What's New in VirusScan for Windows 3.1x v2.5.2 (9609) Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 3.1x. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Contact McAfee ____________ NEW FEATURES * ENHANCEMENTS * 1. VirusScan for Windows 3.1x now implements VShield as a virtual device driver (VxD). This replaces the VShield Terminate and Stay Resident (TSR), enhancing features and reducing the memory footprint. VShield operates directly in the Windows environment, no longer relying on a DOS TSR. 2. A VxD is a filter to prevent the spread or activation of Macro viruses attempting to replicate within Windows applications, such as Microsoft Word for Windows. 3. When a virus is found, VShield's VxD can be pre-configured to prompt the user for action or to automatically repair, quarantine, deny access to, or delete infected files. 4. McAfee's VShield VxD allows the user to configure when to conduct a scan (for example: on file run, copy, create, or rename; on floppy disk access) and which files to include. * NEW VIRUSES DETECTED * This DAT file detects the following 68 new viruses. In addition, locations that have experienced problems with a particular virus are identified. _1194 Spain ACCOUNT.AVENGER.873 ALLIANCE ARCV.255 ARCV.679 ARCV.745 ASH.743 BEDA.1530 BEER.2620 BEER.3164.B BEER.3192.B BIRTHDAY:DE (*) Germany BLEAH BUERO:DE Germany BW-525 CASTELLO.3742 Spain CHEGUEVA Spain COMPBACK.3783 CORDOBES.3334 Spain DEI.8772 DEI.DR.8772 DELWIN.1199 DIETZEL:DE (*) DODGER HASSLE HASTA.884 HLLP.NAZI.5984 IVP.665 JERUSALEM.BUPT.1220 JERUSALEM.BUPT.1279 JERUSALEM.BUPT.1367 KABOUT.1804 (*) KARNAVALI.1972 Europe KDG KITTY LAMEGO.729 Portugal LIBERTY.2857.D LITTLEPEST.4243 (*) MANNEQUIN MANZON.1404 Europe MENDOZA.3380 Spain MSU.297 NECROS.1164.A NECROS.1164.B PHALCON.1117 PINDONGA.B PS-MPC.578.C PS-MPC.611.J PS-MPC.753 PS-MPC.AOS PULCE.1840 RADYUM.509 RAHACK.936 Netherlands RDA FIGHTER.5871 RIOT.ETERNITY.565 SALMAN.2000 US SATRIA.RZ Europe SCREAMING_FIST.652 SCREAMING_FIST.709 SIRIUS.ALIVE.4608 TANPRO.749 TEQUILA.2468 TURNER.3276 TV V3.1765 VACSINA.1206.A VERWOLF VICTOR.2442.A (*) Requires DOS/Win 2.5.2 engine * NEW VIRUSES REMOVED * This DAT file removes the following 38 new viruses. In addition, locations that have experienced problems with a particular virus are identified. _1194 Spain ACCOUNT.AVENGER.873 ALLIANCE England ARCV.255 ARCV.657 ARCV.679 ARCV.745 ASH.743 BIRTHDAY:DE (*) Germany BLEAH BUERO:DE Germany CHEGUEVA Spain COMPBACK.3783 CORDOBES.3334 Spain DEI.8772 DEI.DR.8772 DIETZEL:DE (*) HASSLE HASTA.884 HLLP.NAZI.5984 IVP.665 LAMEGO.729 Portugal LITTLE_BROTHER Germany NO_FRILL.835 Australia PS-MPC.611.J PS-MPC.753 RAHACK.936 Netherlands SALMAN.2000 US SATRIA.RZ Europe SCREAMING_FIST.652 SHELL.10634 Internet TANPRO.524 TANPRO.749 TEQUILA.2468 TV V3.1765 VICTOR.2442.A ZYX Europe (*) Requires DOS/Win 2.5.2 engine * ISSUES ADDRESSED IN THIS RELEASE * 1. Resolved frequent floppy disk drive accesses when opening applications. 2. Increased system performance. 3. Improved virus detection during file decompression. 4. Improved detection of NYB and ONEHALF viruses. 5. Amended AUTOEXEC.BAT to include SCAN C: command to execute system startup scan. 6. Enabled VirusScan's Virus List dynamic character- scrolling feature. 7. Removed company name requirement for installation. 8. Improved VShield's lock-out feature. If the user deselects all options in the Prompt User for Action setting, the user is now locked out and must reboot the system to continue. 9. Resolved VShield's overwriting the Load= line in the WIN.INI file. Now, VShield correctly modifies the line and is compatible with the uninstaller. 10. Resolved the issuing of a general protection fault (GPF) in the Windows environment when clicking the on-demand Scan button. 11. Improved communication between VShield and the on-demand program. The message,"Cannot send exclude data to VxD", no longer appears when stopping an on-demand scan and then changing a setting in the VShield configuration manager. ____________ KNOWN ISSUES 1. This version will not detect previously installed versions of VShield TSR (from 2.2.F and prior) and will not remove the path entry made to the AUTOEXEC.BAT file if the installation was different than the default c:\mcafee\viruscan. 2. In order to re-enable VShield after disabling it, right-click and select Enable. ____________ INSTALLATION * INSTALLING THE PRODUCT * If you would like to perform a "silent" installation of VirusScan, requiring minimal user interaction and using all default or "Typical" installation settings, add -s (i.e. SETUP.EXE -s) to the setup command when you install the product. Network Administrators can customize the silent installation by following the steps below. 