights. The Software is protected by United States copyright laws and international
treaty provisions. McAfee and its suppliers own and retain all right, title and interest in and to the
Software, including all copyrights, patents, trade secret rights, trademarks and other intellectual
property rights therein. Your possession, installation, or use of the Software does not transfer to
you any title to the intellectual property in the Software, and you will not acquire any rights to the
Software except as expressly set forth in this Agreement. All copies of the Software and
Documentation made hereunder must contain the same proprietary notices that appear on and in the
Software and Documentation.
User’s Guide iii

5. Restrictions. You may not rent, lease, loan or resell the Software. You may not permit third parties
to benefit from the use or functionality of the Software via a timesharing, service bureau or other
arrangement, except to the extent such use is specified in the applicable list price or product
packaging for the Software. You may not transfer any of the rights granted to you under this
Agreement. You may not reverse engineer, decompile, or disassemble the Software, except to the
extent the foregoing restriction is expressly prohibited by applicable law. You may not modify, or
create derivative works based upon, the Software in whole or in part. You may not copy the
Software or Documentation except as expressly permitted in Section 1 above. You may not remove
any proprietary notices or labels on the Software. All rights not expressly set forth hereunder are
reserved by McAfee. McAfee reserves the right to periodically conduct audits upon advance
written notice to verify compliance with the terms of this Agreement.
6. Warranty and Disclaimer
a. Limited Warranty. McAfee warrants that for sixty (60) days from the date of original purchase
the media (e.g., diskettes) on which the Software is contained will be free from defects in
materials and workmanship.
b. Customer Remedies. McAfee's and its suppliers' entire liability and your exclusive remedy for
any breach of the foregoing warranty shall be, at McAfee's option, either (i) return of the
purchase price paid for the license, if any, or (ii) replacement of the defective media in which the
Software is contained. You must return the defective media to McAfee at your expense with a
copy of your receipt. This limited warranty is void if the defect has resulted from accident,
abuse, or misapplication. Any replacement media will be warranted for the remainder of the
original warranty period. Outside the United States, this remedy is not available to the extent
McAfee is subject to restrictions under United States export control laws and regulations.
c. Warranty Disclaimer. Except for the limited warranty set forth herein, THE SOFTWARE IS
PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE
LAW, MCAFEE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
NONINFRINGEMENT WITH RESPECT TO THE SOFTWARE AND THE
ACCOMPANYING DOCUMENTATION. YOU ASSUME RESPONSIBILITY FOR
SELECTING THE SOFTWARE TO ACHIEVE YOUR INTENDED RESULTS, AND FOR
THE INSTALLATION OF, USE OF, AND RESULTS OBTAINED FROM THE SOFTWARE.
WITHOUT LIMITING THE FOREGOING PROVISIONS, MCAFEE MAKES NO
WARRANTY THAT THE SOFTWARE WILL BE ERROR-FREE OR FREE FROM
INTERRUPTIONS OR OTHER FAILURES OR THAT THE SOFTWARE WILL MEET
YOUR REQUIREMENTS. SOME STATES AND JURISDICTIONS DO NOT ALLOW
LIMITATIONS ON IMPLIED WARRANTIES, SO THE ABOVE LIMITATION MAY NOT
APPLY TO YOU. The foregoing provisions shall be enforceable to the maximum extent
permitted by applicable law.
iv Dr Solomon’s Anti-Virus

