QUICK START INSTRUCTIONS FOR McAFEE ASSOCIATES PROGRAMS
Last revised November 26, 1990.
Copyright 1990 by McAfee Associates.
Written by Aryeh Goretsky
All rights reserved.

McAfee Associates                  (408) 988-3832 office
4423 Cheeney Street                (408) 970-9727 fax
Santa Clara, CA  95054-0253        (408) 988-4004 BBS 1200/2400baud
U.S.A.                             (408) 988-5138 BBS HST9600 MNP-2


     These instructions tell how to identify a virus with the
VIRUSCAN program and remove the virus with the CLEAN-UP program. 
They are intended to provide the person with a virus infection an 
emergency means to identify and remove an infection.  They are not
meant to replace the program documentation.  Please read through
the documentation for detailed instructions.

     Files ending in a .DOC extension have been formatted for
printing on a printer with a minumum of 60 lines per page.  Files
ending in a .TXT extension have not been formatted. 


VIRUSCAN (SCAN)

1.   Copy all the VIRUSCAN files to a floppy disk.

2.   WRITE PROTECT THE DISK!!!

3.   Insert the disk into the infected PC and type:

SCAN C: D: E: 

     This will allow VIRUSCAN to run on the C:, D:, and E: drives. 
If you do not have D: and E: drives, leave them out.

4.   If infected files are found, they may be ERASED by running
VIRUSCAN with the /D (overwrite and delete) option:

SCAN C: D: E: /D 

     Running VIRUSCAN with the /D option will delete files in a way
that is non-recoverable.  Use this option only if you do NOT want
to recover any of the infected files.  Otherwise use the CLEAN-UP
universal virus disinfector.

5.   Turn computer off to remove the virus from memory.


CLEAN-UP (CLEAN)

1.   Copy all the CLEAN-UP files to a floppy disk.

2.   WRITE PROTECT THE DISK!!!

3.   Power down the infected system and then boot from a clean,
     write protected system master diskette.  Note: If you are
     unable to reference all of the logical drives on your hard
     disk after you have booted from a floppy, then check to make
     sure that you have included on the floppy -- and in your
     CONFIG.SYS -- any special purpose device drivers necessary to
     access your hard disk.  

4.   Insert the CLEAN-UP disk into the infected PC and type:

CLEAN C: D: E: [virus ID code] 

     This will allow CLEAN-UP to disinfect viruses on the C:, D:,
and E: drives.  If you do not have D: and E: drives, leave them
out.  

     For the Jerusalem virus, the ID code is [JERU].  For the
Stoned virus, the ID code is [STONED].  For other viruses, use the
ID code generated by SCAN, or check the VIRLIST.TXT file.  Remember
to include the square brackets, "[" and "]."

     If you are disinfecting a file infector virus, such as the
Jerusalem, it is recommended that you add the /A switch to the
command line to check all files.  This will ensure that the virus
is removed from any overlay files that may not use the defaault
overlay extensions recognized by Clean-up.  If you know that none
of your programs use overlays, then the /A switch is not necessary.

5.   Turn the computer off and then re-boot from the hard disk.


AN IMPORTANT NOTE
You have now completed a virus disinfection of your computer
system, however, you may have other computers and floppy disks
that are infected.  You know have a clean PC from which to
scan and clean them.  Please take the time now to read through
the VIRUSCAN and CLEAN-UP documentation to show you the fastest
and safest way of removing your computer virus infection.