Home

Sophos Anti-Virus OS/2 user manual

1. P sophos ant Sophos Anti Virus for OS 2 For networked and single computers Document date February 2007 Contents About this manual Using Sophos Anti Virus 1 Using Sophos Anti Virus via the GUI 2 Using Sophos Anti Virus via the CLI 3 Using InterCheck 4 Disinfection Configuration 5 Immediate and scheduled scanning options GUI 6 Global configuration options GUI 7 Configuration via the CLI 8 Configuring InterCheck Troubleshooting 9 Troubleshooting Glossary and index Glossary Index Technical support 13 16 19 28 39 44 67 74 78 80 82 Sophos Anti Virus OS 2 user manual About this manual This user manual explains how to use Sophos Anti Virus for OS 2 and how to configure E virus scanning E virus alerts E reporting E disinfection E logging The manual also provides help in resolving common problems For information on the installation initial setup updating or uninstallation of Sophos Anti Virus on an OS 2 network see the Sophos Anti Virus OS 2 computers on a network installation guide For information on the installation initial setup updating or uninstallation of Sophos Anti Virus on a single OS 2 computer see the Sophos Anti Virus OS 2 single user installation guide Sophos documentation is published on the Sophos Anti Virus Supplementary CD and at www sophos com support docs Using Sophos Anti Virus Using Sophos Anti Virus via the
2. can be used to specify that all subdirectories as well as the current directory should be searched For example if the entry Ct ABC is specified and the disk in drive C contains two subdirectories only the current directory will be searched for ABC files On the other hand if the entry Cee ABC is specified not only the current directory but also both subdirectories will be searched for ABC files Similarly if the entry C MYAREFA MYFILES gt ABC is specified the search will cover the subdirectory C MYAREA MYFILES and all its child directories Remember that the more files specified the longer it will take to check the system To check all executable files COM EXE OV SYS DLL DRV IFS etc specify C All executables Sweeping is about 30 faster than when each group is specified individually The drive specification C in above example is optional Excluding files from checking Certain files or directories can be excluded from checking by preceding the description with the lt exclusion operator For example C gt EXE lt C DONOT EXE will not be examined will recursively search all EXE files except DONOT EXE in the root directory of drive C If the name of a file without a drive or path is specified all files or directories with that name will be excluded Sophos Anti Virus OS 2 user manual For example SEOU EXE file FOO EXE will be excluded in whatever drive and
3. E SEE TT File list Time Notify timing _ Run batch file on every infected file Wi Run batch file on end of job Browse OK Cancel To send alerts Sophos Anti Virus runs a batch file after each infected item is found at the end of the job in which the viruses are found or both There are separate batch Tiles for the two forms of notification To create these file s open a text editor and create a batch file The following parameters can be used in the first batch file run after each infected item 1 machine name Yo job name P3 virus name SoA location The file NTFY CMD used by InterCheck to report viruses is suitable for use as the per item batch file 35 Sophos Anti Virus OS 2 user manual The following parameters can be used in the second batch file run at the end of the job 1 machine name Vo job name 3 items number of items scanned 4 viruses number of viruses found YD errors 6 report file Notify timing The notification message can be a summary report sent at the end of each job and or a message for every infected file found Use the browser to specify the batch file that will be run 36 Sophos Anti Virus OS 2 user manual 5 6 Report The Report tabbed page enables you to configure the contents of the report file for each immediate or scheduled job This file is generated in addition to the continuous log file ES Job Configuration a 5 Fil
4. OSWEEP ARCH NZIP directs Sophos Anti Virus to scan inside all archive types except Zip when it does a scan 63 Sophos Anti Virus OS 2 user manual OSWEEP NZIP ARCH directs Sophos Anti Virus to scan inside all archive types when it does a scan Archive type Filename extensions Qualifier to enable scanning Qualifier to disable scanning ARJ ARJ ARJ NARJ bzip2 BZ2 TBZ TBZ2 BZIP2 NBZIP2 Compress TAZ Z CMZ NCMZ gzip GZ TGZ GZIP NGZIP InstallShield Cabinet CAB ISCAB NISCAB ITSS compressed help CHM HXS ITSS NITSS LHA LHA LZH LHA NLHA Microsoft Cabinet CAB CAB NCAB Microsoft Compress 2 MSCMP NMSCMP RAR RAR NRAR RPM RPM NRPM Self extractors SFX NSFX tar TAR NTAR Unix archives UAR NUAR UUEncode UUE NUUE Zip Z P NZIP Sophos Anti Virus OS 2 user manual 7 12 Error codes returned by SWEEP Sophos Anti Virus returns error codes that can be tested by using the IF ERRORLEVEL command in batch files This enables automatic action to be taken if Sophos Anti Virus discovers an abnormal condition O If no errors are encountered and no viruses found 1 If the user interrupts the execution by pressing Esc 2 Ifa corrupt or password protected file is encountered or i
5. 4 Edit tems swept i viruses detected 0 Errors The path list shows the drives paths and files that can be scanned in an immediate scan An illuminated light to the left of an item indicates that it will be scanned Click this light to select or deselect items 1 2 1 Starting an immediate scan To scan all the selected drives click GO To scan an individual item in the area list whether the light beside it is illuminated or not double click that item Interrupting scanning To stop scanning at any time click STOP Sophos Anti Virus OS 2 user manual 10 1 2 2 Adding and editing items for immediate scanning To add new items for immediate scanning or edit existing items ensure the Immediate tabbed page is selected and click the Add or Edit button The Edit item details dialog box Is displayed ES Edit item details Mame Do File types Executables Browse OK all iW Subfolders Ena Path name Specifies the drive folder or filename to be scanned Both drive mapped and UNC path names can be entered Wildcards can also be included Click Browse to select from a list of available items Use the drop down menu to select Local hard drives rather than specific paths File types By default only files defined as executables are scanned unless you select All To find out how to change the list of files defined as executables see section 6 2 Subfolders Select this option to scan
6. directory it may appear lt C FOO AE FOO EXE will be excluded in the current directory of drive C lt J FOO EXE FOO EXE will be excluded if found in the J directory of the current drive lt J FOO EXE FOO EXE will be excluded if found in the J subdirectory of the current directory on the current drive Wildcard characters cannot be used with the exclusion operator Any exclusion descriptors which contain the symbol and do not specify a drive will have the drive specified in the AD command line qualifier inserted For example if SWEEPARE contains lt NU EXE and Sophos Anti Virus is started with the command line qualifier OSWEEP AD C the file which will be excluded will be C NU EXE This is equivalent to entering lt C NU EXE in the SWEEPARE file 7 5 Specifying disk sectors to be checked in SWEEPARE At a lower level than the file structure disks are organised into sectors The most important of these are the master boot sector and the partition boot sector as they contain executable program code which many viruses attack A floppy disk has only a partition boot sector sectors can be referred to in two different ways as logical sectors or as absolute sectors A logical sector number refers to the position of the sector 47 Sophos Anti Virus OS 2 user manual 48 within a particular drive or partition This is useful when referring to the partition boot sector which is
7. MIME Scan MIME files This qualifier enables Sophos Anti Virus to scan MIME files when it does a scan By default it is not enabled to scan MIME files MU Check multiple disks This command line qualifier enables the user to check a succession of disks in a drive without reloading SWEEPEXE every time For example to check multiple disks in drive A type OSWEEP MU A When prompted insert a disk in drive A and press any key to start checking it Once that disk has been checked insert another disk into drive A when prompted and press any key to start checking This will continue until Esc is pressed to interrupt the checking or one or more viruses are detected NAF Do not read file with areas to be checked By default Sophos Anti Virus will try to open the file SWEEPARE and read from it the names of any areas to be checked Use this qualifier if it is not necessary to check the areas defined in SWEEPARE NAS Do not check standard areas By default Sophos Anti Virus will check standard areas defined at compile time Use this qualifier to prevent these areas from being checked for example if the areas to be checked have been specified in SWEEPARE SWEEPARE must reside on the current drive and in the current subdirectory NB No bell When a virus is discovered Sophos Anti Virus sounds a bell This can be disabled using the NB qualifier NDI Do not disinfect infected items Cancels Dl NE Do not use the
8. Infected files Disinfect boot sectors sophos Anti Virus can disinfect boot sectors on floppy and hard disks automatically A hard disk cannot be disinfected if any Tiles on it are active If disinfection of a hard disk fails follow the instructions for disinfection in section 4 2 1 Disinfect documents and programs sophos Anti Virus can disinfect some programs and documents infected with most types of macro virus Check the contents of any disinfected documents carefully as the virus may have corrupted them Delete any disinfected programs and replace them from backups as the virus may have corrupted them Infected files If an infected file is found it can be deleted or shredded automatically Shredding is a secure type of file deletion that overwrites the file 33 Sophos Anti Virus OS 2 user manual lf you choose to delete or shred files Sophos Anti Virus does not attempt to disinfect them first even if you select disinfection as well However Sophos Anti Virus does not delete or shred infected mailboxes Request confirmation If this is selected Sophos Anti Virus will ask for confirmation before it does anything with infected items The request is made before each immediate scan This option is not available for scheduled scanning 34 Sophos Anti Virus OS 2 user manual 5 5 Notify The Notify tabbed page enables you to configure the alerts sent on discovery of a virus ES Job Configuration