7. Limitation of Liability. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY,
WHETHER IN TORT, CONTRACT, OR OTHERWISE,SHALL MCAFEE OR ITS SUPPLIERS
BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL,
INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING,
WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE,
COMPUTER FAILURE OR MALFUNCTION, OR FOR ANY AND ALL OTHER DAMAGES
OR LOSSES. IN NO EVENT WILL MCAFEE BE LIABLE FOR ANY DAMAGES IN EXCESS
OF THE LIST PRICE MCAFEE CHARGES FOR A LICENSE TO THE SOFTWARE, EVEN IF
MCAFEE SHALL HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR
PERSONAL INJURY TO THE EXTENT THAT APPLICABLE LAW PROHIBITS SUCH
LIMITATION. FURTHERMORE, SOME STATES AND JURISDICTIONS DO NOT ALLOW
THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES,
SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. The foregoing
provisions shall be enforceable to the maximum extent permitted by applicable law.
8. United States Government. The Software and accompanying Documentation are deemed to be
"commercial computer software" and "commercial computer software documentation,"
respectively, pursuant to DFAR Section 227.7202 and FAR Section 12.212, as applicable. Any
use, modification, reproduction, release, performance, display or disclosure of the Software and
accompanying Documentation by the United States Government shall be governed solely by the
terms of this Agreement and shall be prohibited except to the extent expressly permitted by the
terms of this Agreement.
9. Export Controls. Neither the Software nor the Documentation and underlying information or
technology may be downloaded or otherwise exported or re-exported (i) into (or to a national or
resident of ) Cuba, Iran, Iraq, Libya, North Korea, Sudan, Syria or any other country to which the
United States has embargoed goods; or (ii) to anyone on the United States Treasury Department's
list of Specially Designated Nations or the United States Commerce Department's Table of Denial
Orders. By downloading or using the Software you are agreeing to the foregoing and you are
certifying that you are not located in, under the control of, or a national or resident of any such
country or on any such list.
IN ADDITION, YOU SHOULD BE AWARE OF THE FOLLOWING: EXPORT OF THE
SOFTWARE MAY BE SUBJECT TO COMPLIANCE WITH THE RULES AND
REGULATIONS PROMULGATED FROM TIME TO TIME BY THE BUREAU OF EXPORT
ADMINISTRATION, UNITED STATES DEPARTMENT OF COMMERCE, WHICH
RESTRICT THE EXPORT AND RE-EXPORT OF CERTAIN PRODUCTS AND TECHNICAL
DATA. IF THE EXPORT OF THE SOFTWARE IS CONTROLLED UNDER SUCH RULES
AND REGULATIONS, THEN THE SOFTWARE SHALL NOT BE EXPORTED OR
RE-EXPORTED, DIRECTLY OR INDIRECTLY, (A) WITHOUT ALL EXPORT OR
RE-EXPORT LICENSES AND UNITED STATES OR OTHER GOVERNMENTAL
APPROVALS REQUIRED BY ANY APPLICABLE LAWS, OR (B) IN VIOLATION OF ANY
APPLICABLE PROHIBITION AGAINST THE EXPORT OR RE-EXPORT OF ANY PART OF
THE SOFTWARE.
User’s Guide v

SOME COUNTRIES HAVE RESTRICTIONS ON THE USE OF ENCRYPTION WITHIN
THEIR BORDERS, OR THE IMPORT OR EXPORT OF ENCRYPTION EVEN IF FOR ONLY
TEMPORARY PERSONAL OR BUSINESS USE. YOU ACKNOWLEDGE THAT THE
IMPLEMENTATION AND ENFORCEMENT OF THESE LAWS IS NOT ALWAYS
CONSISTENT AS TO SPECIFIC COUNTRIES. ALTHOUGH THE FOLLOWING
COUNTRIES ARE NOT AN EXHAUSTIVE LIST THERE MAY EXIST RESTRICTIONS ON
THE EXPORTATION TO, OR IMPORTATION OF, ENCRYPTION BY: BELGIUM, CHINA
(INCLUDING HONG KONG), FRANCE, INDIA, INDONESIA, ISRAEL, RUSSIA, SAUDI
ARABIA, SINGAPORE, AND SOUTH KOREA. YOU ACKNOWLEDGE IT IS YOUR
ULTIMATE RESPONSIBILITY TO COMPLY WITH ANY AND ALL GOVERNMENT
EXPORT AND OTHER APPLICABLE LAWS AND THAT MCAFEE HAS NO FURTHER
RESPONSIBILITY AFTER THE INITIAL SALE TO YOU WITHIN THE ORIGINAL
COUNTRY OF SALE.
10. High Risk Activities. The Software is not fault-tolerant and is not designed or intended for use in
hazardous environments requiring fail-safe performance, including without limitation, in the
operation of nuclear facilities, aircraft navigation or communication systems, air traffic control,
weapons systems, direct life-support machines, or any other application in which the failure of the
Software could lead directly to death, personal injury, or severe physical or property damage
(collectively, "High Risk Activities"). McAfee expressly disclaims any express or implied
warranty of fitness for High Risk Activities.
11. Miscellaneous. This Agreement is governed by the laws of the United States and the State of
California, without reference to conflict of laws principles. The application of the United Nations
Convention ofContracts for the International Sale of Goodsis expressly excluded. This Agreement
sets forth all rights for the user of theSoftware andis the entire agreement between the parties. This
Agreement supersedesany other communications with respect to the Software and Documentation.
This Agreement may not be modified except by a written addendum issued by a duly authorized
representative of McAfee. No provision hereof shall be deemed waived unless such waiver shall
be in writing and signed by McAfee or a duly authorized representative of McAfee. If any
provision of this Agreement is held invalid, the remainder of this Agreement shall continue in full
force and effect. The parties confirm that it is their wish that this Agreement has been written in
the English language only.
12. McAfee Customer Contact. If you have any questions concerning these terms and conditions, or
if you would like to contact McAfee for any other reason, please call [phone], fax (408)
970-9727, or write: McAfee Software, 3965 Freedom Circle, Santa Clara, California 95054.
http://www.mcafee.com.
Statements made to you in the course of this sale are subject to the Year 2000 Information and
Readiness Disclosure Act (Public Law 105-271). In the case of a dispute, this Act may reduce your
legal rights regarding the use of any statements regarding Year 2000 readiness, unless otherwise
specified in your contract or tariff.
vi Dr Solomon’s Anti-Virus

