USER GUIDE
----------

Welcome
----------------------------------------------------------------------------
Overview of the FIBER Anti Virus Utilities
------------------------------------------
FIBER Anti Virus (FAV) is a comprehensive tool kit designed to protect,
detect and recover your PC from the computer viruses. While FIBER Anti
Virus focuses heavily on numerous ways to prevent a virus infection, the
package would not be complete without various cleaner programs to purge
a system, in the unlikely event that a virus manages to slip through. The
package therefore consists of a number of programs each of which help you
to prevent viruses to do their destructive jobs.

Installation
----------------------------------------------------------------------------
System Requirements
-------------------
Due to the enhanced features of FIBER Anti Virus utilities, FIBER Anti Virus
utilities require 386 processor base of computer or above. However, FIBER
Anti Virus utilities support all type of display card that support by DOS
and Windows. FIBER Anti Virus also design for networks, either in DOS or
Windows base.

Here now, this is the system requirements and compatibility of FIBER Anti
Virus

Computer Type           :  IBM PC/AT and PS/2 with 386 processor or above
RAM Amount              :  512Kilobytes for DOS
                           4 Megabytes for Windows 3.xx
                           8 Megabytes for Windows 95
Display Card            :  MDA, CGA, HGA, EGA, VGA, SVGA or XGA
Operating System        :  MS-DOS, PC-DOS, DR-DOS 5.0 or higher
Graphics User Interface :  Windows 3.xx or Windows 95
Storage Media           :  A hard disk and a floppy drive
Optional Accessories    :  PC Mouse, CDROM Drive
Disk Space              :  About 1 to 2 megabytes of disk space.

If the your computer is connected to a network environment, FIBER Anti
Virus utilities automatically become a workstation based anti virus
protection. It is fully compatible with all the network system support
by DOS or Windows.

Download Version Setup
---------------------------------------------------------------------------
1.  Unzip the download file by using your unzipper in to directory C:\TEMP.
2.  Run INSTALL in the directory C:\TEMP to continue installation.
3.  Continue this help to Windows 95 Installation line number 5.

Diskette Version Setup
---------------------------------------------------------------------------
DOS Setup
---------
1.  Insert FIBER Anti Virus Setup Disk in any diskette drive.
2.  Type the following at the command prompt:- a: or  b:
    (depend to your diskette drive letter)
3.  Type the following at the command prompt:  install
4.  Continue this help to Windows 95 Installation line number 5.

Windows Setup
-------------
1.  Insert FIBER Anti Virus Setup Disk in any diskette drive.
2.  On the Programs Manager windows, choose the menu File | Run.
3.  Type the following at the text box:-  a:install or b:install
    (depend to your diskette drive letter)
4.  Hit Enter key or click the OK button to continue.
5.  Continue this help to Windows 95 Installation line number 5.

Windows 95 Installation
-----------------------
1.  Click the Start button or press the Windows logo key if you are using
    Windows 95 keyboard.
2.  Choose Run menu.
3.  Type the following at the text box :- a:\install or b:\install
    (depend to your diskette drive letter)
4.  Press Enter key or click the OK button to continue.
5.  Here it is, the welcome screen of the Setup program.
6.  The text on the top of screen shows up the actual version of FIBER
    Anti Virus utilities, if the version number does not equal to the
    package version, please contacts your dealers.
7.  To continue Setup, press Enter. To exit, press F3 twice. To get some
    help, press F1 key.
8.  When you continue, it's the time to modify FIBER Anti Virus install
    directory. The default directory is C:\FIBER. To modify the directory,
    hit Back Space to erase the characters, and retype a new directory.
    When you complete, press Enter to apply.
9.  If the directory you type already exists, the Setup does not allow the
    user to continue the installation. Please retype another directory that
    does not exist.
10.  The Setup program will now ask you to scan all the fixed drive to
     detect and remove the viruses. To continue the Setup with viruses
     detect and remove process, press Enter. You may skip this process
     by hit the Escape key.
11.  You can terminate the scanning process by hit the Escape key. 
12.  After the scanning process, the Setup program will now ask you to
     generate checksum of the program on your fixed disks. Hit Enter key
     to continue or hit F3 key to terminate Setup. You cannot stop the
     checksum generating process.
13.  The Setup program automatics continue the installation after checksum
     generate process. The Setup copies all of the FIBER Anti Virus
     utilities to your hard disk.
14.  Files copying require a bit of time. After this, press Enter to accept
     modification to the CONFIG.SYS file. Modification made to launch FIBER
     Memory Defense every time system boots up. If you want, you can skip
     it by hit Escape key.
15.  You need to shut down and restart the computer now to accept the change
     made to you computer.

