McAfee VIRUSSCAN 5.1 Manuel de service

McAfee VirusScan

Administrator’s Guide

Version 5.1

of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated

into any language in any form or by any means without the written permission of Network Associates,

Inc.

TRADEMARK ATTRIBUTIONS

* ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX,

Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr

Solomon’s, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk,

Hunter, ISDN Tel/Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy,

MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More

Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetScan, NetShield, NetShield,

NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts,

PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty

Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router

PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer,

SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM,

TeleSniffer, TIS, TMach, TMeg, Total Network Security, Total Network Visibility, Total Service Desk,

Total Virus Defense, T-POD, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virex-PC, Virus Forum,

ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000

are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All

other registered and unregistered trademarks in this document are the sole property of their respective

owners.

LICENSE AGREEMENT

NOTICE TO ALL USERS: CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT

("AGREEMENT"), FOR THE LICENSE OF SPECIFIED SOFTWARE ("SOFTWARE") BY

NETWORK ASSOCIATES, INC. ("McAfee"). BY CLICKING THE ACCEPT BUTTON OR

INSTALLING THE SOFTWARE, YOU (EITHER AN INDIVIDUAL OR A SINGLE ENTITY)

CONSENT TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT. IF YOU DO

NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE BUTTON THAT

INDICATES THAT YOU DO NOT ACCEPT THE TERMS OF THIS AGREEMENT AND DO NOT

INSTALL THE SOFTWARE. (IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO THE

PLACE OF PURCHASE FOR A FULL REFUND.)

1. License Grant. Subject to the payment of the applicable license fees, and subject to the terms and

conditions of this Agreement, McAfee hereby grants to you a non-exclusive, non-transferable right

to use one copy of the specified version of the Software and the accompanying documentation (the

"Documentation"). You may install one copy of the Software on one computer, workstation,

personal digital assistant, pager, "smart phone" or other electronic device for which the Software

was designed (each, a "Client Device"). If the Software is licensed as a suite or bundle with more

than one specified Software product, this license applies to all such specified Software products,

subject to any restrictions or usage terms specified on the applicable price list or product packaging

that apply to any of such Software products individually.

Issued July 2000/McAfee VirusScan v5.1 Anti-Virus Software

Administrator’s Guide iii

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii

Anti-virus protection as information security . . . . . . . . . . . . . . . . . . . . . . . . .vii

Information security as a business necessity . . . . . . . . . . . . . . . . . . . . . . . . . .x

Active Virus Defense security perimeters . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

McAfee VirusScan’s anti-virus research . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

Chapter 1. About VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . . . . .15

Introducing VirusScan anti-virus software . . . . . . . . . . . . . . . . . . . . . . . . . . . .15

How does VirusScan software work? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

What comes with VirusScan software? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19

What’s new in this release? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Chapter 2. Installing VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . .27

Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Other recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Preparing to install VirusScan software . . . . . . . . . . . . . . . . . . . . . . . . .28

Installation options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Installation steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Using the Emergency Disk Creation utility . . . . . . . . . . . . . . . . . . . . . . .39

Determining when you must restart your computer . . . . . . . . . . . . . . . .44

Testing your installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

Modifying or removing your VirusScan installation . . . . . . . . . . . . . . . .46

Chapter 3. Removing Infections

From Your System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

If you suspect you have a virus... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

Deciding when to scan for viruses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

Recognizing when you don’t have a virus . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

Understanding false detections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54

Responding to viruses or malicious software . . . . . . . . . . . . . . . . . . . . . . . . .55

Submitting a virus sample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66

Table of Contents

iv McAfee VirusScan

Using the SendVirus utility to submit a file sample . . . . . . . . . . . . . . . .67

Capturing boot sector, file-infecting, and macro viruses . . . . . . . . . . . .70

Chapter 4. Using VirusScan Software . . . . . . . . . . . . . . . . . . . . . . . . . . .77

Using the VShield scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

Using the VirusScan application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

Scheduling scan tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78

Using specialized scanning tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78

Chapter 5. Sending Alert Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79

Using the Alert Manager Client Configuration utility . . . . . . . . . . . . . . . . . . .79

VirusScan software as an Alert Manager Client . . . . . . . . . . . . . . . . . . . . . . .80

Configuring the Alert Manager Client utility . . . . . . . . . . . . . . . . . . . . . . . . . . .80

