Welcome to Dr Solomon's Anti-Virus Toolkit for Windows 3.x Version 7.74
-----------------------------------------------------------------------

This readme contains important information on developments to the Toolkit.


CONTENTS

1. Disable WinGuard Before Upgrading to Windows 95
2. Comments in Extra Drivers
3. Macro Heuristics
4. WinGuard 'Scan on writes' Doesn't Delete Files
5. Specifying WinGuard Extra Drivers - Use Full Path
6. Magic Bullet and Extra Drivers
7. CleanPart Disk Damage Warning
8. WinGuard Auto-Disinfect
9. Excel Macro Virus Scanning
10. If a FindVirus Repair Fails
11. WinGuard and Extra Drivers
12. Specialized Drivers and booting from diskette
13. Discontinued switch - /GURU
14. New TKUTIL Command ADD WINGUARD
15. New TKUTIL command REMOVE WINGUARD
16. New TKUTIL Command INIUPDATE
17. New Windows FindVirus Switch /NOEXIT
18. New Windows FindVirus Switch /AUTOEXIT
19. New DOS FindVirus Switch /NOOLE
20. Microsoft Expand Support
21. New VirusGuard switch /NOSCAN
22. New VirusGuard switch /NFC
23. Magic Bullet and Multiple Partitions
24. New FindVirus Site Licence Installer
25. Manual Revisions
26. Distributors
27. News about Dr Solomon's Anti-Virus Toolkit


1.  Disable WinGuard Before Upgrading to Windows 95
---------------------------------------------------
 
If you intend upgrading your Windows 3.x installation to Windows 95, you 
must first disable Windows 3.x WinGuard (un-check the 'WinGuard Enabled' 
option in the WinGuard Configuration dialog).


2.  Comments in Extra Drivers
-----------------------------
 
You can now add your own comment text to extra driver files (equivalent of 
'REM' lines in batch files). Open the extra driver file in a text editor, 
such as 'Notepad', to add and view your text. Start each line of comment 
text with a ';' (semi-colon).


3.  Macro Heuristics
--------------------
 
FindVirus's 'Use heuristic analysis' option, which allows the detection of 
previously undiscovered virus code, now extends to finding possible new 
macro virus code.


4.  WinGuard 'Scan on writes' Doesn't Delete Files
--------------------------------------------------
 
The manual states that when the WinGuard 'Scan on writes' option is enabled, 
infected files are deleted. This is an error, infected files are not deleted 
(note that although any infected files are not deleted, you will not be able 
to access them without WinGuard alerting).


5.  Specifying WinGuard Extra Drivers - Use Full Path
-----------------------------------------------------
 
Please note that when specifying an extra driver for WinGuard, using the 
'Configure Protection' dialog of the WinGuard configuration program, the 
full path of the extra driver file must be specified.


6.  Magic Bullet and Extra Drivers
----------------------------------
 
If there is an extra driver file called EXTRA.DRV in the Toolkit's 
directory, this will be used automatically by FindVirus. This includes 
FindVirus as run from the Magic Bullet diskette.


7.  CleanPart Disk Damage Warning
---------------------------------
 
You should only use CleanPart to remove viruses from boot or partition 
sectors if you have first tried using FindVirus, and this has failed.

If it is used incorrectly, CleanPart may damage your disk data. For this 
reason it must only be used under supervision by Dr Solomon's Technical 
support staff. See the printed manual or on-line help for the number to 
call.


8.  WinGuard Auto-Disinfect
---------------------------
 
The 'WinGuard configuration' dialog has a new 'Auto-Disinfect' option. If 
this is enabled, then whenever a virus is discovered it is automatically 
removed, then access is granted. You are notified that the disinfect has 
taken place. If the disinfect fails, then access is blocked, in the same way 
it would be if 'Auto-Disinfect' was not enabled.


9.  Excel Macro Virus Scanning
------------------------------
 
To combat Excel macro viruses, the Excel file extensions .XLA, .XLB and .XLS 
have been added to the group of file extensions which FindVirus and WinGuard 
scan by default.


10.  If a FindVirus Repair Fails
-------------------------------

If a FindVirus repair fails you should make the following checks and retry 
the repair:

* If the repair is being attempted on a diskette, make sure that the
  diskette is not write protected.

* Make sure the logged on user's account has write access to the file.

If the repair still fails contact Dr Solomon's support.


11.  WinGuard and Extra Drivers
------------------------------

WinGuard can be configured to use an extra driver file. If the extra driver 
file is called EXTRA.DRV, and it is in the Toolkit's directory, you now do 
not need to specify this, as it will be used automatically.


