WIN9X010

August 2000

Installing McAfee VirusScan v4.5
Kyler Kwok and Wilbur Wong Revised by Therese Nakadomari
Overview.... 1 Product Overview.... 1 System Requirements.... 1 Where to Download the Software... 2 McAfee VirusScan Installation.... 7 Configuring AutoUpgrade and AutoUpdate... 13 Configuring AutoUpgrade....13 Configuring AutoUpdate....16 Creating an Emergency Boot Disk.... 22 How to Remove Dr. Solomons Anti-Virus Toolkit.. 24

Overview

This document describes the steps to download the McAfee VirusScan software from the ITS Web site and how to install the software on a computer that uses Windows 95/98/2000 Pro/NT Workstation. Please be advised that viruses are created on a daily basis and the best way to protect your system is to update your anti-virus program frequently. Updates are created to stop each virus that is created and are released periodically, a minimum of once per month. If a certain virus possesses a high threat to our computer systems, an extra update file will be released by Network Associates and should be installed immediately. Please be aware of all released warnings and updated versions.

Product Overview

VirusScan protects your computer from all sources of viruses including floppy disks, Internet downloads, e-mail attachments, networks, shared files, CD-ROM, online services, and popular compressed files types. If you surf the Web you are at risk of contracting a virus! More than 70% of all virus infections are being transmitted via Internet downloads and e-mail attachments. VirusScan provides powerful protection for anyone on the Web by scanning all Internet downloads and e-mail attachments to stop viruses before they infect your system. The protection described above is available provided the proper options are turned on.

System Requirements

Pentium class processor 15MB hard disk space (Full Installation) 8MB free RAM memory Windows 95/98/NT Workstation/Windows 2000 Professional (with the Microsoft Service Packs) Modem or Internet access for electronic downloads
Installing McAfee VirusScan v4.5 WIN9X010
Minimum version numbers: Netscape Navigator/Communicator 4.08 or Microsoft Internet Explorer 4.51 in order to register and download the software ITS username and password
Where to Download the Software
1. Use a Web browser and go to the URL www.hawaii.edu/sitelic/antivirus Note: Dr.Solomons Anti-Virus Toolkit must be removed. This software is no longer part of the ITS contract. 2. Look for the McAfee VirusScan section and click on the Anti-virus Download Page link. 3. Under the section Step 1. What kind of computer do you have? click on the PC with Windows 95/98/2000 Pro/NT Workstation link. Note: This document contains the instructions for downloading and installing McAfee VirusScan v4.5 for Windows 95/98/2000 Pro/NT Workstation. If you require the instructions for the other software listed on the previous picture, please do not use this document. You can make a selection for one of the other software links and download the appropriate instructions.
4. Step 2. What anti-virus software package do you need? and Step 3. Read and understand the installation instructions contain general information about McAfee VirusScan and this document.

Page 2

5. Step 4. Download the VirusScan anti-virus software will take you to the University of Hawaii Software Registration Download page. At this time, you must know your ITS username and password. If you need more information about the ITS username and password, click on request an ITS Username link as pictured in Step 1. What kind of computer do you have? or go to www.hawaii.edu/help/idreqinfo.html.

6. The pink shaded section contains information about the Terms and Condition of the Universitys agreement with Network Associates Inc. Please note that by registering and downloading the anti-virus software, you are agreeing to comply with these terms and conditions. To view these terms and conditions, click on the conditions of the contract link.

Page 3

7. Complete the registration form and make the appropriate selection for McAfee VirusScan. Click on the box next to McAfee VirusScan Windows 95/98/2000 Pro/NT Workstation. Important note for LAN administrators! Number of installs must be 1 unless you are faculty/staff responsible for multiple departmental machines (e.g., lab or office environment) and will be accountable for the installations. EXACT numbers, not estimates, are required. Please make an indication (e.g., "Engineering Lab") in the Comments field. If you are computer support staff responsible for installing for others, please have them complete and submit this form individually. To comply with terms of the agreement with the vendor, ITS may be required to perform periodic audits and will need accurate information. 8. Click on the Submit button.

Page 4

9. A Web page similar to the one pictured below should appear. The boxes that you selected on the registration form should be listed here. If not, click on the Back button for your Web browser and try again.
10. Click on the McAfee VirusScan 4.5 Windows (.EXE) [15.9MB] link to download the file to your computers hard drive. The files will not fit on a floppy disk. If your browser displays a window that tells you that you are leaving a secure area, you may click the Continue or Yes button. Here are some examples:
Netscape Communicator 4.61

Internet Explorer 5.0

Your Web browser will display a window similar to the ones below because it wants to know what you want to do with this file.

Page 5

Netscape: Click on Save file button to save the file to your hard drive.
Internet Explorer: Click on the circle in front of Save this file to disk and click the OK button to continue.
11. You need to select a place on the hard drive for the downloaded file (the file name is vscan45.exe). The most common place to put downloaded files is a TEMP folder. If you do not have a TEMP folder already, you may use the one that Windows 95/98/2000 Pro/NT Workstation created. You will find it in the same folder that you have Windows 95/98/2000 Pro/NT Workstation installed. For example, you need to look for C:\WINDOWS\TEMP in the Save As window for Windows 95 or 98. For Windows NT Workstation and Windows 2000, the TEMP folder is located C:\WINNT\TEMP.