User’s Guide vii
Table of Contents
Preface....................................................xiii
Whathappened?................................................xiii
Whyworry?................................................xiii
Wheredovirusescomefrom? ....................................xiv
Virusprehistory ............................................xiv
VirusesandthePCrevolution .................................xv
Onthefrontier.................................................xviii
Wherenext? ................................................xx
Howtoprotectyourself ..........................................xxi
HowtocontactNetworkAssociates................................xxii
Customerservice...........................................xxii
Technical support .........................................xxiii
Downloadsupport .........................................xxiv
NetworkAssociatestraining.................................xxiv
Commentsandfeedback....................................xxiv
Reportingnewitemsforanti-virusdatafileupdates .............xxiv
Internationalcontactinformation.............................xxvi
Chapter 1. About Dr Solomon’sAnti-Virus .......................29
Introducing Dr Solomon’sAnti-Virus ................................29
How does Dr Solomon’sAnti-Viruswork?............................31
What comes with Dr Solomon’sAnti-Virus? ..........................33
What’snewinthisrelease?........................................38
Chapter 2. Installing Dr Solomon’sAnti-Virus ....................41
Beforeyoubegin.................................................41
Systemrequirements.........................................41
Otherrecommendations ......................................42
Preparing to install Dr Solomon’sAnti-Virus .....................42
Installationoptions ..........................................43
Installationsteps ............................................43
Using the Emergency Disk Creation utility . . . . . . . . . ..............57

Table of Contents
viii Dr Solomon’sAnti-Virus
Determiningwhenyoumustrestartyourcomputer................62
Testingyourinstallation ..........................................63
Modifying or removing your Dr Solomon’s Anti-Virus installation . . . .64
Chapter 3. Removing Infections
FromYourSystem ....................................69
Ifyoususpectyouhaveavirus... ...................................69
Decidingwhentoscanforviruses ..................................72
Recognizing when you don’thaveavirus ............................73
Understandingfalsedetections ................................74
Responding to viruses or malicious software . . . . . . . . . . . ..............75
Submittingavirussample .........................................87
Using the SendVirus utility to submit a file sample . . ..............87
Capturing boot sector, file-infecting, and macro viruses . . . . . . . . . . . .90
Chapter4. UsingtheWinGuardScanner.........................95
WhatdoestheWinGuardscannerdo?...............................95
WhyusetheWinGuardscanner?...............................96
Browserande-mailclientsupport ..............................97
EnablingorstartingtheWinGuardscanner...........................98
UsingtheWinGuardconfigurationwizard...........................103
SettingWinGuardscannerproperties ..............................109
UsingtheWinGuardshortcutmenu ................................165
DisablingorstoppingtheWinGuardscanner ........................165
TrackingWinGuardsoftwarestatusinformation......................172
Chapter 5. Using the Dr Solomon’sAnti-Virusapplication .........175
What is the Dr Solomon’sAnti-Virusapplication? ....................175
Why use the Dr Solomon’sAnti-Virusapplication? ...............176
Starting the Dr Solomon’sAnti-Virusapplication .....................177
Configuring the Dr Solomon’sAnti-VirusClassicinterface.............183
Configuring the Dr Solomon’sAnti-VirusAdvancedinterface ..........189
Chapter 6. Creating and Configuring Scheduled Tasks . . . . . . . . . . . .209
What does Dr Solomon’sAnti-VirusConsoledo? ....................209
Whyschedulescanoperations?...................................209

