What's New in VirusScan for Windows 95 v2.0.5 (9608) Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Additional Information - Contact McAfee ____________ NEW FEATURES 1. The new Administrator Mode provides the ability to lock VirusScan95 configuration settings. 2. VirusScan95 configuration files have been enhanced. Right-clicking on a VirusScan configuration file (VSC) displays the file's properties and two new tabs: Options and Actions. One of the new properties is Start Automatically, located in the Options tab. Start Automatically is necessary for scheduled scanning from the optional System Agent and for Startup group on-demand scanning. * NEW VIRUSES DETECTED * This DAT file (9608) detects the 278 new viruses listed below. - Detection for 258 viruses was incorporated from DAT file 9607. - Detection for 20 new macro viruses was added. Also, locations that have experienced problems with a particular virus are identified. _751 3DEVIL.A 3DEVIL.B ACE.1872 AGA.3000 AHAV.336 AIDS.872 ALEVIRUS.690 (Brazil) ALEVIRUS.1613 (Brazil) ALFONS.1536 ANARKEY.475 ANDREW AOS.833 AOS.847 AOS.854 ASMO.1800 AT.1648 ATC-321 AVATAR.POSITRON.512 BABOSE BADTOWN.684 BADTOWN.687 BE.451.B BIGDEATH.1153 BISHDKEY.4160 (*) BISHK.319 BISHKEKE.4240 (*) BISHOP.4240 (*) BLACKTIDE.2419 BLAD.1015 BLTD.2419 BODY.884 BUGS.282 CEIB.4629 CHER.2266 CIVIL IV.586 CMOS_DEATH.B COMPIAC.379 CONCEPT.E CONJURER CONZOULE.240 CORDOBES.3334 (Uruguay) COSENZA.3205 CRAZYFROG.1477 CREEPER.252 CRITTER.1015 CROATIA.683 DARK_APOCALYPSE.1600.B DARK_REVENGE.1024 DAYTON.792 DEADWIN.1228 (Bolivia) DEDA.1000 DEI.1780 DELTA.1163 (Brazil) DFLKFD DIALOGOS.1350 DIALOGOS.1522 DONB.444 DRD-4634 DRUID.1888 DVA.445 DVA.749 EATRITCH.946 EI-CUAREIM.800 ENJOY EPSILON.513 EUSK.811 EVC.161.D EXORCIST.212 FINDME FINPOLY.2368 (*) FIZZLE.313 FLYING.633 GATE GOSH.1831 GRREP H8.1173 HARE.7610 (*) (Internet) HARE.7750 (*) (Internet) HARE.7786 (*) HH HI.680 HI.764 HI.802 HLLC.4528 (*) HLLC.5000 (*) HLLC.8224 (*) HLLC.12573 (*) HLLC.14880 (*) HLLC.AIDS.8064 (*) HLLC.BOLEK.8096 (*) HLLC.CRAWEN.8306 (*) (Italy) HLLC.CRAWEN.8516 (*) HLLC.CUMULUS (*) HLLC.EIB.5000 (*) HLLC.ENRICO (*) HLLC.EVEN.PC (*) HLLC.EVENBEEP.B (*) HLLC.KRAD.4658 (*) HLLC.LANC.7376 (*) HLLC.TREE2.14186 (*) HLLC.VSW.5936 (*) HLLC.WORM.16412 (*) HLLC.XMAS.15264 (*) HLLO.3008 (*) HLLO.3855 (*) HLLO.4032 (*) HLLO.4317.B (*) HLLO.4734 (*) HLLO.4830 (*) HLLO.5760 (*) HLLO.6144 (*) HLLO.BIG&FAT.6561 (*) HLLO.CRASH.7227 (*) HLLO.F-SOFT.3521 (*) HLLO.FU.8608 (*) HLLO.HEPATITUS (*) HLLO.KAMIKAZE (*) HLLO.TU.4752 (*) HLLO.VSW.3836 (*) HLLO.VSW.4017 (*) HLLP.3678 (*) HLLP.5792 (*) HLLP.5824 (*) HLLP.7408 (*) HLLP.7529 (*) HLLP.7808 (*) HLLP.15392 (*) HLLP.BDAAGWA.4984 (*) HLLP.BISHKEK.4160 (*) HLLP.BISHKEK.4240 (*) HLLP.BWA.4984 (*) HLLP.CEIB.4629 (*) HLLP.CHSU.4484 (*) HLLP.DUPALEC (*) HLLP.KASIENKA.8192 (*) HLLP.NOTFOUND.6176 (*) HLLP.RANGEL.5000 (*) HLLP.RUNNER.9312 (*) HLLP.SAURON.4568 (*) HLLP.SON.4731 (*) HLLP.UPI.4641 (*) HLLP.VOVA.12560 (*) HORSA.1185 HUE.482 ID.248 IMI.1536.H IMMORTAL.2185 IVP.667 I_LOVE_D.3618 JASI.666 JULY_29TH JUNKIE.1308 KALN.3225 KALN.3612 KASIUNIA KBWI.1349 KERS.923 KONKOOR.3072 KOSKO.313 KUNS.168 KWX.1458 LAB LEATH LEDA.820 LINC.196 LINC.307 LOSL.535 LYUBA.381 MAD.2631 MADMAX.507 MAR.1972.D MARVIN MARYR MDMA (Texas, Illinois, Georgia) MESSAN.B MG.500.C MICROB.431 MIPT-PHYSTECH.2000 MIREA.703 MOJHOO.1405 MRTI.576 MTZ-PINK NADO.LOVE.602 NADO.REDV.584 NEXIV