Copyright: Copyright © 1996-2002 H+BEDV Datentechnik GmbH
Citation: Copyright © 1996-2002 H+BEDV Datentechnik GmbH


BIOS

Basic Input/Output System. This term is generally used to refer to the operating system routines in the ROM. These are the core routines of the operating system, which are adapted to the installed hardware modules. The BIOS is responsible for carrying out the memory test, initialising the ports and keyboard and booting the operating system from the floppy or hard disk, for example.


Backup


Boot Record

This is the first record of the operating system to be loaded from a floppy or hard disk and executed. The program code of this record is responsible for loading the operating system.


Boot Record Virus

This type of virus attacks the boot record.

As a rule, boot record viruses only infect floppy disks: in the case of hard disks, it is normally the master boot record  which is infected. Boot record viruses are transmitted by booting with an infected disk in drive A: or by starting a dropper or a program infected with a multipartite virus. If the virus is active, any inserted non write-protected disk will be infected on entry of a DIR A:- or DIR B: command!

In most cases, the boot record virus moves the original boot record to a backup area before writing its own program code in the boot record This means that, when you start up the computer, the code of the boot record virus will be activated first, which in turn loads and executes the program code of the original boot record. Boot record viruses are normally identified from a reduction of the main memory, i.e. the computer only appears to have 638 or 639 KB of DOS memory left instead of 640 KB (655,360 bytes).


CRC

(AntiVir Professional only)

CRC (Cyclic Redundancy Check) is a method of calculating checksums. By generating a checksum and storing it in a database on a virus-free computer, AntiVir is able to compare it with a subsequently generated checksum. If the computer is infected with an unknown virus, for example, this will be revealed by the checksum comparison.

In the menu Options / CRC, you can choose whether, how and for which files you wish to use the CRC method.


Command Line

AntiVir offers you several command line parameters which can be useful in certain situations, e.g. for adapting the software to your computer environment or overcoming problems with particularly stubborn viruses.

You can change these parameters by clicking the AntiVir icon on the desktop. Now press the right mouse key and select 'Properties' from the Context menu. Then select the 'Link' index card and enter the desired parameters in the 'Target' box after the program name.

Alternatively, you can start AntiVir together with the desired command line parameters from a DOS box: simply switch to the installation directory of AntiVir and enter the program name and parameters ANTIVIR /<PARAMETER>.

Description of command line parameters

/AF

Highlights all floppy disk drives in the drive list. The drive settings in the AVWIN.INI file are ignored.

/AH

Highlights all hard disk drives in the drive list. The drive settings in the AVWIN.INI file are ignored.

/AN

Highlights all network drives in the drive list. The drive settings in the AVWIN.INI file are ignored.

/B

The automatic batch mode is only terminated if viruses are found in the memory or if a boot record or master boot record is infected. Otherwise, this mode will operate just as if you had selected 'Record in Report File Only' under Options/Repair. You should always specify a name for the report file, however.

/BASK

Automatic batch mode which takes into account the settings of AntiVir. If you have specified, for example, that all detected viruses should be repaired automatically, this will be carried out accordingly.
If you select this parameter together with the parameter /B, the latter will be ignored.

/BASK+

This parameter is identical to /BASK except that in this case statistical information is displayed at the end of the scan.

/CLA

Closes the report file after every write access.

This parameter is solely for support purposes; you should only use it if instructed to by H+BEDV, as the constant opening and closing of the report file impairs the performance of the software.

/DY

This parameter is only effective in batch mode, i.e. one of the parameters /B, /BASK or /BASK+ has to be set in addition. If no viruses were found and the scan was terminated normally (i.e. not aborted), AntiVir will save the current date in a date log file (AVWIN95.DLG). If AntiVir is then started again on the same day with the same parameters, only the self-test will be carried out. On the following day, the scan will be repeated in all cases according to the specified parameters the first time you start AntiVir.

/DYNoMsg

This parameter is identical to /DY, except that no message is generated on termination after the self-test.

/FF

Indicates a full scan of the relevant files.

/IM

This parameter allows you to specify under 'Options/Miscellaneous' whether you want infected files to be moved to the INFECTED directory of AntiVir before being repaired. If you started AntiVir without this parameter, the relevant settings will not be available.

/NB

This parameter prevents searching the bootsecotrs of your system. This paramter should only be used, if there are problems with any bootsector.

/NOCOPYVIR

By default, AntiVir will suggest that you copy certain viruses to a floppy disk and send them in to us for quality assurance purposes. If you want to suppress this message, you should set this parameter.

/NOESC

Prevents a scan from being stopped by deactivating the 'Stop' button in Luke Filewalker. This parameter has the same function as the setting 'Stop Virus Scan' in Options /Miscellaneous.

/NONETDRV

No network drives are displayed in the drive list of AntiVir.

/NOUMB

Deactivates the memory test in the UMA (between 640K and 1MB).

/NOHMA

Deactivates the memory test in the HMA (between 1024K and 1088K).

/NS

Suppresses the opening screen when you start AntiVir.

/R0

Prevents a report file from being generated. This parameter is only effective in conjunction with the parameter /B, and should only be used for test purposes.

X:

Stands for a drive letter. In this case, the settings for the drives in the AVWIN.INI file are ignored and only the drives specified in the command line are scanned. A maximum of 26 entries are possible here.


Contents

Command Line

Contents

Create Desktop Link

Create New Profile

Delete Entry

Delete Summary Report

Demo_Version

Directories

Display Read Me

Display Virus List

Download

Exit AntiVir

Extensions

Extensions/Insert

FAQ

File Filter

File Viruses

First Aid

Help

Help/Information

Important Notes

Insert File

Insert Folder

Keyboard Commands

Licence File

Load Profile

Luke Filewalker

Main Window

Master Boot Record

Master Boot Record Virus

Multiple Licence

News

Options

Options | CRC Files

Options/Action After Scan

Options/CRC

Options/CRC Files

Options/Drag&Drop

Options/Intranet Update

Options/Macro Viruses

Options/Macro Viruses/Omitted Macros

Options/Macro Viruses/Omitted Macros/Insert

Options/Miscellaneous

Options/Network Warnings

Options/Password

Options/Profiles

Options/Repair

Options/Report

Options/Report/Warnings

Options/Scan

Options/Scan/Boot Records

Options/Scan/Default Archives

Options/Scan/Extensions

Options/Scan/Extensions/Insert

Options/Scan/Omitted Files

Options/Scan/User-Defined Archives

Options/Scan/User-Defined Archives/Edit

Options/Scan/User-Defined Archives/Insert

Options/Scan2

Options/Summary Report

Partitionstabelle verschieden

Profile

Read Licence File

Read Me

Report

Report (Contents)

Report/Delete

Report/Print

Returncode

Save As Default Profile

Save Profile

Save Settings

Save Settings on Exit

Scan Options

Scan/Boot Records

Scan/Update Drive List

Scheduler

Start Scan

Start Scheduler

Status

Subdirectories

Summary Report

Summary Report Details

Suspicious Macro Found

Tools

Tools/Save System Files

Tools/Virus List

UpdateWizard

Verifiably Clean DOS Disk

Virus Found

Virus Information

Virus scans

Virus Types


Create Desktop Link

(AntiVir Professional only)

This button  [image]  can be used to create a desktop link called 'AntiVir <Profilename>'.

When this link is clicked on the desktop, AntiVir starts up and scans all files and folders of this profile.


Create New Profile

(AntiVir Professional only)

If you select this function via the button  [image]  , the previously loaded profile is closed and you can create a new one.


Delete Entry

(AntiVir Professional only)

This button  [image]  can be used to delete highlighted folders or files from the 'Profiles' index card.

You can also highlight the relevant entries and delete them from the list with the 'Del' key.


Delete Summary Report

Deletes the file containing the summary report information. If you select this menu option, a dialog window will appear asking you whether you really want to delete the summary report. This function is only active provided such a file is available.

Caution: The entire list is erased in all cases: this method cannot be used to delete individual entries from the list!


Demo_Version
Demo Version

If you have installed AntiVir as a demo version (i.e. without a valid licence file), the program will be subject to the following restrictions:

·AntiVir only scans the first directory branch

·AntiVir only repairs files in the directory 'AVTest', which has to be created in the AntiVir directory by the user himself

·AntiVir does not repair boot records

·All network options are deactivated


Directories

In this index card, you can select individual directories for scanning.

You can select the desired directory in the selection box. The display corresponds to that of the Windows Explorer:

-	To change directories, double-click on the desired directory.

-	To change drives, double-click on the desired drive in the 'Drives' list box.

-	To select folders and drives, you can also click on the + sign in front of a folder or drive symbol.

-	To navigate your way through the menu structure, use the scroll bar and arrows.

If you want to include the subdirectories of the selected directory in the scan, you must highlight 'Subdirectories'.

The scan can then be started with your chosen settings by clicking the 'Scan' button.

The highlighted entries in the drive list of the main window are not included in scans initiated in this index card.

This dialog window contains the following buttons:

Scan (Alt+S)

Starts the scan with the selected settings.

Close (Alt+C)

Closes the dialog window and transfers the settings.

Help (Alt+H)

Displays this help text.


Display Read Me

In this file, you will find important information on each

new version of AntiVir. Due to the short intervals between updates, we are

Unfortunately unable to include all new features in the

manual: these are therefore described in the

READ.ME file.


Display Virus List

This shows you a list of the viruses

detected by AntiVir.


Download

Obtaining files from the internet or from mailboxes and storing them locally on your computer.


Exit AntiVir

To exit AntiVir, you can either select 'Exit AntiVir' under the menu option 'Scan', click the H+BEDV symbol in the top left-hand corner and scroll to the 'Close' command, or use the usual key combination 'Close' (Alt+F4).

If the menu item 'Options / Save Settings on Exit' is activated, all settings will automatically be saved in the AVWIN.INI file. If this item is not active and settings have been changed, AntiVir will ask you whether you want to save these changes before exiting.


Extensions

See also:

By default, AntiVir scans program files only. The extensions of the program files are displayed in the 'File Extensions' window, which can be opened by clicking the ‘Extensions’ button of the ‘Files’ group box in the menu 'Options / Configuration / Search'. The list in this window contains the extensions of the most common program files and documents which may contain macros. If you have installed program files or documents with  different extensions on your computer, add these extension to the list (click 'Insert' button).

Please do not enter the extensions of any non-executable files, as this will impair the scanning performance of AntiVir.

The 'File Extensions' window contains the following buttons:

OK (Alt+O)

Transfers the data from this window and then closes it.

Cancel (Alt+C)

Closes the window without transferring the current settings.

Insert (Alt+I)

Inserts a new file extension. See under Insert.

Delete (Alt+L)

Deletes the highlighted file extensions.

Default (Alt+D)

If you press this button, the existing entries are deleted and the most common extensions are inserted in the file extension list (default setting).

Help (Alt+H)

Displays this help text.


Extensions/Insert

If you select the 'Insert' button in the 'Files' group box under 'Options / Configuration / Search', a dialog window will appear in which to enter file extensions for the AntiVir scan. You can enter a maximum of 3 characters here, remembering to leave out the dot. Illegal characters are not accepted.

This dialog window contains the following buttons:

OK (Alt+O)

Transfers the data from this window and then closes it.

Cancel (Alt+C)

Closes the window without transferring the current entries.

Help (Alt+H)

Displays this help text.


FAQ

When should I carry out virus scans?

How do I remove viruses?

AntiVir cannot remove the Form virus from the hard disk

AntiVir is unable to repair certain files

AntiVir is unable to create certain files

I keep getting warnings when working in a network!

AntiVir has found viruses in the Windows swap file

Virus in the memory, but not after booting from a floppy disk

Virus in the memory even after booting from a floppy disk

AntiVir and network card drivers

When should I carry out virus scans?

Always. Think of it like a car: This too is monitored in various ways - oil change, inspection and MOT, plus the occasional check-up on the indicators and lights. Similarly, you should run a standard scan on the hard disk every day. This will check executable program files (.COM, .EXE etc.) in turbo mode, and is roughly equivalent to the oil change in your car. The weekly scan of all executable program files can be likened to the inspection. Finally, there is the monthly MOT, when all files should be checked (select parameter 'All Files'). And don’t forget to check all floppy disks for viruses, of course. By the way, if you always perform the light and indicator test before starting the software, you can get AntiVir to scan your DOS file with the command line parameter /B.

How do I remove viruses?

Easy: with AntiVir. Joking apart, please always boot your computer system before a possible decontamination from your good old 'verifiably clean DOS disk'. Start Windows using the 'verifiably clean Windows disk'. Then reinstall AntiVir and run it over the data medium in question. In the case of a boot record or master boot record virus, you can carry out repairs directly with AntiVir (except Form on the hard disk; for this, please use the command 'SYS C:'). In the case of a file virus, scan and repair the entire hard disk using the default options of AntiVir (program files only). Now repeat the process in scan mode only (without repairs) using the parameter 'All Files'. If AntiVir still encounters any anomalies, these could be viruses but are not necessarily. AntiVir only distinguishes internally between .EXE and non-.EXE files, and overlays with unusual filename extensions might also be infected. Please check this before repairing. The third step is the most tricky, and requires you to run AntiVir in enhanced scanning mode (/FF) over the data medium in question. In this mode, many of the security prompts are deactivated. This can lead to false alarms (unlikely, but possible). AntiVir now searches for corrupt files and mutations. Corrupt files are particularly important. Many viruses are so badly programmed that they don’t even infect the file properly in all cases. Sometimes only part of the virus is copied to the file, sometimes only the first 10 bytes are modified, sometimes the virus overwrites bits of the file randomly with itself, sometimes it only modifies the program entry without copying itself to it - the list is endless, and provides another challenge for AntiVir. IF AntiVir reports anything abnormal in this mode, check these files paritculary carefully and compare the reported program files with the originals.

AntiVir cannot remove the Form virus from the hard disk

Yes - AntiVir refrains from repairing the boot record (but not the master boot record) of a hard disk to be on the safe side. This is because you can also get rid of this virus yourself. Boot from a clean DOS disk containing the same operating system as that installed on your hard disk (very important!). This disk should also contain the file SYS.COM or SYS.EXE. After booting from this disk, please enter the command 'SYS x:', whereby 'x' stands for the drive letter of your hard disk. Since this is presumably 'C', the command should read: 'SYS C:'. The SYS command now transfers both system files (IBMBIO.COM and IBMDOS.COM or IO.SYS and MSDOS.SYS) to the hard disk and creates a new boot record (not a master boot record!). This overwrites the old, infected boot record and that’s all there is to it.