FIBER Memory Defense
---------------------------------------------------------------------------
General Information
-------------------
   Prevention is always better than cure. With FIBER Memory Defense, a great
product of Fiber Anti Virus utility, you have a very safe method to protect
your computer before your computer is infect by virus. FMD is a TSR anti
virus  that guard your system to prevent viruses or Trojan Horse attack.
FMD provides a very strong shield for your computer system. It is built
around virus behavioural pattern detection model (behavioural blocking,
rule based anti virus, or just call it as Artificer Intelligent anti virus)
that can detect unknown boot viruses, file viruses and Trojan Horses easily
and accurately. It can capture almost all of the computer viruses. There is
no false alarm under normal application.

   In addition, FMD includes Boot Area Detect Engine that enables FMD to
identify a Partition Table and Boot Record infection. It can recover the
original boot area without having to rely on any pre-kept image. FMD does
not use virus signatures to scan system memory for viruses. This is because
FMD builds with Memory Tunnel Engine that enables FMD to detect known or
even unknown viruses that resident before FMD.

   FMD is easy to use. What you need is just install it and then forget it.
At times, however, FMD will require you to make some choice. Making the
correct choice is extremely important.

   FMD is friendly. It is friendly on the issue of false alarms; it will
give you very few of them. Other anti viruses' programs may bother you with
so many false alarms that when a real virus comes along, you might ignore it.

   FMD is small. It was written in assembly programming language. The
resident module occupies a total of less than about 6000 bytes of RAM. It is
very small compare with other resident module anti viruses' product.

   FMD is fast. It was written in assembly programming language. Unlike
other resident modules, FMD does not slow down your computer system. Other
anti viruses' program may slow down you system.

   FMD is compatible. It was compatible with DOS greater than 5.0,
Microsoft Windows 3.xx and also Microsoft Windows 95 either DOS mode or GUI
mode. None of the other memory resident anti virus can make it before.

How It Works
------------
FIBER Memory Defense will always be a shield of your computer system when
it's reside into memory. The FMD does not scan the file for the signature
of the viruses or clean an infected file. It does not write any thing to
the executable file, to the hard disk or floppy disk except create or open
the log file to store the virus alert information. FMD will load every time
the computer boots up. Every time, before FMD resides to the memory, it will
perform some check to the computer system. Memory Tunnel Engine is the first
engine uses by FMD. FMD uses this method to detect memory resided viruses.
This is a new method uses to detect viruses. It is better than the old
method that searches for virus signatures from low to high memory that
require a lot of processor power and time. The second engine is Boot Area
Detect Engine. FMD read the hard disk's master boot record and boot sector.
And compare with the saved image FIBER.MBR file. After that, a big text box
pops up and the FIBER Memory Defense is successfully reside into the memory. 


            ROM BIOS <--------> DOS or Windows <---------> TSR
                ^                     |                     ^
                |                     |                     |
                \----------> FIBER Memory Defense <---------/
                                      |
                                      |
                             Application Software

     FIBER Memory Defense play the trick on hooking the interrupt service,
                        monitors the system activity.


   Protecting the system from being attacks by viruses is the most important
task in the war against computer viruses. Usually, before a virus spread
through the system, it needs to get into the memory first. Normally this
happens when the user accidentally runs an infected application or boots up
from an infected floppy disk.

   When a virus attempt to get into the memory, it will try to hook the
interrupt. If the FMD resides in the memory just before the virus installs
itself, FMD will unhook the interrupts that hook by the viruses, the virus
wills inactive as soon as possible and become a virus shell.

   For example, a virus want to infect a executable file, it require several
step to complete the infection, that is

        1)  Checks for current file extension
        2)  Checks for valid executable file
        3)  Checks for disk space
        4)  Opens it
        5)  Reads it
        6)  Writes it and result in increase length
        7)  Closes it

   FIBER Memory Defense does not pop up and prompt the user for action if
only 3 or 4 actions from the list above happened. FIBER Memory Defense does
not deal it as virus. However, FIBER Memory Defense will deal with the virus
by popping up and prompt the user for action when all of these 7 actions
happen. For instance, FIBER Memory Defense will prompt immediately if the
program tries to low level format the hard disk, because this may destroy
the entire hard disk.