1. Check in the Windows directory to ensure that a file named SETUP.ISS does not already exist. If it does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e. SETUP.EXE -r). 3. Select the components you would like to be installed during the silent installation. All responses will be recorded. 4. Finish the installation, and locate the file SETUP.ISS in the Windows directory. 5. Open the file using any ASCII editor (e.g., NOTEPAD.EXE) and delete the section titled APPLICATION. 6. Rename, back up, or delete SETUP.ISS on the first installation disk (floppies only). For CD-ROM versions of the product, you must copy the installation files onto the hard drive before taking this step. 7. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. 8. Run SETUP.EXE with the -s switch (i.e. SETUP.EXE -s). 9. When the silent installation is complete, you should reboot the machine manually. NOTE: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. Also, the file used for the silent installation, SETUP.ISS, may not work properly across different operating systems. For example, if the silent install is generated for Windows 95, it may not work properly in Windows 3.1x or Windows NT. * PRIMARY PROGRAM FILES FOR VIRUSSCAN FOR WINDOWS 3.1x * Files located in the Install directory: ======================================= 1. Installed for VShield/DOS/VirusScan: README.1ST = McAfee information CLEAN.DAT = Virus clean definition data NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data VALIDATE.EXE = McAfee file validation program WCMDR.EXE = Windows Commander program WCMDR.INI = Windows Commander configuration settings PACKING.LST = Packing list WHATSNEW.TXT = What's New document 2. Installed for VShield: MCKRNL16.DLL = Tools library MCUTIL16.DLL = Run-time support library TABDLL11.DLL = Properties dialog library VSHCFG16.EXE = VShield Configuration Manager VSHWIN.EXE = VShield on-access engine CHKVXD.EXE = VShield virtual device driver checking utility VSHCFG16.HLP = Online help DEFAULT.VSH = Default VSH settings 3. Installed for DOS: SCAN.EXE = MS-DOS scan program 4. Installed for VirusScan: WSCAN.EXE = VirusScan for Windows 3.1x on- demand scanner WSCAN.HLP = VirusScan for Windows 3.1x online help WSCAN.INI = VirusScan for Windows 3.1x config- uration file PROFILE1.PRF = Sample WSCAN configuration profile PROFILE2.PRF = Sample WSCAN configuration profile Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/VirusScan: CTL3D.DLL = 16-bit 3D Windows controls library (*) CTL3D32.DLL = 32-bit 3D Windows controls library (*) (*) File will be installed upon installation of VirusScan if it does not already exist, or if an older version is found. 2. Installed for VShield: MCFSHOOK.386 = File system hook MCKRNL.386 = Scan engine device driver MCSCAN32.386 = Scan engine device driver MCUTIL.386 = Utility device driver VSHIELD.386 = VShield device driver * INSTALLING THE PRODUCT * If you have not already installed the product, create a folder and copy the files to it. When the installation is complete, it is recommended that you restart your system. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69 or 70 byte file. When VirusScan is applied to this file, Scan will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _____________ DOCUMENTATION For more information, refer to the User's Guide, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. This file is in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee product. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or 205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: When I have an infected file, why does the infected counter increase by increments greater than one? A: The file system will typically access a file more than once. On each access, VirusScan scans the file and detects the infection. Q: Does VShield detect Word Macro infections? A: Yes. VShield detects and cleans Word Macro infections. Q: Can I update VirusScan's data files to detect new viruses? A: Yes. If you have Internet access, you can download updated VirusScan data files from the McAfee Web Site, BBS, or other online resources. To download from the McAfee Web Site, follow these steps: 1. Go to the McAfee Web Site (http://www.mcafee.com or 205.227.129.97). 2. Click on the Download McAfee button in the upper left hand column or frame. 3. Click Get that DAT to update DAT files. 4. View the information provided on new DAT files and downloading. 5. Click on Download this Months DAT. 6. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 7. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III Fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations: McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.134 4. World Wide Web: http://www.mcafee.com or 205.227.129.97 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.