welcome to pc-cillin 2002 - documentation.help · stop their processes, and deletes files dropped...

WelcometoPC-cillin2002TrendMicroPC-cillin2002providesnextgenerationsecurecomputingfortoday’spersonalcomputers.Morethanjustantivirussoftware,PC-cillinincludesaPersonalFirewall,Sitefilter,Internetmailscanning,andmoreforallyoursecurecomputingneeds.Designedforthehomeorsmallofficeuser,thefriendlyinterfaceletsyouquicklybecomefamiliarwithallthepowerfulfeaturesofthesoftware.However,theprogrambehindtheinterfaceusesthelatesttechnologyandprovidesyouwithprotectionfromthenastiestviruses,sneakiestTrojans,andthemeanesthackers.Withfirewalltechnology,theTrojanSystemCleanertool,andmore,PC-cillingivesyoupeaceofmindwheneveryouconnecttotheInternet.AndnowthatTrendMicro'sawardwinningICSAapprovedscanenginealsoincludesScriptTrap™ technology,personalcomputinghasneverbeenmoresecure.

Here'swhatPC-cillinwilldo"straightoutofthebox":

Checksforviruseseverytimeyouopen,copy,move,orsaveafileProtectsagainstdownloadinginfectedfilesfromtheInternetorFTPsitesGuardsagainstmaliciousJava™appletsandMicrosoftActiveX™controlswhilesurfingtheWebDetectsandcleansliveTrojansinstalledonyoursystemMonitorsyourMicrosoftWord®andMicrosoftExcel®sessionsformacroviruses,usingMacroTrap™ScansandcleansallfilesonyourharddriveScansallprogramfilesforvirusesChecksallyoursaveddocumentsformacroviruses

Here'swhatyoucandowithjustaclickofabutton:

ScaneveryfileonyoursystemandcleananyinfectedfilesScananyfilefromWindowsExplorerorMyComputerbyright-clickingthefileiconScanfloppydisksandcleananyinfectedfilesCheckallofyourWordandExceldocument(s)formacrovirusesScanyouremailattachmentsastheyarebeingdownloadedfromanInternet(POP3)mailserverProtectyourcomputeragainstattacksfromtheInternetusingacombinationofcloakingandfirewallfunctionsMakewhateverWebsitesyouwant"offlimits"tootherusersofthecomputerProtectyourhandhelddeviceswithupdatedPersonalDigitalAssistant(PDA)viruspatternfiles

PersonalFirewallPC-cillin2002providessecureInternetcomputingwithitsnewPersonalFirewallfeature.Easytooperate,thePersonalFirewallprotectsyourcomputerfromunwantedInternetconnections.ThePersonalFirewallisidealforcomputersusingalways-onbroadband(DSL,cablemodem)connections,orforthosecomputersthatareoftenonline.EvencomputersthatonlyconnecttotheInternetforshortperiodsoftimearestillvulnerabletohackerattacksandneedprotection.Withadjustablesecuritylevels,atrustedsitelist,andaportblockingfunction,thePersonalFirewallgivesyouthecontroltokeepyourcomputersafefrommaliciouscodelikespywareandTrojanhorses.ThePersonalFirewalliscomprisedofthefollowingcomponents:

Cloaking:Preventsyourcomputerfrombeingfound.Cloakinghidestheentrypoints(ports)ofyourcomputermakingitappeartobedisconnectedfromanetwork.HackersusingtechniqueslikeNetBIOSbrowsing,portscanning,orICMPpacketspecialprocessingwillbeunabletolocateyourcomputer.Firewall:Providesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).Thisbarrierexaminesandfiltersnetworktrafficcomingintoyourcomputer.Byfilteringnetworktraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.Thefirewallprotectsagainstattackshackerscommonlyuseincluding:PingofDeath,IPconflict,SYNflooding,andothers.TrojanBackdoorBlocking:Ifahackerhasalreadybrokenintoyoursystem,heorshecouldhaveinstalledaTrojan(smallhiddenprogram)ontoyourcomputer(unlikeviruses,Trojansdonotreplicatethemselves,butcanstillwreakhavoconyoursystem).Toavoidbeingtraced,thehackercanthenuseyourcomputertoattackothercomputers.TheTrojanBackdoorBlockingfunctionpreventshackersfromusingyourcomputerbyblockingBackOrifice,BackOrifice2000,NetBus,DeepThroatandotherknownbackdoorprograms.

TheremaybeWebsitesthatyouknowaresafeandwillnotattackyourcomputer.UsingtheTrustedSitesfunction,thePersonalFirewallletsyouadd

thesesafesitestoalist.YourcomputercanconnecttoanyWebsiteonthislistbecausetheywillnotbefiltered.Seealso:EnablingYourPersonalFirewallAboutthePersonalFirewallsecuritylevelsettingsAdjustingthePersonalFirewallsecuritylevelsettingsAboutTrojansHowTrojanscausedamage

PC-cillinforWirelessMaliciouscodeandotherthreatshiddeninsidefiles,email,orontheWebcanenteryourPalm,PocketPC,orEPOCdeviceduringbeaming,synchronization,orInternetaccess.TrendMicroPC-cillinforWirelessprovidesportable,easy-to-useantivirussecurityforwirelessdevices;todefendagainstpotentialthreats.Bestofall,PC-cillinforWirelessisbundledwithPC-cillin2002providingyouwithsecurecomputingonbothyourdesktopandhandheld.Seealso:AboutPC-cillinforWirelessUpdatingPC-cillinforWirelessSelectingPDAOStypeInstallingPC-cillinforWireless

TrojanSystemCleanerPC-cillinautomaticallyrunstheTrojanSystemCleaner(TSC)duringinitialinstallation,andeverytimeReal-timeScanruns.TheTSCdetectstheactivityofTrojanhorseprograms,recoverssystemfileswhicharemodifiedbyTrojans,stoptheirprocesses,anddeletesfilesdroppedfromTrojans.Traditionalantivirusproductsonlyscan"files",theyopenfilesandcheckforviruscode.Buttheydon'tcheckandcleansystemfilesandcan'tcleanordeleteTrojanhorseprograms(alsoknownasTrojans)ifitisalreadyruninthesystem.TheTSCusespatternstodefinehowtocleanaTrojan.ThesepatternsarebuiltintoTrendMicroviruspatternfilesandarekeptup-to-date.WheneverTSCisexecuted,itfindsthenewestpatternfileandtriestoreadTrojancleansectionfromthepatternfile.Seealso:RunningtheTrojanSystemCleanerAboutTrojansHowTrojanscausedamage

ScriptTrapTechnologyWiththeadditionofScriptTraptechnology,PC-cillinnowmorethaneverprovidesrock-solidprotectionforyourcomputer.PC-cillinnotonlyguardsagainstharmfulknownscript-basedviruses("ILoveYou"and"AnnaKournikova"),butcanalsoprotectyourPCfromnew,unknownscript-basedthreats.Usingthefollowingprocesses,ScriptTrapautomaticallyscansforscriptingvirusesbasedon"whattheydo"ratherthanhowtheyarewritten:

lexicalanalysis-dividesthescript'ssourcecodeintocomponents,calledtokens,basedonpunctuationandotherkeys.semanticparsing-attemptstodeterminethemeaningofeachcomponent.

EmergencyLockPC-cillinalsoincludesanInternetEmergencyLockfunctionthatletsyouimmediatelydisableallInternetactivityifyoususpectanattack.EnablingtheEmergencyLockfunctionimmediatelystopsalltraffictoandfromtheInternet.Seealso:ActivatingtheEmergencyLock

UserInterfaceDesignedforthehomeorsmallofficeuser,theprogram'sfriendlyinterfacequicklyfamiliarizesyouwiththepowerfulfeaturesofPC-cillin2002.TheinterfacenowincludesaSimpleandStandardmode.Usingatabinterface,youcaneasilyswitchbetweenthetwomodes.Simplemode:PerformcommonPC-cillintaskssuchas:viewasimplifiedversionofyoursystemstatus,andscanalldrives.Inaddition,youcanupdateandregisteryoursoftware.Standardmode:AccessmoreadvancedPC-cillin2002functionsincluding:viewingyoursystemstatusinmoredetail,selectivelyscanningfolders,synchronizingyourPDA,quarantiningfiles,andviewinglogs.IntheStandardmode,asintheSimplemode,youcanalsoupdateandregisteryoursoftware.Seealso:AboutSimplemodeAboutStandardmode

AboutIntelligentUpdateIntelligentUpdateautomaticallysearchesforanddownloadsthelatestfilesforPC-cillin2002.ThisincludespatternandprogramfilesforboththemainprogramandPC-cillinforWireless.Inaddition,IntelligentUpdateensuresyouhavethelatestPersonalFirewallrules.ThispowerfulfunctionkeepsPC-cillinandallitscomponentsupdated;offeringyoumaximumprotectionwithminimaluserintervention.Onceyourcomputerisrunning,PC-cillinchecksforanInternetconnection.Whenthisfeatureisenabledandyourcomputerisonline,PC-cillinautomaticallyconnectstotheTrendMicroservertocheckifthelatestupdateisavailable.Ifnewercomponentsareontheserver,apop-upwindowappearsaskingifyouwanttostartdownloading.Ifyouchoosenottodownloadimmediately,thepop-upwindowre-appearsin10minutes.Seealso:AboutVirusPatternFilesViewingpatternfileandscanengineinformationUpdatingPC-cillin2002UpdatingPC-cillinforWirelessEnablingIntelligentUpdateSchedulingIntelligentUpdate

NewproductregistrationmethodPC-cillin2002offersanewwaytoregisteryoursoftwareonline.OnourRegistrationWebpage,simplytypeyournameandemailaddressintheappropriatefields,receiveyourLicenseKeyviaemail,andinsertitintothecorrectfieldontheRegisterNowscreenofthePC-cillinwindow.RegistrationonlytakesafewminutesandTrendMicroprovidestechnicalsupport,viruspatterndownloads,andprogramupdatesforoneyeartoallregisteredusers,afterwhichyoumustpurchaserenewalmaintenance.Seealso:UpgradingyourtrialversionsoftwareRegisteringyoursoftwareCanIinstallPC-cillin2002onanothercomputer?WhatifIlostmyserialnumber?WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?

RegisteringyoursoftwareTakeafewminutestoregisteryoursoftwareonlineandreceivethebenefits.TrendMicroprovidestechnicalsupport,viruspatterndownloads,andprogramupdatesforoneyeartoallregisteredusers,afterwhichyoumustpurchaserenewalmaintenance.Toregisteryoursoftware:

1. OnthePC-cillinwindow,clicktheStandardtab.TheStandardmodemenuappears.

2. OntheStandardmodemenu,clicktheRegisterlink.TheRegisterNowscreenappears.

3. ConfirmthatyourfullversionserialnumberalreadyexistsandclickRegisterNow.TheRegisterWebpageloadsinyourbrowser.

4. OntheRegisterWebpageintheappropriatefields,typeyournameandemailaddress.

5. Typeyouremailaddressagaintoconfirmit’sthecorrectaddress.6. ClickSend.AConfirmationWebpageloadsandaLicenseKeyissentto

theemailaddressyoujusttyped.7. CopytheLicenseKeyfromtheWebpageoremailandpasteitunderStep3

intheRegisterNowscreen.8. ClickFinish.

Congratulations!YouhaveregisteredyoursoftwareandcannowusethefullfunctionalityofPC-cillin2002andreceivethebenefits.Seealso:NewproductregistrationmethodUpgradingyourtrialversionsoftwareCanIinstallPC-cillin2002onanothercomputer?WhatifIlostmyserialnumber?WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?

UpgradingyourtrialversionsoftwareUpgradeyoursoftwareandregisteronlinetotakefulladvantageofPC-cillin2002.Ifyouarestillusingthetrialversionafter30days,thevirusscanningservicesbecomedisabled.UpgradingyoursoftwaretothefullversionandregisteringenablesyoutouseallPC-cillin2002functions.TrendMicroprovidestechnicalsupport,viruspatterndownloads,andprogramupdatesforoneyeartoallregisteredusers,afterwhichyoumustpurchaserenewalmaintenance.Toupgradeyourtrialversionsoftware:


2. OntheStandardmodemenu,clicktheRegisterlink.TheRegisterNowscreenappears.

3. UnderStep1ontheRegisterNowscreen,typeyourserialnumber.4. ClickUpgradeNow.

Congratulations!Youhaveupgradedyourtrialversonsoftwaretothefullversion.Youshouldnowcontinueandregisteryoursoftware.

5. ClickRegisterNow.AWebpageappears.6. OntheRegisterWebpageintheappropriatefields,typeyournameand

emailaddress.7. Typeyouremailaddressagaintoconfirmit’sthecorrectaddress.8. ClickSend.AConfirmationWebpageloadsandaLicenseKeyissentto

theemailaddressyoujusttyped.9. CopytheLicenseKeyfromtheWebpageoremailandpasteitunderStep3

intheRegisterNowscreen.10. ClickFinish.

Congratulations!YouhaveregisteredyoursoftwareandnowcanusethefullfunctionalityofPC-cillin2002andreceivethebenefits.Seealso:

NewproductregistrationmethodRegisteringyoursoftwareCanIinstallPC-cillin2002onanothercomputer?WhatifIlostmyserialnumber?WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?

EnablingtheReal-timeMonitorTheReal-timeMonitorwatchesoveryoursystemanddetectsvirusesastheyarriveatyourcomputer.Eachtimeyouopen,copy,save,ormoveafile,theReal-timeMonitorensuresthatthereal-timescannerperformsaquickcheckofthefile.Becauseitworksinthebackground,itdoesn'tinterferewithyournormaldailycomputingandwon'tdistractyou.Inaddition,theReal-timeMonitorletsyouquicklyperformPC-cillincommands.ToenabletheReal-timeMonitor:

1. ClickStart>Programs>TrendMicroPC-cillin2002>Real-timeMonitor.TheReal-timeMonitorappearsinthesystemtray(locatedinthelower-rightcorner)

2. Right-clicktheReal-timeMonitor.Apop-upmenuappears.3. Youcanchoosethefollowing:

StartupPC-cillin-DisplaysthePC-cillinwindow.EmergencyLock-SetstheEmergencyLock,whichimmediatelyhaltsallnetworkactivity.Real-timeMonitor-EnablestheReal-timeScanfunction.IfthereisacheckmarkbesideReal-timeMonitor,Real-timeScanisenabled.Configuration-DisplaystheSettingswindow.Real-timeStatus-DisplaysReal-timescaninformation,includingthepatternfileversionandthelastscannedfile.Exit-DisablestheReal-timeMonitorandasksyouifyoualsowanttostopreal-timescanning.

Seealso:AbouttheReal-timeMonitorStartingtheReal-timeMonitor

ScanningasinglefilePC-cillincaneasilyrunaquickscanofanyfile.PC-cillinscansthefiletypesandexecutesthenecessaryvirusactionsaccordingtotheManualScansettings.Forthequickestresults,useoneofthefollowingmethods.ToscanasinglefileusingWindowsExplorer,dooneofthefollowing:

Right-clickthefile,andthenclickPC-cillin.Right-clickthefile,andthenclickProperties.ClicktheVirusPropertytab.PC-cillinscansthefile.

Toscanasinglefile,"drag"thefile(s)ontothePC-cillinwindow.Seealso:ScanningfoldersAboutvirusscanactionsAboutManualScan

ScanningfoldersWithPC-cillinyoucanscantheentirecontentsofafolder.PC-cillinscansthefiletypesandexecutesthenecessaryvirusactionsaccordingtotheManualScansettings.Forthequickestresults,dooneofthefollowing:ToscanafolderusingWindowsExplorer,right-clickthefolderyouwanttoscanandclickPC-cillin.Toscanafolder,"drag"thefolderyouwanttoscanontothePC-cillinwindow.Seealso:ScanningasinglefileAboutvirusscanactionsAboutManualScan

ScanningalldrivesScanalldrivestomakesureyoursystemisvirus-free.Withoneclick,PC-cillinprovidesafastandeasywaytoscanalldrivesforinfectedfilesthatareconnectedtoyourcomputer.Toscanalldrives:

1. OnthePC-cillinwindow,clicktheSimpletab.TheSimplemodemenuappears.

2. ClicktheScanAllDriveslink.TheScanFilesdialogboxappearsandPC-cillinbeginsscanning.Tostopscanning,clicktheStopbutton.Aconfirmationmessageboxappears.ClickYestostop.

Note:PC-cillinscansthefiletypesandexecutesthenecessaryvirusactionsaccordingtotheManualScansettings.

Seealso:AboutManualScanScanningfoldersScanningasinglefile

EnablingyourPersonalFirewallEnableyourPersonalFirewallsoyoucanconnecttotheInternetwithoutworryingaboutsomeoneinvadingyourcomputer.ThePersonalFirewallprotectsyoufromhackerstryingtodamagefiles,stealpersonalinformation,orcreatemischief.ToenableyourPersonalFirewall:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheSecurityLevellink.TheSecurityLevelscreenappears.4. SelecttheEnablePersonalFirewallcheckbox.5. ClickApply.

Seealso:AboutPersonalFirewallsAboutthePersonalFirewallsecuritysettingsAbouttrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

ActivatingtheEmergencyLockIfyoususpectanattackoriginatingfromtheInternet,usetheEmergencyLockfunctiontoquicklyhaltallInternetactivity.ActivatingtheEmergencyLockimmediatelystopsalltraffictoandfromtheInternet.ToactivatetheEmergencyLock:

1. MakesuretheReal-timeMonitorisdisplayedinthesystemtray.Ifnot,clickStart>Programs>TrendMicroPC-cillin2002>Real-timeMonitor.

2. Inthesystemtray,right-clicktheReal-timeMonitoriconandclickEmergencyLock.EmergencyLockisselected(acheckappearsbesidethename).ThelocksshutsandallInternetactivityisstopped.TodeactivatetheEmergencyLock,makesurethereisnocheckbesidethename.

Notes:

YoucanalsoactivatetheEmergencyLockifareal-timescandetectsavirus.SimplyclickEmergencyLockonthedialogboxthatappears.IftheReal-timeMonitorisalreadydisplayedinthesystemtrayandyoutrytoopentheReal-timeMonitor,theReal-timeMonitordialogboxappears.

Seealso:AbouttheReal-timeMonitorStartingtheReal-timeMonitor

RunningtheTrojanSystemCleanerToscanforanddestroyTrojanhorseprograms,PC-cillinautomaticallyrunstheTrojanSystemCleanerduringinitialinstallation,andeverytimeReal-timeScanstarts.However,youcanalsomanuallyruntheTrojanSystemCleaner.TomanuallyruntheTrojanSystemCleaner:

1. ClickStart>Programs>WindowsExplorer.TheWindowsExplorerappears.

2. LocatethefolderwhereyouinstalledPC-cillin2002(forexample,thedefaultlocationis;C:\ProgramFiles\TrendMicro\PC-cillin2002).

3. Double-clicktheTsc.exefile.TheTrojanSystemCleanerruns.

Seealso:TrojanSystemCleanerAboutTrojansHowTrojanscausedamage

ScanningforPDAvirusesToscanforvirusesonyourPDA,simplytaptheScanbuttononyourPDA.Aftercompletionofthescan,youareshownalistofvirusesthatwerefoundonyourcomputer.Youcanalsoseethenumberoffilesscanned.Seealso:AboutPDAvirusesDealingwithPDAvirusesGettingPDAvirusinformation

VirusPreventionTakethefollowingmeasurestoprotectyourcomputerfrominfection:

Usethelatestviruspatternfile-RegisteryoursoftwareanddownloadthelatestversionsofthePC-cillinpatternfilesandprogramcomponentstoensurePC-cillinusesthelatestantivirustechnology.Bewareofsuspiciousemailattachments-Emailisthemostcommonwayvirusesandmaliciouscodespread.Ifanemailissenttoyoubyastranger,youshouldn’tsaveorrunanyfilesattachedtotheemail.However,regardlessofwhosentyoutheemail,besuspiciousofemailattachmentsthatcontainexecutablefiles(forexample.EXE,.COM).EnableReal-timeScan-Real-timescanningprovidesconstantprotectionagainstviruses.Withreal-timescanningenabled,youreducethechanceofyourcomputerbecominginfected.Becauseitissopowerful(andbecauseitoperatesimperceptiblyinthebackground),werecommendthatyoualwayskeepreal-timescanningenabled.Setscheduledscantasks-Scantasksareaquickandeasywaytoperformavarietyofscans.Usingscantasksautomatesroutineantivirusmaintenanceproceduresonyourdesktopandimprovesantivirusmanagementefficiencyandcontroloverantiviruspolicy.Formoreinformation,refertotheonlinehelptopicAboutScanTasks.Keepinformed-RegularlyvisittheTrendMicroWebsite(www.antivirus.com)forthelatestvirusinformationandsecurityalerts.Inaddition,youcanlearnmoreaboutvirusesbyaccessingtheonlineTrendMicroVirusEncyclopedia.