9. SWEEP By default Sophos Anti Virus checks only those parts of each file likely to contain viruses A full scan examines the complete contents of each file and can be specified by using this qualifier Note that a full scan is much slower than a quick scan See also section 7 6 FM Specify message file sophos Anti Virus will output the contents of the file specified with this qualifier to the screen if it discovers one or more viruses This facility can be used to customise virus recovery procedures You must specify the full path to the file The default filename of the message file is SWEEP MSG For example OSWEEP FM C MY_MSG TXT specifies the file MY MSG TXT in the root directory of drive C FS File server Use the FS qualifier if checking a file server over a network This qualifier prevents checking of the boot sectors which most networks do not allow see also section 2 4 IDEDIR lt directory gt Use alternative directory for virus identity files This qualifier enables you to specify an alternative directory for IDEs For example OSWEEP IDEDIR C NIDE directs Sophos Anti Virus to read IDEs from the CAIDE directory instead of the default directory C SAV OS2SWEEP ENG If Sophos Anti Virus is reading the main virus data VDL DAT and IDEs from the same floppy disk drive the IDEs must be on the final virus data disk the disk containing VDL DOQ3 57 Sophos Anti Virus OS 2 user manual 58
10. Virus has detected a new virus which could become active Corrupted virus Many viruses contain bugs in their replication routines that cause them to infect target files incorrectly An inactive portion of the virus possibly a Substantial part may appear within the host file and this is detected by sophos Anti Virus A corrupted virus cannot spread Database containing a virus When running a full scan Sophos Anti Virus may report that there is a virus fragment in a database file dD Sophos Anti Virus OS 2 user manual 76 Glossary and index Sophos Anti Virus OS 2 user manual Glossary Boot sector virus Boot sector CMD Hexadecimal IDE InterCheck InterCheck Client LAN 8 A type of computer virus which subverts the initial stages of the boot process A boot sector virus attacks either the master boot sector or the DOS boot sector The part of the operating system which is first read into memory when a PC is switched on booted The program stored in the boot sector is then executed which loads the rest of the operating system from the system files on disk The extension given to command filenames in OS 2 A command file may be written in the OS 2 scripting language REXX or may simply contain a series of OS 2 commands STARTUPCMD is a special command file which is executed whenever OS 2 is Started and can be used to configure OS 2 to a user s requirements A system of counting
11. for example linkup C netscape program netscape exe 4 Sophos Anti Virus OS 2 user manual Do not choose the IBM Web Explorer browser because it cannot display the Sophos web pages properly Choose the language by clicking the drop down arrow on the Language for virus analyses box and selecting the appropriate language 6 7 Progress bar In order to display the progress bar Sophos Anti Virus has to count all the items to be scanned before starting the scan On large network drives this can take a significant length of time which can be saved by disabling this option This will not affect any Sophos Anti Virus jobs that are already running at the time the option is disabled Q This option is set separately for immediate mode and each scheduled job 6 8 Immediate and scheduled scan command line qualifiers You can use the command SWEEP to start the Sophos Anti Virus scan scheduler and to open the Sophos Anti Virus window When you use this command certain command line qualifiers can be used to configure scanning and reporting Either or can be used when entering a qualifier i e AUTO and AUTO are identical AUTO Starts scanning when the Sophos Anti Virus window is opened using the most recent configuration set at the Immediate tabbed page EXEJOB lt jobname gt starts the scheduled job named lt jobname gt when the Sophos Anti Virus window is opened instead of waiting until the scheduled time T
12. it starts a new log file the previous log is renamed with a BAK extension and previous BAK logs are deleted This may throw away valuable information about viruses found previously on this computer so this option enables InterCheck to keep the existing log and append information to it each time the scanner starts If this option is used the log file can grow slowly until it fills the user s disk unless the user prunes it from time to time For this reason the default is not to append but to start a new file each time the scanner starts CheckNetwork YES NO If set to YES default both files on file servers network drives or UNC paths and files on local drives will be scanned before access is allowed If set to NO only files on local drives will be scanned set to NO only if it can be assumed that files on file servers have already been scanned at the server Exclude lt path gt Excludes files from being scanned Access is always allowed immediately and there is no record of whether the file is infected This option is used to exempt critical files which are known to contain non infectable data or text and which are intensively used If this is not done some applications particularly legacy or poor quality ones may run extremely slowly or even hang The choice of files to be exempted is made by experiment if an application performs poorly several Exclude entries may be given one for each group of files to be excluded
13. logical sector O of the partition The absolute specification of a sector is in terms of the cylinder head and sector of its physical position on the specified device While more complex than a logical sector number it allows any sector on the disk to be specified This is important for checking the master boot sector which can be found at cylinder O head O sector 1 On hard disks this sector is not accessible using a logical sector number On floppy disks absolute sector 0 0 1 and logical sector O are the same physical sector Specifying logical sectors to be checked To specify a particular logical sector or set of sectors use the symbol the OS 2 pipe operator It is also possible to specify a byte or group of bytes to be checked in each sector for example if the sector contains variable information The format of the specification is drive ssector esector sbyte ebyte where E drive is the drive letter e g C optional E ssector is the first logical sector to be checked E esector is the last logical sector to be checked optional E sbyte is the first byte to be checked optional E ebyte is the last byte to be checked optional All values must be in decimal format For example Ce iy Specifies that the whole of logical sector O on drive C should be checked whereas C 0 10 Specifies that a check should be taken of logical sectors O to 10 inclusive and CSIO 10 Z71 275 specifies further that in eac
14. must be in hexadecimal format 49 Sophos Anti Virus OS 2 user manual For example FOU UU 1 specifies that sector 1 of cylinder O head O on the first fixed disk usually drive C should be checked whereas L OU 1 23 1B7 specifies that a check should be taken of bytes 23 hex to 1B7 hex inclusive on sector 1 of cylinder O head O on the second floppy disk drive usually drive B To check master boot sectors on drives 80 to 83 Hex specify C All master boot sectors If a particular drive is not present no error message is produced 7 6 Full and quick scanning Quick scanning checks only those parts of each file that are likely to contain viruses This is the default setting and is sufficient for normal operation Full scanning examines the complete contents of each file This level is more secure but is much slower than Quick Full scanning is needed in order to detect some viruses but should only be enabled on a case by case basis e g on advice from Sophos technical support A full scan can be selected with the command line qualifier F See section 7 11 3 7 7 Running Sophos Anti Virus at different priorities 50 When a scan is run it is scheduled by OS 2 to run with the same priority as any other OS 2 application such as a word processor Network servers run at a high priority in order to achieve rapid response Sophos Anti Virus should be run in high priority mode if a virus is suspected on your sys
15. sound backups To disinfect an infected program enter OSWEEP PROG EXE DI where PROG EXE is the program name scan the whole computer for remaining infections 23 Sophos Anti Virus OS 2 user manual 24 o If the program cannot be disinfected delete the program using OSWEEP PROG EXE REMOVEF and replace it from original installation disks a clean computer or sound backups The virus may have corrupted it REMOVEF affects infected files only and can be used on network drives from the workstation It does not require OS 2 to be shut down unless a file to be removed is locked e g an OS 2 system file In this case contact sophos technical support If the RS qualifier is specified as well infected files will be positively overwritten rather than simply deleted This makes them irrecoverable In either case you are asked to confirm that each file should be removed unless the NOC No confirmation before virus removal qualifier is used 4 2 4 Dealing with infected documents When dealing with infected documents it is not necessary to reboot from a clean system disk However it is important to ensure that the application that created the document is not open when disinfection is attempted To disinfect a document file use a command such as OSWEEP FILE DOC DI In some cases it is possible to manually edit the macros from the infected document using the relevant application However some macro viruses n
16. the root directory as well as all SYM files from the ASIMULATI directory downwards REMOVE Remove viruses on discovery This qualifier directs Sophos Anti Virus to delete infected files and disable infected boot sectors The RS command line qualifier can be used in conjunction with REMOVE to ensure that the file is positively overwritten rather than simply deleted Confirmation will be requested before any item is deleted or disabled unless the NOC qualifier is also used If you choose to delete or positively overwrite files Sophos Anti Virus does not attempt to disinfect them first even if you use a disinfection qualifier as well However Sophos Anti Virus does not delete or positively overwrite Infected mailboxes Disabling of boot sectors is done by substituting the first two bytes pointed to by the initial JMP instruction with a JMP to itself instruction Afterwards the virus fragment may still be there but the virus will be inactive For example OSWEEP REMOVE RS NOC See section 4 REMOVEF Remove infected files As REMOVE except that infected boot sectors are not disabled For example OSWEEP REMOVEF This is especially useful if it is inconvenient to boot OS 2 from floppy disk See section 4 Sophos Anti Virus OS 2 user manual RS Remove viruses by positively overwriting them Infected files will be positively overwritten instead of being deleted if this qualifier is used Disabling o
