VIRUSCAN Version 9.14V102 Copyright (C) 1989 - 1993 by McAfee Associates All rights reserved. Documentation by Aryeh Goretsky. McAfee Associates, Inc. (408) 988-3832 office 3350 Scott Blvd, Bldg. 14 (408) 970-9727 fax Santa Clara, CA 95054-3107 (408) 988-4004 BBS (25 lines) U.S.A. USR HST/v.32/v.42bis/MNP1-5 CompuServe GO MCAFEE InterNet support@mcafee.COM TABLE OF CONTENTS: WHAT'S NEW . . . . . . . . . . . . . . . . . . . . . . . . . .2 - New features and viruses in this release - System Requirements OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . .3 - Detection of known viruses - Detection of new and unknown viruses SYNOPSIS . . . . . . . . . . . . . . . . . . . . . . . . . . .4 - Technical description of known virus detection - Technical description of new/unknown virus detection AUTHENTICITY . . . . . . . . . . . . . . . . . . . . . . . . .5 - How to verify the SCAN.EXE program file COMMAND SUMMARY. . . . . . . . . . . . . . . . . . . . . . . .6 - One-line description of switches OPTIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . .8 - Detailed explanation of switches EXAMPLES . . . . . . . . . . . . . . . . . . . . . . . . . . .15 - Samples of frequently-used options EXIT CODES . . . . . . . . . . . . . . . . . . . . . . . . . .16 - Running VIRUSCAN from batch files VIRUS REMOVAL. . . . . . . . . . . . . . . . . . . . . . . . .16 - How to manually remove a virus REGISTRATION . . . . . . . . . . . . . . . . . . . . . . . . .17 - How to register VIRUSCAN TECHNICAL SUPPORT INFORMATION . . . . . . . . . . . . . . . .17 - Information you should have ready when calling OBTAINING THE LATEST VERSION OF VIRUSCAN . . . . . . . . . . .18 - BBS, CompuServe, and Internet access to SCAN APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . .19 - Creating a virus string file with the /EXT option APPENDIX B . . . . . . . . . . . . . . . . . . . . . . . . . .20 - How to check only memory for viruses - Validation codes: Tips and Tricks - Reformatting infected floppies with DOS 5.00 - Creating a Recovery Disk APPENDIX C . . . . . . . . . . . . . . . . . . . . . . . . . .23 - Foreign Language Support Page 1 VIRUSCAN Version 9.14V102 Page 2 WHAT'S NEW Version 9.14V102 replaces 9.13V101, which was recalled from distribution because of false alarms of the Parity virus [Pvar] on disks partitioned with Disk Manager, SpeedStor, or SuperStor. Version 102 adds detection of 74 new viruses, bringing the total number of known viruses to 1,134, or counting 1,830 viruses. For a complete list of known viruses, refer to the enclosed VIRLIST.TXT file. For a description of known viruses please refer to Patricia Hoffman's Hypertext VSUM. Beginning with Version 100, we will provide foreign language support for VIRUSCAN, NETSCAN, and CLEAN-UP with an external language file named MCAFEE.MSG. When the MCAFEE.MSG file is present in the same directory as the SCAN.EXE file, SCAN will automatically use the messages from the MCAFEE.MSG file instead of the default English (American) messages in the program. In order to accommodate this change, the /FR (French) and /SP (Spanish) language switches have been removed and two new files, FRENCH.MSG and SPANISH.MSG have been included with this release. If you wish to use a foreign language, rename the language file to MCAFEE.MSG. Support for other languages will be added in the future. SYSTEM REQUIREMENTS SCAN requires 320Kb of RAM and DOS 2.0 or above (some features require DOS 3.1 or above). SCAN is designed to check stand-alone and networked PC's for viruses. For network file servers please use NETSCAN instead. SCAN displays messages in English (default); foreign language support is available as well (see APPENDIX C). NOTE: WRITE-PROTECT THE FLOPPY DISK CONTAINING THE VIRUSCAN (SCAN.EXE) PROGRAM BEFORE SCANNING TO PREVENT VIRUSCAN FROM BECOMING INFECTED BY A COMPUTER VIRUS. VIRUSCAN Version 9.14V102 Page 3 OVERVIEW (Known Virus Detection) VIRUSCAN Version 9.14V102 (filename SCAN.EXE) identifies all 1,134 known computer viruses and their variants. Some viruses have been modified so that more than one "strain" exists. Counting such modifications, 1,830 viruses exist. All known viruses infect one or more of the following areas: the hard disk partition table (alias Master Boot Record); the DOS Boot Sector of disks; or one or more executable files on the system. Executable files include operating system files, .COM files, .EXE files, overlay files, or any other files containing program code. A virus that infects more than one area, such as a boot sector and an executable file is called a multipartite virus. SCAN checks files, subdirectories, diskettes or entire systems for pre-existing computer virus infections. It will identify the virus infecting the system and the area where it was found, giving the name of the virus as well as the I.D. code used with CLEAN-UP to remove it. Infected files can be removed using the /D switch in SCAN to erase the file, or with the CLEAN-UP universal virus removal (disinfection) program. CLEAN-UP is recommended because in most cases it will eliminate the virus and fully restore infected programs or system areas to normal operation. The