McAfee VIRUSSCAN 4.5 Administrator's Manual page 93

• If you suspect that a macro virus has infected your PowerPoint files, copy
the file BLANKPRESENTATION.POT from C:\Program Files\Microsoft
Office\Templates to the disk.
Making disk images
To send the files now stored on any floppy disks you created, you can use a
McAfee AVERT Labs tool called RWFLOPPY.EXE to make a floppy disk
image that encapsulates the infection. The RWFLOPPY.EXE tool does not
come with your VirusScan software, but you can download it from this
location:
http://www.nai.com/asp_set/anti_virus/avert/tools.asp
The AVERT site stores the tool as a compressed .ZIP file. Download the file to
your computer, then extract it to a temporary folder on your hard disk. The
.ZIP package contains a brief text file that explains the syntax for using the
RWFLOPPY.EXE utility.
NOTE: If you suspect you have a boot virus, you must use RWFLOPPY
to send your samples electronically; otherwise, you must send your
samples physically on a diskette. If you send them electronically without
using RWFLOPPY, the samples will be incomplete or unusable, as boot
viruses often hide beyond the last sectors of a diskette, and other diskette
image creation programs cannot obtain this data.
Once you create images of the disks you want to send, you can send them as
file attachments in an e-mail message to McAfee anti-virus researchers.
Preparing file archives to send
Try to fit as many of file samples as you can on a single floppy disk. To do so,
compress the samples that you captured on disk to a single .ZIP file with
password protection. Here's a suggested procedure that uses the WinZip
utility:
1. Start WinZip.
2. Press CTRL+N to create a new archive.
The New Archive dialog box appears.
3. Enter a name for the new archive, then click OK.
4. Press CTRL+A to add files to the new archive.
The Add dialog box appears.
5. Click Password to display the Password dialog box.
Removing Infections From Your System
Administrator's Guide 93