17. 10 It also lists all the Sophos Anti Virus command line qualifiers and error codes sections 7 11 and 7 12 Q For information on default settings see section 2 1 7 1 Specifying what Sophos Anti Virus will check Users can specify which items will be scanned using either EH the command line or EH an area file SWEEPARE The command line enables the user to specify drives directories files or drive sectors It can also include the command line qualifiers listed in this section The SWEEPARE file enables the user to specify what will be scanned in greater detail down to the level of a byte or group of bytes 7 2 Specifying items to be checked in the command line dd Items to be checked can be specified in the command line For example to check the file ISVIRUS BIN type OSWEEP ISVIRUS BIN or to check all executable files on drives D and E type OSWEEP D E Make sure that any symbols used do not conflict with the OS 2 meaning For example do not use the recursion symbol gt in the command line as it means redirection in OS 2 Q When the items to be checked are specified all default settings will be overridden unless the AS qualifier is added to the command line Sophos Anti Virus OS 2 user manual 7 3 Specifying items to be checked in SWEEPARE Items to be checked can be specified in an area file SWEEPARE This must reside in the current drive and subdirectory For example if the current drive and
18. A group is specified by use of wild cards and or in the filename in the normal OS 2 way The following forms of entry are accepted d Exclude all files on drive d a b c Exclude files matching a b c in any directory on any drive d a b c Exclude files a b c in any directory on drive d dirl dir2 a b c Exclude files a b c in directory dirl dir2 on any drive d dirl dir2 a b c Exclude files a b c in directory dirl dir2 on drive d A filename of is interpreted as any file 69 Sophos Anti Virus OS 2 user manual 70 A filename of means any file with a blank extension If a directory path is given it must be absolute begin with a If a directory is given a filename must be given as well It is not possible to specify a directory subtree in a single entry OS 2 has no way to do this InfectedCacheLifetime n The OS 2 InterCheck scanner remembers the names of infected files it has found so as not to produce duplicate reports OS 2 itself can make several attempts to access a single infected file This memory is erased after the number of seconds specified with this lifetime qualifier so that the user is reminded about the infected file when trying again to access it after a period of time This is particularly important in the case of removable disks which may be replaced in a drive inadvertently The default memory lifetime is 5 seconds The minimum lifetime is 1 secon
19. GUI Using Sophos Anti Virus via the CLI Using InterCheck Disinfection Sophos Anti Virus OS 2 user manual 1 Using Sophos Anti Virus via the GUI This section contains the following information about using Sophos Anti Virus for OS 2 via the GUI Overview of the Sophos Anti Virus window section 1 1 E Running an immediate scan section 1 2 Scheduling scans section 1 3 1 1 Overview of the Sophos Anti Virus window 1 1 1 Opening the Sophos Anti Virus window 1 On the desktop double click the Sophos Anti Virus for OS 2 icon oe Sophos Anti virus for 05 2 2 In the Sophos Anti Virus for OS 2 folder double click the Show Sophos Anti Virus window icon Sophos Anti Virus for 05 2 Icon View Folder Edit View Selected Help a H ta View READOSA THT View SWEEP Scanthis computer LOGfile with Sophos Anti Virus Sie ns aynliys Q To scan the computer immediately double click the Scan this computer with Sophos Anti Virus icon Sophos Anti Virus OS 2 user manual 1 1 2 Features of the Sophos Anti Virus window Sophos Anti Virus SWEEP mle al File Options View Help E Immediate Scheduled Tabs Fath Subfolders s 9 Local Hard Drives Executables Yes Fi le OB E Executables Yes li st e amp R Executables Yes Items swept viruses detected Errors F 0 ENE E 7 SD kee On screen e log ALALE 1211 items swept O viruses detected O errors encountered Info Job Immedi
20. If this procedure fails to disinfect a virus on your computer contact Sophos technical support 21 Sophos Anti Virus OS 2 user manual 22 Replacing the boot sector In most cases the boot sector can be overwritten with a clean one Check that the contents of the infected drive are visible e g with DIR If the contents of the hard disk are not visible contact Sophos technical Support for advice Some boot sector viruses require additional action for full recovery To overwrite the master boot sector ensure the last OS 2 Utility Disk is in the drive and enter FDISK NEWMBR or in the case of Warp Server for e business or Warp 4 Convenience Packages LVM NEWMBR To overwrite the OS 2 boot sector locate the OS 2 Utility disk containing the file SYSINSTX COM m For Warp 3 and Warp Server v4 this will be the third of the three Utility disks For Warp 4 Merlin Warp Server for e business and Warp 4 Convenience Packages this will be the first of the four Utility disks Insert this disk in drive A and enter a command such as OYOINSTX C 4 2 2 Dealing with boot sector viruses on floppy disk 3 Floppy disks with infected boot sectors can be either disinfected or reformatted Disinfection This procedure assumes that A is the floppy disk and E is the CD If OS 2 is already running shut it down Boot 05 2 from the OS 2 Utility disk set The disks should include a CD driver and the f
21. LVM utility to delete and reinstall the Boot Manager Detailed instructions are in IBM s 05 2 documentation If this procedure fails to disinfect Boot Manager contact Sophos technical support 4 3 Recovering from virus side effects How you recover from a virus infection depends on how the virus affected the infected computer Some viruses leave you with no side effects to deal with Others have such extreme side effects that you have to restore a hard disk or replace the BIOS in order to recover some viruses gradually make minor changes to data This type of corruption can be very hard to detect Read the virus analysis on the Sophos website www sophos com and check files carefully after disinfection sound backups are crucial If you did not have them before you were infected ensure you create or obtain them in case of future infections sometimes you can recover data from disks damaged by viruses Sophos can supply utilities for repairing the damage caused by some viruses Contact Sophos technical support for help 25 Sophos Anti Virus OS 2 user manual 26 Configuration Immediate and scheduled scanning options GUI Global configuration options GUI Configuration via the CLI Configuring InterCheck Sophos Anti Virus OS 2 user manual 5 Immediate and scheduled scanning options GUI 28 This section describes how to configure two modes of scanning EH Immediate scanning E Scheduled scanning for which y
22. a zip bomb is displayed Occasionally Sophos Anti Virus incorrectly identifies files that have complex and or multiple levels of archiving as zip bombs and stops scanning them To scan such files rescan them using the qualifier NSSA For example OSWEEP C TEMP PACKAGE ZIP NSSA directs Sophos Anti Virus to scan package zip even if it identifies it as a zip bomb Use this qualifier only if absolutely necessary If a genuine zip bomb is accessed with this qualifier Sophos Anti Virus continues to scan it Users of the Sophos Anti Virus for OS 2 GUI can make use of this feature by entering the NSSA qualifier as an advanced option on the Options menu click Advanced Options Sophos Anti Virus OS 2 user manual NTW No Temp Warning sophos Anti Virus performs a check to ensure the TEMP or TMP environment variable specifies a valid path to which it can write temporary files A warning is issued if this check fails The NTW qualifier disables the check NVOL Do not log the volume IDS of scanned disks If this qualifier is used Sophos Anti Virus does not log the volume IDS of disks that are scanned OE Scan Outlook Express mailboxes This qualifier enables Sophos Anti Virus to scan Outlook Express mailboxes and MIME files when it does a scan By default it is not enabled to scan Outlook Express mailboxes and MIME files P lt file device gt Print security report This command line qualifier directs S
23. are opened it does not scan them when they are closed In practice this means that files are scanned before they are read not when they are created InterCheck does not automatically disinfect infected items Because the standard releases of OS 2 are not high security products InterCheck does not give complete security against the activities of malicious users e g a knowledgeable user can disable InterCheck on their computer InterCheck is believed to be compatible with third party security products that use the OS 2 Installable Security Subsystem Where such a product is installed it is possible that it could be used to protect InterCheck against malicious users However Sophos does not endorse any such product It is not necessary to disable the opportunistic lock feature of IBM LAN server networking to enable InterCheck to work This is of particular Significance for computers running IBM Peer Server 3 1 Monitoring InterCheck To confirm that InterCheck is active in the InterCheck Monitor window check the Status field Intercheck Monitor Total 79 Status Active Lastitem E GSRBAGE PMGRABOO BMP By default InterCheck Monitor is launched on 05 2 at bootup If it is not running on the desktop in the Sophos Anti Virus for OS 2 folder double click InterCheck Monitor 17 Sophos Anti Virus OS 2 user manual InterCheck Monitor displays E the total number of items filtered i e checked against the l
24. ate has finished Button bar Starts a scan Ends a scan Ed Opens a dialog box in which you can configure Sophos Anti Virus ud Connects you to the Sophos virus analyses on the Sophos website Tabs There is a tabbed page for each type of scan Immediate for scanning on demand Scheduled for scanning automatically at set times You cannot control or configure InterCheck on access scanning via the Sophos Anti Virus window See section 8 for information about configuring InterCheck Sophos Anti Virus OS 2 user manual File list On the Immediate tabbed page the file list shows items that can be scanned An illuminated light to the left of an entry indicates that it will be included in an immediate scan Click this light to select or deselect items On the Scheduled tabbed page the file list is replaced with the scheduled job list This is the list of scheduled scans configured to take place on the computer On screen log The on screen log contains information about the current session along with all log messages since the window was opened Double clicking on a virus name here connects you to an analysis of the virus on the Sophos website Sophos Anti Virus OS 2 user manual 1 2 Running an immediate scan To run an immediate scan first ensure the Immediate tabbed page is selected ES immediate Subfolders a Executables TES Executables YES Executables Remove
25. attern bytes can be separated by spaces or tabs name can contain up to 15 characters and a pattern can be up to 24 bytes long If the line starts with a space or a tab the pattern will have the name Noname n where n is a number from O upwards For example SWEEPPAT may contain ABC Virus 26 83 88 de DE T9 0 23 HAL Virus ABCDEF0123456 89 comment SWEEP PAT must reside in the current drive and subdirectory For example if the current drive and directory is CAPROGS and drive A is being checked using the command OSWEEP A then SWEEPPAT must reside on the C drive in the directory C PROGS 51 Sophos Anti Virus OS 2 user manual Sophos Anti Virus looks for patterns only when it is run in full scanning mode quick is the default The F qualifier must be specified For example USMERE Co F 7 10 Virus disinfection and removal Common boot sector viruses can be removed from hard and floppy disks and macro viruses from documents by using Sophos Anti Virus s built in disinfection capability To do this run OSWEEP with the command line qualifier DI sophos Anti Virus can also be used to delete infected programs while the system is running This is done with the REMOVEF qualifier See also section 4 7 11 Sophos Anti Virus command line qualifiers 22 When you use the command OSWEEP certain command line qualifiers can be used to control and or automate the scanning process The qualifiers are descri
