Frequently Asked Questions
General Issues
When I leave Vanderbilt, may I continue to use the antivirus programming?
Virex for the Macintosh Operating System
Will the current version of Virex work on the Macintosh running MacOS version 9 or later?
VirusScan for the MS Windows Operating Systems
Do I need to do both an update and an upgrade to insure that my program is current?
Why provide both the update and upgrade facility (on the VirusScan program)?
Q - If I install an antivirus program on my system, am I totally protected from ever getting a virus or other malicious software again?
A - No, nothing will ever guarantee that! The installation of an antivirus program is only a first step in minimizing your chances of getting a virus. New viruses appear almost daily (some have estimated in the hundreds each week)! Fortunately, most do not circulate widely for a variety of reasons, but some do. Therefore you must keep the antivirus programming up to date. Even so, it generally takes about a week or so from the time a new virus is discovered before the program updates can be distributed to detect and remove it. During this "window of opportunity" for the virus, it may be replicated and spread literally around the world. You can cut down your chances of getting such a virus by not opening attachments to e-mails. If the attachment is from someone you know (and trust) or is something you are expecting, save it to disk and scan it for viruses before opening. Be wary of obtaining files from others, either by diskette or the network. Finally, keep a backup of your important data so that in the event your system is hit by a virus (or suffers damage for non-virus reasons, such as falling off the desk!) you have not lost your research, thesis, financial records, etc., etc.
Q - After installing the antivirus programming, I noticed that the program I just downloaded is more than 6 months old. Is that version recent enough? How come the base program is not updated more frequently.
A - The program, if not upgraded, is too old to be of much use by itself. However, the program does include the upgrade capability so that program changes as well as new virus signature files can be incorporated literally "at the click of a button." The upgrades are cumulative - you need only to bring in the latest upgrade. Since this upgrade step is a part of the installation process, there is no need to change the original program as distributed. You will have the most current version of the programming available when you complete the full installation process, and will continue to be up to date as long as it is updated (upgraded) on a regular basis.
Q - When I leave Vanderbilt, may I continue to use the antivirus programming?
A - Unfortunately, no. The contract with NAI for use of the VirusScan (for Windows) and Virex (for Macintosh) is with Vanderbilt, not with individual user. Upon leaving the University or Medical Center, you must either obtain your own license (e.g., retail copy) for the program, or remove the programming from your system. In addition, once your VUnet ID expires you will no longer have access to the update or upgrade files through the Vanderbilt network.
Q - I have some (or all) of my files on a network file space facility (e.g., VUspace or a departmental network file server). Do I need to check these files for viruses, or are they being checked by the file server?
A - Files on a network file server in some cases are checked for viruses as part of the services provided for that server. However, you may check for viruses on a network server just like the files on a local hard disk system. If the file system is being shared with other users or if you access the file system from multiple computers (e.g., systems in a computer lab accessing your file space on VUspace), it is recommended that you insure the file space is scanned frequently. If you are responsible for maintaining a shared file space, you should scan the file space periodically to prevent the shared file space from becoming a source of virus infections for the department or campus.
Q - I have read the licensing agreement that is presented to me during the installation, and it's confusing and basically unintelligible and/or refers to a document on a web site that contains a number of different license agreements - each for different purposes. What are the licensing conditions that I am agreeing to?
A - When you download and install any of the Network Associates (McAfee) anitivirus programming from the Vanderbilt web site, you are agreeing basically to the following -
Vanderbilt's Acceptable Use Policy -
In using the facilities of the Vanderbilt Network and E-mail services you agree to abide by Vanderbilt's Policy for Computer Privileges and Responsibilities (Acceptable Use Policy, or AUP) as given on the web site - https://www2.vanderbilt.edu/vunet/aup.html
Network Associates Software License Agreement -
Vanderbilt University has signed an agreement with Networks Associates Incorporated (NAI) permitting the use of this software by the faculty, students, and staff of the University and Medical Center.