AntiVir is unable to repair certain files

This probably also depends on the setting 'Path for Temporary Files'. Before repairing, AntiVir generates a copy of the infected file and repairs this. It never repairs the original, since, in case of multiple infections, the file may later prove to be irreparable after all. Or there might be a power failure while the FATs or directories are being updated, in which case there might be nothing left at all. Only after a successful repair is the repaired, temporary copy copied back again, thus overwriting the previously infected file. For this temporary copy, the path indicated under 'Options / Miscellaneous' is used. If you booted your computer system from a 'verifiably clean DOS disk' prior to a repair routine, the 'Path for Temporary Files' should point to 'A:\'. If you change the path to an existing, empty folder (e.g. C:\TEMP), the prompt will be suppressed.

AntiVir is unable to create certain files

This probably depends on the archive files .ZIP, .PAK or .ARJ. AntiVir cannot unpack the files contained in the archive files into the memory. They are therefore physically unpacked into the path indicated under 'Options / Miscellaneous' , 'Temporary Path'. If this path is non-existent or invalid, AntiVir will abort the unpacking procedure for this file, so please set the temporary path to a valid (preferably empty) folder. Attention: this setting is stored in the file AntiVir.INI.

I keep getting warnings when working in a network!

This is probably due to files which AntiVir is not allowed to access because they have been barred by the network software itself. As a result, neither AntiVir nor a virus can get to these files. Printer queues are another example of this.

AntiVir finds viruses in the Windows swap file

It is possible for viruses to be found in the Windows swap file. In this case, however, the problem is usually due to other relocated antivirus programs whose unencrypted search strings have now turned up in this file. Remedy: change swap file to a temporary file, close the relevant programs prior to scanning and create a new swap file after running a defragmenter (with the option Clear Free Clusters if necessary).

Virus in the memory, but not after booting from a floppy disk

AntiVir finds a virus in the memory after booting from the hard disk but a scan conducted after rebooting from a 'verifiably clean DOS disk' yields no results. In this case, try to find out which program call prompts AVScan to report the virus by 'REM'ing or working through CONFIG.SYS or AUTOEXEC.BAT line by line. If this fails, check WIN.INI as well, as well as any programs registered in the Windows autostart program group. These are usually other antivirus programs or resident virus guards. Sometimes it helps to optimise or compress the hard disk. From DOS 6.0 upwards, you can at least work through the entries of CONFIG.SYS step by step instead of line-by-line ‘REM’ing. For this purpose, press the key F8 when booting the computer system, then select the 'Individual Confirmation' mode. DOS 6.20 also allows line-by-line processing of AUTOEXEC.BAT.

Virus in the memory even after booting from a floppy disk

You are informed of a virus in the memory despite having booted from a 'verifiably clean DOS disk' in conjunction with a 'verifiably clean Windows disk'. Let’s ignore for the moment the possibility that these system disks might be infected. AntiVir can only find what’s actually in the memory, and if a signature is found, that means it really is there. The big question is how it got there in the first place. After a clean start from the emergency disks, you would assume no viruses to be active. This is in fact the case, but the infected master boot record of the hard disk has already been read into the memory (buffers, SmartDrive) by DOS. In other words, DOS only interprets the read-in data: this doesn’t mean the virus is active. AntiVir makes no distinction here, however - a signature is a signature. As to the question of how the master boot record of the hard disk came to be in the memory, there are two possible explanations: firstly, drive ‘C:’ was accessed during the booting procedure while processing the file CONFIG.SYS or AUTOEXEC.BAT. This access could have been a DIR C: or the action of loading a program from the hard disk. Please check the start files and make sure no access to C: occurs. Secondly: your hard disk is normally stacked, double-spaced or compressed in some other way. Please press the left shift key when you start up your computer system: this will prevent the compression driver from being loaded and CONFIG.SYS or AUTOEXEC.BAT from being processed.

AntiVir and network card drivers

In the resident state, some network card drivers often call the interrupt 03 without cause, which is an absolute NO-NO. This probably means that the debugging routines have been omitted from these drivers, which not only makes them larger than necessary but also causes AntiVir to crash. This may be due to the hardware-emulating driver. We have heard from one customer who eliminated the problem by replacing the installed DLLNDIS.EXE of the Developer CD from Novell with the retail version.


File Filter

(AntiVir Professional only)

This button  [image]  is used to define the file types to be scanned:

Scan According to Scan Mask (Alt+M)

Here you can enter the extensions of the file types you wish to scan. For a specific scan of all .EXE files for example, enter *.EXE.

TIP: To scan .DOC and .DOT documents, simply enter *.do?.

Scan According to the Default Profile Settings (Alt+D)

In this case, only the file types selected in the menu Options/Drag&Drop and Profiles are scanned.

Scan All Files in This Path (Alt+A)

All files are scanned.


File Viruses

These attack files. Depending on the option you have selected, AntiVir will offer to restore the infected file (if it is capable of repair) or delete it. If a file is irreparable, AntiVir will automatically offer to delete it.


First Aid
First Aid: Don’t Panic!

AntiVir has found an active virus in the memory.

If AntiVir encounters an active virus in the memory during installation or on starting the program, you will be notified by a message which you can’t miss. In this case, you are asked to boot from a write-protected system disk (either your 'verifiably clean DOS disk', a bootable Windows start disk or the bootable AntiVir CD-ROM).

Once you have been notified of a firmly suspected virus: do not carry out a warm start, e.g. with (Ctrl)+(Alt)+(Del) or a boot program, as some resident viruses can survive this. Make sure you only start programs from the emergency or system disks, as the programs on the hard disks may already be infected.

1.	Make a backup of the relevant data medium - a backup with a virus is better than no backup at all.

2.	Start your computer from the 'verifiably clean DOS disk'.

If you don't have a 'verifiably clean DOS disk', you can also use the original DOS installation disk, except that you won't be able to use certain system files and tools which could make life easier for you.

Caution: Do not access the hard disk, as the *.COM, *.EXE and other executable files may already be infected.

The easiest (and usually most successful) way is to remove the virus with the program AVE32.EXE:

3.	Boot your computer system from a 'verifiably clean DOS disk' or the bootable AntiVir CD-ROM.

4.	The drivers for your CD-ROM drive (usually a *.SYS driver supplied by the manufacturer for CONFIG.SYS and the MSCDEX.EXE of your DOS version for AUTOEXEC.BAT) must be available and activated. If not, install these drivers now.

5.	Insert the H+BEDV CD-ROM in the CD-ROM drive and your licence disk containing the file HBEDV.KEY in the 3 ½' drive if you have not already done so.

6.	At DOS level, call the program AVE32 with the parameter /ALLHARD on the CD-ROM in the directory ANTIVIR\. The command line should look like this: X:\...\ANTIVIR\AVE32.EXE /ALLHARD
The 'X:' stands for the letter of the CD-ROM drive containing the H+BEDV CD-ROM.

7.	Confirm this DOS command line with the 'Return' key.

Without any further inputs, AVE32 will now test all files in all subdirectories on all accessible drives including all boot records starting with drive A:.

Any detected viruses will not be deleted in this mode. Abnormal events such as a corrupt file or a virus are reported in the report window of AVE32.

8.	If infected files are reported, you should carry out a repair routine with AVE32 using the parameter /e. Please note that any irreparable files will be deleted in the process. You should therefore make sure you don’t need these infected files first.

Once you have successfully completed this procedure, AntiVir can usually be installed or started without difficulty.

9.	Start a scan on all accessible drives by clicking the 'Scan' button.

If no more viruses were found in the memory but infected files were reported, we recommend that you check all program files of all available drives and data media for viruses. This is because some viruses don’t only spread on the current drive, but also infect other data media, especially floppy disks and exchangeable hard disks, as well as network drives.

10.	Check the report file to see whether all viruses were repaired or whether some files were irreparable.

11.	Once all files have been successfully repaired and the corrupt files deleted, your computer is virus-free. If you have not deleted corrupt files, the virus could be activated when you load the files in question (if they are still executable), and thus start spreading again. You should handle these files with extreme caution: we recommend that you delete them in any case and copy or install the files on the hard disk again from the original disks or a virus-free backup

If AntiVir for Windows still refuses to be installed or loaded, there is a second, more time-consuming way of solving virus problems via a temporary Windows version:

a)	Boot from a non-infected Windows start disk.

If you do not have a 'verifiably clean Windows disk', we recommend that you reinstall Windows in a temporary directory from the write-protected original disks - even if it means a lot of extra work.

Whatever you do, do not start Windows from the hard disk, as some Windows files may already be infected. If you do not have a 'verifiably clean Windows disk', we recommend that you reinstall Windows in a temporary directory from the write-protected original disks - even if it means a lot of extra work.

b)	Create a temporary directory (e.g. TEMPWIN) and copy all the files from the 'verifiably clean Windows disk' to this directory, taking care to maintain the directory structure.

d)	Start Windows from this directory.

e)	Make sure you only start the programs and tools from this directory. All other programs on the drive may already be infected.

f)	Reinstall AntiVir from the original disks.

g)	When asked whether you want your hard disk to be scanned for viruses, answer 'Yes'.

h)	Once it has been successfully installed, load AntiVir.

i)	Under the menu item 'Options / Repair', you can choose whether or not to confirm the repair procedure for each infected file.

k)	Start a scan by clicking the 'Scan' button.

If no viruses were found in the memory but infected files were reported, we recommend that you check all program files of all available drives and data media for viruses. This is because some viruses don’t only spread on the current drive, but also infect other data media, especially floppy disks and exchangeable hard disks, as well as network drives.

l)	Check the report file to see whether all viruses were repaired or whether some files were irreparable.

Once all files have been successfully repaired and the corrupt files deleted, your computer is virus-free. If you have not deleted corrupt files, the virus could be activated when you load the files in question (if they are still executable), and thus start spreading again. You should handle these files with extreme caution: we recommend that you delete them in any case and copy or install the files on the hard disk again from the original disks or a virus-free backup.


Help

To obtain help on a particular topic, select one of the following options from the 'Help' menu:

Read Me

This displays the current Read Me file, in which you will find important information on each new version of AntiVir. If you have any problems or queries regarding AntiVir, please consult this file. You should find the solution to your problem here in the vast majority of cases.

Context

'Contents' allows you to display the list of contents for the help file, and has the same function as the 'Help' button. The help function of AntiVir operates on the same principle as any other Windows tool.

Using Help

This shows you a list of ways of using the Windows Help functions. You can obtain information on individual keywords by double-clicking the relevant entries.

About...

Under the menu option About..., you will find details of the version number and copyright, the name of the licence holder, the serial number and the hotline numbers.


Help/Information
Help/About...

This provides details of the version number and copyright, the name of the licence holder, the serial number and the H+B Datentechnik GmbH hotlines.


Help/This Help
Context

Displays this help text.


Important Notes

To create a 'verifiably clean DOS disk', format a new floppy disk on a guaranteed virus-free computer with the command 'format a: /s /u'. Then copy all the important programs you need from 'FORMAT.EXE' to 'KEYB.COM'. Finally, write-protect the disk and keep it somewhere safe.

The AntiVir CD-ROM is now bootable as from the beginning of 1999. This means that, in most cases, the ‘verifiably clean DOS disk' is no longer necessary for restarting in a guaranteed virus-free environment. This is what the bootable CD-ROM is for:

If the boot and master boot records on FAT16 or FAT32 drives are infected by a virus, it may no longer be possible to start the operating system. With the aid of the bootable CD-ROM from H+BEDV, these infected records can be repaired without using an external operating system.

Beside repairing boot records, it is also possible to scan all file areas on FAT16 or FAT32 drives from the AntiVir CD-ROM immediately after booting.

As a read-only medium, this CD-ROM also allows scanning in a guaranteed virus-free environment. Up to now, this has always required a 'verifiably clean DOS disk'. In many cases, however, this disk was either not generated on a guaranteed virus-free system or not readily locatable. Thanks to the self-booting AntiVir CD-ROM developed by H+BEDV, you now no longer have this problem.

Since the CD-ROM also contains the AntiVir programs, you can now repair the infected operating system with AntiVir. In other words, you no longer have to go through the time-consuming process of reloading programs from floppy disks.

Thanks to a boot manager on the CD-ROM, it is possible to boot on standard systems either from the CD-ROM or in the customary way from the hard disk without having to remove the CD-ROM from the drive.

For further information, please consult the page Frequently Asked Questions.


Insert File

(AntiVir Professional only)

This button  [image]  can be used to insert individual files for scanning in the current profile.


Insert Folder

(AntiVir Professional only)

This button  [image]  can be used to insert folders in the current profile for the purpose of scanning. By default, AntiVir automatically scans all subdirectories of the selected folder.


Keyboard Commands

The following keyboard command and key combinations are used to activate the corresponding AntiVir functions:

F1	Call Help

F2	Start Scan

F5	Update Drives

ESC	Close Dialog Window

Alt+F4	Exit AntiVir for Windows


Licence File

On purchasing AntiVir, you will receive a licence disk containing, among other things, the file 'HBEDV.KEY'. This file tells AntiVir whether you are a registered user of the relevant product.

Full, unrestricted operation of this product is only possible once you have been registered.

The licence file 'HBEDV.KEY' must be located in the same directory as your corresponding AntiVir program package. This file is either transferred to the correct directory at the appropriate point during the setup routine or by selecting the option 'Copy Licence File' in the 'Tools' menu afterwards.

If AntiVir is still started as a demo version after you have copied the licence file, please check whether the correct version of AntiVir for your operating system is enabled. On your licence disk, you will also find a file called 'LIC_INFO.TXT' which contains the following information on your licence:

Product name	The full designation of the AntiVir package enabled by the licence file on this disk.

Serial number	Indicates your serial number

Licence type	Tells you which type of licence is enabled (basic licence, combined package, update plan)

Updates	Tells you which version number your licence starts from and when it is due to expire

Licensee	The name of the user with whom the licence agreement was made.


