U.S. Robotics Connections 2

home *** CD-ROM | disk | FTP | other *** search

/ U.S. Robotics Connections 2 / US Robotics Connections.iso / pc / sourcepc / iris / 31 / readme.txt < prev next >

Wrap

Text File | 1996-01-14 | 22.0 KB | 572 lines

AntiVirus Plus IRIS Software & Computers, Ltd. For assistance with AntiVirus Plus please contact the Iris hotline at: (717) 258-8361 1 Introduction 1.1 What is "AntiVirus Plus"? "AntiVirus Plus" is a powerful protection tool that will stop electronic viruses from damaging your computer system. IRIS software has designed " AntiVirus Plus " to stay in the background, automatically detect viruses and remove them from executable and opened files. You can also scan your disk or diskettes when desired. By using interactive dialogues, you provide the guidelines for dealing with a virus. AntiVirus Plus can remove viruses from files and boot sectors, and reconstruct your system after infection. It can also prevent further infiltration, and monitor suspicious changes in your system at every boot. 1.2 AntiVirus Plus Modules The " AntiVirus Plus " package is made up of four basic components. The first one is the installation utility. The main program has three parts. Together, these three modules will help you maintain a healthy computer system. 1.2.1 CURE - Detection, Removal, Reconstruction The CURE module literally "cures" your system of viruses. It scans through your system, finds viruses, removes them and reconstructs any damaged files. CURE detects the presence of most viruses anywhere in your computer, and usually repairs the damage instantly. You are able to decide how you wish to deal with a virus on the event of finding one. You can also redefine parameters which will be activated automatically during the scan. You can run this program at any time to cure the specified medium (the whole disk, one or more directories, or the floppy disks). There are two versions of CURE at your disposal; a Windows version called WCURE and the non-Windows version. An installation under Windows will automatically install both versions on your hard disk, while a DOS installation will install only the non-Windows version. 1.2.2 IMMUNE Memory Watchdog The IMMUNE module guards against viral penetration into your computer's memory. IMMUNE is a TSR, which means that it is automatically loaded at boot time, and remains active as long as your computer is in use. Every time you run a program (either from your hard drive, or from a floppy disk) or open a file, IMMUNE will examine the program code before it is loaded into your system memory. IMMUNE can recognise the unique signatures of thousands of viruses, and will stop any known virus before it can become active. PREVENT, which is an extension of IMMUNE, attempts to detect unknown viruses by attracting potential virus action to itself. 1.2.3 EXAMINE System Integrity The EXAMINE module inspects vital areas of your disk to ensure that no unwanted changes were made to your hard drive. At every boot, important information on your disk (the COMMAND.COM file, the system files, the disk's partition sector and the disk's boot sector) are compared with special signature files that were created during the installation process. Any discrepancy between the signature files and the current contents of your disk's system area will generate a warning. In cases when system integrity is violated, EXAMINE will rebuild your disk from the information stored in the signature files. If your disk is totally damaged by viral activity, the files saved on the rescue diskette will be used to restore your system. 2 Installation - SETUP Installing AntiVirus Plus under Windows will automatically install both the Windows version and the DOS version on your hard disk, while a DOS installation is effective only for DOS, as it installs only the non-Windows version. 2.1 What do you need to Install AntiVirus Plus? AntiVirus Plus requires the following system configuration: Hardware: IBM-PC or Compatible Operating System: DOS 3.0 or higher Windows 3.1 or higher In order to use the EXAMINE and IMMUNE modules, a hard drive is required. In addition, the SETUP program will ask you for a diskette in order to create a copy of your hard-drive's system area. 2.2 What Happens During Installation? In order to use the AntiVirus Plus package, you need to install the software on your hard-drive. Although this process is quick and straightforward, several important measures are taken durng installation to protect your computer. 