Page 6

McAfee VirusScan Installation
1. Before installing any software, it is strongly recommended that you exit all Windows programs and remove other anti-virus software programs before running the VirusScan installer. The reasons for this recommendation are: It is not a good idea to have more than one anti-virus software program installed on your computer at the same time because the anti-virus scanner programs will conflict and you will be unprotected. The McAfee VirusScan installer might stop to notify you of the Dr. Solomons AntiVirus Toolkits presence and prevent you from continuing with the installation. The Dr. Solomons Anti-Virus Toolkit is no longer part of the Universitys site license. For instructions on how to remove the Dr. Solomon Anti-Virus Toolkit, please go to the section entitled How to Remove the Dr. Solomon Anti-Virus Toolkit in the back of this document. 2. After downloading the vscan45.exe file, you may begin installing the McAfee VirusScan software. Double click on vscan45.exe file to start the setup program. Please note that the filename might change if the version changes.
3. If you have a previous version of McAfee VirusScan installed on your computer; the McAfee VirusScan version 4.5 setup program will automatically prompt you to uninstall your previous version. The installer will ask you if you would like to keep the setting from the previous version. Click on the Yes button if you want to keep the settings. Click on the No button if you do not want to keep the settings.
4. Click on the Yes button to continue. After your computer reboots, the McAfee VirusScan version 4.5 setup program will continue.

Page 7

5. The next screen is the Product Information. Please read the information and click on the Next button to continue.
6. Please read the License Agreement. If you AGREE with the license agreement, click on the circle next to the phrase I agree to the terms of the License Agreement and the Next button to continue. If you DISAGREE with the license agreement, click on the circle next to the phrase I do not agree to the terms of the License Agreement and the Next button to exit the setup program. You will have to start the installation procedure again.
7. If you had a previous version of McAfee VirusScan installed on your computer, the McAfee VirusScan version 4.5 setup program will ask you if you want to keep your old settings from the previous version of McAfee VirusScan. You may click on the box next to the phrase Preserve

Page 8

On Access Settings to save your old settings. If you do not want to save the old settings, make sure the box is not checked. Click on the Next button to continue.
8. At the next screen, choose the type of setup. You should use the Custom Installation because the typical installation does not include the E-Mail and Download scanners. With the new and more creative viruses, the E-Mail and Download scanners are essential to protect your computer. Click the Next button to continue. 9. The next window should look similar to this picture. The red Xs next to Email Scan and Internet Scan means that these options will not be installed. You need to change the red Xs to the icon that looks like a hard drive.

Page 9

Select the red X next to Email Scan. A pop-up menu should appear. From this menu, select This feature will be installed on local hard drive
Select this option from the menu.
10. Repeat the previous step for Internet Scan and Screen Scan. After changing the settings, click on the Next button. See the picture below for a sample of what the setup window should look like. Note: The Screen Scan is optional. It will scan your hard drive or floppy drive for viruses when the screen saver is activated. If your computer is unable to handle the Screen Scan, you need not install it. If your computer freezes because of the screensaver, disable the Screen Scan option.
Note: The red X should still be here if you choose not to install the Screen Scan.

Page 10

11. The default installation directory is C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN. Click the Next button to continue. 12. The next window will ask you if you are ready to proceed with the installation. If you are satisfied with the options, click on the Install button to continue.
13. The setup program will now install the necessary files to your computer. Here are two of the many windows that you will see during the copying of the files.

Page 11

14. After setup has completed installation, you should click on the Skip Config button because you will change the configuration settings later.
15. The installation of McAfee VirusScan version 4.5 is now complete. Click on the Finish button to exit the installation window. If there is a checkmark in the option box Start VirusScan, the scanner will start to scan your hard drive.
16. Restart your computer. After your computer has restarted, note the new icon for the McAfee VirusScan program in the lower right corner of your screen, next to the clock. The icon should look like the one pictured below.

Page 12

Configuring AutoUpgrade and AutoUpdate
Network Associates has improved the AutoUpgrade and AutoUpdate functions in McAfee VirusScan version 4.5. These functions are powerful tools that will allow you to automatically run the upgrade and update periodically. There is a difference in the upgrade and the update. The upgrade file is called SuperDAT file. The SuperDAT file contains the revised files for the current McAfee VirusScan scanner and the latest update to the virus definition file. The AutoUpgrade function will download the SuperDAT file from the ftp site and install it. It is a good idea to reboot your computer after the scheduled AutoUpgrade function is used. Upgrades are available only when McAfee releases a new version of the SuperDAT file which is usually once a month or a few days after a major virus threat. The update file is called a DAT file. This file contains only the virus definitions and is usually the remedy for new major virus threats. The AutoUpdate function is pre-configured to retrieve the DAT file from the Network Associates FTP site. However, in the event of a new virus threat like the ILOVEYOU virus, it might be difficult to retrieve the DAT file from the Network Associates FTP site. Note: New viruses are created daily. The best way to protect your system is to schedule the AutoUpdate for once per week at the minimum. CONFIGURING AUTOUPGRADE 1. After you have restarted your computer, you should go to Start > Programs > Network Associates > VirusScan Console. This will start the McAfee Scheduler and the window should look like the one pictured below. Note: If the VirusScan Console windows does not appear, double click this icon in your system tray, which is next to your clock.

2. Click on AutoUpgrade and then click on the Configure button. 3. Click on the Add button on the AutoUpgrade Options tab.