Seealso:Registeringyoursoftware

http://www.antivirus.com

WhathappensifavirusisdetectedWiththeamountofvirusesalreadyreleasedandthenumberofnewonesbeingcreated,itisverylikelyyouwillencounteravirus.WhenPC-cillindetectsaviruseitherbyReal-timeScan,ManualScan,oranInternetmailscan,PC-cillinnotifiesyouofthevirusandtheactionittakes.TheactionsforReal-timeScan,ManualScan,orInternetmailscandependonthesettingsyouhaveconfiguredforeachscan,respectively.However,thedefaultactionforallscansisClean.Thissimplymeansifafilebecomesinfected,PC-cillinfirstattemptstocleanthefile.Seealso:AboutvirusscanactionsAboutManualScanAboutReal-timeScanAboutInternetmailscanAboutscantasks

ActionstotakeifPC-cillincannotcleanfileWhatdoyoudoifyouhaveupdatedyourpatternfiles,scanengineandprogramfilesandfindthataninfectedfilestillcannotbecleaned?ThisdependsontheactionsyouhavesetforthedifferentPC-cillinscans(Real-timeScan,ManualScan,Internetmailscan).ThedefaultReal-timeandManualScanactionforfilesthatcannotbecleanedisQuarantine.ThismeansPC-cillinwillmovethefiletotheQuarantinefolder.FilesplacedintheQuarantinefolderareisolatedandrenderedharmless.Afteryouquarantinethefileyouhaveseveraloptions,forexample,afterthenextpatternfileupdateyoucancleanthefile.Youcanalsorestoreit,sendittoTrendMicroforanalysisandmanuallycleaning,orultimatelyyoucanstilldeleteitifyouchoose.Thefollowingprovidesfurtherinformationaboutalternatemethodsonhowtoproceedfordifferenttypesofviruses.Important:Infectedfilesthatcannotbecleanedmaybeimportantsystemfiles.Ifyouchoosetoquarantineordeleteafile,itmightcauseasystemerrororfailuretobootupthesystem.Youneedtobecarefulwhatthefileiswhenyouchoosetotaketheseactions.

Trojanhorses(Virusname:Troj_xxx)BecauseTrojanhorsesdonotinfectotherfiles,butratherdestroyorstealinformationfromyourcomputer,thereisnowaytocleanthefile.TheonlywaytocleanaTrojanistodeletetheactualTrojanhorsefile.

CompressedfilesWhiletheTrendMicroscanningenginecandetectviruseswithincompressedfiles,itcannotcleanthefilesinsideofacompressedarchivebeyondthesecondlayerofcompression.Tocleanavirusinadeeperlayerofcompression,youmustfirstdecompressthefile.Tocleanacompressedfile:

1. DisablePC-cillin’sreal-timescanningfunctionsothatitwillnotinterferewiththedecompressionprocess.

2. Useanarchiveutility(forexample,WinZip)toextractthefilesfromthecompressedfile.

3. StartPC-cillin'sreal-timescanningfunction.4. Runthemainprogram.Youcannowmanuallyscanandcleantheinfected

filesthatwereextractedinthesecondstep.

Insufficientdiskspaceorwrite-protecteddiskettesPC-cillincreatesabackupfile,*.rb0,beforeattemptingtocleananinfectedfile.Thisistopreventfilesfrombeingcorruptedifthecleaningfails.Youneedtoprovideenoughdiskspaceoryouhavetocopytheinfectedfilestoaharddiskdrivebeforeattemptingtocleanthefiles.Ifthediskiswrite-protected,makeitwriteablebeforeattemptingtocleanthefile.

Password-protectedfilesIftheinfectedfileispassword-protected(forexample,apassword-protectedZIPorWordfile),PC-cillinwillnotbeabletodetectorcleanit.Pleasedisablethepassword-protectionbeforeattemptingtoscanorcleanthefile.

PE-typevirusinfection(Virusname:PE_xxxx)SincePE-typeviruses(PortableExecutable:standardWin32fileformat)alwaysstayinmemory,thevirusmaynotbecompletelycleaned.TocleanaPE-typevirus:

1. BootyourcomputerwiththerescuedisklabeledEmergencyBootDisk(Disk1).

2. InsertthePC-cillinrescuedisklabeledPCSCANFilesDisk(Disk2)intotheA:\driveandattheDOScommandprompttype:

A:\>PCSCAN/V/CFollowtheonscreeninstructions.Youcannowstartscanningandcleaningtheviruses.Note:Ifyoudonothaveemergencyrescuedisks,refertotheCreatingrescue

disksprocedure.Seealso:AboutvirusscanactionsAboutManualScanAboutReal-timeScanAboutInternetmailscanAboutquarantinedfilesAboutscantasksAboutrescuedisks

AboutVirusPatternFilesTodetectandcleanviruses,PC-cillinusesanextensivedatabaseofvirus"signatures,"(inertsectionsofviruscode)thatholdthesignaturesofthousandsandthousandsofviruses.Asnewvirusesarewritten,releasedontothepublic,anddiscovered;TrendMicrocollectstheirtelltalesignaturesandincorporatestheinformationintotheviruspatternfile.Bysomeestimates,thousandsofnewvirusesarecreatedeachyear,arateofseveraleachday.Infact,virusmakinghasbecomesoeasythatfree"viruskits"areevenavailableovertheInternetfromrogueWebsites.Therefore,itisveryimportanttokeeptheviruspatternfileuptodate.Tokeepupwiththeonslaughtofviruses,TrendMicropublishesanewviruspatternfileweekly(availablefordownloadfromourWebsite).Bothhomeandofficeusersshouldconsiderschedulingweeklyupdates.ViruspatternfileupdatesareavailableforayeartoregisteredPC-cillinusers.TheviruspatternfileislocatedintheTrendMicroPC-cillinfolderonyourcomputerandwillhaveanamesuchasLpt$vpn.120.Thenumberrepresentsthepatternversion.Ifmorethanoneviruspatternfileexistsinthefolder,thescanengineonlyusesthelatest.Seealso:ViewingpatternfileandscanengineinformationUpdatingPC-cillin2002UpdatingPC-cillinforWirelessAboutIntelligentUpdate

ViewingpatternfileandscanengineinformationItisimportanttomakesureyourpatternfilesandscanenginearekeptcurrent.UsingthelatestversionsofthesePC-cillincomponentsensuresyouhavethebestvirusprotectionavailableforyourcomputer.Toconfirmyouhavethelatestupdates,youcanviewyourcurrentpatternfileandscanengineversion.Toviewpatternfileandscanengineinformation,onthePC-cillinmenubar,clickAbout.TheAboutPC-cillin2002dialogboxappearsdisplayingthefollowinginformation:

ProgramVersion,EngineVersion,PatternVersionSerialNumber,Username,Company

Seealso:AboutVirusPatternFilesViewingyourPC-cillinserialnumberUpdatingPC-cillin2002UpdatingPC-cillinforWirelessAboutIntelligentUpdate

UpdatingPC-cillin2002Toprotectyourcomputeragainstthelatestthreats,youneedtoregularlyupdateyourprogramfiles,scanengine,andpatternfiles.Sincenewvirusesarerapidlybeingdiscovered,itiscrucialtoregularlyupdateyourviruspatternfiles.Inaddition,asnewvirusesappear,andexistingonesevolve,itbecomesnecessarytoupdatecertainprogramfilesandaddnewfunctionalitytothescanengine.UpdatingyourscanengineensuresPC-cillincanactonthenewinstructionsintheviruspatternandsuccessfullyidentifyandcleanthevirus.BeforeyoucanupdatePC-cillinyoumustregisteryoursoftware.ToupdatePC-cillin2002:


2. ClicktheUpdateNowlink.TheUpgradeNowscreenappears.Themeterdisplaystheupdateprogress.Ifyouneedtohalttheupdate,clickStop.Tocontinueupdating,clickUpdate.

Seealso:RegisteringyoursoftwareAboutVirusPatternFilesViewingpatternfileandscanengineinformationUpdatingPC-cillinforWirelessAboutIntelligentUpdate

UpdatingPC-cillinforWirelessToensureprotectionagainstthelatestthreatsonyourPDA,youneedtoregularlyupdateyourPC-cillinforWirelesspatternandprogramfiles.PC-cillincandownloadthelatestPC-cillinforWirelessfilesandyoucansynchronizetheexistingfilesonyourPDA.UpdatingPC-cillinforWirelessinvolvesverifyingyourPDAtype,makingsureyourPDAtypeisselectedforsynchronizingwithyourPDA,andupdatingyourpatternandprogramfileswithIntelligentUpdate.ToupdatePC-cillinforWireless:

1. OntheSettingswindow,clicktheProgramUpdatelinkthemenuexpands.2. ClicktheUpdatePDAlink.TheUpdatePDAscreenappears.3. MakesureyourPDAtypeisselected.Ifitisnot,selectyourPDAtype

checkbox(forexamplePalmOS,PocketPC,orEPOC),andthenclickApply.

4. Onthemenubar,clickGoMain.ThePC-cillinwindowappears.5. OnthePC-cillinwindow,clicktheStandardtab.TheStandardmodemenu

appears.6. ClicktheSyncPDAlink.TheSyncPDAscreenappears.7. VerifyyourPDAtypeisselectedandundertheStandardtab,clickthe

Updatelink.TheUpdateNowscreenappears.8. ClicktheUpdatebutton.PC-cillinbeginstoupdate.9. Aftertheupdatehasfinished,clicktheSyncPDAlink.10. PlaceyourPDAintoitscradle,andthenclickSyncNow.

Note:YoumustconnectyourPDAdevicetoyourPCbeforeexecutingSyncNow.DonotuseanyapplicationsorremoveyourPDAdeviceduringsynchronization.

Seealso:UpdatingPC-cillin2002AboutPC-cillinforWirelessSelectingPDAOStype

AboutIntelligentUpdate

AccessingPC-cillinonlinehelpPC-cillin’sonlinehelpprovidescomprehensivecoverageofallthefunctionsandfeaturesofPC-cillin2002.QuicklyfindtheanswerstoallofyourPC-cillinquestions.Theonlinehelpisalsoahandyreferenceandprovidesfrequentlyaskedquestionsandvirusinformation.ToaccessPC-cillinonlinehelp,onthePC-cillinmenubar,clickHelp.Inaddition,dependingonthescreensordialogboxesthatappear,youwillseeHelpbuttons.ClicktheseHelpbuttonstoviewrelevanthelpinformation(context-sensitivehelp)basedonwhatyouarecurrentlyviewing.Seealso:AccessingPC-cillinonlinehelpViewingpatternfileandscanengineinformation

ViewingyourPC-cillinserialnumberQuicklyviewyourPC-cillinserialnumberifyoueverneedtoprovideit.Forexample,ifyouhavetocontacttechnicalsupportforhelpwithanissueorre-installPC-cillin2002,youneedyourserialnumber.ToviewyourPC-cillinserialnumber,onthePC-cillinmenubar,clickAbout.Seealso:AccessingPC-cillinonlinehelpViewingpatternfileandscanengineinformationContactingTechnicalSupport

AboutrescuedisksCertaintypesofbootvirusescanpreventyourcomputerfrombootingnormally.Tocleanthesevirusesyouneedtostartyourcomputerfromacleandiskandnottheinfectedharddrive.A"rescuedisk"isabootablefloppydiskthatPC-cillincancreateifyouarerunningMicrosoftWindows95/98/Me.Rescuedisksshouldbewrite-protectedaftertheyarecreated.Youneedmultiplediskstocreatethecompletesetofrescuedisks.(Disk1)EmergencyBootDisk:Containsfilesnecessarytostartyourcomputer.Usetostartyourcomputerifabootvirushasinfectedyourcomputerandyoucannotstartyourcomputernormally.(Disk2)PCSCANFilesDisk:Containsthescanengine.UsewiththePatternFilediskstodetectandcleanviruseslocatedinthebootsectorofyourcomputer.(Disks3andothers)PatternFileDisks:Containspatternfilessoyoucandetectthelatestviruses.UsewiththePCSCANFilesdisktodetectandcleanviruseslocatedinthebootsectorofyourcomputer.Important:DonotrestartyourcomputerusingrescuedisksthatwerecreatedforanearlierversionofPC-cillin--thiscanresultindataloss.Seealso:CreatingrescuedisksUpdatingrescuedisksCleaningbootvirusesBootviruses

CreatingrescuedisksBeforecreatingyourrescuedisks,makesureyouhaveawritingutensiltolabelthedisks.Youneedmultiplediskstocreateacompletesetofrescuedisks.Ifyou'vealreadygotasetofrescuedisksfromapreviousversionofPC-cillin,youshouldneverthelesscreateanewsetafterinstallingPC-cillin2002.Likewise,ifyoucreatedyourrescuedisksunderWindows95andhavesubsequentlyupgradedtoWindows98,youneedtocreateanewsetofrescuedisks.Ofcourse,youcanre-useyouroldfloppiesforthenewdisks.Alldataontheolddiskswillbelostinthecreationofthenewdisks.Tocreateyourrescuedisks:

1. Obtainsomedisks;insertoneintothefloppydriveofyourcomputer.2. InserttheTrendMicroPC-cillin2002CDintotheappropriatedrive.

3. ClickStart>Programs>TrendMicroPC-cillin2002>CreatetheRescueDisks.Amessageboxappearsaskingforconfirmation.

4. ClickYes.TheCreatingtherescuedisksdialogboxappears.Youcanchoosewheretherescuediskfilesareextractedorjustusethedefaultlocation.Tochangewheretherescuedisksfilesareextracted,clickChangeandbrowsetoadifferentfolder.

5. ClickNext.PC-cillinextractstherescuediskfilestothespecifiedlocation.6. ClickCompleteRescueDiskset,andthenClickNext.7. MakesuretheTargetdriveiscorrectandclickNext.TheFormatdialogbox

appears.8. Chooseyourformattype(werecommendFull)andclickStart.Thedisk

startsformatting.9. Whentheformattingisfinished,clickClose.TheFormatDialogclosesand

PC-cillinstartscopyingthefilestothedisk.10. Aseachfloppyisfinished,removeitandimmediatelylabelit.Youshould

alsowrite-protectitbyslidinguptheplasticbuttonthatisintheupperlefthandcornerofthebackofthedisk.Thediskiswrite-protectedwhenyoucanseethroughbothsquaresintheuppercorners.Creatingtherescuediskstakesabout10minutes.

11. Repeattheprocedureforeachdisk,startingfromtheformattingstep.

12. ClickFinish.

Important:Youcannotmakerescuedisksonamachineinfectedwithabootvirus.Besuretoclean(ordelete)anyvirusesthathavebeendetected.

Seealso:AboutrescuedisksUpdatingrescuedisksCleaningbootvirusesBootviruses

UpdatingrescuedisksRescueDisk3andotherscontainpatternfilesthatmustbekeptupdatedtoprovidethemosteffectivevirusscanning.Toupdatethepatternfilesonyourrescuedisks:

1. Insertthefirstpatternfilediskintothefloppydriveofyourcomputer.2. InserttheTrendMicroPC-cillin2002CDintotheappropriatedrive.

3. ClickStart>Programs>TrendMicroPC-cillin2002>CreatetheRescueDisks.Amessageboxappearsaskingforconfirmation.

4. ClickYes.TheCreatingtherescuedisksdialogboxappears.Youcanchoosewheretherescuediskfilesareextractedorjustusethedefaultlocation.Tochangewheretherescuedisksfilesareextracted,clickChangeandbrowsetoadifferentfolder.

5. ClickNext.PC-cillinextractstherescuediskfilestothespecifiedlocation.6. ClickPatternDiskonly,andthenClickNext.7. MakesuretheTargetdriveiscorrectandclickNext.TheFormatdialogbox

appears.8. Chooseyourformattype(werecommendFull)andclickStart.Thedisk

startsformatting.9. Whentheformattingisfinished,clickClose.TheFormatDialogclosesand

PC-cillinstartscopyingthefilestothedisk.10. Aseachfloppyisfinished,removeitandimmediatelylabelit.Youshould

alsowrite-protectitbyslidinguptheplasticbuttonthatisintheupperlefthandcornerofthebackofthedisk.Thediskiswrite-protectedwhenyoucanseethroughbothsquaresintheuppercorners.Creatingtherescuediskstakesabout10minutes.

11. Foreachdisk,repeattheprocedurestartingfromtheformattingstep.12. ClickFinish.

Important:DonotrestartyourcomputerusingarescuediskthatwascreatedforanearlierversionofPC-cillin--datalosscanresult.Norshouldyoubootfromrescuediskscreatedforoneoperatingsystem(Windows95)ifyouarerunningadifferentone(Windows98,WindowsMe).

Seealso:AboutrescuedisksCreatingrescuedisksCleaningbootvirusesBootviruses

CleaningbootvirusesBootsectorvirusesareespeciallytroublesome(anddangerous)virusesbecausetheyoccupyasensitivepartoftheharddrive,thebootsector,andloadintomemorywheneverthesystemisstarted.Frommemory,theyspreadeasilytoanyfilesthataresubsequentlyopenedandfloppydisksthatareused.Tocleanabootvirus:

1. Shutdownyourcomputerandturnoffthepower.2. InserttherescuedisklabeledEmergencyBootDisk(Disk1)inthefloppy

driveofyourcomputer.3. Afterwaitingafewseconds,turnyourcomputeron.Makesureyour

computerbootsfromthefloppydrive(refertoyourBIOSmanualforinstructions).

4. InsertthePCSCANFilesDisk(Disk2)andattheDOSprompt,andtypethefollowing:

pcscan/V/C

5. PressEnter.6. Whenprompted,insertthePatternFileDisk1andpressEnter.7. Whenprompted,insertthePatternFileDisk2andpressEnter.8. Whenprompted,insertthePatternFileDisk3andothersandpressEnter.

ThelastcommandtellsPC-cillintoscanandcleanallfilesonalldrives,includingthebootsector.

Important:Bootvirusesspreadeasily.IfPC-cillindetectedabootvirus,itisverylikelythatoneormoreofyourfloppydisksarealsoinfected.BesuretoruntheFloppyScantaskandcheckallyourfloppiesforviruses.Seealso:AboutrescuedisksCreatingrescuedisksUpdatingrescuedisksBootviruses

ViewingthePC-cillinwindowViewthePC-cillinwindowtorapidlycarryoutyouractions.OnthePC-cillinwindowyoucanaccessbothSimpleandStandardmodesaswellasthemenubar.ViewthefollowingimagetobecomemorefamiliarwiththePC-cillinwindow.ToviewthePC-cillinwindow,dooneofthefollowing:

ClickStart>Programs>TrendMicroPC-cillin2002>PC-cillin2002.Inthesystemtray,right-clicktheReal-timeMonitorandclickStartupPC-cillin.

ThePC-cillinwindowappears

.Seealso:ViewingtheSettingswindowAbouttheReal-timeMonitorStartingtheReal-timeMonitor

ViewingtheSettingswindowWhilethePC-cillinwindowprovidesthequickinterfacetorapidlycarryoutyouractions,theSettingswindowprovidestheinterfacewhereyoudefinetheactions.ViewthefollowingimagetobecomemorefamiliarwiththeSettingswindow.ToviewtheSettingswindow,dooneofthefollowing:

ClickStart>Programs>TrendMicroPC-cillin2002>PC-cillin2002Settings.Inthesystemtray,right-clicktheReal-timeMonitorandclickConfiguration.

TheSettingswindowappears.

Seealso:ViewingthePC-cillinwindowAbouttheReal-timeMonitorStartingtheReal-timeMonitor

AboutSimplemodePC-cillin2002letsyouchoosebetweenSimpleandStandardmodes.TheSimplemodeletsyouquicklyandeasilyperformcommonPC-cillintaskssuchasviewingasimplifiedversionofyoursystemstatus,andscanningalldrives.Inadditionyoucanupdateandregisteryoursoftware.ToviewtheSimplemode,onthePC-cillinwindow,clicktheSimpletab.Seealso:AboutStandardmode

ViewingSimplemodeSystemStatusViewingtheSimplemodeSystemStatusletsyouinstantlyknowthefollowingaboutyoursystem:

Timeoflastupdatepattern-Thelasttimeyouupdatedyourpatternfile.Real-timeScan-WhethertheReal-timeScanisturnedon(Enabled)orturnedoff(Disabled).VirusdetectedsincePC-cillinwasonguard-IfPC-cillindetectedavirus.PersonalFirewall-WhetherthePersonalFirewallisturnedon(Enabled)orturnedoff(Disabled).HackerattacksincePC-cillinwasonguard-IfPC-cillinhasdetectedahackerattack.

ToviewtheSimplemodeSystemStatus:


2. ClicktheSystemStatuslink.TheSystemStatusscreenappears.

Seealso:ViewingStandardmodeSystemStatus

AboutStandardmodeTheStandardmodemenuletsyouperformadvancedPC-cillin2002functionsincludingviewingyoursystemstatusinmoredetail,selectivelyscanningfolders,synchronizingyourPDA,quarantiningfiles,andviewinglogs.IntheStandardmode,asintheSimplemode,youcanalsoupdateandregisteryoursoftware.ToviewtheStandardmode,onthePC-cillinwindow,clicktheStandardtab.Seealso:AboutSimplemode

ViewingStandardmodeSystemStatusViewingtheStandardmodeSystemStatusprovidesdetailedReal-timeScanandPersonalFirewallinformation:

Real-timeScan-WhethertheReal-timeScanisturnedon(Enabled)orturnedoff(Disabled).Timeoflastvirusfound-LasttimePC-cillinfoundavirusonyourcomputer.Lastvirusfound-NameofthelastvirusPC-cillinfound.Lastinfectedfile-Nameofthelastinfectedfile.PersonalFirewall-WhetherthePersonalFirewallisturnedon(Enabled)orturnedoff(Disabled).Timeoflastattack-LasttimeyourcomputerexperiencedahackerattackSourceoflastattack-Locationthelasthackerattackoriginatedfrom.Lastattacktype-Typeofattackusedtotrytoharmyourcomputer.Bytessent-Numberofbytessentbyyourcomputer.Bytesreceived-Numberofbytesreceivedbyyourcomputer.

