WDR Computer Club Digital 1996 October/CLUB10_96.BIN/antiviru/imast/imast302.exe/QUESTION.TXT

Text File | 1996-07-17 | 33KB | 641 lines

╔═════════════════════════════════════════════════════════════════════════════╗
║                                                                             ║
║ Welcome to QUESTION.TXT!  Hopefully you'll find the answer to your question ║
║ in this collection.                                                         ║
║                                                                             ║
║ o If you have a general question about data integrity, security, viruses,   ║
║   system sectors or similar things, the help index in Integrity Master may  ║
║   provide the answer (Hit F1 and then "I").  If that fails, read the manual ║
║   (file I-M.DOC), especially part two on "Data Integrity and Viruses".      ║
║                                                                             ║
║ o If you're having trouble using the menus in Integrity Master try the      ║
║   tutorial offered in SetupIM.                                              ║
║                                                                             ║
║ o If all else fails, please contact us or the Advanced Support Group for    ║
║   assistance.  See details in file SUPPORT.DOC (IMVIEW SUPPORT.DOC          ║
║   to read this file).                                                       ║
║                                                                             ║
╚═════════════════════════════════════════════════════════════════════════════╝

Q: Integrity Master said a file has an invalid time/date stamp or a file
   date is set into the future.  What should I do?

A: Some viruses mark files as infected by setting the date ahead 100 years
   or by setting the fields in time to stamp to 60 or 62.  This can also
   be caused by buggy software and is occasionally done deliberately. If
   you see this on only an isolated file, you probably have nothing to
   worry about. If you see this on a group of files associated with the
   same program, you should contact the company that produced that program
   to check if that is normal behavior or a bug.  If you have many files
   with this, read the next question:

Q: IM reports invalid time and date stamps on many of my files.  Do I have
   a virus?

A: Maybe!  If it's only executable files with the illegal values, you'll
   need to check further to make sure there's no unknown virus on the
   loose.  If you have such a virus, IM should be detecting unexplained
   changes to executable programs.  Try following the procedures
   outlined in the manual (or the I-M.DOC file) for determining if file
   changes are due to viruses.  (Basically, what you do is to run a full
   check, execute a suspect program, cold boot, and run another full
   check.)  There are some common causes for files to have illegal time
   and date stamps (such as 62 seconds):

   1) There is reportedly a backup program ("Intelligent Backup") which
      marks files by setting the seconds field to an illegal value.

   2) Some anti-virus products attempt to "immunize" your files by setting
      the seconds of time stamp of your programs to 62.  This works only
      against a handful of viruses but some programs do this anyway.

   3) Central Point's (PC Tools) Datamon will reportedly mark encrypted files
      by setting the seconds field to 62.


Q: Integrity Master found some duplicate files (files starting with the
   same name but ending in .COM, .EXE or .BAT).  Do I have a virus?

A: You could have a companion virus.  This is a virus which plants extra
   files to match your legitimate programs (See the manual for details
   on how this works.)  If you see only isolated instances of such
   files, it is usually nothing to worry about.  If you have any concern
   this may be virus, run IM regularly in full check mode and if you see
   additional such files reported, you probably have a virus.  Such a
   virus can be removed by simply deleting the extra files.


Q: I asked IM to scan a floppy but it froze.

A: You probably have a diskette with an invalid boot sector (some viruses
   cause this).  It's actually DOS that crashes when IM asks DOS to read
   the diskette.  You can use the "Scan floppy Boot sectors" option
   on the "Check" "Disk for known viruses" submenu (or the /VB command line
   option) to have IM scan this boot sector for viruses.  In this case, IM
   will bypass DOS and directly read the boot sector.

Q: I start SetupIM and suddenly nothing happens or I see the display
   scroll and then get disorganized.  The program seems to be stuck.

