@ECHO OFF
REM ******************************************************************
REM *****  MCAFEE EMERGENCY BOOT DISKETTE      VERSION 1.0       *****
REM ******************************************************************

REM **** HOUSE KEEPING ****
SET ERROR17=0
SET ERROR10=0
CLS

REM ******************************************************************
REM ****  MAKE SURE ALL THE FILES ARE HERE                      ******
REM ******************************************************************
A:\SELFCHEK.EXE A:\PACKING.LST Validation codes:
IF NOT ERRORLEVEL 1 GOTO SelfCheckOK

ECHO One or more of the required files are missing from this diskette.
ECHO Please check the PACKING.LST file against the directory listing
ECHO to ensure they are present.  If files are missing then this
ECHO diskette may have been tampered with or altered.

A:\GETREPLY.EXE Do you wish to continue anyway (Y/N)? ;yn
IF ERRORLEVEL 2 GOTO AbortSLFCHK


:SelfCheckOK
CLS
ECHO [===============================================================]
ECHO [                                                               ]
ECHO [                  MCAFEE VIRUS REMOVAL TOOL                    ]
ECHO [                                                               ]
ECHO [  THIS DISKETTE IS USED TO SIMPLIFY THE TASK OF REMOVING A     ]
ECHO [  VIRUS FROM YOUR COMPUTER.  IT IS IMPORTANT TO ENSURE THAT    ]
ECHO [  YOU COLD BOOTED YOUR MACHINE BEFORE USING THIS DISKETTE.     ]
ECHO [  A COLD BOOT MEANS THAT THE POWER TO THE COMPUTER IS TURNED   ]
ECHO [  OFF AND THEN TURNED ON WITH THIS DISKETTE IN THE A: DRIVE.   ]
ECHO [                                                               ]
ECHO [===============================================================]

A:\GETREPLY.EXE Did you cycle the power off and on (Y/N)? ;yn
IF ERRORLEVEL 2 GOTO NoCyclePWR

:DoScan
REM ******************************************************************
REM **** PERFORM THE SCAN
REM ******************************************************************

CLS
ECHO MCAFEE WILL NOW PERFORM A SCAN OF ALL LOCAL DRIVES FOR VIRUSES
ECHO AND ATTEMPT TO CLEAN ANY INFECTIONS THAT ARE FOUND.  CERTAIN
ECHO VIRUSES MAY REQUIRE YOU TO REBOOT AND PERFORM THIS SCAN AGAIN.
ECHO IF THE SCAN STALLS FOR MORE THAN 30 SECONDS THEN TURN THE POWER
ECHO OFF AND THEN BACK ON AGAIN WITH THIS DISKETTE IN THE A: DRIVE.
PAUSE

CLS
SCAN /ADL /CLEAN /ALL /NOBREAK
REM Scan C:\Infected /all /clean
PAUSE

:DoErrors
REM ******************************************************************
REM ***  DO ERROR CHECKING
REM ******************************************************************
IF ERRORLEVEL 100 GOTO ErrorDOS
IF ERRORLEVEL 19 GOTO VirusFound
IF ERRORLEVEL 17 GOTO NoTarget
IF ERRORLEVEL 16 GOTO BadAccess
IF ERRORLEVEL 15 GOTO BadScanEXE
IF ERRORLEVEL 14 GOTO Update
IF ERRORLEVEL 13 GOTO VirusFound
IF ERRORLEVEL 12 GOTO BadClean
IF ERRORLEVEL 11 GOTO ProgError
IF ERRORLEVEL 10 GOTO VirusInMemory
IF ERRORLEVEL 8  GOTO MissingDat
IF ERRORLEVEL 6  GOTO ProgError
IF ERRORLEVEL 5  GOTO ProgError
IF ERRORLEVEL 3  GOTO BadAccess
IF ERRORLEVEL 2  GOTO BadDats
IF ERRORLEVEL 1  GOTO BadAccess
IF ERRORLEVEL 0  GOTO Nada

REM ******************************************************************
REM ******  ERROR CHECKING ROUTINES                             ******
REM ******************************************************************

:Nada
REM ******************************************************************
REM *** errorlevel 0
REM ******************************************************************
CLS
IF %ERROR10%==1 GOTO ExitNoMem
ECHO No viruses were found in memory, or on any local drives!
ECHO You should remove this diskette and reboot your system.
GOTO Exit