accompanying VIRLIST.TXT file lists describes all viruses identified by SCAN and their associated I.D. codes for removal by CLEAN-UP. OVERVIEW (Unknown and New Virus Detection) SCAN has three separate methods of detecting unknown and new viruses: ώ Validation codes which can be periodically checked against to look for the changes made by a virus to files or system areas. ώ Generic and Family virus detectors to look for new viruses which are derivatives of older viruses. ώ External virus signatures to insert new virus signature strings on a temporary basis to SCAN. VIRUSCAN Version 9.14V102 Page 4 SYNOPSIS (technical description of known virus detection) SCAN detects known viruses by searching the system for strings (sequences of bytes) unique to each computer virus and reporting their presence if found. For viruses which encrypt or cipher their code so that every infection of the virus is different, SCAN uses detection algorithms (programs) that work by statistical analysis, heuristics, or code disassembly. SYNOPSIS (technical description of new/unknown virus detection) SCAN checks for new or unknown viruses by comparing files against previously-recorded validation (checksum) data. SCAN has two levels of validation which are stored in three separate ways: ώ A simple 10-byte long validation checksum may be appended to .COM and .EXE files. If a file has been modified, it no longer matches the checksum and SCAN will report the file may have become infected. (/AV, /CV, /RV switches) ώ An enhanced 52-byte validation and recovery data checksum can also be created. This can be appended to the end of files like the 10-byte checksum, or stored in a separate log file which can be offline (e.g., on floppies) for recovery purposes. CLEAN-UP can restore infected files, partition tables, or boot sectors using this information. (/AG, /CG, /RG switches and /AF, /CF, /RF switches) NOTE: If validation codes are attached to files, SCAN will NOT add codes to the partition table, boot sector, or system files. Instead, a separate hidden file will be created in the root directory named SCANVAL.VAL containing data for these areas. NOTE: Files which are self-checking (e.g., Lotus 1-2-3) should not be validated with the /AV (Add Validation) or /AG (Add Generic) switches which modify files. Instead, use the /AF (Add File) switch. SCAN also checks for new or unknown viruses by searching for Generic or Family virus strings. These are strings that have been found repeatedly in different viruses. Since virus writers may use the older pieces of code for new viruses, this allows SCAN to detect viruses which have not been written yet. VIRUSCAN can be updated to search for new viruses by an External Virus Data File, which allows the user to input new search strings for viruses. (/EXT switch) VIRUSCAN Version 9.14V102 Page 5 AUTHENTICITY Before using SCAN for the first time, verify that it has not been tampered with or infected by a virus by using the the enclosed VALIDATE program. For instructions on using VALIDATE, please read the VALIDATE.DOC file. The validation results for Version 9.14V102 should be: FILE NAME: SCAN.EXE SIZE: 111,886 DATE: 02-27-1993 FILE AUTHENTICATION Check Method 1: 9FB2 Check Method 2: 0FD1 If your copy of SCAN differs, it may have been damaged or have options stored in it with the /SAVE switch. Run SCAN with only the /SAVE option to remove any stored options and then re-run VALIDATE. Always obtain your copy of VIRUSCAN from a known source. The latest version of VIRUSCAN and validation data for SCAN.EXE can be obtained from McAfee Associates' bulletin board system at (408) 988-4004 or from the McAfee Virus Help Forum on CompuServe (GO MCAFEE), or the mcafee.COM anonymous ftp site on the Internet. VIRUSCAN performs a self-check when run. If SCAN has been modified in any way, a warning will be displayed and the user will be prompted to either continue or quit. SCAN can still check for viruses, however, if SCAN reports that it has been damaged, it is recommended that a clean copy be obtained. Beginning with Version 72, all of McAfee Associates' VIRUSCAN series are archived with PKWare's PKZIP Authentic File Verification. If you do not see an "-AV" after every file is unzipped and receive the "Authentic Files Verified! # NWN405 Zip Source: McAFEE ASSOCIATES" message when you unzip the files then do not use them. If your version of PKUNZIP does not have verification ability, then this message may not be displayed. Please contact us if you believe tampering has occurred to the .ZIP file. VIRUSCAN Version 9.14V102 Page 6 COMMAND SUMMARY IMPORTANT NOTE: WRITE PROTECT YOUR FLOPPY DISK BEFORE SCANNING TO PREVENT INFECTION OF THE VIRUSCAN PROGRAM. VIRUSCAN checks files and other areas of the system that can contain a computer virus. When a virus is found, SCAN identifies the virus and the file or system area where it was found. SCAN examines files based on their extension. The default extensions supported by SCAN are .APP, .BIN, .COM, .EXE, .OV?, .PGM, .PIF, .PRG, .SWP, .SYS, and .XTP. Additional extensions can be added with the /E option, or use the /A to check all files. Valid options for VIRUSCAN are: SCAN {drive(s)} {options} {drive(s)} - Indicates a drive or drives to be scanned Options are: \ - Scan root directory and boot area only /? /H or /HELP - Displays help screen /A - Scan all files, including data, for viruses /AD - Scan all local drives for viruses /AF {filename} - Store recovery & validation data to {filename} /AG {filename} - Add recovery & validation data to files EXCEPT for those listed in {filename} /AV {filename} - Add validation codes to files EXCEPT for those listed in {filename} /BELL - Beep whenever a virus is found /CERTIFY - List files that do not have a validation code /CF {filename} - Check for viruses using recovery & validation data stored in {filename} /CHKHI - Check memory from 0Kb to 1,088Kb /CG - Check recovery & validation data on files /CV - Check validation codes on files /D - Overwrite and delete infected files /DATE - Save the date and time SCAN was last run (use /SHOWDATE to display) /E .xxx .yyy - Scan overlay extensions .XXX and .YYY /EXT {filename} - Scan using external virus data from {filename} /FAST - Speed up VIRUSCAN's output (see below for specifics) /HISTORY {fname} - Create infection log {fname} appending to old log /M - Scan memory for all viruses (see below for specifics) VIRUSCAN Version 9.14V102 Page 7 /MAINT - Scan "invalid media" error (damaged) disk /MANY - Scan multiple disks /NLZ - Skip internal scan of LZEXE-compressed files /NOBREAK - Disable Ctrl-C and Ctrl-Brk during scanning /NOEXPIRE - Do not display expiration notice /NOMEM - Disable memory check /NOPAUSE - Disable screen pause when scanning /NPKL - Skip internal scan of PKLITE-compressed files /REPORT {fname} - Create infection log {fname} deleting the old log /RF filename - Remove recovery & validation data stored /RG - Remove recovery & validation data from files /RV - Remove validation codes from specified files /SAVE - Save specified options as new default options /SHOWDATE - Display the date and time SCAN was last run (use /DATE to save date and time) /SUB - Scan all subdirectories inside a subdirectory /UNATTEND - Scan using DOS critical error handler (required if used within Windows or OS/2) @{filename} - Scan using options from {filename} [This space left intentionally blank.] VIRUSCAN Version 9.14V102 Page 8 OPTIONS Following is a detailed description of VIRUSCAN's options. Please note the /AF and /AG switches modify executable files. The /SAVE switch modifies the SCAN.EXE file. This may cause other anti-viral programs to generate a warning. /A - This option checks all files on the drive scanned and also examines a greater portion of files. This substantially increases the time required to scan disks and also increases VIRUSCAN's ability to detect viruses in overlay files. It is recommended this switch only be used when installing software or if a file-infecting virus has been found. This option takes priority over the /E option. /AD - This option scans all local hard disk drives for viruses. No drives need to be listed when the /AD switch is used. NOTE: If network drives exist, SCAN will attempt to access them when run with the /AD switch and fail. /AF {filename} - This option logs recovery and validation data for .COM and .EXE files, boot sector, and partition table of a disk to a user-specified file. The log file size is about 20Kb per 1,000 files validated. Recovery from a virus using the /AF information requires the CLEAN-UP (CLEAN.EXE) program. /AG {filename} - This option allows the user to store recovery and validation data for .COM and .EXE files, boot sector, and partition table of a disk. Recovery information adds 52 bytes to files. The recovery information for the partition table, boot sector, COMMAND.COM and system files is stored separately in a hidden file called SCANVAL.VAL in the root directory of the drive being scanned. {filename} is an optional ASCII text file listing files NOT to add recovery and validation data to (see NOTE below). Recovery from a virus using the /AG information requires the CLEAN-UP (CLEAN.EXE) program. /AV {filename} - This option allows the user to store validation codes for .COM and .EXE files, boot sector, and partition table of a disk. Validation information adds 10 bytes to files. The validation codes for the partition table, boot sector, system files and COMMAND.COM is stored separately in a hidden file named SCANVAL.VAL in the root directory of the drive being scanned. {filename} is an optional ASCII text file listing the files NOT to add validation codes to (see note below). VIRUSCAN Version 9.14V102 Page 9 NOTE: Files which are immunized against viruses or contain self-modifying code should not have validation codes added to them. To prevent SCAN from adding validation codes to these files, a validation exception list must be created with the path and filename of each file NOT to be validated listed on each line (only one filename for each line). To put a comment in, start the line with an "*" character. This sample file contains a list of programs NOT to validate: *LIST OF FILES NOT TO USE /AV OR /AG OPTIONS WITH * *This is Nantucket Corp's database program, Clipper C:\CLIPPER\BIN\CLIPPER.EXE *This is Lotus Development