A: Insert formatted media (e.g., diskettes) in all removable drives, run
   SetupIM, and try waiting about 10 seconds and hitting the ENTER key
   several times.  You may be using a program which is trying to write a
   message to the screen while SetupIM is checking out your disk drives.
   You can safely ignore any garbage which appears on your screen. SetupIM
   will write a full report to file IMPROC.TXT.  Be sure to check this
   file.   The most common cause for this type of problem is using
   DRIVER.SYS to assign a duplicate drive letter to a floppy drive:

   You may have a statement like this in the \CONFIG.SYS file:

                 DEVICE=DRIVER.SYS /D:0 /F:0

   The numbers could be 0 as above or have some other value.  DRIVER.SYS
   may try to write a message to the screen to ask you to insert a new
   disk and hit a key when SetupIM checks this drive. Deleting this line
   should solve the problem. Once you finish running SetupIM you may
   restore the line. IM will have know enough not to access the
   duplicate logical drive.

Q:  Sometimes IM comes up with different colors on the screen than before.
    What's going on?

A:  IM checks the DOS video mode indicator on your PC to see if you are
    in color or monochrome mode, as well as directly checking your video
    adapter.  This allows you to use the DOS "MODE BW80" to indicate
    that a two-color display is present on a color adapter card.  Some
    programs change this value to an incorrect value.  If this happens
    to you, use the DOS mode command to set the video mode back to the
    correct state.  For example, enter "MODE CO80" to restore normal
    color mode.  You can also use the command line override (or SetupIM)
    so IM comes up using whatever colors you prefer.  "IM /C" would
    force IM to use color mode.

Q:  I just tried to do a check or initialize on my hard disk. Integrity Master
    replied that this disk was not working.  It IS working!  What's wrong?
                                                ~~
A:  File "DISKhelp.TXT" describes how to correct this problem. Read file
    DISKhelp.TXT using your favorite program, copy it to your printer ("COPY
    DISKHELP.TXT PRN") or enter the command:
          IMVIEW DISKHELP.TXT
    to display this file.

Q: I just entered the command IMVIEW (or IMPRINT) and nothing happened. My
   PC just said "Bad command or file name".

A: IMVIEW.COM and IMPRINT.BAT must be either in the current directory or
   in one of the directories in your DOS path.  To put these in the path,
   enter the command PATH at the DOS prompt and you'll see a list of
   directories on your disk.  You can copy IMVIEW.COM or IMPRINT.BAT into any
   of these directories.

Q: I don't have my original DOS install diskettes to do a clean boot from. How
   do I install Integrity Master?

A: It's only important to have a certified clean copy if a virus may already
   in control of your PC.  In most cases you can safely install using your
   DOS files in place on your hard disk.

Q: I use DOS 4.0. I get a message saying that SHARE needs to be loaded for
   large media, when I boot from diskette.   Do I need to copy SHARE.EXE to
   my Integrity Master boot floppy?

A:  Integrity Master does not need SHARE.  You may wish to copy it so other
    programs can use it.  If so, just copy it to your diskette. DOS will
    automatically load it when you boot.

Q:  I just checked several disks but I can't find the report file.  What
    happened?

A:  If you have the report file option turned on in automatic mode (check the
    OPTION menu), then the report file is written to the first disk that you
    check.  If you later switch to check another disk, without turning off the
    report file, the reports will still go to the same file on the same disk.
    You can choose to have this file always written to the same disk by
    selecting this on the OPTION menu.

    If you specified a report file name "of your choice", and did not
    include a drive or directory specification as part of the file
    name, then it will be written to the current disk and directory when
    you start checking or initializing.

Q:  Other anti-virus products don't say I have to boot my PC before checking
    my files; why do I have to boot before checking with Integrity Master?

A:  Actually, if you thoroughly read your documentation you'll probably see
    that your product DOES suggest you boot from a diskette; we're just
    a bit more up front about this issue.  If you're satisfied with the level
    of protection obtained from other products without booting, then you don't
    need to boot. IT IS OUR GOAL TO PROTECT AGAINST ALL VIRUSES NOT JUST KNOWN
    VIRUSES.  The reason we ask you to boot from a write protected floppy
    before checking, is that this is the ONLY way to be sure that a virus is
    not already resident and in control of your PC.   Integrity Master
    checks memory for resident viruses, so it is somewhat safe NOT to boot.
    If you choose to do this, be sure you always have the latest version
    of Integrity Master.