Page 13

4. You will see the Automatic Upgrade Properties window. For steps 5 7, please refer to the picture below.

See Step 5

See Step 6

See Step 7

5. Click in the Site Name box and enter University of Hawaii AntiVirus Upgrade Site. 6. Click on the box beneath Enter an FTP computer name and directory and enter ftp.hawaii.edu/outgoing2/antivirus/upgradevs/ If the box is not enabled, click on the box next to Enabled to turn on the box. 7. Click on the checkmark in front of Use anonymous FTP login. This will take the checkmark away and turn on the FTP login information button. 8. Click on the FTP login information button. 9. Click on the box next to User Name: and enter anonymous 10. Click on the box next to Password: and enter your ITS username (e.g. youraccount@hawaii.edu) 11. Click on the box next to Confirm Password: and re-enter your ITS username. See step 9 See step 10 See step 11

Page 14

12. Click the OK button in the Login Information window. 13. Click the OK button in the Automatic Upgrade Properties window.
14. Click the Upgrade Now button. This will execute the AutoUpgrade function. If you are using a modem to connect to the Internet, please connect to your Internet Service Provider before clicking on the Upgrade Now button. 15. You will see a series of messages in the AutoUpgrade Status window.

Page 15

If the upgrade is successful, the Vshield and the VirusScan Console icons will disappear from the system tray and reappear. 4:51 PM CONFIGURING AUTOUPDATE 1. You need to configure the AutoUpdate feature of your McAfee VirusScan. Double click on the VirusScan Console icon.
2. Click on AutoUpdate in the window and click on the Configure button.
3. Click on the Add button.

Page 16

4. You will see the Automatic Update Properties window below. Please refer to it for steps 5-7.

See Step 6 See Step 7

5. Click in the Site Name box and enter University of Hawaii AntiVirus Update Site. 6. Click on the box beneath Enter an FTP computer name and directory and enter ftp.hawaii.edu/outgoing2/antivirus/update/ 7. Click on the checkmark in front of Use anonymous FTP login. This will take the checkmark away and turn on the FTP login information button. 8. Click on the FTP login information button. 9. Click on the box next to User Name: and enter anonymous See step 9 10. Click on the box next to Password: and enter your ITS username (e.g. youraccount@hawaii.edu) 11. Click on the box next to Confirm Password: and re-enter your ITS username. 12. Click the OK button in the Login Information window. Installing McAfee VirusScan v4.5 WIN9X010 Page 17 See step 10 See step 11

13. Click the OK button in the Automatic Update Properties window to return to the VirusScan Console window. 14. Click on AutoUpdate and then click on the Properties button. 15. Click on the Schedule tab in the Task Properties window.
16. ITS recommends scheduling the AutoUpdate feature to check for updates every week.
Click on Enable Click on Weekly You may select the time of day and the day of the week you want the AutoUpdate to retrieve the file. Note: the time is military time format so 1:00 PM is 13:00. You should put a time and day of the week that you do not have a heavy workload or things that need to be accomplished (e.g. five minutes before you go home or right when you arrive in the morning.) Page 18 Installing McAfee VirusScan v4.5 WIN9X010
17. Once you have entered your choices, click on the OK button. You should be back in the VirusScan Console window. 18. Click on AutoUpgrade and then click on the Properties button. 19. Click on the Schedule tab in the Task Properties window.
20. ITS recommends scheduling the AutoUpgrade feature to check for upgrades every month.
Click on Enable Click on Monthly
You may select the time of day and the day of the month you want the AutoUpgrade to retrieve the file. Note: the time is military time format so 1:00 PM is 13:00. You should also choose a day between the fifth and the tenth of the month.

Page 19

21. Once you have entered your choices, click on the OK button. 22. You need to configure the E-mail Scan, Download Scan, and Screen Scan. Double click on the Vshield icon in the system tray (next to the clock). 23. Click on Properties. 24. Click on the box next to the phrase Enable the scanning of e-mail attachments. 25. Click on the appropriate e-mail program. If you use Microsoft Outlook or Lotus CC:Mail, click on Enable Corporate Mail and the appropriate button next to the product you are using. If you are using other e-mail client software such as Outlook Express, Eudora or Netscape Mail, click on Internet Mail (Requires Download Scan). If you are not sure which e-mail program you are using, click on both Corporate Mail and Internet Mail (Requires Download Scan). Click on the All Attachments option in the Attachments section. This option will scan all attachments that arrive with any e-mail message.

Page 20

26. You should see a window with this information.
27. Click on the Yes button. 28. Vshield will automatically turn on the Download Scan feature. To check if the Download Scan is activated, click on the Download Scan icon in the left column.
Note: The Download Scanner is set to scan All files and Scan compressed files. This is the recommended setting to provide adequate virus protection.

Page 21

Creating an Emergency Boot Disk
1. This section is for those who did not create an Emergency Disk during installation, or for those who wish to create another disk. Note that this disk is used for boot sector viruses and not for viruses that appear in macros or Internet worms; therefore, the definitions will not match the version of the SuperDAT or the DAT files. Please check the support.mcafee.com/down_sup/9.asp#q9 Web page for more information about the update files for the Emergency Disk. You may contact the ITS Help Desk for a current copy of the Emergency Boot Disk. 2. Open the Emergency Disk Wizard Program by clicking on: Start > Programs > Network Associates > Create Emergency Disk. 3. The Emergency Disk Wizard will now load.

4. Insert a blank IBM formatted high density diskette into your computer. Click Next to continue, or Cancel to quit. You should always format the diskette to eliminate any files and viruses that may be on the diskette.

