Sophos Anti-Virus for Windows NT/95/98/Me user manual
Contents
1. 48 Updating Sophos Anti Virus must be updated regularly to enable it to detect all the latest viruses If your computer is on a network or if your administrator has installed Sophos Anti Virus for you Sophos Anti Virus has probably already been configured to update itself automatically If you need to set up automatic updating or want to change the updating settings you can do so However on Windows NT you must be logged in with local Administrator rights This section describes how to e update manually e set up automatic updating e set a source for updates e set an alternative source for updates e schedule updates e update via a proxy e limit the bandwidth used e log updates Updating manually Q If you have installed Sophos Anti Virus as recommended in Sophos documentation updating occurs automatically If you want to update Sophos Anti Virus manually you can do so 1 Locate the Sophos Anti Virus icon in the system tray shown below 2 Right click and select Update now Q Alternatively double click the Sophos Anti Virus icon Provided Sophos Anti Virus has been correctly configured it checks the usual source for new software and if necessary updates itself For information on configuring updating see the other pages in this section 49 Sophos Anti Virus for Windows NT 95 98 Me Updating Setting up automatic updating If your computer is on a network or if your administrator installed Soph2. sd SOPHOS P sophos anti virus Sophos Anti Virus 4 5 for Windows NT 95 98 Me Document version 1 0 Sophos Anti Virus for Windows NT 95 98 Me About this manual This user manual explains how to use Sophos Anti Virus for Windows and how to configure e virus scanning e virus alerts e disinfection e logging e updating The manual also provides help in resolving common problems For information on the installation and initial setup of Sophos Anti Virus see the Sophos Anti Virus Enterprise Solutions startup guide Sophos Anti Virus for Windows NT 95 98 Me Contents About Sophos Amt EMS edd g eg 1 Sophos AMU VINUS WINDOW EE 1 Sophos Anti Virus system tray Ieon rnnr nnneertnr tnne nnne re nee 4 Immediate and scheduled scanning ssssssssssunnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn nnna 5 Running an finnen EE 5 SCHEOUIMIG A scam ra eee 7 Changing items for immediate scanmimg 9 Changing items scanned by a scheduled ob 10 Setting times of a scheduled ob 12 Changing scanning eet EE 13 Setting up automatic daimtechon tn nnnnnnr ennn nnnn nenene 15 Configuring ee e 17 Changing types of executable for scanmimg 18 Excluding files from SGanninG DEEN 20 Scanning memory OS E EE 21 On screen log virus detected messages 21 Enabling or disabling display of progress bar 23 On access SCAMMING DEE 24 Checking on access scanning IS acCHve ee 24 Changing SCANNING OPTIONS cccccc
3. filename e Drive drive name e Sector sector number Disk e Cylinder e Head e Sector e Memory block at address 8 digit hex address Sophos Anti Virus does not remove virus fragments See Virus fragment reported 22 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Enabling or disabling display of progress bar You can choose whether or not the progress bar is displayed during an immediate or scheduled scan 1 For immediate scanning click the Immediate tab in the Sophos Anti Virus window For scheduled scanning click the Scheduled tab 2 On the View menu click Progress Bar This does not affect any scans already running To display the progress bar Sophos Anti Virus has to count the items to be scanned before starting This can take a significant amount of time which is saved by disabling the progress bar 23 On access scanning On access scanning intercepts files as they are accessed and grants access to only those that are virus free If your computer is on a network or if your administrator has installed Sophos Anti Virus for you on access scanning has probably already been configured However if you want to change the settings and your administrator has given you permission to change them permanently you can do so On Windows NT computers to change the settings for on access scanning use the Sophos Anti Virus window You must be logged
4. On access scanning These options give greater protection against viruses that write to the computer s hard drive and or rename files However the increased activity may affect the computer s performance Removable media If you want Sophos Anti Virus to check the boot sectors of all removable media when they are first used select Check boot sectors when disk first accessed By default this option is selected If you want Sophos Anti Virus to allow you to access drives that have infected boot sectors select Allow access to drives with infected boot sectors This option enables you to copy files from a floppy disk infected with a boot sector virus a Do not boot a computer from an infected disk Doing so could infect the computer Changing types of executable for scanning To change the types of file in the executables list on the Options menu click Executables Executable File Extensions EH Current ist of executable exlensons el Fies with no extension On Windows NT this dialog box is only available if you are logged on with Administrator rights Adding an executable type To add an executable type to the list click Add In the New Executable Extension dialog box type the filename extension of the executable type 30 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Removing an executable type To remove an executable type from the list select the filename extension of the executable type you wan
5. for memory resident viruses automatically when it is first started On screen log virus detected messages The following messages can appear in the Sophos Anti Virus window in the on screen log when Sophos Anti Virus detects a virus They include the virus name where the virus was found and the action taken If you click a virus name you can view the analysis of that virus on the Sophos website Q In the descriptions below text in square brackets indicates information that varies Virus virus name detected in location Action This message is displayed if a virus is found during an immediate or scheduled scan The location is one of e filename e Drive drive name e Sector sector number e Disk e Cylinder e Head e Sector e Memory block at address 8 digit hex address The action taken depends on the disinfection settings See Setting up automatic disinfection for immediate and scheduled scanning or Setting up automatic disinfection for on access scanning It is one of the following e No action taken No action is taken if you have configured Sophos Anti Virus not to disinfect rename delete shred move or copy any infected items e File deleted The infected file has been deleted e File renamed to filename The filename is the old name with the filename extension changed to a number For example if the infected file was named Virus exe it is renamed to Virus 000 or Virus 0
6. not have sufficient access rights to the file or folder On Windows NT note that the log file is written as the Sophos Anti Virus service user and not the current user Error Could not notify user The user is on the notification list but cannot be notified This may be because the user is no longer on the list of recognised Microsoft Exchange users or because a profile that requires the user to enter a password was used Error Could not initialize mail system Microsoft Mail may not be set up correctly e g if the MAPI mail interface is not installed correctly Error Could not login to mail system If Sophos Anti Virus cannot log in to the mail system the profile name may be invalid Error Could not allocate memory for filename folder If the report file is too big Sophos Anti Virus cannot load it into memory to send it to the users on the notification list The report file can become very large if it is configured to list every file it examines see Configuring reports 63 Sophos Anti Virus for Windows NT 95 98 Me Technical support 200411 For technical support information visit www sophos com support If you contact technical support provide as much information as possible including Sophos software version number s operating system s and patch level s and the exact text of any error messages Copyright 2004 by Sophos Plc All rights reserved No part of this publication may be reproduced store