Corp's spreadsheet program, 1-2-3 C:\123\123.COM *This is Microsoft's database program, FoxPro C:\FOX\FOXPROLX.EXE *This is MS-DOS 5.00's self-modifying program, SETVER C:\DOS\SETVER.EXE *PKWare's data compression programs already perform a self-check C:\PKWARE\PKLITE.EXE C:\PKWARE\PKZIP.EXE C:\PKWARE\PKUNZIP.EXE *Stac Technologies hard disk swapping program C:\SWAPVOL.COM *Symantec's Norton Utilities V6.01 disk caching program C:\NORTON\NCACHE.EXE *WordStar Corp's word processor is self-modifying C:\WORDSTAR\WS.EXE The validation exception list should be an ASCII or DOS text file. If a word processor is used to create the list, be sure to save the file as ASCII or DOS Text. /BELL - This option causes SCAN to beep when a virus is found. /CERTIFY - This option will audit a system for files that have validation codes added to them with the /AG or /AV switches. Files that have no validation code will be reported as being uncertified by VIRUSCAN and an ERRORLEVEL of 3 will be returned after SCAN is run. /CF {filename} - This option checks recovery and validation data stored by the /AF option in {filename}. If a file or system area has changed, SCAN reports that a viral infection may have occurred. Using the /CG option adds about 25% more time to scanning. VIRUSCAN Version 9.14V102 Page 10 /CG - This options checks recovery and validation data added by the /AG option. If a file or system area has changed, SCAN reports that a viral infection may have occurred. Using the /CG option adds about 25% more time to scanning. This option takes priority over the /CV option. /CHKHI - This option checks the memory from 640Kb to 1,088Kb which can be used on 286 and 386 systems by computer viruses. On XT systems, memory may be scanned twice. Memory above 1,088 is not addressed directly by the CPU and can not contain viral code. This option cannot be used with the /NOMEM option. /CV - This option checks validation codes inserted by the /AV option. If a file or system area has been changed, SCAN will report that the file or system area has been modified and a viral infection may have occurred. Using the /CV option adds about 20% more time to scanning. NOTE: Some older Hewlett Packard and Zenith PC's modify the boot sector each time the system is booted. This causes SCAN to continually report that the boot sector has been modified if the /CF, /CG, or /CV switches are used. Check your system's manual to determine if your PC has self-modifying boot code. /D - This option tells SCAN to prompt the user to overwrite and delete an infected files. Files erased by the /D option can not be recovered. If the CLEAN-UP program is available, it can be used to disinfect the file. Partition table and boot sector viruses can not be removed by the /D option and require the CLEAN-UP virus removal program. /DATE - This option stores the time and date SCAN was last run. This is done by changing the date on the SCANVAL.VAL file. If no SCANVAL.VAL file exists, SCAN will create a 0-byte long one in the currently-logged directory. /E .xxx .yyy - This option allows an additional extension or set extensions to be scanned. Extensions should include a period "." character and be separated by a space after the /E. Up to three extensions may be added with the /E. For more extensions, use the /A option instead. /EXT {filename} - This option tells SCAN to search for viruses using virus search strings from ASCII text file {filename}, in addition to the viruses that SCAN looks for. For instructions creating an external virus data file, refer to Appendix A. VIRUSCAN Version 9.14V102 Page 11 NOTE: The /EXT option provides users with the ability to add strings for detection of viruses on an interim or emergency basis. When used with the /D option, it will overwrite-and-delete infected files. This option is not for general use and should be used with caution. /FAST - This option speeds SCAN up by displaying less on the the screen, skipping checking inside of LZEXE- and PKLITE- compressed files, and examining a smaller portion of files during scanning. This may reduce the accuracy of SCAN. /HISTORY {filename} - This option saves the output of SCAN to {filename} in ASCII text file format. If {filename} exists, SCAN will add the results of the current scan to the end. /M - This option tells VIRUSCAN to check system memory for all known computer viruses that can inhabit memory. SCAN by default only checks memory for critical and "stealth" viruses, which are viruses which can cause catastrophic damage or spread the virus infection during the scanning process. By default, SCAN will check memory for the following viruses: 1024 1253 1530 15xx variant 1963 1971 2153 2560 3040 337 3445-Stealth 4096 500 512 557 702 ABC Agena Anthrax Antitelefonica Aragon arcv B3 Blood Rage Brain Budo Caz CD Chang Coffee Shop Copyr-ug Cracky Crusher Dark Avenger Davis Dir-2 DM-330 Doom II EEL Empire End-of Evil Genius ExeBug Fam Feist Fish Flu FORM Frodo Soft Fune Futhark Geek Greemlin Green HA HBT Hellween 1182 Hi Highland Horror Ice9 Iernim IOU Jeru Variant Joanna Joshi Jump4Joy Kersplat L1 Larry Leech LixoNuke Lozinsky Lycee Magnum Malaga Malaise Microbes Mirror Mocha Monkey