12.  Specialized Drivers and booting from diskette
-------------------------------------------------

If you booting from a system diskette, and you have a hard disk drive 
requiring a special driver (such as a compressed drive or extended IDE 
drive), make sure that clean copies of the relevant drivers are on the 
system diskette. The PC can then be booted clean with these drivers in 
place. If these drivers are not used, our anti-virus scanner will not be 
able to access the hard disk drive properly.


13.  Discontinued switch - /GURU
-------------------------------

The FindVirus switch /GURU has been discontinued. All references to it have 
been deleted from the manual.


14.  New TKUTIL Command ADD WINGUARD
------------------------------------

In the table on TKUTIL utilities (currently on page 167) there is an 
additional entry:

ADD WINGUARD

Adds lines to Windows .INI files to start WinGuard automatically on boot up

The following new sub-section has been added to the "TKUTIL" section:

Starting WinGuard automatically
-------------------------------

The ADD WINGUARD command adds the lines to WIN.INI and SYSTEM.INI needed to 
start WinGuard automatically on Windows startup.

It adds "....(path)....\wgfe.exe" to the "run" line of WIN.INI, and adds 
"device=....(path)....\winguard.386" to the start of the "[386Enh]" section 
of SYSTEM.INI.

The command has the following syntax:

TKUTIL ADD WINGUARD directory1 directory2

where:

directory1 is the directory the Toolkit was installed into - contains 
"winguard.386".

directory2 is the Windows directory - contains "WIN.INI" and "SYSTEM.INI".


15.  New TKUTIL command REMOVE WINGUARD
---------------------------------------

In the table on TKUTIL utilities (currently on page 167) there is an 
additional entry:

REMOVE WINGUARD

Removes the lines from the Windows .INI files that start WinGuard on boot 
up.

The following new sub-section has been added to the "TKUTIL" section:

Disabling automatic WinGuard startup
------------------------------------

The REMOVE WINGUARD command removes the lines from "WIN.INI" and 
"SYSTEM.INI" that start WinGuard on Windows startup.

It has the following syntax:

TKUTIL REMOVE WINGUARD directory

where directory is the Windows directory - contains "WIN.INI" and 
"SYSTEM.INI".


New TKUTIL Command DISKSPACE
----------------------------

The summary table of the TKUTIL utilities (currently on Page 167) will 
contain a new entry:

DISKSPACE   Reports the free space on the drive.

The following new sub-section has been added to the "TKUTIL" section:

Reporting the free disk space
-----------------------------

The DISKSPACE command returns an error level of the remaining space on the 
drive, rounded down to an integral number of megabytes.

It also displays on the screen the remaining space on the drive in bytes.


16.  New TKUTIL Command INIUPDATE
--------------------------------

In the table on TKUTIL utilities (currently on page 167) there is an 
additional entry:

INIUPDATE

Synchronizes .INI files.

The following new sub-section has been added to the "TKUTIL" section:

Synchronizing .INI files
------------------------

The INIUPDATE command synchronizes Windows .INI files. It copies every 
section from the source .INI file into the destination .INI file, 
overwriting any section in the destination file which already existed.

It has the following syntax:

TKUTIL INIUPDATE filename1 filename2

where:

filename1 is the source file's name. filename2 is the destination file's 
name.


17.  New Windows FindVirus Switch /NOEXIT
----------------------------------------

In the reference table on FindVirus switches (currently on page 184) there 
is an additional entry:

/NOEXIT

Force Windows FindVirus to continue scanning even if the "Exit" button is 
pressed.


18.  New Windows FindVirus Switch /AUTOEXIT
-------------------------------------------

In the reference table on FindVirus switches (currently on page 184) there 
is an additional entry:

/AUTOEXIT

This switch Forces FindVirus to quit without displaying a dialog if the scan 
finds no viruses.

In the Section "How FindVirus Works" there is an additional sub- section:

Suppressing All Clear dialog
----------------------------

If no viruses are found FindVirus displays a dialog containing an "All 
Clear" message and an "OK" button, which you must press to continue.

/AUTOEXIT Forces FindVirus to exit without displaying a dialog if the scan 
finds no viruses.

If a virus is found you see the report dialog as normal.


19.  New DOS FindVirus Switch /NOOLE
------------------------------------

In the reference table on FindVirus switches (currently on page 184) there 
is an additional entry:

/NOOLE

This switch stops DOS FindVirus scanning inside Microsoft Word document 
files and templates for macro viruses, such as "WM Concept".