User’s Guide ix
Table of Contents
Starting the Dr Solomon’sAnti-VirusConsole .......................210
Using the Console window . . . . . . . . . . .............................212
Workingwithdefaulttasks ...................................215
WorkingwiththeVShieldtask ................................217
WorkingwiththeAutoUpgradeandAutoUpdatetasks ............218
Creatingnewtasks ..............................................219
Enablingtasks..................................................223
Checkingtaskstatus ........................................226
Configuring Dr Solomon’sAnti-Virusapplicationoptions..............228
Chapter 7. Updating and Upgrading Dr Solomon’sAnti-Virus ......249
Developinganupdatingstrategy ..................................249
Update and upgrade methods . . . . . . . . .............................250
Understanding the AutoUpdate utility . .............................252
ConfiguringtheAutoUpdateUtility.................................254
UnderstandingtheAutoUpgradeutility .............................263
Configuring the AutoUpgrade utility . . . .............................264
Using the AutoUpgrade and SuperDAT utilities together . . . . . . . . . .273
DeployinganEXTRA.DATfile.................................275
Chapter 8. Using Specialized
Scanning Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .277
ScanningMicrosoftExchangeandOutlookmail .....................277
When and why you should use the E-Mail Scan extension . . . . . . . . .277
UsingtheE-MailScanextension...................................278
ConfiguringtheE-MailScanextension .........................279
Scanningcc:Mail................................................294
UsingtheScreenScanutility ......................................294
Chapter 9. Using Dr Solomon’s Anti-Virus Utilities . . . . . . . . . . . . . . .301
Understanding the Dr Solomon’sAnti-Viruscontrolpanel .............301
Opening the Dr Solomon’sAnti-Viruscontrolpanel...................301
Choosing Dr Solomon’sAnti-Viruscontrolpaneloptions ..............302
Using the Alert Manager Client Configuration utility . . . . . .............306
Dr Solomon’sAnti-VirusasanAlertManagerclient...................307
ConfiguringtheAlertManagerclientutility ..........................307

Table of Contents
x Dr Solomon’sAnti-Virus
Appendix A. Default Vulnerable and Compressed File Extensions . .313
Addingfilenameextensionsforscanning...........................313
Currentlistofvulnerablefilenameextensions.......................314
Currentlistofcompressedfilesscanned ...........................318
Appendix B. Network Associates
Support Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .321
Adding value to your Dr Solomon’sproduct .........................321
PrimeSupport options for corporate customers . . . . . .............321
Ordering a corporate PrimeSupport plan . . . . . . . . . . .............324
PrimeSupport options for home users . .............................326
How to reach international home user support . . . . . . .............328
Ordering a PrimeSupport plan for home users . . . . . . .............328
NetworkAssociatesconsultingandtraining.........................329
ProfessionalServices .......................................329
TotalEducationServices.....................................330
Appendix C. Using the SecureCast Service to Get New Data Files . .331
Introducing the SecureCast service . . . .............................331
Why should I update my data files? . . . .............................332
Which data files does the SecureCast service deliver? . . . . . . . . . . . .332
Installing the BackWeb client and SecureCast service . . . . .............333
Systemrequirements........................................333
Troubleshooting the Enterprise SecureCast service . .............343
UnsubscribingfromtheSecureCastservice.....................343
Supportresources ..............................................343
SecureCastservice .........................................343
BackWebclient.............................................344
Appendix D. Understanding iDAT Technology . . . . . . . . . . . . . . . . . . .345
Understandingincremental.DATfiles ..............................345
How does iDAT updating work? . . . . . . .............................346
What does Dr Solomon’sSoftwareposteachweek?..............347
Bestpractices ..................................................348
Frequentlyaskedquestions ......................................349

User’s Guide xi
Table of Contents
Index......................................................353