Mugshot Mummy Murphy VIRUSCAN Version 9.14V102 Page 12 NCU Li Ninja Nomemklatura NOP No-Int Nygus Nygus-KL Ontario-3 Otto P1R PCBB11 Penza Phantom Piazzola Plastique Pogue Pojer Problem Radyum Rattle Reaper Reklama Rocko Sandwich SBC Scr-2 Scroll Scythe Sentinel Sergant Silence Sk Sk1 Sma-108a Soyun Stealthb Sticky Stoned (Vari) Sunday-2 SVC Tabulero Taiwan3 Ten Bytes Tequila Thursday 12th Turbo Turkey Twin-351 V2100 V2P6 V600 Vietnamese Walker Whale Windmill Yan2050a Youth Zaragoza If any of the above viruses is found in memory, SCAN will stop, tell the user to power down and reboot the system from a virus- free system-bootable disk. This option can not be used with the /NOMEM option. NOTE: Using the /M option with another anti-viral software package may result in false alarms if the other package does not remove or cipher (hide or otherwise encrypt) its virus search strings in memory. /MAINT - This option is used to scan hard disks partitioned with DOS 4.0 or above that have been damaged by a boot sector or partition table infecting virus or non-DOS partitions, such as those created by Novell NetWare/386 or IBM OS/2 V2.0 HPFS. Attempts to access damaged or non-DOS disks result in an "Invalid media" message being displayed. When SCAN is run with this option, only the partition table and boot sector will be scanned. /MANY - This option is used to scan multiple diskettes placed in a given drive. If the user has more than one floppy disk to check for viruses, the /MANY option will allows the user to check disks without having to re-run SCAN multiple times. After the system has been disinfected, the /MANY and /NOMEM options options can be used together to speed up the scanning of disks. /NLZ - This option tells SCAN not to look inside files compressed with LZEXE, a file compression program. SCAN will still check LZEXE-compressed files for viruses that may have become infected after LZEXE compression. /NOBREAK - This option prevents Ctrl-C or Ctrl-Brk from aborting the scanning process. VIRUSCAN Version 9.14V102 Page 13 /NOMEM - This option turns off all memory checks for viruses in order to speed up the scanning process. It should only be used when a system is known to be virus-free. This option can not be used with the /CHKHI or /M options. /NOEXPIRE - This option prevents SCAN from displaying a warning message after 7 months warning that it may no longer be current with respect to known computer viruses. /NOPAUSE - This option disables the "More? (H = Help )" prompt displayed when SCAN fills up a screen with 24 lines of text. This allows SCAN to run on PC's with severe infections without requiring operator assistance. /NPKL - This option tells SCAN not to look inside files compressed with PKLITE, a file compression program. SCAN will still check PKLITE-compressed files for viruses that may have become infected after PKLITE compression. /REPORT {filename} - This option saves the output of SCAN to {filename} in ASCII text file format. If {filename} exists, SCAN will erase it and replace with the current scan results. /RF {filename} - This option removes recovery and validation data from log file {filename} created by the /AF option. /RG - This option removes validation and recovery data from a file or files validated with the /AG option. Using the /RG switch against a drive removes the SCANVAL.VAL file. This option can not be used with the /AG option. /RV - This option removes validation codes from a file or files validated with the /AV option. Using the /RV switch against a drive removes the SCANVAL.VAL file. This option can not be used with the /AV option. /SAVE - This option stores any listed options for subsequent executions of SCAN. The options are stored by modifying the SCAN.EXE executable file itself. For example: SCAN /NOMEM /REPORT C:\SCAN.LOG /NOPAUSE /SAVE saves the default options to /NOMEM, /REPORT C:\SCAN.LOG and /NOPAUSE and will cause SCAN to use these options the next time it is run. If SCAN is run with only the /SAVE switch, all saved options are removed and the SCAN.EXE is returned to normal. If you do not wish to modify the SCAN.EXE file, use the @{filename} option instead. VIRUSCAN Version 9.14V102 Page 14 NOTE: VALIDATE 0.4 must be used to validate SCAN V89 or above if the /SAVE option is used. /SAVE directly modifies SCAN.EXE in such a manner that validate codes will not match if an older version of VALIDATE is used. VALIDATE 0.4 generates correct validation results if the /SAVE option is used. /SHOWDATE - This option displays the time and date SCAN was last run. No virus checking is performed. NOTE: When run with /SHOWDATE, SCAN only displays the last run date. Viruses will *NOT* be checked for. /SUB - This option scans all subdirectories inside a subdirectory. Previously, SCAN would only recursively check subdirectories if a drive was scanned at the root level (e.g., C:). Do not use the /SUB switch if you are scanning a drive from the root level. /UNATTEND - This option tells VIRUSCAN to use the DOS critical error handler when accessing files. This allows SCAN to skip files in use by another program instead of stopping and displaying an error message. This option