26. bed in the following subsections or can be listed using OSWEEP The command format is OSWEEP drive filel filen qual quan where E drive is the optional drive which will be checked A B C etc and denotes all local hard drives filel to filen are optional descriptors of files checked E qual to quan are optional command line qualifiers all beginning with either a hyphen or a slash The order of the items after OSWEEP is unimportant except for the qualifiers for archive types see section 7 11 4 For example OSWEEP A scans the floppy disk in drive A while OSWEEP P ALL LOG NS scans all local hard disks listing each file in the file ALL LOG Sophos Anti Virus OS 2 user manual 7 11 1 file Command line qualifiers from an external file Q Sophos Anti Virus can obtain its command line qualifiers from an external text file For example OSWEEP SWEEP CM E when the file SWEEPCM contains NS NK Ce D P SWEEP LOG is equivalent to OSWEEP NS NK C D P SWEEP LOG E Command files can contain any number of items per line up to the maximum number of characters permitted per line 7 11 2 Command files compared with ARE files Both ARE files and command files can contain the symbols lt exclusion gt subdirectory recursion and logical sector specification ARE files contain exactly one item per line command files can contain any
27. d and the maximum is 2147483647 seconds effectively disabling the reminder LogFile lt path gt Specifies the drive directory and name of the log file The defaults for the drive and directory are those where the InterCheck programs are installed The default for the filename is INTERCHK LOG LogLevel 0 5 Controls the amount of information written to the log file nothing except startup messages fatal errors virus alerts O l 2 3 nonfatal errors 4 warnings default 5 information messages the maximum amount of information will be logged Each level also logs the information in all the levels above it ScanMode FULL QUICK Controls the scanning level used to scan for viruses Full scans the complete contents of each file Quick scans only those parts of each file that are most likely to contain viruses The default is quick Sophos Anti Virus OS 2 user manual StartUpReport NONE NORMAL VERBOSE Controls the amount of configuration information logged when the InterCheck scanner starts Default is VERBOSE NONE No information logged NORMAL Program banner and version version of main virus data number of viruses recognised VERBOSE The above plus the virus engine version plus a list of all virus identity files IDEs loaded WorkThreads n This sets the number of file access operations that can be processed simultaneously by the OS 2 InterCheck scanner The default is 10 which Should not normal
28. directory is CAPROGS SWEEPARE must reside on the C drive in the directory C PROGS Q When the items to be scanned are specified all default settings will be overridden unless the AS qualifier is added to the command line The SWEEPARE file can be edited as required The syntax for describing areas to be checked is given in the following sections For example SWEEPARE may contain D4 Die PAR D gt OVL tol uU U I which will check the boot sector on drive D all EXE and OVL files on drive D and physical sector 1 on the second hard disk Q The symbol is the OS 2 pipe operator and is not the same as 1 one or letter Drives can also be specified in the command line For example to check drives A and D while Sophos Anti Virus is on drive C type OSWEEP A D Note that a default drive can precede any areas defined in the SWEEPARE file which do not already specify a drive For example if SWEEPARE contains x De TO and the user issues the command see AD command line qualifier for a full explanation OSWEEP AD A then SWEEP will check Ass Deo 45 Sophos Anti Virus OS 2 user manual 7 4 Specifying files to be checked in SWEEPARE 46 Particular file types and areas can be specified in SWEEPARE using the normal OS 2 descriptions For example C ABC makes Sophos Anti Virus examine all files with extension ABC in the root directory of drive C The recursion operator gt
29. e latest IDEs product downloads and technical articles If your problem is not described on the website contact Sophos technical Support 9 1 Sophos Anti Virus runs slowly 74 Full scan By default Sophos Anti Virus performs a quick scan which scans only the parts of each file that are likely to contain viruses However if scanning is set to full it scans everything and takes significantly longer to carry out a scan Full scanning is needed in order to detect some viruses but should only be enabled on a case by case basis e g on advice from Sophos technical support Checking archive files If checking of archive files is enabled every archive will be unpacked to the depth specified Scanning may therefore take much longer than if this option is not selected Checking all files or all sectors If Sophos Anti Virus has been configured to check all files and or all sectors it will take longer than if only checking executable files Sophos Anti Virus OS 2 user manual 9 2 Virus fragment reported If a virus fragment is reported contact Sophos technical support for advice The report of a virus fragment indicates that part of a file matches part of a virus There are three possible causes Variant of a known virus Many new viruses are based on existing ones so that code fragments typical of a known virus may appear in files infected with a new one If a virus fragment is reported it is possible that Sophos Anti
30. e list Time Supress filenames List filenames Report file Browse OK Cancel Help Report mode select List filenames to configure Sophos Anti Virus to record in the report file the name of every item examined By default only infected items are recorded Report file Use this option to specify the location of the report file This file is deleted and recreated each time a job is run 37 Sophos Anti Virus OS 2 user manual 5 7 Copying scheduled jobs to multiple computers on the network 38 If you have a central installation directory CID from which you installed the Sophos Anti Virus GUI on OS 2 computers you can set up scheduled jobs on one computer and copy them to all the other computers So that any virus reports display the correct computer name on each computer on the network in the file CONFIG SYS add SET HOSTNAME xxx where xxx IS a computer specific name If your OS 2 computers use IBM LAN Server or TCP IP networking or you set up central virus reporting Sophos Anti Virus OS 2 computers on a network installation guide this Should have been done already Restart each computer for this change to take effect Ata computer where the Sophos Anti Virus GUI is installed open the Sophos Anti Virus window Set up the required scheduled jobs For further configuration options see section 6 3 Close the Sophos Anti Virus window Copy the file SWEEPCFG f
31. e scans from the command line on workstations or on a file server Q This section describes how to run immediate scans with the default settings In most cases these settings are sufficient To find out how to change the default settings see section 7 2 1 What are the defaults By default Sophos Anti Virus will look for viruses in E nearly 50 types of file identified by their filename extension E logical sector O of all local hard disk drives E physical sector 1 of hard disk devices 80 to 83 Hex see section 7 to find out how to change these defaults Scanning level By default Sophos Anti Virus performs a quick scan which checks only those parts of files likely to contain viruses This is usually sufficient See section 7 6 for details 2 2 Scanning hard disks Enter the command OSWEEP This starts a scan of all local hard drives To interrupt the scan press Esc at any time To scan specific local or network hard drives use their letters For example OSWEEP D E If a virus is found a red warning message is displayed at the end of the scan To clear the warning press any key The names of viruses discovered are then displayed 13 Sophos Anti Virus OS 2 user manual 2 3 Scanning floppy disks Enter the command OSWEEP MU A You are then prompted to insert the disks you want to scan 2 4 Scanning file servers 14 You can scan file server logical drives over a network On most networks It is neces
32. ecks are recorded This also affects the information placed in the security report created by the P qualifier NS Not silent Using this command line qualifier causes the name of each area to be displayed as it is scanned Files within archive files are flagged by default with a variable length arrow symbol To change this listing use one of the following 39 Sophos Anti Virus OS 2 user manual 60 NS F Do not list files within archive Tiles at all List only the names of the outermost archive Tiles that appear in the OS 2 file system NS P Flag files within archive files with arrow symbol default NS U List the full paths of all files within archive files Include the names of archive files including those inside other archive files in these paths as though they are directories If this qualifier is omitted only infected archives are listed using the same format as NS U NSSA Scan files that Sophos Anti Virus incorrectly identifies as zip bombs By default Sophos Anti Virus stops scanning zip bombs when they are detected Zip bombs are malicious files that are designed to disrupt the action of anti virus scanners These files usually take the form of innocent looking archive files that when unpacked in order to be scanned require enormous amounts of time disk space or memory When a zip bomb is detected a message such as Aborted scanning of C TEMP BOMB ZIP appears to be
33. edence over any other applications Normal priority gives Sophos Anti Virus the same priority as other applications Low priority reduces impact on system performance by ensuring that scanning only occurs when the system is otherwise idle 31 Sophos Anti Virus OS 2 user manual 32 Scan inside archive files select this option if you want to scan inside archive files The archive types that can be checked include ARJ compress gzip LHA Microsoft Compress RAR self extractors tar UUEncode and Zip See the readme file for the latest details To enable Sophos Anti Virus to scan inside only specific archive types including Microsoft Cabinet files see section Fal bat sophos Anti Virus can also scan archive files nested in archive files Use Maximum archive depth to set the number of levels of nested files between O and 32 The default is 16 sophos Anti Virus does not recognise archives nested to a greater depth than the maximum you specify and will not scan inside them Scan mailboxes select this option if you want Sophos Anti Virus to scan emails and attachments in Outlook Express mailboxes Sophos Anti Virus OS 2 user manual 5 4 Action The Action tabbed page enables you to specify the action immediate or scheduled scanning will take on finding a virus W Job configuration Immediate Notify ell y Disinfect boot sectors iW Request confirmation iW Disinfect documents and programs _