7. opens a dialog box in which you can configure virus alerts A The button shown below connects you to virus analyses on the Sophos website Scan list job list In the Sophos Anti Virus window on the Immediate tabbed page the scan list shows the drives paths and files that can be scanned Path File types Subtokers We wi GP Local hard dives Executables Yes Bal 3G Executables Yes wi L C Resuks doc N A Yes wi JC de Executables Yes v On the Scheduled tabbed page the job list shows the currently active or inactive jobs Job Name Days Times E E vety day 21 00 On screen log In the Sophos Anti Virus window the on screen log contains all messages logged since the window was opened Sophos Anti Virus for Windows NT 95 98 Me About Sophos Anti Virus Into Un access scanner started at 13 30 on 13 January 2004 On Windows 2000 XP 2003 if an Administrator user opens the Sophos Anti Virus window it also displays the scheduled and on access messages logged since the service was started Sophos Anti Virus system tray icon The Sophos Anti Virus system tray icon is always displayed even if the Sophos Anti Virus window is closed While on access scanning is active the icon is blue If you pass the mouse over the icon the hint displays the last time Sophos Anti Virus was updated If you right click the icon a menu is displayed From here you can e open the Sophos Anti Virus window e update Sophos Anti Virus
8. or moving infected files If you also select Disinfect mailboxes Sophos Anti Virus asks for confirmation only before disinfecting the first email or attachment it finds to be infected it does not ask for confirmation before performing subsequent disinfections of the same mailbox in the same scan This option is only available for immediate scanning It is selected by default Configuring reports 1 For immediate scanning click the Immediate tab in the Sophos Anti Virus window For scheduled scanning click the Scheduled tab and then select the scheduled job for which you want to configure reports 2 Click the button shown below 3 Click the Report tab 17 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning immediate Scanning Configuration Scanning Disinfection Report Report mode O List filenames Report file C Program Files Saphos Sophos Anii Virus REPO Ce Sophos Anti Virus generates a separate report file for each immediate or scheduled scan This file is provided for the user It is not the same as the continuous log file On Windows NT the report file is written as the current user for immediate scans and as the service user for scheduled scans Report mode If you want Sophos Anti Virus to record in the report file the name of every item scanned click List filenames Otherwise accept the default Report file Type a location for the report file or accept the default T
9. tabbed page select the name of the job you want to edit and click Edit to display the Scheduled Job Configuration dialog box shown above Then configure the job as described in Adding a scheduled job Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Changing items for immediate scanning You change items for immediate scanning from the Immediate tabbed page of the Sophos Anti Virus window Sophos Anti Virus Fie Options View Help ha SA SP sophos anti virus Immediate Scheduled On access Path File types Subfolders CT AN Executables Yes 9 Loca hard Executables Yes MG Executables Yes Items scanned Viruses detected Into Unr access scanner started at 13 30 on 13 January 2004 By default all local drives are included in the file list and are activated for scanning You can change the items in the file list as described below Adding an item for immediate scanning In the Immediate tabbed page click Add to display the Enter item details dialog box Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Enter item details Aiea File types Executables O l V Subtolders Area Specify the drive folder or file to be scanned You can enter either mapped network drives or UNC path names Alternatively click Browse to select from available items or use the drop down list to select all Local hard drives File types Only files defined as
10. will not disinfect a virus fragment because it has not found an exact virus match Virus fragment reported If a virus fragment is reported contact Sophos technical support for advice The report of a virus fragment indicates that part of a file matches part of a virus There are three possible causes 61 Sophos Anti Virus for Windows NT 95 98 Me Troubleshooting Variant of a known virus Many new viruses are based on existing ones so that code fragments typical of a known virus may appear in files infected with a new one If a virus fragment is reported it is possible that Sophos Anti Virus has detected a new virus which could become active Corrupted virus Many viruses contain bugs in their replication routines that cause them to infect target files incorrectly An inactive portion of the virus possibly a substantial part may appear within the host file and this is detected by Sophos Anti Virus A corrupted virus cannot spread Database containing a virus When running a full scan Sophos Anti Virus may report that there is a virus fragment in a database file Sophos Anti Virus reports errors The following error messages can appear in the Sophos Anti Virus window in the on screen log Q In the descriptions below text in square brackets indicates information that varies Error InterCheck report Message At time User user Node network address This is an error reported by on access scanning The d
11. 01 if there is already a file named Virus 000 and so on 21 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning e File shredded The infected file has been deleted and cannot be recovered e File moved to new location The new location is the location specified in the disinfection settings e File copied to new location The new location is the location specified in the disinfection settings e Error problem The problem is one of the following deleting file renaming to file shredding file moving to file copying to file This means the file could not be deleted renamed shredded moved or copied If the infected file is on a floppy disk check the disk is not write protected e If the infected file is not deleted or shredded it remains unchanged and may be able to infect other disks and files e Has been disinfected Sophos Anti Virus has automatically disinfected an item Run an immediate scan to ensure the computer is now free of viruses see Running an immediate scan e Error Disinfection failed Sophos Anti Virus was unable to disinfect an item See the Sophos website for information about disinfecting specific viruses a The infected item remains unchanged and may be able to infect other disks and files Virus fragment virus name detected in location No action taken This message includes the name and location of the fragment The location is one of the following e
12. Elve 54 Updating Via A det EE 55 Limiting the bandwidth USCC Luse dakiske 56 Logging VATER ee 57 lge El e ilayo EE 59 Updating tal OE EE 59 Scanning runs SIOWY degen ee 60 Scheduled scans do not run OB JOo iMei nnne 61 VIs eege Ela Ee HE 61 Virus fragment FeDOTE l een EeebtetetRE eebe HEES ER NSERSdeNEEEERKESU ER ENER devadese sansen 61 Sophos Anti Virus reports emore rnrn nenne 62 About Sophos Anti Virus Sophos Anti Virus is software that detects viruses worms and trojans on your computer or network It can also disinfect infected items In particular it can e scan your computer or network for viruses e check each file you access for viruses e eliminate viruses e alert you when it finds a virus e keep a log of its activity e be updated to detect the latest viruses Sophos Anti Virus consists of two main components e the Sophos Anti Virus window e the Sophos Anti Virus system tray icon Sophos Anti Virus window To open the Sophos Anti Virus window at the taskbar click Start Programs Sophos Sophos Anti Virus Sophos Anti Virus Sophos Anti Virus RBR Fie Options View Help H BR A SP sophos anti virus Immediate Scheduled On access Path File types Sublolders Ej AN Executables Y Le Tes M amp E Local had Executables Yes Bemo Daa Executables Yes sete a Items scanned Viruses detected Into Ur raccess scanner started at 13 30 on 13 January 2004 Sophos Anti Virus for Windows
13. Me computers see On access scanning On Windows NT computers do as follows 1 In the Sophos Anti Virus window click the On access tab 2 Click the button shown below 3 Click the Check tab 28 Sophos Anti Virus for Windows NT 95 98 Me On access scanning On access Scanning Configuration Scanning Disinfection Check Exclusions Files Check files 7 Dehned n gxecutable kst Automatically detected as executable type when V On read C On wete ClOn rename Removable media el Check boot sectors when disk first accessed _ Allow access to drives with infected boot sectors Check files If you want Sophos Anti Virus to check the file types specified in the executables list select Defined in executable list To change this list see Changing types of executable for scanning If you want Sophos Anti Virus to use file structure to determine whether to check files accessed select Automatically detected as executable type This option enables Sophos Anti Virus to determine whether a file could potentially contain a virus You can select one or both of these options When If you want Sophos Anti Virus to check files when they are opened select On read By default this option is selected If you want Sophos Anti Virus to check files when they are closed select On write If you want Sophos Anti Virus to check files when they are renamed select On rename Q 29 Sophos Anti Virus for Windows NT 95 98 Me