Table of Contents
xii Dr Solomon’sAnti-Virus

User’s Guide xiii
Preface
What happened?
If you’ve ever lost important files stored on your hard disk, watched in dismay
as your computer ground to a halt only to display a prankster’s juvenile
greeting on your monitor, or found yourself having to apologize for abusive
e-mail messages you never sent, you know first-hand how computer viruses
and other harmful programs can disrupt your productivity. If you haven’t yet
suffered from a virus “infection,” count yourself lucky. But with more than
50,000 known viruses in circulation capable of attacking Windows- and
DOS-based computer systems, it really is only a matter of time before you do.
The good news is that of those thousands of circulating viruses, only a small
proportion have the means to do real damage to your data. In fact, the term
“computer virus” identifies a broad array of programs that have only one
feature in common: they “reproduce” themselves automatically by attaching
themselves to host software or disk sectors on your computer, usually without
your knowledge. Most viruses cause relatively trivial problems, ranging from
the merely annoying to the downright insignificant. Often, the primary
consequence of a virus infection is the cost you incur in time and effort to track
down the source of the infection and eradicate all of its traces.
Why worry?
So why worry about virus infections, if most attacks do little harm? The
problem is twofold. First, although relatively few viruses have destructive
effects, that fact says nothing about how widespread the malicious viruses are.
In many cases, viruses with the most debilitating effects are the hardest to
detect—the virus writer bent on causing harm will take extra steps to avoid
discovery. Second, even “benign” viruses can interfere with the normal
operationofyourcomputerandcancauseunpredictablebehaviorinother
software. Some viruses contain bugs, poorly written code, or other problems
severe enough to cause crashes when they run. Other times, legitimate
software has problems running when a virus has, intentionally or otherwise,
altered system parameters or other aspects of the computing environment.
Tracking down the source of resulting system freezes or crashes can drain time
and money from more productive activities.
Beyond these problems lies a problem of perception: once infected, your
computer can serve as a source of infection for other computers. If you
regularly exchange data with colleagues or customers, you could unwittingly
pass on a virus that could do more damage to your reputation or your dealings
with others than it does to your computer.

Preface
xiv Dr Solomon’sAnti-Virus
The threat from viruses and other malicious software is real, and it is growing
worse. Some estimates have placed the total worldwide cost in time and lost
productivity for merely detecting and cleaning virus infections at more than
$10 billion per year, a figure that doesn’t include the costs of data loss and
recovery in the wake of attacks that destroyed data.
Where do viruses come from?
As you or one of your colleagues recovers from a virus attack or hears about
new forms of malicious software appearing in commonly used programs,
you’ve probably asked yourself a number of questions about how we as
computer users got to this point. Where do viruses and other malicious
programs come from? Who writes them? Why do those who write them seek
to interrupt workflows, destroy data, or cost people the time and money
necessary to eradicate them? What can stop them?
Why did this happen to me?
It probably doesn’t console you much to hear that the programmer who wrote
the virus that erased your hard disk’s file allocation table didn’t target you or
your computer specifically. Nor will it cheer you up to learn that the virus
problem will probably always be with us. But knowing a bit about the history
of computer viruses and how they work can help you better protect yourself
against them.
Virus prehistory
Historians have identified a number of programs that incorporated features
now associated with virus software. Canadian researcher and educator Robert
M. Slade traces virus lineage back to special-purpose utilities used to reclaim
unused file space and perform other useful tasks in the earliest networked
computers. Slade reports that computer scientists at a Xerox Corporation
research facility called programs like these “worms,” a term coined after the
scientists noticed “holes” in printouts from computer memory maps that
looked as though worms had eaten them. The term survives to this day to
describe programs that make copies of themselves, but without necessarily
using host software in the process.
A strong academic tradition of computer prank playing most likely
contributed to the shift away from utility programs and toward more
malicioususesoftheprogrammingtechniquesfoundinwormsoftware.
Computer science students, often to test their programming abilities, would
construct rogue worm programs and unleash them to “fight” against each
other, competing to see whose program could “survive” while shutting down
rivals. Those same students also found uses for worm programs in practical
jokes they played on unsuspecting colleagues.