Q:  I want to write my reports to my printer.  IM reports that my printer
    isn't working, but it is!  What can I do?

A:  You have a printer which is not compatible with the standard IBM BIOS
    functions that IM uses.  There's an easy way around this.  Just use
    the OPTION menu to write the reports to a file called "PRN".  This
    will allow DOS to route the print for you.

Q:  IM just detected a change to a program.   Only this one program changed,
    I don't think it's a virus.   What are some programs known to change
    themselves?

A:  There are too many programs to list them all here.  Many programs will be
    changed when you run the install or option update program for that
    program.  WordStar is a well known example.  A new program is SETVER.EXE
    which is part of DOS 5.  Whenever you run SETVER to set the DOS version
    for a program, SETVER stores this information by modifying its own code.
    This will result in IM reporting a change to SETVER.EXE every time you
    run the program.    Changing certain options in MicroSoft Windows (R)
    will also change the program itself (WIN.COM).

Q:  IM keeps reporting that my boot sector has changed.  It is NOT reporting
    a known virus. The boot sector seems to change every day. I don't think
    I've got a virus.  What's going on?

A:  If your boot sector keeps changing repeatedly and you have an older HP
    or Zenith PC, you may have one of the models that changes its boot
    sector every time you boot.  If you use a program like STACKER which
    establishes a virtual (not a real) disk, do not be concerned if the boot
    sector on the virtual (e.g., Stacker) disk keeps changing.  This is normal
    behavior.  As a matter of fact, changes to the boot sector of any disk
    which can not be booted from, generally do not represent a problem.  If
    you have any doubt about whether it's a virus, save a few of your
    BOOT.SRL files (Run an Initialize boot sector after IM reports a change)
    and send these along with the other information called for in file
    SUPPORT.DOC to us.  We'll check to see if a virus might be present in
    your boot sector.

Q:  I use an executable compression program (e.g., LZEXE or PKlite), am I in
    danger of the compressed files being infected?

A:  If a virus should infect ANY of your files, compressed or not, IM can
    detect this fact.  So if a virus should infect a compressed executable
    file, IM will have no trouble detecting this.  On the other hand if a
    known virus infects a program and then that program is compressed, IM
    may or may not recognize the virus in the compressed file.  However if
    the virus should attempt to spread, IM will detect this.

Q:  IM just detected a virus in one of my system sectors, and says to
    reload the system sector.  I've never run an "Initialize", so I don't
    have the sector reload file (.SRL).  Help!   What do I do?

A:  This reinforces an important point: DO AN INITIALIZE ON ALL YOUR DISKS
    SO THAT YOU CAN EASILY RECOVER ANY DAMAGE TO A SYSTEM SECTOR.  Don't wait;
    DO IT NOW!  If you lost your boot sector, you're in luck, otherwise you
    have some serious work ahead of you.

    BEFORE YOU DO ANYTHING, POWER OFF AND BOOT FROM A WRITE PROTECTED DISKETTE
    CONTAINING A CLEAN COPY OF DOS THEN:

  o Use the "Floppy boot sector" on the "ReLoad" menu to clean floppy
    diskettes.

  o Partition sector viruses can be removed with the "PArtition boot code"
    option on the "ReLoad" menu.

  o For boot diskettes, you can manually reload the DOS boot sector
    by entering the command: "SYS C:" where "C" is the drive with the
    damaged boot sector.  You must logged on to drive A: when you enter
    this command.

Q: I have a system sector virus but when I boot from floppy, I can't access
   my hard disk.  What do I do:

A: You have a virus like Monkey or Urkel.

   If you can not access your hard disk after booting from floppy, follow
   these steps:

   1) Boot from your infected hard drive.