1. The SETUP program thoroughly scans your computer BEFORE the AntiVirus Plus software is installed on your hard-drive. If a virus is found, consult the user manual or on-line help on the choices available to you. When this process is done, the AntiVirus Plus software is installed on a totally virus-free computer system. 2. The SETUP program copies all files that are necessary to run AntiVirus Plus into a special sub-directory on your hard-drive. The new sub- directory, (which is called ANTVIRUS by default, but you may change that), will be created automatically, if it does not already exist. 3. Your system's boot file (AUTOEXEC.BAT) will be modified if you wish, so that the AntiVirus Plus Modules IMMUNE and EXAyMINE are loaded automatically every time you turn on your computer. 4. AntiVirus Plus creates "signature files" which contain backups of all the system files and other sensitive system information that is normally stored on your hard drive. The EXAMINE module uses these signature files to verify that no suspicious changes were made in your hard-drive's system area. 5. The signature files will also be stored on a special "Rescue Diskette", if you desire. The information on this diskette will help AntiVirus Plus reconstruct your hard-drive in the event that a virus severely corrupts the system information. If you want to create the Rescue Diskette, you will need an extra diskette ready when you run the SETUP program. After SETUP copies the signature information to the diskette, please be sure to label, write - protect and save the diskette, so you would be able to use it when necessary. 2.3 First Time Installation The AntiVirus Plus SETUP program makes the installation of AntiVirus Plus quick and easy. Installation will normally be a one-time process. To Install AntiVirus Plus on a computer with a hard-drive: 1. Make sure you have an extra diskette ready (if you want to make the rescue diskette). 2. Verify that your original AntiVirus Plus diskette is in the appropriate Drive. 3. At the DOS prompt or in the Windows run dialogue, type: A:\SETUP <ENTER> or B:\SETUP <ENTER> 4. Wait for the Install AntiVirus Plus opening screen. You can move with the arrow keys horizontally and vertically, or use the <TAB> key to move between menu items, and the <ENTER> key to make a selection. In order to place a checkmark in checkboxes, use the <Spacebar> key. If your computer is equipped with a mouse or other pointing device, you can also click on a menu item to make a selection. 5. Choose Install AntiVirus Plus from the menu. The other options are UnInstall, Help and Exit. Once you have chosen Install, a series of dialogues will guide you through the installation process. You will have three options: to install a full copy of AntiVirus Plus, a Network Station version or a Custom version. You can also install AntiVirus Plus on the Server using the Windows version. The Custom version enables you to define parameters that controll the way the SETUP program and the AntiVirus Plus itself function. 6. Specify the drive and sub-directory on which you would like to install AntiVirus Plus (C:\ANTVIRUS is the default). SETUP will then check the source and destination drives. When this is done, SETUP will copy the AntiVirus Plus software, in the version you have chosen, to this sub-directory. (if the directory you have chosen does not exist, AntiVirus Plus will create it for you). 7. Follow the Install AntiVirus Plus on-screen instructions to complete the installation. SETUP will prompt you to provide a diskette in order to create a "rescue diskette" containing a backup of your hard-drive's system area. This diskette is not essential to the running of AntiVirus Plus, but it is recommended. SETUP will check with you before modifying your hard-drive's AUTOEXEC.BAT file. If no AUTOEXEC.BAT file exists on the current drive, SETUP will create a new file for you. AntiVirus Plus needs to insert commands into the AUTOEXEC.BAT file so that your computer activates the IMMUNE and EXAMINE modules every time you boot up. NOTE: If you choose not to update your AUTOEXEC.BAT, you will have to manually load the AntiVirus Plus memory-resident modules to enjoy the full benefits of the AntiVirus Plus package (see Section 3.1, 3.3) If the Installation was completed successfully, you will receive the "Installation Successful" message. If you receive a "Partially Successful" message, you may have to reinstall AntiVirus Plus. 8. Choose "Exit" from the main menu to leave the SETUP program. 2.4 Special Instructions for Network Installation 2.4.1 Single Station Installation Please follow the following instructions to install AntiVirus Plus on an individual station connected to a network. 