Appendix A. Using VirusScan Administrative Utilities . . . . . . . . . . . . .85

Understanding the VirusScan control panel . . . . . . . . . . . . . . . . . . . . . . . . . .85

Opening the VirusScan control panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85

Choosing VirusScan control panel options . . . . . . . . . . . . . . . . . . . . . . . . . . .86

Appendix B. Installed Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89

What’s in this appendix? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89

VShield scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89

Dependent and related files for the VirusScan application . . . . . . . . . .95

Alert Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97

VirusScan control panel files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98

ScreenScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100

VirusScan Emergency Disk files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101

Dependent and related files for the E-Mail Scan extension . . . . . . . . .103

Appendix C. Using VirusScan Command-line Options . . . . . . . . . . . .107

Adding advanced VirusScan engine options . . . . . . . . . . . . . . . . . . . . . . . . .107

Running the VirusScan Command Line program . . . . . . . . . . . . . . . . . . . . .107

Appendix D. Using the SecureCast Service to Get New Data Files . .117

Introducing the SecureCast service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117

Why should I update my data files? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118

Administrator’s Guide v

Table of Contents

Which data files does the SecureCast service deliver? . . . . . . . . . . . .118

Installing the BackWeb client and SecureCast service . . . . . . . . . . . . . . . . .119

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119

Troubleshooting the Enterprise SecureCast service . . . . . . . . . . . . . .129

Unsubscribing from the SecureCast service . . . . . . . . . . . . . . . . . . . . .129

Support resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129

SecureCast service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129

BackWeb client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130

Appendix E. Product Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131

Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131

How to Contact McAfee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131

Customer service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132

Technical support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132

Appendix F. Download Information (License ID #: VSF500R) . . . . . . .135

SecureCast™ (For Windows 95/98 Retail Version): . . . . . . . . . . . . . . . . . . .135

Internet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137

Table of Contents

vi McAfee VirusScan

Administrator’s Guide vii

Preface

Anti-virus protection as information security

“Theworld changed [on March 26, 1999]—does anyone doubtthat? The world

is different. Melissa proved that ... and we are very fortunate ... the world

could have gone very close to meltdown.”

—Padgett Peterson, Chief Info Security Architect, Lockheed Martin Corporation,

on the 1999 “Melissa” virus epidemic

By the end of the 1990s, many information technology professionals had

begun to recognize that they could not easily separate how they needed to

respond to new virus threats from how they already dealt with deliberate

network security breaches. Dorothy Denning, co-editor of the 1998 computer

security handbook Internet Besieged: Countering Cyberspace Scofflaws, explicitly

grouped anti-virus security measures in with other network security

measures, classifying them as a defense against malicious “injected code.”

Denning justified her inclusive grouping on based on her definition of

information security as “the effective use of safeguards to protect the

confidentiality, integrity, authenticity, availability, and non-repudiation of

information and information processing systems.” Virus payloads had always

threatened or damaged data integrity, but by the time she wrote her survey

article, newer viruses had already begun to mount sophisticated attacks that

struck at the remaining underpinnings of information security. Denning’s

classification recognized that newer viruses no longer merely annoyed system

administrators or posed a relatively low-grade threat; they had in fact

graduated to become a serious hazard.

Though not targeted with as much precision as an unauthorized network

intrusion, virus attacks had begun to take on the color of deliberate

information warfare. Consider these examples, many of which introduced

quickly-copied innovations to the virus writer’s repertoire:

• W32/CIH.Spacefiller destroyed the flash BIOS in workstations it infected,

effectively preventing them from booting. It also overwrote parts of the

infected hard disk with garbage data.

• XM/Compat.A rewrote the data inside Microsoft Excel spreadsheet files. It

used advanced polymorphic concealment techniques, which meant that

with each infection it changed the signature bytes that indicated its

presence and allowed anti-virus scanners to find it.

Preface

viii McAfee VirusScan

• W32/Ska, though technically a worm, replaced the infected computer’s

WinSock file so that it could attach itself to outgoing Simple Mail Transfer

Protocol (SMTP) messages and postings to USENET news groups. This

strategy made it commonplace in many areas.