Page 22

5. Next, the Disk Wizard will give an option to format your diskette. Check the Dont format box ONLY if your diskette is IBM formatted, and is already bootable (skip to step 7 if you check this box). If you are unsure, leave it unchecked. Click on Next button to continue. The disk-formatting program will now run. Select Full for the Format type and select Display summary when finished and Copy system files for Other options. Click Start to begin formatting. All files on this disk will be deleted. This may take a few minutes, depending on the speed of your computer and disk drive. When it is complete, it will bring up a confirmation message. Click the OK button to continue.
6. Click the Close button to continue the disk creation process. 7. Click the OK button to create the Emergency Disk. The necessary files will now be copied to the disk. Be sure to label the diskette McAfee Emergency Boot Disk and turn on the write protection on the disk. You can do this by opening the write protection switch in the upper right corner of the disk. If you can see through the hole on the diskette, you have turned on the write protection. You can test the diskette by restarting the computer with the McAfee Emergency Boot Disk in the floppy disk drive.

Page 23

Note: The McAfee Emergency Boot Disk will scan all files on your hard drive a number of times. The number of scans the software performs will depend on the DAT file and the number of files on your hard drive. To stop the McAfee Emergency Boot Disk from scanning your computer, you must hold the Control-Alt-Delete keys simultaneously or press the Restart button on the front of your computer. 8. Click the Finish button.
9. When done, store the diskette in a safe place, and use it when you suspect or you have a boot sector virus. If you do have a boot sector virus, you may obtain the most recent copy from the ITS Help Desk in Keller 105 or request one from them. The most common instance of a boot sector virus occurs when a computer is started with an infected floppy diskette.
How to Remove Dr. Solomons Anti-Virus Toolkit
1. 2. 3. 4. Close all software programs that you have running. Click on the Start button. Click on Settings. Click on Control Panel.

Page 24

5. Look for Add/Remove Programs and double click on the icon.
6. Look for Dr. Solomon Anti-Virus Toolkit in the window and click on the phrase.
7. Click on the Add/Remove button. 8. You will see a warning from Windows. Click the Yes button to continue. If you click the No button, the uninstaller function will not remove the Dr. Solomon Anti-Virus Toolkit.

Page 25

9. If you have Winguard installed, you will see a window with the following message:
If you have this icon in your task bar next to the clock, you are using Winguard. 10. If you want to continue, click on the Yes button. If you do not want to continue, click on the No button. The computer will reboot and continue with the uninstall process. 11. During the uninstall process, other message windows might appear. Read the options before selecting a response. Always select the option to keep the file if you have doubts. The uninstaller windows will look like the one pictured below.
12. Click on the Done button to complete the uninstall process.

Page 26

For additional assistance, please phone the ITS Help Desk at (808) 956-8883, send e-mail to help@hawaii.edu, or fax (808) 956-2108. Or see the ITS Helpdesk home page at www.hawaii.edu/help The ITS Help Desk is located in Keller 105 on the UH Manoa Campus.
The University of Hawaii is an equal opportunity/affirmative action institution.

Page 27

WIN9X013

October 2001

Using McAfee VirusScan v4.5

Jocelyn Kasamoto

Introduction.... 1 What is a Computer Virus?... 2 How Computer Viruses Work... 2 How are Computer Viruses Spread?.... 3 Two is Not Better Than One.... 3 How does McAfee VirusScan Work?.... 4 Changing System Scan Settings.... 4 Changing E-mail Scan Settings... 5 How to Scan On-Demand.... 6 Keep SDAT/DAT Files Current.... 7 What Version of McAfee am I Running?... 7 Configuring AutoUpgrade.... 8 How to Upgrade Your SDAT Manually... 9 Configuring AutoUpdate.... 10 In Case of a High Virus Alert.... 11 Installing the EXTRA.DAT File... 12 I Found a Virus, Now What?... 12 Using McAfee Emergency Disk... 14 Performance Issues..... 14 For More Information.... 15

Introduction

Computer viruses, including worms and Trojan horses, are prevalent in todays computing environment. Since most computers are connected to a network such as a local area network (LAN) and the Internet, viruses can spread rapidly via e-mail attachments (e.g. ILOVEYOU and Melissa viruses); Internet downloads and shared files on network connections. Virus infections cause loss of valuable data and time needed to clean up after an infection. Everyone must be aware of new virus alerts, have an antivirus software installed, and keep the antivirus software current. This document provides information to help you become virus-aware and covers the basics of using McAfee VirusScan v4.5 on the Windows 95/98/2000 Pro/NT Workstation platform. It assumes that you have already installed McAfee VirusScan, which is the antivirus software currently supported by ITS. Please see ITS document WIN9X010, Installing McAfee VirusScan v4.5, before continuing. This document is available at the ITS Help Desk in Keller 105 or on the web at www.hawaii.edu/itsdocs.

Page 1

Using McAfee VirusScan v4.5 WIN9X013
What is a Computer Virus?
A computer virus, as defined by the Virus-L/comp.virus newsgroup, is a self-replicating program containing code that explicitly copies itself and that can infectother programs by modifying them or their environment such that a call to an infected program implies a call to a possibly evolved copy of the virus. The program does not have to do outright damage (e.g. deleting or corrupting files) to be called a virus. Examples are the Michelangelo boot sector virus and the Jerusalem file-infecting virus. A computer worm is a self-contained program or set of programs that can spread functional copies of itself or its segments to other computer systems usually through network connections. Unlike viruses, worms do not need to attach themselves to a host program. Examples are the ILOVEYOU and Pretty Park worms. A Trojan horse is a computer program that does something undocumented that the programmer intended but that the user would not have approved of if he knew about it. The term Trojan is usually referred to a non-replicating malicious program. For example, BackOrifice allows the programmer to control an infected computer remotely. A macro virus is a computer virus that uses an applications own macro programming language to distribute itself. Unlike previous viruses, a macro virus doesnt infect programs; it infects documents and templates. Examples are the Melissa and Marker Word macro viruses. Most people use the term virus to loosely cover any program that tries to hide its malicious function and spread to as many computers as possible. ITS will use the term, virus, to represent viruses, worms or Trojan horses.
How Computer Viruses Work
Computer viruses are programs which are executable files such as.exe and.com files, macros (scripting language found in Microsoft Word, Excel and other applications), Visual Basic scripts and other executable code. The malicious code must be executed (i.e. run) before it can infect the host system and spread. For example, opening a document infected with a macro virus, booting with a diskette infected with boot sector virus or double-clicking on a program file infected with a virus are ways to execute a virus. Viruses may or may not have a payload (i.e. action programmed by the virus writer to occur on an infected system). The payload could range from irritating text that pops up on your screen, text embedded in your document, deleted or corrupted files to a reformatted hard drive (i.e. losing all your data and programs). Often times the payload is not immediate after being infected but may be triggered by a date, time, number of file opens, etc. so the infection may not be noticed until it is too late.