34. emulator Sophos Anti Virus finds various polymorphic viruses by emulating the environment in which the virus code would normally execute making the virus decrypt and reveal itself Disabling this emulator will speed up a scan but may result in some polymorphic viruses not being found Sophos Anti Virus OS 2 user manual NI No interrupting Execution of a scan can normally be interrupted by pressing Esc or Ctrl Break If this command line qualifier is used execution cannot be interrupted NK No key to continue If Sophos Anti Virus discovers one or more viruses or virus fragments it pauses at the end of the security report and asks for a key to be pressed before continuing To skip this use the command line qualifier NK NMIME Do not scan MIME files Cancels MIME NOC No confirmation before virus removal If this qualifier is used Sophos Anti Virus does not ask for confirmation before deleting an infected file or disabling an infected boot sector This qualifier has no effect unless REMOVE is also specified Use this qualifier with care NOE Do not scan Outlook Express mailboxes Cancels OE This qualitier does not disable scanning of MIME files NP Do not display full pathname If Sophos Anti Virus has been set to display the names of the areas it checks it normally displays the full path of the files see the NS qualifier Using the NP qualifier means only the names of the files it ch
35. et Log Folder on the File menu In the Log Folder dialog box type in or browse to the path to the required log folder location ES Log folder Enter folder for log file Ica Browse OK Cancel a9 Sophos Anti Virus OS 2 user manual 6 2 Executables To edit the list of filename extensions treated as executables on the Options menu click Executables Then specify extensions in the dialog box ES Executable file extensions Current list of executable extensions This list is used only if Sophos Anti Virus is set to check executable rather than all file types Checking only executable types is the default See section 1 2 2 to find out how to change this setting The list does not apply to the command line interface or InterCheck The list is automatically updated with filename extensions associated with new viruses whenever you update Sophos Anti Virus If you edit the list as explained above and you subsequently want to revert to the default list click Default 6 3 Exclusion list 40 The exclusion list is a list of specific files to be excluded from immediate and scheduled scanning To edit it on the Options menu click Exclusion List Then add or remove items in the Exclusion List dialog box The list does not apply to the command line interface or InterCheck Sophos Anti Virus OS 2 user manual 6 4 Machine name If Sophos Anti Virus is configured to notify other users of vi
36. executed every time the server is started add the following line to the Startup command Tile START MIN RUNSWEEP CMD where RUNSWEEPCMD is the command file The command file can easily be customised to take additional actions when a virus is encountered 15 Sophos Anti Virus OS 2 user manual 3 Using InterCheck 16 InterCheck checks files for viruses as they are accessed by the computer and denies access to a file if it contains a virus InterCheck also scans removable disks for boot sector viruses and denies access to a whole disk if it contains an infected boot sector To find out how to configure InterCheck see section 8 Do not run more than one on access scanner at any one time This could Cause serious problems with your system or even prevent OS 2 from booting If InterCheck finds a virus it displays a message like this EM Sophos Anti Virus Message Virus EICAR AVY Test found in Divirusteicar com Please refer to the on line virus library or the user manual for further details No action taken Click OK Deal with the virus as explained in section 4 Notification to network administrators of viruses is done using the network s native messaging utility When infected files are accessed frequently in extreme cases the capacity of the messaging system may be exceeded Although this means some infected files may not be reported to the network administrator they will be made aware of which computers sto
37. f boot sectors is not affected RS has no effect unless REMOVE or REMOVEF is also specified For example OSWEEP REMOVE RS Q Files overwritten when this qualifier is used cannot be recovered See section 4 S Silent running without displaying checked areas By default Sophos Anti Virus does not display on the screen the areas it is checking The qualifier S is equivalent to this default mode and is the opposite of the NS qualifier SC Scan inside compressed files By default Sophos Anti Virus looks for viruses inside files compressed by using dynamic compression utilities PKLite LZEXE and Diet This qualifier is the equivalent of the default SS Super silent running Sophos Anti Virus will not display anything not even the copyright message unless a virus is found if this qualifier is used 7 11 4 Command line qualifiers for specific archive types By default Sophos Anti Virus does not scan inside the archive types in the following table To enable Sophos Anti Virus to scan inside a specific archive type use the appropriate qualifier To enable Sophos Anti Virus to scan inside all the archive types in the table except Microsoft Cabinet and InstallShield Cabinet files use the ARCH qualifier instead section 7 11 3 You can also use this with the specific archive type qualifiers to more easily specify which archive types should be scanned In this case the qualifiers are processed from left to right For example
38. f some error preventing further execution is discovered 3 If viruses or virus fragments are discovered Q These return values can be tested by using the IF ERRORLEVEL command For example ECHO OFF OSWEEP NK IF ERRORLEVEL 3 GOTO FISHY IF ERRORLEVEL 1 GOTO SOMEERR ECHO No problems GOTO END SOMEERR ECHO Some error has occurred GOTO END ELON ECHO Something has been discovered END This batch file will print Something has been discovered if Sophos Anti Virus discovers a virus Some error has occurred in the event of an error or No problems if nothing is discovered The NK qualifier tells Sophos Anti Virus not to pause for a key if viruses are discovered Extended error codes A different set of error codes are returned if Sophos Anti Virus is run with the EEC command line qualifier 65 Sophos Anti Virus OS 2 user manual 66 16 20 24 32 36 40 No errors have occurred and no viruses have been found Survivable errors have occurred Password protected files have been found They are not scanned Viruses have been found and disinfected Viruses have been found and not disinfected OSWEEP has failed an integrity check Unsurvivable errors have occurred Execution has been interrupted Sophos Anti Virus OS 2 user manual 8 Configuring InterCheck This section describes how to configure InterCheck on access scanning and lists the options that you can set 8 1 How to configure Inte
39. h of the logical sectors O to 10 only bytes 271 to 2 5 inclusive should be checked Sophos Anti Virus OS 2 user manual The following specification would check logical sector 15 on drive A checking only byte number 536 within that sector A 15 15 530 The start and end sectors have been specified the same In addition the following can be used on all drives except network drives This checks all disk sectors within the current logical disk and should be used with care because it might find virus fragments in deleted files and might cause false positives Specifying absolute sectors to be checked To specify an absolute sector use the symbol followed by the drive number the cylinder or track number the head or side number and the sector number within that cylinder The first floppy disk drive in the system is number O the second is number 1 and so on The first physical hard disk drive is number 80 the second is number 81 and so on It is also possible to specify a byte or group of bytes to be checked in the sector for example if the sector contains variable information The format of the specification is drive cylinder head sector sbyte ebyte where E drive is the disk drive number E cylinder is the cylinder number E head is the head number E sector is the sector number E sbyte is the first byte to be checked optional E ebyte is the last byte to be checked optional All values
40. he EXEJOB and AUTO qualifiers cannot both be used if both are included in the command line EXEJOB will be ignored CLOSE Closes both the Sophos Anti Virus window and the background scheduler If Sophos Anti Virus is not running errorlevel 1 is returned All other qualifiers are ignored 42 Sophos Anti Virus OS 2 user manual CF lt config file gt Specifies a name and path for the configuration file If the program cannot open the file Sophos Anti Virus will be started with default options and on exit will try to create a configuration file with the given path and filename NOWIN Starts the background scheduler only LOGPATH lt path gt Enables the user to alter the stored or default location of the log file SWEEPLOG The new path will be stored in the configuration file REPORTPATH lt path gt Enables the user to enter a default path for the job report files This path will be used when no path is entered for a report file in the appropriate dialog 43 Sophos Anti Virus OS 2 user manual 7 Configuration via the CLI This section describes how to configure Sophos Anti Virus from the command line or with an area file It describes how to specify which items should be scanned sections 7 1 to 7 5 specify full or quick scanning section 7 6 run scanning at different priorities section 7 7 use new virus identities or patterns sections 7 8 and 7 9 E disinfect or remove files section 7
41. infection 33 removal 24 mailbox scanning 32 master boot sector replacing 22 MIME files 58 59 N NTFY CMD 68 O on access scanning configuring 67 on demand scanning 13 25 configuring 28 38 configuring via the CLI 44 66 on screen log clearing 41 Outlook Express mailboxes 59 61 Sophos Anti Virus OS 2 user manual P pattern of virus adding 51 physical sector 47 scanning 49 PKLite 63 positive overwriting of infected files 63 programs dealing with infected 23 disinfection 33 progress bar displaying 42 Q quick scan 13 31 50 R recursive scanning via the CLI 62 report file 37 rights on NetWare 14 S scanning CD boot image 55 scheduled scanning adding a job 11 configuring via the CLI 15 44 66 configuring via the GUI 28 38 copying jobs 38 editing a job 12 job list 11 removing a job 12 security report 61 SETUP UPDATE 67 shredding of infected files 63 silent running CLI version 63 STARTUPCMD 55 subfolders scanning 10 SWEEPARE 14 45 SWEEP PAT 51 virus analyses 41 boot sector 33 disinfection 19 25 33 34 52 56 Form 24 fragment 75 macro 24 pattern adding 51 recovery from 25 removal 52 59 62 63 warning 35 72 Winword ShareFun 24 zip bombs 60 81 Sophos Anti Virus OS 2 user manual Technical support 82 For technical support visit www sophos com support If you contact technical support provide as much information as possible including the following E S