requires DOS 3.10 or above. NOTE: The /UNATTEND switch is required if you are running SCAN from a DOS session inside Windows or OS/2. @{filename} - This option allows the user to store a list of options and drives to be scanned in a configuration file. Options need to be separated by a space, while drives (disks, subdirectories, or files) need to be listed on separate lines. A sample file might look like this: /A /BELL /CV /NOMEM /REPORT C:\VIRUSCAN\SCAN.LOG C: D:\BBS E:\MCAFEE\CLEAN-UP\CLEAN.EXE The first line contains the SCAN options while other lines list the names of disks, subdirectories, or files to scan. The file should be an ASCII text file. If a word processor is used to create the list, be sure to save it as ASCII or DOS text. VIRUSCAN Version 9.14V102 Page 15 EXAMPLES The following examples show different option settings: SCAN C: To scan drive C: SCAN A:R-HOOPER.EXE Scans file "R-HOOPER.EXE" on drive A: SCAN A: /A /CV Scans all files and checks validation codes for unknown viruses on drive A:. SCAN B: /D /A Scans all files on drive B: and prompt for erasure of any infected files, if found. SCAN C: D: E: /AV /NOMEM Scan for viruses, add validation codes to files on drives C:, D:, and E:, and skip memory checking. SCAN C: D: /M /A Scan memory for all viruses, all files on drives C: and D: for viruses. SCAN C: D: /E .WPM .COD Scans drives C: and D:, including .WPM and .COD files SCAN C: /EXT A:SAMPLE.ASC /BELL To scan drive C: for known computer viruses and also for viruses added by the user via the external virus data file option, and beep whenever a virus is found. SCAN C: /M /NOPAUSE /REPORT A:INFECTN.RPT To scan for all viruses in memory and drive C: without stopping, and create a log file INFECTN.RPT on drive A: SCAN E:\DOWNLOADS /SUB To scan all subdirectories under the directory DOWNLOADS on drive E: SCAN C: D: E: /FAST /CERTIFY To perform a fast scan of drives C:, D:, and E: and check for any files that do not have validation codes. SCAN @C:\SCANOPTN.LST To run SCAN using configuration file SCANOPTN.LST located in the root directory of drive C:. SCAN /AD /M Scan all hard drive partitions and memory for viruses. VIRUSCAN Version 9.14V102 Page 16 EXIT CODES After VIRUSCAN has finished running, it will set the DOS ERRORLEVEL. ERRORLEVEL's are used in batch files to pass the results of a program's actions. The ERRORLEVEL's returned by SCAN are: ERRORLEVEL ³ DESCRIPTION ΝΝΝΝΝΝΝΝΝΝΝΨΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝΝ 0 ³ No viruses found 1 ³ One or more viruses found 2 ³ Abnormal termination (program error) 3 ³ One or more uncertified files found 4 ³ Ctrl-C or Ctrl-Break aborted scan If a user stops the scanning process, SCAN will set the ERRORLEVEL to 4. If you wish to prevent users from stopping the scanning process, then run SCAN with the /NOBREAK option. VIRUS REMOVAL What do you do if a virus is found? You can contact McAfee Associates for help, their authorized agents, or use the CLEAN-UP program. McAfee Associates can be reached by BBS, CompuServe, FAX, Internet, or Telephone and there is no charge for support calls to McAfee Associates (Authorized agents may charge normal McAfee Associates consulting rates.). The CLEAN-UP universal virus disinfection program can disinfect virtually all reported computer viruses. It is updated with each release of the SCAN program to remove new viruses. CLEAN-UP can be downloaded from McAfee Associates' BBS, the McAfee Virus Help Forum on CompuServe, and the mcafee.COM and WSMR-SIMTEL20.Army.Mil sites on the Internet, or from any of the agents' BBSes listed in the enclosed AGENTS.TXT text file. It is strongly recommended that you get experienced help in dealing with viruses if you are unfamiliar with anti-virus software and methods. This is especially true for 'critical' viruses and partition table/boot sector infecting viruses as improper removal of these viruses can result in the loss of all data and the use of the infected disk(s). [For a listing of critical viruses, see the /M switch listed under OPTIONS above.] Before removing a boot sector or partition table-infecting virus, it is recommended that you cold boot the infected PC from a clean DOS disk and backup any critical data. VIRUSCAN Version 9.14V102 Page 17 For qualified assistance in removing a virus, contact McAfee Associates directly or any of the Authorized Agents in your area. Agents may charge McAfee Associates' normal consult rates for their services. If you wish to remove a file-infecting virus manually, cold boot the PC from a clean (virus-free) DOS system disk and run SCAN with the /A and /D switches to erase all infected files. Any files removed in this manner can not be recovered. REGISTRATION A registration fee of US$25.00 is required for the use of VIRUSCAN by individual home users. Registration entitles the holder to unlimited free upgrades from McAfee Associates' BBS, the Internet, and the McAfee Virus Help Forum on CompuServe as well as technical support for one year. When registering, a diskette containing the latest version may be requested for an additional US$9.00. Only one diskette mailing will be made. Registration is for home users only