What's New in ScanPM v2.5.3 (9611) Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's ScanPM protected mode scanner. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. ScanPM is a command-line scanner with a reduced conventional memory footprint, that operates in protected mode command-line environments such as DOS. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Contact McAfee ____________ NEW FEATURES ScanPM now supports centralized alerting and reporting to a remote NetWare or Windows NT server. Using NetShield for NetWare v2.3.3 or NetShield for Windows NT v2.5.3, client alerts and reports can be redistributed or compiled at the central server location for ease of management. * ENHANCEMENTS * 1. Significantly increased Master Boot Record and Boot Sector virus detection and removal. 2. Enhanced the DOS ErrorCodes feature for increased compatibility with SCAN.EXE. * NEW VIRUSES DETECTED * This DAT file (9611) detects the following 129 new viruses. Locations that have experienced particular problems with specific viruses are also identified. _922 Germany _1000 US _2673 Philippines APOCALIPSE.1685 Portugal APRIL1A.798 APRIL1B.797 AREQUIPA.1994 Peru ASBV ASH.302 ASMODEOUS.1437 ASSIGN.653 ATOM BANDUNG.A US/Indonesia BANDUNG.B BARAN.2978 BARAN.3001 BNB.498 BR.1180 BW.790 CACO.3310 Peru CHANDI US CHAPA.447 CHAPA.448 CHERRY.2266 COMP.180 CONCEPT.I CONCEPT.L CONCEPT.M CONCEPT.N CONCEPT.P COOL.929 COREA.926 COUP.2062 CRAWLER.545 CRIM_WW CYBERTECH.668 DAN.1784 DELTREE TROJAN DEMON3B.4313 DINA.271 DINA.283 DIR-II.1536.G DIR-II.AS DREAMER.8869 DST.330 DST.347 DST.396 DSTAR.223 EASY Internet EDOL.832 EXEHEADER.VLAD.337 EXTRACTJPG.TROJAN FATHER_MAC.1382 FAULT.9209 FORMATC:TROJAN FSN.1279 GANGSTERZ Internet H-ANDROMED.594 HELGA.666.B HELPER US HIDER.2143 INCH INFERNO.781 JASON.626 JOVIAL.503 JUICE.305 KALO.1464 KOSKON.313 LATER.981.B LD93.1217 Australia LUNCH.783 MACGYVER.4112 (MBR) Taiwan MAIDEN.891 MARKUS.5415 MBRK.714 MDMA.C US MINZ.470 MIXTURA.1000 MOSCA.1278 MURCIA.4651 NPOX.1186 OKTUBRE.1784 OUTLAW Internet PELIGRO.1206 Peru PHARDERA Internet PIRANIA.1617 PROTOVIRUS.720 PS-MPC.504 Peru RESCUE 911.3774 Saudi Arabia ROTATOR.864 SALAMANDER.888 SANLORENO.1025 SAVER:DE Internet SCROLL.600 SHOWOFXX Australia SIERRA.D US SILLY.745 SMILEY:DE Germany SPEC.907 SPOOKY:DE Internet STEATODA.1623 Israel STRYX:DE Internet SUPERF.1175 SVC.3103 South America SYSKLL.290 T555.556 TAURUS.1852 THEATRE:TW (*) Taiwan THEATRE.A:TW (*) Taiwan TREBUJENA.1094 TRIVIAL.44.F TRIVIAL.45.H TRIVIAL.52 TRIVIAL.53.A TRIVIAL.119 TRIVIAL.284 TROOPER.2259 TWNO:TW (*) Taiwan TWNO.B:TW (*) Taiwan TWNO.C:TW (*) Taiwan UNHAPPY.763.A UNHAPPY.763.B VCC.620 VCS.799 WAZZU.J WAZZU.O WAZZU.P US WAZZU.Q US WEATHER:TW (*) Taiwan ZGENRAT.785 US (*) Infects double-byte (omnicode) versions of Microsoft Word which include Japanese, Korean, Chinese, and Simplified Chinese. * NEW VIRUSES REMOVED * This DAT file (9611) removes the following 112 new viruses. Locations that have experienced particular problems with specific viruses are also identified. 