What's New in VirusScan for Windows 95 v3.0.0 (3000) Copyright 1994-1997 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Additional Information - Contact McAfee ____________ NEW FEATURES 1. VirusScan now offers the highest level of virus detection rates in the industry as well as fast scanning performance with its new Hunter engine technology. The Hunter engine achieves its stellar performance through a 32-bit, multithreaded implementation designed to utilize the latest advances in memory and I/O management. Hunter scanning technology achieves its leadership position in virus detection by combining several types of virus analysis technologies. All virus types including Word and Excel macros, boot-sector infections, file, multi-partite, stealth, polymorphic and encrypted viruses are detected. The Hunter engine even stops viruses written in Visual Basic 5.0 and Office97 file formats, offering users maximum defense against the newest threats to data. 2. VirusScan for Windows 95 now offers an Emergency Disk creation utility. With this utility, you can create an Emergency Disk during and after VirusScan installation with your own high density floppy disk. This disk is an important part of a complete security program. 3. ScanPM is now included with VirusScan for Windows 95. ScanPM is a command-line scanner with a reduced conventional memory footprint that operates in protected mode command-line environments such as DOS. SCANPM.EXE is added to the AUTOEXEC.BAT for low-memory- condition scanning on boot-up. 4. VirusScan detects and removes viruses specific to Microsoft Word97 and Excel97 files. 5. VirusScan now offers simplified Microsoft Word, Excel, and zip file scanning. Word, Excel, and zip file scanning can now be enabled by clicking the right mouse button. 6. VirusScan for Windows 95 now detects and removes the LAROUX Excel macro virus. 7. VirusScan now includes new and improved polymorphic detection. * NEW VIRUSES DETECTED * This DAT file (3000) detects and removes an additional 2000 viruses. The Macro viruses listed below are detected and removed with this DAT file. New Macro viruses detected and removed: ABC.A ALIEN (.A-.B) ALLIANCE.A ANTICONCEPT.A APPDER.A ATOM (.A-.H) BADBOY (.A-.B) BALU.A BANDUNG (.A-.J) BIRTHDAY.A BOOM.A BEURO.A CEEFOUR.A CHAOS.A CLOCK (.A-.D) COLORS (.A-.J) CONCEPT (.A-.N, .P, .S-.Z) COUNT10 (.A-.B) DANIEL (.A-.C) DARK.A DATE.A DIETZEL.A DIVINA (.A-.D) DMV (.A-.B) DOGGIE.A DZT.A EASY.A EPIDEMIC.A FORMATC TROJAN FRIDAY.A FRIENDLY.A FURY.A GANGSTERZ.A GOLDFISH.A HASSLE.A HELLGATE.A HELPER.A HOT.A HYBRID.A IMPOSTER (.A-.B) IRISH (.A-.C) ITALIAN.A JOHNNY (.A-.B) KILLDLL.A KILLPROT.A KOMPU.A LOOK (.A-.C) LUNCH (.A-.B) MADDOG (.A-.B) MAGNUM.A MDMA (.A-.E, .G) MINIMAL (.A-.B) MVDK1 (Macro Virus Development Kits; .A-.B) NF.A NICEDAY (.A-.B) NIKI.A NIKITA.A NJ-CVK2 (Another Development Kit; .A-.B) NJ-DLK1A (.A-.D) NOMVIR (.A-.B) NOP (.A,.B,.D) NPAD (.A-.O) NUCLEAR (.A-.E) OLYMPIC (.A-.B) OUTLAW (.A-.C) PAPER.A PHANTOM.A PHARDERA (.A-.B) POLITE.A RAPI (.A-.H, .A1, .A2, .B1, .B2, ...) RATS (.A-.C) REFLEX.A SATANIC.A SAVER.A SHOWOFF (.A-.E) SMILEY (.A-.B) SPOOKY.A STRYX.A SWITCHES TROJAN TARGET.B TEDIOUS.A TELE.A THEATRE (.A-.C) TWISTER.A TWNO (.A-.F, .H) TWOLINES.A WAZZU (over 40) WEATHER (.A-.C) WIEDEROFFEN TROJAN XENIXOS (.A-.B) New Excel viruses detected and removed: DELTA (.A-.B) DMV.A LAROUX (.A-.B) LEGEND.A ROBOCOP.A SOFA.A YOHIMBE.A ____________ KNOWN ISSUES 1. On some systems, after running the VirusScan for Windows 95 uninstaller, the right mouse click option to "Scan for Viruses" is not always removed. 2. Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS memory managers may cause VirusScan for Windows 95 to falsely detect viruses in memory. To eliminate false warnings, remark (Rem) the memory manager lines from your CONFIG.SYS to deactivate them. 3. ScreenScan's log file has a maximum size of 100K. If the file reaches this size, the oldest data will be deleted. To retain logging data, you should edit the content to keep the log file under 100K or save the oldest data to another file. 4. ScreenScan is designed to display the Centralized Alerting and Reporting settings as declared in the DEFAULT.VSC file. Actual configuration of ScreenScan Centralized Alerting and Reporting must be done through the procedures outlined in the Frequently Asked Questions section below. 