You may view the legal agreements located in the Network Associates License Agreement.PDF file. The Network Associates License Agreement.PDF file can be individually downloaded from the Download web site: http://www.mcafeeb2b.com/naicommon/download/upgrade/login.asp . The agreement in this document that applies is the one relating to perpetual use within the United States. By downloading and using the programming you agree to be a part of this agreement, but only for as long as you remain associated with Vanderbilt. For example the perpetual use clause applies to usage by Vanderbilt - not by individuals once they leave Vanderbilt. When a person leaves the University or Medical Center, she or he must obtain a new license to use this program from Networks Associates or remove this programming from her or his system(s) and backups. Of course, individuals may not give or sell the programming away to others, especially to those outside of the University or Medical Center. Updates and upgrades are only available to systems that are currently licensed (or until the agreement between Vanderbilt and Network Associates expires and is not renewed).
The Network Associates License Agreement.PDF file is saved in Adobe Acrobat Portable Document Format (PDF). You must have a copy of Acrobat Reader installed to view the .PDF file. A free copy of the latest version may be downloaded from the Adobe web site: http://www.adobe.com/prodindex/acrobat/readstep.html
Q - I received a message on my Macintosh system (with Virex installed) and was able to read it with no indication of a problem. When I went to read the same message on a Windows-based PC with VirusScan installed, the VirusScan program reported that the message was infected with a virus. Why wasn't the Macintosh-based Virex able to detect the virus when the PC-based VirusScan was able to? (This could happen the other way around.)
A - Each program (Virex and VirusScan) are intended to protect the client computer system from viruses and worms that would affect the individual machines. In this case, Virex did not "catch" the infected message because the programming code involved with the suspect message would not work on the Macintosh platform - it was not an infected message as far as the Macintosh system was concerned. Neither program are designed to catch all of the viruses and worms that have been written - just the ones that would affect the platform(s) for which the antivirus product was designed for.
Q - I am constantly getting messages that I have been sending infected e-mail messages to others. However I have checked my system with the latest virus definitions and cannot find any problem with my system. What's going on?
A - When a virus that use e-mail to spread generates a message to send to others, it will look in the infected system for address books, saved (cached) web pages, and elsewhere for e-mail addresses of possible recipients (victims). This is called spoofing the address. The e-mail type of virus now not only spoof the address of the intended receiver (the "To:" address) but also that of the sender (the "From:" address) as well, making it appear that the message was coming from someone else instead. When an antivirus program detects the infected message, many times it attempts to generate a message back to what it thinks is the sender based on the "From:" address. Hence, if you are listed in someone else's address book and their system gets infected, you end up getting the responses! (The Vanderbilt VUmail system's antivirus does not attempt to notify "senders" of messages it finds infected for this reason.)
Q - Will the current version of Virex work on the Macintosh running MacOS version 9 or later?
A - Previous versions of Virex (versions 6.0 and before) do not work under MacOS version 9. However, the current version - version 6.1 - does support version 9 of MacOS. Version 7 of Virex supports only the Macintosh OS-X operating system. Version 7.2 of Virex can be installed only on Macintosh OS-X systems version 10.1.3 or later, and includes an eUpdate procedure (not included on Virex v7.0) to make the updating process more convenient.
Q - My system reports that it has beem detected with the SIRCAM virus (W32/Sircam), but it cannot clean all of the files. How can I get rid of this virus!
A - At the present time, the best way is by using a virus removal program made available from Symantec. To use, download this program, Symantec's FixSirc.com, to the desktop. Upon completion, disconnect the system from the network (unplug the network cable from the back of the system). Shut down all programs running on the system, including VirusScan and VShield. (Open the VirusScan Console window, select the VShield task, and click on "Stop" to stop the VShield program. Now click on the "Tasks" menu item and select "Exit" to shut down the VirusScan Console.) If you are running Windows Me you must disable the "System Restore" feature of that operating system.