20.  Microsoft Expand Support
-----------------------------

"Microsoft Expand" has been added to the list of supported file compression 
formats which is currently on Page 79.

"Microsoft Expand" has been added to the list of compression formats scanned 
when the /UNZIP switch is specified. This is currently detailed on Page 84.

In the reference table on FindVirus switches (currently on page 185) 
"Microsoft Expand" has been added to the list of formats scanned when the 
/UNZIP switch is specified.


21.  New VirusGuard switch /NOSCAN
----------------------------------

Note: This switch was introduced initially as a workaround for DECPathworks 
users whose network drives are marked as removable, and so are included by 
/COPY=FLOPPY in the scan.

In the reference table on VirusGuard switches, currently on Page 186, there 
is an additional entry:

/NOSCAN="string"

Exclude drive letters contained in "string" from scan. Letters must be 
uppercase; eight maximum.

In the "Running VirusGuard" section there will a new subsection:

Excluding Drives From Scan
--------------------------

You can exclude drives from the scan.

/NOSCAN="string" Exclude drive letters contained in "string" from scan.
Letters must be uppercase; eight maximum.

For example:

GUARD /NOSCAN="CD"

stops VirusGuard scanning the C: and D: drives.


22.  New VirusGuard switch /NFC
--------------------------------

In the reference table on VirusGuard switches, currently on Page 186,
there is an additional entry:

/NFC

Stop VirusGuard checking whether a NetWare server is running FAM (File
Access Monitor), before scanning a file accessed on the server.

In the "Running VirusGuard section" there will a new subsection:

Stopping FAM check clashing with NetWare and PC-NFS
---------------------------------------------------

Before scanning a file accessed from a NetWare server, VirusGuard checks
whether the server is running FAM (File Access Monitor). This is to
prevent wasting time in scanning a file which the FAM has already
scanned.

When the access is by PC-NFS however, the check for the FAM prevents all
access to the file.

Specifying /NFC disables the FAM check. This allows access to the files
but causes files to be scanned twice (this is not a major problem
however).


23.  Magic Bullet and Multiple Partitions
-----------------------------------------

Problems may be encountered when using Magic Bullet to scan disks with
multiple partitions. Some partitions may not be recognized, some
partition drive letters may be reported incorrectly.


24.  New FindVirus Site Licence Installer
-----------------------------------------

There is a new procedure for installing FindVirus from site licence
diskettes.

This will be covered by the following new section in the "Installing the 
Toolkit" chapter of the manual:

Installing FindVirus from site licence diskettes
------------------------------------------------

FindVirus is available separately as a site licence product. To install
FindVirus from the site licence diskettes:

1. Insert the site licence installation disk 1 and switch to the
diskette drive.

2. If you wish to install FindVirus into the directory TOOLKIT on the c:
drive (this will be created if it doesn't already exist), type:

install [return]

3. If you wish to install FindVirus into a directory other than TOOLKIT
use the command:

install [drive:\directory path]

The directory will be created if it doesn't already exist. Type for
example:

install c:\avtk [return]

4. If you followed Step 3 and didn't specify a directory, you will need
to respond to the prompt:

This batch file will copy the files to the C:\TOOLKIT directory. If you
want the files to be copied somewhere else.  Press the CTRL and C keys
together and then run INSTALL [drive:\directory path] Press any key to
continue . . .

5. As the installation continues you see a listing of the files as they
are copied to the hard drive. Follow the prompt to install the site
licence disk 2. More files are copied and the installation is complete.

6. If necessary use the standard Windows procedure to create a new
program group. Use the standard Windows procedure to create a new
program item (icon) link to FindVirus.

Start these procedures at the Program Manager by selecting "New" from
the "File" menu. Select the "Program Group" or "Program Item" radio
button and click on OK. Click on "Help" for more details. When creating
a program item specify ..path...\wfindvir.exe  in the "Command Line"
box, and specify the Toolkit's directory in the  "Working Directory"
box.

25.  Manual Revisions
--------------------

In the "What you can do" section in the preface, the following sub-section
will be added:

Avoiding encryption and password protection
-------------------------------------------

Encryption and password protection are ways of protecting files from
unauthorized access. You can, for example, password protect Word
documents.

Unfortunately files protected in this way cannot be accessed by scanning
programs, which can lead to viruses remaining undetected. Files may
contain embedded objects (Word documents containing macros for example)
which may be infected. Non-password protected files can be scanned, and
the virus found, password protected files cannot be scanned.

