McAfee VIRUSSCAN 5.1 User manual

McAfee VirusScan
Getting Started Guide
Version 5.1

COPYRIGHT
Copyright © 2000 Network Associates, Inc. and its Affiliated Companies. All Rights Reserved. No part
of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated
into any language in any form or by any means without the written permission of Network Associates,
Inc.
TRADEMARK ATTRIBUTIONS
* ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX,
Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr
Solomon’s, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk,
Hunter, ISDN Tel/Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy,
MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More
Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetScan, NetShield, NetShield,
NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts,
PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty
Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router
PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer,
SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM,
TeleSniffer, TIS, TMach, TMeg, Total Network Security, Total Network Visibility, Total Service Desk,
Total Virus Defense, T-POD, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virex-PC, Virus Forum,
ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000
are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All
other registered and unregistered trademarks in this document are the sole property of their respective
owners.
LICENSE AGREEMENT
NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT
("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") BY
NETWORK ASSOCIATES, INC. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR
INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY)
CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO
NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE BUTTON THAT
INDICATES THAT YOU DO NOT ACCEPT THE TERMS OF THIS AGREEMENT AND DO NOT
INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE
PLACE OF PURCHASE FOR A FULL REFUND.)
1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and
conditions of this Agreement, McAfee hereby grants to you a non-exclusive, non-transferable right
to use one copy of the specified version of the Software and the accompanying documentation (the
"Documentation"). You may install one copy of the Software on one computer, workstation,
personal digital assistant, pager, "smart phone" or other electronic device for which the Software
was designed (each, a "Client Device"). If the Software is licensed as a suite or bundle with more
than one specified Software product, this license applies to all such specified Software products,
subject to any restrictions or usage terms specified on the applicable price list or product packaging
that apply to any of such Software products individually.
Issued July 2000/VirusScan v5.1

Getting Started Guide iii
Table of Contents
Chapter 1. About VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
How does VirusScan software work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
What comes with VirusScan software? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
What’s new in this release? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Chapter 2. Installing VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . .13
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Other recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Preparing to install VirusScan software . . . . . . . . . . . . . . . . . . . . . . . . .14
Installation options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Installation steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Chapter 3. Using the
VirusScan application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Starting the VirusScan application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Displaying the VirusScan application main window . . . . . . . . . . . . . . . .25
Chapter 4. Removing Infections
From Your System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
If you suspect you have a virus... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Chapter 5. Using the VShield Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . .33
What does the VShield scanner do? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Why use the VShield scanner? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Browser and e-mail client support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Enabling or starting the VShield scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Using the VShield configuration wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Using the VShield shortcut menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44
Appendix A. Product Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45
How to Contact McAfee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

Table of Contents
iv McAfee VirusScan
Customer service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Technical support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Appendix B. Download Information (License ID #: VSF500R) . . . . . . . .49
SecureCast™ (For Windows 95/98 Retail Version): . . . . . . . . . . . . . . . . . . . .49
Internet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

1
Getting Started Guide 5
1About VirusScan Software
How does VirusScan software work?
VirusScan software combines the anti-virus industry’s most capable scan
engine with top-notch interface enhancements that give you complete access
to that engine’s power. The VirusScan graphical user interface unifies its
specialized program components, but without sacrificing the flexibility you
need to fit the software into your computing environment. The scan engine,
meanwhile, combines the best features of technologies that McAfee and
McAfee VirusScan researchers developed independently for more than a
decade.
What comes with VirusScan software?
VirusScan software consists of several components that combine one or more
related programs, each of which play a part in defending your computer
against viruses and other malicious software. The components are:
•The VirusScan Central. This is your main entry point in using all of the
available components of McAfee VirusScan. This home screen (see Figure
1-2) provides relevant information such as the last time a virus scan was
performed on your computer; what VShield settings are enabled or
disabled and available DAT information and when it was created.