14. NT 95 98 Me About Sophos Anti Virus The components of the window are described in the following sections e Tabbed pages e Button bar e Scan list job list e On screen log To close the Sophos Anti Virus window on the File menu click Exit If Sophos Anti Virus is running on Windows 95 98 Me it may warn you that scheduled scans will not run if you close the window This means if you want scheduled scans to run the Sophos Anti Virus window must be open Tabbed pages In the Sophos Anti Virus window there is a tabbed page for each type of scan Different tabs may be displayed This depends on the version of Windows on the computer and the status of the user Immedate Scheduled On access Path File types Sublolders Add AN Executables Yes vw SP Local hard Executables res BE Io Executables Yes Ede Items scanned Viruses detected Errors The tabs are as follows e Immediate for starting a scan at any time e Scheduled for scanning automatically at set times as long as the computer is switched on e On access for checking files when they are accessed Button bar In the Sophos Anti Virus window the buttons are shortcuts to commonly used menu options The button shown below starts scanning Sophos Anti Virus for Windows NT 95 98 Me About Sophos Anti Virus d The button shown below stops scanning The button shown below opens a dialog box in which you can configure scanning The button shown below
15. Scanning leve Nomal Recommended Extensive C Scan inside archive files C Include Macintosh viruses Scanning level Normal scanning is sufficient for normal operation and scans those parts of each file that are likely to contain viruses Extensive scanning examines the complete contents of each file This level is rarely required would normally be used only on advice from Sophos technical support and is significantly slower than Normal scanning Scan inside archive files If you want Sophos Anti Virus to scan for viruses inside archive files select this option Archive types checked include ARJ BZIP2 CMZ GZIP InstallShield CAB RAR RAR3 RedHat Package Manager RPM Stuffit TAR Unix archive ZIP You can find a full list of archive types scanned in the Sophos Anti Virus ReadMe 25 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Q Whether you select this option or not files compressed with dynamic compression utilities PKLite LZEXE and Diet are scanned This option is rarely required and makes scanning significantly slower Even if you don t select the option on access scanning T still provides automatic protection from viruses in compressed files because access to every unrecognised item e g a newly decompressed file is only granted after that item has been virus scanned Include Macintosh viruses If you want Sophos Anti Virus to scan for viruses inside Mac files select this opti
16. al operation and scans those parts of each file that are likely to contain viruses Extensive scanning examines the complete contents of each file This level is rarely required would normally be used only on advice from Sophos technical support and is significantly slower than Normal scanning Priority Set Sophos Anti Virus to run at Low priority if you want to minimise the impact on system performance Note that this increases the time Sophos Anti Virus takes to perform a scan 14 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Scan inside archive files If you want Sophos Anti Virus to scan for viruses inside archive files select this option Archive types checked include ARJ BZIP2 CMZ GZIP InstallShield CAB RAR RAR3 RedHat Package Manager RPM Stuffit TAR Unix archive ZIP You can find a full list of archive types scanned in the Sophos Anti Virus ReadMe Q By default files compressed with dynamic compression utilities PKLite LZEXE and Diet are also scanned Even if you don t select this option on access scanning see On access scanning still provides automatic protection from viruses in compressed files because access to every unrecognised item e g a newly decompressed file is only granted after that item has been virus scanned Include Macintosh viruses Windows NT only If you want Sophos Anti Virus to scan for viruses inside Mac files select this option This enables S
17. ans on access scanning remains inactive until you start it again 35 Disinfection Sophos Anti Virus can disinfect infected files or make them safe You can e set up automatic disinfection e eliminate viruses This section also tells you how to e recover from virus side effects Setting up automatic disinfection Sophos Anti Virus can disinfect many infected files or make them safe automatically The procedure for setting up automatic disinfection depends on the type of scanning that you want to carry out the disinfection and on the version of Windows you are using Click below for details of how to set up automatic disinfection for e immediate or scheduled scanning e on access scanning Eliminating viruses Q Sophos Anti Virus can disinfect many viruses automatically See the help pages on setting up automatic disinfection If a virus is found Sophos Anti Virus displays a virus warning In the Sophos Anti Virus window in the on screen log click the virus name a Virus WM97 WM97Bad detected in C DOCUMENTS AND SETTINGS ED HVMY DO v lt gt Sophos Anti Virus connects you to the analysis of the virus on the Sophos website and advice on disinfection Recovering from virus side effects Recovery from virus infection depends on how the virus infected the computer Some viruses leave you with no side effects to deal with others may have such 36 Sophos Anti Virus for Windows NT 95 98 Me Disinfection e
18. ceceeeeeeseeeceeeeeeeeeeeceeaeeeeeeeeeeseesenaeaeeees 24 Setting up automatic daimtechon tn nn nnter ennn rnnn nennen ee 26 Selecting what iS Scanned rrsaennanvarvernornavnnnsnvarevrnerersennennnnvareasanvennennnnnene 28 Excluding items from scanminmg cece eee eee eee eee narrer 31 Starting and stopping scanning Windows NIT 33 RI In E 36 Setting up automatic dreimtechon nnna 36 Eliminating VIFUSSS s 2 2 c0rs4szeayavterarvedevecivs veayaurauatendaoeeiey Haver stdioyadeverusanned ass 36 Recovering from virus side effects ce cee ee cece ee nnnnnnnnnnnnnnnnnnn 36 Configuring lens E 38 Desktop messaging EE 38 Event logging Windows NT rnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn 39 Network messaging Windows NI 41 SST lee enee ee 42 Re Le Ta Hae 45 Setting the lee Miel 45 Clearing the on screen og 45 Administration ODNONS sac sacaseecsiee sees kc ecencaeeee cheteciets ett taestveesctia ee 47 Restoring ST AUT Le 47 Purging checksums for virus free fil S ccccceeeeeeesseneeeeeeeeeeeeeeeseaneees 47 Sophos Anti Virus for Windows NT 95 98 Me Administration options Locking settings for immediate SCANS ccceee cece ee ee rnrn eee te tee nn 47 VARANGER 49 leie Elte Bien ET EE 49 Setting up automatic updatmg 2 ccc cc eecceeeceeeeeeeeeseeeeeaeeeeeeeeseseeseneeaeeess 50 Setting a source ee EE 51 Setting an alternative source for updates 52 Scheduling
19. chedule tab If your computer is networked or if you update via a broadband internet connection select Enable automatic updates and enter the frequency of updating If you update via a dial up connection select Check on dial up The source for updates is not being maintained Your company may have moved the directory on the network or on a web server from which you should update Alternatively they may not be maintaining the directory If you think this may be the case contact your network administrator Scanning runs slowly Immediate or scheduled scans may run slowly for the following reasons Extensive scanning enabled By default Sophos Anti Virus scans only the parts of files that are likely to contain viruses If you set scanning to Extensive Sophos Anti Virus scans every part of every file and takes significantly longer to carry out a scan Extensive scanning should be enabled only on advice from Sophos technical support Checking all files By default Sophos Anti Virus checks only files that are defined as executables If it is configured to check all files the process takes longer See the section on changing items for immediate scanning or for scheduled scanning Network drives selected Network drives can be much larger than local hard disks and so take significantly longer to scan Most network interfaces provide much slower access than the local hard disk which can further slow down the scan Scan locally where