42. ist of authorised items by InterCheck E the status of InterCheck active or inactive E the last item filtered To display the InterCheck Monitor menu click the left hand side of its title bar You can open the Sophos Anti Virus window from this menu OQ Closing InterCheck Monitor does not stop InterCheck 18 Sophos Anti Virus OS 2 user manual 4 Disinfection This section provides some general information about disinfection It does not explain how to disinfect a computer of specific viruses as disinfection methods are varied and can be virus specific It is recommended that you get information about the virus see below then either use the Sophos website for help with disinfection or contact Sophos technical support 4 1 Getting information about the virus If the Sophos Anti Virus GUI finds a virus it displays a message box like this Sophos Anti Virus S Immediate job 1 item swept 1 virus detected O errors encountered Please refer to the on line virus library or the user manual for further details For technical support email support sophos com or call 44 1235 559933 You also see details in the on screen log at the bottom of the Sophos Anti Virus window 19 Sophos Anti Virus OS 2 user manual If command line Sophos Anti Virus finds a virus it displays a message like this Sophos Anti Virus Version 3 90 0 Virus data version 3 90 February 2005 Includes detection for 99603 vir
43. ly be changed except under the advice of Sophos technical support Using too small a value will probably cause the user s computer to hang so that a restart would be required 8 3 Configuration options shared with other versions of InterCheck The InterCheckGlobal and InterCheckWorkstation sections are shared with versions of InterCheck that run on other operating systems If you use only OS 2 you should use only 05 2 specific sections and the options described in sections 8 1 and 8 2 CheckNetwork YES NO Same as above Exclude same as above Other versions of InterCheck may accept only simple exclusion specifications a b c filename only only is recognised as a wild card d all files on drive d PopUpDisplay OFF same as VirusPopUp above ERROR and VERBOSE both mean YES StartUpDisplay NONE NORMAL VERBOSE same as StartUpReport above 71 Sophos Anti Virus OS 2 user manual 72 SweepVxDLogFile lt path gt Same as LogFile above SweepVxDLogLevel 0 5 Same as LogLevel above SweepVxDMode FULL QUICK Same as ScanMode above Troubleshooting Sophos Anti Virus OS 2 user manual 9 Troubleshooting This section provides answers to some common problems that you may encounter when using Sophos Anti Virus for OS 2 If your problem is not described in this section refer to the Sophos website www sophos com which includes a support knowledgebase virus analyses th
44. ollowing files NLS DLL QUECALLS DLL and VIOCALLS DLL Follow the on screen instructions When booting is finished the A prompt appears Insert the Sophos Anti Virus Supplementary CD Sophos Anti Virus OS 2 user manual 4 At a command prompt enter SET BEGINLIBPATH A N E NOS 2 This tells OS 2 where to find the files mentioned in step 2 Enter E OS_2 OSWEEP A DI MU When the computer prompts you insert the floppy disks to be disinfected Infected boot sectors and programs are disinfected When disinfection is complete scan the whole computer for remaining infections If this procedure fails to disinfect a virus on your floppy disk contact Sophos technical support Reformatting If OS 2 is already running shut it down Boot OS 2 from the 05 2 Utility disk set Follow the on screen instructions When booting is finished the A prompt appears Remove the 05 2 Utility disk Copy the valuable data from the infected disk to a clean destination it is safe to copy files if the computer has been clean booted Reformat the infected disk 4 2 3 Dealing with infected programs Q Sophos Anti Virus can disinfect some infected programs However if 2 disinfected programs may be unstable and put valuable data at risk We recommend that disinfection of programs is used only as a temporary measure and that you subsequently replace disinfected programs from original installation disks a clean computer or
45. ophos Anti Virus to produce a report of the areas checked This report is output to the device PRN if the qualifier is used as P not followed by Alternatively the report can be directed to a particular file or device using the qualifier as P For example OoOWEEE P 0EC e DOC directs Sophos Anti Virus to write its security report to the file SEC DOC PD Pause on discovery of a match Sophos Anti Virus will pause whenever it discovers a matching pattern and wait for a keystroke before continuing if this command line qualifier is used PR Priority By default Sophos Anti Virus runs with the priority of any other standard OS 2 task such as a word processor This qualifier can be used to increase or decrease this priority OSWEEP PR H specifies high priority while OSWEEP PR L specifies low priority High priority is a little below that of real time tasks while low priority is equivalent to idle time priority 6l Sophos Anti Virus OS 2 user manual 62 Q Quick sweep By default Sophos Anti Virus performs a quick scan This qualifier is only necessary if default mode is switched off This might have been done for example in a batch file or in a file specified by file REC Recursive search This qualifier directs Sophos Anti Virus to search directories below the ones Specified in the command line For example OSWEEE Colt DE CONSIMULATIN OIM REC searches all DLL files on the disk starting from
46. ophos software version number s E operating system s and patch level s mM the exact text of any error messages Copyright 2003 2007 Sophos Group All rights reserved No part of this publication may be reproduced stored in a retrieval system or transmitted in any form or by any means electronic mechanical photocopying recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the licence terms or you otherwise have the prior permission in writing of the copyright owner Sophos and Sophos Anti Virus are registered trademarks of Sophos Plc and Sophos Group All other product and company names mentioned are trademarks or registered trademarks of their respective owners
47. ot disable boot sectors from the Sophos Anti Virus GUI Sophos Anti Virus OS 2 user manual If you are using the Sophos Anti Virus window specify automatic disinfection in the Job Configuration dialog box described in section 5 4 Then run an immediate scan of the infected area described in section 1 2 If using Sophos Anti Virus from the command line or if automatic disinfection is unsuccessful see the rest of this section for more information about disinfection 4 2 1 Dealing with boot sector viruses on the hard disk There are two ways to deal with boot sector viruses on the hard disk by disinfection or by replacing the boot sector Disinfection This is the preferred approach Before disinfection backup any important data on the hard disk This procedure assumes that A is the floppy disk and E is the CD 1 If OS 2 Is already running shut it down 2 Boot 05 2 from the OS 2 Utility disk set The disks should include a CD driver and the following files NLS DLL QUECALLS DLL and VIOCALLS DLL Follow the on screen instructions When booting is finished the A prompt appears 3 Insert the Sophos Anti Virus Supplementary CD 4 Atacommand prompt enter SET BEGINLIBPATH A E OS_2 This tells OS 2 where to find the files mentioned in step 2 5 Enter E OS_2 OSWEEP DI The computer is scanned for boot sector and file viruses Sophos Anti Virus disinfects infected boot sectors and some programs see section 4 2 3
48. ou specify a different configuration for each scheduled job The different scanning modes are described in section 1 This section also describes how to set up scheduled scanning on multiple computers on the network For information on further global options e g to exclude files from all forms of scanning see section 6 There are Job Configuration dialog boxes for immediate scanning and each scheduled job They enable you to specify which items Sophos Anti Virus should scan and what action it should take on discovering a virus To open the required configuration dialog box in the Sophos Anti Virus window click the tab for the scanning mode you would like to configure Immediate Scheduled Path Fila tunas Cohfnidare a a If you clicked the Scheduled tab select the job that you want to configure Then click the Configuration button The sub sections in this section describe each tabbed page you will find in the configuration dialog boxes Some tabbed pages are only available for scheduled scanning Sophos Anti Virus OS 2 user manual 5 1 File list scheduled mode only The File list tabbed page enables you to specify the items to be included in a scheduled scan It is used in the same way as the file list on the Immediate tabbed page of the Sophos Anti Virus window section 1 1 2 ES Job Configuration F Report OE SEIS Ea Time Mode Action Motify Subfolders O S Local Hard Drive
49. ow operate a form of stealth to prevent users from doing this For example Winword ShareFun disables the Macro option on the Tools menu and Templates option on the File menu Consult Sophos technical support before attempting to perform manual disinfection of macro viruses 4 2 5 Dealing with an infected Boot Manager Almost all known viruses execute in DOS mode OS 2 systems with Boot Manager configured are vulnerable to attack while DOS is running For example the common virus Form can damage the Boot Manager If the OS 2 Boot Manager is infected do as follows This procedure assumes that A is the floppy disk and E is the CD If OS 2 is already running shut it down Boot 05 2 from the OS 2 Utility disk set The disks should include a CD driver and the following files NLS DLL QUECALLS DLL and VIOCALLS DLL Follow the on screen instructions When booting is finished the A prompt appears Sophos Anti Virus OS 2 user manual 3 Insert the Sophos Anti Virus Supplementary CD 4 At a command prompt enter SET BEGINLIBPATH A N E NOS 2 This tells OS 2 where to find the files mentioned in step 2 d Enter E OS_2 OSWEEP DI The computer is scanned for boot sector and file viruses Sophos Anti Virus disinfects infected boot sectors and some programs see section 4 2 3 If this procedure fails to disinfect Boot Manager continue to step 6 6 Ensure the last OS 2 Utility Disk is in the drive 7 Use the 05 2 FDISK or
50. rCheck InterCheck is configured via the file INTERCHK CFG located on the workstations in the same directory as Sophos Anti Virus and InterCheck If the workstations have been set to update from a central installation directory CID there is also a central copy of INTERCHK CFG in the CID Whenever the InterCheck on access scanner is installed or updated by a workstation from the CID the central copy of INTERCHK CFG Is copied to the workstation facilitating centralised configuration of INTERCHK CFG Q You must run the following command after carrying out any changes to this file in the CID SETUP UPDATE to ensure the workstations detect the changed file The file is not case sensitive lt has four sections InterCheckGlobal Recognised by all workstations InterCheckWorkstation Recognised by one or more named workstations InterCheckOS2Global Recognised by all OS 2 workstations InterCheckOS2Workstation Recognised by one or more named 05 2 workstations The square brackets are part of the section names The two section names workstation must be followed by a line Address Xxx Where xxx is the name of a workstation that will recognise the section A section may include several address lines if more than one workstation Is required to recognise the section 67 Sophos Anti Virus OS 2 user manual Q In 05 2 InterCheck the workstation name is specified by the line SET HOSTNAME xxx which must be included in
