QUICK START INSTRUCTIONS FOR McAFEE ASSOCIATES PROGRAMS
Last revised February 15, 1994.
Copyright 1990-1992 by McAfee Associates.
All rights reserved.
McAfee Associates (408) 988-3832 Telephone
2710 Walsh Avenue, Suite 200 (408) 970-9727 FAX
Santa Clara, CA 95051-0963 (408) 988-4004 BBS
USA CompuServe GO MCAFEE
Internet [email protected]
QUICK START Page 1
These instructions explain how to identify a virus with the
VIRUSCAN program and remove the virus with the CLEAN-UP program.
They are intended to provide an emergency means to identify and
remove an infection. They are not meant to replace the program
documentation. Please read through the documentation for
Files ending in a .DOC extension have been formatted for
printing on a printer with a minimum of 55 lines per page.
Files ending in a .TXT extension have not been formatted.
1. Copy all the VIRUSCAN files to a floppy disk in drive A:.
2. WRITE PROTECT THE DISK!!!
3. Turn computer off to remove the virus from memory, insert a
clean (virus-free) DOS system boot disk into the A: drive,
and turn the power back on.
4. Insert the VIRUSCAN disk into the infected PC and type:
SCAN C: D: E:
This will allow VIRUSCAN to scan the C:, D:, and E: drives.
If you do not have D: and E: drives, leave them out.
NOTE: If infected files are found, they may be ERASED by
running SCAN with the /D (overwrite and delete)
SCAN C: D: E: /D
Running SCAN with the /D option will delete files so they
can not be recovered. Use this option only if you do NOT
want to recover any infected files. Otherwise use CLEAN-UP,
the universal virus disinfection program.
4. Copy SCAN.EXE to the hard disk and run it from there against
any floppies you suspect have the virus on them.
QUICK START Page 2
1. Copy all the CLEAN-UP files to a floppy disk in drive A:.
2. WRITE PROTECT THE DISK!!!
3. Power down the infected system and then boot from a clean,
write protected system master diskette. This must be done
to remove any viruses from memory that may interfere with the
virus removal process.
NOTE: If you are unable to access the hard disk after booting
from a floppy, check to make sure that any special
device drivers needed to use the hard disk are on the
floppy and loaded from the CONFIG.SYS or AUTOEXEC.BAT
file. Check to make sure the version of DOS is the
same version as on the hard disk (or a later version).
4. AT THIS POINT IF YOU HAVE NOT DONE A BACKUP OF ANY CRITICAL
FILES ON YOUR SYSTEM, THEN DO SO IMMEDIATELY.
5. Insert the CLEAN-UP disk into the floppy drive of the
infected PC and type:
CLEAN C: D: E: [virus I.D. code]
This will allow CLEAN-UP to disinfect viruses on the C:, D:,
and E: drives. If you do not have D: and E: drives, leave them
For the Jerusalem virus, the ID code is [JERU]. For the
Stoned virus, the ID code is [STONED]. For other viruses,
use the ID code reported by SCAN, or refer to the
VIRLIST.TXT file. Be sure to include the square brackets,
"[" and "]."
If you are disinfecting a file-infecting virus, such as the
Jerusalem, it is recommended that you add the /A switch to the
command line to check all files. This will ensure that the virus
is removed from any overlay files that may not use the default
overlay extensions recognized by CLEAN-UP.
If more than one virus type was detected, then CLEAN-UP will
have to be run for each type of virus.
5. Turn the computer off and then re-boot from the hard disk,
run SCAN to confirm that the virus has been removed, copy
CLEAN.EXE to the hard disk, and check any floppies that may
have been infected by the virus.
QUICK START Page 3
AN IMPORTANT NOTE
You have now completed a virus disinfection of your computer
system, however, you may have other computers and floppy disks
that are infected. You now have a clean PC from which to
scan and clean them. Please now take the time to read through
the VIRUSCAN and CLEAN-UP documentation to show you the fastest
and safest way of completely removing your computer virus infection.