About VirusScan Software
6 McAfee VirusScan
Figure 1-1. McAfee VirusScan Central screen
Through this user-friendly interface, you can access the main functions of
McAfee VirusScan. Click the appropriate buttons as displayed to start
performing a particular task within McAfee VirusScan (e.g., Scan, Schedule,
Quarantine, etc).
You can also click the Update button to start searching and downloading any
availableupdatestoMcAfee VirusScaninstalledon yourcomputer.Make sure
that you are connected to the Internet prior to using this feature. For more
information and step-by-step instructions, click the Help icon on the upper
right-hand corner of the window. To view available options in customizing
how you want McAfee VirusScan components to work on your PC, click the
Options button.
•The VirusScan Console. This component allows you to create, configure
and run VirusScan tasks at times you specify. A “task” can include
anything from running a scan operation on a set of disks at a specific time
orinterval,torunningan update or upgradeoperation.Youcanalsoenable
or disable the VShield scanner from the Console window. The Console
comes with a preset list of tasks that ensures a minimal level of protection
for your system—you can, for example, immediately scan and clean your
C: drive or all disks on your computer. See “Creating and Configuring
Scheduled Tasks” on page 191 of the VirusScan User’s Guide for details.

Getting Started Guide 7
About VirusScan Software
•The VShield scanner. This component gives you continuous anti-virus
protection from viruses that arrive on floppy disks, from your network, or
from various sources on the Internet. The VShield scanner starts when you
start your computer, and stays in memory until you shut down. A flexible
set of property pages lets you tell the scanner which parts of your system
to examine, what to look for, which parts to leave alone, and how to
respond to any infected files it finds. In addition, the scanner can alert you
when it finds a virus, and can summarize each of its actions.
The VShield scanner comes with three other specialized modules that
guard against hostile Java applets and ActiveX controls, that scan e-mail
messages and attachments that you receive from the Internet via Lotus
cc:Mail, Microsoft Mail or other mail clients that comply with Microsoft’s
Messaging Application Programming Interface (MAPI) standard, and that
block access to dangerous Internet sites. Secure password protection for
your configuration options prevents others from making unauthorized
changes. The same convenient dialog box controls configuration options
for all VShield modules. See “Using the VShield Scanner” on page 85 of the
VirusScan User’s Guide for details.
•Safe & Sound. This component allows you to create backup sets in
protected volume files, which is the safest and preferred type of backup. A
protected volume file is a sectioned-off area of the drive, sometimes called a
logical drive.
NOTE: Safe & Sound is only available for Windows 95, 98 and
Windows ME. For more information, access the PDF formatted
file of the User’s Guide (i.e., vscan51_userguide.pdf) included
in the McAfee VirusScan CD-ROM and read Chapter 10
“About Safe & Sound”.
•Quarantine. This component allows you to move infected files to a
quarantine folder. This moves infected files from areas where they can be
accessed and enables you to clean or delete them at your convenience.
NOTE: For more information, access the PDF formatted file of
the User’s Guide (i.e., vscan51_userguide.pdf) included in the
McAfee VirusScan CD-ROM and read Chapter 11 “About
Quarantine”.

About VirusScan Software
8 McAfee VirusScan
• The E-Mail Scan extension. This component allows you to scan your
Microsoft Exchange or Outlook mailbox, or public folders to which you
have access, directly on the server. This invaluable “x-ray” peek into your
mailbox means that VirusScan software can find potential infections before
they make their way to your desktop, which can stop a Melissa-like virus
in its tracks. See “Scanning Microsoft Exchange and Outlook mail” on page
253 of the VirusScan User’s Guide for details.
• A cc:Mail scanner. This component includes technology optimized for
scanning Lotus cc:Mail mailboxes that do not use the MAPI standard.
Install and use this component if your workgroup or network uses cc:Mail
v7.x or earlier. See “Choosing Detection options” on page 116 of the
VirusScan User’s Guide for details.
•The Alert Manager Client configuration utility. This component lets you
choose a destination for Alert Manager “events” that VirusScan software
generates when it detects a virus or takes other noteworthy actions. You
can also specify a destination directory for older-style CentralizedAlerting
messages, or supplement either method with Desktop Management
Interface (DMI) alerts sent via your DMI client software. See “Using the
Alert Manager Client Configuration utility” on page 281 of the VirusScan
User’s Guide for details.
• The ScreenScan utility. This optional component scans your computer as
your screen saver runs during idle periods. See “Using the ScreenScan
utility” on page 269 of the VirusScan User’s Guide for details.
• The SendVirus utility. This component gives you an easy and painless
way to submit files that you believe are infected directly to McAfee
anti-virus researchers. A simple wizard guides you as you choose files to
submit, include contact details and, if you prefer, strip out any personal or
confidential data from document files. See “Using the SendVirus utility to
submit a file sample” on page 76 of the VirusScan User’s Guide for details.
• The Emergency Disk creation utility. This essential utility helps you to
create a floppy disk that you can use to boot your computer into a
virus-free environment, then scan essential system areas to remove any
viruses that could load at startup. See “Using the Emergency Disk Creation
utility” on page 49 of the VirusScan User’s Guide for details.
•Command-line scanners. This component consists of a set of full-featured
scanners you can use to run targeted scan operations from the MS-DOS
Prompt or Command Prompt windows, or from protected MS-DOS mode.
The set includes:

Getting Started Guide 9
About VirusScan Software
– SCAN.EXE, a scanner for 32-bit environments only. This is the
primary command-line interface. When you run this file, it first
checks its environment to see whether it can run by itself. If your
computer is running in 16-bit or protected mode, it will transfer
control to one of the other scanners.
– SCANPM.EXE, a scanner for 16- and 32-bit environments. This
scanner provides you with a full set of scanning options for 16- and
32-bit protected-mode DOS environments. It also includes support
for extended memory and flexible memory allocations. SCAN.EXE
will transfer control to this scanner when its specialized capabilities
can enable your scan operation to run more efficiently.
– SCAN86.EXE, a scanner for 16-bit environments only. This scanner
includes a limited set of capabilities geared to 16-bit environments.
SCAN.EXE will transfer control to this scanner if your computer is
running in 16-bit mode, but without special memory configurations.
– BOOTSCAN.EXE, a smaller, specialized scanner for use primarily
with the Emergency Disk utility. This scanner ordinarily runs from
a floppy disk you create to provide you with a virus-free boot
environment.
All of the command-line scanners allow you to initiate targeted scan
operations from an MS-DOS Prompt or Command Prompt window, or
from protected MS-DOS mode. Ordinarily, you'll use the VirusScan
application's graphical user interface (GUI) to perform most scanning
operations, but if you have trouble starting Windows or if the VirusScan
GUI components will not run in your environment, you can use the
command-line scanners as a backup.
•Documentation. VirusScan software documentation includes:
– This Getting Started Guide, which introduces the product, provides
installation instructions, outlines how to respond if you suspect
your computer has a virus, and provides a brief product overview.
TheprintedGettingStartedGuidecomes withtheVirusScansoftware
copies distributed on CD-ROM discs.
– A complete user’s guide saved on the VirusScan software CD-ROM
or installed on your hard disk in Adobe Acrobat .PDF format. The
VirusScan User’s Guide describes in detail how to use VirusScan and
includes other information useful as background or as advanced
configuration options. Acrobat .PDF files are flexible online
documents that contain hyperlinks, outlines and other aids for easy
navigation and information retrieval.

About VirusScan Software
10 McAfee VirusScan
– An administrator’s guide saved on the VirusScan software
CD-ROM or installed on your hard disk in Adobe Acrobat .PDF
format. The VirusScan Administrator’s Guide describes in detail how
to manage and configure VirusScan software.
– An online help file. This file gives you quick access to a full range of
topicsthat describeVirusScan software. Youcan openthisfile either
by choosing Help Topics from the Help menu in the VirusScan
main window, or by clicking any of the Help buttons displayed in
VirusScan dialog boxes.
The help file also includes extensive context-sensitive—or “What's
This”—help.Toseethese helptopics,right-click buttons,lists, icons,
some text boxes, and other elements that you see within dialog
boxes. You canalso click the ?symbolatthetop-right cornerinmost
dialog boxes, then click the element you want to see described to
display the relevanttopic. The dialog boxes with Helpbuttons open
the help file to the specific topic that describes the entire dialog box.
– A README.TXT file. This file contains last-minute additions or
changes to the documentation, lists any known behavior or other
issues with the product release, and often describes new product
features incorporated into incremental product updates. You’ll find
the README.TXT file at the root level of your VirusScan software
CD-ROM or in the VirusScan software program folder—you can
open and print it from Windows Notepad, or from nearly any
word-processing software.
What’s new in this release?
This VirusScan release introduces a number of innovative new features to the
product’s core functionality, to its range of coverage, and to the details of its
application architecture. The section “How does VirusScan software work?”
onpage25of the VirusScanUser’s Guide, discusses many of these features. The
single most significant change between previous VirusScan versions and this
release, however, is the integration of two separate VirusScan versions
optimized to run on separate Windows platforms into a single product that
runs on both. This single product also takes full advantage of each platform’s
strengths.
The next sections discuss other changes that this VirusScan release introduces.