   2) Insert a diskette containing IM.EXE and IM.PRM in drive A. (A: in
      this example but B: is fine also.).

   3) At the C: prompt type "A:IM /IP /B" (without the quotes). This will
      allow IM to create an uninfected copy of your partition sector in file
      PART.SRL in your root directory.

   5) Copy PART.SRL to a floppy. (e.g. "COPY C:\PART.SRL A:") DO NOT COPY
      IT TO THE INTEGRITY MASTER OR THE BOOT DISKETTE.

   6) Cold boot (as explained above) from the write-protected "DOS"
      diskette.

   7) Insert the IM diskette and execute IM (do not boot from this
      diskette).

   8) Insert the diskette containing the PART.SRL file into a drive (you
      may remove the diskette with IM.EXE to do this.)

   9) Go to the Options menu, hit "R" to select "Report" and then select
      "Nowhere" to turn off the report (this avoids IM trying to write
      a report while we remove the virus.

  10) Select the ReLoad menu and then select "Missing partition".  Select
      "Physical hard disk" and enter number 0 (zero).  This will remove the
      virus and you can now continue booting from your hard drive.

  11) Please use IM to check all diskettes for infection. We recommend
      you copy the files off the diskettes and reformat or discard them.



Q:  When I first start IM, I see something red flash on my screen, but I
    can't make out what it says.

A:  When IM first starts, it looks for the parameter file (IM.PRM)
    which contains all your option settings.  On some PCs this can be a
    slow process, so IM announces that it is: "Searching for and reading
    parameter file."   On faster PCs, this message appears as barely a blur!

Q:  IM says I have a virus resident in memory, but I doubt this, since I have
    another anti-virus product which reports nothing.  What's going on?

A:  Some anti-virus products execute as a resident program (TSR) to monitor
    your system and check for signs of known viruses.  To check for these
    viruses, they use fragments of the same viruses that IM checks for.
    It's a standard practice to keep these fragments encrypted or stored in
    pieces, but some products don't follow this practice.  You probably have
    such a product.  To double check, remove any line in your CONFIG.SYS and
    AUTOEXEC.BAT file which executes this product(e.g., VWATCH or VSAFE).
    Cold boot your PC.  Now run IM.  If the other product was at fault,
    IM will now detect no virus.

Q:  I'm using STACKER on my PC and IM keeps reporting boot sector corruption
    on my stacker volume.  What gives?

A:  STACKER closely simulates an actual DOS disk drive on its volume. It
    pretends to have an actual boot sector.  This boot sector is not a real
    boot sector and may change from moment to moment.  Viruses can not spread
    by infecting this boot sector and since it can change at any time,
    checking this boot sector is a waste of time.  When you check a STACKER
    volume, just check the files and not the system sectors. Don't do a
    "Check Entire disk integrity" which includes the system sectors on the
    STACKER volumes.  If you use the command line, use "/CD" rather than
    "/CE".  Automatic handling of STACKER volumes will be available soon.

Q:  IM reports corruption of its own report file.  Why?

A:  This happens in one circumstance.  If you select a report
    file with a name of your own choice and then check the disk and
    directory containing that report file, IM will write to that file
    between the time that it checks it and the time that the file is
    closed.  We recommend using auto-named report files or placing them
    on a disk different from the disk being checked to avoid this message.

Q:  I am getting errors when reading a disk I think is working OK.
    Why does IM report an error.

A:  See file DISKhelp.TXT

Q:  How do I get rid of that wait for a keypress at the end of processing.

A:  If you enter a command line parameter such as "/CR" or "/CD", and
    specify no pause either by using the option menu or with the
    "/N" or "/NE" parameter, IM will pause only briefly after it
    finishes checking.

Q:  How can I quickly remove boot sector viruses (such as Stoned or
    Michelangelo) from numerous diskettes?