ToviewtheStandardmodeSystemStatus:


2. ClicktheSystemStatuslink.TheSystemStatusscreenappears.

Seealso:AboutStandardmodeViewingtheSimplemodeSystemStatus

ScanNowUseScanNowtoquicklyselectthedrivesorfoldersyouwanttoscanforviruses.PC-cillinscansthedrivesorfoldersandexecutesthenecessaryvirusactionsaccordingtothesettingsyouhaveconfiguredforManualScan.ToperformamanualscanusingScanNow:


2. ClicktheScanNowlink.TheScanNowscreenappears.3. UnderManualScan,selectthedrivesorfoldersyouwanttoscan.4. ClickScan.TheScanfilesdialogboxappears.

Seealso:RunningscantasksAboutManualScan

RunningscantasksScantasksareaquickandeasywaytoperformavarietyofscans.Youcanexecuteanyscantaskyouhavepreviouslydefined.Torunascantask:


2. ClicktheScanNowlink.TheScanVirusscreenappears.3. UnderScantasks,selectthetaskyouwanttoexecute.4. ClickExecute.TheScanFilesdialogboxappearsandPC-cillinbegins

scanning.

PC-cillin2002includesanumberofscantasksthathavebeenpre-defined.Inadditiontorunningthesescantasks,youcanalsoviewthemtogiveyouhintsabouthowtocreateyourowneffectivescantasks.=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A1>Scanformacroviruses=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A2>ScanC:\driveweekly=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A3>Scaneverythingmonthly=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A4>ScanfloppyA:\=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A5>ScanInternetrelatedfiles=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A6>ScanallWorddocuments=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A7>ScanallExceldocuments=4)&&(typeof(BSPSPopupOnMouseOver)=='function'))BSPSPopupOnMouseOver(event)"id=A8>ScanProgramfilesSeealso:ScanNowAboutscantasks

AboutPC-cillinforWirelessAsPDAsandotherhandheldcomputingdevicesincreasethenumberofwaysforcommunicatingwithotherdevices,frominfraredtransmitters,tomobilephoneinterfaces(high-endPDAsevenfeatureInternetconnectivity),thechancesofbecominginfectedbyvirusesalsoincrease.Withfeatureslikereal-timelaunchscanning(forPalmPDAs),PC-cillinforWirelesspreventsvirusesfromenteringeverypossibleentrypoint--beaming,synchronizing,email,andInternetdownloading.Note:Thereal-timelaunchscanningforPalmPDAsisactivatedwhenyoutap

theVirusApplication.Seealso:AboutIntelligentUpdateUpdatingPC-cillinforWirelessSelectingPDAOStype

AboutquarantinedfilesPC-cillin2002cansafelyquarantinefilesthatcannotbecleanedorsuspiciousfilesthatmaycontainnew,unknownviruses.QuarantinedfileswillnotspreadandmaybesenttoTrendMicro'seDoctorLab,deleted,orheldforfurtheranalysisandrepair.Youshouldquarantinefilesthatcan'tbecleaned.Althoughyoucoulddeletethefile,ifyouquarantineit,youhavealotmoreoptions.Forexample,perhapsafterthenextpatternfileupdateyoucancleanthefile.Youcanalsorestoreit,sendittoTrendMicroforanalysisandmanuallycleaning,orultimatelyyoucanstilldeleteitifyouchoose.However,infectedfilesplacedinquarantinearenotimmediatelycleanedandthefileremainsinfecteduntilcleaned.Formaximumprotectionagainstthelatestviruses,remembertohavethelatestviruspatternfilesandscanengineupdatesinstalledonyourcomputer.Note:Infectedfilesthatarepartofacompressedfilearenotautomatically

quarantined--youmustfirstdecompressthefiletohavePC-cillintaketheactionspecified.

Seealso:AddingfilestotheQuarantinefolderCleaningquarantinedfilesDeletingquarantinedfilesRestoringquarantinedfilesSendingquarantinedfilestoTrendMicroWhathappensifavirusisdetected

AddingfilestotheQuarantinefolderYoucanmanuallyaddfilestotheQuarantinefolder.Performthisactionifyoususpectafileisinfectedandthescanengineisunabletocleanthefile.Forexample,ifyoureceivedanemailwithanattachmentfromsomeoneyoudon'tknowandaccidentallysavedtheattachmenttoyourcomputer.ToaddafiletotheQuarantinefolder:


2. OntheStandardmodemenu,clicktheQuarantinelink.TheQuarantinescreenappears.

3. ClickAdd.TheOpendialogboxappears.4. Browsetothelocationofthefile.5. SelectthefileandclickOpen.Aconfirmationmessageboxappears.6. ClickYes.ThefileappearsintheQuarantineList.

Seealso:AboutquarantinedfilesCleaningquarantinedfilesDeletingquarantinedfilesRestoringquarantinedfilesSendingquarantinedfilestoTrendMicroWhathappensifavirusisdetected

CleaningquarantinedfilesFilesmovedtotheQuarantinefoldermaystillcontainavirus.EverytimeyouupdateyourpatternfilesoranyotherPC-cillinprogramfiles,trytocleanquarantinedfiles.Tocleanaquarantinedfile:



3. IntheQuarantineList,selectthefileyouwanttoclean.4. ClickCleantoattempttocleanthefile.

Seealso:AboutquarantinedfilesAddingfilestotheQuarantinefolderDeletingquarantinedfilesRestoringquarantinedfilesSendingquarantinedfilestoTrendMicroWhathappensifavirusisdetected

DeletingquarantinedfilesSincefilesmovedtotheQuarantinefoldermaystillbeinfected,itmaybenecessarytodeletethefilesifthefilecannotbecleanedevenafterusingthelatestpatternfilesandscanengines.Todeleteaquarantinedfile:



3. IntheQuarantineList,selectthefileyouwanttodelete.4. ClickDelete.Aconfirmationmessageboxappears.5. ClickYestodeletethefile.

Seealso:AboutquarantinedfilesAddingfilestotheQuarantinefolderCleaningquarantinedfilesRestoringquarantinedfilesSendingquarantinedfilestoTrendMicroWhathappensifavirusisdetected

RestoringquarantinedfilesAfterafileintheQuarantinefolderhasbeencleanedyoucanrestoreittoitsoriginallocation.Inaddition,theremaybetimeswhenfilesmovedtotheQuarantinefoldermaycauseanapplicationorevenyouroperatingsystemtostopfunctioningproperly.Inthissituation,youmayneedtorestorequarantinedfilestotheiroriginallocation.Torestoreaquarantinedfile:



3. IntheQuarantineList,selectthefileyouwanttorestore.4. ClickRestore.Aconfirmationmessageboxappears.5. ClickYestorestorethefiletoitsoriginallocation.

Seealso:AboutquarantinedfilesAddingfilestotheQuarantinefolderCleaningquarantinedfilesDeletingquarantinedfilesSendingquarantinedfilestoTrendMicroWhathappensifavirusisdetected

SendingquarantinedfilestoTrendMicroIfthefilecannotbecleanedevenafterusingthelatestpatternfilesandscanengines,youcansendittoTrendMicroforfurtheranalysis.TheinfectedfileisautomaticallyroutedtotheTrendMicrovirusexpertonduty.Becausewehaveofficesaroundtheworld,virusexpertsareondutyaroundtheclock.Ifit'snighttimeintheUnitedStates,forexample,thefileisroutedtoourvirusanalysislabinAsia.TosendaquarantinedfiletoTrendMicro:



3. IntheQuarantineList,selectthefileyouwanttosenttoTrendMicro.4. ClickSendtoTrend.Amessageboxappears.5. ClickOK.ThequarantinedfileissenttoTrendMicroforanalysis.

Seealso:AboutquarantinedfilesAddingfilestotheQuarantinefolderCleaningquarantinedfilesDeletingquarantinedfilesRestoringquarantinedfilesWhathappensifavirusisdetected

AboutlogsPC-cillinkeepsrunninglogsofallupdate,virus,Sitefilter,andPersonalFirewallactivity.TheselogscanbeviewedfromtheViewLogsscreenandprovideavaluablesourceofinformation.Inadditiontodisplayingthedateandthetimeofeachrecordedlog,thevariouslogtypesprovidelog-specificinformation:UpdateLogs:PC-cillinkeepsarunningrecordofeachtimeitcontactsTrendMicrotoupdatetheviruspatternfileorprogramfiles.Newlogsarecreatedwhenadownloadisperformed.Updatelogentriesalsocontain:thetimetheviruswasdetected;whatfile(s)weredownloadedandinstalledfromTrendMicro;thestatus--SuccessorFailure--ofthedownload.VirusLogs:PC-cillinkeepsarecordofallthevirusesitdetectsandtheactionsperformedonthem.Newlogsarecreatedwhenavirusisdetected.Viruslogentriesalsocontain:thetimetheviruswasdetected;thetypeofscan--Real-timeoraScanTask--thatdetectedthevirus;thesourcetypeofthevirus;thenameofthevirus;thenameoftheactualfilethatcontainsthevirus;thesuccessorfailurethefirstactiontookontheinfectedfile;andthesuccessorfailurethesecondactiontookontheinfectedfile.SiteFilterLogs:PC-cillinrecordsitsWebSecurityactivity.NewlogsarecreatedwhenaWebsiteisblockedorharmfulWebcontentencountered.Sitefilterlogentriesalsocontain:thetimeaccesstoarestrictedsitewasattempted;theURL,orWebaddress,thatwasblocked;theActiontheWebfiltertook;andeitherDenyAccessorWarn.PersonalFirewallLogs:PC-cillinlogsallofitsInternetactivity.NewlogsarecreatedwhenyourcomputerisattackedfromsomeoneusingtheInternet.PersonalFirewalllogentriesalsocontain:thetimeoftheattack;thedirectionofthenetworktraffic(IN/OUT);thetypeofprotocolused;theIPaddressofthesource;theportnumberofthesource;theIPaddressofthedestination;theportnumberofthedestination;thenameoftheattacktype.Seealso:ViewinglogsExportinglogsDeletinglogs

ViewinglogsYoucanviewthefollowingtypesoflogs:Update,Virus,SiteFilter,andPersonalFirewall.Thelogentriesaregroupedaccordingtothedatetheeventoccurred.Toviewalog:


2. OntheStandardmodemenu,clicktheViewLogslink.TheViewLogsscreenappears.

3. UnderLogType,clickthetypeoflogyouwanttoview(forexample:Update,Virus,SiteFilter,andPersonalFirewallLogs).

4. ClicktheViewLogsbutton.Thelogdialogboxappears.5. Selectthedateofthelogyouwanttoview.Thelogentriesforthatdate

appear.6. Tosortthelogs(ascendingordescending)bycolumnheader(forexample:

Time),clickthecolumntitleforthedesireddisplay.

Seealso:AboutlogsExportinglogsDeletinglogs

ExportinglogsYoucansavelogentriesandprintthemoutorexaminethemindetail.Savelogentriesasacomma-separatedvalue(CSV)file(filesaretextwitheachofthefieldsseparatedbyacomma)orasaplaintextfile.ThedefaultfileformatisCSV.Toexportalogentry:



3. UnderLogType,clickthetypeoflogyouwanttoexport.4. ClicktheViewLogsbutton.Thelogdialogboxappears.5. UnderLogDate,selectthedateofthelogentriesyouwanttoexport.The

logentriesforthatdateappear.6. ClickExport.TheSaveAsdialogboxappears.7. Browsetothedesiredlocationandtypeanameforthelogentry.Tosaveas

aplaintextfile:intheSaveastypelist,choosetextfile.8. ClickSave.

Seealso:AboutlogsViewinglogsDeletinglogs

DeletinglogsDeletelogentriesiftheinformationtheyprovideisnolongeruseful.Ifthenumberoflogsistakinguptoomuchdiskspaceyoumayalsowanttodeletelogentriesforcertaindates.Todeletealogentry:



3. UnderLogType,clickthetypeoflogyouwanttodelete.4. ClicktheViewLogsbutton.Thelogdialogboxappears.5. UnderLogdate,selectthedateofthelogentryyouwanttodelete.Thelog

entriesforthatdateappear.6. ClickDelete.TheDeletelogsdialogboxappears.7. FromtheDeletelogsbeforeandincludingthedatelist,selectadate.8. ClickOK.Aconfirmationmessageboxappears.9. ClickYestodeletethelogentries.

Seealso:AboutlogsViewinglogsExportinglogs

AbouttheReal-timeMonitorTheReal-timeMonitoristhequickestwaytoaccesscertainfunctions,forexampletodisplaythePC-cillinorSettingswindows.WiththeReal-timeMonitor,youknowataglanceifreal-timescanningisenabled(thelightningstreakiconisred)ordisabled(thelightningstreakiconisgrey).

TheEmergencyLockisactivated.AllincomingandoutgoingInternettrafficishalted.

PC-cillinisconnectingtotheTrendMicroservertodownloadthelatestupdates.

Yourcomputeriscurrentlyunderattack.

Thereal-timescanningfunctionisenabled.

Thereal-timescanningfunctionisdisabled.

TheReal-timeMonitorcanhelpyouperformthefollowing:

OpenthePC-cillinwindowEnabletheEmergencyLockEnablereal-timescanningOpentheSettingswindowViewthereal-timestatusExittheReal-timeMonitor

Seealso:StartingtheReal-timeMonitorOpeningthePC-cillinwindowOpeningtheSettingswindowViewingReal-timeSatus

StartingtheReal-timeMonitorWhenthePC-cillinprogramloads,theReal-timeMonitorshouldautomaticallylaunchandappearsinyoursystemtray.However,ifyoudonotseetheReal-timeMonitorinyoursystemtray,werecommendyoulaunchit.TostarttheReal-timeMonitor,clickStart>Programs>TrendMicroPC-cillin2002>Real-timeMonitor.TheReal-timeMonitoriconappearsinthesystemtray.

Seealso:AbouttheReal-timeMonitorOpeningthePC-cillinwindowOpeningtheSettingswindowViewingReal-timeSatus

OpeningthePC-cillinwindowUsetheReal-timeMonitortoquicklyopenthePC-cillinwindow.ToopenthePC-cillinwindow:


2. Dooneofthefollowing:

Double-clicktheReal-timeMonitor.Right-clicktheReal-timeMonitorandclickStartupPC-cillin.

ThePC-cillinwindowappears.Seealso:AbouttheReal-timeMonitorStartingtheReal-timeMonitorOpeningtheSettingswindowViewingReal-timeSatus

OpeningtheSettingswindowUsetheReal-timeMonitortoquicklyopentheSettingswindow.ToopentheSettingswindow:


2. Right-clicktheReal-timeMonitorandclickConfiguration.TheSettingswindowappears.

Seealso:AbouttheReal-timeMonitorStartingtheReal-timeMonitorOpeningthePC-cillinwindowViewingReal-timeSatus

ViewingReal-timeStatusViewtheReal-timestatustodisplaythepatternfileversionyouarecurrentlyusingandthenameofthelastfilescanned.ItalsodisplaysFirewalltrafficinformationandthestatusoftheEmergencyLock.Inaddition,youcanactivatetheInternetEmergencyLockfunctiontoimmediatelyhaltallnetworkactivity.ActivatingtheEmergencyLockfunctionimmediatelystopsalltraffictoandfromtheInternet.ToviewtheReal-timeStatus:


2. Inthesystemtray,right-clicktheReal-timeMonitoriconandclickReal-timeStatus.TheReal-timeScanMonitordialogboxappears.

Note:IntheReal-timeScanMonitordialogbox,youcanclicktheEmergencybuttontoactivatetheEmergencyLock.

Seealso:AbouttheReal-timeMonitorStartingtheReal-timeMonitorOpeningthePC-cillinwindowOpeningtheSettingswindow

PDAvirusesTheincreasingpowerofPDAshasspawnedanewbreedofviruses.MaliciouslycreativeprogrammershaveleveragedthePDA'sabilitytocommunicatewithotherdevicesandrunprograms,tocausedigitalmayhem.TheblissfullysafeworldwhereusersofthesedevicescouldsynchronizeanddownloadwithimpunitycametoanendinAugust2000withthediscoveryofthePalmLiberty.Avirus.Sincethen,manymoreviruseshavebeendiscovered.ThoughnotyetasharmfulastheirPC-basedcousins,thesevirusesstillposeathreattounsuspectingusers.Theireffectsvaryfromtheharmlessflashingofanunwantedmessageoranincreaseinpowerconsumption,tothedeletionofallinstalledprograms.Butthethreatisgrowing,andthedestructivenessofthesevirusesisexpectedtoparallelthedevelopmentofthedevicestheyattack.Seealso:ScanningforPDAvirusesDealingwithPDAvirusesGettingPDAvirusinformation

PC-cillinforWirelessSystemRequirementsSystemRequirementsYourPDArequiresthefollowingtorunPC-cillinforWireless.

Palm

Palm®OS3.1orabove2MBofmemoryormoreMinimum100KBoffreememoryforprograminstallationDesktopcomputermusthavePalmDesktopandHotSync®applications

EPOC

PsionRevo™orRevoPlus8MBofRAMormoreMinimum200KBoffreememoryforprograminstallation.DesktopcomputermusthavePsiWinapplication

PocketPC

WindowsCE®3.016MBofRAMormoreMinimum1MBoffreememoryforprograminstallationDesktopcomputermusthaveMicrosoftActiveSyncapplication

InstallingPC-cillinforWirelessPreviousversionsofPC-cillinforWirelessarenotsupportedforProgramupdateandunlikethePC-cillin2002mainprogram,PC-cillinforWirelessisnotoverwrittenduringinstallation.IfyouhaveaPDAconnectedtoyourcomputer,duringinitialinstallationofPC-cillin2002thereareadditionalinstallationproceduresyouneedtofollowbasedonyourPDAOStype.EvenifyouinstalledPC-cillin2002andthenaddedaPDAtoyourcomputer,PC-cillindetectsthePDAtypeandletsyouselectyourPDAtypeintheUpdatePDAscreenoftheSettingswindow.However,ifyourPDAisnotaPalmPDA,youneedtoperformthefollowingadditionalproceduretosynchronizeyourPDA.Note:ToinstallPC-cillinforWirelesswhileinstallingthePC-cillin2002main

program,itisnecessarytohavePDAsynchronizationsoftwareforyourPDAinstalledonyourPC,andthePDAdevicemustbeconnectedtothePCbeforerunningtheinstallationprogram.

ForEPOCandPocketPCPDAs:YouhavetoperformthefollowingprocedureonlyifyouinstalledanEPOCorPocketPCPDAafteryouinstalledPC-cillin2002.Tomanuallyinstallsynchronizefiles:

1. InsertthePC-cillin2002CDintotheappropriatedrive.2. OntheCD,navigatetotheWirelessfolder(PCC9\programfiles\Trend

Micro\PC-cillin).Dooneofthefollowing:

ForEPOCPDAs:Double-clickthePcciEpoc.sisfile.ForPocketPCPDAs:Double-clickthePocketPC.exefile.

Followtheonscreeninstructions.

DealingwithPDAvirusesTherearetwoactionsavailableifavirusisdetected:bypassordelete.

Totakenoactionagainstthedetectedviruses,taptheBackbuttontoreturntotheprogram'sentryscreen.Todeletealldetectedviruses,taptheDeleteAllbutton.Todeleteonlyselectedviruses,choosethetargetvirusonthelistofdetectedviruses,andtaptheDeletebutton.

Seealso:AboutPDAvirusesScanningforPDAvirusesGettingPDAvirusinformation

GettingPDAvirusinformationVirusinformationcanbeviewedeitherfromthemainscreen,oronthescanresultsscreen.

FromtheMainScreen:

1. TaptheVirusInfobutton.Thisopensthevirusencyclopedia.2. Selectthevirusyouwishtoinquireabout.3. TaptheDescriptionbuttontoviewthevirusdescription.

FromtheScanResultsScreen:

1. Selectthevirusyouwanttoknowmoreaboutfromthelistofdetectedviruses.

2. TaptheDescriptionbuttontoviewthevirusdescription.

Seealso:AboutPDAvirusesScanningforPDAvirusesDealingwithPDAviruses

UsingthePC-cillinforWirelessVirusLogTheviruslogstoresinformationaboutvirusesdetectedduringpreviousscansandtheactiontakenagainstthem.Toviewthelog,taptheLogbuttononthemainscreen.TheVirusScanLogscreenshowsthedetectedvirusesaswellasthesizeoftheloginbytes.TaponBacktoreturntothemainscreen,orClearLogtodeletethelogentries.Inthelatteroption,adialogboxappearsforyoutoconfirmlogdeletion.TaponYestocontinue,orNotoaborttheoperation.

