McAfee AVDCDE-AA-AA User Guide - Page 81

Removing Infections From Your System • If you suspect that a macro virus has infected your PowerPoint files, copy the file BLANKPRESENTATION.POT from C:\Program Files\Microsoft Office\Templates to the disk. Making disk images To send the files now stored on any floppy disks you created, you can use a McAfee AVERT Labs tool called RWFLOPPY.EXE to make a floppy disk image that encapsulates the infection. The RWFLOPPY.EXE tool does not come with your VirusScan software, but you can download it from this location: http://www.nai.com/asp_set/anti_virus/avert/tools.asp The AVERT site stores the tool as a compressed .ZIP file. Download the file to your computer, then extract it to a temporary folder on your hard disk. The .ZIP package contains a brief text file that explains the syntax for using the RWFLOPPY.EXE utility. NOTE: If you suspect you have a boot virus, you must use RWFLOPPY to send your samples electronically; otherwise, you must send your samples physically on a diskette. If you send them electronically without using RWFLOPPY, the samples will be incomplete or unusable, as boot viruses often hide beyond the last sectors of a diskette, and other diskette image creation programs cannot obtain this data. Once you create images of the disks you want to send, you can send them as file attachments in an e-mail message to McAfee anti-virus researchers. Preparing file archives to send Try to fit as many of file samples as you can on a single floppy disk. To do so, compress the samples that you captured on disk to a single .ZIP file with password protection. Here's a suggested procedure that uses the WinZip utility: 1. Start WinZip. 2. Press CTRL+N to create a new archive. The New Archive dialog box appears. 3. Enter a name for the new archive, then click OK. 4. Press CTRL+A to add files to the new archive. The Add dialog box appears. 5. Click Password to display the Password dialog box. User's Guide 81