:BadAccess
REM ******************************************************************
REM *** errorlevels 1, 3 & 16
REM ******************************************************************
CLS
ECHO An error has occurred while trying to access one of your local
ECHO drives.  Please reboot the machine with this diskette in the A: 
ECHO drive and reattempt the procedure.  If this error continues then
ECHO it may be necessary to run some kind of disk diagnostic software
ECHO on the drive before re-attempting the removal procedure.
GOTO Exit

:BadDats
REM ******************************************************************
REM *** errorlevel 2
REM ******************************************************************
CLS
ECHO An error occurred while trying to read the data files.  This could
ECHO mean that either the diskette is damaged, has been modified or the
ECHO floppy drive is slightly misaligned.  If you have a second machine
ECHO you could boot from this disk and verify if the floppy drive is OK.
ECHO Since the diskette is write protected it is unlikely that the file(s)
ECHO were modified unless the write-protection was forcefully over-ridden.
GOTO Exit

:ProgError
REM ******************************************************************
REM *** errorlevels 5, 6 and 11
REM ******************************************************************
CLS
ECHO There has been a problem with the VirusScan program. This could
ECHO be caused by a corrupted file, low memory or a conflict with a
ECHO piece of hardware. It is also possible that a virus is active and
ECHO interfering with the program. Please cold boot this system again
ECHO with this disk and try the scan again. If this problem continues
ECHO please consult your manual on how to get a new copy of this disk.
GOTO Exit

:MissingDat
REM ******************************************************************
REM *** errorlevel 8
REM ******************************************************************
CLS
ECHO One or more of the following files are missing:  SCAN.DAT, NAMES.DAT.
ECHO There is a good chance that this diskette may have been modified.
ECHO Please cold boot this system again with this disk and try the scan
ECHO again. If this problem continues please consult your manual on how to
ECHO get a new copy of this disk.
GOTO Exit


:VirusInMemory
REM ******************************************************************
REM *** errorlevel 10
REM ******************************************************************
CLS
ECHO    W       A       R       N       I       N       G
ECHO .
ECHO The signature of a virus was found in memory while performing
ECHO the memory scan.  It is unlikely that this disk is infected
ECHO as long as the write protect tab on the diskette was never
ECHO bypassed.  There are other possibilities.  You should check
ECHO the boot sequence in CMOS.  The hardware documentation that
ECHO came with your computer should discuss how to access this area.
ECHO Ensure that the sequence is A: first THEN C:.
ECHO .
ECHO It is also possible that you have a hard drive controller that
ECHO is placing an IMAGE of the infected Boot Record into memory.
ECHO If this is the case then the virus may not be active and could
ECHO possibly be removed.
A:\GETREPLY.EXE Would you like to attempt anyway (Y/N)? ;yn
IF ERRORLEVEL 2 GOTO Exit
GOTO ScanNOMEM

:BadClean
REM ******************************************************************
REM *** errorlevel 12
REM ******************************************************************
CLS
ECHO A problem has occurred in trying to clean a virus. Either the
ECHO CLEAN.DAT file is missing or corrupted or VirusScan was unable to
ECHO clean the virus. Please check this diskette with the Validate
ECHO program included to make sure the files are all there and are not
ECHO corrupted. If the files are ok, please cold boot the machine with
ECHO this diskette and try the scan again. If the file will still not
ECHO clean, you will need to delete them.
ECHO The Packing.lst will now be displayed for you to compare the values
ECHO from the Validate program. To use Validate, just type:
ECHO VALIDATE {filename} and check the codes versus the Packing.lst
PAUSE
TYPE PACKING.LST
GOTO Exit

:VirusFound
REM ******************************************************************
REM *** errorlevels 13 and 19
REM ******************************************************************
CLS
ECHO    W       A       R       N       I       N       G
ECHO .
ECHO One or more viruses were found on this computer. In many cases the
ECHO viruses were cleaned at the same time by the program. It is
ECHO recommended that you cold boot this machine with this disk again
ECHO and have it run another scan to insure that the computer is clean
ECHO and no viruses were missed or were not cleaned.
GOTO Exit