UninstallingPC-cillinforWirelessfromyourPDATouninstallPC-cillinforWirelessfromyourPalm:

1. SelectDeletefromthePalmsystemmenutobringuptheDeletelist.2. Removethefollowingfiles:

PC-cillin-themainprogramfilePATTERN.xxx-thepatternfilePccillin.log-thelogfile;thiscontainsloginformationRealtime-thereal-timescanningmodule

3. TapDonetoreturntothemainscreen.AfteryouremovetheRealtimefile,thesystemrestarts.

TouninstallPC-cillinforWirelessfromyourEPOC:

1. ClosethePC-cillinforEPOCprogrambyclickingtheESCbutton.2. ClickControlPanelontheright-handsidebar.3. Double-taptheAdd/RemoveicontoopentheInstalledProgramsdialog

box.4. SelectthePC-cillinforEPOCitem,thentapRemove.Aconfirmation

dialogboxopens.5. TapYestoremovetheprogram.

TouninstallPC-cillinforWirelessfromyourPocketPC:

1. ClosePC-cillinforPocketPCbytappingtheOKbuttonatthetop-rightcornerofthescreen.

2. ClickStart>SettingstoopentheSettingsdialog.3. SelecttheSystemtabandthentaptheRemoveProgramsicon.4. SelecttheTrendMicroPC-cillinforPocketPCitem,thenclickRemove.

TheRemoveProgramdialogboxopens.5. TapYestoremovetheprogram.

UninstallingPC-cillinBeforeuninstallingPC-cillin,youmuststopReal-timescanning.Youcandothisbyright-clickingthePC-cilliniconinthesystemtrayandthenclickingReal-timeMonitortoclearthecheck,ifany.Thelightningbolticonturnsgreywhenreal-timescanningisdisabled.Duringuninstallation,PC-cillindeletesallquarantinedfiles.Thesefilesmaycontain"live"virusesandshouldnotbeleftonyourcomputer.Ifyoumustpreservethem,wesuggestthatyoucopytheentiredirectorytoasafelocationsuchasaspeciallymarkedfloppydisk.TouninstallPC-cillin,dooneofthefollowing:

ClickStart>Programs>TrendMicroPC-cillin2002>Uninstall.Aconfirmationdialogboxappears.ClickYestouninstallPC-cillin.ClickStart>Settings>ControlPanel.Double-clickAdd/RemoveProgramsandselectPC-cillin2002.ClickAdd/Remove.Aconfirmationdialogboxappears.ClickYestouninstallPC-cillin.

MaintainingconstantprotectionfromvirusesReal-timescanningprovidesconstantprotectionagainstviruses.WithReal-timescanningturnedon,youcansignificantlyreducethechancesofyourcomputerbecominginfected.Thereal-timescannerchecksfilesforviruseswhenevertheyareusedforexample,eachtimeafileis:opened,copied,moved,saved,compressedordecompressed,downloadedfromtheInternet,and,inthecaseofemailattachments,read.Becauseitissopowerfulandoperatesinthebackground,werecommendyoukeepReal-timescanningenabled.Tomaintainconstantprotectionfromviruses:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheQuickAccesslink.TheQuickAccess

screenappears.3. SelecttheEnableReal-timeScancheckbox.4. ClickApply.

Seealso:AboutReal-timeScan

ProtectingagainstemailthreatsPC-cillincanscandatapacketsasyoudownloadmailmessagesfromanInternet(POP3)mailserver.Thismakessureinfectedattachmentsdon'tinfectyourcomputer.SomeexamplesofmailclientsthatusePOP3mailserversinclude:MicrosoftOutlook,OutlookExpress,EudoraPro,andNetscapeMessenger.Toprotectagainstemailthreats:


screenappears.3. SelecttheEnableInternetmailscancheckbox.4. ClickApply.

Seealso:AboutInternetmailscan

PreventingInternetprogramsfromharmingyourcomputerWebTrapprotectsagainstmaliciousJavaandActiveXapplets.AlthoughmostWebsitesarecompletelyharmless,itispossibleforsomeonetocreateasmallprogramandsetittorun,invisibly,whenevertheirWebpageisaccessed.Theseprogramsmaydestroydata,stealyourpasswords,financialdata,etc.PC-cillin'sWebTrapprotectsyouagainstmaliciousJavaandActiveXprogramswhileallowingharmlessonestosafelypassthrough.TopreventInternetprogramsfromharmingyourcomputer:


screenappears.3. SelecttheEnableWebTrapcheckbox.4. ClickApply.Amessageboxappearsnotifyingyouthatthechangewillnot

takeeffectuntilyourestartyourcomputerorlogoffandlogonagain.5. ClickOK.6. Restartyourcomputerorlogonagaintoimmediatelyenablethefunction.

Seealso:AboutWebTrap

FilteringunwantedWebcontentForprotectionagainstoffensiveWebcontent,PC-cillinofferstheSitefilter.ThisutilityletsyousetwhateverWebsitesyouwant"off-limits"tootherusersofthecomputer.Thisfunctionisespeciallyusefulforfamilieswheremanyfamilymembersshareonecomputer.TofilterunwantedWebcontent:


screenappears.3. SelecttheEnableSitefiltercheckbox.4. ClickApply.Amessageboxappearsnotifyingyouthatthechangewillnot

takeeffectuntilyourestartyourcomputerorlogoffandlogonagain.5. ClickOK.6. Restartyourcomputerorlogonagaintoimmediatelyenablethefunction.

Note:Ifyouhavepassword-protectedyourSitefilterscreenandtrytoenabletheSitefilterontheQuickAccessscreen,youmustsupplyyourpassword.Seealso:AbouttheSiteFilter

BlockingharmfulInternetconnectionsThePC-cillin2002PersonalFirewallprotectsyourcomputeragainstattacksfromtheInternet.Afirewallcreatesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).ThisbarrierexaminesandfilterstheincomingandoutgoingInternettraffic.ByfilteringInternettraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.ToblockharmfulInternetconnections:


screenappears.3. SelecttheEnablePersonalFirewallcheckbox.4. ClickApply.

Seealso:AboutthePersonalFirewall

AboutvirusscanactionsWhathappenswhenPC-cillindetectsavirus?ItdependsontheactionthatisconfiguredintheSettingswindow.ForbothManualScanandReal-timeScan,youcansetactionsPC-cillinexecuteswhenitdetectsavirus.YoucanalsosetactionsPC-cillinwillperform,ifforsomereason,PC-cillinisunabletocleanavirus.AnyactionPC-cillintakesisrecordedasalogentryintheViruslog.ForaReal-timeScan,thesevirusscanactionsincludethefollowing:

DenyAccess-Denytheuseraccesstotheinfectedfile.Rename-Modifythefile'sextensiontopreventopeningorexecution.Quarantine-Moveinfectedormaliciousfilestoarestrictedaccessfolder.Clean-Removeviruscodefrominfectedfiles.Delete-Removetheinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).

ForaManualScan,allthevirusactionsarethesameasaReal-timeScanwiththeexceptionofDenyAccess.InsteadtheManualScanactionis:Pass-RecordvirusinfectionormaliciousfilesintheViruslogbuttakenoaction.Seealso:SettingvirusscanactionsSettingvirusscanactionsifunabletocleanfileCleaningcompressedfilesBackingupfilesbeforecleaning

SettingvirusscanactionsForbothManualScanandReal-timeScan,youcansetactionsPC-cillinexecuteswhenitdetectsavirus.Werecommendyouusethedefaultscanactionsetting,Clean.AnyvirusscanactionPC-cillinexecutesisrecordedasalogentryintheViruslog.Tosetavirusscanaction:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.Doone

ofthefollowing:

TosetManualScanvirusscanactions,clicktheManualScanlink.TosetReal-timeScanvirusscanactions,clicktheReal-timeScanlink.

Dependingonthelinkyouclicked,theManualScanorReal-timeScanscreenappears.

3. OntheManualScanorReal-timeScanscreen,underScanaction,selectoneofthefollowingvirusscanactionsfromtheActionwhenvirusfoundlist:

DenyAccess-Denytheuseraccesstotheinfectedfile(Real-timeScanonly).Pass-RecordvirusinfectionormaliciousfilesintheViruslog,buttakenoaction(ManualScanonly).Rename-Modifythefile'sextensiontopreventopeningorexecution.Quarantine-Moveinfectedormaliciousfilestoarestrictedaccessfolder.Clean-(Default)Removeviruscodefrominfectedfiles.Delete-Removetheinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).

4. ClickApply.

Seealso:AboutvirusscanactionsSettingvirusscanactionsifunabletocleanfile

CleaningcompressedfilesBackingupfilesbeforecleaning

SettingvirusscanactionsifunabletocleanfileYoucanalsosetactionsPC-cillinwillexecuteifafilecannotbecleaned.Ifafilecan'tbecleaned,youshouldquarantinethefile.Therefore,werecommendyouusethedefaultscanactionsetting,Quarantine.Althoughyoucoulddeletethefile,ifyouquarantineit,youhavealotmoreoptions.Forexample,perhapsafterthenextpatternfileupdateyoucancleanthefile.Youcanalsorestoreit,sendittoTrendMicroforanalysis,orultimatelyyoucanstilldeleteitifyouchoose.AnyvirusscanactionPC-cillinexecutesisrecordedasalogentryintheViruslog.Tosetavirusscanactionifunabletocleanafile:


ofthefollowing:

TosetManualScanvirusscanactionsifunabletocleanafile,clicktheManualScanlink.TosetReal-timeScanvirusscanactionsifunabletocleanafile,clicktheReal-timeScanlink.


3. OntheManualScanorReal-timeScanscreen,underScanaction,selectoneofthefollowingvirusscanactionsfromtheActiononuncleanablefileslist:

DenyAccess-Denytheuseraccesstotheinfectedfile(Real-timeScanonly).Pass-RecordvirusinfectionormaliciousfilesintheViruslog,buttakenoaction(ManualScanonly).Rename-Modifythefile'sextensiontopreventopeningorexecution.Quarantine-(Default)Moveinfectedormaliciousfilestoarestrictedaccessfolder.Delete-Removeinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).

4. ClickApply.

Seealso:AboutvirusscanactionsSettingvirusscanactionsCleaningcompressedfilesBackingupfilesbeforecleaning

CleaningcompressedfilesFilecompressioninvolvesshrinkingthesizeofafileorfilesusingadatacompressionformat.OneofthemostpopularistheZipformat.Compressedfilesareusefulfortransferringinformationovernetworksbecauseofthesmallerfilesize.Forexample,let'ssaytherearefivefiles,A.doc,B.doc,C.doc,D.doc,andE.doc:C.docisinfectedwithamacrovirus,andtheyareallpackedintoasinglecompressedfilecalleddocs.zip:[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)].YoucansetPC-cillintodetectthevirusinC.doc,issueanalert,andwritetheeventtotheViruslog.BecauseC.docisinthefirstlayer,PC-cillinwillautomaticallyexecutetheactionyouhavespecifiedwhenPC-cillindetectsavirusuptothesecondlayer.IfyouhaveselectedtheCleanvirusesincompressedfilescheckbox.PC-cillinisabletocarryoutthisactiononlyiftheinfectedfileiscontainedinthesecondlayerorlessofthecompressedfile.However,ifC.docwaslocatedinadeeperlayerofcompression,forexample,{docs1.zip[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)]}.AlthoughPC-cillincoulddetectit(ifyouhavesetyourscancompressionlayerstoanumbergreaterthanthree)itisunabletoperformanyscanaction.Therefore,ifyouwanttocleanC.doc,useWinZip,oranothercompressionprogramtodecompressthecompressedfile.Whentheindividualfileshavebeendecompressed,right-clickC.docandclickPC-cillin.PC-cillinwillperformthescanactionyouhavesetforManualScans.Tocleanacompressedfile:


ofthefollowing:

TosetManualScanvirusscanactions,clicktheManualScanlink.TosetReal-timeScanvirusscanactions,clicktheReal-timeScanlink.


3. OntheManualScanorReal-timeScanscreen,underScanactionmakesure

CleanisselectedfromtheActionwhenvirusfoundlistandselecttheCleanvirusesincompressedfilescheckbox.

4. ClickApply.

Seealso:AboutvirusscanactionsSettingvirusscanactionsSettingvirusscanactionsifunabletocleanfileBackingupfilesbeforecleaning

BackingupfilesbeforecleaningDuringthecleanprocessitispossiblethefilebeingcleanedmaysuffersomedamage.YoucansetPC-cillintorenameandbackupthefilestotheBackupfolder(locatedintheQuarantinefolder)beforecleaningtheoriginalfiles.Thisisasafetyprecautionincasetheoriginalfileiscriticalandbecomesdamagedwhilebeingcleaned.Backedupfilesshouldbequicklydeletedonceyou'vedeterminedwhethertheoriginalfileisusableafterbeingcleaned.Ifnot,andthefileismissioncritical,youcansendittoTrendMicroforfurtheranalysis.(Evenifthevirusitselfcanbecompletelyremoved,i.e.,thefilecleaned,somevirusescandamagetheoriginalfilecodebeyondrepair.)Tobackupfilesbeforecleaning:


ofthefollowing:

TosetManualScanvirusscanactionsifunabletocleanafile,clicktheManualScanlink.TosetReal-timeScanvirusscanactionsifunabletocleanafile,clicktheReal-timeScanlink.


3. OntheManualorReal-timeScanscreen,underScanactionselecttheBackupfilesbeforecleaningcheckbox.

4. ClickApply.

Seealso:AboutvirusscanactionsSettingvirusscanactionsSettingvirusscanactionsifunabletocleanfileCleaningcompressedfiles

AboutManualScanAScanNow(ManualScan)occursimmediatelyafteryouchooseyourscantargetandrunthefunction.ScanNowisaneffectivewaytocheckafile,folder,ordrivethatyoususpecthasbeeninfectedandyouwantimmediateconfirmationaboutthestatus.WhenPC-cillindetectsavirusorothermaliciouscode,itperformsthenecessaryactionsaccordingtothesettingsyouhaveconfiguredforManualScan.Seealso:AboutvirusscanactionsSelectingManualScanfiletypesAddingManualScanfiletypesSettingManualScancompressionlayersIncludingthebootsector

SelectingManualScanfiletypesThePC-cillin2002ManualScanonlyexaminesthosefiletypesconfiguredintheSettingswindow.ThefollowingisalistofoptionsyoucansettoselectManualScanfiletypes:

Allfiletypes-Examineallfilesnomatterwhattype--thehighestlevelofsecurity.However,thereisatradeoffbetweenspeedandsafety.Scanningallfilestakeslongerthanscanningonlyspecifiedfilestypes.However,mostfiletypes,forexample.TXT,.JPG,.AVI,.HLP,.PDF,etc.,arenotknowntohostorspreadvirusesandprobablydonotrequirescanning.ButthenagainuntilAugust1995,documentfiles(.DOC,.XLS,etc.)hadneverbeenknowntocarryviruseseither.Andnowmacrovirusesarethemostprevalent.Recommendation-ExamineonlythosefiletypesrecommendedbyTrendMicrovirusanalysts.Theserecommendedfiletypesareknowntohaveahigherriskofcontainingviruses.Anyfileswhoseextensiondoesnotappearonthelistwillnotbescanned."Zip"andothercompressedfiletypesmustbespecifiedtobeincludedinthescan.SelectedFiles-Examinethefiletypesyouset.UsingthisoptionyoucancustomizethetypesoffilesPC-cillinwillexamine.Anyfileswhoseextensionisnotspecifiedwillnotbescanned."Zip"andothercompressedfiletypesmustbespecifiedtobeincludedintheManualScan.

ToselectManualScanfiletypes:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheManualScanlink.TheManualScanscreenappears.4. UnderScanfiletypes,clickoneofthefollowing:

Allfiletypes-Thebuttonbecomesdisabled.Recommendation-ThebuttoncaptionbecomesViewFileTypes.ClickViewFileTypestoseealistofTrendMicrorecommendedhigher-riskfiletypes.SelectedFiles-ThebuttoncaptionbecomesSelectFileTypes.

5. ClickApply.

Seealso:AboutvirusscanactionsAboutManualScanAddingManualScanfiletypesSettingManualScancompressionlayersIncludingthebootsector

AddingManualScanfiletypesDefineyourownfiletypestoscanforhigh-riskfilesthatarenotincludedintherecommendedfilelist.Thisincreasesthescanningspeedbecauseyoudon'tscanallfiletypes.However,whenyouselectthisoption,PC-cillinwillonlyscanforselectedfiletypesduringaManualScan.Toaddafiletype,yousimplyprovidethefiletypeorextension(threeletter"suffix"thatidentifiesthetypeoffile)thatyouwantPC-cillintoexamine.Examplesoffiletypesorextensionsinclude:annualreport.doc,4thquartersales.xls,win.com,calculator.exe.Youcanaddcompressedfiletypestothelistofthosescannedorremoveunnecessaryfiletypes.ToaddaManualScanfiletype:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheManualScanlink.TheManualScanscreenappears.4. UnderScanfiletypesclickSelectedFiles.ThebuttoncaptionbecomesSelectFileTypes.

5. ClickSelectFileTypes.TheFileTypesdialogboxappears.6. ClickAdd.TheAddFileType(s)dialogboxappears.7. IntheExtensionbox,typeyourfileextension.Youcanjusttypetheletters

ofyourfiletype,itisunncessarytoincludea"."beforethefiletypeortotypeinupper-case.

8. ClickOK.Youcanalsodothefollowing:

Todeleteafiletype,selectitandclickDelete.Thefiletypeisremovedfromthelist.Toaddcompressedfiletypes(ARJ,CAB,CO_,DO_,EX_,LZH,XL_andZIP),clickCompressed.Thecompressedfiletypesareaddedtothelist.Torestorealistofthedefaultfiletypes,clickDefault.Theoriginaldefaultfiletypesareaddedtothelist.

9. ClickOK.

10. ClickApply.

Seealso:AboutvirusscanactionsAboutManualScanSelectingManualScanfiletypesSettingManualScancompressionlayersIncludingthebootsector

SettingManualScancompressionlayersPC-cillinrecognizesmanytypesoffilecompressionincludingPK-ZIPandLZEXE,andfourtypesoffileencoding,includingUUencodeandMIME.Filecompressioninvolvesshrinkingthesizeofafileorfilesusingadatacompressionformat.OneofthemostpopularistheZipformat.Compressedfilesareusefulfortransferringinformationovernetworksbecauseofthesmallerfilesize.PC-cillinwillcheckthecontentsofacompressedfileforvirusesbasedonthenumberoflayersyouhaveset.Usuallywhenfilesarecompressedtheyareonlycompressedtothefirstlayer:[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)]i.e.,thecompressedfile[docs.zip]containsthefiles(A.doc,B.doc,C.doc,D.doc,E.doc)whicharelocatedinthefirstlayer.Ifthedocs.zipfilewascompressedagain,{docs+1.zip[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)]}theoriginalfilesarenowlocatedinthesecondlayer.Whenmultiplelayersofcompressionareencountered,PC-cillinrecursivelydecompresseseach,uptothelimityouset.Inotherwords,ifanarchivecontains.cabfilesthathavebeencompressedusingPK-ZIP,andLZEXE,PK-LITE,MicrosoftCompress,etc.,PC-cillinwilldecompresseachlayeruntilnomorecompressedfilesarefoundorthelimitofyouhavespecifiedisreached.TosetManualScancompressionlayers:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheManualScanlink.TheManualScanscreenappears.4. UnderScanfiletypes,selectthenumberofcompressionlayersfromthe

CompressionLayerlist.Thedefaultnumberoflayersisfive.5. ClickApply.

Note:Whendetectinginfectedfilesthatarepartofacompressedfile,PC-cillincanautomaticallyexecutetheCleanactiononlyifthefollowingconditionsaremet:

YouhaveselectedtheCleanvirusesincompressedfilescheckbox.Thefileorfilesarelocatedinthesecondlayer.

ToperformaCleanscanactionforacompressedfileforfilesbeyondthesecondlayer,youmustdecompressitfirst.IfyouhaveReal-timeScanenabled,decompressingthefilewilltriggertheaction.Ifyou'renotusingReal-timeScan,right-clicktheinfectedfileafteritisdecompressed,selectPropertiesfromthepop-upmenuandthenchooseVirusProperties.Important:Besuretodeletethecompressedfile(forexamplethe.ZIPfile),becauseitwillstillcontainacopyoftheinfecteditem.Seealso:AboutvirusscanactionsAboutManualScanSelectingManualScanfiletypesAddingManualScanfiletypesIncludingthebootsector

IncludingthebootsectorThebootsectoriscriticaltotheproperstartupofyourcomputer.Onstartup,thecomputerchecksthemasterbootrecord(MBR)forinstructionsonhowtostarttheoperatingsystemandloadsmuchofthisdataintomemory.Thebootsectorisspecial,andusuallyoff-limitstomostprograms--theycan'ttouchit.NorcanyouseethebootsectorusingExplorer,forexample.Anybootvirusesthatareinfectingthecomputerareloadedintomemoryalongwiththevaliddataduringbootup(systemstart-up).It'sfromtheirperchinmemorythattheyinfectfilesontheharddrivewhenevertheyareopened,closed,etc.Whatmakesbootvirusesespeciallynastyisthatevenifallthefilesonthesystemarecleaned,andthememoryiscleaned,thenexttimethecomputerisrestarted,thewholeinfectionwillcomeback--unlessanduntilthebootsectoritselfhasbeencleaned.Andbesidescleaningthec:\bootsector,ifyoueverhaveabootvirus,besuretocleaneveryfloppy,ZIP,andotherremovable,bootablediskthatyouhave.Youmayalsowanttorunaquickscanofthebootsectorofanyfloppiesordisksbeforeusingthemtostartyourcomputer(includinggamedisks!).ToincludethebootsectorinaManualScan:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheManualScanlink.TheManualScanscreenappears.4. UnderScanfiletypes,selecttheIncludebootsectorcheckbox.5. ClickApply.