and does not apply to businesses, corporations, organizations, government agencies, or schools, which must obtain a license for use. Contact McAfee Associates directly or an Authorized Agent for more information. TECH SUPPORT For fast and accurate help, please have the following information ready when you contact McAfee Associates: ώ Program name and version number. ώ Type and brand of computer, hard disk, plus any peripherals. ώ Version of DOS plus any TSRs or device drivers in use. ώ Printouts of your AUTOEXEC.BAT and CONFIG.SYS files. ώ A printout of what is in memory from the MEM command (DOS 4 and above users only) or a similar utility. ώ The exact problem you are having. Please be as specific as possible. Having a printout of the screen and/or being at your computer will be helpful. McAfee Associates can be contacted by BBS, CompuServe, FAX, or InterNet 24 hours a day, or by telephone at (408) 988-3832, Monday through Friday, 7:00AM to 5:30PM Pacific Time. VIRUSCAN Version 9.14V102 Page 18 If you are overseas, you can contact a McAfee Associates Authorized Agent. Agents are located in over 50 countries around the world and provide local sales and support for our software. Please refer to the AGENTS.TXT file for a complete list of McAfee Associates Agents. OBTAINING THE LATEST VERSION OF McAFEE ASSOCIATES PROGRAMS McAfee Associates regularly updates the VIRUSCAN series of programs every 4 to 6 weeks to add new virus detectors, new options, and fix reported bugs. To distribute these new versions, we run a multi-line BBS, CompuServe Forum, and Internet node. BBS ACCESS Our 25-line BBS is accessible 24 hours a day, 365 days a year, except for scheduled downtime and maintenance. All lines run US Robotics Courier HST Dual Standard ASL modems operating from 1,200bps to 16,800bps with line settings of 8 data bits, no parity, and one stop bit. THE McAFEE VIRUS HELP FORUM ON COMPUSERVE We are now sponsoring the McAfee Virus Help Forum on CompuServe. To reach the McAfee Virus Help Forum type GO MCAFEE at any CompuServe prompt. A free introductory membership is available. For more information, please read the enclosed COMPUSER.NOT file. INTERNET ACCESS TO McAFEE ASSOCIATES SOFTWARE The latest versions of McAfee Associates' anti-viral software is now available by anonymous ftp (file transfer protocol over the Internet from the site mcafee.COM. If your domain resolver does not support names, use the IP# 192.187.128.1. Enter "anonymous" for your user I.D. and your own email address for the password. Programs are located in the pub/antivirus directory. If you have any questions, please send email to support@mcafee.COM McAfee Associates' anti-viral software may also be found at the Simtel20 archive site WSMR-SIMTEL20.Army.MIL in the PD1: directory and its associated mirror sites WUARCHIVE.WUSTL.EDU (US), NIC.SWITCH.CH (Swiss), NIC.FUNET.FI (Finland), SRC.DOC.IC.AC (UK), and RANA.CC.DEAK.OZ.AU (Australia). VIRUSCAN Version 9.14V102 Page 19 APPENDIX A: Creating a Virus String File with the /EXT Option NOTE: The /EXT option is intended for emergency and research use only. It is a temporary method for identifying new viruses prior to the subsequent release of SCAN. A thorough understanding of viruses and string-search techniques is advised for using this option. A string length of 10 to 15 bytes is recommended. The External Virus Data file should be created with an editor or a word processor and saved as an ASCII text file. Be sure each line ends with a Carriage Return/Line Feed pair. The virus string file uses the following format: #Comment about Virus_1 "aabbccddeeff..." Virus_1_Name #Comment about Virus_2 "gghhiijjkkll..." Virus_2_Name . . "uuvvwwxxyyzz..." Virus_n_Name Where aa, bb, cc, etc. are the hexadecimal bytes that you wish to scan for. Each line in the file represents one virus. The Virus Name for each virus is mandatory, and may be up to 25 characters in length. The double quotes (") are required at the beginning and end of each hexadecimal string. SCAN will use the string file to search memory, the Partition Table, Boot Sector, System files, all .COM and .EXE files, and overlay files with the extension .APP, .BIN, .COM, .EXE, .OV?, .PGM, .PIF, .PRG, .SWP, .SYS, and .XTP. Virus strings may contain wild cards. The two wildcard options are: FIXED POSITION WILDCARD The question mark "?" may be used to represent a wildcard in a fixed position within the string. For example, the string: "E9 7C 00 10 ? 