• Remote Explorer stole the security privileges of a Windows NT domain

administrator and used them to install itself as a Windows NT Service. It

also deposited copies of itself in the Windows NT driver directory and

carried with it a supporting Dynamic Link Library (.DLL) file that allowed

it to randomly encrypt data files. Because it appeared almost exclusively at

one corporate site, security experts speculated that it was a deliberate,

targeted attack on the unfortunate company’s network integrity.

• Back Orifice, the product of a group calling itself the Cult of the Dead Cow,

purported to give the owner of the client portion of the Back Orifice

application complete remote access to any Windows 95 or Windows 98

workstation that runs the concealed companion server. That access—from

anywhere on the Internet—allowed the client to capture keystrokes; open,

copy, delete, or run files; transmit screen captures; and restart, crash, or

shut down the infected computer. To add insult to injury, early Back

Orifice releases on CD-ROM carried a W32/CIH.Spacefiller infection.

Throughout much of 1999, virus and worm attacks suddenly stepped up in

intensity and in the public eye. Part of the reason for this, of course, is that

many of the more notorious viruses and worms took full advantage of the

Internet, beginning a long-predicted assault by flooding e-mail transmissions,

websites, newsgroups and other available channels at an almost exponential

rate of growth. They now bullied their way into network environments,

spreading quickly and leaving a costly trail of havoc behind them.

W97M/Melissa, the “Melissa” virus, jolted most corporate information

technology departments out of whatever remaining complacency they had

held onto in the face of the newer virus strains. Melissa brought corporate

e-mail servers down across the United States and elsewhere when it struck in

March 1999. Melissa instructed e-mail client programs to send out infected

e-mail messages to the first 50 entries in each target computer’s address book.

This transformed a simple macro virus infection with no real payload into an

effective denial-of-service attack on mail servers.

Melissa’s other principle innovation was its direct attempt to play on end-user

psychology: it forged an e-mail message from a senderthe recipient knew,and

sent it with a subject line that urged that recipient to open both the message

and the attached file. In this way, Melissa almost made the need for viral code

to spread itself obsolete—end users themselves cooperated in its propagation,

and their own computers blindly participated.

Administrator’s Guide ix

Preface

A rash of Melissa variants and copycats appeared soon after. Some, such as

W97M/Prilissa, includeddestructive payloads. Laterthesame year, a number

of new viruses and worms either demonstrated novel or unexpected ways to

get into networks and compromise information security, or actually

perpetuated attacks. Examples included:

• W32/ExploreZip.worm and its variants, which used some of Melissa’s

techniques to spread, initially through e-mail. After it successfully infected

a host machine, ExploreZip searched for unsecured network shares and

quietly copied itself throughout a network. It carried a destructive payload

that erased various Windows system files and Microsoft Office documents,

replacing them with an unrecoverable zero-byte-length files.

• W32/Pretty.worm, which did Melissa one better by sending itself to every

entry in the infected computer’s MAPI address book. It also connected to

an Internet Relay Chat (IRC) server, joined a particular IRC channel, then

opened a path to receive commands via the IRC connection. This

potentially allowed those on the channel to siphon information from the

infected computer, including the computer name and owner’s name, his or

her dial-up networking user name and password, and the path to the

system root directory.

• W32/FunLove.4099, which infected ActiveX .OCX files, among others.

This meant that it could lurk on web pages with ActiveX content, and infect

systems with low or nonexistent browser security settings as they

downloaded pages to their hard disks. If a Windows NT computer user

had logged into a system with administrative rights, the infecting virus

would patch two critical system files that gave all users on the network

—including the virus—administrative rights to all files on the target

computer. It spread further within the network by attaching itself to files

with the extensions .SCR, .OCX, and .EXE.

• VBS/Bubbleboy, a proof-of-concept demonstration that showed that a

virus could infect target computers directly from e-mail messages

themselves, without needing to propagate through message attachments.

It effectively circumvented desktop anti-virus protection altogether, at

least initially. Its combination of HTML and VBScript exploited existing

vulnerabilitiesin Internet-enabledmail systems;itsauthorplayedupon the

same end-user psychology that made Melissa successful.

The other remarkable development in the year was the degree to which virus

writers copied, fused, and extended each others’ techniques. This cross-

pollination had always occurred previously, but the speed at which it took

placeand theincreasingsophisticationofthe tools and techniquesthatbecame

available during this period prepared very fertile ground for a nervously

awaited bumper crop of intricate viruses.

