McAfee VIRUSSCAN 5.1 User Manual page 76

Removing Infections From Your System
Capturing file-infecting or macro viruses
If you suspect you have a file-infecting virus or a macro virus that has infected
any of your Microsoft Word, Excel, or PowerPoint files, send these files to
McAfee VirusScan's anti-virus researchers, either with the SENDVIR.EXE
utility, via e-mail as floppy disk images, or through the mail on floppy disk:
• If you suspect that a virus has infected executable files on your system,
copy COMMAND.COM to a formatted floppy disk, then change its file
extension to a non-executable extension.
• If you suspected that a macro virus has infected your Microsoft Word files,
copy NORMAL.DOT and all files from the Microsoft Office Startup folder
to the floppy disk. You'll find the Microsoft Office startup files here, if you
installed Office to its default location:
C:\Program Files\Microsoft Office\Office\Startup
• If you suspect that a macro virus has infected your Microsoft Excel files,
copy all files from C:\Program Files\Microsoft Office\Office\XLSTART
to the disk. Include all files you have installed in alternative startup file
locations.
• If you suspect that a macro virus has infected your PowerPoint files, copy
the file BLANKPRESENTATION.POT from C:\Program Files\Microsoft
Office\Templates to the disk.
Making disk images
To send the files now stored on any floppy disks you created, you can use a
McAfee VirusScan AVERT Labs tool called RWFLOPPY.EXE to make a floppy
disk image that encapsulates the infection. The RWFLOPPY.EXE tool does not
come with your VirusScan software, but you can download it from this
location:
The AVERT site stores the tool as a compressed .ZIP file. Download the file to
your computer, then extract it to a temporary folder on your hard disk. The
.ZIP package contains a brief text file that explains the syntax for using the
RWFLOPPY.EXE utility.
76 McAfee VirusScan
http://www.nai.com/asp_set/anti_virus/avert/tools.asp
NOTE: If you suspect you have a boot virus, you must use RWFLOPPY
to send your samples electronically; otherwise, you must send your
samples physically on a diskette. If you send them electronically without
using RWFLOPPY, the samples will be incomplete or unusable, as boot
viruses often hide beyond the last sectors of a diskette, and other diskette
image creation programs cannot obtain this data.