Seealso:AboutvirusscanactionsAboutManualScanSelectingManualScanfiletypesAddingManualScanfiletypesSettingManualScancompressionlayers

AboutReal-timeScanReal-timescanningprovidesconstantprotectionagainstviruses.Withreal-timescanningturnedon,youreducethechanceofyourcomputerbecominginfected.Becauseitissopowerful(andbecauseitoperatesimperceptiblyinthebackground),werecommendyoualwayskeepreal-timescanningenabled.Thereal-timescannerchecksfilesforviruseswhenevertheyareused,forexampleeachtimeafileisopened,copied,moved,saved,compressedordecompressed,downloadedfromtheInternet,and,inthecaseofemailattachments,read.Seealso:AboutvirusscanactionsEnablingReal-timeScanSelectingReal-timeScanfiletypesAddingReal-timeScantiletypesSettingReal-timeScancompressionlayersAboutExceptionfiles

EnablingReal-timeScanWhenenabled,PC-cillin'sReal-timeScanprovidesconstantprotectionagainstviruses.Real-timescanningtakesplaceinthebackgroundandrequiresnouserintervention,soyoudon'treallyhavetodoanythingto"use"Real-timeScan--justbesureitisenabled.ToenableReal-timeScan:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. SelecttheEnableReal-timeScancheckbox.5. ClickApply.

Seealso:AboutvirusscanactionsAboutReal-timeScanSelectingReal-timeScanfiletypesAddingReal-timeScantiletypesSettingReal-timeScancompressionlayersAboutExceptionfiles

SelectingReal-timeScanfiletypesReal-timeScanonlyexaminesthosefiletypessetintheSettingswindow.ThefollowingisalistofoptionsyoucansettoselectReal-timeScanfiletypes:

Allfiletypes-Examineallfilesnomatterwhattype--thehighestlevelofsecurity.However,thereissometradeoffbetweenspeedandsafety.Ontheonehandscanningallfilestakeslongerthanscanningonlyspecifiedfilestypes.Ontheotherhand,mostfiletypes,forexample.TXT,.JPG,.AVI,.HLP,.PDF,etc.,arenotknowntohostorspreadvirusesandprobablydonotrequirescanning.ButthenagainuntilAugust1995,documentfiles(.doc,.xls,etc.)hadneverbeenknowntocarryviruseseither.Andnowmacrovirusesarethemostprevalent.Recommendation-ExamineonlythosefiletypesrecommendedbyTrendMicrovirusanalysts.Theserecommendedfiletypesareknowntohaveahigherriskofcontainingviruses.SelectedFiles-Examinethefiletypesyouset.UsingthisoptionyoucancustomizethetypesoffilesPC-cillinwillexamine.Anyfileswhoseextensionisnotspecifiedwillnotbescanned."Zip"andothercompressedfiletypesmustbespecifiedtobeincludedintheReal-timeScan.

ToselectReal-timeScanfiletypes:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. UnderScanaction,clickoneofthefollowing:

Allfiletypes-Thebuttonbecomesdisabled.Recommendation-ThebuttoncaptionbecomesViewFileTypes.ClickViewFileTypestoseealistofTrendMicrorecommendedhigher-riskfiletypes.SelectedFiles-ThebuttoncaptionbecomesSelectFileTypes.

5. ClickApply.

Seealso:AboutvirusscanactionsAboutReal-timeScanEnablingReal-timeScanAddingReal-timeScantiletypesSettingReal-timeScancompressionlayersAboutExceptionfiles

AddingReal-timeScanfiletypesDefineyourownfiletypestoscanforhigh-riskfilesthatarenotincludedintherecommendedfilelist.Thisincreasesthescanningspeedbecauseyoudon'tscanallfiletypes.However,whenyouselectthisoption,PC-cillinwillonlyscanforselectedfiletypesduringaReal-timeScan.Yousimplyprovidethefiletypeorextension(threeletter"suffix"thatidentifiesthethetypeoffile)thatyouwantPC-cillintoexamine.Examplesoffiletypesorextensionsinclude:annualreport.doc,4thquartersales.xls,win.com,calculator.exe.Youcanaddcompressedfiletypestothelistofthosescannedorremoveunnecessaryfiletypes.ToaddReal-timeScanfiletypes:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. UnderScanfiletypes,clickSelectedFiles.ThebuttoncaptionbecomesSelectFileTypes.

5. ClickSelectFileTypes.TheFileTypesdialogboxappears.6. ClickAdd.TheAddFileType(s)dialogboxappears.7. IntheExtensionbox,typeyourfileextension.Youcanjusttypetheletters

ofyourfiletype,itisunncessarytoincludea"."beforethefiletypeortotypeinupper-case.

8. ClickOK.Youcanalsodothefollowing:


9. ClickOK.

10. ClickApply.

Seealso:AboutvirusscanactionsAboutReal-timeScanEnablingReal-timeScanSelectingReal-timeScanfiletypesSettingReal-timeScancompressionlayersAboutExceptionfiles

SettingReal-timeScancompressionlayersPC-cillinrecognizesmanytypesoffilecompressionincludingPK-ZIPandLZEXE,andfourtypesoffileencoding,includingUUencodeandMIME.Filecompressioninvolvesshrinkingthesizeofafileorfilesusingadatacompressionformat.OneofthemostpopularistheZipformat.Compressedfilesareusefulfortransferringinformationovernetworksbecauseofthesmallerfilesize.PC-cillinwillcheckthecontentsofacompressedfileforvirusesbasedonthenumberoflayersyouhaveset.Usuallywhenfilesarecompressedtheyareonlycompressedtothefirstlayer:(docs.zip{A.doc,B.doc,C.doc,D.doc,E.doc})i.e.,thecompressedfile(docs.zip)containsthefiles(A.doc,B.doc,C.doc,D.doc,E.doc)whicharelocatedinthefirstlayer.Ifthedocs.zipfilewascompressedagain[docs+1.zip(docs.zip{A.doc,B.doc,C.doc,D.doc,E.doc})],theoriginalfilesarenowlocatedinthesecondlayer.Whenmultiplelayersofcompressionareencountered,PC-cillinrecursivelydecompresseseach,uptothelimityouset.Inotherwords,ifanarchivecontains.cabfilesthathavebeencompressedusingPK-ZIP,andLZEXE,PK-LITE,MicrosoftCompress,etc.,PC-cillinwilldecompresseachlayeruntilnomorecompressedfilesarefoundorthelimitofyouhavespecifiedisreached.TosetReal-timeScancompressionlayers:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. UnderScanfiletypes,selectthenumberofcompressionlayersfromthe

CompressionLayerlist.Thedefaultnumberoflayersisone.5. ClickApply.

Note:Whendetectinginfectedfilesthatarepartofacompressedfile,PC-cillincanautomaticallyexecutetheCleanactiononlyifthefollowingconditionsaremet:

YouhaveselectedtheCleanvirusesincompressedfilescheckbox.Thefileorfilesarelocatedinthesecondlayer.

ToperformaCleanscanactionforacompressedfileforfilesbeyondthesecondlayer,youmustdecompressitfirst.IfyouhaveReal-timeScanenabled,decompressingthefilewilltriggertheaction.Ifyou'renotusingReal-timeScan,right-clicktheinfectedfileafteritisdecompressed,selectPropertiesfromthepop-upmenuandthenchooseVirusProperties.Important:Besuretodeletethecompressedfile(forexamplethe.ZIPfile),becauseitwillstillcontainacopyoftheinfecteditem.Seealso:AboutvirusscanactionsAboutReal-timeScanEnablingReal-timeScanSelectingReal-timeScanfiletypesAddingReal-timeScantiletypesAboutExceptionfiles

AboutExceptionfilesOccasionallyantivirusprogramsdetectafileasbeinginfectedwithaviruswheninfactthereisnovirus.Thisisbecausethebinarypatternofthefileissufficientlysimilartoarealvirusthatthescanenginecannotdistinguishthedifference.ThissometimeshappensinMicrosoftWordorExceldocumentswithcomplexmacros.Inordertopreventfalsealarmsorspeedupthescanningprocess,youcanconfigurePC-cillintoavoidscanningcertainfiles.Thesearecalledscanexceptions.Seealso:AboutvirusscanactionsAboutReal-timeScanAddingExceptionfilesAddingExceptionfolders

AddingExceptionfilesYoucansetexceptionstoPC-cillin'sReal-timeScansothatcertainfilesareignored.Forexample,Quarantinedfilesareneverincludedinreal-timescanning(youknowthey'reinfected,that'swhythey'vebeenquarantined).Youmayhaveotherfilesthatyoudon'twantreal-timescanningtoexamine.Toaddanexceptionfile:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. UnderScanfiletypes,clickExceptionfiles.TheSetReal-timeException

dialogboxappears.5. ClickAddFile.TheOpendialogboxappears.6. Browsetoandselectthefileyouwanttoexcludefromscanning.7. ClickOpen.ThefileappearsintheReal-timeScanexceptionslist.To

removeafilefromthelist,underReal-timeScanexceptionsselectthefile,andthenclickDelete.

8. ClickOK.9. ClickApply.

Seealso:AboutvirusscanactionsAboutReal-timeScanAboutExceptionfilesAddingExceptionfolders

AddingExceptionfoldersYoucanaddfolderstoaScanExceptionslist,whichPC-cillinusestodeterminewhatfoldersshouldbeskippedwhenrunningareal-timescan.Toaddanexceptionfolder:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheReal-timeScanlink.TheReal-timeScanscreenappears.4. ClickExceptionfiles.TheSetReal-timeExceptiondialogboxappears.5. ClickAddFolder.TheBrowseforComputerdialogboxappears.6. Browsetoandselectthefolderyouwanttoexcludefromscanning.7. ClickOK.ThefolderappearsintheReal-timeScanexceptionslist.To

removeafolderfromthelist,underReal-timeScanexceptionsselectthefolder,andthenclickDelete.


Seealso:AboutvirusscanactionsAboutReal-timeScanAboutExceptionfilesAddingExceptionfiles

AboutInternetmailscanPC-cillincanscandatapacketsasyoudownloadmailmessagesfromanInternet(POP3)mailservermakingsureinfectedattachmentsdon'tinvadeyourcomputer.ExamplesofmailclientsthatusePOP3mailserversinclude:MicrosoftOutlook,OutlookExpress,EudoraPro,andNetscapeMessenger.Theemailclientretrievesmessagesfromthemailserver.Thesemessagesareanalyzedandanyvirusesaredetected.However,Internetmailscandoesnotscanmessageattachmentsthatarealreadyinfoldersonyourcomputer.PostOfficeProtocol3(POP3)isthemostrecentstandardprotocolforreceivingemail,wherebyaserverreceivesmailonyourbehalfandstoresituntilyoucheckyourmailboxanddownloadthemessages.IfyouareahomeuserwhoconnectstoamailserverhostedbyyourISPoraWeb-basedemailservice,youareprobablyusingaPOP3server.Ifyourcomputerisconnectedtoalocalareanetwork(LAN),youmightbeusingaPOP3mailserver.Checkwithyournetworkadministratorabouthowmailishandledonyourcompany'snetwork.Seealso:EnablingInternetmailscanSettingInternetmailscanactionsSettingInternetmailscanactionsifunabletocleanfileCleaningcompressedmailfiles

EnablingInternetmailscanInfectedemailattachmentsarenowtheprimarymeansofvirusinfection.Duetotheubiquityofemailcommunication,manyviruswritersarenowwritingvirusesthatexploitthevulnerabilitiesofemailclients.TheInternetmailscanfeaturemustbeenabledonthecomputerbeforeaccessingtheemailserver.ToenableInternetmailscan:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClickInternetMailScan.TheInternetmailscanscreenappears.4. SelecttheEnableInternetmail(POP3mail)scancheckbox.5. ClickApply.

Note:ANotificationscreenbrieflyappearstoinformyouthePOP3scanisworkingcorrectly.Topreventthisscreenfromdisplaying,cleartheDisplayNotificationwhenInternetmailscanchecksforvirusescheckbox.Seealso:AboutInternetmailscanSettingInternetmailscanactionsSettingInternetmailscanactionsifunabletocleanfileCleaningcompressedmailfiles

SettingInternetmailscanactionsFortheInternetmailscan,youcansetactionsPC-cillinexecuteswhenitdetectsavirus.Werecommendyouusethedefaultmailscanactionsetting,Clean.ThisletsPC-cillincleananyinfectedfiles--effectivelykeepingthefileintactwhiledestroyingthevirus.AnyvirusscanactionPC-cillinexecutesisrecordedasalogentryintheViruslog.TosetanInternetmailscanaction:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheInternetMailScanlink.TheInternetMailScanscreenappears.4. OnInternetMailScanscreen,underScanaction,selectoneofthe

followingvirusscanactionsfromtheActionwhenvirusfoundlist:

Pass-RecordvirusinfectionormaliciousfilesintheViruslog,buttakenoaction.Delete-Removeinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).Clean-(Default)Removesviruscodefrominfectedfiles.

5. ClickApply.

Seealso:AboutInternetmailscanEnablingInternetmailscanSettingInternetmailscanactionsifunabletocleanfileCleaningcompressedmailfiles

SettingInternetmailscanactionsifunabletocleanfileYoucanalsosetactionsPC-cillinwillexecute,ifforsomereasonafilecannotbecleaned.AnyvirusscanactionPC-cillinexecutesisrecordedasalogentryintheViruslog.TosetanInternetmailscanactionifunabletocleanfile:

1. UnderScanaction,selectoneofthefollowingvirusscanactionsfromtheActiononuncleanablefileslist:

Pass-(Default)RecordvirusinfectionormaliciousfilesintheViruslog,buttakenoaction.Delete-Removeinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).

2. ClickApply.

Seealso:AboutInternetmailscanEnablingInternetmailscanSettingInternetmailscanactionsCleaningcompressedmailfiles

CleaningcompressedmailfilesFilecompressioninvolvesshrinkingthesizeofafileorfilesusingadatacompressionformat.OneofthemostpopularistheZipformat.Compressedfilesareusefulfortransferringinformationovernetworksbecauseofthesmallerfilesize.Forexample,let'ssaytherearefivefiles,A.doc,B.doc,C.doc,D.doc,andE.doc:C.docisinfectedwithamacrovirus,andtheyareallpackedintoasinglecompressedfilecalleddocs.zip:[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)].YoucansetPC-cillintodetectthevirusinC.doc,issueanalert,andwritetheeventtotheViruslog.BecauseC.docisinthefirstlayer,PC-cillinwillautomaticallyexecutetheactionyouhavespecifiedwhenPC-cillindetectsavirusuptothesecondlayer.ifyouhaveselectedtheCleanvirusesincompressedfilescheckbox.PC-cillinisabletocarryoutthisactiononlyiftheinfectedfileiscontainedinthesecondlayerorlessofthecompressedfile.However,ifC.docwaslocatedinadeeperlayerofcompression,forexample{docs1.zip[docs.zip(A.doc,B.doc,C.doc,D.doc,E.doc)]}.AlthoughPC-cillincoulddetectit(ifyouhavesetyourscancompressionlayerstoanumbergreaterthanthree)itisunabletoperformanyscanaction.Therefore,ifyouwanttocleanC.doc,useWinZip,oranothercompressionprogramtodecompressthecompressedfile.Whentheindividualfileshavebeendecompressed,right-clickC.docandclickPC-cillin.PC-cillinwillperformthescanactionyouhavesetforInternetmailscans.Tocleanacompressedmailfile:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheInternetMailScanlink.TheInternetMailScanscreenappears.4. UnderScanaction,makesureCleanisselectedfromtheActionwhenvirusfoundlist,andthenselecttheCleanvirusesincompressedfilescheckbox.

5. ClickApply.

Seealso:AboutInternetmailscanEnablingInternetmailscan

SettingInternetmailscanactionsSettingInternetmailscanactionsifunabletocleanfile

AboutscantasksScantasksareaquickandeasywaytoperformavarietyofscans.Usingscantasksautomatesroutineantivirusmaintenanceproceduresonyourdesktopandimprovesantivirusmanagementefficiencyandcontroloverantiviruspolicy.Youcan"setandforget"asmanytasksasyouseefit.Foreachtask,youcanselectthefiletypesyouwanttoscanforviruses,theactionPC-cillinwilltakeuponfindingavirus,andotherprogramdetails.Tocreateascantask,youmustspecifyatarget,configurescanoptions,andsetaschedule.Seealso:SpecifyingscantasktargetConfiguringscantaskoptionsSchedulingscantasksEditingscantasksDeletingscantasks

SpecifyingscantasktargetUsePC-cillintocreateanynumberofscantasksdesignedaccordingtoyourspecificneeds.Forexample,youcanspecifyscantaskstoscanonlycompressedfiles,allfilesonaremovablediskdrive,oronlyfileslocatedinaparticularfolder.Tospecifyascantasktarget:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheScanTaskslink.TheScanTasksscreenappears.4. ClickAdd.TheTaskConfigurationdialogboxappears.5. ClicktheScanTargettab.6. IntheTaskname(ordescription)box,typeadescriptivenameforthetask.7. FromtheTargetlist,selectatargetofyourscantask:

Alldrives-scanalldrives(includingmappednetworkdrives).Selecteddrive(s)-scanasingledrivefromtheDrivelist.Selectedfile/folder-choosetoscanindividualfilesorfoldersthendothefollowing:

Tosetuparoutinecheckofanindividualfile-ClickAddFile,andthenintheOpendialogboxselectthefileyouwantscanned,andthenclickOpen.Tosetuparoutinecheckofanindividualdriveorfolder-ClickAddFolder,andthenintheOpendialogboxselectthefoldersyouwantscanned,andthenclickOK.Toremoveadrive,folder,orfilefromthelist-Fromthelist,selecttheitem,andthenclickDelete.

8. ClickOK.

Seealso:AboutscantasksConfiguringscantaskoptions

SchedulingscantasksEditingscantasksDeletingscantasks

ConfiguringscantaskoptionsConfigureyourscantaskoptionsincluding,filetypes,andscanactions.Scantasksonlyexaminethosefiletypesconfigured.Thefollowingisalistofoptionsyoucansettoselectfiletypes:

Allfiletypes-Examineallfilesnomatterwhattype--thehighestlevelofsecurity.However,thereissometradeoffbetweenspeedandsafety.Ontheonehandscanningallfilestakeslongerthanscanningonlyspecifiedfilestypes.Ontheotherhand,mostfiletypes,forexample,.TXT,.JPG,.AVI,.HLP,.PDF,etc.,arenotknowntohostorspreadvirusesandprobablydonotrequirescanning.ButthenuntilAugust1995,documentfiles(forexample,.doc,.xls)hadneverbeenknowntocarryviruseseither.Andnowmacrovirusesarethemostprevalent.Recommendation-ExamineonlythosefiletypesrecommendedbyTrendMicrovirusanalysts.Theserecommendedfiletypesareknowntohaveahigherriskofcontainingviruses.Anyfileswhoseextensiondoesnotappearonthelistwillnotbescanned."Zip"andothercompressedfiletypesmustbespecifiedtobeincludedinthescan.SelectedFiles-Examinethefiletypesyouset.UsingthisoptionyoucancustomizethetypesoffilesPC-cillinwillexamine.Anyfileswhoseextensionisnotspecifiedwillnotbescanned."Zip"andothercompressedfiletypesmustbespecifiedtobeincludedinthescan.

AnyactionPC-cillintakesisrecordedasalogentryintheViruslog.Thevirusscanactionsyoucansetincludethefollowing:

Pass-RecordvirusinfectionormaliciousfilesintheViruslogbuttakenoaction.Rename-Modifythefile'sextensiontopreventopeningorexecution.Quarantine-Moveinfectedormaliciousfilestoarestrictedaccessfolder.Clean-Removeviruscodefrominfectedfiles.Delete-Removetheinfectedormaliciousfiles(e.g.,Trojans,worms,etc.).

Toconfigurescantaskoptions:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheScanTaskslink.TheScanTasksscreenappears.4. ClickAdd.TheTaskConfigurationdialogboxappears.5. ClicktheScanOptionstab.TheScanOptionspropertysheetappears.6. UnderScanfiletypes,clickoneofthefollowing:

Allfiletypes-Thebuttonbecomesdisabled.Recommendation-ThebuttoncaptionbecomesViewFileTypes.ClickViewFileTypestoseealistofTrendMicrorecommendedhigher-riskfiletypes.SelectedFiles-ThebuttoncaptionbecomesSelectFileTypes.Toaddfiletypes:

a. ClickSelectFileTypes.TheFileTypesdialogboxappears.b. ClickAdd.TheAddFileType(s)dialogboxappears.c. IntheExtensionbox,typeyourfileextension.Youcanjusttypethe

lettersofyourfiletype,itisunncessarytoincludea"."beforethefiletypeortotypeinuppercase.

d. ClickOK.e. Youcanalsodothefollowing:


f. ClickOK.