666 _922 Germany _1000 US 1946 _2673 Philippines ARALE AREQUIPA.1994 Peru ASBV AWAITS.500 BABY_L.674 BADSIZE.369 BANDUNG.B BARAN.2978 BARAN.3001 BARROTES.840 Spain BNB.498 BR.1180 BRBI.KOBRIN.492 CACO.2965 CACO.3310 Peru CARRYON.534 CHANDI US CHAPA.447 CHAPA.448 CONCEPT.I CONCEPT.L CONCEPT.M CONCEPT.N CONCEPT.P COOL.929 COREA.926 COUP.2062 DEARFRIEND.524 DOPERLAND.490 DREAMER.4808 DREAMER.8869 DUNE.483 EASY Internet EUPM.1731 F-YOU FIFO.333 FORMAS.1146 FORMATC:FORMAT GANGSTERZ Internet GENE.1991 GENIUS H-ANDROMED.594 HELPER US INCH.386 INT4B.231 INT4B.242 IVP.BUBBLES.684 US KALI-4 KOSKON.313 LD93.1217 Australia LOVEBUZZ.591 LUNCH MACGYVER.4112 Taiwan MANTRA.719 MARKUS.5415 MDMA.C US NPOX.1186 OMEGA OUTLAW Internet PELIGRO.1206 Peru PHARDERA Internet PS-MPC.504 Peru PUPPETS.960 RESCUE 911.3774 Saudi Arabia SAVER:DE Internet SHOWOFXX Australia SIERRA.D US SILLYC.90 SILLYC.155.B SILLYC.165 SILLYC.200.B SILLYC.202 SILLYC.226 SILLYC.316 SILLYC.373 SILLYORCE.76.B SILLYRC.214 SILLYRC.248 SILLYRC.303 SMILEY:DE Germany SPOOKY:DE Internet STEATODA.1623 Israel STRYX:DE Internet SUPERVISOR.2221 SVC.3103 South America T555.556 THEATRE:TW (*) Taiwan THEATRE.A:TW (*) Taiwan TIE.619 TIP.554 TULA.1540 TULA.1656 TURBOEXE.854 TWNO:TW (*) Taiwan TWNO.B:TW (*) Taiwan TWNO.C:TW (*) Taiwan UNHANDLED.495 UNHAPPY.763.A UNHAPPY.763.B VIAGGIO.1051 VOTADC.591 WAZZU.J WAZZU.O WAZZU.P US WAZZU.Q US WEATHER:TW (*) Taiwan WILDY.354.B WILDY.354.C (*) Infects double-byte (omnicode) versions of Microsoft Word, which include Japanese, Korean, Chinese, and Simplified Chinese. ____________ KNOWN ISSUES 1. ScanPM does not support Windows 95 or Windows NT. To scan 95 or NT systems, use a McAfee product that is native to those operating systems, such as VirusScan95, VirusScan for Windows NT, or NetShield NT. 2. If CTRL+C is applied when running the SCANPM /VIRLIST command, ScanPM generates a false scanning summary and "SCAN terminated by user" message. 3. ScanPM does not generate a summary report after CTRL+BREAK is applied. 4. It is recommended that SMARTDrive be enabled and buffers increased for maximum performance. When SMARTDrive is not present and/or buffers settings are low, ScanPM may operate considerably slower than VirusScan for DOS. ____________ INSTALLATION * PRIMARY PROGRAM FILES FOR SCANPM * PACKING.LST = Packing list README.1ST = McAfee information WHATSNEW.TXT = What's New document SCAN.DAT = Virus scan definition data NAMES.DAT = Virus names definition data CLEAN.DAT = Virus clean definition data SCANPM.EXE = ScanPM program VALIDATE.EXE = McAfee file validation program AGENTS.TXT = McAfee authorized agents * SYSTEM REQUIREMENTS * Because ScanPM is designed to operate in the protected mode environment, its system requirements differ slightly from those for VirusScan for DOS. Before installing ScanPM, please review the system requirements listed below: - 386 CPU or higher - MS DOS version 3.3 or higher - 75 kilobytes of conventional memory - 1.5 megabytes of free hard drive space * INSTALLING THE PRODUCT * 1. Make a directory on your hard disk drive. 2. Copy the files to that directory. 3. Add the directory to the path statement in your AUTOEXEC.BAT file. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When ScanPM is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. * UNINSTALLING THE PRODUCT * 1. Remove the directory from the path statement in your AUTOEXEC.BAT file. 2. Delete the files from the directory. 