Page 2

How are Computer Viruses Spread?
Network connections give viruses many different avenues to spread themselves. You can spread a virus if you share files with others from a disk, a network drive, external drive media or exchange files over the Internet via e-mail attachment or browsing an infected web server. You could also get virus infections from Internet downloads. Opening a document or template that contains a macro virus will infect your system and will spread to other documents and templates on your system. Popular computer products are often the favorite targets of virus writers. Examples are Windows 95/98/2000 Pro/NT Workstation, Microsoft Office (Word, Excel, PowerPoint, Access), Outlook, and Outlook Express. If you use these operating systems and applications, be on guard. New viruses and their numerous variants are constantly being introduced. Viruses are typically platform-specific. With new cross-platform macro language for Microsoft Office, it is possible for a PC Word macro virus to infect a Macintosh Word file. A PC Word document infected with a macro virus could infect a Macintosh if the infected Word document were opened on the Macintosh. If you receive an e-mail message with an infected attachment, you will not get infected if the attachment is not opened. If you receive suspicious e-mail (e.g. multiple e-mail messages with the same subject header, attachments from unknown users or unexpected attachments from known users), do NOT open the attachment without scanning it first! If in doubt, delete the message and contact the user who sent the attachment. Unfortunately, we can not predict how the next virus attack will occur. We have already seen an attempt to pass a virus through e-mail without the recipient opening the message or attachment.
Two is Not Better Than One
Please make sure that you have only one copy of antivirus software installed on your PC. Multiple copies may cause conflicts and system instability when competing antivirus software scan for viruses at the same time. If you have Dr. Solomons antivirus software, it is no longer on the ITS contract. You must uninstall Dr. Solomon by following details in Installing McAfee VirusScan v4.5. Some new computers come preinstalled with Norton Antivirus or other antivirus software. It is up to you to decide whether to keep the preinstalled antivirus software or switch to McAfee. It does not matter which antivirus software you use just as long as you have one and keep it updated. Note: the PDC computers on the current contract come with a 90-day evaluation copy of Norton Antivirus. If you decide to keep Norton Antivirus, you will be responsible for updating your DAT files and paying for a years subscription of updates once the evaluation period is over.

____________________________________________________________________________________ Page 3 Using McAfee VirusScan v4.5 WIN9X013
How does McAfee VirusScan Work?
McAfee VirusScan uses a two-pronged approach to protect against viruses 1) an on-access virus scanner working in the background and 2) an on-demand scanner. Vshield Scanner is the component that provides background protection continuously watching for viruses as you work on your computer. It is loaded automatically when your computer is started up and stays in memory until you shut it or your system down. Viruses are detected when you attempt to access a file (read, copy, create, rename) on your hard drive or attempt to access your floppy diskette, zip disk, or CDROM. VirusScan application is the component that allows you to scan your system on demand or as scheduled in VirusScan Console. VirusScan application should be configured to scan all files and be run initially when VirusScan is installed and once a week thereafter. (Note: if your computer is in a high-traffic environment such as computer labs, you should scan all files more frequently.) There are five modules in Vshield: System Scan, E-mail Scan, Download Scan, Internet Filter and Security. E-mail Scan, Download Scan and Internet Filter are options available under the custom installation. You must enable E-mail Scan and Internet Filter before they will work. Download Scan must be enabled for E-mail Scan to scan Internet mail. System Scan scans files when they are run, copied, created or renamed and when floppies are accessed. Email Scan works in conjunction with Download Scan to scan e-mail attachments and files while they are being downloaded. Internet Filter scans for potentially harmful Java applets and ActiveX controls and filters Internet sites by IP address and/or URL. The Security module allows you to password protect your scan settings.
Changing System Scan Settings
1. Right click on the Vshield icon in the Windows system tray on the bottom right corner of your screen. 2. Click on Properties. 3. Click on System Scan. 4. Click on the Detection tab. 5. We recommend that you use the scan all files option to prevent virus attacks (default is program files only). Click on the All files radio button. This option may slow down the performance of your computer. If you are not happy with system performance when using the scan all files option, you can select scan program files only AND schedule an all files scan weekly. Use VirusScan Console to schedule your task (see page 6). 6. In the scan floppies on section, uncheck the box for shutdown because it has caused problems.