7. Dothefollowing:

Tosetthenumberofcompressionlayers,fromtheCompressionLayerslist,selectthenumberofcompressionlayers.Thedefaultnumberoflayersisfive.Toincludethebootsector,selecttheIncludebootsectorcheckbox.

8. UnderScanaction,dothefollowing:

Tosetascanaction,fromtheActionwhenvirusfoundlistselectanaction.Tosetascanactionifthefilecannotbecleaned,fromtheActiononuncleanablefileslistselectanaction.

9. Dothefollowing:

Tocleanvirusesincompressedfiles,selecttheCleanvirusesincompressedfilescheckbox.Tobackupfilesbeforecleaning,selecttheBackupfilebeforecleaningcheckbox.

10. ClickOK.

Seealso:AboutscantasksSpecifyingscantasktargetSchedulingscantasksEditingscantasksDeletingscantasks

SchedulingscantasksYoucanconfigurePC-cillintoautomaticallyrunthetasksyoucreateatthefrequencyyouspecify.Settingascheduleforyourtasksensuresthatwhatyouwantscannedhappenswhenyouwantit.Toscheduleascantask:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheScanTaskslink.TheScanTasksscreenappears.4. ClickAdd.TheTaskConfigurationdialogboxappears.5. ClicktheScheduleTheTasktab.TheScheduleTheTaskpropertysheet

appears.6. FromtheFrequencylist,selecthowoftenyouwanttoexecutethetask:

IfyouchoseDaily,intheTimeboxenteratime(timeisin24hourclockformat).IfyouchoseWeekly,intheTimeboxenteratime,andthenfromtheDayofWeeklist,selectaday.IfyouchoseMonthly,intheTimeboxenteratime,andthenenteradate.

7. ClickOK.

Seealso:AboutscantasksSpecifyingscantasktargetConfiguringscantaskoptionsEditingscantasksDeletingscantasks

EditingscantasksYoucaneditascantaskincludingmodifyingthescantarget,filetypes,scanactionsandthefrequencythatthetaskexecutes.Toeditascantask:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheScanTaskslink.TheScanTasksscreenappears.4. IntheTaskList,selectthescantaskyouwanttoedit.5. ClickEdit.TheTaskConfigurationdialogboxappears.Dooneofthe

following:

Toeditthescantarget,clicktheScanTargettab,andthenmakeyouredits.Toeditthescanoptions(filetypes,scanactions),clicktheScanOptionstab,andthenmakeyouredits.Toeditthefrequency,clicktheScheduleTheTasktab,andthenmakeyouredits.

6. ClickOK.

Seealso:AboutscantasksSpecifyingscantasktargetConfiguringscantaskoptionsSchedulingscantasksDeletingscantasks

DeletingscantasksYoucandeletescantasksifthetasksarenolongeruseful.Todeleteascantask:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheScanTaskslink.TheScanTasksscreenappears.4. FromtheTaskList,selectthescantaskyouwanttodelete.5. ClickDelete.Aconfirmationmessageboxappears.6. ClickYestodeletethetask.

Seealso:AboutscantasksSpecifyingscantasktargetConfiguringscantaskoptionsSchedulingscantasksEditingscantasks

EnablingIntelligentUpdateEnableIntelligentUpdatesoyounevermissthelatestPC-cillinupdate(including:viruspatternfiles,scanengine,otherprogramfiles,andPersonalFirewallrules).UsingthelatestupdatesprovidesyouwiththemostprotectionandensuresPC-cillin2002iskeptcurrenttocatchthenewestvirusesandpreventthelatesthackerattacks.ToenableIntelligentUpdate:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheProgramUpdatelink.Themenuexpands.3. ClickIntelligentUpdate.TheIntelligentUpdatescreenappears.4. SelecttheEnableIntelligentUpdatecheckbox.5. ClickApply.

Seealso:AboutVirusPatternFilesViewingpatternfileandscanengineinformationUpdatingPC-cillin2002UpdatingPC-cillinforWirelessAboutIntelligentUpdateSchedulingIntelligentUpdate

SchedulingIntelligentUpdateYoucanconfigurePC-cillin2002toautomaticallysearchforupdatesatthefrequencyyouspecify.SettingascheduleforupdatesensuresPC-cillinhasinstalledthelatestcomponentsandoffersthebestprotection.YoucanalsosettheconnectiontimeperiodforPC-cillintosearchforupdates.ToscheduleIntelligentUpdate:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheProgramUpdatelink.Themenuexpands.3. ClickIntelligentUpdate.TheIntelligentUpdatescreenappears.4. MakesuretheEnableIntelligentUpdatecheckboxisselectedanddothe

following:

FromtheUpdateeverylistselect,howoftenyouwantPC-cillintocheckforupdates.TosetaconnectiontimeperiodthatrestrictsPC-cillinfromconnectingduringanyothertime,selecttheConnectonlyduringthespecifiedtimeperiodcheckbox,andthenintheFromandToboxesenteratime(timeisin24hourclockformat).

5. ClickApply.

Seealso:AboutVirusPatternFilesViewingpatternfileandscanengineinformationUpdatingPC-cillin2002UpdatingPC-cillinforWirelessAboutIntelligentUpdateEnablingIntelligentUpdate

SelectingPDAOStypeBeforeyouupdateyourPC-cillinforWirelessfiles,youmustsettheoperatingsystemofyourPDA.ToselectthePDAOStype:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheProgramUpdatelink.Themenuexpands.3. ClicktheUpdatePDAlink.TheUpdatePDAscreenappears.4. SelectyourPDAOStype.5. ClickApply.

Seealso:AboutIntelligentUpdateUpdatingPC-cillinforWirelessSelectingPDAOStype

AboutproxyserversAproxyserverisanintermediateserverthattypicallysitsbetweentheuserandthemainserver.Itcanbeusedtoprovidesecurityandtospeeddownloadtimes.Mosthomeusersdonotuseaproxyserver,butmanyoffices,schools,andInternetServiceProvidersdo.Ifyouarehavingtroubledownloadingviruspatternfilesorprogramupdates,itmaybebecauseyouuseaproxyserverbutithasnotbeenidentifiedorthereisanerrorintheaddress/credentials.IfthereisaproxyserverbetweenyourcomputerandtheInternet,yourWebbrowserisprobablyconfiguredtouseit.ChecktheonlinehelpofyourWebbrowsertofindoutifyouareconnectedtotheInternetusingaproxyserver.Inmanycases,youcancheckwhetheryouhaveaproxyserverconnectionbycheckingtheAdvanced,orOptionssettingsofyourWebbrowser.Seealso:EnablingproxysettingsEnteringproxysettings

EnablingproxysettingsIfyou'vedeterminedthatyoudouseaproxyserver,youmustenabletheproxysettings.Toenableproxysettings:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheProgramUpdatelink.Themenuexpands.3. ClicktheProxySettingslink.TheProxySettingsscreenappears.4. SelecttheEnableproxysettingcheckbox.5. ClickApply.

Seealso:AboutproxyserversEnteringproxysettings

EnteringproxysettingsIfyouuseaproxyserveronyournetwork(forexample,youusePC-cillininanoffice,school,oryourInternetServiceProviderrequiresaproxyserver)youneedtoentertheIPaddress(number)andportofthisproxyserver.Inaddition,ifyouuseaproxyserverandusersarerequiredtologon,youneedtosupplytheappropriatelogoncredentials.Toenterproxysettings:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheProgramUpdatelink.Themenuexpands.3. ClicktheProxySettingslink.TheProxySettingsscreenappears.4. MakesuretheEnableproxysettingcheckboxisselectedanddothe

following:

IntheProxyaddressandPortbox,typetheIPaddressandportnumberoftheproxyserver.IntheUserNameandPasswordboxes,typeyourproxyserverlogoncredentials.

5. ClickApply.

Seealso:AboutproxyserversEnablingproxysettings

AboutWebTrapWebTrapprotectsagainstmaliciousJavaandActiveXapplets.AlthoughmostWebsitesarecompletelyharmless,itispossibleforsomeonetocreateasmallprogramandsetittorun,invisibly,whenevertheirWebpageisaccessed.Theseprogramsmaydestroydata,stealyourpasswordsorfinancialdata,etc.PC-cillin'sWebTrapprotectsyouagainstmaliciousJavaandActiveXprogramswhileallowingharmlessonestopasssafelythrough.Seealso:EnablingWebTrapSettingWebTrapactions

EnablingWebTrapWithWebTrapenabled,PC-cillin2002monitorsallJavaandActiveXappletsthataresilentlydownloadedtoyourcomputerwhenyouaresurfingtheWeb.ToenableWebTrap:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheWebTraplink.TheWebTrapscreenappears.4. SelecttheEnableWebTrapcheckbox.5. ClickApply.Amessageboxappearsnotifyingyouthatthechangewillnot

takeeffectuntilyourestartyourcomputerorlogoffandlogonagain.6. ClickYes.7. Restartyourcomputerorlogonagaintoimmediatelyenablethefunction.

Note:ANotificationscreenbrieflyappearswhenyouopenyourbrowsertoinformyouWebTrapisenabled.Topreventthisscreenfromdisplaying,cleartheDisplayNotificationwhenyouopenyourbrowsercheckbox.Seealso:AboutWebTrapSettingWebTrapactions

SettingWebTrapactionsYoucansetdifferentWebTrapactionsPC-cillin2002willperformwhenmaliciousprogramsarefound.TosetaWebTrapaction:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheWebTraplink.TheWebTrapscreenappears.4. MakesuretheEnableWebTrapcheckboxisselected,andclickoneofthe

following:

Promptforaction-PC-cillininformsyouofthepotentiallyharmfulprogramandpromptsyoutospecifyanaction.Blockthemaliciousprogram-PC-cillinautomaticallyblockstheharmfulprogramwithoutanyuserintervention.

5. ClickApply.Amessageboxappearsnotifyingyouthatthechangewillnottakeeffectuntilyourestartyourcomputerorlogoffandlogonagain.

6. ClickOK.7. Restartyourcomputerorlogonagaintoimmediatelyenablethefunction.

Note:ANotificationscreenbrieflyappearswhenyouopenyourbrowsertoinformyouWebTrapisenabled.Topreventthisscreenfromdisplaying,cleartheDisplayNotificationwhenyouopenyourbrowsercheckbox.Seealso:AboutWebTrapEnablingWebTrap

AbouttheSitefilterForprotectionagainstoffensiveWebcontent,PC-cillinoffersSitefilter.ThisconfigurableutilityletsyoumakewhateverWebsitesyouwant"offlimits"tootherusersofthecomputer.Thisfunctionisespeciallyusefulforfamilieswheremanyfamilymembersusethesamecomputer.WebsitesrestrictedbytheSitefilterarelistedintheRestrictedsitelist.TheRestrictedsitelistdisplaysaniconwiththeuniformresourcelocator(URL)oftheWebsite.Inaddition,youcanspecifytheSitefiltertoallowaccesstoarestrictedsite,butonlyafterapromptappearsremindingtheuseryouhaveflaggedthesiteasobjectionable.Note:Websitesthatarecompletelyrestrictedincludingallsub-pageshavea

smallcrossontheURLicon.Seealso:EnablingtheSitefilterProtectingtheSitefilterscreenAddingURLstotheSitefilterEditingSitefilterURLsDeletingSitefilterURLs

EnablingtheSitefilterEnabletheSitefiltertocontrolaccesstooffensiveWebsites.ToenabletheSitefilter:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheSiteFilterlink.TheSiteFilterscreenappears.4. SelecttheEnableSitefiltercheckbox.5. IfyouonlywantSitefiltertowarnsomeonetryingtoretrievearestricted

sitebutthenallowentrytorestrictedsites,selectthePermitaccesstotherestrictedsites...checkbox.Ifthischeckboxisclear,anyWebsiteintheRestrictedsiteslistwillnotbeloadedandamessagewillappearinthebrowsernotifyingtheusertheyaretryingtoaccessarestrictedsite.

6. ClickApply.Amessageboxappearsnotifyingyouthatthechangewillnottakeeffectuntilyourestartyourcomputerorlogoffandlogonagain.

7. ClickOK.8. Restartyourcomputerorlogonagaintoimmediatelyenablethefunction.

Seealso:AbouttheSitefilterProtectingtheSitefilterscreenAddingURLstotheSitefilterEditingSitefilterURLsDeletingSitefilterURLs

ProtectingtheSitefilterscreenYoucanpassword-protectthelistofWebsitesyouwanttorestrict.ThispreventsunauthorizedusersfromviewingormodifyingtheSitelist.Afteryouhaveenabledthepasswordprotection,youshouldimmediatelysetyourpassword.Passwordsarecase-sensitivesotrend,Trend,TrEnDareallconsidereddifferent.ThenexttimeandeverytimeyoutrytoviewtheSiteFilterscreen,youmustprovideyourpassword.Ifyouhavepassword-protectedyourSitefilterscreenandtrytoenabletheSitefilterontheQuickAccessscreen,youmustsupplyyourpassword.ToprotectyourSitefilterscreen:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheSiteFilterlink.TheSiteFilterscreenappears.4. SelectthePasswordrequiredtoaccessthisfeaturecheckbox.TheSet

Passwordbuttonbecomesenabled.5. ClickSetPassword.TheSetPassworddialogboxappears.Dothe

following:

IntheEnterpasswordbox,typeyourpassword.IntheConfirmpasswordbox,typethesamepassword.


Seealso:AbouttheSitefilterEnablingtheSitefilterAddingURLstotheSitefilterEditingSitefilterURLsDeletingSitefilterURLs

AddingURLstotheSitefilterYoucanaddtheURLsofWebsitesthatyouwanttorestricttheaccess.ToaddaURLtotheSitefilter:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheSiteFilterlink.TheSiteFilterscreenappears.4. MakesuretheEnableSitefiltercheckboxisselectedandclickAdd.The

AddSiteToRestrictedListdialogboxappears.5. Inthetextbox,typetheURLoftherestrictedWebsite(forexample,

www.anywebsite.com).ToblocktheentireWebsiteincludingallsub-pages,selecttheExtendtoallsub-pagescheckbox.

6. ClickOK.TheURLappearsintheRestrictedsitelist.IfyouselectedtheExtendtoallsub-pagescheckbox,asmallcrossappearsontheURLicon.

7. IfyouonlywantSitefiltertowarnsomeonetryingtoretrievearestrictedsitebutthenallowentrytorestrictedsites,selectthePermitaccesstotherestrictedsites...checkbox.Ifthischeckboxisnotselected,anyWebsiteintheRestrictedsiteslistwillnotbeloadedandamessagewillappearinthebrowsernotifyingtheusertheyaretryingtoaccessarestrictedsite.

8. ClickApply.

Seealso:AbouttheSitefilterEnablingtheSitefilterProtectingtheSitefilterscreenEditingSitefilterURLsDeletingSitefilterURLs

EditingSitefilterURLsYoucanedittheURLsofWebsitesyouhaveaddedtotheRestrictedSitelist.ToeditaSitefilterURL:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheSiteFilterlink.TheSiteFilterscreenappears.4. IntheRestrictedsitelist,selecttheURLyouwanttoedit.5. ClickEdit.TheAddSiteToRestrictedListdialogboxappears.6. Inthetextbox,edittheURLoftherestrictedWebsite.Toblocktheentire

Website,selecttheExtendtoallsub-pagescheckbox.7. ClickOK.ThemodifiedURLappearsintheRestrictedsitelist.Ifyou

selectedtheExtendtoallsub-pagescheckbox,asmallcrossappearsontheURLicon.

8. ToallowaWebsitetobeviewedafterbeingprompted,selectthePermitaccesstotherestrictedsites...checkbox.

9. ClickApply.

Seealso:AbouttheSitefilterEnablingtheSitefilterProtectingtheSitefilterscreenAddingURLstotheSitefilterDeletingSitefilterURLs

DeletingSitefilterURLsYoucanremovetheURLsofWebsitesfromtheRestrictedSitelist.OnceaURLofaWebsiteisremovedfromtheRestrictedSitelist,itcanreadilybeaccessed.TodeleteaSitefilterURL:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheInternetSecuritylink.Themenuexpands.3. ClicktheSiteFilterlink.TheSiteFilterscreenappears.4. IntheRestrictedsitelist,selecttheURLyouwanttodelete.5. ClickDelete.TheURLisremovedfromthelist.6. ClickApply.

Seealso:AbouttheSitefilterEnablingtheSitefilterProtectingtheSitefilterscreenAddingURLstotheSitefilterEditingSitefilterURLs

AboutPersonalFirewallsTheTrendMicroPC-cillin2002PersonalFirewallprotectsyourcomputeragainstattacksfromtheInternet.Afirewallcreatesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).Thisbarrierexaminesandfiltersnetworktraffictoyourcomputer.Byfilteringnetworktraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.WiththePC-cillin2002PersonalFirewall,youcanalsocontrolthesecuritylevel,createalistofsitesyouknowcanbetrusted,andviewalistofblockedports.ThePersonalFirewallisactuallycomposedofthefollowingcomponents:

Cloaking:Preventsyourcomputerfrombeingfound.Cloakinghidestheentrypoints(ports)ofyourcomputermakingitappeartobedisconnectedfromanetwork.HackersusingtechniqueslikeNetBIOSbrowsing,portscanning,orICMPpacketspecialprocessingwillbeunabletolocateyourcomputer.Firewall:Providesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).Thisbarrierexaminesandfiltersnetworktrafficcomingintoyourcomputer.Byfilteringnetworktraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.Thefirewallprotectsagainstattackshackerscommonlyuseincluding:PingofDeath,IPconflict,SYNflooding,andothers.TrojanBackdoorBlocking:Ifahackerhasalreadybrokenintoyoursystem,heorshecouldhaveinstalledaTrojan(smallhiddenprogram)ontoyourcomputer(unlikeviruses,Trojansdonotreplicatethemselves,butcanstillwreakhavoconyoursystem).Toavoidbeingtraced,thehackercanthenuseyourcomputertoattackothercomputers.TheTrojanBackdoorBlockingfunctionpreventshackersfromusingyourcomputerbyblockingBackOrifice,BackOrifice2000,NetBus,DeepThroatandotherknownbackdoorprograms.

ThereisalsoanInternetEmergencyLockfeaturethatletsyouimmediatelydisableallInternetactivityifyoususpectyouareunderattack.EnablingthisfeatureimmediatelystopsalltraffictoandfromtheInternet.Seealso:EnablingyourPersonalFirewall

AboutthePersonalFirewallsecuritysettingsAbouttrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AboutthePersonalFirewallsecuritylevelsettingsAnytimeyourcomputerconnectstoanothercomputerthethreatofinvasionbyanoutsideintruderexists.Themorecomputersconnectedtoyourcomputer,thegreaterthethreatandthehighertheprobabilityyourcomputerwillbesingledoutforanattack.EachtimeyouconnecttotheInternet,therearemillionsofcomputersthatcanalsoconnecttoyourcomputer.Sincedifferentusershavedifferentneeds,PC-cillinprovidesthreelevelsofsecurity.TheHighSecurityleveloffersmaximumprotectionfromoutsideattacks,whiletheLowSecurityleveloffersminimumprotection.Unlessyouuseyourcomputerasaserver(Medium),werecommendyouusethedefaultsetting:High.High(Default):Cloaking,Trojanbackdoorblocking,andFirewallallenabled.Thisisthedefaultandmostsecuresetting.Atthissecuritylevel,yourcomputer'sentrypointsareinvisible,andTrojanbackdoorprogramsareblocked.Inaddition,abarrierfiltersandexaminesbothincomingandoutgoingInternettraffic.ThissettingisrecommendedfortheexpertInternetuserthatfrequentlyvisitsmanydifferentWebsites,oftentransfersfilesonline,andreceivesalotofemailfromnumerousaccounts.Alsorecommendedforuserswithalways-onInternetconnections.Donotusethissecuritylevelifyouuseyourcomputerasaserver;choosetheMediumsecuritylevel.Medium:TrojanbackdoorblockingandFirewallenabled.Usethissettingifyouuseyourcomputerasaserver.Atthissecuritylevel,Trojanbackdoorprogramsareblocked,andabarrierfiltersandexaminesbothincomingandoutgoingInternettraffic.However,yourcomputer’sentrypointsarevisibleandserver-functionswillfunctionnormally.ThesesettingsarealsorecommendedforthecasualInternetuserwhospendslesstimeonline,doesn'toftentransferfiles,andonlyusesoneemailaccount.Low:Firewallenabled.Atthissecuritylevel,abarrierfiltersandexaminesbothincomingandoutgoingInternettraffic.Thislevelisrecommendedforusersthatrarelygoonline,don'ttransferfilesovertheInternet,anddon'tuseemailontheircomputer.Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewall

AdjustingthePersonalFirewallsecuritysettingsAbouttrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AdjustingthePersonalFirewallsecuritylevelsettingsDependingonyourneedsyoucanadjustthePersonalFirewallsecuritylevel.ToadjustthePersonalFirewallsecuritylevelsettings:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheSecurityLevellink.TheSecurityLevelscreenappears.4. MakesuretheEnablePersonalFirewallcheckboxisselectedandUnder

SecurityLevel,choosethelevelofsecurity:

High(Default):Cloaking,Trojanbackdoorblocking,andFirewallallenabled.Medium:TrojanbackdoorblockingandFirewallenabled.(Recommendedsecuritylevelifcomputerfunctionsasaserver.)Low:Firewallenabled.