A:  Use the "Reload floppy boot sector" option on the IM "ReLoad" menu.
    This will quickly replace the infected boot sector with a clean
    (and self-checking) boot sector.

    IMPORTANT NOTE: we advise copying all files from infected diskettes
    and reformatting the diskettes.  Many common boot sector viruses
    corrupt the FAT/directory structure on the diskette. This can lead
    to future data loss if you do not reformat these diskettes.

Q:  How can I avoid having separate report files on each disk IM checks?

A:  Use the Options menu to set the auto-named report file to go to
    a specific disk of your choosing.  All reports will then go to this
    disk, independent of the disk being checked.

Q:  I see:  "Changes in directory xxxxxx:" but no changes appear on my
    screen.  Why is this?

A:  If you have asked IM to exclude files or directories from checking,
    IM will remove their associated integrity data the next time you
    run a check.  If you have asked IM not to tell you about excluded files
    or directories, it will still alert you that it is updating the
    integrity data for directories where something is being excluded.
    This notice appears only once when IM first removes the preexisting
    integrity data for the excluded files and directories.

Q:  Integrity Master reported a file as having a problem or being suspicious
    yet I didn't see why.  Where's the explanation?

A:  You probably have your halt options set to halt only on serious
    problems or emergencies.  In this situation the detail information is
    written only to your report file.  Please read the report for the
    detail information on what was found wrong with the file.

Q:  I tried the "/L" option on my laptop but the screen is not very legible.

A:  The "/L" (LCD) option is intended for older CGA compatible laptops such
    as the Toshiba 1000.  Newer laptops (especially VGA gray scale displays)
    should work fine with no special video override.  If the display doesn't
    look right on a newer laptop try the "/M" rather than the "/L" command
    line switch.

Q:  When I run Integrity Master on an empty directory, it lists a large
    number of files as deleted (or sometimes added).  These files don't
    exist there.

A:  You are using the DOS "APPEND" command.  This makes files appear to be
    present in any directory which are actually in the appended directory.
    Type "APPEND" and hit ENTER to see if you are using it. When you
    installed DOS this command may have been placed in your AUTOEXEC.BAT
    file.   You almost certainly don't need it.  If you don't want to
    get rid of it, just enter the command "APPEND ;" before you execute IM
    or include this in a .BAT file to execute IM.

Q:  I don't like the way IM displays dates or times.

A:  Execute SetupIM and select "Change Format for date or time" from the
    "Advanced option" menu.

Q:  I registered an earlier version of IM; can I download and use the current
    shareware (evaluation) version on my system?

A:  If you have registered or upgraded to version 2.31a or later, any
    shareware version will work as the registered version.  (This is true
    for shareware versions released up to 12 months after your paid
    registration.)  You must use the IM.PRM file that you created with
    registered version 2.31a or later.  If you have lost this, get your
    IM diskette with the IM.DAT file--then run "SetupIM /U".  This reads
    the IM.DAT from the diskette and updates the license information
    stored in your IM.PRM file.

Q:  IM keeps find the same changes every time it runs. It appears that it
    is not updating its integrity data.

A:  If you run IM from the command line with halt turned off (/N, /NE or /ND),
    it will stop updating your integrity data if it finds a damaged file.
    It does this because it assumes it is running unattended and can't ask
    you what to do about the damaged file.  If you do want IM to update the
    integrity data just run from the menus or with a lower halt setting.
    IM will then ask you whether to update the integrity for the
    corrupted file. Check your report for disk corruption and run IM
    from the menus to let let it update t

Q:  IM reports that integrity data for a directory is invalid or a *.SRL
    file is damaged.  What do I do?

A:  This could be due to a hardware problem but it's most likely due to
    doing another "first time" install with SetupIM.   When you run
    SetupIM and specify a new install, it will look for an existing IM.PRM
    file.  If it finds one, it will offer to "Keep the old check algorithms".
    If you do NOT select this option, IM will select different encryption
    and check algorithms. This means that when IM uses the new IM.PRM that
    is created by SetupIM, it will be unable to decrypt the old integrity
    data files.