Load Profile

(AntiVir Professional only)

This button  [image]  opens a window containing a list of all previously composed profiles.

To load a stored profile, double-click on an entry in this list (or highlight the entry and click the 'Open' button).


Luke Filewalker

Luke Filewalker is the scanner screen of AntiVir. It tells you what AntiVir is currently scanning and which tasks it has already completed.

Last Virus Found

With any luck, this should say ‘NO VIRUS FOUND’; if not, the name of the last detected virus appears in red.

Number of Files

This tells you which file AntiVir has got to so far

Time

Indicates the scanning time in mm:ss

Viruses

Indicates the number of viruses found

Repaired

Indicates the number of viruses repaired

Deleted

Indicates the number of viruses deleted

Folder

Tells you the name of the folder currently being scanned

File

Tells you the name of the file currently being scanned

Status

This line tells you what AntiVir is doing at the moment. There are three different possibilities: Scanning, Repairing and Unpacking

STOP

This button stops the scan instantly.

If this button is greyed out, the scan cannot be interrupted. In this case, the option ‘Allow Stopping’ is not selected in the group box ‘Stop Virus Scan’ under 'Options \ Miscellaneous'.


Main Window

Index card 'Profiles'

(AntiVir Professional only)

This index card enables you to group files, folders and drives into profiles and then save them in a list. These profiles can then be used for quicker, more specific virus scans, without having to go through all the other drives.

If you want to scan one of these profiles for viruses, all you have to do is open the list of profiles with the button  [image]  'Load Profile' and double-click on the relevant profile in the list (or highlight it and click on the 'Open' button).

The selection window is then closed and you can start a scan with the 'Scan' button or the 'F2' key.

The button  [image]  'Create Link' can be used to create a desktop link for a profile.


Master Boot Record

This is the first physical sector of a hard disk and only occurs in hard disk drives. It has a double function: firstly, it contains the partition table indicating which locations have been reserved for which operating system and how, and which partition is identified as active. The other part of the program code checks the validity of the partition table, selects the active partition and loads the first record of this active partition into the memory. This record is the boot record of a hard disk.


Master Boot Record Virus

This replaces the program code of the master boot record with its virus code after placing the original master boot record in temporary storage (in most cases). In this way, the master boot record virus is the first program to gain control over the entire system after the BIOS.


Multiple Licence

With a multiple licence - from three users upwards - you can also use AntiVir on several platforms according to the number of users.

There are also additional network options available such as network warnings.

In a network, the Intranet Update Wizard provides an easy way of updating AntiVir. Further information on this can be found here.


Network warnings for Windows 9x

(AntiVir Professional only)

Currently network warnings are only enabled if you have Client 32 installed.


Network warnings for Windows 9x with Novell Client 32

(AntiVir Professional only)

Warning Message

Here you can enter the text of the warning message you want AntiVir to send should a virus be detected. This message may contain the wildcards %NAME% and %VIRUS%. AntiVir replaces %NAME% with the name of the user on whose workstation the virus was found, and %VIRUS% with the name of the last detected virus. This warning message is sent at the end of each scan leading to the detection of a virus, and may contain a maximum of 58 characters: anything over this is curtailed.

Warnings To

In the 'Type' list box, you can choose whether to send the warnings messages to a group or individual users.

The selection window 'Group' or 'User' contains a list of the groups or users with access authorisation to the server you are currently logged into. You can use the checkbox here to specify whom you wish to send the message to. Once you have confirmed the entries with ‘OK’, each user in the right-hand list will be sent the message entered above whenever a virus is detected.


Network warnings for Windows NT

(AntiVir Professional only)

Warning Message

Here you can enter the text of the warning message you want AntiVir to send should a virus be detected. This message may contain the wildcards %NAME% and %VIRUS%. AntiVir replaces %NAME% with the name of the user on whose workstation the virus was found, and %VIRUS% with the name of the last detected virus. This warning message is sent at the end of each scan leading to the detection of a virus, and may contain a maximum of 58 characters: anything over this is curtailed.

Send message to

Please add the computer name to send the message to.


Network warnings for Windows NT with Novell Client 32

(AntiVir Professional only)

Warning Message

Here you can enter the text of the warning message you want AntiVir to send should a virus be detected. This message may contain the wildcards %NAME% and %VIRUS%. AntiVir replaces %NAME% with the name of the user on whose workstation the virus was found, and %VIRUS% with the name of the last detected virus. This warning message is sent at the end of each scan leading to the detection of a virus, and may contain a maximum of 58 characters: anything over this is curtailed.

Warnings To

In the 'Type' list box, you can choose whether to send the warnings messages to a group or individual users.

The selection window 'Group' or 'User' contains a list of the groups or users with access authorisation to the server you are currently logged into. You can use the checkbox here to specify whom you wish to send the message to. Once you have confirmed the entries with ‘OK’, each user in the right-hand list will be sent the message entered above whenever a virus is detected.


News

Did you know that...

...	the new AntiVir search engine can detect over 55,000 viruses and virus strains?

...	AntiVir is also available for Windows NT servers?

...	the CIH virus put several hundred thousand computers out of action in Turkey and Taiwan in April '99?

...	AntiVir for Linux is free of charge for private, non-commercial use? All you have to do is register. For more information, look in the internet under www.antivir.de.

...	there is now also a graphic user interface for AntiVir Linux called TkAntiVir? This product, created by Stefan Geiges, is subject to the GNU General Public Licence (GPL) and can be downloaded free of charge from the author’s homepage (http://www.geiges.de/sebastian/).

...	H+BEDV has developed the world’s first resident virus guard for Linux? AVGuard/X has been specially developed for servers under the free operating system Linux (e.g. with Mars, Samba).

...	the Secure AntiVirus Application Programming Interface (SAVAPI) offers a programming interface for our antivirus software which enables you to create your own individual antivirus program? SAVAPI is particularly ideal for email gateways, firewalls and specific client-server solutions.

Further information and news can be found in the internet under http://www.antivir.de


Options

In this window, you can select the following index cards in order to set the options for the relevant areas:

Search	Here you can specify when and how you want AntiVir to scan for viruses.

Repair	Here you can select the settings for repairing infected files.

Macro Viruses	Here you can select all scanning and repair pre-settings relating to macro viruses.

Action After Scan	Here you can enter the name and command line parameter of any program to be started after the scan.

Drag&Drop	Here you can specify whether you want to scan the subdirectories of folders dragged and dropped to the main window of AntiVir, and which file formats you want to include.

CRC:	(AntiVir Professional only)

                                     Here you can specify whether you want to use the CRC method, and if so how and for which files.

Network Warnings	(AntiVir Professional only)

                                      If you are connected to a network, you can specify here which users you want to warn in the event of a virus.

Miscellaneous	Here you can enter the start time of a screen saver (idle time), the temporary path, whether you want to allow interruption of the virus scan and whether you want to overwrite deleted files.

Profiles	(AntiVir Professional only)

Report	Here you can specify which information you want to include in the report.

Summary Report	Use this to specify whether you want a summary report to be generated and with which options.

Password	Here you enter a password in order to restrict access to the options of AVWin.

Intranet Update	(AntiVir Professional only)

                                      This feature allows a simple automatic update in a network (enabled for 3-user licences and upwards).

If you select the options via the menu bar of the main window, you will also find these two entries at the bottom:

Save Settings	Saves the settings of AntiVir immediately.

Save Settings

On Exit	Automatically saves all settings of AntiVir on closing the program.


Options | CRC Files
Options/CRC Files

(AntiVir Professional only)

If you click this button, a dialog window will appear in which to enter the names of the files you want to omit.

If you only enter one filename, AntiVir will exclude all files with this name from the CRC calculation, whether on drive C:, D: or A:. If you only want one specific file with this name to be omitted from the CRC calculation, you must enter its full path and name.


Options/Action After Scan

(AntiVir Professional only)

In this index card, you can specify the name and command line parameters of any program you want AntiVir to start automatically on detecting a virus.

Program Name

Enter the full name of the program you want to start after a scan here (drive, path filename and extension). This program will only be started if at least one virus is detected. Using the folder button, you can scroll through the directories in the usual way and select your target folder and program.

Arguments

You can enter any command line parameters for the program you want to start here.


Options/CRC

(AntiVir Professional only)

See also:

This index card allows you to define the mode for the CRC calculation. Inputs are only accepted if the 'Calculate Checksums' box is activated.

During the CRC test, only virus-free files are accepted in the CRC database. If AntiVir detects an infected file which has NOT been repaired, no CRC sum will be calculated for that file.

Whenever it has to calculate the CRC sum, AntiVir creates a CRC database in the root directory of each drive (using the filename entered under 'Database Name' or found automatically by AntiVir).

Calculate Checksum (Alt+C)

This option activates the function 'Calculate CRC Sums', assuming you have specified a valid database name for the CRC file. If you have confirmed this option with (OK) without entering the name of a database, AntiVir will remind you to do so and display the CRC index card again.

Database Name (Alt+D)

This is for entering the filename under which the CRC calculation data are to be stored. A default name is not provided for this file, as it could be manipulated by viruses. A CRC file with this name is stored in the root directory of each drive.

Since the database format is compatible with AntiVir for DOS, you can still use the old CRC database.

If no database name exists, AntiVir will search all available hard disks for a CRC database when the program is started. If a valid database is found (this includes databases generated under AntiVir for DOS), the name of this file will be used as the database name.

Confirm Changes (Alt+O)

In this mode, every change to the CRC sum is reported with one exception: if the box 'Record in Report File Only' is activated in the dialog window Options/Repair, any change to the CRC sum will merely be recorded in the report file. You can tell when this is the case because the 'Confirm Changes' box is deactivated.

Test Mode

There are two modes available for calculating the CRC sum: In 'Turbo Mode' (Alt+T), only part of the file in question is used to calculate the CRC sum. If 'Whole File' (Alt+H) is selected, the CRC sum will be calculated for the entire file.

The 'Turbo Mode' is sufficient in most cases, and is much quicker than calculating a CRC sum for an entire file. If a new entry is added to the CRC database, however, this setting won't make any difference, as both CRC values will then have to be calculated.

This dialog window contains the following buttons:

CRC Files (Alt+R)

If the 'Calculate Checksums' box is activated, this button can be used to open a window in which to specify the files to be included in the CRC calculation.

OK

Closes the dialog window and transfers the current entries. If 'Calculate Checksums' is activated, a database name must be entered, otherwise an error message will appear reminding you to do so.

Cancel

Closes the dialog window without transferring the new settings.

Help

Displays this help text.


Options/CRC Files

(AntiVir Professional only)

See also:

This index card allows you to define the settings for the CRC files.

You can choose whether to subject all files to a CRC test or only program files.

If you have selected 'All Files', you will find that AntiVir reports changes to the CRC sum more frequently because you are working continuously on your computer and probably changing your text files, for example. If there are no suspected viruses, you should update the CRC sum whenever a change is reported.

If you have selected 'Program Files', AntiVir will suggest a list of the most common extensions. You can of course also adapt these extension to your own file system as described later on. If a CRC change is reported in this mode, you should consider whether or not you have modified the relevant file (e.g. by updating your development environment, in which executable files are often recompiled). If not, compare the relevant file with the original (on disk or CD). If you find a discrepancy here, e.g. in the length of some executable files, this could be due to a virus.

In the 'CRC Files' window, you can enter the names of files you wish to exclude from the CRC calculation in the group box 'Omitted Files'. This is advisable in the case of files which are frequently modified (e.g. in the development/design sector). To add a file to this list, click on the 'Insert' or 'Browse' button. To delete a file, highlight the file and click on the 'Delete' button.

If you have entered a filename together with its full path, only this particular file will be omitted from the CRC test; if you enter a filename without a path, all files with this name (regardless of path and drive) will be omitted.

This dialog window contains the following buttons:

Extensions (Alt+E)

This button opens a dialog window in the 'Files' group box containing all file extensions to be scanned during the CRC calculation in the 'Program Files' mode.

Insert (Alt+I)

If you click on this button, a dialog window will appear in which to enter the name of the files you want to omit.

If you only enter one filename, AntiVir will exclude all files with this name from the CRC calculation, whether on drive C:, D: or A:. If you only want one specific file with this name to be omitted from the CRC calculation, you must enter its complete path.

Browse (Alt+B)

If you select this function, a dialog window will appear to help you search a data medium for the files you want to omit. Use this button if you don't know the exact path or name of the file you want to omit.

Delete (Alt+L)

Deletes the highlighted entry from the list of files to be omitted. This button is only active if an entry is highlighted.

OK (Alt+O)

Closes the dialog window and transfers the current entries. If 'Calculate Checksums' is active, you must enter a database name, otherwise an error message will appear reminding you to do so.

Cancel (Alt+C)

Closes the dialog window without transferring the new settings.

Help (Alt+H)

Displays this help text.


Options/Drag&Drop

In this index card, you can define the settings for the drag&drop and profile features. The drag&drop feature enables you to move files and directories to the main window of AntiVir.

If you want to scan individual directories or files on a regular basis, you can create a profile for this purpose.

Drag&Drop

Scan Subdirectories (Alt+S)

If this function is selected, all subdirectories will be scanned whenever you move one or more folders from Windows Explorer to the main window of AntiVir. If this option is not activated, the folders will only be scanned on the directory level which you have dragged and dropped to the main window of AntiVir.

All Files (Alt+D)

       (AntiVir Professional only)

By default, AntiVir looks for executable files only. If this menu option is selected, all files in the folder you have dragged and dropped to the main window of AntiVir will be scanned, including non-executable files.

AntiVir takes longer for this type of virus scan, as there are far more files to get through. When 'All Files' is active, the 'Extension' button cannot be selected.

Files Listed in Options/Scan/Files/Extensions

       (AntiVir Professional only)

This function is used to scan only the files you have previously set in the menu 'Options/Scan/Files/Extensions'.

Program Files (Alt+G)

       (AntiVir Professional only)

If this function is selected, AntiVir will only scan the relevant folder for files with specified extensions (e.g. *.BIN, *.COM, *.EXE, etc.). Default values are given for these extensions, and can be changed in a window opened via the 'Extensions' button.