5. ClickApply.

Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewallAboutthePersonalFirewallsecuritysettingsAbouttrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AbouttrustedsitesTheremaybeWebsitesthatyouknowaresafeandwillnotattackyourcomputer.ThePersonalFirewallletsyouaddthesetrustedsitestoalist.YoushouldbeabsolutelysureaWebsitecanbetrustedbeforeaddingittothisTrustedSitelist.ThePersonalFirewallignoresallsitesontheTrustedSitelistsotheycanfreelyconnecttoyourcomputer.Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewallAboutthePersonalFirewallsecuritysettingsAddingtrustedsitesEditingtrustedsitesDeletingtrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AddingtrustedsitesYoucanaddWebsitesyouknowtobesafetotheTrustedSitelistandthePersonalFirewallwillnotblockthese.Topermitotheruserstoaccessyourcomputeroveranetwork(typicallyaLAN),ontheTrustedSitesList,selectthecheckboxofyournetworkadaptercard,andthenclickApply.Toaddatrustedsite:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheTrustedSiteslink.TheTrustedSitesscreenappears.4. ClickAdd.TheIPSettingsdialogboxappears.5. IntheDescriptionbox,typeadescriptionofthetrustedsiteyouareadding.6. IntheTypebox,selectadefinitiontype,anddothefollowing:

HostName:intheHostNameboxtypethehostnameofthetrustedsite,andthenclickResolvetoviewtheIPaddress.IPAddress:intheIPAddressboxtypetheIPaddressofthetrustedsite.IPRange:intheIPAddrFromandIPAddrToboxes,typetherangeofIPaddressesthatareconsideredsafe.Subnet:intheIPAddressboxtypetheIPaddressandintheNetmaskboxtypethesubnetaddressforthesafesite.

7. ClickOK.Ifyouselectthecheckboxnexttothetrustedsite,thesiteis"trusted"andconsideredsafe.Ifyouclearthecheckboxthesiteisnot"trusted".

8. ClickApply.

Note:Ifyouhavetroubleusingresourcesonanetwork,(printerorothercomputers),addthesubnetmasktotheTrustedSitesList.Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewall

AboutthePersonalFirewallsecuritysettingsAbouttrustedsitesEditingtrustedsitesDeletingtrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

EditingtrustedsitesYoucaneditatrustedsiteincludingmodifyingthehostname,IPaddress,IPaddressrange,andthesubnet.Toeditatrustedsite:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheTrustedSiteslink.TheTrustedSitesscreenappears.4. OntheTrustedSitesList,selectthesiteyouwanttoedit.5. ClickEdit.TheIPSettingdialogboxappears.Dothefollowing:

ToeditthetypeofIPsetting,selectthetypefromtheTypelist:HostName,IPAddress,IPRange,andSubnetandmakeyourchanges.Toeditthedescription,typeyournewdescriptionintheDescriptionbox.

6. ClickOK.Ifyouselectthecheckboxnexttothetrustedsite,thesiteis"trusted"andconsideredsafe.Ifyouclearthecheckboxthesiteisnot"trusted".

7. ClickApply.

Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewallAboutthePersonalFirewallsecuritysettingsAbouttrustedsitesAddingtrustedsitesDeletingtrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

DeletingtrustedsitesYoucanremovesitesyounolongertrustfromtheTrustedSitesList.Todeleteatrustedsite:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheTrustedSiteslink.TheTrustedSitesscreenappears.4. OntheTrustedSitesList,selectthesiteyouwanttodelete.5. ClickDelete.Aconfirmationmessageappears.6. ClickYestoremovethetrustedsitefromtheTrustedSitelist.

Ifyouwanttokeepthesiteinthelist,butyounolongertrustthesite,youcanclearthesitecheckbox.Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewallAboutthePersonalFirewallsecuritysettingsAbouttrustedsitesAddingtrustedsitesEditingtrustedsitesAboutblockedportsActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AboutblockedportsBydefault,thePersonalFirewallblocksalistofportsusedbyTrojanattackswhenmaliciousindividualstrytogainaccesstoyourcomputer.Manynetworkattackscanbeavoidedbypreventingaccesstotheseports.Aportisanentrypointcomputersusetoconnecttonetworksortoothercomputerstoexchangeinformation.Everyporthasauniquenumberandbasedonthisnumber,thereceivingcomputerdetermineswhichapplicationtosendreceiveddata.Toviewthelistofblockedports:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clickthePersonalFirewalllink.Themenuexpands.3. ClicktheBlockedPortslink.TheBlockedPortsscreenappears.4. UnderthePortlist,youcanviewtheTrojanname,protocol,andthe

numberoftheporttheTrojantriestoaccesswhenattacking.

Seealso:AboutPersonalFirewallsEnablingyourPersonalFirewallAboutthePersonalFirewallsecuritysettingsAbouttrustedsitesActivatingtheEmergencyLockAboutTrojansHowTrojanscausedamage

AboutvirusesAcomputervirusisaprogramthatreplicates.Todoso,itneedstoattachitselftootherprogramfiles(forexample,.exe,.com,.dll)andexecutewheneverthehostprogramexecutes.Beyondsimplereplication,avirusalmostalwaysseekstofulfillanotherpurpose:tocausedamage.Calledthedamageroutine,orpayload,thedestructiveportionofaviruscanrangefromoverwritingcriticalinformationkeptonyourharddisk'spartitiontabletoscramblingthenumbersinyourspreadsheetstojusttauntingyouwithsounds,pictures,orobnoxiouseffects.It’sworthbearinginmind,however,thatevenwithouta"damageroutine,"virusesallowedtorununabatedwillcontinuetopropagate--consumingsystemmemory,diskspace,slowingnetworktrafficandgenerallydegradingperformance.Besides,viruscodeisoftenbuggyandcanalsobethesourceofmysterioussystemproblemsthattakeweekstounderstand.So,whetheravirusisharmfulornot,itspresenceonyoursystemcanleadtoinstabilityandshouldnotbetolerated.Someviruses,inconjunctionwith"logicbombs,"donotmaketheirpresenceknownformonths.Insteadofcausingdamagerightaway,thesevirusesdonothingbutreplicate--untilthepreordainedtriggerdayoreventwhentheyunleashtheirdamageroutinesonthehostsystemoracrossanetwork.Tolearnmoreaboutanyparticularvirus,oraboutvirusesingeneral,youcanaccessTrendMicro'sonlineVirusEncyclopediaat:www.antivirus.com/.

HowvirusesarecreatedUntilafewyearsago,creatingavirusrequiredknowledgeofacomputerprogramminglanguage.Todayanyonewithevenalittleprogrammingknowledgecancreateavirus.Usually,though,misguidedindividualswhowanttocausewidespread,randomdamagetocomputerscreateviruses.Inthetypicalscenario,itisanindividual,workingalone,whowritesavirusprogramandthenintroducesitontoasinglecomputer,networkserver,ortheInternet.Why?Ego,revenge,sabotage,andbasicdisgruntlementhaveallbeencitedasmotivations.Recently,do-it-yourself"viruskits"havebeenpoppingupontheInternet,andmacroscriptsarebecomingbotheasiertolearnandmorepowerful,puttingthecapacitytoengineervirusesinthehandsofnearlyeveryone.Inotherwords,nosingle,likelyprofileexistsbywhichviruswriterscanbedescribedorunderstood.Sowhateverthereasononemayhaveforwritingavirus,theimportantthingistomakecertainyourcompanyisnotvictimized,thatdatayouareresponsibleforissafe,andthatprecioustimeisnotwastedhuntingdown(andcleaningupafter)viruses.

TestvirusTheEuropeanInstituteforComputerAnti-VirusResearch(EICAR),alongwithantivirussoftwarevendors,hasdevelopedatestfilethatcanbeusedincheckingyourinstallationandconfiguration.Thefileisnotanactualvirus;itwillcausenoharmanditwillnotreplicate.Rather,itisaspeciallycreatedfilewhose"signature"hasbeenincludedintheTrendMicroviruspatternfileandassuch,canbedetectedbythevirusscanengine.Youcandownloadthisfilefrom:www.antivirus.com/vinfo/testfiles/Alternatively,copythefollowingtextintoatexteditorandthensavethefilewitha*.COMextension.X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*Youmayneedtodisablereal-timescanningbeforedownloadingthefileandmakesurenootherantivirusproductsarerunning.Onceonyourmachine,youcanusethetestvirustoseeforyourselfhowPC-cillin'svariousscanningfeatureswork.

http://www.antivirus.com/vinfo/testfiles/

AccessingtheTrendMicroVirusEncyclopediaPC-cillinincludesaccesstotheonlineTrendMicrovirusencyclopedia,organizedbynameandvirustype.Useittofindoutabouttensofthousandsofindividualviruses,includingthetypicalsymptomsofagivenvirus,itsinfectionprocedure,andthedamageroutine.WiththegrowingprevalenceofMacroviruses,we’vebolsteredthenumberofMacrovirusdescriptionsincludedintheencyclopediatowellover2000.Ofcourse,PC-cillin,whichusesTrend’saward-winning,32-bit,multi-threadingscanengine,iscapableofdetectingallvirusesthatareknowntobeincirculation,plusthemanythousandsmorethatexistas"proofofconcept"onlyinresearcher'sviruslabsandonhacker'scomputers.ToaccesstheTrendMicroVirusEncyclopedia,onthePC-cillinmenubar,clickSecurityInfo>Encyclopedia..

ViewingtheTrendMicroViruslistTheVirusInformationCentercontainsalistoftheReal-timetoptenviruses.Inaddition,youcanviewupdatedSecurityAlertsandVirusAdvisories.ToaccesstheTrendMicroViruslist,onthePC-cillinmenubarclick,SecurityInfo>VirusList.

HowvirusesspreadThemostlikelyvirusentrypointsareemail,Internetandnetworkconnections,floppydiskdrives,andmodemsorotherserialorparallelportconnections.Intoday'sincreasinglyinterconnectedworkplace(Internet,intranet,shareddrives,removabledrives,andemail),virusoutbreaksnowcanspreadfasterandwiderthaneverbefore.Thefollowingaresomecommonwaysforavirustoenteryoursystem:

EmailattachmentsWorldWideWeb(WWW)sitesFTPtrafficfromtheInternet(filedownloads)Sharednetworkfiles&networktrafficingeneralDemonstrationsoftwarePiratedsoftwareShrink-wrapped,productionprograms(rare)ComputerlabsElectronicbulletinboards(BBS)Disketteswapping(usingotherpeople’sdiskettesforcarryingdataandprogramsbackandforth)

HighriskfilesThemostdangerousfilestypesare:.EXE,.COM,.XLS,.DOC,.MDBBecausetheydon'tneedanyspecialconversiontoinfectacomputer--allthey'vegottodoisrun,orbeopened,andthevirusspreads.TrendMicrovirusdoctorsestimatethat99%ofallvirusesarewrittenforthesefileformats.Alistofpossibleviruscarriersinclude:EXE-(Executablefile)SYS-(Executablefile)COM-(Executablefile)DOC-(MicrosoftWord)DOT-(MicrosoftWord)XLS-(MicrosoftExcel)XLA-(MicrosoftExcel)XLT-(MicrosoftExcel)MDB-(MicrosoftAccess)ZIP-(Compressedfile,commonintheUSA)ARJ-(Compressedfile,commonintheUSA)DRV-(Devicedriver)0VL-(Windowsoverlayfile)BIN-(Commonbootsectorimagefile)SCR-(Microsoftscreensaver)Mostofthesefileformats,.drv,.ovl,and.bin,forexample,arenotdangerousinandofthemselves;theymustbeconvertedinordertobeexecuted.

BootvirusesUntilthemid-1990s,bootsectorviruseswerethemostprevalentvirustype,spreadingprimarilyinthe16-bitDOSworldviafloppydisk.Bootsectorvirusesinfectthebootsectoronafloppydiskandspreadtoauser'sharddisk,andcanalsoinfectthemasterbootrecord(MBR)onauser'sharddrive.OncetheMBRorbootsectorontheharddriveisinfected,thevirusattemptstoinfectthebootsectorofeveryfloppydiskthatisinsertedintothecomputerandaccessed.Bootsectorvirusesworklikethis:byhidingonthefirstsectorofadisk,thevirusisloadedintomemorybeforethesystemfilesareloaded.ThisallowsittogaincompletecontrolofDOSinterruptssothatitcanspreadandcausedamage.ThesevirusesoftenreplacetheoriginalcontentsoftheMBRorDOSbootsectorwiththeirowncontentsandmovethesectortoanotherareaonthedisk.Cleaningupabootsectorviruscanbeperformedbybootingthemachinefromanuninfectedfloppysystemdiskratherthanfromtheharddrive,orbyfindingtheoriginalbootsectorandreplacingitinthecorrectlocationonthedisk.

DirectactionvirusADirectActionvirusloadsitselfintomemorytoinfectotherfilesandthenunloadsitself,whileacompanionvirusactstofoolanexecutablefileintoexecutingfroma.comfile.Forexample,acompanionvirusmightcreateahiddenpgm.comfilesothatwhenpgmcommandisexecuted,thefakepgm.comrunsfirst.The.comfileinvokesitsviruscodebeforegoingontostarttherealpgm.exefile.

MacrovirusesMacrovirusescurrentlyaccountforabout80percentofallviruses,accordingtotheInternationalComputerSecurityAssociation(ICSA),andarethefastestgrowingvirusesincomputerhistory.Unlikeothervirustypes,macrovirusesaren’tspecifictoanoperatingsystemandspreadwitheaseviaemailattachments,floppydisks,Webdownloads,filetransfers,andcooperativeapplications.Macrovirusesare,however,application-specific.TheyinfectmacroutilitiesthataccompanysuchapplicationsasMicrosoftWordandExcel,whichmeansaWordmacroviruscannotinfectanExceldocumentandviceversa.Instead,macrovirusestravelbetweendatafilesintheapplicationandcaneventuallyinfecthundredsoffilesifundeterred.Macrovirusesarewrittenin"everyman'sprogramminglanguage"--VisualBasic--andarerelativelyeasytocreate.Theycaninfectatdifferentpointsduringafile'suse,forexample,whenitisopened,saved,closed,ordeleted.

Multi-partitevirusesMulti-partitevirusessharesomeofthecharacteristicsofbootsectorvirusesandfileviruses:Theycaninfect.comfiles,.exefiles,andthebootsectorofthecomputer’sharddrive.Onacomputerbootedupwithaninfecteddiskette,thetypicalmulti-partiteviruswillfirstmakeitselfresidentinmemorytheninfectthebootsectoroftheharddrive.Fromthere,thevirusmayinfectaPC'sentireenvironment.Notmanyformsofthisvirusclassactuallyexist.However,theydoaccountforadisproportionatelylargepercentageofallinfections.

PolymorphicormutationvirusesPolymorphic(mutation)virusesareuniqueinthattheyaredesignedtoeludedetectionbychangingtheirstructureaftereachexecution--withsomepolymorphicviruses,millionsofpermutationsarepossible.Ofcourse,thismakesitharderfornormalantivirusprogramstodetectorinterceptthem.Itshouldbenotedthatpolymorphicvirusesdonot,strictlyspeaking,constituteaseparatecategoryofvirus;theyusuallybelongtooneofthecategoriesdescribedabove.

StealthvirusesStealthviruses,orInterruptInterceptors,astheyaresometimescalled,takecontrolofkeyDOS-levelinstructionsbyinterceptingtheinterrupttable,whichislocatedatthebeginningofmemory.Thisgivesthevirustheabilitytodotwoimportantthings:1)gaincontrolofthesystembyre-directingtheinterruptcalls,and2)hideitselftopreventdetection.

FileinfectingvirusesFileinfectors,alsoknownasparasiticviruses,operateinmemoryandusuallyinfectexecutablefileswiththefollowingextensions:*.COM,*.EXE,*.DRV,*.DLL,*.BIN,*.OVL,*.SYS.Theyactivateeverytimetheinfectedfileisexecutedbycopyingthemselvesintootherexecutablefilesandcanremaininmemorylongafterthevirushasactivated.Thousandsofdifferentfileinfectingvirusesexist,butsimilartobootsectorviruses,thevastmajorityoperateinaDOS16-bitenvironment.Some,however,havesuccessfullyinfectedtheMicrosoftWindows,IBMOS/2,andAppleComputerMacintoshenvironments.

MethodsofvirusdetectionThreemainmethodsexistfordetectingviruses:integritychecking(alsoknownaschecksumming),behaviormonitoring,andpatternmatching(scanning).PC-cillinisscanningbased,withfurtherbuttressingfromTrendMicro'sMacroTrap,WebTrap,andScriptTraptechnologies.

IntegritycheckingAntivirusprogramsthatuseintegritycheckingstartbybuildinganinitialrecordofthestatus(size,time,date,etc.)ofeveryapplicationfileontheharddrive.Usingthisdata,checksummingprogramsthenmonitorthefilestoseeifchangeshavebeenmade.Ifthestatuschanges,theintegritycheckerwarnstheuserofapossiblevirus.However,thismethodhasseveraldisadvantages,thebiggestbeingthatfalsealarmsarealtogethertoocommon.Therecordsusedbychecksummingprogramsareoftenrenderedobsoletebylegitimateprograms,which,intheirnormalcourseofoperations,makechangestofilesthatappeartotheIntegritycheckertobeviralactivity.Anotherweaknessofintegritycheckingisthatitcanonlyalerttheuserafteravirushasinfectedthesystem.

BehaviormonitoringBehaviorMonitoringprogramsareusuallyterminateandstayresident(TSR)andconstantlymonitorrequeststhatarepassedtotheinterrupttable.Theseprogramsareonthelookoutforactivitiesthatavirusmightengagein--requeststowritetoabootsector,openinganexecutableprogramforwriting,orplacingitselfresidentinmemory.Thebehaviortheseprogramsmonitorisderivedfromauser-configurablesetofrules.

PatternmatchingUsingaprocesscalled"patternmatching,"PC-cillindrawsuponanextensivedatabaseofviruspatternstoidentifyknownvirussignatures,ortelltalesnippetsofviruscode.KeyareasofeachscannedfilearecomparedagainstthelistofthousandsofvirussignaturesthatTrendMicrohasonrecord.Wheneveramatchoccurs,PC-cillintakestheactionyouhaveconfigured:Clean,Delete,Quarantine,Pass(DenyAccessforReal-timeScan),orRename.

AboutTrojansTrojans,orTrojanhorses,aresmallseeminglyharmlessprograms.Tocauseanydamage,theseprogramsmustbeinstalledontoyoursystem.OnceaTrojanisinstalled,ithasallthesameprivilegesastheuserofthecomputerandcanexploitsthesystemtodosomethingtheuserdidnotintend.ThemaindifferencebetweenTrojansandvirusesisthatTrojanscannotreplicateorspreadontheirown.Seealso:HowTrojanscausedamageTrojanSystemCleanerRunningtheTrojanSystemCleanerActivatingtheEmergencyLock

HowTrojanscausedamageAlthoughaTrojanseemslikeaharmlessprogram,itactuallycontainsmaliciouscode.Trojanstrickyoursystemintoacceptingthemasusefulprograms.OnceaTrojanisinstalledontoyoursystemthisprogramhasthesameprivilegesasyouhaveandcan:

DeletefilesTransmittotheintruderanyfilesyoucanreadChangeanyfilesyoucanmodifyInstallotherprogramswithyourprivilegesExecuteprivilege-elevationattacks—theTrojancanattempttoexploitaweaknesstoraisethelevelofaccessbeyondtheuserrunningtheTrojan.Ifsuccessful,theTrojancanoperatewithincreasedprivileges.InstallvirusesInstallotherTrojans

DuringinstallationandeverytimetheReal-timeMonitorruns,PC-cillin’sTrojanSystemCleaner(TSC)scansyoursystemforanyTrojansonyoursystem.Seealso:HowTrojanscausedamageTrojanSystemCleanerRunningtheTrojanSystemCleanerActivatingtheEmergencyLock

ContactingTechnicalSupportTrendMicroprovidestechnicalsupport,viruspatterndownloads,andprogramupdatesforoneyeartoallregisteredusers,afterwhichyoumustpurchaserenewalmaintenance.SendanemailtoourhighlytrainedtechnicalsupportstafforvisitourWebsitetoreceivetechnicalsupport.TrendMicroTechnicalSupport

Email:[email protected]:www.antivirus.com

Tospeedupyourproblemresolution,whenyoucontactourstaffpleaseprovideasmuchofthefollowinginformationasyoucan:

ProductserialnumberPC-cillinprogram,scanengine,patternfile,versionnumberOSnameandversionInternetconnectiontypeExacttextofanyerrormessagegivenStepstoreproducetheproblem

Seealso:BeforeContactingTechnicalSupportVisitingtheTrendMicroUser'spageVisitingtheTechnicalSupportWebsite


BeforeContactingTechnicalSupportWhileourtechnicalsupportstaffisalwayspleasedtohandleyourinquiries,thereareacouplethingsyoucandotoquicklyfindtheansweryouareseeking.