Double-click the FixSirc program downloaded earlier. On the program window click the "Start" button to start program execution. Upon completion, reboot the system. The virus should be gone and the system functioning normally. Before reconnecting to the network, remove or at least password protect any network file sharing access you may have (the SIRCAM and other viruses can spread via open file shares as well as via e-mail messages). (Thanks to the Symantec Corporation for making this tool publicably available.)
Q - When bringing the VirusScan programming (for Windows-based systems) up to date, what is the difference between update and upgrade? (Applies to VirusScan programming prior to version 7.0.)
A - In terms of the program, the update process obtains the current data files containing information (usually code fragments, or signatures) used in checking with program and data files to identify and report viruses when they are found. Also included is information used by the program needed to remove or disable the virus when it is found. However, in some cases one or more new viruses are discovered requiring a change in how the program itself examines files in order to detect these viruses. These program changes are made if needed during an upgrade process. In addition, the program upgrade includes the latest virus signatures so that it is never necessary to perform an update and an upgrade at the same time.
Note that starting with version 7, VirusScan drops the upgrade process as a specific task - the update operation includes upgrading of the programming whenever needed.
Q - Do I need to do both an update and an upgrade to insure that my program is current? (Applies to VirusScan programming prior to version 7.0.)
A - Starting with version 4.51 of the VirusScan program, only periodic updates are needed, as any program changes as well as new virus signatures will be included. However, if the program has not been updated within the last four to six weeks, it may be quicker to perform an upgrade operation rather than execute all of the needed update operations required to bring the program up to the current level of protection.
Prior to version 4.5 it is recommended that periodic upgrade operations be performed so that the programming itself will remain current as well as the virus signatures.
Q - Then why provide both the update and upgrade facility (on the VirusScan program)? (Applies to VirusScan programming prior to version 7.0.)
A - The version of VirusScan that is distributed is the standard commercial (retail) version, which includes the update capability using the virus signature data files freely available from Networks Associates, Inc. (NAI). The upgrade files are not generally available (at least, not without a fee paid to NAI). As part of Vanderbilt's contract with NAI, Vanderbilt is able to obtain weekly updates to both the virus signature files and the program upgrade files and make them available to the University community.
The upgrade files are usually somewhat larger than the update files. While not too much of a concern for systems directly connected to the Vanderbilt network, the longer files result in a significantly longer connect time for those systems connected by telephone modems. Users of such systems will find the update process somewhat faster as a result than the upgrade process. However, those users of VirusScan version 4.5 or earlier will need to check to make sure the scanning program (or "engine") is up to date and perform an upgrade operation when a new version is released.
Q - I am having problems with installing VirusScan. It either reports a conflict with some other program or an entry in the system register, or just aborts the installation process. What is causing this?
A - Chances are that you still have another antivirus program installed or that the previous programming was simply deleted from the system by deleting the program files from the disk. When removing any program from a Microsoft Windows system (Windows 95/98 or NT), be sure to follow the program's uninstallation instructions. This usually means to remove the program using the "Add/Remove Program" facility within the Windows "Control Panel". Removing a program by simply deleting it's files runs the risk of leaving missed and no longer used program, data, and library (.DLL) files taking up space on the system. Worse, it almost always leaves entries related to the program being deleted in the system registry file, potentially causing conflicts and erratic program and system behaviour from that point on.
Q - VirusScan states that it has found a virus but cannot clean the virus or delete the file (often because the file is in use). What can I do to get rid of this virus?
A - This can occur with many types of viruses that are automatically started on bootup (and cannot be cleaned because the files containing the virus are always "in use"). Removing such a virus usually requires special procedures. Click here for some specific instructions. (But see above for specific question and answer relating to the W32/Sircam virus.)
Q - I have installed the current version of VirusScan and now I find that on occasions my system "locks up" on me or even crashes. I have not noticed this prior to installing the antivirus program. What is going on and how can I fix this?
A - If you are also running another antivirus program in addition to VirusScan, the two program are "competing" for the same resources and are interfereing with each other. Remove both (all) antivirus programming, then reinstall only the VirusScan program. If you wish to "obtain a second opinion" concerning a possible virus infection, disable the VShield file on-access scanner portion of the VirusScan program, then run a "stand-alone" version of another antivirus program. Don't forget to re-enable VShield afterwards.