20. ction fails the infected file is dealt with in the same way as other infected files see Infected files below Disinfect programs Sophos Anti Virus can disinfect programs Sophos recommends that you use this option only as a temporary measure You should subsequently replace disinfected programs from the original disks or a clean backup 16 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Disinfect mailboxes Sophos Anti Virus can detect infected emails and attachments in Outlook Express mailboxes All infected emails and attachments that can be disinfected including those that are multiply infected are disinfected in one scan At the end of the scan Sophos Anti Virus reports any emails or attachments that it could not disinfect Infected files Sophos Anti Virus can make an infected file safe in several ways other than disinfection Renaming or moving an executable file reduces the likelihood of it being run Deleting or shredding the file disposes of it Shredding is a more secure type of deletion that overwrites the contents of the file If you choose to move or copy files you can select a folder for infected files from the browser The Infected files option does not apply to infected mailboxes Request confirmation If you select this option Sophos Anti Virus asks for confirmation before it does anything that involves changing infected items i e disinfecting renaming deleting shredding
21. d in a retrieval system or transmitted in any form or by any means electronic mechanical photocopying recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the licence terms or you otherwise have the prior permission in writing of the copyright owner Any name should be assumed to be a trademark unless stated otherwise InterCheck and Sophos are registered trademarks of Sophos Plc 64
22. e configure updating e check the progress of an update Immediate and scheduled scanning ts Q An immediate scan is a virus scan of the computer or parts of the computer that you can carry out at any time A scheduled scan is a scan of the computer or parts of the computer that takes place at a pre specified time You can use Sophos Anti Virus to e run an immediate scan e schedule a scan e change items for immediate scanning e change items scanned by a scheduled job e set times of a scheduled job e change scanning options e set up automatic disinfection e configure reports e change types of executable for scanning e exclude files from scanning e scan memory 95 98 Me e view on screen log virus detected messages e enable or disable display of progress bar Running an immediate scan 7 An immediate scan is a virus scan of the computer or parts of the computer that you can carry out at any time You run an immediate scan from the Immediate tabbed page of the Sophos Anti Virus window Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Sophos Anti Virus De Options View Help ka Sg A SP sophos anti virus Immediate Scheduled On access Path File types Subfolders E PAN Executables Yes Loca hard Executables Yes WEER Executables Yes Items scanned Viruses detected Into Un access scanner started at 13 30 on 13 January 2004 The file list shows items t
23. escription of the error is contained in the message Error Could not open filename The file called filename was on the list of files to be scanned but could not be opened for examination Check that the file is not in use or already open Error Could not read filename The file called filename was on the list of files to be scanned but could not be read This might indicate the file or disk is corrupt 62 Sophos Anti Virus for Windows NT 95 98 Me Troubleshooting Error Sector size of drive drive is too large Sophos Anti Virus currently only scans disk sectors of 2 KB or less in size It is highly unlikely that your computer will ever contain sectors larger than this Error Could not open report file filename folder The filename and folder of the report file are specified on the Report tabbed page of the Immediate Scanning Configuration or Scheduled Job Configuration dialog box see Configuring reports Sophos Anti Virus cannot open the report file if its filename is invalid or it doesn t have sufficient access rights to the folder On Windows NT note that the report file is written as the current user for immediate scans and as the Sophos Anti Virus service user for scheduled scans Error Log file filename could not be opened Log data will not be saved The location of the log file is specified in the Log Folder dialog box see Setting the log folder Sophos Anti Virus cannot open the log file if it does
24. etting the log folder By default Sophos Anti Virus maintains a log file of all its activity in the Sophos Anti Virus folder If you are logged on with Administrator rights you can change the location of the log file 1 On the File menu click Set Log Folder 2 In the Log Folder dialog box specify a folder and click OK Log Folder Enter folder for log file Sophos S ophos Anti Veus Clearing the on screen log The on screen log is displayed at the bottom of the Sophos Anti Virus window It contains all messages logged since the window was opened On Windows NT if an Administrator user opens the Sophos Anti Virus window it also displays the scheduled and on access messages logged since the service was started To clear the on screen log on the Options menu click Clear log 45 Sophos Anti Virus for Windows NT 95 98 Me Logging This does not affect the Sophos Anti Virus log HM file 46 Administration options In Sophos Anti Virus you can e restore default settings e purge the checksums for files already found to be virus free e lock the settings for immediate scans Restoring defaults You can return all settings to their defaults The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help In the Sophos Anti Virus window on the Options menu select Restore Defaults If you are not logged on with Adminis
25. executables are scanned unless you click All See Changing types of executable for scanning to find out how to change the file types defined as executables Subfolders If you select this option subfolders are scanned Removing an item for immediate scanning In the Immediate tabbed page select the name of the item you want to remove and click Remove Editing an item for immediate scanning In the Immediate tabbed page select the name of the item you want to edit and click Edit to display the Enter item details dialog box described above Changing items scanned by a scheduled job 1 In the Sophos Anti Virus window click the Scheduled tab 2 In the job list select the scheduled job Click the button shown below 3 Click the File List tab 10 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Scheduled Job Configuration Main File List Time Scanning Disinfection Report Path File types Subfolders GR eee Executables Yes er ich Executables Yes A check box to the left of an item indicates whether it is activated and will be scanned Click the check box to activate or deactivate items The default file list is the same as that for immediate scanning except that local floppy disk drives are not listed If Sophos Anti Virus is running on Windows NT the items available for scanning here might not be the same as those available for immediate Q scanning This is because the sched
26. ges Viuses Viuses and gsrors O All Messages Recpient computer of user names Then set the options as described below 41 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts Job specification By default alerts are sent for all scanning jobs To specify settings separately for each job select Specify jobs Notification level If you want to change this ensure that you deselect Use default settings for this job Then set the types of event for which you want to receive alerts SMTP email alerts You can configure Sophos to send email alerts Mail is sent after each event encountered by on access scanning or at the end of an immediate or scheduled scan The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help 1 In the Sophos Anti Virus window click the button shown below 2 Click the SMTP email tab 3 Deselect Disable SMTP email 42 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts Notification configuration Desktop Messagng Event Logging Network Messaging SMTP Emal Cl Disable SMTP email Aljobs Configure SMTP Specify jobs Nokficahon level ER nd ON e or the Inter lt server a D i a client mad vall be sent for every 2 Yiuses applicable evert Viruses and errors For al other jobs mail wil only be O All Messages sent on job completion Recipent emal addres