If this option is activated and you have deleted all entries from the file extension list, the words 'NO EXTENSIONS' will appear below the 'Extensions' button.

This dialog window contains the following buttons:

Extensions (Alt+E)

       (AntiVir Professional only)

If the function 'Program Files' is activated, the 'Extensions' button can be selected. The dialog window File Extensions will then appear, in which you can enter the extensions of the files to be scanned directly.

OK

Transfers the data from the 'File Extensions' window and then closes it.

Cancel

Closes the dialog window without transferring the new settings.

Help

Displays this help text.


Options/Intranet Update

(AntiVir Professional only)

In this index card, you can specify whether AntiVir is to be updated via the internet and if so how frequently.

For this purpose, AntiVir starts the Update Wizard; this now checks the path in which the current program files are centrally located on the server and copies any new source files to the AntiVir target directory on your workstation.

This function is only available with a multiple AntiVir licence (for 3 or more users).

Intranet Update

Do not Perform Automatic Update (Alt+D)

If this function is selected, AntiVir will not perform an automatic update.

Only Search for New Files All xxx Days (Alt+N)

If you only want AntiVir to search for new files every xth day, select this entry and enter the appropriate number of days in the input box.

Search for New Files Every   Monday, Tuesday, ... (Alt+F)

If you only want AntiVir to search for new files on a certain day of the week, select this option box and enter the chosen day.

Path Containing Source Files (Alt+P)

Enter the path containing the current AntiVir files on the server here. If the data structure was retained on transferring the current files to the server, the current AntiVir files will be located in the folder Disk_1.

This source path might look like this, for example: \\SERVERNAME\VOLUME\UPDATES\AVWIN9x\DISK_1

If the directory structure of the AntiVir source files remains unchanged, the parallel folders, e.g. Disk_2, Disk_3, Admin, etc. will also be searched. In order to ensure a successful intranet update, it is essential to specify the update path Disk_1 correctly.

Detailed information on how to install the Intranet Update Wizard can be found on the H+BEDV CD-ROM in the directory

\en\products\win9x\disk_1\admin\admin.htm

Path Containing Licence File

Here you can specify the path to a directory on the server via which to distribute new licence files.

For example, if the Update Wizard finds a new licence file (internal generation date) in the specified directory, this will be installed automatically first and then used for the rest of the update procedure.

Hide Copy Dialog of Update application (Alt+H)

If the Update Wizard is started from AntiVir, it will begin immediately by checking the source files. If you don't want the user to follow the progress of the update routine, you should select this setting.


Options/Macro Viruses

AntiVir also scans Word documents (or rather templates) for viruses. The removal of known viruses can be controlled via the 'Options/Repair' window.

Suspicious Macros

Delete All Suspicious Macros (Alt+D)

If this option is activated, all suspicious macros of the relevant file will be deleted.

Viruses generally consist of several macros. If at least one of these is identified as suspicious and accordingly deleted, a remnant of the virus is usually left in the file. However, since part of the virus - and usually the most important part - is now missing, it is no longer fully functional.

Delete All Macros if One is Suspicious (Alt+A)

This ‘kill or cure’ remedy is actually the best way of getting rid of macro viruses. However, care should be taken if the suspicious file also contains other macros, as you will lose any macros which do not belong to the virus and which you might still need.

Confirm Action (Alt+O)

If this option is activated, a dialog window is opened as soon as AntiVir finds a macro virus. This enables you to decide immediately what to do with the possibly infected macro. This box is checked by default.

Convert Templates

Templates consist of 'normal' text just like documents, but may contain other data in addition. If Word opens a document, for example, it searches for these data in the corresponding template. AntiVir can convert templates to document format if no additional data is present, i.e. if all macros have been deleted and the template contains no menus or shortcuts, etc.

Never (Alt+N)

In this case, no templates are converted.

.DOC Files Only (Alt+I)

If this option is activated, only documents are automatically converted. Templates are not converted even if they don’t contain any macros.

Templates usually exist in the form .DOT or .WIZ and pure documents in .DOC form. Activate this function if you want AntiVir to convert all repaired documents.

Always (Alt+L)

If this setting is activated, templates will be converted to documents whenever a macro virus is found and eliminated.

Confirm (Alt+F)

In this case, AntiVir awaits your confirmation before converting the displayed file. This box is checked by default.

Compress format Table (Alt+C)

This option allows you to specify whether AntiVir should also remove references to deleted macros and their names from the table of templates.

Once you have removed macros from a file, the name of the macro still remains in the file, even though the macro itself has been overwritten and marked as deleted. Some antivirus programs do not search for the contents of a virus macro, however, but only it's name, and therefore report viruses where they no longer exist.

Omitted Macros

Information on 'Omitted Macros' can be found here


Options/Macro Viruses/Macros to omit

This button opens a window containing a list of all macros to be excluded from the heuristic virus scan.

Caution: These macros will not be scanned. Please enter as few macros as possible here, and only those which - for whatever reason - you don’t want to be checked during a normal scan. We recommend that you check these macros for viruses without fail before entering them in this list. You should send us the file containing the relevant macro at all events, as this is the only way to make sure the file is virus-free.

In the list box in this window, you can see the CRC sum (hexadecimal) and the corresponding length of the macros omitted from the scan.

To add a new macro to this list, select the 'Insert' button. To delete a macro from the list, highlight it first and then select the 'Delete' button.


Options/Macro Viruses/Macros to omit/Insert

To add an entry to the list, click on the ‘Insert’ button in the menu 'Options / Macro Viruses / Macros to omit'.

A dialog window will then appear in which to enter the CRC sum (hexadecimal) and the length of the macro to be omitted. These values can be found in the report file or in the dialog window reporting the suspicious macro.


Options/Miscellaneous

See also:

Interruption allowed (Alt+I)

If this checkbox is highlighted, the virus scan can be stopped at any time with the 'Stop' button. If you have deactivated this setting, the 'Stop' button in the ‘Luke Filewalker’ window will be greyed out, in which case you can no longer abort the scan, but must wait patiently until AntiVir has completed it's task.

Detect Idle Time (Alt+D)

If this setting is activated, AntiVir will behave like a screen saver, keeping a constant check on whether you are working on your computer. If not, it will automatically start a virus scan on all non-exchangeable drives (i.e. not floppy disk, cartridge or CD-ROM drives) after the time interval specified in this window. When the virus scan begins, AntiVir activates whichever screen saver you have set (provided it is a Windows or After Dark one). In the box 'Start After ... Minutes', you can enter the interval after which AntiVir is to start.

N.B.: In the case of After Dark, AntiVir may activate the screen saver without actually being able to scan any files. Some After Dark screen savers simply fail to release the processor, so that AntiVir can no longer carry out its virus scan. It is therefore advisable to carry out a test first on this setting in order to check whether everything is working.

Temporary Path (Alt+T)

Enter the temporary path to be used by AntiVir in this line.

The temporary path is used in order to

- unpack and scan compressed executable files

- carry out repairs

- unpack archives

If the path for temporary files no longer exists or if there is less than 1 MB of free storage space available on this drive, you will be asked which path you want AntiVir to use.

Many programs (including Microsoft Windows) use the environment variable 'TEMP' in order to determine the path for swap files. This path often points to a RAM disk or other fast medium, and is thus ideal for AntiVir. This means that you can set the environment variable 'TEMP' or 'TMP' in your AUTOEXEC.BAT (SET TMP=C:\RAMDISK).

Within AntiVir, you can also use the wildcard %TEMP% for the environment variable.

If there is no entry in the AVWIN.INI file, AntiVir will search for the environment variable 'TEMP' first, and then 'TMP'. If no entry exists in either case, the start directory of AntiVir will be used by default.

Overwrite Deleted Files (Alt+O)

If this checkbox is activated, the data of the files in question are overwritten first and then deleted.

This setting should be permanently activated, as it prevents any infected files from being recovered (e.g. with UNERASE).

Exit AntiVir If System was booted via the Shell Extension (Alt+X)

If this entry is highlighted, AntiVir will be terminated again after a scan in which it was started via the shell extension. If you don’t want this to happen, you should deactivate this setting.

This option is only effective if AntiVir is started via the shell extension; if AntiVir is active and a scan is started via the shell extension, it will have no effect.

Load the Guard at System Start (Alt+L)

If this option is activated, AVGuard will be loaded automatically when you start the system. If you want to suppress the automatic start, you should deactivate this entry. This option does not take effect until you restart the system.

Save Virulent File in INFECTED Directory Before Repair (Alt+V)

       (AntiVir Professional only)

This option can only be used if you started AntiVir with the parameter '/IM'. You should activate this option if you want to move each file to the INFECTED directory of AntiVir before it is repaired.

You can enter the extension of the relocated file under 'Extension'. When the file is moved for the first time, this exact file extension is used. Every subsequent time a file with this name is moved, the last letter of the extension is deleted and replaced by a number (from 0 to 9).

Please do not enter the extension of an executable file here, as the relocated file still contains a virus and will generally cause damage!


Options/Network Warnings

(AntiVir Professional only)

See also:

This function is only available if you have a multiple licence for AntiVir and you are working within a network.

In this index card, you can select the names of the network users who are to receive a warning automatically via the network following the detection of a virus. It is always advisable to notify the supervisor in the event of a virus, as infected files can spread very quickly via the network.

If the user at the receiving end has switched off the NetWare Broadcast Messages via the 'CASTOFF' command, for example, the message will be sent to him but not displayed.

Network warnings for Windows NT

Network warnings for Windows NT with Novell Client 32

Network warnings for Windows 9x

Network warnings for Windows 9x with Novell Client 32


Options/Password

(AntiVir Professional only)

You can protect access to the options of AntiVir by means of password. Once you have entered a password, you will be asked for this password whenever you wish to open the ‘Options’ dialog window.

Please Enter Your Password (Alt+P)

Enter the password of your choice here.

Important: This input is case-sensitive!

Please Confirm Your Password (Alt+L)

Enter your password again in the second input box by way of confirmation.

Next time you start AntiVir, a dialog window will appear as soon as the Options menu is selected in which to enter the password.


Options/Profiles

(AntiVir Professional only)

In this index card, you can specify whether subdirectories are to be included in profile scans and which file types you want AntiVir to include when scanning a profile.

Scan Subdirectories (Alt+S)

If this option is activated, all subdirectories will be scanned in profiles containing one or more directories. If this option is not activated, only directories grouped together directly in the profile will be scanned.

Files

All Files (Alt+A)

By default, AntiVir only searches for executable files. If this menu option is selected, all files in the relevant directory will be incorporated in the profile scan, including executable files.

The virus scan takes longer on this setting as there are far more files to get through. When 'All Files' is activated, the 'Extensions' button cannot be selected.

Files According to the List in Options/Search/Files/Extensions (Alt+O)

On this setting, only files previously selected in the menu 'Options/Scan/Files/Extensions' are scanned.

Program and Macro Files (Alt+P)

       (AntiVir Professional only)

If this option is selected, AntiVir will only search within the profile for files with specified extensions (e.g. *.BIN, *.COM, *.EXE, etc.). Default extensions are already given, and can be changed using the 'Extensions' button. If this option is active and you have deleted all the entries from the list of file extensions, you will see the words 'NO EXTENSIONS' below the 'Extensions' button.


Options/Repair

This index card allows you to specify what action you want AntiVir to take following the detection of a virus. The possibilities range from simply recording the events to repairing the infected files.

Most settings in this dialog window can only be selected and are only effective if you have not activated the option 'Record in Report File Only'!

Infected Files

Repair With Prompt (Alt+R)

If this setting is selected, whenever AntiVir finds a reparable file with an infected code it will ask you first whether or not you want to repair the file.

Repair Without Prompt (Alt+W)

In this case, reparable files with infected codes are repaired immediately without prompting.

Delete With Prompt (Alt+D)

In this case, infected files are deleted when you confirm the prompt. If you want to make sure that the infected file cannot be restored (e.g. with UNERASE), you should also highlight the item 'Overwrite Deleted Files' in the 'Options/Miscellaneous' window.

If 'Overwrite Deleted Files' is activated, AntiVir will also delete infected files which are possibly capable of repair.

Delete Without Prompt (Alt+E)

In this case, infected files are deleted without prompting. If you want to make sure that the file in question cannot be restored (e.g. with UNERASE), you should also highlight the item 'Overwrite Deleted Files' in the 'Options/Miscellaneous' window.

If 'Overwrite Deleted Files' is activated, AntiVir will also delete infected files which are possibly capable of repair.

Infected Destroyed Files

The settings in this group are only active if you have chosen to repair infected files under 'Infected Files'.

Delete With Prompt (Alt+L)

If an infected file was unable to be repaired, e.g. because it was destroyed by a virus, the file will be deleted after prompting when this setting is active. If you want to make sure that the file in question cannot be restored (e.g. with UNERASE), you should also highlight the item 'Overwrite Deleted Files' in the 'Options/Miscellaneous' window.

Delete Without Prompt (Alt+T)

Once again, this setting is only effective when AntiVir encounters an infected, irreparable file. If you have activated this option, the relevant file will be deleted without prompting. If you want to make sure that the file in question cannot be restored (e.g. with UNERASE), you should also highlight the item 'Overwrite Deleted Files' in the 'Options/Miscellaneous' window.

Ignore (Alt+I)

If this option is selected, irreparable files will be neither deleted nor repaired.

Warning: If such a file remains on your system, you should proceed with caution, as although this defective file is probably no longer executable, it still contains virulent code which may cause damage.

Acoustic Warning

Acoustic Warning (Alt+O)

If this checkbox is activated, an acoustic alarm is generated on detection of a virus.

Wave File (Alt+V)

In the input box 'Wave File', you can enter the path and name of a wave file of your choice. If this box is empty, the default alarm signal will be used. The button 'Test Acoustic Alarm' can be used to test the selected wave file.

Date/Time

When AntiVir repairs a file, it has to write-access the file in question in order to remove the virus code. During this process, the date and time of this file is normally set to the current system date.

The settings in this group are only active if you have specified under 'Infected Files' that you want to repair infected files.

No Change (Alt+C)

If this setting is activated, the original date and time will be retained.

Current System Time (Alt+U)

In this case, the date and time of a repaired file are set to the current system values.

