5/28/94:  Begin User Manual for The Doctor Anti-Virus Software
--------------------------------------------------------------

Fast Start
----------

Stand-Alone PC's

If you are familiar with DOS, you can use this section to get The Doctor Anti-
virus System programs up and running fast.

(1)     Reboot your machine using a clean DOS disk.

(2)     Make a back-up copy of The Doctor Anti-virus System diskette(s).
        (Use the DOS Diskcopy Command).

(3)     Insert the back-up of The Doctor disk in the A: drive (or B: drive)
        and type INSTALL and then <Enter> and the A:> or B:> prompt.
        (For monochrome screens, type "INSTALL /M").

(4)     Follow the installation instructions.  We suggest you choose the
        Default method.

We strongly recommend that after installation you copy the file DISKINFO.DAT
to a diskette for safe storage.  This file will be in the directory you
installed The Doctor Anti-virus System to (C:\DOCTOR of you choose the DEFAULT
install).

To upgrade a previous installation, you should simply re-run the entire
installation, as described above.


                                   Page 1


Network Servers and Network Workstations

To install The Doctor to a network server you should login to the target server
with system administrator or equivalent user id.

Installing to a network file server will consist of running the NINSTALL
program.  This program will copy The Doctor files to a network directory of
your choice.  It will also build a workstation install batch file (NODI.BAT)
for installing The Doctor to all attached workstations.

(1)     Run the NINSTALL program from the disk containing The Doctor and read
        any information it presents.

(2)     When asked select the destination directory (note:  this must be a
        directory on teh network file server you are installing to).

(3)     You will then be asked if you wish to scan and checksum the network
        drives.  If you choose to perform the checks you will then be asked
        to select the drives to scan and checksum.  These drives must be
        network drives and should be only those logical drives which are mapped
        to the same network drive.  Note:  if you have two logical drives
        mapped to the same network drive (volume) select only one of the drives
        (both would be redundant).  Once you select the drives NINSTALL will
        run Doctor to scan the network and (optionally) Checksum to perform an
        initial checksum of the network executables.

If you do choose to scan and checksum the network drives in step 3 NINSTALL
will build the batch file DOCSERV.BAT in the installed directory.  You may run
this batch file at anytime to recheck the network drives.

To install The Doctor to a network workstation:

(1)     From that workstation login to the network and change to the network
        directory (i.e. CD\DOCMAST).

(2)     Run the NODI batch file.  This will copy The Doctor file to the
        workstation's hard drive.


                                   Page 2

(3)     The next time the workstation is rebooted a virus scan and initial
        checksum run will occur.  After this point The Doctor Anti-virus
        System is completely installed on the workstation.


You may place the NODI.BAT file or its contents (execution of NodInstl.Exe)
into a common login batch file or system login script.  This will insure that
all workstations when logged in will have The Doctor installed to their local
drives.  Note:  Once a workstation has Doctor installed subsequent runs of the
NODI.BAT file (or the NodInstl program) will not install The Doctor to the
workstation.  This eliminates the worry of an installation occurring during
every login.

In addition to first time installations you may also perform updates of network
workstations with the same methods described above.  For more information on
performing updates refer to the NodInstl section.


                                   Page 3


Why we do things our way


Viruses are tricky.  We have been in the anti-virus industry now for about six
years, and if there is one thing that has been repeatedly demonstrated, it is
that viruses, and virus-writers are tricky.  AND TENACIOUS!

Who would have thought that anyone would ever go to the trouble to write a
Stealth virus?  We could not believe it when we first saw the Frodo virus.

Who ever would have thought that people would have the time to write a
tunneling virus, a directory infector, a polymorphic engine, or a virus
generator?

As well as being what can best be described as cunning, they really work quite
hard, too.  At the time of writing, they were still producing between 50 to 100
new viruses per month, and there is no sign of a slow down.

What this means is that it simply is not appropriate to buy a copy of ANY anti
virus software from a shop, and then forget about it.  It also is not
appropriate to rely on just one method of testing, such as signature scanning
to find all the viruses.

We believe that the correct way to build an anti-virus software is to use many
different techniques, and arrange them in layers, so that if a virus gets past
one layer, it will be picked up by another layer.

There are really only three broad techniques that anyone can provide to detect
viruses, signature scanning, checksumming and monitoring.

THEREFORE, we provide three main programs, The Doctor, CHECKSUM and VBTsr, that
do most of hte work, and several ancillary programs such as Onceaday that help
by making administration easier.


                                   Page 4


The Programs

The Doctor Anti-virus System contains three major programs.  Each program
provides one or more ways of combating viruses.  Together the programs make a
formidable defense force.

The three programs are CHECKSUM, VBTSR and DOCTOR.

In addition The Doctor contains a number of powerful complementary programs to
provide a complete virus security system.


How CHECKSUM stops viruses

CHECKSUM is a generic virus detection program which works by adding up all the
bytes in a program and thus arriving at what's known as a "checksum" for each of
the executable (i.e. program) files on disk the first time it runs.  (A checksum
is simply a summary of the contents of a file.  All the characters in the file
are added in a special (secret) way to produce the checksum.  If any character
or program instruction changes, the calculated checksum will also change.)
After that, when you ask CHECKSUM to check the disk, it knows what the programs
on the disk look like, and is able to report any changes in programs or disk
system areas which may indicate a virus is active.