27. hat can be included in scans A check box to the left of an item indicates whether it is activated and will be scanned Click the check box to activate or deactivate items Starting an immediate scan To scan all the selected items click the button shown below gt Alternatively on the File menu click Go To scan any individual item in the file list double click its icon The check box to the left of the item doesn t have to be selected Stopping an immediate scan To stop scanning click the button shown below Alternatively on the File menu click Stop Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning To add remove or edit items for immediate scanning see Changing items for immediate scanning Scheduling a scan A scheduled scan is a scan of the computer or parts of the computer that takes place at a pre specified time You schedule a scan from the Scheduled tabbed page of the Sophos Anti Virus window Sophos Anti Virus EEK Fie Options View Help E BR A P sophos anti virus Immediate Scheduled e On access Job Name Days Times Ciu Coen dar 21 00 L e L_Bemove Edit Current job Next job Dap 27 00 Today Items scanned Viruses detected Ir o Imeneckate job aborted at 14 18 on 13 January 2004 0 tems scanned 0 viruses detected 0 errors The job list shows the available scheduled scanning jobs A check box to the left of a job indicates whether it is act
28. his file is deleted and recreated for each immediate or scheduled scan Changing types of executable for scanning To change the types of file that are scanned if Sophos Anti Virus is set to scan only executables on the Options menu click Executables 18 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Executable File Extensions x Current fist of executable extensions ADD BAT Defauk v Fies with no extension F To specify whether Sophos Anti Virus scans all file types or only Q executables see Changing items for immediate scanning or Changing items scanned by a scheduled job Adding an executable type To add an executable type to the list click Add In the New Executable Extension dialog box type the filename extension of the executable type Removing an executable type To remove an executable type from the list select the filename extension of the executable type you want to remove and click Remove Selecting executables with no filename extension To select executables whose filename has no extension click Files with no extension Using the default list of executable types Unless you edit the list as explained above it is automatically updated with filename extensions associated with new viruses whenever you update Sophos Anti Virus If you want to discard your edits and revert to the default list recommended click Default On Windows NT this dialog box is on
29. in with local Administrator rights On Windows 95 98 Me computers to change the settings for on access scanning edit the Interchk cfg file in the installation folder by default C Program Files Sophos Sophos Anti Virus using a text editor Details of what you enter are given in the InterCheck for Windows 95 98 Me advanced user guide available on the Sophos website With Sophos Anti Virus you can e check on access scanning is active e change scanning options e set up automatic disinfection e select what is scanned e exclude items from scanning e start and stop scanning Windows NT Checking on access scanning is active When on access scanning is active a blue shield is displayed in the system tray When on access scanning is inactive the shield is grey Q Alternatively on Windows NT in the Sophos Anti Virus window click the On access tab The status is displayed here Changing scanning options The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help On Windows 95 98 Me computers see On access scanning 24 Sophos Anti Virus for Windows NT 95 98 Me On access scanning On Windows NT computers do as follows 1 In the Sophos Anti Virus window click the On access tab 2 Click the button shown below 3 Click the Scanning tab On access Scanning Configuration Scanning Disinfection Check Exclusions
30. its s IT Automatically initiate dial up connection Logging updates You can configure Sophos Anti Virus to record updating activity in a log file 1 Locate the Sophos Anti Virus icon in your system tray Right click and select Configure 2 Click the Logging tab Ensure that Log Sophos AutoUpdate activity is selected Then set other options as described below When you want to open the log click View Log File Properties for Sophos AutoUpdate Primary server Secondary server Logging Schedule Lei Log Sophos AutoUpdate activity Maximum log size 1 gt MB Log level Log file logs alc log Size 1 0 K8 Created 06 01 2004 14 22 52 Modified 15 01 2004 12 47 04 View Log Fie Cor Jes Jar Je 57 Sophos Anti Virus for Windows NT 95 98 Me Updating Maximum log size Specify a maximum size for the log in MB Log level You can select Normal or Verbose logging Verbose logging provides information on many more activities than usual so the log will grow faster Use this setting only when problems occur 58 Troubleshooting This section provides answers to some common problems that you may encounter when using Sophos Anti Virus e Updating fails e Scanning runs slowly e Scheduled scans do not run 95 98 Me e Virus not disinfected e Virus fragment reported e Sophos Anti Virus reports errors If your problem is not described here refer to the Sophos website www sophos com which includes a knowledgeba
31. ivated An activated job will run as long as the computer is switched on at the time and if Sophos Anti Virus is running on Windows 95 98 Me the Sophos Anti Virus window is open for the duration of the scan Select the check box to activate or deactivate jobs On Windows NT a default job called Daily scans the computer at 21 00 every day as long as it is switched on at the time On Windows 95 98 Me a default job called Default scans the computer at 13 00 every day as long as it is switched on at the time and the Sophos Anti Virus window is open for the duration of the scan Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Adding a scheduled job In the Scheduled tabbed page click Add You are prompted to enter a job name Type a name and click OK to display the Scheduled Job Configuration dialog box Scheduled Job Configuration Main File List Time Scanning Disinfection Report Path File types Subtolders GAR eee Executables Yes er in Executables Yes Use the File List and Time tabbed pages to specify what is scanned and when For more information about configuring the job see Changing scanning options for immediate and scheduled scanning Setting up disinfection for immediate and scheduled scanning and Configuring reports Removing a scheduled job In the Scheduled tabbed page select the name of the job you want to remove and click Remove Editing a scheduled job In the Scheduled
32. k wildcard character does not work in this dialog box Removing a file To remove a file or filename extension from the list select the file or filename extension you want to remove and click Remove Starting and stopping scanning Windows NT On Windows NT computers you start or stop on access scanning from the On access tabbed page of the Sophos Anti Virus window 33 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Sophos Anti Virus Fie Options View Help gt HEA SP sophos anti virus Immediste Scheduled On access INTERCHECK TECHNOLOGY Stabus Active Last Hiere C WINDOWS system32 ipcss dil Items Hiere 94 Last scanned CC AWINDOWS system32 ipcss dil At 16 55 on 14 January 2004 Items scanned 52 Viruses detected 0 Enos 0 into Un access scanner started at 16 26 on 14 January 2004 On access scanning is active by default Starting on access scanning To start on access scanning click the button shown below gt Alternatively on the File menu click Go The shield that is displayed in the system tray turns blue Stopping on access scanning To stop on access scanning click the button shown below Alternatively on the File menu click Stop The shield that is displayed in the system tray turns grey 34 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Sophos Anti Virus retains the setting you make here even after you reboot the computer This me
33. lect Exclude checking of remote files Volume exclusions Any drive s you select here are excluded from checking by Sophos Anti Virus The Exclude list shows all possible drive mappings whether or not the mapping is valid for a particular user Drives that are unmapped for the current user are marked If you want to prevent Sophos Anti Virus from checking all local fixed disks whether or not they are specified in the Exclude list select Exclude local fixed disks If you want to prevent Sophos Anti Virus from checking all CD ROM drives whether or not they are specified in the Exclude list select Exclude CDROM drives 32 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Editing the list of files to be excluded On the Options menu click Exclusion List File Exclusion List All files listed are excluded from immediate and scheduled scanning By default they are also excluded from on access scanning On Windows NT this dialog box is only available if you are logged on with Administrator rights Adding a file To add a file or filename extension to the list click Add In the Exclude File dialog box enter the path of the file or the filename extension To enter a filename extension type eight question marks followed by the extension For example filename is longer than eight characters For filenames longer than eight characters you must use the required number of question marks Q Using the asteris