____________________________________________________________________________________ Page 4 Using McAfee VirusScan v4.5 WIN9X013
We recommend removing Recycle Bin from the Exclusion tab. The SirCam virus (discovered July 17, 2001) created copies of itself and moved them to the Recycle Bin. The Recycle Bin is normally not scanned for viruses by default since programs stored in the Recycle Bin can not be run. To remove the Recycle Bin scanning exclusion, in System Scan Properties: 1. Click on the Exclusion tab. 2. Highlight C:\RECYCLED. 3. Click on Remove. 4. Click on Apply. 5. Click on OK.
Changing E-mail Scan Settings
You must enable scanning of e-mail attachments; it is not enabled by default. This will allow you to scan e-mail attachments while you are downloading your message. in the Windows system tray. 1. Right click on the Vshield icon 2. Click on Properties and E-mail Scan. 3. In the Detection tab, check Enable Scanning of e-mail attachments. 4. Check Internet Mail. 5. Click on Apply. 6. Click on OK. Note on E-Mail System options Click on Enable Corporate Mail if you are using Microsoft Exchange, Microsoft Outlook or Lotus cc:Mail. Internet Mail includes Outlook Express, Eudora and Netscape Mail.
____________________________________________________________________________________ Page 5 Using McAfee VirusScan v4.5 WIN9X013

How to Scan On-Demand

Use VirusScan application to scan your hard drive, floppy diskette or a selected folder before accessing the files on the media. VirusScan will scan the entire hard drive, floppy diskette or folder, not just one file. This should be done routinely once a week. If you have many files, the scanning process will take time. We recommend scanning your hard drive when you dont need to use the computer. 1. 2. 3. 4. 5. Close all applications. Click on Start Programs Network Associates Select the drive or folder you wish to scan. Select scan all files. Click on Scan Now. VirusScan.
To automate this task, use VirusScan Console to configure your scan job. The following are instructions for configuring the task of automatically scanning your c: drive on a weekly basis. 1. Click on Start Programs Network Associates VirusScan Console. 2. Highlight Scan Drive C. 3. Click on Properties. 4. In the Program tab, click on Configure. 5. On the Detection tab, make sure that scan all files is selected. 6. On the Exclusion tab, highlight \Recycled\. 7. Click on Remove. 8. Click on Apply and OK. 9. On the Schedule tab, click on Enable. 10. Click on run weekly. 11. Select a time in 24-hour time (e.g. 14:00 is 2:00 p.m.) and a day of the week when you want to run the scan. Pick a day and time when your computer will be on and VirusScan Console is running. 12. Click on Apply and OK. 13. Close VirusScan Console.

____________________________________________________________________________________ Page 6 Using McAfee VirusScan v4.5 WIN9X013
Keep SDAT/DAT Files Current
There are 200 to 300 new viruses introduced every month. The antivirus software will not protect you against these new threats unless you update your virus definition data (DAT) files and scan engine. The antivirus software uses the DAT file to scan for virus signatures (code identifying the virus). In order to maintain the best detection and cleaning capability, the DAT files and scan engine must be current. It is important to keep the scan engine current to the level required for using the most current DAT file. Sometimes when you have the latest DAT file with an older scan engine, new viruses are not detected or cleaned properly. Upgrade refers to the upgrading of the scan engine, which is the part of the antivirus software that detects and cleans virus infections. As new viruses appear and existing viruses evolve, the scan engine needs to be upgraded with new functionality. Update refers to the updating of the virus definition files. The SuperDAT (SDAT) installer utility automatically loads updated virus definitions and scan engine. SDAT version xxxx contains the virus definition version xxxx with the scan engine associated with that virus definition. For example, SDAT 4164 contains the DAT 4164 and scan engine 4150. ITS recommends that you update your SDAT files weekly to keep it current by using the autoupgrade task in VirusScan Console. NAI normally updates the SDAT/DAT files weekly on Wednesday mornings (HST time). The DAT files are updated more frequently during a high alert virus outbreak. For example, NAI released 4 DAT files within 3 days during the Nimda virus outbreak in Sept. 2001.
What Version of McAfee am I Running?
To find out what version DAT file and scan engine you are running, right click on the Vshield icon in
VirusScan version DAT file version

Date DAT file created

Scan engine version
the Windows system tray and click on About. I am running McAfee VirusScan v4.5.0 with SP1 using DAT file 4164 created on October 3, 2001 using scan engine version 4150.
____________________________________________________________________________________ Page 7 Using McAfee VirusScan v4.5 WIN9X013

Configuring AutoUpgrade

To automatically upgrade your scan engine and DAT file, configure the autoupgrade task: 1. 2. 3. 4. 5. 6. 7. Click on Start Programs Network Associates VirusScan Console. Click on AutoUpgrade then Properties. In the Task Properties window, click on the Schedule tab. Check Enable. Select run weekly. Enter the time in 24-hour time (i.e. 1300 is 1:00 p.m.) when you want the task to start. Select a day from the pull-down menu. Select a day and time when your computer will be on. Your computer must be on and VirusScan Console must be running for the autoupgrade task to start. If your computer is off at the scheduled time, the upgrade will be performed at the next scheduled time.
____________________________________________________________________________________ Page 8 Using McAfee VirusScan v4.5 WIN9X013

8. 9. 10. 11. 12.