It is better to install CHECKSUM on a machine that is free of viruses, so that
it tells you as soon as a virus enters the machine.  However, even if you
install CHECKSUM on an infected machine, it will tell you something is wrong as
soon as the virus infects the next program.  In practice, the worse the
infection in your machine, and the more virulent the virus, the sooner it is
detected.  (If it is infected by a known virus then Doctor can detect it
immediately).

When CHECKSUM detects that a virus is active, it can also generically remove
many viruses from the disk.

How Doctor stops viruses

Use Doctor to check all your programs for known viruses.  Doctor searches each
program for particular virus "signatures" (sequences of instructions) which
indicate a virus in the program.

                                   Page 5


If a program has a virus, Doctor can (for most viruses) remove the virus from
the program or disk and restore the program to its origianl form. Alternatively
the Doctor can erase the program from the disk or rename it, or you can choose
to ignore the warning.

How VBTSR stops viruses

VBTSR is a small memory resident program which scans programs for known viruses
as the infected host program is run.  In this respect VBTSR is a memory
resident version of the Doctor.

You can add your own signatures for new viruses.  VBTSR can also be used to
prevent the use of any nominated programs, or allow the use of ONLY a nominated
set of programs.

VBTSR will optionally scan the boot record of diskettes as they are accessed
and the boot record when rebooting.  VBTSR will also optionally scan files when
they are opened.  VBTSR wiill then detect viruses in files being copied by disk
management utilities.


What the other programs do

DiskLok and KeyLok provide security protection from unauthorized access to your
PC and the data and programs on your fixed disk.  DiskLok also provides
automatic removal of, and recovery from, most viruses which infect the master
boot record or the active boot record of fixed disks.

Fido provides access to VBTSR when using Microsoft Windows 3.1.

GetSign can be used to extract suitable "signatures" from virus infected files
and disks.  You can use it to automatically add the msot suitable signature to
the VBTSR data file.

List displays and prints text files.  Use it to display the log files produced
by The Doctor Anti-virus System programs.

OnceADay is a batch enhancement utility which will run a nominated program
either once a day, or once a week on a nominated day.

Install performs the initial installation of The Doctor Anti-virus System
programs to your fixed disk.


                                   Page 6

What The Doctor Anti-virus system can/cannot do

The Doctor Anti-virus system cannot completely prevent a virus from entering
your computer and destroying data.  (Despite the claims of less objective
software houses, there is no way to prevent all virus attacks completely.)

As some writers have commented, the only complete way of preventing virus
infection is to switch your machine off (permanently).  We do not pretend to
provide complete protection; it is impossible to do so for the PC.  What we do
provide is the best protection that money can buy.

The Doctor will alert you to the presence of most known viruses.  If Doctor
does detect a known virus, you then can act to isolate the virus and eradicate
it.  Doctor will do most of this for you.

At present there is no 100% way of known, without running a program, if it is
(or has) a virus.  New viruses are appearing regularly and other viruses mutate
during reproduction.  It also is very easy for hackers to take a known virus
and rearrange the "signature" bytes.  This renders the virus invisible to virus
scanning programs.  (Note that changes caused by the virus are always detectable
by CHECKSUM).

VBTSR can prevent many viruses from damaging the critical areas of your disk
and intercepts many viruses during the infection process.  It can also prevent
viruses from writing to programs which you designate as being write-protected.

VBTSR cannot prevent all viruses from altering data files on an unprotected
disk.  Some sophisticated viruses may bypass VBTSR by addressing the disk
controller directly.

CHECKSUM provides the most secure protection from viruses available.  CHECKSUM
maintains a highly encrypted checksum on each program.  If anything tampers
with the program in any manner CHECKSUM will alert you.

CHECKSUM also maintains a watchon the system areas of the fixed disks in the
same way.  CHECKSUM alerts you to any viral infection of the boot record or
other vital areas.

                                   Page 7

Any warnings CHECKSUM gives you should be examined very carefully.  Its
perceptions will often be better than your own!

Because CHECKSUM (necessarily) take a little time to run, it is impractical to
use it before running each and every program during the day.

CHECKSUM should be run each time you reboot, or once a day, whichever is most
convenient.  In this way you can be assured that your programs are intact at
start of each session.  CHECKSUM also provides generic recovery from all boot/
system area viruses, and generic recovery from many program viruses.

Although there is no 100% effective method of stopping viruses, The Doctor
products provide the best protection available.


Your plan


Use The Doctor to check your fixed disk and any disks you obtain from other
sources for any known viruses.  Be particularly careful with disk from public
domain sources and bulletin boards.  Run CHECKSUM over your disks and programs
to do its initial checksums.  Use CHECKSUM regularly to do a comprehensive
check for changes to programs or disks.

IMPORTANT:  Please do not rely solely on signature scanning and TSR monitors to
detect viruses.  These are useful aids, but only CHECKSUM can be relied upon to
always detect a virus.

                                   Page 8