Correct Date (Alt+A)

Some viruses manipulate the date or time of a file in order to find out whether or not they have already infected it. An example of this is the Vienna virus, which sets the seconds display of the infected file to 62.

If you select 'Correct Date', AntiVir will reset the file to a valid time and date after repairing it.

Caution: If you have installed any Sierra games on your computer, you should not select this setting, as Sierra adds 100 to the year figure (we are not absolutely sure why), an action also performed by Tremor viruses in order to find out whether the file is already infected. When AntiVir comes to correct the year figure, it cannot be expected to tell whether it is dealing with your favourite game or a virus.

Record in Report File Only (Alt+N)

If this setting is activated, AntiVir will neither carry out repairs nor delete infected files.

Attention: Detected viruses are only recorded in the report file!

Infected files will remain on your computer!

In case of a virus warning, it is now up to you to decide what to do with the infected files.

To make sure a report file is generated in every case, you should not deactivate the report file under 'Options/Report'.

This dialog window contains the following buttons:

Test Acoustic Alarm (Alt+S)

This button in the group box 'Acoustic Alarm' is for testing the selected wave file.

OK

Closes the dialog window and transfers the new settings.

Cancel

Closes the dialog window without transferring the new settings.

Help

Displays this help text.


Options/Report

See also:

This index card is for selecting the settings for the AntiVir report file.

A report file should be generated in all cases in order to see what action AntiVir has taken following the detection of a virus.

Before a report can be generated, you must enter a valid name for the output file. The report file is always stored in the AntiVir directory.

The report file contains boxes for entering your name in case you ever have to send this report file in to us. To avoid having to fill in all the details by hand in this case, you can create a file named AVWIN.ADR in the AntiVir directory in which to enter all the necessary information. AntiVir will then transfer these data to each report file.

Structure of address file:

[Address]

Institution=H+BEDV Datentechnik GmbH

Department=Development

Name=Mr. X

Street=Lindauer Strasse 21

Town=88069 Tettnang

Tel./Fax=07542/93040  07542/52510

EMail=mr@x.de

The following settings can be changed in order to generate a report file:

File Mode

No Report (Alt+E)

In this case, AntiVir will not generate a report file. This setting should really only be used for test purposes, when the report file can become relatively large. You should make sure a report file is always generated during normal operation.

Overwrite Report (Alt+V)

In this case, AntiVir will overwrite an existing report file after each new scan. This setting should be sufficient as a rule, and has the advantage of restricting the size of the report file.

Append New Report (Alt+N)

In this case, AntiVir appends the new report file to an existing report file. Please note, however, that if you use AntiVir regularly and keep adding to an existing file, this file will get larger and larger, and the space on your hard disk will diminish accordingly. You should therefore delete your report file again from time to time.

Data To Be Logged

Infected Files (Alt+I)

Only the names of the infected files plus the path are included in the report file.

Include All Paths (Alt+D)

All scanned paths are included in the report file in addition to the names of the infected files.

All Scanned Files (Alt+L)

All scanned filenames and paths are included in the report file.

Full Information (Alt+M)

The same data is recorded as for 'All Scanned Files', but additional information is also included, i.e. the files AUTOEXEC.BAT, CONFIG.SYS, WIN.INI and SYSTEM.INI. Should you ever have to send us a report file (for debugging), please generate it in this mode.

Please note with regard to all the above settings: if the report is deactivated, nothing will be written in the report file!

Output File (Alt+O)

Use the box in this group box to enter the name of the file under which the report is to be saved. This name can be changed for each scan unless you want to delete the report file immediately.

Shorten Report File (Alt+R)

This group box is used to define the maximum size of the report file. Activate this option and then enter (Alt+A) the desired size in the box 'Cut Off After ...  KB'. The advantage of this setting is that it prevents the report file from getting too big. Imagine you are working in the ‘Append’ mode and choose to write all information to the report file after every scan: if you use AntiVir regularly, the space on your hard disk will steadily decline.

The following buttons are available:

Warnings (Alt+W)

This button is used to open the 'Warnings' window, where you can choose which warnings you want to include in the report file. These settings only relate to warnings, and not to detected viruses or CRC modifications, for example. For more information, please refer to Options/Report/Warnings.

OK

Closes the dialog window and transfers the current settings.

Cancel

Closes the dialog window without transferring the settings.

Help

Displays this help text.


Options/Report/Warnings

In this dialog window, you can select which warnings you want to include in the report file.

These settings only relate to warnings, and not to detected viruses or CRC modifications, for example. Each of the entries highlighted here will be included in the report file whenever the event in question occurs.

Access denied (Alt+D)

This means that the file cannot be accessed, and was therefore unable to be scanned for viruses. This message occurs in the case of Windows swap files, for example. Because the swap file remains open throughout the Windows session, it cannot be scanned.

Wrong File Size in Directory (Alt+W)

The size stored in the directory does not coincide with the actual size of the file.

Wrong Creation Time in Directory (ALt+T)

The file contains an incorrect date or time entry.

For example, the Vienna virus enters the value 62 in the seconds display when it infects a file, while a Tremor virus characteristically adds 100 to the year figure. These changes to the time or date are not necessarily always caused by a virus, however: the games manufacturer Sierra, for instance, also adds 100 to the year figure.

COM File is Too Large (Alt+F)

A COM file must not exceed 65536 bytes. The above warning is issued if a larger COM file is found.

Invalid Start Address (Alt+I)

In the case of EXE files, the start address of the program is stored in CS:IP in the EXE header. The above warning is issued if an incorrect address is found here.

Invalid EXE Header (Alt+E)

The length of a file is stored in the EXE header. If the length indicated here differs from the actual length, the above warning is issued.

Possibly Damaged by Viruses (Alt+P)

This file may have been damaged by viruses. If you have any problems with it, replace it with the original file.

OLE file is Damaged or Protected (Alt+L)


Options/Scan
Options/Search

This index card allows you to specify which files you want AntiVir to scan, where these files are located and which type of scan you want to use.

Boot Records

Boot Record of Selected Drives (Alt+T)

If this function is activated, the boot record of all selected drives are checked for viruses at the start of the scan. This option is only active and can only be changed when 'All Boot Records' is deactivated.

All Boot Records (Alt+L)

On this setting, all preselected boot records are checked for viruses, including those of drives not subject to a full scan. When this setting is selected, the setting 'Boot Record of Selected Drives' is deactivated and the 'Boot Records' button is activated.

Boot Records (Alt+O)

When 'All Boot Records' is activated, this button can be used to open a window in which to specify the drive types whose boot records are to be checked at the beginning of each scan.

All drive types are highlighted by default. An additional possibility is offered by the setting 'Boot Record of Selected Floppy Disk': if you have chosen not to scan the boot records of floppy disk drives here, but a floppy disk is highlighted in the drive list of the main window, the boot record of this disk will still be included in the scan.

Files

All Files (Alt+D)

By default, AntiVir scans program files only. If this menu option is selected, all files on the relevant drives will be scanned, including non-executable files.

N.B.: This setting should only be activated following the detection of a virus in order to carry out a thorough check on all your files, as it takes much longer. The 'Extensions' button cannot be selected when 'All Files' is activated.

Program Files (Alt+G)

If you have selected this function, only files with a specified extension will be scanned (e.g. *.BIN, *.COM, *.EXE, etc.). Default extensions are already given, and can be changed in the window opened via the 'Extensions' button.

If this option is active and you have deleted all the entries from the list of file extensions, you will see the words 'NO EXTENSIONS' below the ‘Extensions’ button.

Extensions (Alt+E)

This command opens a dialog window containing all the file extensions to be checked during a scan in the ‘Program Files’ mode. The most common program file extensions are set by default.

Memory

Begin Scan with Memory (Alt+M)

If this checkbox is highlighted, the main memory of your computer will be examined for viruses at the beginning of each scan.

N.B.: This function should be active at all times in order to ensure maximum protection against viruses. If a virus is active in the memory, you will run the risk of infecting all scanned files. In this case, reboot your system from a virus-free, write-protected system disk.

Priority (Alt+R)

In the list box within this group box, you can set the priority of the scan to either ‘low’, 'medium' or 'high'. ‘Low’ means that the processor is released for scanning at longer intervals, while 'high' ensures much shorter intervals. This priority refers to both foreground and background processing.

Omit Files

This button or key combination is used to open a window containing a list of all files to be omitted from a scan. Further information can be found here.


Options/Scan/Boot Records
Options/Search/Boot Records

(AntiVir Professional only)

This button opens a dialog box in which to specify which boot records you want to scan (provided you have activated the setting 'All Boot Records' in the Scan/Options window). All drive types are activated by default.

Highlight the drive types you want to scan (floppy disk drives, hard disks, RAM disks) in this dialog window.

This setting can be used to avoid scanning floppy disk drives, for example: often there is no disk inserted in the drive, yet AntiVir still has to access this slow medium in order to check whether or not a disk is present. This check is carried out with every scan and takes up unnecessary time.


Options/Scan/Default Archives
Options/Search/Default Archives

In this dialog window, you can specify which archives you want AntiVir to scan by highlighting the relevant entries.

AntiVir uses internal unpacking routines for .ZIP and .ARJ archives, i.e. the corresponding DOS unpackers are not required.

With .LZH and .PAK archives, you also need to have the corresponding archiving program on your hard disk in order to unpack the archives (LHA.EXE and PAK.EXE). In addition, a path to the directory containing the archiving program must be set, or the archiving program must be located in the AntiVir directory. You can also enter the path for the unpacker in the corresponding editing box. In this case, AntiVir will begin searching for the unpackers in the path specified in the input box, then in the AntiVir directory, then in the directories of the environment variable 'PATH'.

At the beginning of every scan, AntiVir begins by searching for the highlighted archiving programs; if one of these programs is not available (i.e. not found in either the specified directory or the AntiVir directory or a directory of the environment variable 'PATH'), a message is generated and the corresponding entry automatically deselected. On commencing the scan, AntiVir first checks whether the archiving programs are virus-free; if not, the archive in question is automatically deselected.

The external command line programs accessed by AntiVir for the default archives are called with the following parameters:

PAK.EXE: e /wn

LHA.EXE: e /m1


Options/Scan/Extensions
Options/Search/Extensions

By default, AntiVir scans program files only. The extensions of the program files are displayed in the 'File Extensions' window, which can be opened by clicking the ‘Extensions’ button of the ‘Files’ group box in the menu 'Options / Scan'. The list in this window contains the extensions of the most common program files and documents which may contain macros. If you have installed program files or documents with  different extensions on your computer, add these extension to the list (click 'Insert' button).

Please do not enter the extensions of any non-executable files, as this will impair the scanning performance of AntiVir.

The 'File Extensions' window contains the following buttons:

OK (Alt+O)

Transfers the data from this window and closes the window.

Cancel (Alt+C)

Closes the dialog window without transferring the current settings.

Insert (Alt+I)

Inserts a new file extension. See under Insert.

Delete (Alt+L)

Deletes highlighted file extensions.

Default (Alt+D)

If you click on this button, the existing entries are deleted and the most common extensions are inserted in the file extension list (default setting).

Help (Alt+H)

Displays this help text.


Options/Scan/Extensions/Insert
Options/Search/Extensions/Insert

If you select the 'Extensions’ button in the ‘Files’ group box, a dialog window will appear in which to enter file extensions for the AntiVir scan. A maximum of 3 characters are accepted (leaving out the dot at the beginning). Illegal characters are not accepted.

This dialog window contains the following buttons:

OK (Alt+O)

Transfers the data in this window and closes the window.

Cancel (Alt+C)

Closes the dialog window without transferring the current entry.

Help (Alt+H)

Displays this help text.


Options/Scan/Omitted Files
Options/Search/Omit Files

Here you can enter the files and paths you want to exclude from the virus scan.

Warning: These files will not be scanned!

Please enter as few files as possible here and only those which - for whatever reason - you don’t want to include in a normal scan. We recommend that you check these files for viruses in all cases before adding them to this list!

N.B.: The files included in this list are entered in the report file. Please check the report file from time to time for these unscanned files in case your reason for excluding one of them no longer applies and you can remove it from the 'Omitted Files' window again.

To add a file to this list, click on the 'Insert' button or select a file using the browser, which is activated via the 'Browse' button. If you enter a filename here together with its full path, this file and only this file will be omitted from the virus scan. If you enter a filename without a path, any file with this name (regardless of path or drive) will be omitted.

To delete an entry, highlight it first and then click on the ‘Delete’ button.


Options/Scan/User-Defined Archives
Options/Search/User-Defined Archives

(AntiVir Professional only)

You can get AntiVir to scan rarely used or in-house archives by entering the file extension and name of the relevant unpacker together with the corresponding parameters in the dialog window 'Options/Search/User-Defined Archives'.

The following wildcards are permitted in the command line:

%a	is expanded by AntiVir to the full name (with drive and path) of the file to be scanned.

For example, a command line such as

/d /o %a

could be expanded by AntiVir to:

/d /o C:\DATEN\ARCHIV.DAT

In order to unpack a file, AntiVir creates a new subdirectory in the path for temporary files, to which it then switches.

As a rule, the unpacker will unpack files into the current directory unless it has been given a target path.

If this does not apply to your unpacker, try entering '.' as the target directory. Files will then be unpacked into this directory, which is now the current directory. Please make sure there is sufficient space available here for all the files you want to unpack.


Options/Scan/User-Defined Archives/Edit
Options/Search/User-Defined Archives/Modify

(AntiVir Professional only)

You can get AntiVir to scan rarely used or in-house archives by entering the file extension and name of the relevant unpacker together with the corresponding parameters in the dialog window 'Options/Search/User-Defined Archives'.

This dialog window can be used to edit the existing entry.

File Type (Alt+F)

Change the extension of the relevant archive here.

Program (Alt+P)

Change the name of the unpacker (including path) here.

Parameter (Alt+R)

The following wildcards are permitted in the command line:

%a	is expanded by AntiVir to the full name (with drive and path) of the file to be scanned.

For example, a command line such as

/d /o %a

might be expanded by AntiVir to:

d /o C:\DATEN\ARCHIV.DAT


Options/Scan/User-Defined Archives/Insert
Options/Search/User-Defined Archives/Insert

(AntiVir Professional only)

You can get AntiVir to scan rarely used or in-house archives by entering the file extension and name of the relevant unpacker together with the corresponding parameters in the dialog window 'Options/Search/User-Defined Archives'.