Click on the Program tab then Configure. In the Upgrade Sites tab, click on Add. In the Upgrade Options tab, enter the following information. Site Name: University of Hawaii Antivirus Upgrade Site Enter an FTP computer name and directory - ftp.hawaii.edu/outgoing2/antivirus/upgradevs/.
13. Clear Use anonymous FTP login and click on FTP login information. 14. For User Name, type in anonymous. 15. For Password, type in your ITS username (e.g. user@hawaii.edu) which will appear as asterisks. 16. For Confirm Password, type in your ITS username again. 17. Click on OK in the login information window. 18. Click on OK in the automatic upgrade properties window. 19. Click on Apply and OK. 20. Close VirusScan Console.
How to Upgrade Your SDAT Manually
There are two ways to manually upgrade your SDAT. The easier way is to use the autoupgrade task. If your autoupgrade task has been configured as in the previous section, right-click on the VirusScan Console icon in the system tray and select Restore. Highlight the Autoupgrade task, click on Properties, and click on Run Now. ____________________________________________________________________________________ Page 9 Using McAfee VirusScan v4.5 WIN9X013
McAfee will disable VirusScan, connect to the ftp site, download the upgrade components, run the SDAT upgrade, and enable VirusScan. Sometimes this will fail if McAfee is unable to login to the ftp site. You should try again later as the ftp site may be busy. The second way to upgrade your SDAT is to open your web browser to http://www.hawaii.edu/downloads/mcafee/sdat.html. Click on the download SuperDAT link and save the file to your Windows desktop. Double-click on the SDAT icon to run it.

Configuring AutoUpdate

The autoupdate task is configured with the default Network Associates (NAI) ftp location, ftp.nai.com/pub/antivirus/datfiles/4.x, for DAT updates when you first install VirusScan. You may also use the UH antivirus update site, ftp.hawaii.edu/outgoing2/antivirus/update/ that may be more accessible during times of high virus alerts. To change from the default NAI site to the UH antivirus update site: 1. Go to Start Programs Network Associates VirusScan Console. 2. Click on AutoUpdate and Configure. 3. In the Update Sites tab, highlight Network Associates and click on Delete. 4. Click on Add.
____________________________________________________________________________________ Page 10 Using McAfee VirusScan v4.5 WIN9X013
5. 6. 7. 8. 9. 10. 11. 12. 13.
In the Update Options tab, enter the following information. Site Name: University of Hawaii Antivirus Update Site Enter an FTP computer name and directory - ftp.hawaii.edu/outgoing2/antivirus/update/. Clear Use anonymous FTP login and click on FTP login information. For User Name, type in anonymous. For Password, type in your ITS username (e.g. user@hawaii.edu) which will appear as asterisks. For Confirm Password, type in your ITS username again. Click on OK in the login information window. Click on OK in the automatic update properties window.
Click on the Schedule tab. Check Enable. Select Daily (or Weekly at minimum). Select the days and times you want to run autoupdate. Enter times in 24-hour time, e.g. 16:30 is 4:30 pm. Remember that your computer must be powered on. Autoupdate takes a few minutes. 18. Click on Apply and OK. 19. Close VirusScan Console.

14. 15. 16. 17.

See the Configuring AutoUpgrade and AutoUpdate section in ITS document WIN9X010, Installing McAfee VirusScan v4.5, for details. Do not schedule autoupgrade and autoupdate for the same day and time.
In Case of a High Virus Alert
In the event of a fast-breaking high alert virus, NAI usually makes available an EXTRA.DAT virus definition file that will detect the new virus. ITS will make the EXTRA.DAT file available on its antivirus web page (www.hawaii.edu/sitelic/antivirus) for download customized for the UH community.

____________________________________________________________________________________ Page 11 Using McAfee VirusScan v4.5 WIN9X013
Note: to receive e-mail notification of high or medium virus alerts, subscribe to the list uhvirus-alert. (Virus risk levels are determined by NAI.) To subscribe, send e-mail to listproc@hawaii.edu with the following in the message body: Subscribe uhvirus-alert <first name> <last name> You may also subscribe on-line at www.hawaii.edu/virus. The EXTRA.DAT file must be copied in the folder where the DAT files are installed. The default location is the C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.XX folder.
Installing the EXTRA.DAT File
1. Go to the ITS antivirus web page, www.hawaii.edu/sitelic/antivirus/instructextra.html. 2. Download the EXTRA.DAT file to your Windows desktop or in a temporary folder. (The EXTRA.DAT file will be saved with a filename of the following format: extrammddyy.exe where mmddyy is the month, day and year of the EXTRA.DAT file, e.g. extra052700.exe). 3. Close your web browser (i.e. Netscape or Internet Explorer). 4. Double click on the filename or icon for extra052700.exe in our example. 5. The file is programmed to place the EXTRA.DAT file into the default VirusScan folder mentioned above. 6. If you installed VirusScan in a different folder, extract EXTRA.DAT onto the Windows Desktop by typing in C:\Windows\Desktop instead of C:\Program Files\Common Files\Network Associates\VirusScan Engine\4.0.XX then copy the file to the appropriate folder.
I Found a Virus, Now What?
When Vshield detects a virus, you will receive a warning similar to the following: You will be prompted with several options, which depend on the Vshield component that detected the
virus. In this example, Download Scan detected the Eicar test virus. Your options are to continue scanning, delete the file or move the file to a quarantine folder. Vshield also suggests what you should do with the infected file. Please write down the name of the virus and the infected file for reference. ____________________________________________________________________________________ Page 12 Using McAfee VirusScan v4.5 WIN9X013
If you select to move the file, the infected file is copied to the C:\INFECTED folder and renamed to original-filename.vir (e.g. eicar.com.vir). In most cases, you should choose to delete the infected file. Here is another example of a virus detection, this time by the System Scan module when the user attempted to open the infected file, Pretty Park.exe, on a floppy diskette. Click on Clean to disinfect the virus. VirusScan will tell you whether it was successful in removing the
virus. Some viruses (usually boot sector viruses) can not be cleaned while running Windows. You will need to use the McAfee Emergency Disk to clean boot sector viruses in DOS. (See section below on Using McAfee Emergency Disk.) Sometimes when the virus is newly introduced, VirusScan may only be able to detect the virus but may not be able to clean it. In those cases, you should delete the infected file and restore the original file from a clean (pre-infected) backup. Once the virus is disinfected, a report will be given depending on the status of the virus and whether the virus could be cleaned, deleted or renamed. The log file is saved in c:\Program Files\Network Associates\VirusScan\VSHLog.txt. Once you have disinfected the virus (or deleted the infected file and restored it from backup), rerun VirusScan scanning with the all files option once more just to be safe. You should track down the source of your virus infection and notify the appropriate people involved who may have given you the virus and those to whom you may have spread the virus (if not detected in time). For example, if VirusScan detected a virus in your e-mail attachment, notify the persons to whom you may have inadvertently forwarded the infected attachment and the person who sent you the attachment. If you detect a virus and need assistance cleaning it, please contact the ITS Help Desk at 956-8883 with the name of the virus, your version of VirusScan, the date of your virus definition, and the version of your scan engine.