NICHOLS NO5.1235 NUCLEAR.B PC KNIGHT.2083 (Europe) PCW:DE (Europe) PEMPE.1811 (France) PHANTOM1 (*) PIZELUN.3599 PMM.575 PRES.7760 PRIMUS.512 PRIMUS.528 PS-MPC.AOS QRES.224 RADYUM.503 RENE.4509 RETALIATOR.1535.A RETALIATOR.1535.B RIOT.304 RIOT.IR8.928 RIOT.MARI.1125 ROMA RUSSEL.3072 SANDRA.1809 SENORITA.885 (Europe) SEPULTURA:MTE SHELL.10634 (Australia) SHIRE.117 SILLYC.96 SILLYC.115.B SILLYC.186 SILLYC.208 SILLYC.228 SILLYC.710 SINAI.1208 SIRIUS.ALIVE.4000 SMEG.V0_3.DEMO.B STEALTH.F STONED.KILL STRAT.486 STRIKE SZATAN TANKAR.236 TCHECHNYA.1919 TIMID.497 TORNADO.759 TPED.1760 TRIVIAL.35.B TRIVIAL.44.D TRIVIAL.86 TRIVIAL.963 TRIVIALSMEG UFO.1468 UNGAME.823 UPI.4641 VCL.O.610 VIV 524 VOYAGER.1134 VOYAGER2.508 VSV.3836 VSW.3966 VSW.4017 VSW.5063 VSW.5176 VSW.5936 WASP.1312 WRLK.1672 ZIBBERT.1268 (Brazil) ZNOS.1730 ZNOSK.509 ZYX.5739 (*) Requires VirusScan for Windows 95 2.0.5 engine Detection for the following 20 new macro viruses was added in DAT file 9608. Locations that have experienced problems with a particular virus are identified. BOOM:DE (**) COLORS.D CONCEPT.G (US) CONCEPT.H DIVINA (Italy) DOGGIE FRIENDLY:DE (**) GUESS IMPOSTER.B IRISH KILLDLL LBYNJ:DE (**) MADDOG (US) NF NPAD (Pacific Rim) REFLEX SATANIC (Internet) WAZZU.B (US) WAZZU.C WAZZU.D (US) (**) Some viruses can only spread in the Word for Windows environment of specific localized languages, denoted by a colon and two letters following the virus name. The viruses indicated above, followed by :DE, can only spread in the German Word for Windows environment. * NEW VIRUSES REMOVED * This DAT file (9608) removes the 55 new viruses listed below. - Removal of 35 viruses was incorporated from DAT file 9607. - Removal of 20 new macro viruses was added. Also, locations that have experienced problems with a particular virus are identified. _751 ALEVIRUS.690 (Brazil) ALEVIRUS.1613 (Brazil) ALFONS.1344 CONCEPT.E (Belgium) DARK_REVENGE.1024 DEADWIN.1228 (Bolivia) DELTA.1163 (Brazil) DEMON3B.5610 (*) (Europe) DIGI.3547 (*) (Czech Republic) EPSILON.513 FITW.7924/7448 (*) (Europe) H8.1173 HARE.7610 (*) (Internet) HARE.7750 (*) (Internet) HARE.7786 (*) HLLC.CRAWEN.8306 (Italy) IMMORTAL.2185 KARNIVALI.1972 (US - East Coast) LEDA.820 MDMA (Texas, Illinois, Georgia) NATAS.4926 NUCLEAR.B PC KNIGHT.2083 (Europe) PCW:DE PEMPE.1811 (France) RUSSEL.3072 (*) SILLYC.96 SILLYC.186 SILLYC.710 SIRIUS.ALIVE.4000 SKATER.819 (Australia) VCL.O.702 (Internet) VOYAGER.1134 ZIBBERT.1268 (Brazil) (*) Requires VirusScan for Windows 95 2.0.5 engine DAT file 9608 removes the following 20 new macro viruses. Locations that have experienced problems with a particular virus are identified. BOOM:DE (**) COLORS.D CONCEPT.G (US) CONCEPT.H DIVINA (Italy) DOGGIE FRIENDLY:DE (**) GUESS IMPOSTER.B IRISH KILLDLL LBYNJ:DE (**) MADDOG (US) NF NPAD (Pacific Rim) REFLEX SATANIC (Internet) WAZZU.B (US) WAZZU.C WAZZU.D (US) (**) Some viruses can only spread in the Word for Windows environment of specific localized languages, denoted by a colon and two letters following the virus name. The viruses indicated above, followed by :DE, can only spread in the German Word for Windows environment. ____________ KNOWN ISSUES 1. VirusScan95 appears to continue scanning after clicking STOP. If this occurs, move the VirusScan95 window to reveal the DynaZip UnZip Error window. Click OK and respond appropriately to the dialog box. 2. Files with the "-" (dash) character in the filename that are compressed in Zipped files will not be scanned by the on-demand scanner. 