Note that infected Word "documents" are actually templates which have been 
disguised by the virus as documents.
---------------------------------------------------------------------------
New text has been added to the "tip" paragraphs on booting clean from a 
system diskette, which occur at several points in the manual; see 
"Specialized Drivers and booting from diskette" below.
---------------------------------------------------------------------------
Wherever "PKLite" is stated as being supported in the manual, this is now
qualified as being Version 1.0 only.
---------------------------------------------------------------------
In the sub-section "Configuring WinGuard" in the section "Using WinGuard" in 
the chapter "Guarding against viruses", the explanation of the "Extra 
Driver" option has been amended - see "WinGuard and Extra Drivers" above.
------------------------------------------------------------------------
In the section "The Virus Encyclopedia" in the "Checking for viruses"
chapter, the text after the screen example has been replaced by the
following text:

For the virus highlighted in the "Viruses" list on the right hand side
of the dialog, the "Description" provides the following information:

* How common it is.

* How infectious it is.

* How much damage it does.

* What is infected: files, boot sectors or partition sectors.

* Whether or not it has memory-resident capabilities.

* If it uses stealth.

* If it is polymorphic.

* Any aliases it is known by, and whether there are any variants.

A virus can be highlighted in the "Viruses" list by clicking on it with
the mouse. Keyboard users can move the selection bar using the cursor
keys.

Use the "Locate" box to jump to a specific part of the "Viruses" list.
The virus highlighted is the one whose name starts with the string of
letters you type into the box. For the first few letters you type
several viruses will probably match; the first one in the list will be
highlighted. As you type more letters the identification will get more
specific. The "Search" option is more powerful as it can find the
specified string occurring anywhere in the virus name.

The "Search" button finds each virus whose name, or the name of any of
its aliases, contains the string of letters you enter.

Once you have run a search you can step to the next found match using
the "Next" button.

The "Print" button outputs the current description to the default
printer port.
---------------------------------------------------------------------------
The procedure in the "Single button repair" section in the "If you Find a
Virus" chapter, has been amended to read:

1. Tab to the Drives box.

2. Use the up and down arrow keys to highlight the drive on which you
have found a virus.

3. Press the space bar to select the drive. Select Repair.
---------------------------------------------------------------------------
In the section "How FindVirus Works" in the "Advanced Virus Detection" 
chapter the first paragraph has been amended to:

FindVirus searches disks for viruses contained within files, boot and
partition sectors. An example of the code of each known virus is stored
in a virus driver file; and FindVirus identifies a virus when it finds
an occurrence of one of these examples. FindVirus can also use more
sophisticated techniques for identifying possible new virus code.
---------------------------------------------------------------------------
In the sub-section "Compressed and archived files" in the section "How
FindVirus works" in the chapter "Advanced Virus Detection" the following
text has been added:

In the report after a scan including ZIP files, it may appear the same
file is being reported twice. This is not actually the case: when
reporting the path of files within a ZIP file, directories after the ZIP
file entry are missed out. This means, for example, that

C:\ZIPFILE\INTHEZIP.XXX

and

C:\ZIPFILE\ADIR\INTHEZIP.XXX

both appear as C:\ZIPFILE\INTHEZIP.XXX in the report.
---------------------------------------------------------------------------
To the "How FindVirus works" section of the "Advanced Virus Detection" 
chapter, the following sub-section has been added:

DOS FindVirus Memory Usage
--------------------------

When you start a DOS FindVirus scan using the DOS Toolkit User Interface,
or by using the "findviru" command, an automatic choice is made between
three methods of carrying out the scan. The fastest method which can run
in the available memory is chosen. In order of speed, the methods are:

1. Using FV386.EXE (this is the fastest method, and requires most
   memory).

2. Using FV86.EXE in single pass mode.

3. Using FV86.EXE in multi-pass mode.

Look at the on-screen integrity check message to see which module is
being used. You will see, for example, "Integrity checking
C:\toolkit\fv86.exe". The pass number will be displayed on screen if
fv86.exe is running in multi-pass mode.

You will achieve faster scanning if, by making more memory available,
you can allow a faster method to be used.

In addition to its speed advantage, you will need fv386 to run if you
want to scan inside compressed and archived files using the "findviru
/unzip" or "findviru /pack" command. If fv386 cannot run in this case, you
will see an "unable to understand switches" message.

fv86 uses conventional (base) memory only. If you find fv86 is running
in multi-pass mode, by making more conventional memory available to it,
you can allow it to run in single pass mode. Methods of freeing up
conventional memory include "loading high", using MemMaker, or manually
re-arranging your config.sys and autoexec.bat files.

fv386 uses extended or expanded memory; you will have this if you are
running Windows. You can make more memory available to fv386 by reducing
the number of programs running (including TSRs) to free up the existing
memory.

If low memory is a persistent problem you might consider adding more memory 
to your PC.
---------------------------------------------------------------------------
In the "Scanning specific drives" sub section of the "Running FindVirus,
from the command line" section of the "Advanced Virus Detection" chapter,
the explanation of the /PAUSE switch has been amended to "Prompts for the
drive letter before scanning.".
---------------------------------------------------------------------------
In the "Scanning specific drives" sub section of the "Running FindVirus,
from the command line" section of the "Advanced Virus Detection" chapter,
more "for examples" have been added, as follows:

For example:

FINDVIRU /D=A /PAUSE

or

FINDVIRU /PAUSE

first display the prompt "Please insert a disk and press the drive
letter or Esc to quit". If you are running FindVirus from the
installation diskette this lets you swap the installation diskette for
the one you want to scan, rather than waiting until after the
installation diskette has first been scanned (which would happen without
the /PAUSE switch).
---------------------------------------------------------------------------
In the "Producing reports" sub-section of the "Running FindVirus from the
command line" section of the "Advanced Virus Detection" chapter, the
/REPORT=file switch paragraph is now:

/REPORT=file

Directs the report to a file as well as to the screen. When no file is
specified the report file defaults to "FINDVIRU.REP". When a file but no
path is specified the file is created in the Toolkit directory (usually
"TOOLKIT"). If you are running FindVirus from the original write
protected diskette, you must specify a file on the C: drive. The /APPEND
switch appends the report to an existing file.
---------------------------------------------------------------------------
The "Defining drivers" section of the "Running FindVirus from the
command line" section of the "Advanced Virus Detection" chapter, has been
amended to:

FindVirus can only detect viruses which have an entry in the driver file
FINDVIRU.DRV. A new version of FINDVIRU.DRV is generated and released
monthly, to include entries for newly discovered viruses. To cover the
period until the next release an extra driver, containing only entries
for new viruses, is occasionally made available via the Dr Solomon's
Bulletin Board.

Extra drivers may be implemented in one of the following ways:

* As the file "EXTRA.DRV" in the Toolkit directory. When present this
file is used automatically and need not be specified with a switch.

* As a file with any other name, in which case you must specify it with
the FindVirus switch:

/EXTRA=file.

Note that if FindVirus cannot locate the specified file there is no
specific alert. The best way to check that the extra driver is being
used is to note the "Searching for..(number of viruses)" item in the
dialog you see on scanning. If this number increases then the extra
driver is in use.
---------------------------------------------------------------------------
The "Speeding up FindVirus" sub-section of the "Hints and tips" section of
the "Advanced Virus Detection" chapter has been amended to:

See "DOS FindVirus Memory Usage" on Page 81 for details of how freeing
up memory can speed up DOS FindVirus.

The section referred to is the new section detailed above.
--------------------------------------------------------------------------
In the "Executable files" sub-section of the "How VirusGuard works" section
of the "Advanced Virus Protection" chapter, the extensions "DOC" and "DOT"
has been deleted from the list of file extensions scanned by default.
--------------------------------------------------------------------------In 
the "Specifying a keyword" sub-section of the "Running ViVerify from the
command line" section of the "Advanced Virus Checking" chapter, the
/X=keyword switch explanation has been amended to:

/X=keyword

Specifies a keyword to be used when creating or checking fingerprints.
The keyword must be at least eight alphabetic characters; do not use
accented characters as found on some non-UK keyboards.
--------------------------------------------------------------------------
In the "Replacing partition sectors" sub-section of the "Replacing partition
sectors" section of the "Virus Repair and Removal" chapter, the following
paragraph has been inserted:

Problems may be encountered when using the /FIX option with drives
containing an EZDrive partition. Phone Dr Solomon's Technical Support
for advice before attempting this.
--------------------------------------------------------------------------
The sub-section "Start-up order" in the section "Running VirusGuard on a
network" in the "Using the Toolkit on a Network" chapter, has been amended
to:

In general it is best to start VirusGuard as early as possible in the
Workstation's start up routine (by including the GUARD command at the
beginning of the AUTOEXEC.BAT for example). Once VirusGuard is started
it can check the remaining items(drivers etc.) in the routine, as they
are started.

When the network drivers start they take over some of the functions that
VirusGuard normally intercepts to allow it to examine files. On Novell
networks, for example, this usually means that VirusGuard cannot check
files as they are accessed over the network. For this reason you must
reactivate VirusGuard after loading the network drivers, but before
login, using one of the following methods:

* Run GUARD.COM again with the switch /REGUARD. 

* Run the command TKUTIL REGUARD. 

* Run the command TKUTIL RETSR. See "Restarting TSRs" on page 180.

NOTE: The switch /REGUARD will not function correctly when used with
NetWare VLM drivers earlier than 8th December, 1993. These drivers
should be updated.

If VirusGuard is not active at login to a Novell server, and the server
is set up for VirusGuard enforcement on workstations, the login will
terminate.

Do not include the GUARD command within the login script. Running any
TSR within the login script causes the memory area to be split into two
parts, resulting in messages such as:

Not enough memory to load program
---------------------------------------------------------------------------
In the sub-section "Reporting batch file run" in the section "TKUTIL" in
the "Toolkit Utilities" chapter, the first two paragraphs have been
amended to:

TKUTIL LASTRUN returns the number of days since it was last run. You can
use it in a batch file to indicate when the batch file was last run. Use
it in AUTOEXEC.BAT, for example, to ensure you only scan on the first
boot up of the day (dont scan if TKUTIL LASTRUN=0).

You can use it in conjunction with TKUTIL WEEKDAY to write a batch file
which will start a scan if run on a particular weekday, and if there has
not been a scan already that day. See "WEEKDAY.BAT" on page183.

The syntax is:
---------------------------------------------------------------------------
In the "Adding text to a file" sub-section of the "TKUTIL" section of the
"Toolkit Utilities" chapter, the following paragraph has been inserted:

If you specify /AFTER and "text" is already in the file, and after
"phrase", then "text" will not be inserted. If you specify /AFTER and
"text" is already in the file, but before "phrase", then "text" will be
inserted after "phrase" (so it will occur in the file twice).

And the second example of using TKUTIL ADD has been deleted. This is
because it adds the AUTOEXEC.BAT text after the line containing "login",
but it should always be added before the login command.
---------------------------------------------------------------------------
The sub-section "Removing other anti-virus packages" in the "TKUTIL"
section of the "Toolkit Utilities" chapter, has been amended to:

Removing other anti-virus packages
----------------------------------

If you have previously used other anti-virus software, you can remove
any references to them from your system files using the FROM command.
The command has the following syntax (note there is no space after
"FROM"):

TKUTIL FROM[CPAV][NAV][MSAV] [drive\directory]

where:

CPAV               removes all references to the Central Point 
                   anti-virus package.

NAV                removes all references to the Norton anti-virus
                   package.

MSAV               removes all references to the Microsoft anti-virus
                   package.

drive\directory    is where the package is installed. If you do not
                   specify this you are prompted for it.

.........rest of section unchanged.............
---------------------------------------------------------------------------
In the "Examples of batch files" section of the "Toolkit Utilities"
chapter, a new batch file example sub-section has been added:

WEEKDAY.BAT
@echo off
cls
echo This batch file will run FindVirus
echo automatically echo every Monday; but only
echo the first time the PC is  booted.
echo.
echo TKUTIL LASTRUN returns an errorlevel
echo corresponding to the number of days since it
echo was last run. After running TKUTIL LASTRUN,
echo errorlevel=1 is true if the program has
echo not been run for one or more days;
echo errorlevel=0 is true if the program has
echo been run the same day. 
echo.
echo TKUTIL WEEKDAY returns errorlevels
echo corresponding to the days of the week. By
echo checking for the appropriate errorlevel, a
echo program may be 'scheduled' for a specific
echo day.
echo.
pause
cls
echo FindVirus returns errorlevels appropriate
echo to the status of the disk being checked. In
echo this batch file, standard FindVirus
echo errorlevels are used to display an
echo appropriate message to the user. If the
echo /EXTERROR parameter is added to the
echo FindVirus command line, errorlevels may be
echo returned for more specific events [see the
echo Windows & DOS Anti-Virus Toolkit manual, p90
echo for further details].
echo.
echo TKUTIL ALARM produces a visual and audible
echo warning. In this batch file, TKUTIL ALARM is
echo run if FindVirus detects a virus.
echo.
echo For a complete list of TKUTIL options, see
echo the Windows & DOS Anti-Virus Toolkit manual,
echo page 167
echo ________________________________________________
echo.
pause
cls
TKUTIL LASTRUN /SILENT
if errorlevel=1 goto RUN
if errorlevel=0 goto EXIT
:RUN
TKUTIL WEEKDAY /SILENT
if errorlevel=6 goto SATURDAY
if errorlevel=5 goto FRIDAY
if errorlevel=4 goto THURSDAY
if errorlevel=3 goto WEDNESDAY
if errorlevel=2 goto TUESDAY
if errorlevel=1 goto MONDAY
if errorlevel=0 goto SUNDAY
:SATURDAY
goto EXIT
:FRIDAY
goto EXIT
:THURSDAY
goto EXIT
:WEDNESDAY
goto EXIT
:TUESDAY
goto EXIT
:MONDAY
FINDVIRU /LOCAL
if errorlevel=2 goto VIRUS
if errorlevel=1 goto PROBLEM
if errorlevel=0 goto ALL_CLEAR
:VIRUS
echo A virus has been detected, 
echo please contact your network manager.
TKUTIL ALARM
:PROBLEM
echo A problem has occurred while
echo FindVirus was scanning the 
echo disk, please contact your network manager.
TKUTIL ALARM
:ALL_CLEAR
echo This PC is virus-free.
goto EXIT
:SUNDAY
goto EXIT
:EXIT
---------------------------------------------------------------------------
In the "Switches" sub-section of the "FINDVIRUS command" section of the
"Reference information" chapter, the table entry on the /INI switch has
been deleted.

Also the table entry for the /EXTRA=file switch has been amended to:

Use specified additional virus driver. Note that this switch need not
be used if the file's name is "EXTRA.DRV" and it is in the Toolkit
directory.

Also the table entry for the /PAUSE switch has been amended to:

Prompts for the drive letter before scanning.
---------------------------------------------------------------------------
The section "WTKUTIL command" in the "Reference Information" chapter should
be ignored. This section has been replaced by the following section on the
TKUTIL command:

TKUTIL command
--------------

Syntax

TKUTIL [switches] COMMAND [switches] [optional parameters ...] switches

Switches
--------

/help or /?

display help, then continue with valid commands, if any

Commands
--------

ADD

Adds text to a specified place in a text file.

ADUPDATE

Replaces an older file with a newer one of the same name.

ADD WINGUARD

Adds lines to Windows .INI files to start WinGuard automatically on
Windows startup.

ALARM

Generates a visible alarm.

CPU

Reports the main processor type.

DELETE

Deletes a line from a text file.

DRIVETYPE

Reports the current disk drive type.

FORMFEED

Sends a form feed character to the printer.

FROM

Removes references to other anti-virus products from your system files.

GUARDCHECK

Indicates whether or not VirusGuard is installed.

INIUPDATE

Synchronizes .INI files.

LASTRUN

Indicates when the program was last run.

LOCK

Forces a cold boot of the PC.

MEMTYPE

Reports the type of memory installed.

MKDIR

Makes a new directory.

MONTHDAY

Reports the day of the month.

REGUARD

Reinitializes VirusGuard after network start-up.

REMOVE WINGUARD

Removes the lines from the Windows .INI files that start WinGuard on
Windows startup.

RETKEY

Reports the upper-case ASCII keystroke.

RETSR

Reinitializes all Toolkit TSRs after network start-up.

RFCHECK

Indicates if RingFence is installed.

SEARCH

Searches an ASCII file for a given phrase.

TECHFILE

Generates a file containing system information.

TSRMAP

Returns a list of programs in memory.

TUNE

Plays a tune.

UPDATE

Replaces an older file with a newer one of the same name.

WEEKDAY

Returns the day of the week.
----------------------------------------------------------------------------
 Wherever in the manual a list of file extensions that are scanned by 
default appears, for both WinGuard and FindVirus, '.XLB' has been added. See 
also 'Excel Macro Virus Scanning above'.


26.  Distributors
----------------

Argentina
NextVision
Tel : +54  1375 2851

PC LAND
Tel: +54 1334 1474

Australia
Loadplan Australasia Pty Ltd
Tel: +61 3 9690 0455

Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, UAE & Egypt
Library & Business Interiors International (Malta) Ltd
Tel: +356 344 257

Belgium, Luxembourg & Netherlands
Data Alert International B.V.
Tel: +31 70 307 7111

Brazil
PC Software e Consultoria Ltda
Tel: +55 21 537 0405

Canada
Sensible Security Solutions
Tel: +1 613 623 6966

Chile, Bolivia, Ecuador, Peru, Venezuela & Central America
Bysupport Computacion SA
Tel: +56 2231 0308

Croatia
GIPRO Informatika D.o.o
Tel: +38 551 425 110

Cyprus, Greece & Israel
AEC Consultants
tel: +357 4 656 108

Czechia
PCS Software spol sro
Tel: +42 2 42 3962

Denmark
Swanholm Distribution A/S
Tel: +45 44 92 9393

Finland, Estonia, Lithuania, Latvia, Russia
QA Information Security OY
Tel: +358 9 502 1947

France
AB Soft
Tel: +33 1 69 33 70 00

Germany, Austria and Switzerland
Dr Solomon's Software GmbH
Tel: +49 (0)1805 237678

Ghana, Ivory Coast & Sierra Leone
Software Marketing Consultancy
Tel: +233 2755 7506

India, Bangladesh & Nepal
IT Secure
Tel: +91 22 643 1233

N&N Systems & Software
Tel: +91 22 368 0512

Iran
Shabakeh Gostar Corporation
Tel: +98 21 876 7615

Ireland
Priority Data Systems Ltd
Tel: +353 1 284 5600

Italy
Siosistemi srl
Tel: +39 30 24411

Kenya & Ethiopia
Memory Masters
Tel: +254 2 751 916

Madagascar
Ireland Blyth
Tel: +261 2 242 90

Mauritius
Formation Recrutment et Conseil en Informatique (FRCI)
Tel: +230 208 7785

Malta
Panta Computer Co. Ltd
Tel: +356 492 741

Mexico
Grupo ASISA
Tel: +52 5 254 3948

Norway
Swanholm Distribution (Norway) AS
Tel: +47 2289 0000

Pakistan
Premier Systems (PVT) Ltd
Tel: +92 21 242 9051

Poland
Dagma sp. z o o
Tel: +48 32 102 1122

System 3000
Tel : +48 12 137 722

Portugal
RSVP Consultores Associados Lda
Tel: +351 2830 0741

Slovakia
Lynx sro
Tel: +42 95 62 27309

South Africa
BSS (Pty) Ltd
Tel: +27 11 444 8800

South East Asia, Korea, Hong Kong, Indonesia, Singapore, China, Taiwan
Digitus Computer Systems
Tel: +65 337 1945

Spain
Economic Data sl
Tel: +34 1442 2800

Sweden
QA Information Security AB
Tel: +46 8580 100 02

Tunisia
International Computers & Networks
Tel: +21 61 78 72 56

Turkey
Logosoft Yazilim San Tic Ltd
Tel: +90 216 348 1399

United Kingdom
Dr Solomon's Software Ltd
Tel: +44 (0)1296 318700

United States of America
Dr Solomon's Software, Inc.
Tel: 1 888-DRSOLOMON (888-377-6566)

Trinidad & West Indies
Global Traders Inc Ltd
Tel: +1 809 662 6256

Zimbabwe
CSS Computer Services
Tel: +263 4 882 072

Ryval Computers (Private) Ltd
Tel: +263 4 751 808


27.  News about Dr Solomon's Anti-Virus Toolkit
-----------------------------------------------

* The June 97 edition of PC Home magazine reviewed Dr Solomon's
  Anti-Virus Toolkit: "Dr Solomon's is arguably the best virus
  protection for your PC to date.  It's feature packed and uses
  powerful detection and prevention techniques... Dr Solomon's
  is a powerful, yet simple to use, tool to have in your arsenal".

* In May 97 Evesham Micros online magazine reviewed the Windows 95
  versions of Dr Solomon's Anti-Virus Toolkit and Norton AntiVirus.
  Dr Solomon's came out in top place: "Dr Solomon's is ideal for
  regular Internet users, as it is capable of virus checking the
  type of compressed files found on the Internet.  As such, it's
  the only package to offer complete virus protection... The extensive
  capabilities of Dr Solomon's Anti-Virus Toolkit are highly
  recommended".

* The May 1997 edition of Virus Bulletin conducted a comparative review
  of over 20 anti-virus products for Windows 95.  Not only did Virus
  Bulletin test the detection results of on-demand scanners, but
  on-access scanners as well.  Dr Solomon's was one of only two products
  to score a perfect 100% in the boot sector, file, and polymorphic
  virus detection tests for both the on-demand *and* on-access scanners.

* The April 97 issue of PC Answers awarded Dr Solomon's Anti-Virus
  Toolkit with the title "Recommended" and described it "as one of
  the best". 

* In April 97 Personal Computer World reviewed Dr Solomon's HomeGuard
  AntiVirus, concluding: ""Easy to use, top-class virus detection."

* What Personal Computer's April 97 edition reviewed Dr Solomon's
  HomeGuard AntiVirus, awarding it the maximum 5 stars: "Found all
  the viruses we threw at it, and as it uses the same virus engine
  as its big brother product, we expect it's going to be the
  standard that all other virus programs have to match."


CompuServe: GO DRSOLOMON
WorldWide Web: http://www.drsolomon.com
Anonymous ftp: ftp://ftp.drsolomon.com