34. ly available if you are logged on with Administrator rights 19 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Excluding files from scanning On the Options menu click Exclusion List File Exclusion List All files listed are excluded from immediate and scheduled scanning By default they are also excluded from on access scanning on Windows NT On Windows NT this dialog box is only available if you are logged on with Administrator rights Adding a file To add a file or filename extension to the list click Add In the Exclude File dialog box enter the path of the file or the filename extension To enter a filename extension type eight question marks followed by the extension For example filename is longer than eight characters For filenames longer than eight characters you must use the required number of question marks Q Using the asterisk wildcard character does not work in this dialog box Removing a file To remove a file or filename extension from the list select the file or filename extension you want to remove and click Remove See also the section about excluding items from on access scanning 20 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Scanning memory 95 98 Me To perform an immediate scan of memory on the File menu click Scan memory This enables Sophos Anti Virus to locate memory resident viruses Q Sophos Anti Virus scans memory
35. og box select Access the server via a proxy Then enter the proxy server Address and Port number Enter a User name and Password that give access to the proxy server If the user name needs to be qualified to indicate the domain use the form domainlusername 55 Sophos Anti Virus for Windows NT 95 98 Me Updating Proxy details v Access the server via proxy Address wie proxy COM User name Fred Password PITT Confirm password eeee Cx Cee Limiting the bandwidth used You can limit the bandwidth used for updating This prevents Sophos Anti Virus from using all your bandwidth when you need it for other purposes e g downloading your email 1 Locate the Sophos Anti Virus icon in the system tray Right click it and select Configure 2 Click the Primary server tab or the Secondary server tab as required Then click Advanced Properties for Sophos AutoUpdate Primary server Secondary server Logging Schedule Primary server details Address servernamelantivirus windowsxp User name fred Password cece Confirm password sees 3 In the Advanced settings dialog box select Limit amount of bandwidth used and use the slider control to specify the bandwidth in Kbits second If 56 Sophos Anti Virus for Windows NT 95 98 Me Updating you specify more bandwidth than the computer has available Sophos Anti Virus uses all that is available Advanced settings V Limit amount of bandwidth used 16 Kb
36. on This enables Sophos Anti Virus to scan executable Mac files irrespective of their file extension Setting up automatic disinfection The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help On Windows 95 98 Me computers do as follows 1 Edit the Interchk cfg file in the installation folder by default C Program Files Sophos Sophos Anti Virus using a text editor 2 Type SweepVxDWorkStation DisinfectDisks YES DisinfectDocuments YES 3 Save and close the file For more information see the InterCheck for Windows 95 98 Me advanced user guide available on the Sophos website On Windows NT computers do as follows 1 In the Sophos Anti Virus window click the On access tab 2 Click the button shown below 3 Click the Disinfection tab 26 Sophos Anti Virus for Windows NT 95 98 Me On access scanning On access Scanning Configuration Scanning Disinfection Check Exclusions Cl Disintect boot sectors C Disintect documents C Disinfect programs C Infected files Disinfect boot sectors Sophos Anti Virus can disinfect most boot sector viruses on floppy disks It does not automatically disinfect hard disk boot sectors To deal with a virus in a hard disk boot sector click the virus name in the on screen log to view the virus analysis section of the Sophos website Disinfect documents Sophos Anti Virus can di
37. on level No messages Viruses Viuses and grors All Messages Then set the options as described below Job specification By default alerts are sent for all scanning jobs To specify settings separately for each job select Specify jobs Notification level If you want to change this ensure that you deselect Use default settings for this job Then set the types of event for which you want to receive alerts 40 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts Network messaging Windows NT You can configure Sophos Anti Virus to send network messages to named computers or users Q Q The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help Due to limitations in the LAN Manager messaging system only one message is delivered per name Even if a username is logged onto several computers only the first computer receives the message Sophos therefore recommends that you enter computer names Windows 95 98 Me computers can receive messages if they are running the WinPopup application 1 In the Sophos Anti Virus window click the button shown below 2 Click the Network Messaging tab 3 Deselect Disable Network Messaging Notification configuration Desktop Messagng Event Logging Network Messaging SMTP Email CO Disable Network Messagng Alljobs Specity jobs Nobilication level No messa
38. ophos Anti Virus to scan executable Mac files irrespective of their file extension Scan mailboxes If you want Sophos Anti Virus to scan emails and attachments in Outlook Express mailboxes select this option Setting up automatic disinfection 1 For immediate scanning click the Immediate tab in the Sophos Anti Virus window For scheduled scanning click the Scheduled tab and select the scheduled job for which you want to set up automatic disinfection 2 Click the button shown below 3 Click the Disinfection tab 15 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning immediate Scanning Configuration Scanning Disinfection Report F Disintect boot sectoed V Request confirmation C Disintect documents C Disinfect programs C Disinfect malboxes _ Infected files J _comt_ em _ Disinfect boot sectors Sophos Anti Virus can disinfect most boot sector viruses on floppy disks It does not automatically disinfect hard disk boot sectors To deal with a virus in a hard disk boot sector click the virus name in the on screen log to view the virus analysis section of the Sophos website Disinfect documents Sophos Anti Virus can disinfect documents infected with most types of document virus This removes the virus but does not repair any changes the virus has made in the document see the virus analysis section of the Sophos website for details of the virus s side effects If disinfe
39. os Anti Virus for you Sophos Anti Virus has usually been set to update itself automatically If automatic updating has not been set up follow the steps below For full information on the options at each step see the section describing that configuration page 1 Locate the Sophos Anti Virus icon in your system tray Right click it and select Configure 2 Click the Primary server tab and set the source for updates Your administrator gives you the details you need to enter Properties for Sophos AutoUpdate Primary server Secondary server Logging Schedule Primary server details Address servernameantivirus windowsxp User name fred Password cece Confirm password eeee Ladranced _ Ces 3 Click the Schedule tab and schedule updates 50 Sophos Anti Virus for Windows NT 95 98 Me Updating Properties for Sophos AutoUpdate Primary server Secondary server Logging Schedule Check for updates every 60 gt minutes C Check for updates on dial up Restore Defauks Ce Setting a source for updates If you want Sophos Anti Virus to update itself automatically you must specify where it fetches updates from 1 Locate the Sophos Anti Virus icon in your system tray Right click and select Configure 2 Click the Primary server tab and enter the details needed as described below 51 Sophos Anti Virus for Windows NT 95 98 Me Updating Properties for Sophos AutoUpdate Primary ser