User’s Guide xv
Preface
Some of these students soon discovered that they could use certain features of
the host computer’s operating system to give them unauthorized access to
computer resources. Others took advantage of users who had relatively little
computer knowledge to substitute their own programs—written for their own
purposes—in place of common or innocuous utilities. These unsophisticated
users would run what they thought was their usual software only to find their
files erased, to have their account passwords stolen, or to suffer other
unpleasant consequences. Such “Trojan horse” programs or “Trojans,” so
dubbed for their metaphorical resemblance to the ancient Greek gift to the city
of Troy, remain a significant, and growing, threat to computer users today.
Viruses and the PC revolution
What we now think of as true computer viruses first appeared, according to
Robert Slade, soon after the first personal computers reached the mass market
in the early 1980s. Other researchers date the advent of virus programs to 1986,
with the appearance of the “Brain” virus. Whichever date has the better claim,
the link between the virus threat and the personal computer is not
coincidental.
The new mass distribution of computers meant that viruses could spread to
many more hosts than before, when a comparatively few, closely guarded
mainframe systems dominated the computing world from their bastions in
large corporations and universities. Nor did the individual users who bought
PCs have much use for the sophisticated security measures needed to protect
sensitive data in those environments. As further catalyst, virus writers found
it relatively easy to exploit some PC technologies to serve their own ends.
Boot-sector viruses
Early PCs, for example, “booted” or loaded their operating systems from
floppy disks. The authors of the Brain virus discovered that they could
substitute their own program for the executable code present on the boot
sector of every floppy disk formatted with Microsoft’s MS-DOS, whether or
not it included system files. Users thereby loaded the virus into memory every
time they started their computers with any formatted disk in their floppy
drives. Once in memory, a virus can copy itself to boot sectors on other floppy
or hard disks. Those who unintentionally loaded Brain from an infected
floppy found themselves reading an ersatz “advertisement” for a computer
consulting company in Pakistan.
With that advertisement, Brain pioneered another characteristic feature of
modern viruses: the payload. The payload is the prank or malicious behavior
that,iftriggered,causeseffectsthatrangefromannoyingmessagestodata
destruction. It’s the virus characteristic that draws the most attention—many
virus authors now write their viruses specifically to deliver their payloads to
as many computers as possible.

Preface
xvi Dr Solomon’sAnti-Virus
For a time, sophisticated descendants of this first boot-sector virusrepresented
themostseriousvirusthreattocomputerusers.Variantsofbootsectorviruses
also infect the Master Boot Record (MBR), which stores the partition
information your computer needs to figure out where to find each of your
hard disk partitions and the boot sector itself.
Realistically, nearly every step in the boot process, from reading the MBR to
loading the operating system, is vulnerable to virus sabotage. Some of the
most tenacious and destructive viruses still include the ability to infect your
computer’s boot sector or MBR among their repertoire of tricks. Among other
advantages, loading at boot time can give a virus achance to do its work before
your anti-virus software has a chance to run. Many Dr Solomon’s anti-virus
products anticipate this possibility by allowing you to create an emergency
disk you can use to boot your computer and remove infections.
ButmostbootsectorandMBRviruseshadaparticularweakness:theyspread
by means of floppy disks or other removable media, riding concealed in that
first track of disk space. As fewer users exchanged floppy disks and as
software distribution came to rely on other media, such as CD-ROMs and
direct downloading from the Internet, other virus types eclipsed the boot
sector threat. But it’s far from gone—many later-generation viruses routinely
incorporate functions that infect your hard disk boot sector or MBR, even if
they use other methods as their primary means of transmission.
Those same viruses have also benefitted from several generations of evolution,
and therefore incorporate much more sophisticated infection and concealment
techniques that make it far from simple to detect them, even when they hide
in relatively predictable places.
File infector viruses
At about the same time as the authors of the Brain virus found vulnerabilities
in the DOS boot sector, other virus writers found out how to use other
software to help replicate their creations. An early example of this type of virus
showed up in computers at Lehigh University in Pennsylvania. The virus
infected part of the DOS command interpreter COMMAND.COM, which it
used to load itself into memory. Once there, it spread to other uninfected
COMMAND.COM files each time a user entered any standard DOS command
that involved disk access. This limited its spread to floppy disks that
contained, usually, a full operating system.
Later viruses quickly overcame this limitation, sometimes with fairly clever
programming. Virus writers might, for instance, have their virus add its code
to the beginning of an executable file, so that when users start a program, the
virus code executes immediately, then transfers control back to the legitimate
software, which runs as though nothing unusual has happened. Once it
activates, the virus “hooks” or “traps” requests that legitimate software makes
to the operating system and substitutes its own responses.