51. re infected files They can then check the InterCheck log on those computers which contains a definitive record of all viruses found and other important events Running InterCheck can slow down a computer especially when it is Starting up To avoid this configure the OS 2 file systems to use large caches using the command DISKCACHE and or the CACHE qualifier of the IFS command in CONFIG SYS Sophos recommends a value of 2048 in each case or 1024 if computer memory is limited See the IBM 05 2 Command Reference Guide for more information InterCheck does not scan the contents of archive files before the archive files are unpacked However it does scan the extraction stub of self extracting Sophos Anti Virus OS 2 user manual archives prior to extraction This is because such a process could be too Slow for an on access scanner After archive files have been unpacked with the archive utility InterCheck prevents access to any of the unpacked files that are infected so that security is maintained Sophos does not recommend using InterCheck on a file server as it is likely to reduce performance Files held on servers will be scanned by clients running InterCheck when they access the files InterCheck is designed to prevent multiple virus alerts due to repeated attempts by a user to access the same infected file For more information see the InfectedCacheLifetime command in section 8 InterCheck only scans files when they
52. reasonable number Command files can contain qualifiers NS NK etc ARE files cannot ARE files can contain specifications containing spaces e g 80 O O 1 All executables and comments command files cannot 7 11 3 List of command line qualifiers to OSWEEP Help sophos Anti Virus displays all command line qualifiers and a short description of their function A Append report By default any security report written to a file by Sophos Anti Virus will be overwritten by a subsequent report written to a file of the same name Specifying the A qualifier in the command line for example OSWEEP A P FOO REP appends the new report to the old file FOO REP rather than overwriting the old report with the new one 53 Sophos Anti Virus OS 2 user manual 54 If this is used in an automatic process this file should be pruned from time to time to stop it taking up ever more disk space especially if the NS command line qualifier is used AD lt drive gt Area file default Any files or areas listed in the SWEEPARE file are assumed to be in the specified drive unless they have an explicitly stated drive For example OSWEEP AD X would assume that all areas refer to drive X AF lt filename gt Area file The default area file is called SWEEPARE The AF qualifier can be used to specify a different name See also section 7 3 ALL Scan all files In order to scan all files on a disk instead of jus
53. rom the installation directory on this computer by default C SAV OS2SWEEP ENG to the CID on the server by default C SAVCID OS2 INST Change directory to the CID Enter SELO UPDATE The server and the workstations detect the changes and are updated with the new configuration Sophos Anti Virus OS 2 user manual 6 Global configuration options GUI This section describes global configuration options accessible from the menu bar in the Sophos Anti Virus window It contains the following information How to change the location of the Sophos Anti Virus log folder section 6 1 How to change the files defined as executables for all scanning modes section 6 2 How to exclude files or file types from scanning by all scanning modes section 6 3 How to set the machine name used by Sophos Anti Virus alerts section 6 4 EH How to clear the Sophos Anti Virus log section 6 5 How to set the web browser and language used to display virus analyses section 6 6 How to disable the progress bar displayed during a scan section 6 7 It also lists the Sophos Anti Virus command line qualifiers section 6 8 6 1 Set log folder Sophos Anti Virus maintains a continuous log of all its activity This log file contains administrative messages along with on screen messages By default the log file is saved in the directory in which Sophos Anti Virus was installed the default is CASAV This can be changed by clicking S
54. rus finds it is useful to identify the computer where the virus has been found To do this on each computer on the network in the file CONFIG SYS add SET HOSTNAME xxx where xxx IS a computer specific name Restart each computer for this change to take effect This method ensures all the components of Sophos Anti Virus for OS 2 use the computer name It is also possible to use the Machine Name option on the Options list to set the machine name However this only applies to virus finds reported by the GUI 6 5 Clear log The on screen log provides a record of activity in the current session and reflects the information that is appended to the continuous log file This option clears the on screen log but does not affect the continuous log file on disk 6 6 Virus library To configure the web browser and language used to display the virus analyses on the Sophos website on the Options menu click Virus Library to display the Virus Library Viewer Configuration dialog box virus Library Viewer Configuration Web browser command C METSCAPE PROGRAM NETSCAPE EXE Browse Language for virus analyses E Cancel Help Choose the web browser by typing the path of the browser program in the Web browser command text box or by using the Browse button The default is the computer s default browser if one has been set To use the OS 2 internet dial up feature precede the path of the browser program with linkup
55. s Executables TES Cancel To add items to the list click Add and specify an item or items in the item details dialog To remove an item highlight it and click Remove To edit an item double click it or highlight it and click Edit then edit it in the Edit item details dialog box The options in the Edit item details dialog box are described in section 1 2 2 29 Sophos Anti Virus OS 2 user manual 5 2 Time scheduled mode only The Time tabbed page enables you to set the times and days on which a scheduled job should take place a Job configuration Default 30 Sophos Anti Virus OS 2 user manual 5 3 Mode The Mode tabbed page enables you to configure scanning options for immediate or scheduled scans Job configuration Immediate Quick Normal K Full C Low _ Scan inside archive files Er O Deb bee te Bet ree ED ma Pia Mt TE Da MEN Piniint fiseriry Hitt OAR AAR BR RE COB Rad df PEREL AGT Scan mailboxes Quick scanning checks only those parts of each file that are likely to contain viruses This level is sufficient for normal operation Full scanning examines the complete contents of each file This level is more secure but is much slower than Quick Full scanning is needed in order to detect some viruses but should only be enabled on a case by case basis e g on advice from Sophos technical support Priority High priority gives Sophos Anti Virus prec
56. sary to be logged in as a Supervisor or have read rights equivalent to those of a supervisor the latter is more secure if the workstation itself is infected Most networks do not allow file server boot sectors to be examined Sophos Anti Virus determines automatically to which network drives such restrictions apply You can force Sophos Anti Virus to treat all drives as network drives during a scan by using the FS command line qualifier On most networks some files are not readable and Sophos Anti Virus will report an error when it tries to open them It automatically avoids the Tiles EA DATA ESF WP ROOT SF OS2 SYSTEM SWAPPER DAT on all drives where the symbol represents the space character Any files can be exempted from a scan by quoting them preceded by the exclusion operator in the SWEEPARE file For more information see section 4 A quick way to find unreadable files on the file server is to run a scan and note the names of any file s that could not be opened Maximum effectiveness is obtained by running Sophos Anti Virus on the file server itself in stand alone mode For instructions on disinfecting a system in Stand alone mode see section 4 2 Sophos Anti Virus OS 2 user manual 2 5 Running Sophos Anti Virus on a file server Sophos Anti Virus for OS 2 can be installed on a LAN Server or LAN Manager file server as an integral part of an anti virus strategy Although Sophos Anti Virus does not contain an
57. se the CDR qualifier For example OSWEEP CDR H scans all executables logical sector O and the boot image if any of CD drive H If Sophos Anti Virus finds a boot image it checks the boot sector of that image for boot sector viruses and scans all executables in the boot image for file viruses CI Check integrity This qualifier causes Sophos Anti Virus to check the integrity of OSWEEPEXE before executing A change in the contents of OSWEEPEXE may indicate the presence of a virus or some other form of data corruption D lt day percentage gt Day or Percentage Sophos Anti Virus may be incorporated into the STARTUPCMD file however it may not be desirable to perform the system check every time the computer is switched on The D qualifier enables you to specify either the probability with which SWEEP will actually proceed to check the system or the day of the week on which the system should be checked For example OSWEEP D MONDAY will only run Sophos Anti Virus when invoked on a Monday The day of the week can be abbreviated to a minimum of two letters e g MO for Monday TU for Tuesday etc Alternatively OSWEEP D 20 55 Sophos Anti Virus OS 2 user manual 56 makes Sophos Anti Virus check the system on average 20 times out of every 100 times that SWEEP is invoked The number specified must be an integer between O and 100 See also the DE qualifier DA Display areas This command line qualifier will li
58. sinfection Universal Naming Convention a standard system for naming network drives e g the UNC directory MAIN USERS would refer to the USERS directory on the server called MAIN A sequence of bytes extracted from a virus and used for virus recognition 79 Sophos Anti Virus OS 2 user manual Index A absolute sector 4 scanning 49 archive files scanning 16 32 74 scanning via the CLI 54 63 B boot image CD 55 boot manager and disinfection 24 boot sector disinfection 20 33 C CD boot image 55 checking all files 10 74 via the CLI 54 compressed files scanning via the CLI 63 D Diet 63 disinfection 19 25 56 automatic 33 34 on systems with boot manager 24 disk sectors checking via the CLI 47 documents disinfection 20 24 33 E email scanning 32 excluding files from scanning 14 40 executables files treated as 40 limiting scanning to 10 F file server checking via the CLI 14 57 floppy disk checking via the CLI 14 disinfecting boot sectors 22 full scan 13 31 50 74 via the CLI 57 80 H hard disk checking via the CLI 13 disinfecting boot sectors 21 IDE files specifying location 57 immediate scanning 9 25 adding items for scan 10 25 removing items from scan 10 starting 9 infected files dealing with 20 integrity check 55 InterCheck configuring 67 72 InterCheck Monitor 17 L log file 39 logical sector 47 scanning 48 LZEXE 63 M macro virus dis