40. otification configuration Network Messaging SMTP Emal Desktop Messaging Event Logging C Disable Desktop Messaging Alljobs Specily jobs Nobhcation leve No messages O Viuses Veuses and errors All Messages User dehned message Please refer to the on ne virus ibrary or the user manual for further details Then set the options as described below Job specification By default alerts are sent for all scanning jobs To specify settings separately for each job select Specify jobs Notification level If you want to change this ensure that you deselect Use default settings for this job Then set the types of event for which you want to receive alerts User defined message Type a message that will be added to the end of the standard virus detected message Event logging Windows NT The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the 39 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts console help To specify the types of alert added to the Windows NT event log do as follows You must be an Administrator 1 In the Sophos Anti Virus window click the button shown below 2 Click the Event Logging tab 3 Deselect Disable Event Logging Notification configuration Network Messaging SMTP Emal Desktop Messaging Event Logging CO Disable E vent Loggng Alljobs O Specily jobs Notificati
41. possible 60 Sophos Anti Virus for Windows NT 95 98 Me Troubleshooting Progress bar displayed If the progress bar is displayed Sophos Anti Virus must count all items it will scan This can take several minutes on large network drives To enable or disable the progress bar click Progress bar on the View menu Archive scanning enabled By default Sophos Anti Virus does not scan inside archives If you select Scan inside archive files scanning may take longer See Changing scanning options Scheduled scans do not run 95 98 Me In Sophos Anti Virus for Windows 95 98 Me scheduled scans only run if the computer is switched on and the Sophos Anti Virus window is open You can configure Sophos Anti Virus to run scheduled scans when the Sophos Anti Virus window is not open using AT INI This is described in the appendix of the Sophos Anti Virus DOS Windows 3 1x user manual available on the Sophos website Virus not disinfected If Sophos Anti Virus has not attempted to disinfect a virus No action taken check that automatic disinfection has been enabled If Sophos Anti Virus could not disinfect the virus Disinfection failed it may be that it cannot disinfect that type of virus You should also check the following e f dealing with a disk or removeable media make sure that it is not write protected e If dealing with files on an NTFS volume Windows NT make sure that it is not write protected Sophos Anti Virus
42. se virus analyses and technical articles If your problem is not described on the website contact Sophos technical support Updating fails If updating fails a white cross is Superimposed on the Sophos Anti Virus icon in the system tray To find out more about an update failure look at the update log Right click on the Sophos Anti Virus icon and select Configure Then open the Logging tabbed page and click View Log File The sections below explain why updating may fail and how you can change the settings to correct the problem You need Administrator rights to change the updating settings Sophos Anti Virus contacts the wrong source for updates 1 Right click on the Sophos Anti Virus icon and select Configure 2 Click the Primary server tab Check that the address and account details are those supplied by your administrator Sophos Anti Virus cannot use your proxy server If your copy of Sophos Anti Virus updates itself via the internet you must ensure that it can use your proxy server if there is one 1 Right click on the Sophos Anti Virus icon and select Configure 2 Click the Primary server tab Then click Proxy 59 Sophos Anti Virus for Windows NT 95 98 Me Troubleshooting 3 In the Proxy details dialog box enter the proxy server address and port number and the account details Automatic updating is not correctly scheduled 1 Right click on the Sophos Anti Virus icon and select Configure 2 Click the S
43. server Secondary server Logging Schedule Z Enable automatic updates Check for updates every 60 minutes C Check for updates on dial up Restore Defaults Caer If you update from the network or via a broadband connection to the internet select Enable automatic updates Then enter the frequency in minutes with which Sophos Anti Virus will check for updated software The default is 60 minutes Q If the updates are downloaded directly from Sophos you cannot update more frequently than every 60 minutes If you update via a dial up connection to the internet select Check for updates on dial up Sophos Anti Virus will attempt to update whenever you connect to the internet 54 Sophos Anti Virus for Windows NT 95 98 Me Updating Updating via a proxy If Sophos Anti Virus fetches updates via the internet you must enter details of any proxy server that you use to connect to the internet 1 Locate the Sophos Anti Virus icon in your system tray Right click it and select Configure 2 Click the Primary server tab or the Secondary server tab as required Ensure that all the details have been correctly entered Then click Proxy details Properties for Sophos AutoUpdate Primary server Secondary server Logging Schedule Secondary server details Address http www mycompany comf User name fred Password ege Confirm password esee Advanced Restore Defaults Help 3 In the Proxy details dial
44. ses Then set the options as described below Configure SMTP Click this to enter details of the SMTP server In the Set up SMTP dialog box enter the host name or IP address of the SMTP server In the same dialog box in the SMTP sender address text box enter an email address that bounces and non delivery reports can be sent to Job specification By default alerts are sent for all scanning jobs To specify settings separately for each job select Specify jobs Notification level If you want to change this ensure that you deselect Use default settings for this job Then set the types of event for which you want to receive alerts 43 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts Recipient email addresses Use the Add and Remove buttons to add or remove addresses for recipients of email alerts 44 Logging Sophos Anti Virus logs its activity in two places The log file is a continuous log file aimed at the administrator On Windows NT it is written as the Sophos Anti Virus service user and not as the current user The on screen log is displayed at the bottom of the Sophos Anti Virus window It contains all messages logged since the window was opened On Windows NT if an Administrator user opens the Sophos Anti Virus window it also displays the scheduled and on access messages logged since the service was started You can e change the location of the log file e clear the on screen log S
45. shown below 12 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning 3 Click the Time tab Scheduled Job Configuration Main FileList Time Scanning Disinfection Report 7 Sun Z Mon C Run job on service startup V Tue Times v Wed 12 00 21 00 Sms MI En 7 Sat Select the day s on which the job should run Then specify the time s as follows Add To add a time set the time and click Add Remove To remove a time select it and click Remove Run job on service startup Windows NT only If you want this scheduled job to run whenever the Sophos Anti Virus service is started select this option The scheduled job then takes place whenever the computer is booted and whenever Sophos Anti Virus is updated Changing scanning options 1 For immediate scanning click the Immediate tab in the Sophos Anti Virus window 13 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning For scheduled scanning click the Scheduled tab and select the scheduled job for which you want to change scanning options 2 Click the button shown below 3 Click the Scanning tab immediate Scanning Configuration Scanning Disinfection Report Scanning level Normal Recommended Extersive Priceity Normal C Scan inside archive fies J Include Macintosh vinuses C Sean mailboxes Scanning level Normal scanning is sufficient for norm
46. sinfect documents infected with most types of document virus This removes the virus but does not repair any changes the virus has made in the document in the on screen log click the virus name to view details on the Sophos website of the virus s side effects If disinfection fails the infected file is dealt with in the same way as other infected files see Infected files below Disinfect programs Sophos Anti Virus can disinfect programs Sophos recommends that you use this option only as a temporary measure You should subsequently replace disinfected programs from the original disks or a clean backup 27 Sophos Anti Virus for Windows NT 95 98 Me On access scanning Infected files Sophos Anti Virus can make an infected file safe in several ways other than disinfection Renaming or moving an executable file reduces the likelihood of it being run Deleting or shredding the file disposes of it Shredding is a more secure type of deletion that overwrites the contents of the file If you choose to move or copy files you can select a folder for infected files from the browser The Infected files option does not apply to infected mailboxes Selecting what is scanned You can select what is scanned by Sophos Anti Virus and specify precisely when it is checked The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help On Windows 95 98