:Update
REM ******************************************************************
REM *** errorlevel 14
REM ******************************************************************
CLS
ECHO You're virus data files are getting old and you should update them
ECHO This is not a major problem. However, there may be viruses on this
ECHO machine that are not detectable by this version of the software.
ECHO By updating your software you are getting the most protection
ECHO possible. Please consult your manual for update information.
GOTO Exit

:BadscanEXE
REM ******************************************************************
REM *** errorlevel 15
REM ******************************************************************
CLS
ECHO The self-check has failed.  This may be caused by a damaged or 
ECHO modified SCAN.EXE file or problem with the floppy drive. First at 
ECHO the A:> prompt run VALIDATE SCAN.EXE and verify the validation code 
ECHO against the code in the PACKING.LST file.  The PACKING.LST file will
ECHO be displayed on exit.
PAUSE
GOTO AbortSLFCHK

:NoTarget
REM ******************************************************************
REM *** errorlevel 17:  Possible encrypting virus
REM ******************************************************************
IF %ERROR17%==1 GOTO EncManualRemove
CLS
ECHO Scan has reported that there is no target specified for scanning.
ECHO This could be due to an encrypting virus or a possible hardware
ECHO issue.  Another scan will be attempted to remedy the situation.
ECHO Please stand by...
GOTO ScanCDrive

:ErrorDOS
REM ******************************************************************
REM *** DOS Error
REM ******************************************************************
CLS
ECHO A DOS error has occurred.  Please consult your DOS manual for 
ECHO details or contact your DOS vendor for assistance.
GOTO Exit


REM ******************************************************************
REM ****  AUXILLARY PROCEDURES
REM ******************************************************************


:AbortSLFCHK
REM ******************************************************************
REM self check failed
REM ******************************************************************
CLS
TYPE PACKING.LST
GOTO Exit

:NoCyclePwr
REM ******************************************************************
REM user said that he did not cycle the power off
REM ******************************************************************
CLS
ECHO It is strongly recommended that you leave this diskette in the
ECHO A: drive and turn the power to the computer off and then on.  Some
ECHO viruses are capable of surviving a warm boot or CTRL+ALT+DEL.
GOTO Exit

:ScanNOMEM
REM ******************************************************************
REM *****  ATTEMPT TO BYPASS MEMORY SCAN
REM ******************************************************************
CLS
ECHO If no virus is found on the hard drive(s) then most likely the
ECHO virus is active and it is a stealth type virus.  If a virus is
ECHO is found it is recommended that you boot to this diskette a second
ECHO time to ensure that it is removed.
SET ERROR10=1
SCAN /ADL /CLEAN /ALL /NOMEM /NOBREAK
GOTO DoErrors

:ScanCDrive
REM ******************************************************************
REM ***  Run scan on only the C: drive
REM ******************************************************************
SET ERROR17=1
SCAN C: /CLEAN /NOBREAK
GOTO DoErrors

:EncManualRemove
REM ******************************************************************
REM *** The Scan C: /CLEAN didn't work
REM ******************************************************************
CLS
ECHO The same error has occurred again.  If this is due to a virus you
ECHO may need to perform a manual removal in this case.  It is also
ECHO possible that you are experiencing some hardware issues. Try running
ECHO a disk diagnostic program to see if it can clear up the problem.
GOTO Exit

:ExitNoMem
REM ******************************************************************
REM *****  EXIT AFTER USING NOMEM AND VIRUS WAS FOUND PREVIOUSLY
REM ******************************************************************
CLS
ECHO Scan did not find a virus on the second pass. However, because a 
ECHO virus was found in memory it is possible that there is still a 
ECHO virus active on the hard drive.  Again, it is unlikely that this 
ECHO disk is infected as long as the write protect tab on the was 
ECHO diskette was never bypassed. There are other possibilities. 
ECHO You should check the boot sequence in CMOS.  The hardware 
ECHO documentation that came with your computer should discuss how to 
ECHO access this area. Ensure that the sequence is A: first THEN C:
ECHO Try cold booting your system again using this diskette and run
ECHO another scan. If a virus continues to show up in memory, then 
ECHO there may be a compatibility issue with some hardware in the
ECHO computer.
GOTO Exit


:Exit
echo exit