59. st all areas to be checked by Sophos Anti Virus but not actually check them DE Daily execution This command line qualifier will check whether Sophos Anti Virus has already been executed that day and if it has it will not be executed again The file SWEEP DAY is created on the current drive and directory A different file can be specified by including filename after the DE qualifier For example OSWEEP DE SWEEP DA1 DI Disinfect This qualifier enables Sophos Anti Virus to perform automatic disinfection of some boot sector macro and file viruses For more information on using it see section 4 Boot sector virus disinfection will not work if the boot sector has already been disabled by using the REMOVE qualifier DIB Use the DIB qualifier to disinfect only boot sectors DID Use the DID qualifier to disinfect only documents and programs DN Display names of files as they are scanned The display consists of the time followed by the item being scanned EEC Use extended set of error codes This qualifier directs Sophos Anti Virus to use an extended set of error codes For details see section 7 12 Sophos Anti Virus OS 2 user manual EX lt extensions gt Executable extensions The extensions of files normally treated as executables can be changed with the EX command line qualifier For example OSWEEP EX EX1 EX2 replaces the list of extensions with the EX1 and EX2 file types F Full
60. subfolders 1 2 3 Removing items for immediate scanning Highlight by clicking the name of the path to be removed and click the Remove button Sophos Anti Virus OS 2 user manual 1 3 Scheduling scans To view or edit scheduled jobs first ensure the Scheduled tabbed page is selected 1 3 1 Default scheduled mode job list By default there is a job named Default which scans all local hard drives see sections 1 3 3 and 1 3 4 for details of how to modify or remove this job 1 3 2 Adding a new scheduled job 1 Click the Add button on the Scheduled tabbed page 2 Enter the name of the job in the Enter new job name dialog box EM Enter new job name Job name Cancel 3 In the Job Configuration dialog box use the tabs to set up the job ESET TETO e Notity Subfolders O Local Hard Drives Executables Yes The options in the Job Configuration dialog box are explained in section 5 11 Sophos Anti Virus OS 2 user manual 1 3 3 Editing a scheduled job Highlight by clicking the name of the scan and click the Edit button or double click the name of the scan The Job Configuration dialog box is displayed in which you can edit the scan 1 3 4 Removing a scheduled job Highlight by clicking the name of the job to be removed and click the Remove button 12 Sophos Anti Virus OS 2 user manual 2 Using Sophos Anti Virus via the CLI This section describes how to run immediat
61. t the executable files specify the ALL command line qualifier This is equivalent to creating a SWEEPARE file which contains Oar It thus specifies a recursive search of all files rather than just executable files from the root directory of the current drive For example OSWEEP A ALL will recursively sweep all files on drive A This is a slow process ARCH n Scan inside archive files This qualifier enables Sophos Anti Virus to scan inside archive files The archive types scanned include ARJ compress gzip LHA Microsoft Compress RAR self extractors tar UUEncode and Zip See the readme file for the latest details To enable Sophos Anti Virus to scan inside only specific archive types including Microsoft Cabinet files see section 7 11 4 By default Sophos Anti Virus will unpack 16 levels of nested archive files i e archive files within archive files If you want to change this setting use Sophos Anti Virus OS 2 user manual ARCH n where n is the maximum number of levels The number n can be between O and 32 AS Scan standard areas If an area to be scanned is specified in the command line Sophos Anti Virus will not scan standard areas master boot sector OS 2 boot sector etc With the AS command line qualifier standard areas are checked as well For example OSWEEP SUSPFILE EXE AS will scan SUSPFILE EXE as well as the standard areas CDR Scan CD boot image To scan the boot image of a CD u
62. tem and the user wishes to run the scan as soon as possible and as fast as possible without shutting the system down Use the command line qualifier PR H OSWE EP PR H sophos Anti Virus will run with the same high priority as the network software but at a lower priority than any real time processes Sophos Anti Virus OS 2 user manual scanning should be run in low priority lower than any other task if the user wishes to check constantly for virus presence without affecting the system performance Use the command line qualifier PR L OSWEEP PR L This makes Sophos Anti Virus run only when 05 2 would otherwise be idle 7 8 Scanning with new virus identity files see the Sophos Anti Virus OS 2 computers on a network installation guide or the Sophos Anti Virus OS 2 single user installation guide for information about updating Sophos Anti Virus with new virus identity files IDEs To specify the location of the IDEs that Sophos Anti Virus should use use the command line qualifier IDEDIR section 7 11 3 7 9 Scanning with new patterns The range of patterns checked by Sophos Anti Virus can be extended by creating a file called SWEEPPAT containing the patterns in the format Name Hexl Hex2 Hexn Comments where m Name is the pattern name no spaces allowed Hexl etc are pattern bytes in hexadecimal 2 hex digits per byte most significant nibble first E Comments are any comments after the P
63. the file CONFIG SYS on each computer Restart the computer for this change to take effect You may find this line has already been inserted by the Sophos Anti Virus installer The file contains some information by default which is explained in section 8 2 8 2 Configuration options for InterCheck for OS 2 68 The default InterCheck configuration file is as shown below e exe interchk cfg el Ey File Edit Options Help InterCheckOs26lobal Eme nele 082 Oe 7 a INI Eee ile DEZ e co Ece ls OSZ OS emas Exclude SF Users should change the following to suit their requirements NetworkNotification Yes statusWindow YES Whe Ui jaja NetworkNotification YES When InterCheck finds a virus it will run the batch file NTFY CMD in the CID and send a virus notification to a named workstation This file may also be run if a virus is found during an immediate or scheduled scan StatusWindow YES InterCheck Monitor runs constantly recording the last file scanned by InterCheck VirusPopUp YES When InterCheck finds a virus a popup virus alert is displayed at the workstation To change any of these settings change YES to NO Sophos Anti Virus OS 2 user manual You can add other commands to the file as described below If you have any non 05 2 computers you should also see the shared configuration options listed in section 8 3 AppendLogfile YES NO Normally when the 05 2 InterCheck scanner starts
64. uses trojans and worms Copyright c 1989 2005 Sophos Pic www sophos com System time 20 16 25 System date 16 February 2005 Quick Sweeping Press Esc to quit gt gt gt Virus EICAR AV Test found in file F EICAR COM 9 files swept in O minutes and 1 second 1 virus was discovered 1 file out of 9 was infected For advice consult www sophos com email support sophos com or telephone 44 1235 559933 First isolate the infected computers from the network and internet Write down the name of the virus Then from an uninfected computer look up its virus analysis on the Sophos website The virus analysis search page is located at www sophos com virusinfo analyses You can go straight to this page by double clicking the Sophos Virus Information Website icon in the Sophos Anti Virus for OS 2 folder The analysis tells you what types of files the virus infects and provides information about disinfection It may also include a link to detailed disinfection instructions Use these instructions to help you disinfect the computer If there are no instructions contact Sophos technical support 4 2 Disinfection 20 sophos Anti Virus s automatic disinfection facilities or OS 2 commands can deal with most virus attacks Infected boot sectors can be disinfected in some cases or disabled EH Infected documents can be disinfected EH Some infected programs can be disinfected EH Infected files can be deleted You cann
65. using number base 16 The numbers 10 to 15 are represented by the characters A through F respectively Hexadecimal is often abbreviated to Hex Each Hex digit is equivalent to four bits half a byte of information Virus identity file enables Sophos Anti Virus to detect a specific virus You need IDEs to protect your computer against viruses discovered since your version of Sophos Anti Virus was compiled A component of Sophos Anti Virus that intercepts files as they are accessed and grants access only to those that are virus Tree Local Area Network a data communications network covering a limited area up to several kilometres in radius with moderate to high data transmission Speeds Sophos Anti Virus OS 2 user manual Macro virus Master boot sector Polymorphic virus SWEEP UNC Virus pattern A type of virus that uses macros in a data file to become active in memory and attach itself to other data files Unlike other types of virus macro viruses can attain a degree of platform independence The first physical sector on the hard disk sector 1 head O track O which is loaded and executed when the PC is booted It contains the partition table as well as the code to load and execute the boot sector of the active partition Common point of attack by boot sector viruses Self modifying encrypting virus The component of Sophos Anti Virus that provides immediate and scheduled virus scanning and di
66. y network specific features the LAN server environment encourages the use of different techniques for controlling the operation of the virus scanner Scheduling You can schedule regular scans using the Al command provided by the Network Operating System For example the following instruction will run a scan at midnight each day and place the output in the file OSWEEPLOG AT 00 00 E M T W Th F S Su C SAV OS2SWEEP ENG OSWEEP P C SAV OSWEEP LOG The red alert message is displayed if a virus is detected The log file should then be examined to determine which files are infected Full pathnames must be specified The instruction can be added to the startup command file so that it will be executed automatically every time the server is started Background Operation sophos Anti Virus can be configured to run continually as a background process A command file is required to restart the scan The following Is a simple example file that scans continuously until a virus is detected QECHO OFF START C SAV OS2SWEEP ENG OSWEEP PR L P C SAV OSWEEP LOG IF ERRORLEVEL 3 GOTO VIRUS FOUND GOTO START VIRUS FOUND The qualifier PR L changes the priority of the scan to low so that the impact on server performance is reduced It is not advisable to run the command file as a detached process since it cannot easily be monitored or terminated The command should be run in the background instead To ensure the command file is

Sophos Anti-Virus OS/2 user manual

Contents

Download Pdf Manuals

Related Search

Related Contents