You can now add your archives via this dialog window.

File Type

Enter the extension of the relevant archive here.

Program

Enter the name of the unpacker (including path) here.

Parameters

The following wildcards are permitted in the command line:

%a	expanded by AntiVir to the full name (with drive and path) of the file to be scanned.

For example, a command line such as

/d /o %a

might be expanded by AntiVir to:

/d /o C:\DATEN\ARCHIV.DAT


Options/Scan2
Options/Search

This index card allows you to specify which files you want AntiVir to scan, where these files are located and which type of scan you want to use.

Boot Records

Boot Record of Selected Drives (Alt+T)

If this function is activated, the boot record of all selected drives are checked for viruses at the start of the scan. This option is only active and can only be changed when 'All Boot Records' is deactivated.

All Boot Records (Alt+L)

(AntiVir Professional only)

On this setting, all preselected boot records are checked for viruses, including those of drives not subject to a full scan. When this setting is selected, the setting 'Boot Record of Selected Drives' is deactivated and the 'Boot Records' button is activated:

Boot Records (Alt+O)

When 'All Boot Records' is activated, this button can be used to open a window in which to select the drive types whose boot records you want to check at the beginning of each scan.

All drive types are highlighted by default. An additional possibility is offered by the setting 'Boot Record of Selected Floppy Disk': if you have chosen not to scan the boot records of floppy disk drives here, but a floppy disk is highlighted in the drive list of the main window, the boot record of this disk will still be included in the scan.

Files

All Files (Alt+A)

If you have selected this menu option, all files on the relevant drives will be scanned, including non-executable files.

This setting should only be activated following the detection of a virus in order to carry out a thorough check on all your files, as it takes much longer. The 'Extensions' button cannot be selected when 'All Files' is activated.

Program and Macro Files (Alt+P)

If you have selected this function, only files with a specified extension will be scanned (e.g. *.BIN, *.COM, *.EXE, etc.). Default extensions are already given, and can be changed using the 'Extensions' button.

If this option is active and you have deleted all the entries from the file extension list, you will see the words 'NO EXTENSIONS' below the 'Extensions' button.

Extensions (Alt+E)

This command opens a dialog window containing all the file extensions to be checked during a scan in the ‘Program Files’ mode. The most common program file extensions are set by default.

Archives

PKLite-Compressed Files (Alt+L)

Executable programs can be packed in order to save storage space on a data medium. For this purpose, a small unpacker, e.g. PKLite, is placed in front of the application program and the latter is reduced in size by a compression technique. The compressed file can be up to 50% smaller than the original.

If the original program was infected by a virus before it was compressed, however, the virus will be 'packed' with it and usually remains fully executable when the compressed file is 'unpacked' on another computer. The virus is generally impossible to find in the packed file, as it is present in a strongly modified form.

If the setting 'PKLite-Compressed Files' is highlighted, AntiVir will pack the PKLite-compressed files and is then able to detect any virus infection. It is not possible to repair such files: in this case, you have to unpack the compressed files yourself, repair the relevant files and then re-compress the files.

Archived Files (Alt+V)

If this setting is highlighted, you can use AntiVir to scan files within archives.

If a packer program is infected (this is checked at the beginning of the scan), the relevant option is automatically deselected: the same applies if the packer is not found.

In the dialog window 'Options/Scan/Archives' (Alt+R) ), you can specify which archives you want to scan. You also need the packer program (e.g. ARJ.EXE, LZH.EXE) which was used to generate the archive in question. Finally, you need to have created a path to the directory containing the packer program (e.g. PATH=C:\PACKER;C:\REST in AUTOEXEC.BAT;). Once these conditions are fulfilled and you have activated this option, AntiVir will unpack the files from the archives, scan the unpacked files and then delete them again. Once again, AntiVir is unable to repair infected files within archives. In this case, you have to unpack the archive yourself, repair the relevant files and then create a new archive.

Memory

Begin Scan with Memory (Alt+M)

If this button is selected, the main memory of your computer will be examined for viruses at the beginning of each scan. This function should be active at all times in order to ensure maximum protection against viruses. If a virus is active in the memory, you will run the risk of infecting all scanned files. In this case, reboot your system from a virus-free, write-protected system disk.

Priority

high

In this case, AntiVir appropriates almost all the system resources for the scan, making it virtually impossible to use any other programs in the meantime.

medium

AntiVir is given medium priority (default setting): this means you can still use other programs during the scanning routine.

low

AntiVir is only assigned a small proportion of the system resources, so that it is easily possible to continue using other programs during the scan.

If you wish to continue working with another program while AntiVir is searching for viruses, we recommend that you select the low priority setting. This will release the processor much more frequently for the other application. If you want to conduct a scan without activating any other programs, choose the high priority setting for the sake of speed.

Omit Files

Information on the 'Omitted Files' button can be found here

This dialog window contains the following buttons:

Boot Records (Alt+O)

This button is only available when the setting 'All Boot Records' is active. When it is selected, the dialog window 'Boot Records' appears in which to specify the drive types whose boot records you want to check at the beginning of each scan.

Extensions (Alt+E)

The 'Extensions' button can only be selected when the 'Program Files' option is active. Clicking this button opens the dialog window 'File Extensions' in which to enter the extensions of the files you want to include in the scan.

OK

Transfers the data from this window and then closes it.

Cancel

Closes the dialog window without transferring the new settings.

Help

Displays this help text.


Options/Summary Report
Options/Report/Summary Report

See also:

This index card allows you to select the settings for the summary report. This report is used to record key data for each scan performed by AntiVir, so that you can follow the activities of AntiVir over an extended period. In this way, you can keep track of recent events in your system on the virus front - provided you have activated 'Generate Summary Report'.

Create Summary Report (Alt+C)

If this box is checked, the summary report will be written automatically.

Output File (Alt+O)

Here you can enter the filename under which the summary report data are be saved. AntiVir suggests the name 'AVWIN.ACT' by default.

Maximum Number of Entries (Alt+M)

This function allows you to influence the size of the output file. AntiVir only stores as many entries in the output file as are set here, the maximum number being 999. You can either enter the number of entries directly or change it using the arrows to the right of the input field. Clicking on one of these arrows causes the current value to be incremented by 1, or by 10 if you press the Ctrl button simultaneously.

This dialog window contains the following buttons:

OK

Transfers the data from the 'Summary Report' index card and closes the dialog window.

Cancel

Closes the dialog window without transferring the new settings.

Help

Displays this help text.


Partition Table Discrepancy

The partition table has been modified by a virus. As AntiVir cannot restore the partition table, you are invited here to create a new one.

Caution:  You may lose data during this process, so whatever you do, make a backup first!


Profiles

(AntiVir Professional only)

This index card enables you to group files, folders and drives into profiles and then save them in a list. These profiles can then be used for quicker, more specific virus scans, without having to go through all the other drives.

If you want to scan one of the existing profiles for viruses, all you have to do is open the list of profiles with the button  [image]  'Load Profile' and double-click on the relevant profile in the list (or highlight it and click on the 'Open' button).

The selection window is then closed and you can start a scan with the 'Scan' button or the 'F2' key.

As soon as you select the 'Profiles' index card, this function switches to edit mode. You can now open a window via the button 'Insert Folder'  [image]  in which to select the folder you wish to insert in the profile. By default, AntiVir will scan all subdirectories of the selected folder.

This button  [image]  can be used in the same way to insert individual files in the current profile.

Once you are in the list of existing profiles, you can switch to edit mode via this button  [image]  and then create a new profile as described above.

This button  [image]  can be used to delete highlighted folders or files from the 'Profiles' index card.

This button [image]  enables you to specify which file types you want to include in a scan.

This button [image]  enables you to specify whether you also want to scan the subdirectories of the selected folder.

This button  [image]  opens a window in which to save a new or edited profile.

Profile files can be identified from the extension *.PRO.

This button  [image]  opens a window in which to save a new profile as the default profile.

When you restart AntiVir, this default profile will be loaded into the index card automatically.

The button  [image]  'Create Link' enables you to create a desktop link for a particular profile.

Whenever you click this link on the desktop, AntiVir will start up and scan all files and folders of this profile.


Read Licence File

This menu option can be used to read the licence file HBEDV.KEY. AntiVir can transfer this licence file from all data media, e.g. floppy disks, CD-ROMs, hard disks, network drives, etc.

If no licence file is transferred, AntiVir will only run as a restricted demo version. The licence disk containing your individual licence file is supplied when you buy AntiVir or an update plan.

If you scroll to this menu option, the standard file selection window is opened. Select the licence file from the selection box or enter the drive, path and name of the licence (DRIVE:\PATH\HBEDV.KEY) directly in the 'Filename' box.

If the licence file is not found in the specified location, check to make sure it is in the right folder and correct your inputs in the 'Open' window if necessary.


ReadMe
Help/Read Me

See also:

In this file, you will find important information on each new version of AntiVir.

Due to the short intervals between updates, we are unfortunately unable to include all new features in the manual: these are therefore described in the READ.ME file. Should you have any problems or questions concerning AntiVir which the manual cannot answer, have a look in this file: in the majority of cases you will find the solution to your problem here.


Report

If you select this menu, the program AntiVir Report will be called. This tool is a file viewer which is normally used to load and display the AntiVir report file.

You can also use AntiVir Report to view .TXT or .LOG files.

These file types can also be opened with the drag&drop feature.

Further information can be found in the help file of AntiVir Report.


Report (Contents)

Here you will find all the functions relevant to the report file and summary report:

Display	Opens the main window of AntiVir Report containing the last report file created.

Settings	Opens the options window in which to select the settings for the report file.

Delete	Deletes the report file.

Print	Prints the report file.

Display Summary Report	Displays the summary report.

Summary Report Settings	Opens the Options window in which to select the settings for the summary report.

Delete Summary Report	Deletes the summary report.


Report/Delete

See also:

This function can be used to delete an existing report file.

If there is no report file available, the 'Report' button and all options relating to AntiVir Report except 'Report / Settings' are deactivated.


Report/Print

See also:

By selecting the menu option 'Print', you can print out the currently displayed file, which is normally the AntiVir report file.

If you have any problems with the printing procedure, you may need to set the printer using the 'Set Up Printer' function. The settings selected here only apply to AntiVir Report: they are not changed universally.

Information on how to install the printer can be found in your Windows documentation.


Returncode
Return Code (Error Level)

When you exit the program, AntiVir returns various codes (also known as error level).

0	Executed without errors.

1	Evaluation version is out of date and no longer executable.

2	Demo version is out of date and no longer executable.

3	AntiVir is out of date: this version cannot detect new viruses.

10	The virus scan was aborted by the user.

100	AntiVir may have discovered an unknown macro virus.

101	Self-test error. AntiVir may have been modified.

102	Viruses were found in a file.

103	Viruses were found in the boot record.

104	Viruses were found in the master boot record.

105	Viruses were found in the memory.


SA_DELETE_REPORT
Report/Display

Report/Settings

Report/Print


SA_EXTENSIONS
Options

Options/Scan

Options/Repair

Options/Macro Viruses

Options/Drag&Drop

Options/CRC Mode

Options/CRC Files

Options/Network Warnings

Options/Miscellaneous

Options/Password

Options/Save Settings

Options/Save Settings on Exit


SA_FILEVIRUS

Boot Record Virus

Partition Table Discrepancy


SA_NETWARNING
Options

Options/Scan

Options/Repair

Options/Macro Viruses

Options/Drag&Drop

Options/CRC Mode

Options/CRC Files

Options/Miscellaneous

Options/Password

Options/Save Settings

Options/Save Settings on Exit


SA_OPTIONEN_CRC
Options

Options/Scan

Options/Repair

Options/Macro Viruses

Options/Drag&Drop

Options/CRC Files

Options/Network Warnings

Options/Miscellaneous

Options/Password

Options/Save Settings

Options/Save Settings on Exit


SA_PRINT_REPORT
Report/Display

Report/Settings

Report/Delete


SA_READ_ME
Help/About


SA_REPORT_SETTINGS
Report/Display

Report/Print

Report/Delete


SA_SAVE_ON_EXIT
Tools

Tools/Scheduler

Tools/Virus List


SA_SAVE_SETTINGS
Options

Options/Scan

Options/Repair

Options/Macro Viruses

Options/Drag&Drop

Options/CRC Mode

Options/CRC Files

Options/Network Warnings

Options/Miscellaneous

Options/Password

Options/Save Settings on Exit


SA_SCHEDULER
Tools/Virus List


SA_SEARCH_BOOTRECORDS
Scan/Selected Directories

Scan/Directory

Scan/File


SA_SEARCH_DIRECTORIES
Scan/Boot Records


SA_SEARCH_FILES
Scan/Boot Records


SA_SEARCH_OPTIONS
Options

Options/Repair

Options/Macro Viruses

Options/Drag&Drop

Options/CRC Mode

Options/CRC Files

Options/Network Warnings

Options/Miscellaneous

Options/Password

Options/Save Settings

Options/Save Settings on Exit


SA_SELECTED_DRIVES
Scan/Directory

Scan/Boot Records


SA_SETTINGS
Options

Options/Scan

Options/Repair

Optionen/Macro Viruses

Options/Drag&Drop

Options/CRC Mode

Options/CRC Files

Options/Network Warnings

Options/Password

Options/Save Settings

Options/Save Settings on Exit


SA_SETTINGS_SHORT_REPORTS
Display Summary Report

Delete Summary Report


SA_SHORT_REPORT
Summary Report Settings

Delete Summary Report


SA_SHOW_REPORT
Report/Settings

Report/Delete

Report/Print


SA_VIRUSLIST
Tools

Tools/Scheduler


Save As Default Profile

(AntiVir Professional only)

This button  [image]  opens a window in which you can save a newly created profile as the default profile.

This default profile will be automatically loaded into the index card when you restart AntiVir.


Save Profile

(AntiVir Professional only)

This button  [image]  opens a window in which to save your new or modified profile.

Profile files can be identified from the extension *.PRO.

If you have made any changes in the 'Profiles' index card since the last save, you will be asked whether you wish to save them before closing the profile in question. Answer this query accordingly with 'Yes' or 'No'.


