QUICK START INSTRUCTIONS FOR McAFEE ASSOCIATES PROGRAMS
Last revised May 26, 1991.
Copyright 1990, 1991 by McAfee Associates.  All rights reserved.
Written by Aryeh Goretsky.  Thanks to Mike Ramey for his comments.

McAfee Associates                  (408) 988-3832 Telephone
4423 Cheeney Street                (408) 970-9727 FAX
Santa Clara, CA  95054-0253        (408) 988-4004 BBS 1200/2400baud
U.S.A.                             (408) 988-5138 BBS HST9600 MNP-2
                                   mcafee@netcom.com       INTERNET
                                   GO VIRUS              CompuServe

     These instructions tell how to identify a virus with the
VIRUSCAN program and remove the virus with the CLEAN-UP program. 
They are intended to provide the person with a virus infection an 
emergency means to identify and remove an infection.  They are not
meant to replace the program documentation.  Please read through
the documentation for detailed instructions.

     Files ending in a .DOC extension have been formatted for
printing on a printer with a minumum of 60 lines per page.  Files
ending in a .TXT extension have not been formatted. 


VIRUSCAN (SCAN)

1.   Copy all the VIRUSCAN files to a floppy disk in drive A:.

2.   WRITE PROTECT THE DISK!!!

3.   Insert the disk into the infected PC and type:

A:\SCAN C: D: E:

     This will allow VIRUSCAN to run on the C:, D:, and E: drives. 
If you do not have D: and E: drives, leave them out.

4.   If infected files are found, they may be ERASED by running
VIRUSCAN with the /D (overwrite and delete) option:

A:\SCAN C: D: E: /D

     Running VIRUSCAN with the /D option will delete files in a way
that is non-recoverable.  Use this option only if you do NOT want
to recover any of the infected files.  Otherwise use the CLEAN-UP
universal virus disinfector.

5.   Turn computer off to remove the virus from memory.


CLEAN-UP (CLEAN)

1.   Copy all the CLEAN-UP files to a floppy disk in drive A:.

2.   WRITE PROTECT THE DISK!!!

3.   Power down the infected system and then boot from a clean,
     write protected system master diskette.  This must be done
     to remove any viruses from memory that may interfere with the
     virus removal process.   NOTE: If you are unable to access
     your hard disk after booting from a floppy, check to make sure
     that any special device drivers needed to use the hard disk
     are on the floppy and run from the CONFIG.SYS or AUTOEXEC.BAT
     file.

4.   Insert the CLEAN-UP disk into the A: drive of the infected PC
     and type:

A:\CLEAN C: D: E: [virus-ID-code]

     This will allow CLEAN-UP to disinfect viruses on the C:, D:,
and E: drives.  If you do not have D: and E: drives, leave them
out.  

     For the Jerusalem virus, the ID code is [JERU].  For the
Stoned virus, the ID code is [STONED].  For other viruses, use the
ID code generated by SCAN, or check the VIRLIST.TXT file.  Remember
to include the square brackets, "[" and "]."

     If you are disinfecting a file-infecting virus, such as the
Jerusalem, it is recommended that you add the /A switch to the
command line to check all files.  This will ensure that the virus
is removed from any overlay files that may not use the defaault
overlay extensions recognized by CLEAN-UP.  If you know that none
of your programs use overlays, then the /A switch is not necessary.

     If more than one virus type was detected, then CLEAN-UP will
have to be run for each type of virus.

5.   Turn the computer off and then re-boot from the hard disk.


AN IMPORTANT NOTE
You have now completed a virus disinfection of your computer
system, however, you may have other computers and floppy disks
that are infected.  You know have a clean PC from which to
scan and clean them.  Please now take the time to read through
the VIRUSCAN and CLEAN-UP documentation to show you the fastest
and safest way of removing your computer virus infection.