How to Make Choice
------------------
When FIBER Memory Defense monitors a virus and caught it, a virus alert box
appears at the screen. Each virus alert dialog has THREE choice that
requires you to select. The three choices are :

  1.  Reboot the computer.
        The safest way, but it is not recommend you select this choice all
        at the time.
  2.  Disable current action and continue your computer section.
        When you choose this selection, FIBER Memory Defense tries to
        disable the virus activity and recovers the system as much as
        possible. It is recommend you to choose this option all at the
        time except the virus alert warning A Program Attempt To Trace
        FMD Memory Code. Due to the bug of the virus, the system may
        crash after this choice has been selected.
  3.  Continue current action. 
        This is a danger selection. You may choose this option if you are
        sure that it is not a virus but is a false alarm generate by a
        normal application.

Warning and Error Message
-------------------------
* The FIBER Memory Defense was resident
  FMD already resided.
* The DOS you use is older than version 5
  The DOS version is older than 5.
* Boot record information file FIBER.MBR cannot open
  The FIBER.MBR file is missing, use FSU to create it.
* Cannot read hard disk partition table or boot sector
  Hard Disk got problem.
* Boot record of the hard disk not same as FIBER.MBR
  Boot record of hard disk is not same as the actual record in FIBER.MBR.
  This will happen if you install a new version of DOS, Windows, OS, Boot
  sector protection software. If you are sure that you have install a new
  version of operating system, exit FMD and save the new copy of boot record
  using FSU. Then reboot your computer again. Otherwise, the boot record of
  your first hard disk properly infected by a boot sector virus. You need
  to restart the computer (do not press CTRL+ALT, Del) Then, place the
  rescue disk and restore the system information using FSU. Remember to
  reboot your computer after boot record had restored.
* Extended Memory Specification no install
  Insert this line DEVICE=C:\DOS\HIMEM.SYS to the beginning of the
  CONFIG.SYS file using any word processing program. If you do not know
  how to do this, please refer to the DOS manual or just contact your
  computer's dealer.
* SHARE.EXE detect in memory
  To solve this problem, please reside FIBER Memory Defense before SHARE.EXE
  program.
* Multitasking environment was detected
  Resident FIBER Memory Defense within multitasking environment ( like
  Windows and OS/2 ) is impossible to gain the full power of virus
  protection. If you can, exit multitasking environment and then re-run
  FMD. However, you can force reside is you want but FIBER Memory Defense
  no longer successfully defense you PC.

FIBER System Utility
----------------------------------------------------------------------------
General Information
-------------------
Today, almost 60% of the computer virus spread from a computer to another
computer through the diskette's boot sector. They are boot sector virus.
Although they can be removed very easily ( some of them are very hard ) but
they are normally dangerous viruses. So, keeping your boot sector clean is
a must job for every computer user. FSU is a utility from FIBER Anti Virus
product which keeps an image of the hard disk's partition table and boot
sector. It will warn you when the boot record has been changed. It is easy
and useful to clean the boot sector virus by replacing the saved image to
the hard disk boot area in just a second. Beside keeping the image of the
partition table and boot sector, the FIBER System Utility also keep a copy
of CMOS parameter. Keeping the copy of CMOS parameter is useful when you
forget the parameter of your hard disk. In some case, inaccessible of hard
disk cause by incorrect CMOS parameter in the CMOS setting. The DOS will
damage the hard disk if the CMOS setting is incorrect. So, before FIBER
System Utility restore or store the boot record, it will check for correct
CMOS parameter.

Using FIBER System Utility
--------------------------
To use it, quit any multitasking environment like Windows. Running the FSU
at the DOS command prompt is the good ideal. To run FSU at the DOS command
prompt, type :- FSU <ENTER>. Then, it will check for the existing of
FIBER.MBR file in the directory. Normally, the Setup program will
automatically create the image file during installation. So, let say the
FIBER.MBR exist. The FIBER System Utility will now compare the CMOS record,
and hard disk boot area with the saved image. If no change has made to the
CMOS record or hard disk boot area, FIBER System Utility will display

        Begin system information comparison.
        CMOS record seem to be same.
        Partition table and boot sector seem to be same.
        All seem to be OK !

This mean your system states is same as default, no virus or problem occur.
When FIBER System Utility display this several line of messages :-

        XXXX seem to be changed !

You hard disk partition table and/or boot sector and/or CMOS seem to be
matchless as the image. So there are four main reasons. 1) Hard disk
infected by boot sector virus 2) Hard disk damage by virus 3) Incorrect
FIBER.MBR 4) Install of new OS, or boot sector routine.. For the third
reason, please hit C to continue without any modification. For the first
and second reason, choose Restore MBR (press R). And, for the last reason
hit S to save the boot record into FIBER.MBR.