____________________________________________________________________________________ Page 13 Using McAfee VirusScan v4.5 WIN9X013
Using McAfee Emergency Disk
The McAfee Emergency Disk will only detect boot sector and file-infecting viruses. ITS creates a McAfee Emergency Disk with DAT file updates for these viruses on a monthly basis. You can obtain an updated McAfee Emergency Disk at the ITS Help Desk in Keller 105. You can create an Emergency Disk using VirusScan (Start Program Files Network Associates Create Emergency Disk) but it will not have the updated virus definitions.) 1. Make sure the McAfee Emergency Disk is write-protected (slide the write-protect tab so a hole appears near the corner of the diskette) 2. Shut down Windows. Click on Start Shut Down Shut Down. 3. Power off your computer. 4. Insert the McAfee Emergency Disk into the floppy drive (a:). 5. Power on your computer. (Note: cycling the power on your computer is known as a cold boot, which will clear any memory resident viruses.) 6. Use the arrow keys to highlight Next and press Enter. If you dont have McAfee VirusScan installed on your computer, you must use the DAT files on the Emergency Disk (default location) and skip to step 10. To use the DAT files on your hard drive, go to step 7. 7. Use the arrow keys to highlight Location and press Enter. 8. In the location box, type in c:\progra~1\common~1\networ~1\viruss~1\40~1.xx (without the quotes). Press the arrow keys to highlight OK and press Enter. 9. The Use DAT files from box will be filled in with the location you just entered. 10. Use the arrow keys to highlight Next and press Enter. 11. Use the arrow keys to highlight Finish and press Enter. 12. The program will begin scanning and cleaning your system using the DAT files on your hard drive or on the Emergency Disk if you selected this option. It may take several passes to complete. Each pass may take several minutes or a couple of hours. When the scan is finished, you will see a report and the a:> prompt. Power off your computer, remove the McAfee Emergency Disk from the floppy drive and power on your computer.

Performance Issues

As on-access virus scanning becomes more complex and requires more system resources, you may notice degradation in system performance. This was especially noticeable after DAT 4163 was released. Do NOT disable your anti-virus software! This is a tremendous security risk. Here are recommendations on configuring McAfee to improve your system performance: 1. Scan program files only instead of scanning all files and change the program file extensions list to include the following ?? 00? 386 A?? BA? BIN BZ CBT CDR CHM CLA CMD CNV COM CP? CRT CSC CX D?B DEV DLL DO? DRV DVB DWG EML EXE GMS HLP HT? INF INP ISP JS? L? LNK MD? MP? MS? NWS O?? PCD PIF POT PP? PS PWZ Q?? REG RTF SH? S?S SC? SMM TLB TM TX? URL V?? VB? W?? X?? Right-click on VirusScan Console icon in the system tray and select Restore. Highlight Vshield and click on Properties then Configure. On the Detection tab, select Program Files Only.

____________________________________________________________________________________ Page 14 Using McAfee VirusScan v4.5 WIN9X013
Click on the Extensions button. Click on Add. Type in one of the file extensions (maximum 3 characters) listed above then OK. Repeat the process until all the file extensions are added. Click OK when done. Click on Apply and OK. 2. In addition to step 1, configure Download Scan and E-mail Scan to scan for all files and all attachments. Scan all files on your hard drives at least once a week.

For More Information

For help on installing or using McAfee VirusScan, to report a virus or to request help cleaning up after a virus infection, call the ITS Help Desk at 956-8883, visit the Help Desk at Keller 105 or send e-mail to help@hawaii.edu. For information about a specific virus, go to URL vil.nai.com/villib/alpha.asp and specify the virus name in the search box. For VirusScan FAQs on update, install/uninstall, general and virus infection issues, go to URL www.mcafeehelp.com/main.asp?docName=VSFAQList. McAfee VirusScan Getting Started and Users Guide manuals are available in PDF format at www.nai.com/asp_set/services/technical_support/docs.asp?pCode=VSCMP.
For additional assistance, please phone the ITS Help Desk at (808) 956-8883, send email to help@hawaii.edu, or fax (808) 956-2108. The Help Desks toll-free phone number is (800) 558-2669. Or see the ITS Help Desk home page at www.hawaii.edu/help The ITS walk-in Help Desk is located in Keller 105 and Keller 213 on the UH Mnoa Campus.
The University of Hawaii is an equal opportunity/affirmative action institution.
____________________________________________________________________________________ Page 15 Using McAfee VirusScan v4.5 WIN9X013