FILE SHIELD Version 1.4

Copyright 1990 McAfee Associates
All Rights Reserved


This product may not be used in a business, corporate,
government or agency environment without a negotiated site license.

For licensing information, contact:

McAfee Associates
4423 Cheeney Street
Santa Clara, CA 95054

408 988 3832 (Voice)
408 970 9727 (FAX)
408 988 4004 (BBS)


Executable Program (FSHIELD.EXE):
FSHIELD is packaged with a VALIDATE program that will
authenticate the integrity of FSHIELD.EXE. Refer to the
VALIDATE.DOC instructions for the use of the validation program.
The validation results for V1.4 should be:
SIZE: 61,370
DATE: 7-09-1990
FILE AUTHENTICATION:
Check Method 1 - 8F85
Check Method 2 - 074F

You may also call the McAfee Associates bulletin board at 408
988 4004 to obtain on-line FSHIELD.EXE verification data. The
VALIDATE program distributed with FSHIELD may be used to
authenticate all future versions of FSHIELD.


OVERVIEW:

FILE SHIELD has been designed primarily for software
manufacturers, publishers, developers and distributors. It shields
executable files so that virus infections are instantly detected
and automatically removed by the shield. Programs shielded in this
manner will not remain infected and will not continue to propagate
an infection. This protects the software manufacturer against
possible legal or liability questions when the software is
introduced into an already infected site. Infected users are
frequently confused about the origin of an infection and it is
difficult, if not impossible, do determine whether a specific
program has infected a system, or whether the already infected
system had infected the program in question. Shielded programs
will not carry an infection and will provide greater assurance to
the user that the program was not the source of the infection.
FILE SHIELD may, of course, also be used by end users. But
it is not recommended as a global system protector. It is fine for
shielding your most frequently used programs or those programs
which would be difficult or costly to replace in the event of an
infection, but it is limited to protecting executable files. Boot
sector and partition table viruses do not infect executable files
and you would still be vulnerable to these infections. For global
system protection please use VSHIELD. This program is available
on most bulletin boards, or contact McAfee Associates at the above
address.

Notes on Version 1.3
Version 1.3 fixes a number of bugs existing in 1.2. The major
bug in version 1.2 involved removing the shield from COM files
whose length was a multiple of 16 bytes. If the shield was removed
from such a file, the original file length was incorrectly
calculated. Other bugs included difficult to read displays on a
monochrome monitor, lack of a warning message for shielding
COMMAND.COM and incompatibilities with some memory resident
programs. All have been fixed in version 1.3.

USING FILE SHIELD:

To run FILE SHIELD simply type:

FSHIELD

A menu screen will appear with the following menu options:


INSTALL REMOVE OPTIONS EXIT


If you wish to install FILE SHIELD on a selected program or
collection of programs, select the INSTALL option.

NOTE: FILE SHIELD may only be used to shield programs with
COM or EXE extensions.

After selecting INSTALL, a window will open at the bottom of
the screen. Input the name of the drive, directory or file that
you want to specify for installation. If a drive or subdirectory
is selected with no file name specified, then FILE SHIELD will
search the entire drive or subdirectory for all COM and EXE files
and prompt you at each file to ask if you wish to install the
Shield. Respond YES if you wish to shield the particular file.
FILE SHIELD will shield the selected programs and, in each
instance, will display a window indicating the name of the file
shielded, the original size, and the size after application of the
shield. FILE SHIELD will add between 1500 bytes to 6,000 bytes to
each shielded file. The average should be 2,000 bytes.

To remove a shield from a file select the REMOVE option from
the main menu. A window will open at the bottom of the screen.
Input the file specification for the file or group of files that
you wish to un-shield. FILE SHIELD will prompt you to ask if you
are sure that you want to un-shield the file. Respond YES if you
wish to proceed.

The OPTIONS selection allows you to set automatic mode. In
automatic mode, FILE SHIELD searches the disk or directory
specified for COM and EXE files and shields them without prompting
the user at each file. If you do not want to shield all of the
files in your specified path, then do not use this option. The
default option is NO. You may also choose to backup shielded files
prior to shielding and set automatic subdirectory searching by
choosing the appropriate option in the OPTIONS menu.

To leave FILE SHIELD, select EXIT.


NOTE: FILE SHIELD will not attempt to shield any EXE file that
uses internal overlays. These files contain a length
field in the header record that does not match the
DOS specified file size. Such programs cannot be
shielded. FILE SHIELD will display an error message if
an attempt is made to shield this type of program.


OPERATION OF THE SHIELD:
Once a program has been shielded, it will monitor itself for
infection each time it is loaded. If a virus attaches to the
program, the shield will pause execution, inform the user of the
virus condition, and offer the following options:

1. Re-boot the system

2. Restore the program to its original, uninfected state and
continue processing.

3. Restore the program to its original, uninfected state and exit
to DOS.

4. Execute as is (this option should only be chosen in a research
environment).

5. Take no action, but immediately exit to DOS.

You may choose one of the above options at execution time.
It is recommended that option 3 be chosen in normal circumstances.
After the shield has removed the virus and exited to DOS,
Immediately power down the machine. Find a clean, write-protected
boot diskette and re-boot the machine from that diskette. Then
scan your system using the SCAN program to determine the extent of
the infection.


REGISTRATION:

FILE SHIELD is distributed as shareware and requires a $25
registration fee for home or domestic use. Please use the enclosed
registration document (REGISTER.DOC). Business, corporate or
organizational use requires a negotiated site license. For site
license or developer license information, please contact:

McAfee Associates
4423 Cheeney Street
Santa Clara, CA 95054-0253

408 988 3832 (Voice)
408 970 9727 (FAX)

408 988 4004 (BBS)