1.0 What is F-STOPW F-STOPW is a memory resident anti-virus program which provides Windows 95/98 users with real time ("on access") scanning. The program does not run under Windows 3.x or Windows NT. Unlike VIRSTOP.EXE which was included in versions 2.x of F-PROT and only ran under older versions of Windows, F-STOPW has the same detection rate as the main scanner F-PROT. We do not recommend that you run F-STOPW simultaneously with other resident antivirus programs. 2.0 Installation of F-STOPW The file SETUPFS.EXE is an installation file for F-STOPW. When it is run the program starts to set itself up automatically. 3.0 Using F-STOPW When installation is complete, F-STOPW is run and on every start-up (bootup). When F-STOPW is active, the icon for F-STOPW can be seen in the right corner of the system tray. Right-clicking on the icon activates a small menu with the following options: Disable: F-STOPW stops monitoring the system temporarily, i.e. until the user enables F-STOPW again or on re-boot. This also changes the menu. The menu the changes "Disable" to "Enable". Over the F-STOPW icon appears a "forbidden" sign. Enable: F-STOPW starts monitoring the system again and just as when the program is disabled the menu changes, this time from "Enable" to "Disable" and the "forbidden" sign disappears Properties: Activates a settings menu. This menu can also be activated by double-clicking on the F-STOPW icon with the left mouse button. See section 4 for further details. Exit: This option shuts down F-STOPW and the icon disappears from the system. 4.0 Settings in F-STOPW In the upper left corner of the settings menu F-STOPW's version number is shown. The settings menu is divided into 6 pages. Properties: Settings, which indicate how F-STOPW should scan, i.e. what, how and when. Action: F-STOPW's reactions to an infection, for example: deny access or delete. Report: Settings for log report. All actions can be logged to a file. Exclusions: Here certain folders can be excluded from the scanning process. Information: Information on the last file F-STOPW scanned and statistical information. About: Here you can find the version number as well as information on how many viruses F-STOPW detects and the age of the database, SIGN.DEF and MACRO.DEF files, that F-STOPW uses. The settings window has four buttons: OK: Alterations (if any) become effective at once and the settings menu disappears. Cancel: Cancels all alterations at the time and the settings menu disappears. Apply: Has the same function as the OK button, but the settings menu stays on the screen Help: This document. 4.1 Properties In the "What to scan" section of the Properties page, settings can be made on how and what F-STOPW scans. Program Files: F-STOPW scans files, which could contain viruses (default setting). It is possible to add or exclude file extensions by selecting "Program Files". When selected, a small window pops up. There the user can either add or exclude file extensions. Only macros: F-STOPW scans only for macro viruses, i.e. viruses in Word and Excel files. All files: Scans for viruses in all files. In the lower section of the properties page the following options are: Inside Archives: Scans inside compressed files such as zip files. Compressed executables: Scans inside compressed executables. Floppy boot sectors: Scans boot sectors on diskettes (default settings). Heuristics: Uses heuristics when scanning. Attempts to detect unknown viruses with the use of heuristics (rules that describe the behaviour and structure of viruses). Increases the detection rate, at the cost of increase in chance of false alarms. In the "Scan files on" section the user can set when F-STOPW scans. Open, Copy, Run: F-STOPW scans files when they are opened, copied or run. Create, Download: F-STOPW scans files when they are created or downloaded from the Internet. Both: Combines both the above options (default setting). The "General" section has three options. Scan floppies on shutdown: F-STOPW scans the floppy drive when either F-STOPW is turned off or Windows is shutdown (default setting). F-STOPW can be disabled: Enables the user to disable F-STOPW from the system tray. Show icon on taskbar: The F-STOPW icon is shown on the system tray (default setting). 4.2 Action If a virus is found, you can choose between six different reactions. Deny access: F-STOPW denies access to the infected file (default setting) Rename automatically: Infected files are automatically renamed. Move automatically: Infected files are automatically moved to a folder. Delete automatically: Infected files are automatically deleted. Disinfect automatically: Infected files are automatically disinfected. Report only: Only reports that a virus has been found. Only log to report. By choosing the "Only log to report" option, the program will NOT display a message on the screen if a virus is found. The selected action (deny access, rename, move, delete, disinfect) will, however, still be performed. It will only be logged to the report file. If you have the "Only log to report" checkbox checked, you will not be allowed to turn off the reporting to a file. 4.3 Report It is possible to create a report file onto which the following information can be logged: Virus infection: All virus infections are logged to the report file. Virus disinfection: All virus disinfections are logged to the report file. Delete: All deleted files are logged to the report file. Move, Rename: All instances of moved or renamed files are logged to the report file. User: The user name at the time of the infection is logged to the report file. Date and Time: The date and time at the time of the infection is logged to the report file. Settings: The setting chosen in the "Properties" and Action" sections are logged to the report file. Summary: A summary of everything in the "Information" section is logged to the report file. To activate this the "Log to file" option must be selected. By selecting the "Append to log file" option as well as the "Log to file" option the report is logged to the last report file created. 4.4 Exclusion Here the user can exclude folders from scanning. Selecting "Add" activates a window where the user can specify what folders should be excluded from the scanning process. The "Remove" button serves as the opposite of the "Add" button. Future versions of F-STOPW will enable users to select files as well as folders. 4.5 Information Last file scanned: Displays the path of the last file scanned. Statistics: Files / Boot sectors Scanned: The number of files / boot sectors scanned. Infected: The number of infected files / boot sectors. Suspicious: The number of suspicious files / boot sectors (i.e. files / boot sectors which may possibly be infected. Action: Disinfected: The number of files which have been disinfected. Renamed: The number of files which have been renamed. Deleted: The number of files which have been deleted. Moved: The number of files which have been moved. 4.6 About Here you can find the version number as well as information on how many viruses F-STOPW detects and the age of the database, SIGN.DEF and MACRO.DEF files, that F-STOPW uses.