Save Settings

If you select this menu option, all current settings of AntiVir are saved manually at once in the AVWIN.INI file.


Save Settings on Exit

If this option is selected (identified by a tick in front of the text), all AntiVir settings will be saved automatically when you exit the program. If you make any changes when this function is not active, you will be asked whether you want to save these changes before exiting AntiVir.


Scan

In this menu, you can start the scan in the highlighted drives, select which items you want to scan and exit AntiVir.

The following functions are available:

Start Scan	Scans all drives highlighted in the main window.

Boot Records	Opens a dialog window in which to highlight the drives whose boot records you wish to scan.

Update Drive List	Updates the drive list displayed in the index card.

Exit AntiVir	Closes AntiVir for Windows.


Scan Options

Here you can select the options to

be used by AntiVir for the scan.

Further information on the wide range of

possible configurations can be obtained by

calling the help function of the relevant

index cards via the ‘Options’ window.


Scan/Boot Records

See also:

The selection window 'Drives' allows you to select the drives whose boot record you wish to test. The boot records of the highlighted drives will then be scanned for viruses when you click on the 'Scan' button. If one of the highlighted drives is a hard disk, the master boot records of all hard disks will also be scanned in addition.

The ‘Boot Record Test’ dialog window contains the following buttons:

Scan (Alt+S)

This button is active when at least one drive is highlighted. Clicking on this button will trigger an immediate scan for boot record viruses in the highlighted drives.

Close (Alt+C)

Closes this window and transfers the entries.

Report (Alt+R)

Clicking on this button enables you to view the report file on the last scan started from this window. This option is only activated once a scan has been initiated.

Help (Alt+H)

Displays this help text.


Scan/Update Drive List

If you select this menu option or press the function key (F5), the drive list in the 'Drives' index card will be updated.

You should activate this function if you connect or disconnect your workstation to/from a network drive while the main window of AntiVir is open. When you restart AntiVir, all accessible drives will be displayed in this list.


Scheduler
Tools/Scheduler

See also:

By selecting this menu option or clicking the corresponding button, you can load the AntiVir Scheduler, an autonomous program which allows you to start AntiVir at fixed times.

This way, you don't have to sit at your computer in order to scan huge hard disks - just tell the Scheduler to start AntiVir every Friday evening at 10 p.m., for example (provided your computer system is running and the Scheduler is activated at that time, of course).

You can also use the Scheduler to call messages at certain times or define the start time of other programs and utilities. This makes it an easy-to-operate tool for controlling regularly recurring routines.

For further information, please consult the AntiVir Scheduler help file.


Start Scan

If you click on this button,

AntiVir will start a scan.

This button is only active once you

have selected a drive, directory or

file.


Start Scheduler

This is where the AntiVir Scheduler is started. With this

program, you can specify the times when you want

AntiVir to start an automatic scan.

For further information, call the Scheduler help function.


Status

After completing each scan, AntiVir opens the 'Status' window, which contains a summary of the actions performed by AntiVir.

An exclamation mark on the right of the notepad indicates that a virus has been detected.

Below the line 'Result of Virus Scan', you are notified whether AntiVir terminated its scan normally or whether it was aborted by the user.

This is followed by a list containing the following entries:

Time Taken

Scanning time in mm:ss

Folders Scanned

Total number of scanned folders

Files Scanned

Total number of scanned files

Number of Warnings

Number of warnings issued

Number of Files Deleted

Total number of deleted files

Number of Viruses Removed

Number of repaired files

Viruses Found

Number of viruses found

The two buttons next to the display can be used to obtain further information on scans:

Report

Displays a detailed report on the scan

More Information on Report

Summary Report

Displays a brief summary of the events of all scans performed so far (or since the last deletion of the summary report)

More Information on Summary Report


Subdirectories

(AntiVir Professional only)

This button  [image]  enables you to specify whether you wish to scan the subdirectories of the selected folder in addition.

If you click on this button, the + next to the highlighted folder is replaced by a -

+ means:	scan subdirectories

- means: 	don’t scan subdirectories

By default, AntiVir scans all subdirectories of the selected folder.


Summary Report

See also:

This window tells you when your computer was scanned for viruses by AntiVir and what the results were. If a scan was aborted by the user, this is indicated by a (*)at the end of the line. If an entry is marked [image], this means that AntiVir was unable to find a virus in this scan. An entry marked [image] on the other hand means that a virus was detected. To obtain further information on a particular entry, highlight it and then select the 'Details' button. Alternatively, you can simply double-click on the entry.

This dialog window contains the following buttons:

Close (Alt+C)

Closes the window without transferring the changes.

Details (Alt+D)

Press this button to obtain further information on the highlighted entry.

Delete (Alt+L)

Deletes all entries in the summary report without any further prompting.

Help (Alt+H)

Displays this help text.

In the dialog window 'Options/Summary Report', you can also specify how many entries are to be stored. If the maximum number of entries is exceeded, the corresponding number of entries are deleted from the top of the list. Under ‘Output File’, you can specify the name of a file in which to store the summary report data. By default, AntiVir will suggest the name AVWIN.ACT.


Summary Report Details

This window contains the main information on a particular scan selected from the summary report.

After highlighting an entry in the 'Summary report' window, you can activate it with the 'Details' button or the key combination (Alt)+(D). Alternatively, you can simply double-click on the desired entry.

In addition to the date and time of the scan, this window tells you whether the scan was terminated normally or aborted by the user. The other information is the same as that displayed in the status window at the end of each scan.


Suspicious Macro Found

AntiVir has detected a suspicious macro in a document and you have specified under Options/Macro Viruses that AntiVir should ask you how to proceed in this case.

You can now choose between the following courses of action:

Delete This Macro

Causes AntiVir to delete the suspicious macro. If the macro is a virus or part of a virus, it will no longer be able to function.

Delete All Suspicious Macros

Causes all suspicious macros to be deleted from the document without prompting.

Attention: you may lose your own macros at the same time.

Delete All Macros

Causes all macros to be deleted from the document without prompting.

Attention: you may lose your own macros at the same time.

Don’t Delete Macro

In this case the suspicious macro is not deleted.

Caution: if this setting is activated, infected data will remain on your computer!

Skip This File

Causes AntiVir to quit editing the document.


Tools

AntiVir offers the following tools in this menu:

Save System Files                    (AntiVir Professional only)

This menu option opens a dialog window in which you can choose whether to save the boot record of drive C:, the system files from the root directory of drive C: and the contents of the CMOS in the directory 'SYSSAVE' under the installation directory of AVWin.

Scheduler	Starts the AntiVir Scheduler.

Virus List	Displays the names of all viruses known to AntiVir.

Virus Information	Calls a Windows help file containing information on viruses.

Intranet Update	(AntiVir Professional only)

                                               If you select this option, the Intranet Update Wizard will search the specified source directory immediately for more recent program files.

Load Licence File	(AntiVir Professional only)

                                               Reads the licence file in order to turn a demo version into a fully registered version.

Read VDF File	(AntiVir Professional only)

                                               Opens the standard file selection file, in this case in the installation folder of AVWin.


Tools/Save System Files

(AntiVir Professional only)

This dialog box enables you to save the system files, the boot record of drive C: and the CMOS. These data are saved in the directory 'SYSSAVE' under the AntiVir installation directory.

Boot Record of Drive C: (Alt+B)

Select this entry if you want to write the boot record of drive C: to the directory 'SYSSAVE' under the installation directory of AntiVir. The record is saved in the file 'BootRecC.DAT'.

System Files (Alt+Y)

If this option is selected, all system files from the root directory of drive C: will be written to the directory 'SYSSAVE' under the installation directory. The system files include all files with the system flag (except for swap files!). The following files are always copied, even if they do not have the system flag:

COMMAND.COM

IO.SYS

MSDOS.SYS

AUTOEXEC.BAT

CONFIG.SYS

CMOS (Alt+C)

The contents of the CMOS are saved in the directory 'SYSSAVE' under the installation directory of AntiVir.


Tools/Virus List

See also:

This function is used to list the names of all viruses known to AntiVir, and has a convenient integrated search function for virus names.

Partial String Search

Here you can enter a consecutive string of letters or characters via the keyboard. The cursor will then jump  to the first place in the name list where this sequence of characters occurs (e.g.: 'raxa' will find 'Abraxas').

Search From First Character of Virus Name

Here you can enter the initial letter and subsequent characters via the keyboard. The cursor then scrolls through the name list in alphabetical order (e.g.: 'Ra' will find 'Rabbit').

Search: (Alt+N)

Enter the name of a virus or a consecutive string of characters from a virus name. If this name or string exists, the cursor will jump to the corresponding place in the list.

You can use the buttons 'Search Forwards', 'Search Backwards' and 'First Match' to navigate your way through the list of virus names. To remove an entry from the ‘Find:’ list, use the button 'Delete Entry'.

Virus Name:

Under this heading you will find a list of virus names identifiable by AntiVir. Most of the viruses in this list can also be removed with AntiVir. The viruses are arranged in alphabetical order (with special characters and numbers at the top, followed by letters). To move up and down the list, use the scroll bar.

For information on current viruses, see Virus Information.

This dialog window contains the following buttons:

Search Forward (Alt+F)

Initiates a forward search in alphabetical order.

Search Backward (Alt+B)

Initiates a backward search in alphabetical order.

First Match (Alt+M)

Jumps back to the first entry found in the list.

Clean Input (Alt+I)

Removes the entry from the 'Find:' list box.

Close (Alt+C)

Closes the dialog window.

Help (Alt+H)

Displays this help text.


Update Wizard

(AntiVir Professional only)

In order to supply workstations in a network with updates, we have developed the Intranet Update Wizard (AVWUPD32.EXE). This function is only available with a multiple AntiVir licence (for 3 or more users).

If correctly configured, this tool will ensure that your workstation computer updates itself automatically with the latest versions of AntiVir. The Update Wizard is already entered in the RUN key of the Windows registry during the installation routine and will check a particular directory on a particular server for any new AntiVir programs or new virus signatures whenever it is logged onto the system.

Further information on how to install the Update Wizard can be found on the H+BEDV CD-ROM in the directory

/EN/PRODUCTS/WINxx/DISK_1\ADMIN\Admin.htm


Verifiably Clean DOS Disk

The 'verifiably clean DOS disk' can be used in an emergency to reconstruct your computer. This disk - you can use to if you need to - should contain all the programs and tools your computer needs to get it going again.

In order to create a 'verifiably clean DOS disk', your computer must be absolutely virus-free. If a virus has found its way onto your system at this stage, an infection will be very hard to detect, as this disk is always assumed to be completely clean.

To begin with, make a bootable operating system disk using the DOS command FORMAT. The parameter /u (= UNDELETE) is only available from DOS 5.0 onwards, in which case the system disk will not contain any information for salvaging the system data:

format a: /s /u

Once formatted, your disk is already bootable.

Now generate an AUTOEXEC.BAT and a CONFIG.SYS file on this disk. These files might look like this, for example:

CONFIG.SYS:

DEVICE=A:\HIMEM.SYS

FILES=40

BUFFERS=20

STACKS=9,256

SHELL=A:\COMMAND.COM /E:1024 /P

AUTOEXEC.BAT:

KEYB GR

If you need any other drivers in order to boot successfully, copy them to this disk too and modify CONFIG.SYS accordingly. Drivers are available for hard disk drives (SSTOR.SYS, HARDRIVE.SYS, DMDRV.BIN), floppy disk drives (IBM PS/2 - DASDRVS.SYS) or networks (please consult the manufacturer's instructions for the relevant call parameters). The keyboard driver may also have a different name. Please do not enter any programs or files in CONFIG.SYS which are loaded via a hard disk, i.e. do not use 'C:' etc.!

Be sure to include the drivers for your CD-ROM drive: these usually comprise a *.SYS driver supplied by the manufacturer for CONFIG.SYS and the MSCDEX.EXE of your DOS version for AUTOEXEC.BAT.

Then copy a few other important operating system programs to this disk, e.g.:

FDISK.*

COMP.*

KEYB.*

FORMAT.*

LABEL.*

HIMEM.*

SYS.*

DISKCOPY.*

DEBUG.*

XCOPY.*

Once again, you can add any other programs you want to hang on to.

Then copy the most important utilities to the disk. Essential utilities are your Backup program, its corresponding Restore program and - if available - the Norton Utilities. If you don't have enough space on your disk, you can store these programs on other resource disks which you know to be clean.

To complete your 'verifiably clean DOS disk', slide the write-protect tab to the 'open' position (on a 3½' disk) and keep the disk in a safe place (where you are likely to find it again!).


Virus Found

AntiVir has found a virus.

As a rule, there is no cause for alarm if AntiVir  or the AntiVir Guard finds a virus in an everyday situation: such viruses will be removed either with or without prompting depending on the AntiVir configuration (for details of the possible ways of handling infected files, see the description of the available options).

If AntiVir encounters an active virus in the memory during installation or on starting the program, you will be notified by a message which you can’t miss.

In this case, you are asked to boot from a write-protected system disk (either your 'verifiably clean DOS disk', a bootable Windows start disk or the bootable AntiVir CD-ROM).

Once you have been notified of a firmly suspected virus: do not carry out a warm start, e.g. with (Ctrl)+(Alt)+(Del) or a boot program, as some resident viruses can survive this. Make sure you only start programs from the emergency or system disks, as the programs on the hard disks may already be infected.

1.	Make a backup of the relevant data medium - a backup with a virus is better than no backup at all.

2.	Start your computer from the 'verifiably clean DOS disk'.

If you don't have a 'verifiably clean DOS disk', you can also use the original DOS installation disk, except that you won't be able to use certain system files and tools which could make life easier for you. Do not access the hard disk, as the *.COM, *.EXE and other executable files may already be infected.

The easiest (and usually most successful) way is to remove the virus with the program AVE32.EXE:

3.	Boot your computer system from a 'verifiably clean DOS disk' or the bootable AntiVir CD-ROM.

4.	The drivers for your CD-ROM drive (usually a *.SYS driver supplied by the manufacturer for CONFIG.SYS and the MSCDEX.EXE of your DOS version for AUTOEXEC.BAT) must be available and activated. If not, install these drivers now.