If the FIBER.MBR not exist, the FIBER System Utility will ask for create
new file. So, you need to hit Y to continue. FIBER System Utility will try
to detect for all of your hard disk drives. If the information match, press
Y, otherwise hit N, and check for correct CMOS setting for the hard disk
drive. After all, if nothing special happens, FIBER System Utility creates
a new system image file. All processes completed, if you run FIBER System
Utility again, it will compare your system information.

Error Message
-------------
* Error occur while create/open/read data file...
  This error will occur if FSU fail to create, open or read FIBER.MBR file.
  Make sure media is not write protected.
* Error occur while read/write boot area
  FIBER System Utility fail to read or write the information from/to the
  boot area of the hard disk drive. This problem usually cause by boot
  sector viruses that refuse the action of FIBER System Utility.
* Error, FSU cannot read data from FIBER.MBR and/or FIBER.MBR corrupted
  The FIBER.MBR file seem to be corrupted, you need to do is delete it
  anyway. To erase this file, type DEL FIBER.MBR at DOS prompt or using
  File Manager inside Windows. Run FSU again to create new image.

FIBER Cryptographic CRC
----------------------------------------------------------------------------
General Information
-------------------
FCRC, FIBER Cryptographic Cyclic Redundancy Check is another useful anti
viruses utility of FIBER Anti Virus. It is an indispensable tool, adding
support to the rest of the FIBER Anti Virus utilities, even though it does
not take an active part in actual virus removing. FCRC organises control
and recovery information giving extra power to the other FIBER Anti Virus
utilities. The information is gathered, mainly from executable files, into
two reference files called FCRC.DAT and FSCAN.DAT, one each per directory.
FSCAN and FCRC will perform an integrity check while scanning if it can
detect the FSCAN.DAT and FCRC.DAT files. If a file gets infected by a virus,
the information in the FSCAN.DAT and FCRC.DAT files will not match the
actual file contents, and FSCAN and FCRC will inform you that the file has
been changed. Once a file is infected, FSCAN will reconstruct the original
file. The information in the FCRC.DAT file will be of great help to FCAN.
Almost all of the infected programs can be cured if there is information
about the program in the FCRC.DAT file. These include overwritten viruses
because FCRC.DAT saved a portion data of the program files.

Launch FIBER Cryptographic CRC
------------------------------
You are able to use FIBER Cryptographic CRC under DOS environment or
Windows environment. To run this anti virus utility, type: FCRC <Enter>
at the DOS command prompt. However, FIBER Cryptographic CRC requires some
parameters to work as well. For example, to generate/calculate checksums
of the files in the directory C:\DOS, type: FCRC C:\DOS ( and hit enter )
to generate/calculate all executable files in these directory. To generate
checksums to all executable files on drive D:, type :- FCRC D: (and hit
enter ) Due to FCRC only calculates checksums for several types of file,
so wildcards ( * or ? ) are not accept. Whenever you specify a directory
to generate for, FIBER Cryptographic CRC always generates the checksums
include all sub-directories found.

Normally, the FIBER Anti Virus Setup program will automatic generates
checksums for all of the file on your fixed disk(s). So, when you run FIBER
Cryptographic CRC again, it will performs integrity check for the files,
and will prompts you if change detected.

Stop From Running
-----------------
You can press ESC key any time when you want to quit.

Executable File Changed Dialog Box
----------------------------------
When FIBER Cryptographic CRC detects changed on the executable file, it
will prompts this dialog box and requires your selection. Making the
correct choice is very important. It has several ways to make the selection.

i.   If you sure that your system infected by known or unknown viruses,
     choose SKIP and quit FIBER Cryptographic as quick as possible. Then
     launch up FIBER Multi Scanner to clean the infected executable files.
     For the information on FIBER Multi Scanner, please refer to it's
     section.
ii.  If you are a programmer, or cracker that always changes the contents
     of the executable files, and your are sure that the changed is made
     result of recompile, reedit or re-link of the executable file, choose
     UPDATE to update the checksum file.
iii. If you have just install or upgrade a software on this directory,
     choose UPDATE to update the checksum file.
iv.  If you don't know any thing, choose SKIP and quit FIBER Cryptographic
     CRC. Then run FIBER Multi Scanner to rebuild these executable file. If
     something wrong happen, or the software does not run properly, you can
     delete the current executable file and restore it by renaming the
     backup of the executable to the original filename.

Remove All Checksum File
------------------------
For unknown reasons, some user might want to remove all of the checksum file
available on the fixed disks. So, if you want to remove all of the checksum
file on your hard disk drives, it is no need to delete FSCAN.DAT and
FCRC.DAT one by one using DOS DELETE command or special utilities. FIBER
Cryptographic CRC offer you with a option which use for removing checksum
files. The option is /r which place before directory or drive parameters.
For example, to delete checksum files on drive C directory WINDOWS, type
FCRC /r C:\WINDOWS ( and hit enter ) at the DOS command prompt. To delete
all checksum file on the drive D, type FCRC /r D: ( and hit enter ) and the
FIBER Cryptographic will delete all of them include sub-directories.