    If this has happened to you, it's best to delete then new incompatible
    IM.PRM and locate the old IM.PRM files.  If this is impossible or if
    something else such as a hardware problem damaged your integrity data,
    then you will need to use the "Initialize" menu to create new integrity
    data files.

Q:  IM says my disk does not have a boot sector or it fails while trying to
    read the boot sector.

A:  You may be running software such as the Artisoft Lantastic network server.
    This software intercepts all disk access and makes even local disks
    simulated (network) disks.  These disks do not have a boot sector.
    To allow IM to run in this situation, shut down the server or start
    only your network redirector (without the server component).  Alternately,
    ask IM to check only the files (use /CD rather than /CE) when this
    software is active.

Q:  Integrity Master is finding file corruption but it's not reporting a virus
    and I think my disk is OK.  What could be wrong?

A:  Check the following items:


    If your disk uses disk compression (e.g., Stacker, DoubleSpace,
    DriveSpace, SuperStore, etc.) try disabling all other resident (TSRs
    and drivers) software including your disk cache.  There may be a
    conflict causing the corruption.

    Turn off your disk cache and see if the problem goes away.  It may be
    conflicting with another resident program or a hardware disk cache.

    Run Scandisk or similar program to read your entire disk and check for
    hardware errors.

    Boot with no config.sys or autoexec.bat file and see if the problem goes
    away. If not, then you are probably having hardware problems.  If the
    problem does go away, then try adding back your files one line at a time.

Q:  I am using IM under Win95. When I start Win95, it present a window titled
    "Open with" and asks me what program to use to open one of IM's integrity
    data files (e.g., "ZZ##.IM").  I also see these files in different folders.
    How do I eliminate this nuisance?

A:  Integrity Master, if installed with the default options, will place
    integrity data files into all subdirectories including the Startup
    subdirectory.  Unfortunately, Windows95 mistakes these files for
    application related files and will want to know what to do with
    them. There are several solutions to this:

    1) Run SetupIM (not a new install) and select "Integrity data Options".
       Then select "Change attribute" and turn on the hidden attribute.

       THIS IS DONE AUTOMATICALLY FOR NEW INSTALLS OF IM.  If you have done
       a new install and you still see the IM files, you may have changed
       the setting that hides "hidden" files. To correct this, start the
       Win95 "Explorer" and click on "View", then click on "Options..."
       and select the "hide" option.

    2) Use the IM Options menu to exclude subdirectory "Startup".

    3) You can remove the integrity data files from your hard disk and then
       use setupIM to place your integrity data files on a different
       device:

       1) From the IM "CoMands" menu select "Uninstall". This removes the
          existing integrity data files.

       2) Run SetupIM (not a new install) and select "Integrity data Options".
          Then change  the location of the integrity data to "Separate floppy
          disks".  You will then need a separate floppy diskette to hold the
          integrity data for each disk you check.

    4) Start the Win95 explorer and then click on "View", then click on
       "Options...", and then click on "File types" and click on "New".
       You can now enter "Integrity data" as the file name and the extension
       you are using for integrity data files (e.g., "IM").  You do not need
       to assign any program--just leave this blank.  This will prevent Win95
       from asking you how to open the integrity data files.


Q: I use DiskManager (or other third party hard disk partitioning software)
   to support my large hard drive.  What special precautions should I take?

A1: We suggest you upgrade to a controller that has a BIOS on the board
    that directly supports your hard drive.  This will make you system
    much safer and more reliable than using this software.

A2: Some products such as DiskManager DDO (Dynamic Drive Overlay), replace
    the real partition sector (AKA Master boot record) with their own code.
    If you boot from a plain DOS diskette, and can't access your hard drive
    you may have such software. Diskmanager and most similar programs
    can also be loaded from a DEVICE= statement in your CONFIG.SYS file.
    You will need such a statement to access your hard drive from a boot
    floppy.  It is important to prepare such an emergency boot diskette.

