User manual MCAFEE VIRUSSCAN 4.5 ADMINISTRATOR GUIDE

[. . . ] McAfee VirusScan Administrator's Guide Version 4. 5 COPYRIGHT Copyright © 1998-2000 Networks Associates Technology, Inc. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc. , or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS * ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, CNX, Compass 7, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr Solomon's, Enterprise Secure Cast, First Aid, ForceField, Gauntlet, GMT, GroupShield, HelpDesk, Hunter, ISDN Tel/Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy, MagicTree, Magic University, MagicWin, MagicWord, McAfee, McAfee Associates, MoneyMagic, More Power To You, Multimedia Cloaking, NetCrypto, NetOctopus, NetRoom, NetScan, Net Shield, NetShield, NetStalker, Net Tools, Network Associates, Network General, Network Uptime!, NetXRay, Nuts & Bolts, PC Medic, PCNotary, PGP, PGP (Pretty Good Privacy), PocketScope, Pop-Up, PowerTelnet, Pretty Good Privacy, PrimeSupport, RecoverKey, RecoverKey-International, ReportMagic, RingFence, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer, SniffMaster, SniffNet, Stalker, Statistical Information Retrieval (SIR), SupportMagic, Switch PM, TeleSniffer, TIS, TMach, TMeg, Total Network Security, Total Network Visibility, Total Service Desk, Total Virus Defense, T-POD, Trusted Mach, Trusted Mail, Uninstaller, Virex, Virex-PC, Virus Forum, ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000 are registered trademarks of Network Associates and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. [. . . ] Virus Research 20460 NW Von Neumann Drive Beaverton, OR 97006 In the United Kingdom: Network Associates, Inc. Virus Research Gatehouse Way Aylesbury, Bucks HP19 3XU UK In Germany: Network Associates, Inc. Virus Research Luisenweg 40 20537 Hamburg Germany In Japan: Network Associates, Inc. 33 3-8-21 Toranomon, Minato-Ku Tokyo Japan 105-0001 In Australia: Network Associates, Inc. Virus Research 500 Pacific Highway, Level 1 St. Leonards, NSW Sydney Australia 2065 In Europe: Network Associates, Inc. Virus Research Gatwickstraat 25 1043 GL Amsterdam Netherlands NOTE: McAfee AVERT Labs does keep all submitted samples, but once you submit a sample, AVERT cannot return it to you. AVERT does not accept or process Iomega Ditto or Jazz cartridges, Iomega Zip disks, or other types of removable media. Administrator's Guide 95 Removing Infections From Your System 96 McAfee VirusScan Anti-Virus Software 4U sing VirusScan Software 4 Using the VShield scanner The VShield scanner protects your system in the background, as you work with your files, in order to prevent infection from viruses that arrive via floppy disks, from your network, embedded in file attachments that come with e-mail messages, or from your computer's memory. The scanner starts when you start your computer, and stays in memory until you shut down. The VShield scanner also includes technology that guards against hostile Java applets and ActiveX controls, and that keeps your computer from connecting to dangerous Internet sites. Secure password protection for your configuration options prevents others from making unauthorized changes. NOTE: In order for some VShield scanner features to become active, you must do a custom installation of these modules: Download Scan and Internet Filter. To learn how to configure VShield properties and how to start and stop the VShield scanner, see Chapter 4, "Using the VShield Scanner, " in the VirusScan User's Guide. Using the VirusScan application The VirusScan name applies both to the entire set of desktop anti-virus program components described in the User's Guide, and to a particular component of that set: SCAN32. EXE, or the VirusScan application, which allows you to run "on-demand" scan operations. "On demand" means that you as a user control when VirusScan software starts and ends a scan operation, which targets it examines, what it does when it finds a virus, or any other aspect of the program's operation. Other VirusScan components, by contrast, operate automatically or according to a schedule you set. VirusScan software originally consisted solely of an on-demand scanner--features integrated into the program since then provide a cluster of anti-virus functions that give you maximum protection against virus infections and attacks from malicious software. The VirusScan application operates in two modes: the VirusScan "Classic" interface gets you up and running quickly, with a minimum of configuration options, but with the full power of the VirusScan anti-virus scanning engine; the VirusScan Advanced mode adds flexibility to the program's configuration options, including the ability to run more than one scan operation concurrently. Administrator's Guide 97 Using VirusScan Software To learn how to configure VirusScan properties and how to start and stop VirusScan software, see Chapter 5, "Using the VirusScan application, "in the VirusScan User's Guide. Scheduling scan tasks The VirusScan Console runs scan operations and other tasks on the dates and at the times you choose, or at intervals you set. Use the Console to run a scan operation in your absence, when it causes the least disruption to your work, as part of a series of automated tasks, or in other ways that suit your needs. To learn how to configure VirusScan Console properties, see Chapter 6, "Creating and Configuring Scheduled Tasks, " in the VirusScan User's Guide. Using specialized scanning tools In addition to the continuous background scanning that the VShield scanner provides you with through its E-Mail Scan module, VirusScan software includes a Microsoft Outlook client extension designed specifically to look for viruses in your Microsoft Exchange and Microsoft Outlook mailboxes. The E-Mail Scan extension gives you the ability to scan your mail servers at your own initiative, and at times convenient for you. An unobtrusive plug-in architecture gives you access to the scanner from directly within your Exchange or Outlook client application. To learn how to configure the E-Mail Scan extension and other specialized scanners, see Chapter 8, "Using Specialized Scanning Tools, " in the VirusScan User's Guide. 98 McAfee VirusScan Anti-Virus Software 5S ending Alert Messages 5 Using the Alert Manager Client Configuration utility All McAfee anti-virus software includes wide range of methods to alert you when it has detected a virus or other malicious software. These methods include: · graphical and full-screen warnings that appear on your local computer, often with response options · system beeps and custom messages that you can compose · e-mail messages sent as replies to those who send you infected items, or as warnings to others that you've received an infected item · log files that record VirusScan component actions, including virus detection and response events · summary and real-time statistical displays that update detection and response events Many of these methods alert you only if you are at your computer and watching as a scan operation runs. If you manage a network of workstations that you want to secure, however, you often need a method that will tell you about an infection if you are at any other workstation on your network, or even if you are not connected to the network at all. [. . . ] The scheduling feature also allows you to set a "randomization window" centered on the time you schedule for your update. You can use this feature to send out a standard AutoUpdate configuration, with a standard update schedule, but still prevent network traffic bottlenecks that might otherwise result when all of the computers on your network simultaneously try to update their . DAT files. If some of your client computers are off, or if they do not have the VirusScan Console running, the AutoUpdate utility will resume its scheduled task when you next start the computer or the VirusScan Console. To learn how to use this feature, see "Enabling tasks" on page 208 of the VirusScan User's Guide. NOTE: Be sure to schedule your client computer updates for a time after you have downloaded and installed the update files on your central server. [. . . ]