1.0 What is F-STOPW

F-STOPW is a memory resident anti-virus program which provides Windows 95/98
users with real time ("on access") scanning. The program does not run under
Windows 3.x or Windows NT. Unlike VIRSTOP.EXE which was included in versions
2.x of F-PROT and only ran under older versions of Windows, F-STOPW has the
same detection rate as the main scanner F-PROT. We do not recommend that you
run F-STOPW simultaneously with other resident antivirus programs.


2.0 Installation of  F-STOPW

The file SETUPFS.EXE is an installation file for F-STOPW. When it is run the
program starts to set itself up automatically.


3.0 Using F-STOPW 

When installation is complete, F-STOPW is run and on every start-up (bootup).

When F-STOPW is active, the icon for F-STOPW can be seen in the right corner
of the system tray.

Right-clicking on the icon activates a small menu with the following options:


Disable:        F-STOPW stops monitoring the system temporarily, i.e. until
                the user enables F-STOPW again or on re-boot.
                This also changes the menu.
                The menu the changes "Disable" to "Enable".  Over the F-STOPW
                icon appears a "forbidden" sign.

Enable:         F-STOPW starts monitoring the system again and just as when the
                program is disabled the menu changes, this time from "Enable"
                to "Disable" and the "forbidden" sign disappears
 
Properties:     Activates a settings menu. This menu can also be activated by
                double-clicking on the F-STOPW icon with the left mouse button.
                See section 4 for further details.


Exit:           This option shuts down F-STOPW and the icon disappears from
                the system.

                
4.0 Settings in F-STOPW

In the upper left corner of the settings menu F-STOPW's version number is
shown. The settings menu is divided into 6 pages.

Properties:     Settings, which indicate how F-STOPW should scan, i.e. what,
                how and when.

Action:         F-STOPW's reactions to an infection, for example: deny access
                or delete.

Report:         Settings for log report. All actions can be logged to a file.

Exclusions:     Here certain folders can be excluded from the scanning
                process.

Information:    Information on the last file F-STOPW scanned and statistical
                information.

About:          Here you can find the version number as well as information on
                how many viruses F-STOPW detects and the age of the database,
                SIGN.DEF and MACRO.DEF files, that F-STOPW uses.


The settings window has four buttons:

OK:             Alterations (if any) become effective at once and the settings
                menu disappears.

Cancel:         Cancels all alterations at the time and the settings menu
                disappears.

Apply:          Has the same function as the OK button, but the settings menu
                stays on the screen

Help:           This document.


4.1 Properties

In the "What to scan" section of the Properties page, settings can be made on
how and what F-STOPW scans.

Program Files:   F-STOPW scans files, which could contain viruses (default
                 setting). It is possible to add or exclude file extensions
                 by selecting "Program Files". When selected, a small window
                 pops up. There the user can either add or exclude file
                 extensions.
                 
Only macros:     F-STOPW scans only for macro viruses, i.e. viruses in Word
                 and Excel files.

All files:       Scans for viruses in all files.


In the lower section of the properties page the following options are:

Inside Archives:         Scans inside compressed files such as zip files.

Compressed executables:	 Scans inside compressed executables.

Floppy boot sectors:	 Scans boot sectors on diskettes (default settings).

Heuristics:              Uses heuristics when scanning.  Attempts to detect
                         unknown viruses with the use of heuristics (rules
                         that describe the behaviour and structure of viruses).
                         Increases the detection rate, at the cost of increase
                         in chance of false alarms.

In the "Scan files on" section the user can set when F-STOPW scans.

Open, Copy, Run:	F-STOPW scans files when they are opened, copied or run.

Create, Download:	F-STOPW scans files when they are created or downloaded 
                        from the Internet.

Both:			Combines both the above options (default setting).

The "General" section has three options.

Scan floppies on shutdown:	F-STOPW scans the floppy drive when  either
                                F-STOPW is turned off or Windows is shutdown
                                (default setting).

F-STOPW can be disabled:        Enables the user to disable F-STOPW from the
                                system tray.

Show icon on taskbar:           The F-STOPW icon is shown on the system tray
                                (default setting).


4.2 Action


If a virus is found, you can choose between six different reactions.

Deny access:             F-STOPW denies access to the infected file
                         (default setting)
Rename automatically:    Infected files are automatically renamed.

Move automatically:      Infected files are automatically moved
                         to a folder.
Delete automatically:    Infected files are automatically deleted.

Disinfect automatically: Infected files are automatically disinfected.

Report only:             Only reports that a virus has been found.

Only log to report.

        By choosing the "Only log to report" option, the program
        will NOT display a message on the screen if a virus is found.
        The selected action (deny access,
        rename, move, delete, disinfect) will, however, still be
        performed. It will only be logged to the report file.
        If you have the "Only log to report" checkbox checked,
        you will not be allowed to turn off the reporting to a file.



4.3 Report

It is possible to create a report file onto which the following
information can be logged:

Virus infection:        All virus infections are logged to the report file.

Virus disinfection:     All virus disinfections are logged to the report file.

Delete:                 All deleted files are logged to the report file.

Move, Rename:           All instances of moved or renamed files are logged
                        to the report file.
User:                   The user name at the time of the infection is logged
                        to the report file.
Date and Time:          The date and time at the time of the infection is
                        logged to the report file.
Settings:               The setting chosen in the "Properties" and Action"
                        sections
                        are logged to the report file.
Summary:                A summary of everything in the "Information" section
                        is logged to the report file.

To activate this the "Log to file" option must be selected.

By selecting the "Append to log file" option as well as the "Log to file"
option the report is logged to the last report file created. 



4.4 Exclusion

Here the user can exclude folders from scanning. Selecting "Add" activates a
window where the user can specify what folders should be excluded from
the scanning process. The "Remove" button serves as the opposite of the
"Add" button. Future versions of F-STOPW will enable users to select files as
well as folders.

4.5 Information


Last file scanned:	Displays the path of the last file scanned.

Statistics:

Files / Boot sectors
Scanned:                The number of files / boot sectors scanned.
Infected:               The number of  infected files / boot sectors.
Suspicious:             The number of suspicious files / boot sectors
                        (i.e. files / boot sectors which may possibly be
                        infected.

Action:

Disinfected:		The number of files which have been disinfected.
Renamed:                The number of files which have been renamed.
Deleted:                The number of files which have been deleted.
Moved:			The number of files which have been moved.       


4.6 About

Here you can find the version number as well as information on
how many viruses F-STOPW detects and the age of the database,
SIGN.DEF and MACRO.DEF files, that F-STOPW uses.
