McAfee DR SOLOMON S ANTI-VIRUS 8.5, Руководство администратора

Страница: 102 / 224

Removing Infections From Your System
102 Dr Solomon’s Anti-Virus
• If you suspect that a macro virus has infected your PowerPoint files, copy
the file BLANKPRESENTATION.POT from C:\Program Files\Microsoft
Office\Templates to the disk.
Making disk images
To send the files now stored on any floppy disks you created, you can use a
AVERT Labs tool called RWFLOPPY.EXE to make a floppy disk image that
encapsulates the infection. The RWFLOPPY.EXE tool does not come with your
Dr Solomon’s Anti-Virus, but you can download it from this location:
http://www.nai.com/asp_set/anti_virus/avert/tools.asp
The AVERT site stores the tool as a compressed .ZIP file. Download the file to
your computer, then extract it to a temporary folder on your hard disk. The
.ZIP package contains a brief text file that explains the syntax for using the
RWFLOPPY.EXE utility.
NOTE: If you suspect you have a boot virus, you must use RWFLOPPY
to send your samples electronically; otherwise, you must send your
samples physically on a diskette. If you send them electronically without
using RWFLOPPY, the samples will be incomplete or unusable, as boot
viruses often hide beyond the last sectors of a diskette, and other diskette
image creation programs cannot obtain this data.
Once you create images of the disks you want to send, you can send them as
file attachments in an e-mail message to Dr Solomon’s anti-virus researchers.
Preparing file archives to send
Try to fit as many of file samples as you can on a single floppy disk. To do so,
compress the samples that you captured on disk to a single .ZIP file with
password protection. Here’s a suggested procedure that uses the WinZip
utility:
1. Start WinZip.
2. Press
CTRL+N
to create a new archive.
The New Archive dialog box appears.
3. Enter a name for the new archive, then click OK .
4. Press
CTRL+A
to add files to the new archive.
The Add dialog box appears.
5. Click Password to display the Password dialog box.
6. Type
INFECTED
in the Password text box, then click
OK
.