2.4.1.1 Network Stations with a Hard Drive Important: the installation of AntiVirus Plus will be fully capacitated provided that you are - or authorized by - a Network Administrator. Installing AntiVirus Plus on a network station from the server is similar to installing a full version from a diskette, except that the SETUP program is run from the Server drive on which AntiVirus Plus is installed. In addition, many files which can be run from the server will not be installed on your hard drive. The IMMUNE and EXAMINE modules will be installed on your hard drive. The AUTOEXEC.BAT file will be updated so that the AntiVirus Plus server facilities will be available to you and IMMUNE and EXAMINE will also be activated every time your computer boots. 2.5 Removing AntiVirus Plus To remove the AntiVirus Plus Program: 1. Insert your original AntiVirus Plus diskette in the appropriate drive 2. Run the SETUP program by typing: A:\SETUP <ENTER> or B:\SETUP <ENTER> 3. Choose "UnInstall AntiVirus Plus...." from the main menu. If you receive the "Successfully UnInstalled" message, then AntiVirus Plus is no longer installed on your hard drive. However, if you receive the "partially UnInstalled" message, you should try again. 4. Choose "Exit" to leave the SETUP program. 2.6 Reconstructing Bad Boot/Partition Sectors 2.6.1 When Will You Need the Rescue diskette? The Boot and Partition Sectors of your hard drive contain important information about the organization of the data on your disk. Should the information in these areas of the disk become corrupted (either through viral activity, or through physical damage), the hard drive will not function properly. Commonly, you will find that your computer cannot boot from the hard drive, or that the computer does not "recognise" the hard drive. In such cases, it is necessary to rebuild the information in the Boot and Partition sections from the rescue diskette which AntiVirus Plus has created during installation. 2.6.2 Using the Rescue diskette The regular installation procedure puts files on the Rescue diskette. These files contain the boot and partition sector signatures of your hard disk. 1. It is recommended to use this option after booting from a clean, write-protected, original DOS system diskette. Run the RESCUE program from the Rescue diskette with one of these two commands: A:\RESCUE<ENTER> or B:\RESCUE<ENTER> 3. A series of dialogues will guide you through the reconstruction of your disk. 3 Using AntiVirus Plus 3.1 Loading IMMUNE Normal installation of AntiVirus Plus on your hard drive enssures that the IMMUNE module is activated automatically when the computer is turned on. However, if your AUTOEXEC.BAT file has not been set to load IMMUNE, you will need to manually load the module into memory. To load the IMMUNE module: 1. Make sure that the active drive is correct, and that the current directory contains the AntiVirus Plus files. 2. Load the module by typing: IMMUNE<enter> 3. There are many options to the IMMUNE command. These can be found by typing: IMMUNE /h<enter> 3.2 Virus Detection with IMMUNE 3.2.1 How Will You Know that Your Computer is Infected? When a program infected with a known virus attempts to load itself into memory, the IMMUNE module will be alerted. IMMUNE will immediately warn you of the attempted infiltration. A dialogue box will pop up on your screen with a message warning of viral infection. This means that the program you are currently running was infected with a virus which attempted to enter system memory, and IMMUNE successfully prevented the infected program from running. 3.2.2 What Should You Do if You Are Running an Infected Program? If you see the IMMUNE warning box appear when you run a particular program, it is likely that the program is infected with a computer virus. Although IMMUNE prevents the virus from entering memory and causing damage, it cannot remove it from the infected diskette or disk which carried the virus. To eradicate the viral code from the infected diskette or disk, you need to run CURE (or WCURE) on the infected medium (see Section 3.5). 3.3 Running EXAMINE EXAMINE is run automatically every time you boot your computer. However, if you did not allow the Install program to modify your AUTOEXEC.BAT file, you would have to run EXAMINE manually. To load EXAMINE: 1. Make sure that the active drive is the one where AntiVirus Plus was installed, and that the current directory contains all the AntiVirus Plus files. 