3. When a macro virus is detected in conjunction with other viruses, the macro virus remover will not work. If this occurs, remove the other virus first or work in a separate area. 4. Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS memory managers may cause VirusScan95 to falsely detect viruses in memory. To eliminate false warnings, remark (Rem) the memory manager lines from your CONFIG.SYS to deactivate them. ____________ INSTALLATION * PRIMARY PROGRAM FILES FOR VIRUSSCAN95 * Files located in the Install directory: ======================================= 1. Installed for VShield/Scan95/DOS: README.1ST = McAfee information SCAN.DAT = Virus scan definition data NAMES.DAT = Virus names definition data CLEAN.DAT = Virus clean definition data VALIDATE.EXE = McAfee file validation program CHKVSH32.EXE = VShield virtual device driver checking utility PACKING.LST = Packing list UINSTALL.EXE = Uninstall program WHATSNEW.TXT = What's New document VSUINST.EXE = Uninstall assistant UPDATE.MSG = Update message file 2. Installed for VShield/Scan95: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library MCKRNL95.DLL = Library files MCUTIL95.DLL = Library files MCSCAN32.DLL = Library files 3. Installed for VShield: VSHCFG32.EXE = VShield configuration manager VSHWIN32.EXE = Detection engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan95: SCAN95.EXE = VirusScan95 program SHUTIL95.DLL = Run-time support library DZIP32.DLL = File compression library DUNZIP32.DLL = File decompression library DEFAULT.VSC = Default Scan95 settings 5. Installed for DOS: SCAN.EXE = MS-DOS scan program Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan95: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 2. Installed for VShield: VSHIELD.VXD = Detection virtual device driver 3. Installed for Scan95: S95EXT.DLL = Shell extension Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan95: SCANEXT.HLP = Scan95 Extension help VIRUSCAN.HLP = VirusScan help VIRUSCAN.CNT = VirusScan context-sensitive help Note: WINDOWS refers to the directory to which Windows 95 is installed, not the Windows 3.1x directory. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69 or 70 byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _____________ DOCUMENTATION For more information, refer to the User's Guide, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. This file is in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee product. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or 205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: How do I scan multiple drives? A: #1 VirusScan95 can scan many locations simultaneously. To do this, take these steps: 1. Launch Explorer. 2. Highlight the drives or folders you want to scan. 3. Right-click to reveal the Context Menu. 4. Select Scan for Viruses. 5. Click Scan Now to begin scans. A: #2 Enter LocalDrives or NetworkDrives in the Scan In text dialog on the Where & What property page. Click Scan Now and all LocalDrives or all NetworkDrives will be scanned. Q: I moved a VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan95, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved VSC file. 2. While pointing to the VSC file, right-click to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Options Tab on the property sheet. 