
                      How to use Virus Rx
                 © 1988, Apple Computer, Inc.

NEW VERSION OF VIRUS RX

Virus Rx is a virus detection program made available by 
Apple Computer, Inc. to assist in the detection of the 
"SCORES" virus.  A new version, Virus RX 1.4, is now 
available which in addition to detecting the presence of 
the "SCORES" virus, now searches for the "nVIR" virus
and the "INIT 29" virus.   

Virus Rx has been written to specifically detect the 
SCORES and nVIR and INIT 29 viruses.  It also detects 
other viruses similar in nature to SCORES and nVIR.

Version 1.4 supports the following new features:

¥  Support for detecting the nVIR virus and deviations 
    of nVIR (e.g. Hpat).
¥  INITs, cdev's, and RDEVs are no longer reported unless
    there appears to be a problem.
¥  "Too New" files are no longer reported.
¥  New menu entry for quick, auto-checking of floppy diskettes.
¥  Virus Rx now checks more file types.
¥  You can zoom windows by typing command-space.
¥  Current examination of a diskette or hard drive can be 
    aborted using command-period.
¥  The memory requirement for using Virus Rx under MultiFinder
    has been reduced.
¥  Typing shortcuts have been added to replace clicking 
    in response to the "Save this document dialog" box.  
    Type Y or y for yes, N or n for no, and command-period 
    for cancel.

		
INSTRUCTIONS FOR USING VIRUS Rx

Copy Virus Rx to a blank floppy diskette.  Physically lock the 
diskette containing Virus Rx by sliding the black tab located 
in the left upper corner on the reverse of the diskette into 
the upper position.  (Your diskette is locked when you can see
through the hole.)  It is mandatory to boot and run Virus Rx
from a locked floppy diskette.  This protects Virus Rx from 
being damaged if a virus is present.  

If you run Virus Rx  from an unlocked diskette in the presence
of SCORES or nVIR, the name Virus Rx will change to 
"Throw me in the trash" to indicate that Virus Rx has been 
damaged.  Discard Virus Rx by throwing it in the trash and 
replacing it with another clean copy.

To run Virus Rx, open the Virus Rx application, then select
the diskette or hard drive you would like examine.  
Virus Rx operates by searching the entire diskette and listing 
all files that could potentially hide a virus such as
damaged or altered applications, invisible files and altered 
system files.  

VIRUS Rx REPORTS

Virus Rx reports different levels of concern from simple 
comments to "dangerous" and "fatal" to indicate the presence
of a virus.   When Virus Rx says to remove a file, do so.
NEVER attempt to repair an infected file.  Incorrect repair
attempts may cause further infections or damage files.

	¥ Virus Rx first lists damaged applications.  Damaged 
	applications have not necessarily been infected by a 
	virus, but they will not work and should probably be 
	removed from your disk or hard drive and replaced with 
	an original copy of the application.

	¥ Files aren't normally invisible and should be viewable 
	from the desktop.  The presence of an invisible file may be
	an indication of a virus.  Virus Rx lists unusual invisible files.

	¥ Altered system files or applications are possible carriers
	of a virus.  Virus Rx will lists all altered system files or
	applications.  These files or applications should be thrown
	in the trash and replaced with copies from the original 
	master diskette.  By the way, when you buy software,
  lock the master diskette before inserting it in any Macintosh.
  Never unlock it.  This will keep it clean.

	¥ FATAL MESSAGES.  When Virus Rx says "***** FATAL Ñ Ó 
  it is an indication that applications and system files may be 
	corrupted by a virus.  The SCORES and nVIR virus only attack
	system files and applications, not data files.  To ensure 
	that the virus is completely removed, all data files should
	be backed up and restored later,  all system files and 
	applications should be thrown away and replaced with clean 
	copies, and the diskette or hard drive should be 
	re-initialized. 

	1. 	Reboot from a locked startup disk.
	2. 	Backup all data files onto diskette, tape or another 
		hard drive.
	3. 	Erase and re-initialize the infected disk or hard drive.
	4. 	Restore the system files and your applications from 
		original master disks.
	5. 	Restore your data files.
	6. 	Use Virus Rx to check other disks youÕve used recently. 

_______________________________________________________________


                   PROTECTING FROM SOFTWARE VIRUSES

The following basic rules are helpful and should be followed to
protect against viruses. 

                             Commercial Software

When you buy commercial software, LOCK the floppy disks the
instant you remove them from the package.  Never unlock them.
Then make a copy and use only copies all the time.  Keep your
originals clean and untouched.

                                 Bulletin Boards 

1. Software to be distributed through a BBS should always be
inspected and tested by the Sysop before making it available
for downloading.  Sysops should never assume users have the
expertise needed to protect their systems.

                        Non-Commercial Software

2. Any downloaded or unfamiliar, non-commercial software should
be kept on a floppy disk and tested until its quality and 
character are determined.  Since viruses may not always show 
up immediately and may spread or install themselves anywhere in 
your system, all non-commercial software should be tested 
several times before putting it on your hard disk or exposing 
it to other application or system disks.  If you receive a copy 
of a commercial application that is not taken from the master 
diskette, you should also use caution.
 
A basic method for testing unknown software

¥  Boot your Macintosh from a floppy disk containing a system 
folder.

¥  If you have an internal hard disk, unmount it by dragging 
its icon into the trash before running the downloaded software.
External hard disks should be turned off.

¥  Using the File menu, select the Get Info menu item and note 
the size of your system file and other related files located in 
the system folder on the diskette.  The size of the system 
file will change when you add or remove fonts, desk accessories 
or other resources, otherwise it should generally remain 
constant.  Some files like the scrapbook or notepad files will 
change size as often as you use them. 

¥  Place the unknown software and a familiar application on the
floppy disk.  

¥  Use the Get Info menu item and note the size of both 
applications.  Applications usually do not change size.  
A change in size may indicate that a virus has attached itself 
to an application and is replicating itself.

¥  Run the unknown software from the floppy several times over 
a few days.  Afterward, again check the size of your system 
file and other files in your system folder.  Watch for changes 
in size which don't make sense.

¥  After using the unknown software, run the familiar 
application.  Watch for unusual behavior.  

Also check the size of the familiar application after running it.  

	                        Backing up Information

3.	Always back up diskettes and hard drives after testing to 
assure that software is free from viruses.  Several back ups 
should be kept and back ups should always be done on schedule.
Dealers will have additional information on software and 
equipment (i.e. tape drives) that can be purchased.

										         Reporting Viruses 
Apple has set-up an Applelink address for dealers, developers 
and Apple technicians to use in reporting potential viruses or 
incidents.  Please send bug reports to VIRUS.TECH on AppleLink.