Checkthedocumentation:themanualandonlinehelpprovidecomprehensiveinformationaboutPC-cillin.Searchbothdocumentstoseeiftheycontainyoursolution.VisitourtechnicalsupportWebsite:ourtechnicalsupportWebsitecontainsthemostup-to-dateinformationaboutallTrendMicroproducts.OtherinquiriesthatwerealreadyansweredarealsopostedonthesupportWebsite.

Seealso:ContactingTechnicalSupportVisitingtheTrendMicroUser'spageVisitingtheTechnicalSupportWebsite

VisitingtheTrendMicroUser'spageVisittheTrendMicrouser'spagetoreceivethelatestnewsaboutPC-cillin.Asaregistereduser,youcanaccessinformationthatcannotbefoundonotherWebsites.TovisittheTrendMicroUser'spage,onthePC-cillinmenubar,clickSupport>TrendMicroUserHomePage.Seealso:ContactingTechnicalSupportBeforeContactingTechnicalSupportVisitingtheTechnicalSupportWebsite

VisitingtheTechnicalSupportWebsiteVisittheTrendMicroTechnicalSupportWebsitetofindanswerstoyourquestions.TheTrendMicroTechnicalSupportWebsitecontainsthelatestvirusandproductinformation.TovisittheTechnicalSupportWebsite,onthePC-cillinmenubar,clickSupport>TechnicalSupportHomePage.Seealso:ContactingTechnicalSupportBeforeContactingTechnicalSupportVisitingtheTrendMicroUser'spage

HowdoIreinstallPC-cillin2002?TheprocedureforreinstallingPC-cillin2002isthesameprocedureyouusedtooriginallyinstallPC-cillin.WhenyoureinstallPC-cillinonthesamecomputerwiththeoriginaloperatingsystem(i.e.,youdidnotreformatyourharddriveorinstalladifferentoperatingsystem),itisunnecessarytore-registeryoursoftware.ThisprocedureisalsodocumentedintheQuickStartGuidethatcamebundledinsidetheCDcase.However,ifyoucannotfindyourQuickStartGuidewerecommendyouprintouttheseinstructionssoyoucanrefertothemduringtheinstallationprocess.ToreinstallPC-cillin2002:

1. InsertthePC-cillinprogramCDintoyourCD-ROMdriveanddothefollowing:

Iftheinstallationprogramautomaticallystarts.ClickNext.

Iftheinstallationprogramdoesn’tautomaticallystart,clickStart>Run.IntheOpenbox,typed:\setup.exeandclickOK(whered:\isthedriveletterofyourCD-ROM).ClickNext.

2. ClickIacceptthetermsofthelicenseagreementtoacceptandcontinueinstallingPC-cillin.Theinstallationprocedurewillbeabortedifyoudonotaccepttheterms.

3. ClickNext.PC-cillinscansyoursystemmemory,bootsector,andcriticalfilesbeforeinstallingtheprogramfiles.IfPC-cillinfindsavirus-infectedfile,PC-cillineithercleansordeletesit.Dothefollowing:

IntheUserNamebox,typeausername.Youmustprovideausernametocontinueinstallation.IntheOrganizationbox,typethenameofyourorganization.IntheSerialKeyboxes,typeyourserialkey.Ifyoudonothaveaserialkey,youcancontinueinstallationandinstalla30-daytrialversion.IfyouareinstallingthetrialversionanadditionalscreenappearswhenyouclickNextaskingifyouwanttoinstallthetrialversion.SelecttheIwishtoinstallastrialversioncheckboxandclickNext.

4. ClickNext.TheDestinationFolderscreenappears.YoucanchoosewherePC-cillinisinstalledorjustusethedefaultlocation.TochangethelocationPC-cillinisinstalled,clickChangeandbrowsetoadifferentfolder.

5. ClickNext.Ifyouarereadytocompleteinstallation,clickInstall.

CanIinstallPC-cillin2002onanothercomputer?IfyouinstallPC-cillinonanothercomputer,itisnecessarytore-registeryoursoftwareafteryouinstallPC-cillin.YoumustperformtheRegisteringyoursoftwareprocedureandenteryournewLicenseKey.AnypreviouslyobtainedLicenseKeysareinvalidandwillnotworkcorrectlyonanothercomputer.Seealso:NewproductregistrationmethodRegisteringyoursoftwareWhatifIlostmyserialnumber?WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?

WhatifIlostmyserialnumber?ContactyourregionalTrendMicrotechnicalsupportrepresentative.TrendMicroTechnicalSupport

Email:[email protected]:www.antivirus.com

Seealso:NewproductregistrationmethodRegisteringyoursoftwareCanIinstallPC-cillin2002onanothercomputer?WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?


WhathappenstomyLicenseKeyifIreinstallmyoperatingsystem?Ifyoureinstallyouroperatingsystem,itisnecessarytore-registeryoursoftwareafteryouinstallPC-cillin.YoumustperformtheRegisteringyoursoftwareprocedureandenteryournewLicenseKey.AnypreviouslyobtainedLicenseKeysareinvalidandwillnotworkcorrectly.Seealso:NewproductregistrationmethodRegisteringyoursoftwareCanIinstallPC-cillin2002onanothercomputer?WhatifIlostmyserialnumber?

LicenseKeyerror...can'tregisterPC-cillin2002WhenyouregisteryousoftwareandreceiveaLicenseKeyfromtheTrendMicroWebsite,anerrormessagemayappear:Thismayhaveoccurredforthefollowingreasons:

Ifyouaccessedtheonlineregistrationsitefromadifferentcomputer,pleasetryregisteringagainfromyourowncomputer.ALicenseKeyiscreatedusingacombinationofyourcomputerinformationandyourPC-cillinserialnumber.YoumayhavemistypedyourLicenseKey.TypeyourLicenseKeyexactlyasitappears.LicenseKeysarecasesensitive.Ifyoure-installedyouroperatingsystem,youmustre-registerPC-cillin.YouhavetogetanewLicenseKeyfromtheonlineregistrationsite.

DoesPC-cillin2002automaticallychangeauser'smailaccount?YestheaccountnameandthenameoftheincomingPOP3mailserverchanges.However,ifyouareusingasupportedInternetmailclient,likeOutlook98orabove,OutlookExpress,NetscapeMessenger,orEudora,PC-cillinwillautomaticallymakethesechangesandwillnotaffectyoureceivingmail.IfyouareusinganunsupportedInternetmailclient,modifythemailconfigurationsettings(refertothedocumentationofyourmailclient)bymanuallychangingtheincomingservertolocalhostandchangingtheaccountnametoname/pop3server(wherenameisyouraccountnameandpop3serveristhenameofyourPOP3mailserver).

Howtosetmultiplemailaccounts?IfyouareusingaPC-cillin2002-supportedInternetmailclientlikeOutlook98orabove,OutlookExpress,NetscapeMessenger,orEudora,youdonothavetoperformanyspecialmodificationstocreatemultiplemailaccounts(refertoyourrespectivemailclientdocumentationfortheexactproceduresforcreatingmultiplemailaccounts).However,ifyouareusinganunsupportedInternetmailclient,foreachmailaccountmodifythemailconfigurationsettings(refertoyourmailclientdocumentation)bymanuallychangingtheincomingservertolocalhostandchangingtheaccountnametoname/pop3server(wherenameisyouraccountnameandpop3serveristhenameofyourPOP3mailserver).

Whenvirusdetectedinfileswith".RB"extensionWhenPC-cillincleansavirus,itcreatesabackupfilebeforetheprocess.Backupinfectedfileshavetheextension"RB0",or"RB1"~"RB8".Thebackupfilesarecreatedinthesamefolderastheinfectedfiles.Whenviruscleanprocesssucceedsyoucandeletethesebackup.RBfiles.PC-cillincannotcleanorquarantinevirusesfrombackup.RBfiles.Therefore,when.RBfilesaredetectedduringaManualScan,PC-cillincannotclean,quarantineordeletethefile.IfPC-cillinisconfiguredtoquarantinethefilewhenthecleanprocessfails,itcannotquarantinethefile,butthefilenameappearsonQuarantinedfileslist.Youcandeletethis.RBfilefromQuarantinedfileslistbutactuallyitisn'tdeleted.WhenyouperformaManualScanthe.RBfilewillbedetectedagain.Todelete.RBfiles:

1. OnthePC-cillinwindow,clickSettings.TheSettingswindowappears.2. OntheSettingsmenu,clicktheVirusScanlink.Themenuexpands.3. ClicktheManualScanlink.TheManualScanscreenappears.4. UnderScanaction,selectPassfromtheActionwhenvirusfoundlist.5. Scanalldrivesmanually.6. Whenthe.RBfileisdetected,selectthefilefromthelistintheScanFiles

dialogbox.7. ClickDelete.Aconfirmationmessageappears.8. ClickYestodeletethefile.

Afterdetecting"MBX"file,can'topenreceivedemailPC-cillinwithVSAPI5.400(orabove)canscan"MBX"files(filesusedbyOutlookExpress4.xformailboxfiles).OutlookExpress4.xcombinesmultiplemailsinone"MBX"file.TheVSAPI5.400scanenginecanscanthis"MBX"fileandcheckforviruses.Ifavirusisdetected,PC-cillincandetectthevirusbutcannotcleanthefile.Thedefaultsettingforafilethatcannotbecleanedis"quarantine".Therefore,the"MBX"filewillbemovedtotheQuarantinefolderandyoucannotaccessincomingemails.Ifthe"MBX"fileisquarantinedpleaserestorethequarantinedfiletooriginaldirectorytoaccessyouremail.Note:Don'tdeletean"MBX"file.Ifyoudeleteit,youwilllosenotonlyinfectedemailbutalsoallemail.Pleasedeleteinfectedemailusingyouremailreader.Checktheinfectedfilenameandthensearchfortheeachemail'sattachedfilename,anddeletethefilemanually.

What'sthedifferencebetweenWebTrapandthePersonalFirewall?PC-cillin'sWebTrapprotectsyouagainstmaliciousJavaandActiveXprogramswhilestillallowingtheharmlessonestopassthroughsafely.WebTraponlyscansJavaandActiveXprograms.ThePersonalFirewallmakesyourcomputer'sentrypointsinvisibletosnoopingintrudersandcreatesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).Thisbarrierexaminesandfiltersnetworktraffictoyourcomputer.Byfilteringnetworktraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.

WhatdothePersonalFirewalllogsymbolsmean?Apacket(informationtransmittedacrossanetwork)wasidentifiedaspartofanattackandblockedtryingtopassthePersonalFirewall.

Anunauthorizedindividualtriedtoconnecttoyourcomputer(probablyusingapacketsnifferorothertool).Thisrequestwasrejectedandyourcomputerremainshiddenfromothercomputers.

ATrojanhorseprogram(e.g.,BackOrifice)attemptedtoaccessacomputerportthatmatchedaportlistedintheTrojandatabase.Traffictryingtoaccessthiscomputerportwasblocked.

BurningaCD-ROMwhilerunningPC-cillin2002BeforeburningaCD-ROM,werecommendyouexitPC-cillinandturnoffreal-timescanning.ThisistopreventanyinterferencewiththeCD-ROMburningsoftware.Alsomakesureyouhaven’tscheduledatasktooccuratthesametimeyouwanttoburntheCD-ROM.

ReinstallingyouroperatingsystemIfyoureinstallyouroperatingsystem,youmustalsoreinstallPC-cillin,andre-registeryoursoftwareafterinstallation.YoumustperformtheRegisteringyoursoftwareprocedureandenteryournewLicenseKey.AnypreviouslyobtainedLicenseKeysareinvalidandwillnotfunctioncorrectlyonanothercomputer.

UsingadualbootmachineYoumustusedifferentserialnumberswhenyouinstallPC-cillinintodualbootmachine.IfyouinstalledbothWindows98andWindows2000usingdualbootmachineandwanttousePC-cillinforyourmachine,youhavetobuy2licenseofPC-cillin.Inthiscase,youhavetorepeatthesameinstallationprocessesforeachOS.Youmustperformon-lineregistrationonceforeachOS.Sinceyouusedifferentserialnumber,youwillgetdifferentlicensekeyforeachOS.Pleasekeepregistrationdate.LicensekeyisissuedusingyourserialnumberandOSinformation.Ifyouget2licensekeysusingdifferentOSs,onelicensekeymaybeinvalid.

IntelligentUpdateToreceivethelatestpatternfileandprogramupdates,PC-cillin2002detectsthecomputer'sInternetconnection.Ifthecomputerisonlineandthisfeatureisenabled,PC-cillinautomaticallyconnectstotheTrendMicroservertocheckifthelatestpatternfileorscanengineisavailable.Ifanewercomponentavailable,apop-upwindowappearsrequestingpermissiontostartdownloading.Ifyouchoosenottodownloadnow,thepop-upwindowwillre-appear10minuteslater.Withthisfeature,youdonothavetobeinvolvedwhenorhowoftenyouupdateyoursoftware.AslongasyouuseyourcomputerandtheInternet,PC-cillinalwaysinformsyouwhenyoucanupdateyoursoftware.

LicenseKeyYouneedtheLicenseKeytocompletetheregistrationprocess.Whenyouregisteryoursoftwareonline,youreceiveaLicenseKeyfromTrendMicroviaemail.AfteryouenterthisLicenseKeyintothecorrectfieldonthePC-cillinwindowandclickFinish,theproductisofficiallyregisteredandyoureceivethefollowingbenefits:ayearofviruspatternfileupdates,technicalsupport,andinformationaboutfutureupdatesandthelatestvirusthreats.WhenyoureinstallPC-cillinonthesamecomputerwiththeoriginaloperatingsystem(i.e.,youdidnotreformatyourharddriveorinstalladifferentoperatingsystem),itisunnecessarytore-registeryoursoftware.However,ifyouinstallPC-cillinonanothercomputerorreinstallyouroperatingsystem,itisnecessarytore-registeryoursoftwareandobtainanewLicenseKey.YoumustperformtheRegisteringyoursoftwareprocedureandenteryournewLicenseKey.AnypreviouslyobtainedLicenseKeysareinvalidandwillnotworkcorrectlyonanothercomputer.

logPC-cillinkeepsrunninglogsofallupdate,virus,Sitefilter,andPersonalFirewallactivity.TheselogscanbeviewedfromtheViewLogsscreenandprovideavaluablesourceofinformation.Youcanexporttheselogstoprintthemorexaminetheminmoredetail.Youcanalsodeletethemiftheybegintotakeuptoomuchspaceonyourharddisk.Inadditiontodisplayingthedateandthetimeofeachrecordedlog,thevariouslogtypesprovidelog-specificinformation.

InternetmailscanPC-cillincanscanemailattachmentsretrievedfromaPOP3mailserver(supportedPOP3mailclientsinclude:MicrosoftOutlook98andabove,MicrosoftOutlookExpress4andabove,NetscapeMessenger,andEudoraPro4.0andabove).Virus-infectedemailattachmentsarenowtheprimarymeansofvirusinfection.Duetotheubiquityofemailcommunication,manyviruswritersarenowwritingvirusesthatexploitthevulnerabilitiesofemailclients.

MacroTrapTrendMicro'sMacroTrapperformsarules-based,line-by-lineexaminationofallmacrocodethatissavedinassociationwithadocument.Thiscodeanalysisiscalleda"heuristic,"or"intelligent"searchbecauseitallowsthevirusenginetodetectnewvirusesthathavenotbeenincludedintheviruspatternfile.Macroviruscodeistypicallycontainedasapartoftheinvisibletemplate(.dot,forexample,inMicrosoftWord)thattravelswithmanydocuments.MacroTrapchecksthetemplateforsignsofaMacrovirusbyseekingoutkeyinstructionsthatperformvirus-likeactivities--instructionstocopypartsofthetemplatetoothertemplates(replication)ortoexecutepotentiallyharmfulcommands(destruction).Macrovirusesarethemostcommontypeofviruses,responsibleforthegreatestnumberofinfections.Thisisbecausemacrovirusesarerelativelyeasytoproduce,spreadeasily(forexampleviaemailattachments),andareplatformindependent.AnycomputerrunningWord,forexample,canbecomeinfectedwiththeConceptvirus--regardlessofwhethertheWorddocumentisopenedonaPC,aniMac,oronanotherplatform.

PDAAsmallhandheldcomputingdevice,apersonaldigitalassistant(PDA),providescomputing,storage,retrieval,andnetworking.ManufacturershaveprovidedPDAswithanumberofmethodsforcommunicatingwithotherdevices,frominfraredtransmitterstomobilephones.High-endPDAsalsofeatureInternetconnectivity.

PatternfileApatternfile,orviruspatternfile,isadatabaseoftheknownvirusbinarypatterns.Thesebinarypatternsorsignaturesserveasa"fingerprint"thePC-cillinscanengineusestodetectvirusesinemail,FTP,andWebtraffic.Asnewvirusesarewrittenandreleasedoutintothepublic,TrendMicrocollectstheirtell-talesignaturesandincorporatestheinformationintothepatternfile.UpdatedpatternfilesareavailableeveryweekorsoandyoushouldmakesureyourpatternfilesarethelatestversionTrendMicrohasreleased.UpdatesareavailableforoneyeartoregisteredPC-cillinusers.

RescueDisksA"rescuedisk"isabootablefloppydiskthatPC-cillincancreateifyouarerunningWindows95/98/Me.Rescuedisksshouldbecheckedforvirusesandwrite-protected.Inadditiontothisdisk,PC-cillinbacksupsomecriticalsystemfilesandcopiesthemtootherfloppydisks.Youneedmultipledisksforthecompletesetofrescuedisks.

PersonalFirewallTheTrendMicroPC-cillin2002PersonalFirewallprotectsyourcomputeragainstattacksfromtheInternet.Afirewallcreatesabarrierbetweenyourcomputerandthenetwork(LAN,Internet).Thisbarrierexaminesandfiltersnetworktraffictoyourcomputer.Byfilteringnetworktraffic,thefirewallpreventsmaliciousprogramsorfilesfromenteringyourcomputer.Actuallycomposedofthreecomponents(cloaking,firewall,Trojanbackdoorblocking),thePersonalFirewallletsyoucontrolthesecuritylevel,createalistofsitesyouknowcanbetrusted,andviewalistofblockedports.

Real-timeScanReal-timescanningprovidesconstantprotectionagainstviruses.Withreal-timescanningenabled,youreducethechanceofyourcomputerbecominginfected.Becauseitissopowerful(andbecauseitoperatesimperceptiblyinthebackground),werecommendthatyoualwayskeepreal-timescanningenabled.Thereal-timescannerchecksfilesforviruseswhenevertheyareused,forexampleeachtimeafileisopened,copied,moved,saved,compressedordecompressed,downloadedfromtheInternet,andinthecaseofemailattachments,read.Besidesmonitoringfileoperations,real-timescanningoffersprotectionagainstvirusesenteringyoursystemfromtheInternetviafiledownloads(HTTPandFTP)andthroughinfectedemailattachments.ItevenmonitorscompressedfilessuchasZIPfilesastheyaredecompressed.

Real-timeMonitorTheReal-timeMonitorislocatedinthesystemtrayandisusedtoquicklyperformcommonlyusedfunctions.Forexample,youknowataglanceifreal-timescanningisenabled(thelightningstreakiconisred)ordisabled(thelightningstreakiconisgrey).

TheEmergencyLockisactivated.AllincomingandoutgoingInternettrafficishalted.

PC-cillinisconnectingtotheTrendMicroservertodownloadthelatestupdates.

Yourcomputeriscurrentlyunderattack.

Thereal-timescanningfunctionisenabled.

Thereal-timescanningfunctionisdisabled.

TheReal-timeMonitorisalsoausefultoolfordoingthefollowing:

OpeningthePC-cillinwindowEnablingtheEmergencyLockEnablingreal-timescanningOpeningtheSettingswindowViewingthereal-timestatusExitingtheReal-timemonitor

ScanNow(ManualScan)Ifyoususpectthatafile,folder,ordrivehasbeeninfectedandyouwantimmediateconfirmationaboutthestatus,runScanNow(ManualScan).IfduringScanNow,PC-cillindetectsavirus,PC-cillintakestheactionyouhavespecifiedinyourScanNowsettings.

ScantasksForaquickandconvenientwaytoperformavarietyofvirusscanning,usescantasks.Scantasksautomatesroutineantivirusmaintenanceproceduresonyourdesktopandimprovesantivirusmanagementefficiency.

SiteFilterSiteFilterofferscustomizedprotectionagainstoffensiveWebcontent.TrendMicro'suser-configurableSiteFilterfunctionletsyouspecifywhateverWebsitesyouwant"offlimits"tootherusersofthecomputer.Thisfunctionisespeciallyusefulforfamilieswherefamilymembers,includingchildren,shareonecomputer.

WebTrapAlthoughmostWebsitesareharmless,itispossibleforsomeonetocreateasmallprogramandconfigureittoruninvisiblywheneveraWebpageisaccessed.Thesetypesofprogramscandestroydata,stealyourpasswordsorfinancialdata,etc.WebTrapprotectsyourcomputeragainstmaliciousJavaandActiveXappletswhileallowingharmlessonestopasssafelythrough.

welcome to pc-cillin 2002 - documentation.help · stop their processes, and deletes files dropped...

Documents