FIBER Multi Scanner
----------------------------------------------------------------------------
General Information
-------------------
FIBER Multi Scanner is a computer virus scanner. It has been specifically
developed to detect viruses, Trojan Horses and other such threats to your
valuable data. Most viruses consist of a unique sequence of instructions,
called a signature. Hence through checking for the appearance of such
signatures in a file we can find out whether or not a program has been
infected. Scanning all program files for the signatures of all known
viruses helps you to find out quickly whether or not your system has been
infected and, if so, by which virus. FSCAN can detect yet unknown viruses.
The built-in disassembler  is able to detect suspicious instruction
sequences and abnormal program layouts. This feature is called 'heuristic
scanning' and it is partially enabled by default. Heuristic scanning is
performed on files and boots sectors.

Launch FIBER Multi Scanner
--------------------------
FSCAN works well under all environment. For daily use you can activate
FSCAN by loading the program from the DOS command line. To run FSCAN, type
FSCAN ( and hit enter ) However, FSCAN require some parameters to work
together. For example, to scan drive C, type FSCAN C: ( and hit enter )
and it will perform scanning to all file on the drive C. To scan directory
WINDOWS on drive E, type FSCAN E:\WINDOWS ( and hit enter )

Options
-------
FIBER Multi Scanner has several useful options, here it is :

Scan options:-
        /nf             Do not scan file
        /cba            Check Boot Area with image
        /cmos           Compare CMOS with image
        /full           Scan with full options
        /turbo          Perform high speed check.
Seek file options:-
        /all            Scan all files for all viruses
        /sub            Include subdirectories
        /rp             Scan multiple diskettes
Action options:-
        /ig             Ignore all infected file
        /ra             Rename all infected file
        /ri             Repair all infected file
        /move=path      Move infected file to path
        /da             Delete all infected file
        /bk             Create backup file
        /sa             Sound alert when virus found.
Interrupt options:-
        /batch          Batch mode, no user input
        /trap           Trap Ctrl+Alt+Del key
        /ns             Interrupt not accepted
        /pause          Prompt for pause
        /quit           Quit after scan
Time options:-
        /day=md         Scan when month day specified
        /weekday=d      Scan when the week day specified
        /numday=x       Scan after number of day specified
        /oo             Only once a day
        /wait=nnn       Number of timer tick to wait
Display options:-
        /mo             Monochrome
        /ss             Enable conventional scrolling
Report options:-
        /ic=file                Log virus detection incidents
Other options:-
        /old            Do not report program is old
        /ex             Extract signatures

FIBER Multi Scanner Screen
--------------------------
At the top of the screen is the version and product name. The bottom of
the screen is the copyright notice. The texts with red background is some
information messages. On the center of the screen, a white background line
is the current scan directory. The black background contents the information
of current scan file. It can divide to 3 main field, it is File Name field,
File Type field and the Flags.

File Name Field		The file name currently scan.
File Type Field		The type of the file currently scan.
Flag Field              The flag field is use to identify the current file
                        status or infection.

Remove The Virus
----------------
FSCAN is able to clean over thousand of viruses. If virus is caught, FSCAN
will popup a dialog, choose repair to repair the file, delete to delete it,
rename to rename the file or just ignore it.. Options at the right side is
to perform all files to current action.

Trademarks and Copyright
----------------------------------------------------------------------------
Trademarks
----------
The FIBER Anti Virus are registered trademarks of FIBER Software Development.
All other product names mentioned are acknowledged to be the marks of their
producing companies.

Copyright
---------
All FIBER Anti Virus utilities are copyright 1995-1997 FIBER Software
Development, All rights reserved. The diskettes or files provided with the
FIBER Anti Virus are not copy protected. The FIBER Anti Virus are protected
by copyright law, which applies to the computer software as well, except
for that you may make copies of the software solely for backup or archive
purposes and transfer the software to hard disk provided that the software
is used as specified herein.

Should you have any questions concerning this Agreement, or if you desire
to contact FIBER Software Development, please write:

ADDRESS		FIBER Software Development
                6083, JALAN ONG YI HOW,
                13400 BUTTERWORTH,
                PULAU PINANG,
                MALAYSIA.
VOICE           (604)-3233706
EMAIL #         fiber@advantise.net
                ltchew@pop.jaring.my
URL #           http://www.advantise.net/fiber