Preface

x McAfee VirusScan

Information security as a business necessity

Coincidentally or not, these darkly inventive new virus attacks and speedy

propagation methods appeared as more businesses made the transition to

Internet-based information systems and electronic commerce operations. The

convenience and efficiency that the Internet brought to business saved money

and increased profits. This probably also made these same businesses

attractive targets for pranksters, the hacker underground, and those intent on

striking at their favored targets.

Previously, the chief costs from avirus attack were the time and money it took

to combat an infection and restore computer systems to working order. To

those costs the new types of virus attacks now added the costs of lost

productivity, network and server downtime, service denials for e-mail and

other critical business tools, exposure—and perhaps widespread distribution

—of confidential information, and other ills.

Ultimately, the qualifying differences between a hacker-directed security

breach in a network and a security breach that results from a virus attack

might become merely ones of intent and method, not results. Already new

attacks have shaken the foundations of Net-enabled businesses, many of

which require 24-hour availability for networks and e-mail, high data

integrity, confidential customer lists, secure credit card data and purchase

verification, reliable communications, and hundreds of other computer-aided

transactional details. The costs from these virus attacks in the digital economy

now cut directly into the bottom line.

Because they do, protecting that bottom line means implementing a total

solution for information and network security—one that includes

comprehensive anti-virus protection. It’s not enough to rely only on

desktop-based anti-virus protection, or on haphazard or ad hoc security

measures. The best defense requires sealing all potential points by which

viruses can enter or attack your network, from the firewall and gateway down

to the individual workstation, and keeping the anti-virus sentries at those

points updated and current.

Part of the solution is deploying the McAfee VirusScan’s Active Virus

Defense* software suite, which provides a comprehensive, multi-platform

series of defensive perimeters for your network. You can also build on that

security with the McAfee VirusScan’s Active Security suite, which allows you

to monitor your network against intrusions, watch actual network packet

traffic, and encrypt e-mail and network transmissions. But even with

anti-virus and security software installed, new and previously unidentified

viruses will inevitably find their way into your network. That’s where the

other part of the equation comes in: a thorough, easy-to-follow anti-virus

security policy and set of practices for your enterprise—in the last analysis,

only that can help to stop a virus attack before it becomes a virus epidemic.

Autres manuels pour VIRUSSCAN 5.1

Table des matières

Autres manuels McAfee Logiciel

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 - LOG FILES FOR Manuel utilisateur

McAfee

McAfee MIS80E001RAI - Internet Security Suite 2006 Manuel utilisateur

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 1 - S... Mode d’emploi

McAfee

McAfee SAV85E - Active VirusScan - PC Manuel du propriétaire

McAfee

McAfee VIRUSSCAN 4.5 - Manuel de service

McAfee

McAfee AGENT 4.0 PATCH 2 - FOR WINDOWS S 10-03-2009 Mode d’emploi

McAfee

McAfee TOTAL PROTECTION 2009 Manuel utilisateur

McAfee

McAfee MSA09EMB1RAA - Site Advisor Plus 2009 Manuel utilisateur

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 2009 Manuel utilisateur

McAfee

McAfee QUICKCLEAN 1.0 Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 5.0 Manuel utilisateur

McAfee

McAfee STUDENT SURVIVAL KIT 1.0-GETTING STARTED Manuel utilisateur

McAfee

McAfee TEECDE-AA-AA - Total Protection For Endpoint Manuel utilisateur

McAfee

McAfee UTILITIES 4.0 Manuel utilisateur

McAfee

McAfee PASCDE-AB-IA - Policy Auditor For Servers Manuel utilisateur

McAfee

McAfee SMEFCE-AI-DA - Email Security Service... Mode d’emploi

McAfee

McAfee VCLCDE-AA-DA - VirusScan Command Line Scanner... Manuel utilisateur

McAfee

McAfee TSA00M005PAA - Total Protection Service Manuel utilisateur

McAfee

McAfee NETSHIELD - FOR NETWARE SERVERS Manuel utilisateur

McAfee

McAfee FIREWALL 2.1-GETTING STARTED Manuel utilisateur

McAfee

McAfee MTP08EMB3RUA - Total Protection - PC Manuel utilisateur

McAfee

McAfee VIRUSSCAN HOME EDITION 7.0 Manuel utilisateur

McAfee

McAfee EBCACE-AA-HA - E-Business Client - PC Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur