
	    LAN Installation of F-PROT Professional for DOS
	    ===============================================
     Copyright (c) 1992 - 1994 Data Fellows Ltd, Helsinki, Finland


This document describes how to use F-PROT and VIRSTOP antivirus programs
in a LAN environment and also shows an example on how to create an
autoupdate system to make the updates automatic.

This document talks only about the DOS version of F-PROT, since F-PROT's
Windows-version contains all update-mechanisms internally.

F-PROT, F-CHECK and VIRSTOP are compatible with practicly all LANs.
These applications can be installed on the file server and the
workstations directed to use the shared version from the file server.

This can be done in two different ways:

o	At the time of the login a login batch or script in the server
	will check whether the F-PROT installed on the server is more
	up-to-date than the one on the workstation. If the server
	version is newer it is copied to the workstation. The new F-PROT
	can be used immediately and VIRSTOP after the next boot-up.

o	When the user logs in to the server VIRSTOP is executed from the
	server. Also F-PROT can be executed from the server. This
	alternative will function only if every user logs automatically
	to the network at every boot.

It is recommended that VIRSTOP is loaded after the network drivers. In
any case, do a test installation, and check with the F-TEST utility that
VIRSTOP is functioning normally when the network is loaded.

There are two ways to scan the file servers for viruses:

o	The scanning of the file server should be done by the system
	administrator. The scan should be executed from a specially
	prepared system disk which includes an AUTOEXEC file to handle
	the logging in to the file server and a batch file to start
	F-PROT with parameter /NET to check the whole file server. Make
	sure the diskette contains all files needed to log in to the server,
	and that no programs are executed from the local hard disk or from
	the network.

	The reason for a separate disk is that if the system
	administrator's own computer were infected by an unknown `fast
	infector' type of a virus, there is a theoretical threat that it
	could infect every file in the file server during the virus
	check. By making a clean system disk for this purpose and
	keeping it write-protected at all times this threat can be
	avoided.

o	The file server could also be scanned with a special user name
	that has read rights to the whole server but no write rights at
	all. The user rights attributes should be chosen very carefully
	because although it is possible to choose a combination of
	attributes that makes it impossible for viruses to spread, this
	is very difficult to do (this pertains especially to Novell
	networks).


Examples of the Automation of VIRSTOP and F-PROT Updating
=========================================================

Solution 1: the simple way:
---------------------------

This update mechanism requires that all workstations already have
F-PROT installed to a directory in their local disk, and that VIRSTOP
is already loaded during start-up.

Install F-PROT to the server normally. In this example we assume that
the server directory is Z:\F-PROT. Maintain this directory as the
master F-PROT directory. Any new versions of F-PROT should be placed
in this directory.

The workstations should execute a batch file automatically after users
have logged in to the network. Usually this can be incorporated into
an existing LOGON.BAT. This batch file should contain the following
lines:

REPLACE Z:\F-PROT\*.* C:\F-PROT /U
REPLACE Z:\F-PROT\*.* C:\F-PROT /A

REPLACE is a standard DOS utility. The first line updates all files that
are older in the workstation and the second line adds all new files when
F-PROT gets new features/files.

That's all. After this change the local copy of F-PROT will be updated
automatically when the version on the server gets updated.


Solution 2: FPUPDATE:
---------------------

The following presents one example on how to automate the update process
of VIRSTOP and F-PROT. A process like the one in the example is in use
in many different kinds of organizations. The largest of them have
several networks and file servers with thousands of computers.

A new version of F-PROT is installed only in one file server. From there
on the update process is totally automatic.

The Server Configuration
------------------------

o       The LOGON script or batch will call FPUPDATE batch. which
        is stored on a shared disk (in this example, in Z:\LOGON)

o	FPUPDATE will make the following checks:
	1) whether F-PROT is installed in the workstation
	2) is the F-PROT in the server later than the one in the
	   workstation

o	If F-PROT has not been installed, it will be installed to C:\F-PROT
	(the directory is also created if it does not already exist)


In certain disk operating systems the CALL command can not be used from
LOGON. If this is the case, the contents of the FPUPDATE.BAT must be
included in the LOGON. The PAUSE command may also need to be changed.

The last line in LOGON batch (or similar) could be

CALL Z:\LOGON\FPUPDATE.BAT

or, if you are using a Novell setup without a specific LOGON.BAT,
insert this line to the Login script:

#C:\DOS\COMMAND /C Z:\LOGON\FPUPDATE.BAT

It is suggested to install FPUPDATE.BAT to server to directory named
LOGON. Users should have only execute rights there.

Automatic update process is dependent on the ability to recognize the
VIRSTOP version in the workstation. This will be done with a file named
according to the following format VERSIO_X.YYz (VERSIO_2.12,
VERSIO_2.12b or VERSIO_2.14 etc.). The master copies of F-PROT include
a file named like this.

The Workstation Configuration
-----------------------------

Installation or updating happens every time user logs in as a network
user.

o	Automatic workstation installation makes directory C:\F-PROT
	for F-PROT

o	Command LOADHIGH C:\F-PROT\VIRSTOP.EXE /DISK is added to the
	end of AUTOEXEC.BAT

o	FP.BAT is copied to BAT (or BATCH or F-PROT) directory and
	can be used to start F-PROT

This kind of solution works if it is acceptable to install F-PROT
in the same directory in every workstation. The recommended directory is
C:\F-PROT. If you want to install the program somewhere else you must
edit FP.BAT and FPUPDATE.BAT accordingly.

Automatic installation and updating works only if the program version
can be automatically determined by a batch file. Version is marked by a
file which is named VERSIO_X.YYz.

There is an example of FPUPDATE.BAT on F-PROT installation diskette.
The FPUPDATE batch file needs modification to suit the paths in your
system. After the system has been installed, all you have to do is
to update the master version in the server whenever a new version
comes available. When you update the server F-PROT remove first the old
version file.

Network vendor specific notes:
------------------------------

Windows for Workgroups and Microsoft TCP/IP Extension

For VIRSTOP to work properly check the loading order of TSR 
programs. The following order works fine:

1.      NET START
2.      VIRSTOP
3.      all other TSR programs


Lan Manager or Lan Server and Windows for Workgroups

The user can see shared disks only after Windows has started. 
There are two possibilities to update VIRSTOP automatically to 
workstations.

o       Use F-PROT Professional for Windows and copy VIRSTOP.EXE 
        to the same directory with F-PROT on the server. The 
        automatic update system of F-PROT then updates VIRSTOP too.
        
o       It is possible to call FPUPDATE inside PROFILE.BAT if you 
        have the latest version of Lan Manager or Lan Server. 
        Windows runs PROFILE.BAT before activating Program Manager 
        and shared disk are available inside this batch file.


Novell Netware

Some programs are known to grab DOS interrupts to itself,
dropping all other TSRs that have hooked them - this means that VIRSTOP
will either have to be loaded after these programs or rehooked 
afterwards with the VIRSTOP /REHOOK parameter. Such programs are:

NETX (Novell Netware)
Stacker 4
DOS window inside DESQview
logging to TOP-VIEW network


IBM AS/400 PC Support

Because the AS/400 device driver modify the data areas of other TSR
programs, the loading order of TSRs needs to be changed. The correct
order goes like this: Move VIRSTOP to load from CONFIG.SYS via a DEVICE
or DEVICEHIGH command. The correct loading order of drivers is:

1.	DEVICE=DXMA0MOD.SYS, DXME0MOD.SYS, DXMT0MOD.SYS and other
	DXMA-drivers (which are generally needed for e-mail purposes)
2.	DEVICE=VIRSTOP
3.	DEVICE=EIMPCS.SYS and also ECYDDX.SYS, if it is needed

Contact your local F-PROT Professional support if you need help in
setting up F-PROT to operate in a LAN environment.

     Copyright (c) 1992 - 1994 Data Fellows Ltd, Helsinki, Finland