47. t to remove and click Remove Selecting executables with no filename extension To select executables whose filename has no extension click Files with no extension Using the default list of executable types Unless you edit the list as explained above it is automatically updated with filename extensions associated with new viruses whenever you update Sophos Anti Virus If you want to discard your edits and revert to the default list recommended click Default Excluding items from scanning The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help On Windows 95 98 Me computers see On access scanning On Windows NT computers do as follows 1 In the Sophos Anti Virus window click the On access tab 2 Click the button shown below 3 Click the Exclusions tab 31 Sophos Anti Virus for Windows NT 95 98 Me On access scanning On access Scanning Configuration Scanning Disinfection Check Exclusions Files exclusions C Exclude checking of remote fies Volume exclusions C Exchade local fred disks C Exchude CDROM chives File exclusions If you want to prevent Sophos Anti Virus from checking the file types specified in the exclusion list select Apply file exclusions To change this list see Editing the list of files to be excluded If you want to prevent Sophos Anti Virus from checking files on network drives se
48. trator rights you can only restore defaults for immediate scanning Restoring defaults deletes all scheduled Q jobs Purging checksums for virus free files Sophos Anti Virus stores checksums for files that on access scanning has already found to be free of viruses You can clear the checksums The on access scanner will then have to scan the files again the next time they are accessed In the Sophos Anti Virus window on the Options menu click Purge Checksums Q This option is only available if you are logged on with Administrator rights Locking settings for immediate scans Administrators can configure an immediate scanning job that is then used by all non Administrators 1 In the Sophos Anti Virus window on the Options menu click Security 2 In the Security settings dialog box configure the settings as described below 47 Sophos Anti Virus for Windows NT 95 98 Me Administration options Security Settings C Enforce immediate configuration This option peevents nor administrators altenng their immediate job contiguration options Configure When you click Configure the Admin Defined User Mode Configuration dialog box is displayed Select the configuration options for users installations Defaults This returns the options to their default settings Enforce immediate configuration Select this if you want to prevent non Administrator users from changing their immediate scanning configuration
49. uled scan runs with the Sophos Anti Virus service s user rights which may differ from those of the current user You can change the items in the file list as described below Adding an item for scheduled scanning In the File List tabbed page click Add to display the Enter item details dialog box 11 Sophos Anti Virus for Windows NT 95 98 Me Immediate and scheduled scanning Enter item details Alea File types e Executables O l V Subfolders Area Specify the drive folder or file to be scanned You can enter either mapped network drives or UNC path names Alternatively click Browse to select from available items or use the drop down list to select all Local hard drives File types Only files defined as executables are scanned unless you click All See Changing types of executable for scanning to find out how to change the file types defined as executables Subfolders If you select this option subfolders are scanned Removing an item for scheduled scanning In the File List tabbed page select the name of the item you want to remove and click Remove Editing an item for scheduled scanning In the File List tabbed page select the name of the item you want to edit and click Edit to display the Enter item details dialog box described above Setting times of a scheduled job 1 In the Sophos Anti Virus window click the Scheduled tab 2 In the job list select the scheduled job Click the button
50. ver Secondary server Logging Schedule Primary server details Address iservername antivirus windowsxp User name fred Pi assword TTT Confirm password eeee Advanced eh Address Enter the address UNC path or web address from which Sophos Anti Virus will usually fetch updates If you select Sophos Sophos Anti Virus will download updates directly from Sophos via the internet Q Your administrator supplies you with the address and account details you need User name If necessary enter the User name for the account that will be used to access the server and then enter and confirm the Password Q If the User name needs to be qualified to indicate the domain use the form domain username If you want to limit the bandwidth used click Advanced If you access the internet via a proxy server click Apply and then Proxy Details Note that some internet service providers require web requests to be sent to a proxy server Setting an alternative source for updates You can set an alternative source for updates If Sophos Anti Virus cannot contact its usual source it will attempt to update from this alternative source 52 Sophos Anti Virus for Windows NT 95 98 Me Updating 1 Locate the Sophos Anti Virus icon in your system tray Right click on it and select Configure 2 Click the Secondary server tab Then enter the details as described below Properties for Sophos AutoUpdate Primary server Secondar
51. xtreme side effects that you have to restore a hard disk in order to recover Some viruses gradually make minor changes to data This type of corruption can be hard to detect It is therefore very important that you read the virus analysis on the Sophos website and check documents carefully after disinfection Sound backups are crucial You should keep original executables on write protected disks so that infected programs can easily be replaced If you did not have them before you were infected create or obtain them in case of future infections Sometimes you can recover data from disks damaged by a virus Sophos can supply utilities for repairing the damage caused by some viruses Contact Sophos technical support for advice 37 Configuring alerts Sophos Anti Virus can send alerts about viruses errors and scanning activity You can set up e desktop messaging e event logging NT e network messaging NT e SMTP email alerts By default desktop messaging is enabled to send virus detected and error messages Desktop messaging The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help To set up desktop messaging 1 In the Sophos Anti Virus window click the button shown below 2 Click the Desktop Messaging tab 3 Deselect Disable Desktop Messaging 38 Sophos Anti Virus for Windows NT 95 98 Me Configuring alerts N
52. y server Logging Schedule Secondary server details Address http www mycompany comi User name fred Password CITT Confirm password eeee Advanced Restore Defaults Help Address Enter the Address UNC path or web address from which Sophos Anti Virus will fetch updates if it cannot contact the usual source If you select Sophos Sophos Anti Virus will download updates directly from Sophos via the internet Q Your administrator supplies you with the address and account details you need User name If necessary enter the User name for the account that will be used to access the server and then enter and confirm the Password Q If the User name needs to be qualified to indicate the domain use the form domain username If you want to limit the bandwidth used click Advanced If you access the address via a proxy server click Apply and then Proxy Details Note that some internet service providers require web requests to be sent to a proxy server 53 Sophos Anti Virus for Windows NT 95 98 Me Updating Scheduling updates You can specify when or how often Sophos Anti Virus updates itself The central console if any that administers Sophos Anti Virus on workstations may override changes made here To avoid this see the console help 1 Locate the Sophos Anti Virus icon in your system tray Right click on it and select Configure 2 Click the Schedule tab Properties for Sophos AutoUpdate Primary
Download Pdf Manuals
Related Search