QUICK START INSTRUCTIONS FOR McAFEE ASSOCIATES PROGRAMS Last revised November 15, 1992. Copyright 1990-1992 by McAfee Associates. All rights reserved. McAfee Associates (408) 988-3832 Telephone 3350 Scott Blvd. Bldg. 14 (408) 970-9727 FAX Santa Clara, CA 95054-3107 (408) 988-4004 BBS USA CompuServe GO MCAFEE InterNet support@mcafee.com QUICK START Page 1 These instructions explain how to identify a virus with the VIRUSCAN program and remove the virus with the CLEAN-UP program. They are intended to provide an emergency means to identify and remove an infection. They are not meant to replace the program documentation. Please read through the documentation for detailed instructions. Files ending in a .DOC extension have been formatted for printing on a printer with a minimum of 55 lines per page. Files ending in a .TXT extension have not been formatted. VIRUSCAN (SCAN) 1. Copy all the VIRUSCAN files to a floppy disk in drive A:. 2. WRITE PROTECT THE DISK!!! 3. Turn computer off to remove the virus from memory, insert a clean (virus-free) DOS system boot disk into the A: drive, and turn the power back on. 4. Insert the VIRUSCAN disk into the infected PC and type: SCAN C: D: E: This will allow VIRUSCAN to scan the C:, D:, and E: drives. If you do not have D: and E: drives, leave them out. NOTE: If infected files are found, they may be ERASED by running SCAN with the /D (overwrite and delete) option: SCAN C: D: E: /D Running SCAN with the /D option will delete files so they can not be recovered. Use this option only if you do NOT want to recover any infected files. Otherwise use CLEAN-UP, the universal virus disinfection program. 4. Copy SCAN.EXE to the hard disk and run it from there against any floppies you suspect have the virus on them. QUICK START Page 2 CLEAN-UP (CLEAN) 1. Copy all the CLEAN-UP files to a floppy disk in drive A:. 2. WRITE PROTECT THE DISK!!! 3. Power down the infected system and then boot from a clean, write protected system master diskette. This must be done to remove any viruses from memory that may interfere with the virus removal process. NOTE: If you are unable to access the hard disk after booting from a floppy, check to make sure that any special device drivers needed to use the hard disk are on the floppy and loaded from the CONFIG.SYS or AUTOEXEC.BAT file. Check to make sure the version of DOS is the same version as on the hard disk (or a later version). 4. AT THIS POINT IF YOU HAVE NOT DONE A BACKUP OF ANY CRITICAL FILES ON YOUR SYSTEM, THEN DO SO IMMEDIATELY. 5. Insert the CLEAN-UP disk into the floppy drive of the infected PC and type: CLEAN C: D: E: [virus I.D. code] This will allow CLEAN-UP to disinfect viruses on the C:, D:, and E: drives. If you do not have D: and E: drives, leave them out. For the Jerusalem virus, the ID code is [JERU]. For the Stoned virus, the ID code is [STONED]. For other viruses, use the ID code reported by SCAN, or refer to the VIRLIST.TXT file. Be sure to include the square brackets, "[" and "]." If you are disinfecting a file-infecting virus, such as the Jerusalem, it is recommended that you add the /A switch to the command line to check all files. This will ensure that the virus is removed from any overlay files that may not use the default overlay extensions recognized by CLEAN-UP. If more than one virus type was detected, then CLEAN-UP will have to be run for each type of virus. 5. Turn the computer off and then re-boot from the hard disk, run SCAN to confirm that the virus has been removed, copy CLEAN.EXE to the hard disk, and check any floppies that may have been infected by the virus. QUICK START Page 3 AN IMPORTANT NOTE You have now completed a virus disinfection of your computer system, however, you may have other computers and floppy disks that are infected. You now have a clean PC from which to scan and clean them. Please now take the time to read through the VIRUSCAN and CLEAN-UP documentation to show you the fastest and safest way of completely removing your computer virus infection.