5.	Insert the H+BEDV CD-ROM in the CD-ROM drive and your licence disk containing the file HBEDV.KEY in the 3 ½' drive if you have not already done so.

6.	At DOS level, call the program AVE32 with the parameter /ALLHARD on the CD-ROM in the directory ANTIVIR\. The command line should look like this:
X:\...\ANTIVIR\AVE32.EXE /ALLHARD
The 'X:' stands for the letter of the CD-ROM drive containing the H+BEDV CD-ROM.

7.	Confirm this DOS command line with the 'Return' key.

Without any further inputs, AVE32 will now test all files in all subdirectories on all accessible drives including all boot records starting with drive A:. Any detected viruses will not be deleted in this mode. Abnormal events such as a corrupt file or a virus are reported in the report window of AVE32.

8.	If infected files are reported, you should carry out a repair routine with AVE32. using the parameter /e. Please note that any irreparable files will be deleted in the process. You should therefore make sure you don’t need these infected files first.

Once you have successfully completed this procedure, AntiVir can usually be installed or started without difficulty.

9.	Start a scan on all accessible drives by clicking the 'Scan' button.

If no more viruses were found in the memory but infected files were reported, we recommend that you check all program files of all available drives and data media for viruses. This is because some viruses don’t only spread on the current drive, but also infect other data media, especially floppy disks and exchangeable hard disks, as well as network drives.

10.	Check the report file to see whether all viruses were repaired or whether some files were irreparable.

11.	Once all files have been successfully repaired and the corrupt files deleted, your computer is virus-free. If you have not deleted corrupt files, the virus could be activated when you load the files in question (if they are still executable), and thus start spreading again. You should handle these files with extreme caution: we recommend that you delete them in any case and copy or install the files on the hard disk again from the original disks or a virus-free backup

If AntiVir for Windows still refuses to be installed or loaded, there is a second, more time-consuming way of solving virus problems via a temporary Windows version:

a)	Boot from a non-infected Windows start disk.

If you do not have a 'verifiably clean Windows disk', we recommend that you reinstall Windows in a temporary directory from the write-protected original disks - even if it means a lot of extra work.

Whatever you do, do not start Windows from the hard disk, as some Windows files may already be infected. If you do not have a 'verifiably clean Windows disk', we recommend that you reinstall Windows in a temporary directory from the write-protected original disks - even if it means a lot of extra work.

b)	Create a temporary directory (e.g. TEMPWIN) and copy all the files from the 'verifiably clean Windows disk' to this directory, taking care to maintain the directory structure.

d)	Start Windows from this directory.

e)	Make sure you only start the programs and tools from this directory. All other programs on the drive may already be infected.

f)	Reinstall AntiVir from the original disks.

g)	When asked whether you want your hard disk to be scanned for viruses, answer 'Yes'.

h)	Once it has been successfully installed, load AntiVir.

i)	Under the menu item 'Options / Repair', you can choose whether or not to confirm the repair procedure for each infected file.

k)	Start a scan by clicking the 'Scan' button

If no viruses were found in the memory but infected files were reported, we recommend that you check all program files of all available drives and data media for viruses. This is because some viruses don’t only spread on the current drive, but also infect other data media, especially floppy disks and exchangeable hard disks, as well as network drives.

l)	Check the report file to find out whether all files were repaired or whether some were deemed irreparable.

Once all files have been successfully repaired and the corrupt files deleted, your computer is free of viruses. If you have not deleted corrupt files, the virus could be activated when you load the files in question (if they are still executable), and thus start spreading again. You should handle these files with extreme caution: we recommend that you delete them in any case and copy or install the files on the hard disk again from the original disks or a virus-free backup.

See also 'First Aid'

AntiVir distinguishes between the following:

File Virus

Boot Record Virus

Partition Table Discrepancy


Virus Information

The following section provides information on two viruses which have caused recent uproar, namely

the ExploreZip virus and the CIH virus.

Detecting the ExploreZip virus with AntiVir

General information:

	W32/ExploreZip (listed under  Tr.ExploreZip.Worm in our products)
Alias:	Worm.Explore.Zip Zipped Files Troj.Explore.Zip
Characteristics:	Trojan horse, worm
Text string:	zipped_files
Length:	210432 bytes
Platform:	Windows 9x/Windows NT

W32/ExploreZip is spread via email on Windows 9x and Windows NT computer systems. Email programs at risk include any email client with MAPI capability, e.g.:

MS Outlook
NetScape Mail
MS Exchange
Outlook Express

In the active state, it spreads via MAPI commands by sending itself as an attachment with the name 'zipped_files.exe'. Unlike Melissa, W32/ExploreZip sends itself automatically to the addresses of unanswered mail in the inbox. Melissa, on the other hand, sent copies of itself to up to 50 recipients from the address book.

This trick makes the email look perfectly harmless to the recipient - a normal reply to a message sent to a known recipient.

An infected email looks like this:

From: [name of email sender]
Subject: re:[subject of unanswered message]
To: [name of email recipient]

Hi [name of email recipient] !

I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs.

Bye or sincerely
[Name of email sender]

Attachment: zipped_files.exe

By then, however, the virus is already active and 'at work'. It copies itself either under the name 'Explore.exe' or '_setup.exe' to the respective system directory, i.e. %windir%\System (normally c:\windows\system) under Windows 9x or %windir%\System32 (normally c:\winnt\system32) under Windows NT.

It then modifies the WIN.INI file under Windows 9x or the registry under Windows NT. By modifying the INI file or registry, the virus ensures that it will be reloaded every time you boot the system. That way it can answer new incoming mail too.

The damage routine of the virus is multi-threading, i.e. it generates two 'killer threads'. One of these threads is responsible for 'email handling' and the other for ‘emptying’ files. The first thread monitors new incoming mails via MAPI. This enables it to 'answer' incoming emails immediately with itself. Existing unread messages are also answered immediately.

A second thread 'empties' files with the extensions '.doc, .c, .cpp, .h, .asm, .xls and .ppt'. 'Emptying' means shortening the files to 0 bytes via the Windows function 'Create File'. This means that files are not deleted, nor can they be restored via the recycling bin. They cannot be restored, however, because their contents have been lost.

Increased hard disk activity is a sign that files are being emptied. However, the virus also empties files which are available via 'mapped' drives up to the drive letter ‘Z:’ which are used as network drives (WnetEnumResource).

The damage routine of the virus remains active as long as the virus itself remains in the memory.

The virus can be removed quite easily, however, by deleting the infected files and modifying WIN.INI or the registry.

Removing the autostart entries under Windows 9x:

These can be removed from WIN.INI (via SysEdit) by deleting the following line:

run=C:\WINDOWS\SYSTEM\Explore.exe
(run=%windir%\SYSTEM\Explore.exe)

or

run=C:\WINDOWS\SYSTEM\_setup.exe
(run=%windir\SYSTEM\_setup.exe)

Removing the autostart entries under Windows NT:

Remove a key from the following registry path (via RegEdit):

HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows

Delete the following entry under \Run:

run=C:\\WINNT\\SYSTEM32\\Explore.exe
(run=%windir%\\SYSTEM32\\Explore.exe)

or

run=C:\\WINNT\\SYSTEM32\\_setup.exe
(run=%windir%\\SYSTEM32\\_setup.exe

Removing the infected file under Windows 9x:

After a restart or 'zapping' of the virus via the Task Manager, the virus itself should be deleted. The file can be found under the name 'Explore.exe' or '_setup.exe' under:

c:\windows\system\Explore.exe

or

c:\windows\system\_setup.exe

Removing the infected file under Windows NT:

The paths for Windows NT are (after restart or 'zapping'):

c:\winnt\system32\Explore.exe

or

c:\winnt\system32\_setup.exe

The danger of emails with unknown file attachments cannot be stressed enough, therefore. It is also rather unusual for documents to be sent with self-extracting .EXE files. Users should check all files of their computer system with suitable antivirus programs once in a while purely as a precautionary measure. That way the temporary files of the various email programs will also be checked and any viruses they may contain detected.

Again, the aggressive destructive part of this virus clearly shows how a systematic assignment of rights within networks can limit the damage inflicted.

General information on the W95/CIH virus:

Name:	W95/CIH
Alias:	PE_CIH, CIH
Characteristics:	Resident, PE infector (Windows-EXE)
Text string:	Version 1.2	CIH v1.2 TTIT
	Version 1.3	CIH v1.3 TTIT
	Version 1.4	CIH v1.4 TATUNG
Length:	Version 1.2	1003 bytes
	Version 1.3	1010 bytes
	Version 1.4	1019 bytes
Platform:	Windows 95/Windows 98

W95/CIH is a resident virus which attacks Windows programs (PE files). It infects PE files in such a way that the length of infected files remains unchanged. By using its knowledge of unused areas within these PE files, it is able to divide itself into several parts. W95/CIH contains the following destructive damage routines: overwriting of the BIOS in the flash ROM and overwriting all hard disks.

This virus has been an increased incidence of this virus recently in Germany. H+BEDV already provided an effective and powerful detector with version 5.13.1. From version 5.13.2, however, it is also possible to repair this virus. For this purpose, AntiVir does not follow the usual course of simply deactivating the load function of the virus ('butcher’s knife method'), but repairs the file using the more subtle 'scalpel method'. Since W95/CIH divides itself into several parts when infecting a file and spreads these over different sections of the file, all the sections modified by the virus have to be treated separately by the repair routine. That way AntiVir does not run the risk of leaving parts of the virus intact.

Many other antivirus programs simply overwrite the installation routine of the virus or 'repair' it solely by correcting the program entry. This means that other parts of the virus in the (still infected) file remain in executable form. In other words, the damage routines are still present in the file and may still be capable of uncontrolled execution (e.g. due to a program crash, an error in the host program, a double infection, etc.).

Since AntiVir knows the exact structure of both the virus and the PE files, it is able to carry out quality repairs. AntiVir removes the individual parts of the virus in the various sections and restores the internal management information of each section. That way the programs are safe to use again after having been repaired by AntiVir.

The damage routines of the virus vary from one version to the next. Version 1.2 attempts to overwrite the BIOS in the flash ROM on 26 April and version 1.3 on 26 June of a particular year. Version 1.4, which is currently the most widespread, appears to be a refinement of previous versions, and attempts to overwrite the BIOS in the flash ROM on the 26th of every month. Common to all versions is their additional habit of overwriting all hard disks on the relevant trigger date by direct access. This is likely to render most emergency disks worthless unless a full backup is available in addition!


Virus Types

There are various 'species' of virus which can be broken down in turn into 'sub-species'. The definitions given here correspond to those in Martin Rösler’s German virus FAQs (Frequently Asked Questions):

Trojan horses

A Trojan horse or Trojan is a program which purports to have a useful function, but, once loaded, reveals its true self and begins its (usually) destructive work. Trojans differ from viruses and worms in that they cannot duplicate themselves. Most Trojans are programs with either an inconspicuous or an intriguing name (STARTME.EXE or SEX.EXE), which are activated immediately on execution and may format the hard disk or mix up data, for example. There is also a special kind of Trojan called a dropper: this implants viruses and is thus itself a ‘victim’ which infects the computer when the Trojan is called, thereby causing a snowball effect.

Logic bombs

Strictly speaking,a  logic bomb (or bomb for short) is a special kind of Trojan horse. Bombs are program sections which are embedded in useful code and which consist of a trigger and a payload. The destructive functions of such bombs lie dormant for a certain period of time. However, when a trigger condition is eventually fulfilled (e.g. after reaching a certain date or loading the program fifty times), the bomb 'explodes' and begins its destructive work.

A special case is the so-called ANSI bomb which redefines the keyboard configuration via the ANSI.SYS driver.

Viruses

A computer virus is a program with the ability to ‘attach‘ itself automatically in some way to other programs when loaded, thus infecting those programs. Viruses are self-reproducing, a feature which distinguishes them from Trojans and bombs. They do not necessarily have to contain destructive program elements, however. A computer virus essentially requires a foreign code (host code), the sequence of which it alters by infecting it. The hosts serve merely as a vehicle, i.e. the sequence of the host code is not changed.

Worms

The term ‘worm’ has two meanings. The first definition is: ‘Program which duplicates itself within networks and steals processing time‘. This occurs on networked mainframes, for example, as a result of process bifurcation.

The second definition is: ‘A worm is a program which duplicates itself but does not infect any host codes‘. An example would be a program called WURM.COM containing commands telling it to copy itself to all available drives in the active folder. Worms cannot therefore become part of other program sequences and only constitute a hazard if they generate their own task within multitasking systems and are able to trigger themselves as part of this task. Otherwise a worm can only be spread by human intervention when started by the user.

Joke programs

Joke programs are designed purely to give someone a fright or for general amusement: they are not harmful and cannot duplicate themselves. When a joke program is loaded, the computer usually begins at some point to play a tune or display something out of the ordinary on the screen. Examples of joke programs are the washing machine in the disk drive (DRAIN.COM) and the screen eater (BUGSRES.COM).

But beware! All symptoms of joke programs may also stem from a virus or Trojan. At the very least, they give the user quite a shock or throw him into such a panic that he may cause real damage to the computer himself.

For further information on this topic, see the brief glossary of viruses in the installation manual.


Virus scans

These are performed by searching for a specific signature, which is like the 'fingerprint' of a virus.

By using a database of virus codes (comparable to a criminal file), AntiVir is able to identify this signature. In this way, the virus can be detected and rendered harmless, and infected files can be repaired.

You can scan in various ways:

−	by clicking on the 'Scan' button

−	via the menu bar 'Scan / Selected Directories'

−	via the key combination (Alt+S / M)

−	via the function key (F2)

−	via the drag & drop function

−	via the shell extension (right mouse key)

The scanning screen of AntiVir, Luke Filewalker, is then displayed and checks the files in the selected areas.

This screen tells you the names of the last viruses to have been detected, the number of files scanned so far, the time taken, the number of viruses detected and the number of files repaired and deleted. The name and path of the file currently being scanned are also displayed, together with the current status (e.g. testing memory, testing boot record, scanning, unpacking, repairing).

If the box ‘Allow Stopping’ is checked in the menu 'Options / Miscellaneous', you can interrupt the scan via the 'Stop' button.


Options/Network Warnings (NT)

(AntiVir Professional only)