2. load the module by typing: EXAMINE<enter> 3. There are many options to the EXAMINE command. These can be found by typing: EXAMINE /h<enter>. 3.4 Maintaining System Integrity with EXAMINE The EXAMINE module checks the integrity of your system information against the backup data stored in the special signature files that were created during the installation process. An EXAMINE warning box will appear on your screen, should any discrepancies be discovered. The warning reports inform you what area of the system has been affected, and prompts you for one of three courses of action: Restore: Asking EXAMINE to Restore will update your system area with the backup information stored in the signature files. This removes any damage a virus may have done to your hard drive. This option must be used with care as the signature files must be up to date. Accept: You may choose to accept the new state of your system area as correct. This will update the signature files with the new information from your hard drive. Use the Accept option if you have recently performed some operation which legitimately changes the hard drive system area; e.g., installing a new version of DOS. Remember that if you update your signature files, your signature disk should also be updated. Ignore: Choose Ignore if you do note want EXAMINE to take action at this point. 3.5 Using AntiVirus Plus Cure for DOS or AntiVirus Plus Cure for Windows The cure module detects viruses, removes them from your files, and reconstructs damaged files. 3.5.1 When to Use CURE You can use the CURE program any time you want, to ensure that a specific diskette or hard drive partition is virus free. We recommend that you run CURE periodically, as well as whenever you obtain new software or add new files to your hard drive. You should always run CURE after a viral infection has been detected by IMMUNE. 3.5.2 Starting CURE 1. Make sure the current directory contains the AntiVirus Plus software. 2. Run the CURE module by typing: CURE <ENTER> There is also a CURE interface for the Windows environment called WCURE. If you use Windows this version of CURE is available to you. When you first load Windows after installing AntiVirus Plus you are given the opportunity to have an "IRIS AntiVirus" group created with the WCURE and WIMMUNE icons. Once these are created, all you have to do is click on the relevant program icon. 3.5.3 Scan your disk or diskettes using the CURE graphic interface. If it is not possible to remove a virus from a file, you have the option to save a sample of the infected file for further investigation. 3.5.4 Using CURE with Command Line Arguments The CURE module can also be run non-interactively. This is useful for including CURE in a batch file. To run CURE in batch mode, you must specify command line arguments. The CURE COMMAND LIN syntax is as follows: CURE path [ optional parameters ] CURE path [/K | /I | /D| /RE] [/C] [/B] [/F] [/T | /R] [/A | /S] [/P] [/L] [/N] Only one parameter from each group can be used simultaneously. Example: C:\ Cure C: /d /c /r Command Line Parameters: /? or /h Display this HELP screen. /asK Ask user how to handle the virus /Ignore Report viruses and continue /Delete Delete the infected object /Remove Remove the virus /Copy Copy samples to a directory /Boot Scan boot sectors /Files Scan files /fasT Fast scan /secuRe Secure scan /All Scan all files /Specific Scan specific files /Print Print a report to the printer /resuLts Print a report to a file /Nomem Do not scan memory for viruses For example: CURE D:\DOS /A /L Scan for all files for the DOS directory on drive D. Any viruses found will be logged in a report file. 3.6 WIMMUNE - Active Monitor for Windows. WIMMUNE Active Monitor starts whenever you open a Windows session, and runs in background mode. WIMMUNE remains on guard to protect your system while in Windows session, just as the IMMUNE protects DOS sessions; it also protects DOS applications under Windows. WIMMUNE intercepts the reports that the various modules generate when they detect virus activity. Then, the WIMMUNE generates a Windows pop-up dialogue box over whatever application you are running at the current time, and displays a warning that a virus has been discovered. You may either TERMINATE, or CANCEL the Active Monitor: if TERMINATE is chosen, the WIMMUNE will cease to be active. If CANCEL is chosen, the Active Monitor will only be minimized and retain its activity in a background mode. The Active Monitor also enables you to choose between ENABLE or DISABLE the monitor, by clicking the button at the bottom of the screen. ................Copyright (c) IRIS Software & Computers, Ltd.