5. Check the Start Automatically box. By enabling this option, scanning will begin automatically. If viruses are not detected, VirusScan95 will automatically close and free up system resources. Q: When VirusScan95 is launched, how does it determine the default settings? A: VirusScan95 default settings may be found in the DEFAULT.VSC file located in the install directory. Q: My executable files were set to shareable and read-only before I ran VirusScan95, now they are read-only. How can I retain the shareable attribute? A: Mark the files Execute Only. Then create a dummy account called SCAN on the server and grant only Read and Filescan rights to that account. Log in as SCAN before scanning your Novell volumes. Q: Can I update VirusScan's data files to detect new viruses? A: Yes. If you have Internet access, you can download updated VirusScan data files from the McAfee Web Site, BBS, or other online resources. To download from the McAfee Web Site, follow these steps: 1. Go to the McAfee Web Site (http://www.mcafee.com or 205.227.129.97). 2. Click on the Download McAfee button. 3. Scroll down, and select either McAfee for Home (for personal evaluation copies) or McAfee for Business (for corporate evaluation copies). If you select McAfee for Business, you will be asked to provide some contact information. Use Tab to move from line to line within the form. 4. Click on either Evaluation Copies of McAfee Products or the McAfee Public Beta Site. 5. Click on Anti-virus, then select Index.txt to view descriptions of the products available on this site. Find the most recent virus data file for your product. 6. Return to the Anti-virus page and click on the file. Download the file by saving it to your Desktop. 7. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 8. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________________ ADDITIONAL INFORMATION The new Administrative Mode feature allows System Administrators to lock VirusScan95 configurations on users' systems. To use this feature, take the following steps: 1. Start VirusScan95 by double-clicking on the VirusScan icon. 2. Press and hold the Ctrl+Shift+Alt keys and double-click the magnifying glass icon. 3. Open the File menu. 4. Select Administrator Mode. a. Enter a new password. b. Confirm your new password. 5. Choose your configurations from the What & Where, Actions, and Reports tabs. 6. To retain these settings as an individual custom configuration file, save the file to the desktop or Program Menu for execution. Context-sensitive scanning (right-clicking) will draw upon the original DEFAULT.VSC configuration file and scan the selected item with the pre-established default settings. 7. To establish your configuration as the default setting, save the new settings by overwriting C:\PROGRAM FILES\MCAFEE\VIRUSSCAN95\DEFAULT.VSC 8. After saving your configuration and leaving Administator Mode or closing VirusScan95, the optional settings will be locked and cannot be altered without knowledge of the access keys, hotspot, and established password. 9. To view and confirm your changes, restart VirusScan95 from the shortcut if you overwrote the DEFAULT.VSC file or from your saved configuration file (VSC). To alter your configuration settings or make additional changes, repeat this process. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.134 4. World Wide Web: http://www.mcafee.com or 205.227.129.97 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.