3. Remove the directory. _____________ DOCUMENTATION For more information, refer to the DOS section of the VirusScan User's Guide, available from McAfee's BBS and FTP site. This file is in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee product. Adobe Acrobat Reader can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.97 __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: How do I enable McAfee's centralized alerting and reporting option? A: ScanPM now supports centralized alerting and reporting to a remote NetWare or Windows NT server running NetShield for Windows NT v2.5.3 or NetShield for NetWare v2.3.3. To set up this option on your VirusScan client, use the /ALERTPATH option, where the is the path to the remote NetWare volume or NT directory. From this directory, NetShield can broad- cast or compile the alerts and reports according to its established configuration. NOTE: The client must have write access to this location and the directory must contain the NetShield-supplied CENTALRT.TXT file. To send a complete alerting file that identifies the system and user, establish the following environment variables or add them to the AUTOEXEC.BAT file. Set COMPUTERNAME= Set USERNAME= The alert file sent to the server is an .alr text file. Upon receipt of the alert file, NetShield NT or NetShield for NetWare sends an alert message to an administrator and/or appropriate personnel. Q: How does ScanPM differ from VirusScan for DOS? A: ScanPM is a limited substitute for VirusScan for DOS to be used for reduced memory footprint. A minimum of 490K of free conventional memory is recommended to run VirusScan for DOS. ScanPM operates in protected mode and only requires 75K of conventional memory. Q: Can I clean the Master Boot Record (MBR) of a Windows NT file system (NTFS) formatted hard drive? A: Yes. Take these steps to clean the MBR. Boot the Windows NT computer from a virus-free DOS bootable (system) diskette. Then run ScanPM: SCANPM C: /BOOT /CLEAN. This will clean the NTFS Master Boot Sector and allow Windows NT to successfully reboot from the hard disk drive. However, ScanPM will not be able to read the rest of the NTFS partition. After starting Windows NT, execute VirusScan for Windows NT to detect and clean Windows NT file infections. Q: How can I minimize the time needed for scanning my hard drive with ScanPM? A: McAfee recommends two methods for minimizing scanning time. The most effective method is using SMARTDrive and increasing buffer size. For information on increasing buffer size, consult your DOS manual. If you do not have SMARTDrive enabled, you can minimize scanning time by only scanning critical areas at system startup. In the AUTOEXEC.BAT, use the command SCANPM C:\ to scan memory and the root directory, where a virus would most likely reside. Perform a full scan at a regularly scheduled, off-peak time when your system would otherwise be idle. Q: Can I update ScanPM's data files to detect new viruses? A: Yes. If you have Internet access, you can download updated McAfee data files from the McAfee Web Site, BBS, or other online resources. To download from the McAfee Web Site, follow these steps: 1. Go to the McAfee Web Site (http://www.mcafee.com or http://205.227.129.97). 2. Click on the Download McAfee button in the upper left hand column or frame. 3. Click on Update Your DAT Files to update DAT files. 4. View the information provided on new DAT files and downloading. 5. Click on Download this Month's DAT. 6. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 7. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.134 4. World Wide Web: http://www.mcafee.com or http://205.227.129.97 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.