User’s Guide xvii
Preface
Particularly clever viruses can even subvert attempts to clear them from
memory by trapping the CTRL+ALT+DEL keyboard sequence for a warm
reboot, then faking a restart. Sometimes the only outward indication that
anything on your system is amiss—before any payload detonates, that
is—might be a small change in the file size of infected legitimate software.
Stealth, mutation, encryption, and polymorphic techniques
Unobtrusive as they might be, changes in file size and other scant evidence of
a virus infection usually gives most anti-virus software enough of a scent to
locate and remove the offending code. One of the virus writer’s principal
challenges, therefore, is to find ways to hide his or her handiwork. The earliest
disguises were a mixture of innovative programming and obvious giveaways.
The Brain virus, for instance, redirected requests to see a disk’s boot sector
away from the actual location of the infected sector to the new location of the
boot files, which the virus had moved. This “stealth” capability enabled this
and other viruses to hide from conventional search techniques.
Because viruses needed to avoid continuously reinfecting host systems—
doing so would quickly balloon an infected file’s size to easily detectable
proportions or would consume enough system resources to point to an
obvious culprit—their authors also needed to tell them to leave certain files
alone. They addressed this problem by having the virus write a characteristic
byte sequence or, in 32-bit Windows operating systems, create a particular
registry key that would flag infected files with the software equivalent of a “do
not disturb” sign. Although that kept the virus from giving itself away
immediately, it opened the way for anti-virus software to use the “do not
disturb” sequence itself, along with other characteristic patterns that the virus
wrote into files it infected, to spot its “code signature.” Most anti-virus
vendors now compile and regularly update a database of virus “definitions”
that their products use to recognize those code signatures in the files they scan.
In response, virus writers found ways to conceal the code signatures. Some
viruses would “mutate” or transform their code signatures with each new
infection. Others encrypted themselves and, as a result, their code signatures,
leaving only a couple of bytes to use as a key for decryption. The most
sophisticated new viruses employed stealth, mutation and encryption to
appear in an almost undetectable variety of new forms. Finding these
“polymorphic” viruses required software engineers to develop very elaborate
programming techniques for anti-virus software.

Preface
xviii Dr Solomon’sAnti-Virus
Macro viruses
By 1995 or so, the virus war had come to something of a standstill. New viruses
appeared continuously, prompted in part by the availability of ready-made
virus “kits” that enabled even some non-programmers to whip up a new virus
in no time. But most existing anti-virus software easily kept pace with updates
that detected and disposed of the new virus variants, which consisted
primarily of minor tweaks to well-known templates.
But 1995 marked the emergence of the Concept virus, which added a new and
surprising twist to virus history. Before Concept, most virus researchers
thought of data files—the text, spreadsheet, or drawing documents created by
the software you use—as immune to infection. Viruses, after all, are programs
and, as such, needed to run in the same way executable software did in order
to do their damage. Data files, on the other hand, simply stored information
that you entered when you worked with your software.
That distinction melted away when Microsoft began adding macro
capabilities to Word and Excel, the flagship applications in its Office suite.
Using the stripped-down version of its Visual Basic language included with
the suite, users could create document templates that would automatically
format and add other features to documents created with Word and Excel.
Other vendors quickly followed suit with their products, either using a
variation of the same Microsoft macro language or incorporating one of their
own. Virus writers, in turn, seized the opportunity that this presented to
conceal and spread viruses in documents that you, the user, created yourself.
The exploding popularity of the Internet and of e-mail software that allowed
users to attach files tomessages ensured that macro viruses would spread very
quickly and very widely. Within a year, macro viruses became the most potent
virus threat ever.
On the frontier
Even as viruses grew more sophisticated and continued to threaten the
integrity of computer systems we all had come to depend upon, still other
dangers began to emerge from an unexpected source: the World Wide Web.
Once a repository of research papers and academic treatises, the web has
transformed itself into perhaps the most versatile and adaptable medium ever
invented for communication and commerce.
Because its potential seems so vast, the web has attracted the attention and the
developmental energies of nearly every computer-related company in the
industry.