If you are not running a second antivirus program when the system locks up or crashes, chances are this is happening when the system is running some disk maintenance program such as disk defragmentation or optimization routines. If you are using version 4.5 of the VirusScan program there is a Service Pack that needs to be installed as well. It is also available from this website, and will resolve most of these sistuations. Better yet, install the latest version (version 4.51 SP1 or later, also found at this web site). If you are still having problems with system crashes or lock-ups, contact your Local Support Provider (LSP) or the ITS Help Desk for assistance.
Q - I have installed VirusScan (for Windows-based systems) on my computer at home, but now I cannot update or upgrade the programming. The update/upgrade process keeps informing me that it cannot access the server. What's wrong?
A - Chances are if you are having a problem such as this, you are connecting to the Vanderbilt network using a third pary Internet Service Provider (ISP), such as "...@home.com" and "...@aol.com," and have configured the program for proxy access (this used to be a requirement for off-campus access to the update and upgrade files). Since the Spring of 2001 this proxy access is no longer needed for off-campus access to these files. Bring up the VirusScan Console window - click once on "AutoUpgrade" - click on the "Configure" button - click on the Vanderbilt AV site name and click on "Edit..." - uncheck the box for "Use proxy server" - click on "Ok" to close each of the opened windows. Repeat for the "AutoUpdate" task, then close the VirusScan console window.
Q - I have been told that my system has been infected by something called the "Code Red" or the "Nimda" virus, or that I am suseptable to the virus. What can/should I do?
A - Microsoft has issued an update to close some vulnerabilies that were uncovered in a server program called "Internet Information Server" or IIS. This program is normally installed as a part of Windows/NT and Windows 2000 server system - not as part of a workstation installation, nor in a Windows/9x or Windows/Me system. Users who think they might be infected should check out Microsoft's Security Bulletin relating to this. You will still need to run an up-to-date antivirus program to protect you from "Nimda" and similar viruses.
Q - The version of VirusScan sold in the retail stores appears to be a later version than that available from your web site (e.g., version 6 in the stores, rather than version 4.5.1 on the web). Should I get the later version from the store? (or) Why aren't you making the later version available on the web site?
A - The version of VirusScan available from the retail store is designed for stand-alone systems as commonly found at home, with only occasional access to the Internet (via dial-up modem or cable/DSL modem). The version distributed by Vanderbilt is an "enterprise" version designed for systems with constant access to the network via high-speed connection to the Internet and local network, and is the current version available from NAI/McAfee for such environments. (If you will, it is the corporate "industrial-strength" version, as opposed to the "consumer" version available from the retail stores.) In the home environment, the version distributed by Vanderbilt may take a little longer to perform a full scan of the system, but provides at least equal protection to the retail version (assuming of course both are kept up-to-date). Connected to the network via high-speed connections (as is the case on campus) the version distributed by Vanderbilt gives better protection for such things as shared file access across the network.
For Windows NT, 2000, XP, and 2003 Server based systems, VirusScan is available in an "enterprise" version designated as version 7. This version makes use of the facilities in these more advanced opeating systems for improved performance. For Windows 95, 98, and Me based systems version 4.5.1 remains the version of choice for the Vanderbilt environment.
Q - I am unable to schedule tasks or perform updates (or) I get some message about "services" not being started whenever I attempt to schedule a task or perform an update (or) I am unable to uninstall VirusScan v7 (the procedure starts to uninstall, stalls at some point in the uninstall operation, then "rolls" back the operation leaving the program installed).
A - For unknown reasons, the installation has become corrupted. In some cases uninstalling the program and rebooting the system, followed by reinstallation of the program will fix the problem. In the case that this does not work, or the uninstall operation does not remove the program, the program will need to be "manually" uninstalled and the system registry file "cleaned up" (VirusScan related entries removed from the registry). Click here for information and instructions for manual removal of the program.
