The REScan program has been designed to run on Windows NT Systems both server and desktop. The program will do the following:

• Scan the system and remove the ie403r.sys and in some cases if created the taskmgr.sys files to stop the service.
• Remove the virus from memory.
• Decompress the EXE’s code and remove it from the virus, making it usable.
• Decrypt the encrypted data files, and make them usable.
• Immunize the system from re-infection.

REScan can take on the following switches:

• /sub - this command will provide recursive scanning to subdirectories
• /log - will create a log from the scan called RESCAN.LOG
• /adl - is used to scan all local drives
• /adn - is used to scan all mapped network drives

Running REScan w/o an argument, the /ADL switch is used. Here's an example of how to use this program:

C:\>rescan /adl /adn /log

The /sub switch will execute by default when the /adl or the /and switches are used together or independently. REScan will always scan for the system processes IE403R.SYS and TASKMGR.SYS, and will always attempt to clean infected files and decrypt virus encrypted files.

C:\> rescan \ /sub to scan and clean from the system and the C: drive

C:\> rescan \FOO to scan just the foo directory, no subdirectory is scanned.

C:\> rescan \FOO /sub to scan everything in the "FOO" directory

C:\> rescan /adl /adn to scan and clean both local and network drives

C:\> rescan \*.dll /sub to scan all .DLL's on the C: drive

C:\> rescan same as /ADL

• The scanner will kill the virus process, and then "clean" the virus' key from the system registry.

• The ie403r.sys and taskmgr.sys (if present) will be deleted. They cannot be cleaned since, they don't contain any "original" data.

• The PSAPI.DLL is required to run the program and is installed with most the NT server and work station installations.