User’s Guide xix
Preface
Convergences in the technologies that have resulted from this feverish pace of
invention have given website designers tools they can use to collect and
displayinformation in ways never previously available. Websites soonsprang
up that could send and receive e-mail, formulate and execute queries to
databases using advanced search engines, send and receive live audio and
video, and distribute data and multimedia resources to a worldwide audience.
Much of the technology that made these features possible consisted of small,
easily downloaded programs that interact with your browser software and,
sometimes, with other software on your hard disk. This same avenue served
as an entry point into your computer system for other—less benign—
programs to use for their own purposes.
Java, ActiveX, and scripted objects
These programs, whether beneficial or harmful, come in a variety of forms.
Someare special-purposeminiatureapplications,or“applets,”written inJava,
a programming language first developed by Sun Microsystems. Others are
developed using ActiveX, a Microsoft technology that programmers can use
for similar purposes.
Both Java and ActiveX make extensive use of prewritten software modules, or
“objects,” that programmers can write themselves or take from existing
sources and fashion into the plug-ins, applets, device drivers and other
software needed to power the web. Java objects are called “classes,” while
ActiveX objects are called “controls.” The principle difference between them
lies in how they run on the host system. Java applets run in a Java “virtual
machine” designed to interpret Java programming and translate it into action
on the host machine, while ActiveX controls run as native Windows software
that links and passes data among other Windows programs.
The overwhelming majority of these objects are useful, even necessary, parts
of any interactive website. But despite the best efforts of Sun and Microsoft
engineers to design security measures into them, determined programmers
can use Java and ActiveX tools to plant harmful objects on websites, where
they can lurk until visitors unwittingly allow them access to vulnerable
computer systems.
Unlike viruses, harmful Java and ActiveX objects usually don’t seek to
replicate themselves. The web provides them with plenty of opportunities to
spread to target computer systems, while their small size and innocuous
nature makes it easy for them to evade detection. In fact, unless you tell your
web browser specifically to block them, Java and ActiveX objects download to
your system automatically whenever you visit a website that hosts them.

Preface
xx Dr Solomon’sAnti-Virus
Instead, harmful objects exist to deliver their equivalent of a virus payload.
Programmers have written objects, for example, that can read data from your
hard disk and send it back to the website you visited, that can “hijack” your
e-mail account and send out offensive messages in your name, or that can
watch data that passes between your computer and other computers.
Even more powerful agents have begun to appear in applications that run
directly from websites you visit. JavaScript, a scripting language with a name
similar to the unrelated Java language, first appeared in Netscape Navigator,
with its implementation of version 3.2 of the Hyper Text Markup Language
(HTML) standard. Since its introduction, JavaScript has grown tremendously
in capability and power, as have the host of other scripting technologies that
have followed it—including Microsoft VBScript and Active Server Pages,
Allaire Cold Fusion, and others. These technologies now allow software
designers to create fully realized applications that run on web servers, interact
with databases and other data sources, and directly manipulate features in the
web browser and e-mail client software running on your computer.
As with Java and ActiveX objects, significant security measures exist to
prevent malicious actions, but virus writers and security hackers have found
ways around these. Because the benefits these innovations bring to the web
generally outweigh therisks, however, mostusers find themselves calculating
the tradeoffs rather than shunning the technologies.
Where next?
Malicious software has even intruded into areas once thought completely out
of bounds. Users of the mIRC Internet Relay Chat client, for example, have
reported encountering viruses constructed from the mIRC scripting language.
The chat client sends script viruses as plain text, which would ordinarily
preclude them from infecting systems, but older versions of the mIRC client
software would interpret the instructions coded into the script and perform
unwanted actions on the recipient’s computer.
The vendors moved quickly to disable this capability in updated versions of
the software, but the mIRC incident illustrates the general rule that where a
way exists to exploit a software security hole, someone will find it and use it.
Late in 1999, another virus writer demonstrated this rule yet again with a
proof-of-concept virus called VBS/Bubbleboy that ran directly within the
Microsoft Outlook e-mail client by hijacking its built-in VBScript support. This
virus crossed the once-sharp line that divided plain-text e-mail messages from
the infectable attachments they carried. VBS/Bubbleboy didn’t even require
you to open the e-mailmessage—simply viewing it from the Outlook preview
window could infect your system.