home *** CD-ROM | disk | FTP | other *** search
- FILE SHIELD Version 1.5
-
- Copyright 1990 McAfee Associates
- All Rights Reserved
-
-
- This product may not be used in a business, corporate,
- government or agency environment without a negotiated site license.
-
- For licensing information, contact:
-
- McAfee Associates
- 4423 Cheeney Street
- Santa Clara, CA 95054
-
- 408 988 3832 (Voice)
- 408 970 9727 (FAX)
- 408 988 4004 (BBS)
-
- Notes on Version 1.5:
- Version 1.5 of FSHIELD fixes a bug that causes conflicts with
- Versions 67 and above of VSHIELD. If VSHIELD Versions 67 and above
- are used in /CV mode, then FSHIELD Versions 1.4 and below will not
- be allowed to run.
-
- Executable Program (FSHIELD.EXE):
- FSHIELD is packaged with a VALIDATE program that will
- authenticate the integrity of FSHIELD.EXE. Refer to the
- VALIDATE.DOC instructions for the use of the validation program.
- The validation results for V1.4 should be:
- SIZE: 61,370
- DATE: 10-08-1990
- FILE AUTHENTICATION:
- Check Method 1 - 8A30
- Check Method 2 - 135C
-
- You may also call the McAfee Associates bulletin board at 408
- 988 4004 to obtain on-line FSHIELD.EXE verification data. The
- VALIDATE program distributed with FSHIELD may be used to
- authenticate all future versions of FSHIELD.
-
-
- OVERVIEW:
-
- FILE SHIELD has been designed primarily for software
- manufacturers, publishers, developers and distributors. It shields
- executable files so that virus infections are instantly detected
- and automatically removed by the shield. Programs shielded in this
- manner will not remain infected and will not continue to propagate
- an infection. This protects the software manufacturer against
- possible legal or liability questions when the software is
- introduced into an already infected site. Infected users are
- frequently confused about the origin of an infection and it is
- difficult, if not impossible, do determine whether a specific
- program has infected a system, or whether the already infected
- system had infected the program in question. Shielded programs
- will not carry an infection and will provide greater assurance to
- the user that the program was not the source of the infection.
- FILE SHIELD may, of course, also be used by end users. But
- it is not recommended as a global system protector. It is fine for
- shielding your most frequently used programs or those programs
- which would be difficult or costly to replace in the event of an
- infection, but it is limited to protecting executable files. Boot
- sector and partition table viruses do not infect executable files
- and you would still be vulnerable to these infections. For global
- system protection please use VSHIELD. This program is available
- on most bulletin boards, or contact McAfee Associates at the above
- address.
-
- Notes on Version 1.3
- Version 1.3 fixes a number of bugs existing in 1.2. The major
- bug in version 1.2 involved removing the shield from COM files
- whose length was a multiple of 16 bytes. If the shield was removed
- from such a file, the original file length was incorrectly
- calculated. Other bugs included difficult to read displays on a
- monochrome monitor, lack of a warning message for shielding
- COMMAND.COM and incompatibilities with some memory resident
- programs. All have been fixed in version 1.3.
-
- USING FILE SHIELD:
-
- To run FILE SHIELD simply type:
-
- FSHIELD
-
- A menu screen will appear with the following menu options:
-
-
- INSTALL REMOVE OPTIONS EXIT
-
-
- If you wish to install FILE SHIELD on a selected program or
- collection of programs, select the INSTALL option.
-
- NOTE: FILE SHIELD may only be used to shield programs with
- COM or EXE extensions.
-
- After selecting INSTALL, a window will open at the bottom of
- the screen. Input the name of the drive, directory or file that
- you want to specify for installation. If a drive or subdirectory
- is selected with no file name specified, then FILE SHIELD will
- search the entire drive or subdirectory for all COM and EXE files
- and prompt you at each file to ask if you wish to install the
- Shield. Respond YES if you wish to shield the particular file.
- FILE SHIELD will shield the selected programs and, in each
- instance, will display a window indicating the name of the file
- shielded, the original size, and the size after application of the
- shield. FILE SHIELD will add between 1500 bytes to 6,000 bytes to
- each shielded file. The average should be 2,000 bytes.
-
- To remove a shield from a file select the REMOVE option from
- the main menu. A window will open at the bottom of the screen.
- Input the file specification for the file or group of files that
- you wish to un-shield. FILE SHIELD will prompt you to ask if you
- are sure that you want to un-shield the file. Respond YES if you
- wish to proceed.
-
- The OPTIONS selection allows you to set automatic mode. In
- automatic mode, FILE SHIELD searches the disk or directory
- specified for COM and EXE files and shields them without prompting
- the user at each file. If you do not want to shield all of the
- files in your specified path, then do not use this option. The
- default option is NO. You may also choose to backup shielded files
- prior to shielding and set automatic subdirectory searching by
- choosing the appropriate option in the OPTIONS menu.
-
- To leave FILE SHIELD, select EXIT.
-
-
- NOTE: FILE SHIELD will not attempt to shield any EXE file that
- uses internal overlays. These files contain a length
- field in the header record that does not match the
- DOS specified file size. Such programs cannot be
- shielded. FILE SHIELD will display an error message if
- an attempt is made to shield this type of program.
-
-
- OPERATION OF THE SHIELD:
- Once a program has been shielded, it will monitor itself for
- infection each time it is loaded. If a virus attaches to the
- program, the shield will pause execution, inform the user of the
- virus condition, and offer the following options:
-
- 1. Re-boot the system
-
- 2. Restore the program to its original, uninfected state and
- continue processing.
-
- 3. Restore the program to its original, uninfected state and exit
- to DOS.
-
- 4. Execute as is (this option should only be chosen in a research
- environment).
-
- 5. Take no action, but immediately exit to DOS.
-
- You may choose one of the above options at execution time.
- It is recommended that option 3 be chosen in normal circumstances.
- After the shield has removed the virus and exited to DOS,
- Immediately power down the machine. Find a clean, write-protected
- boot diskette and re-boot the machine from that diskette. Then
- scan your system using the SCAN program to determine the extent of
- the infection.
-
-
- REGISTRATION:
-
- FILE SHIELD is distributed as shareware and requires a $25
- registration fee for home or domestic use. Please use the enclosed
- registration document (REGISTER.DOC). Business, corporate or
- organizational use requires a negotiated site license. For site
- license or developer license information, please contact:
-
- McAfee Associates
- 4423 Cheeney Street
- Santa Clara, CA 95054-0253
-
- 408 988 3832 (Voice)
- 408 970 9727 (FAX)
- 408 988 4004 (BBS)