    If you have the software installed in the partition sector (e.g.,
    DDO), rather than with a DEVICE= statement, do NOT use IM to reload
    the partition sector but use the product diskette to reinstall the
    partition sector. These type of products create a non-standard
    partition sector that IM may not be able to safely reconstruct.

Q: I want to use the "Partition boot code" option on the ReLoad menu to
   remove a virus (I haven't run an initialize for the parition sector
   yet so I have no saved copy to reload). How can I be sure this is safe?

A: This option replaces the partition sector boot code (not the partition
   table) with a clean, self-checking boot program.   This will work
   if your partition sector loads a standard operating system (Win 3.1x,
   WinNt, Win95, DOS, OS/2, etc.) but will NOT if a non-standard program
   is in the partition sector such as Diskmanager (see the prior question).

   To verify that it's safe to rewrite your partition sector, boot from
   a clean floppy (without a CONFIG.SYS or AUTOEXEC.BAT file).  If
   you can NOT access your hard disk normally (you don't see the files
   and directories you expect on your hard disk), then you should NOT
   use "Partition boot code" option to rewrite your boot sector.  You
   either have the software described above or you have a virus like Monkey
   or Urkel that doesn't leave a valid partition table.  You can follow
   the procedure described earlier in this file to remove viruses like
   Monkey or Urkel.

 Q:  IM says: "Disk has invalid partition table!"  What does this mean
     what do I do about it.

 A:  The partition table is the table in the partition sector that
     describes how your disk organized. It determines how much space is
     allocated for each logical disk on your physical hard disk. This
     table is initially created using the FDISK program.  Without this
     information, it is not safe to write to your hard disk.  IM checks
     this for validity before offering to replace executable code
     in your partition sector.

     If the partition table is invalid, it means one of three things:

     1) You have special software installed that replaces the standard
        partition sector with its own program. If this is the case, you
        can let IM reload the partition sector from its saved version
        but it's not safe to have IM replace just executable code; you
        must reinstall the original software to fix problems in the
        partition sector.

     2) You have a virus such as Monkey or Urkel. In this case follow
        the procedure (earlier in this file) to remove the virus.

     3) Your partition sector has been corrupted.  You must either
        reload the sector by using the "Missing partition" option on
        the reLoad menu or use your partitioning software (e.g.,FDISK or
        Disk Manager) to recreate the partition sector.

Q:  How do I use IM with WinZip?

A:  IM can be used as the scanner with the checkout feature of WinZip.
    Under Windows Filemanager open an archive, then under Winzip select
    "program locations".  For "Scanner", specify:

    C:\IM_HOME\IM.EXE

    (or whatever location you are using to keep your IM.EXE file)

    and for "Parameters" specify:

    /N /UN /B /VL /RF=%f /P%d

 Q: SetupIM or IM will not recognize the system sector (partition or boot)
    on my hard disk.

 A: You are running some software (such as security software or network
    server software) that is preventing us from accessing your disk directly.
    You must end these programs.  WfWG, Win NT, and Win 95 provide network
    server capability. This software can be active even if you are not
    running a local area network and will prevent secure access to your
    partition sector.

    If you are having this problem under Win 95, it's almost always the
    the fact that your PC is making files available to the network (acting
    as a server). You can click on "My computer" and

 Q: Integrity Master is finding a macro virus in a file that has already been
    cleaned. What do I do?

 Q: I don't what to let IM delete infected MS Word documents or manually delete
    delete the macros with either Tool/Macro or File/Templates/Organizer/Macro;
    what else can I do?

 A: (to both questions) Create a new document and copy the text from the
    infected document into the new one. Then delete the infected document.


 Q: I am using Windows/NT. IM is not finding the HD boot sectors. How do
    I check these under NT?

 A: You can get full protection for your files by running IM directly under
    NT but you will have to run both SetupIM (so IM recognizes the boot
    sectors) and IM after booting DOS to check the actual boot sectors
    of the hard disk.