User Guide

Removing Infections From Your System
92 Dr Solomon’sAnti-Virus
• If you suspect that a macro virus has infected your PowerPoint files, copy
the file BLANKPRESENTATION.POT from C:\Program Files\Microsoft
Office\Templates to the disk.
Making disk images
To send the files now stored on any floppy disks you created, you can use a
Network Associates AVERT Labs tool called RWFLOPPY.EXE to make a
floppy disk image that encapsulates the infection. The RWFLOPPY.EXE tool
does not come with your Dr Solomon’s Anti-Virus, but you can download it
from this location:
http://www.nai.com/asp_set/anti_virus/avert/tools.asp
The AVERT site stores the tool as a compressed .ZIP file. Download the file to
your computer, then extract it to a temporary folder on your hard disk. The
.ZIP package contains a brief text file that explains the syntax for using the
RWFLOPPY.EXE utility.
NOTE: If you suspect you have a boot virus, you must use RWFLOPPY
to send your samples electronically; otherwise, you must send your
samples physicallyona diskette.Ifyousend them electronicallywithout
using RWFLOPPY, the samples will be incomplete or unusable, as boot
virusesoftenhidebeyond thelastsectorsof adiskette, andotherdiskette
image creation programs cannot obtain this data.
Onceyoucreateimagesofthedisksyouwanttosend,youcansendthemas
file attachments in an e-mail message to Dr Solomon’s anti-virus researchers.
Preparing file archives to send
Try to fit as many of file samples as you can on a single floppy disk. To do so,
compress the samples that you captured on disk to a single .ZIP file with
password protection. Here’s a suggested procedure that uses the WinZip
utility:
1. Start WinZip.
2. Press CTRL+N to create a new archive.
The New Archive dialog box appears.
3. Enter a name for the new archive, then click OK.
4. Press CTRL+A to add files to the new archive.
The Add dialog box appears.
5. Click Password to display the Password dialog box.