37 CB" would match "E9 7C 00 10 27 37 CB", "E9 7C 00 10 9C 37 CB", or any other similar string, regardless of the fifth byte. VIRUSCAN Version 9.14V102 Page 20 RANGE WILDCARD The asterisk "*", followed by range number in parentheses "(" and ")" is used to represent a variable number of adjoining random bytes. For example, the string: "E9 7C *(4) 37 CB" would match "E9 7C 00 37 CB", "E9 7C 00 11 37 CB", and "E9 7C 00 11 22 37 CB". The string "E9 7C 00 11 22 33 44 37 CB" would not match since the distance between 7C and 37 is greater than four bytes. You may specify a range of up to 99 bytes. Up to 10 different wildcards of either kind may be used in one virus string. COMMENTS A pound sign "#" at the begining of a line will denote a comment. Use this for adding notes to the external virus data file. For example: #New .COM virus found in file FRITZ.EXE from #Schneiderland on 01-22-91 "53 48 45 45 50" Fritz-1 [F-1] gives a description of the virus, name of the infected file, where and when it was found, etc. APPENDIX B: Miscellaneous Application Notes CHECKING MEMORY FOR VIRUSES ONLY VIRUSCAN can perform a quick check for viruses in memory only. In this mode, SCAN will not check the disk for viruses. This option is useful for network administrators who need to check workstations for viruses before allowing them to log on to a LAN but cannot run the VSHIELD program due to memory constraints. The command for this is: SCAN NUL /M /CHKHI By designating NUL as the drive to be scanned, SCAN will check system memory for viruses (up to 1088Kb if the /CHKHI option is used) and then return to DOS without scanning any disks. SCAN returns the DOS ERRORLEVEL in the normal manner. VIRUSCAN Version 9.14V102 Page 21 VIRUSCAN VALIDATION CODES If you have installed any new software or programs on your system, and are running VIRUSCAN or VSHIELD with the /CF, /CG, or /CV validation codes options, you will need to reinstall validation codes to the new files with the /AF, /AG, or /AV add validation codes options of SCAN. In addition, the SCANVAL.VAL hidden file containing validation codes for the partition table, boot sector, COMMAND.COM, and system files may have to be replaced (unhide the file with the DOS ATTRIB command and then delete it). The quickest way to update the validation codes is to remove all validation codes from the hard disk and then add them back by running SCAN with the /RV and then the /AV options. NOTE: This applies to any new version of DOS, as well as any programs which you install on your system. REFORMATTING INFECTED FLOPPIES WITH DOS 5.00 When reformatting infected floppy disks under DOS 5.0, be sure to add the /U switch to the FORMAT command. This tells DOS to do an Unconditional Format of the disk, without saving the original infected boot sector of the disk. This should be done to prevent the reinfection by unformatting the disk. CREATING A RECOVERY DISK USING THE /AF OPTION The /AF switch added in Version 90 of SCAN creates a separate file to store recovery data and validation codes. This file can be stored off-line (on a floppy disk, network drive, tape drive, etc.) and accessed on-demand to check for, and recover from infection by unknown viruses. To create a Recovery Disk, format a system-bootable floppy and copy the VIRUSCAN (SCAN.EXE) and CLEAN-UP (CLEAN.EXE) files to it. Then run SCAN against the hard disk with the /AF option. For example: SCAN C: D: /AF A:\SCANCRC.CRC will scan the C: and D: drives for known viruses and create a file named SCANCRC.CRC containing recovery data and validation codes. After SCAN finishes, write-protect the disk. To check for virus infection, turn the PC off, insert the Recovery Disk, and turn the power back on. The PC will now boot from the floppy disk. At the DOS prompt, type: SCAN C: D: /CF A:\SCANCRC.CRC to compare drives C: and D: against the recovery data stored in the SCANCRC.CRC file on the A: drive. VIRUSCAN Version 9.14V102 Page 22 To disinfect your system, turn your PC off, insert the Recovery Disk, and turn the power back on. The PC will now boot from the floppy disk. At the DOS prompt, type: CLEAN C: D: /GRF A:\SCANCRC.CRC to restore drives C: and D: with the recovery data stored in the SCANCRC.CRC file on the A: drive. [This space left blank intentionally.] VIRUSCAN Version 9.14V102 Page 23 APPENDIX C: VIRUSCAN'S FOREIGN LANGUAGE SUPPORT VIRUSCAN can display messages in a foreign language by reading in a replacement set of messages from an external file named MCAFEE.MSG. When the MCAFEE.MSG file is placed in the same directory as the SCAN.EXE file, SCAN will display messages from the foreign language module instead of displaying messages in English (American). Currently, SCAN is bundled with two .MSG files, FRENCH.MSG and SPANISH.MSG, which contain messages in French (European) and Spanish (Latin America), respectively. To use a foreign language module, rename it to MCAFEE.MSG and place it in the same directory as the SCAN.EXE file. When SCAN is run, it will check for the MCAFEE.MSG file and use it, if found. Support for other languages such as Chinese, Dutch, Finnish, French (Canadian), German, Hungarian, Norwegian, Portuguese, Russian, Spanish (European), Swahili, Swedish and Bulgarian is planned for future releases. Contact your local McAfee Associates Authorized Agent or McAfee Associates directly for availability. VIRUSCAN Version 9.14V102 Page 24 IMPORTANT NOTICE - PLEASE READ! Due to the nature of anti-virus software, the slight chance exists that a virus may be reported in a file that is not infected by that virus. If you receive a report of a virus infection which you believe may be in error, please contact McAfee Associates by telephone at (408) 988-3832, by fax at (408) 970-9727, or upload the file to our BBS at (408) 988-4004 along with your name, address, daytime telephone number, and electronic mail address, if any.