5. ScreenScan will stop scanning after it detects a virus and prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until the next time it activates. McAfee recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. 6. ScreenScan is not currently compatible with 3-D screen savers in Windows 95 Service Pack II or third-party ScreenSavers. A standard Windows 95 screen saver must be selected and ScreenScan must be enabled in order to activate scanning during screen saver operation. 7. After uninstalling ScreenScan, the screen saver will be set to None. You can reactivate your screen saver from the Display Properties. 8. Re-install VirusScan after installing or upgrading to Microsoft Excel 97 and/or Word 97 to enable VirusScan's right-mouse click option. ____________ INSTALLATION * INSTALLING THE PRODUCT * If you would like to perform a "silent" installation of VirusScan, requiring minimal user interaction and using all default or "Typical" installation settings, add -s (i.e. SETUP.EXE -s) to the setup command when you install the product. Network Administrators can customize the silent installation feature by following the steps outlined below. 1. Check in the Windows directory to ensure that a file named SETUP.ISS does not already exist. If it does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e. SETUP.EXE -r). 3. Select the components you would like to be installed during the silent installation. All responses will be recorded. 4. Finish the installation, and locate the file SETUP.ISS in the Windows directory. 5. Open the file using any ASCII editor (e.g., NOTEPAD.EXE) and delete the section titled APPLICATION. 6. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result=x where x is equal to 301 (Typical installation) 302 (Compact installation) 303 (Custom installation) 7. Add 100 to the above value, so that the Result variable is equal to 401, 402, or 403. Modifying this file will allow the installation to copy the VirusScan files to the drive where the operating system resides instead of defaulting to the C: drive. 8. Rename, back up, or delete SETUP.ISS on the first installation disk (floppies only). For CD-ROM versions of the product, you must copy the installation files onto the hard drive before taking this step. 9. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. 10. Run SETUP.EXE with the -s switch (i.e. SETUP.EXE -s). NOTE: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. Also, the file used for the silent installation, SETUP.ISS, may not work properly across different operating systems. For example, if the silent install is generated for Windows 95, it may not work properly in Windows 3.1x or Windows NT. 11. When the silent installation is complete, you should reboot the machine manually. * PRIMARY PROGRAM FILES FOR VIRUSSCAN FOR WINDOWS 95 * Files located in the Install directory: ======================================= 1. Installed for VShield/Scan32/DOS/ScreenScan: README.1ST = McAfee information CLEAN.DAT = Virus clean definition data MCALYZE.DAT = Virus definition data NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data CHKVXD.EXE = VShield virtual device SLFSRVSW.EXE = SelfServe client program VALIDATE.EXE = McAfee file validation program WCMDR.EXE = Windows Commander program driver checking utility WCMDR.INI = Windows Commander configuration settings WCMDRSIL.INI = unInstallShield helper configuration DELSL?.ISU = Uninstall file PACKING.LST = Packing list AGENTS.TXT = McAfee authorized agents FAXFORM.TXT = Fax registration form WHATSNEW.TXT = What's New document MCAFEE.SCU = Temporary SelfServe catalog file 2. Installed for VShield/Scan32: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library DUNZIP32.DLL = File decompression library file DZIP32.DLL = File decompression library file MCALYZE.DLL = Library files MCCOD32.DLL = Library files MCKRNL32.DLL = Library files MCSCAN32.DLL = Library files MCUTIL32.DLL = Library files VSECOM.DLL = Library files 3. Installed for VShield: VSHCFG32.EXE = VShield configuration manager VSHWIN32.EXE = Detection engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan32: SHUTIL.DLL = Run-time support library SCAN32.EXE = VirusScan for Windows 95 program DEFAULT.VSC = Default Scan32 settings 5. Installed for DOS: EDISKDOS.BAT = Emergency Disk batch file SCAN.EXE = MS-DOS scan program SCANPM.EXE = Protected mode scanner EDISK32.EXE = Emergency Disk creation utility EDISK32.INF = Emergency Disk information file EDISKDOS.IN = Emergency Disk file EDISKDOS.PIF = Emergency Disk program information file 6. Installed for ScreenScan: MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file SCRSCAN.EXE = ScreenScan program file SCRSCAN.HLP = ScreenScan online help file ScreenScan Activity Log.TXT = ScreenScan activity log Files located in WINDOWS directory: ========================================== SECCAST.ICO = Secure Cast icon Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan32/DOS: CDISSS.OCX = SelfServe library file MCAFECOM.DLL = McAfee Electronic Commerce library file 2. Installed for VShield/Scan32: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver 4. Installed for Scan32: S95EXT.DLL = Shell extension Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan32: SCANEXT.HLP = Scan32 Extension help VIRUSCAN.HLP = VirusScan help VIRUSCAN.CNT = VirusScan context-sensitive help 3. Installed for ScreenScan: SCRSCAN.HLP = ScreenScan help Note: WINDOWS refers to the directory to which Windows 95 is installed, not the Windows 3.1x directory. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti- virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _____________ DOCUMENTATION For more information, refer to the User's Guides, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. These files are in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee products. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan and ScreenScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: How do I enable McAfee's Centralized Alerting and Reporting feature? A: VirusScan v.2.0.8 or later now supports Centralized Alerting and Reporting to a remote NetWare or Windows NT server running NetShield for Windows NT v2.5.3 or NetShield for NetWare v2.3.3. To configure this option on your VirusScan client, modify Scan32's DEFAULT.VSH and DEFAULT.VSC, and/or your custom settings file to read the following: Note: Administrators will need to configure the AlertOptions section in both the .VSH and .VSC files for complete Centralized Alerting & Reporting. Add the following lines to the AlertOptions section: Note: The AlertOptions section already exists in the .VSC file. You must manually create this section in the .VSH file. szNetworkAlertPath= bNetworkAlert=1 Where the is the path to the remote NetWare volume or NT directory. From this directory, NetShield can broadcast or compile the alerts and reports according to its established configuration. NOTE: The client must have write access to this location and the directory must contain the NetShield-supplied CENTALRT.TXT file. To send a complete alerting file identifying the system and user, establish the following environment variables or add them to the AUTOEXEC.BAT file. Set COMPUTERNAME= Set USERNAME= The alert file sent to the server is an .alr text file. Upon receipt of the alert file, NetShield NT or NetShield for NetWare sends an alert message to an administrator and/or appropriate personnel. Q: I would like to electronically purchase and download the latest version of VirusScan for Windows 95. I don't feel comfortable giving my credit card information over the Internet and my modem is very slow. Is there a way I can purchase VirusScan via modem but download the product via the Internet? A: Yes. The first time you download VirusScan for Windows 95, the McAfee Online Purchase Wizard will prompt you to select the transmission method you prefer to download and to transmit your encrypted credit card information. At the Transaction Connection Type dialog box, select Internet to download your order via the Internet. At the Security Connection Type dialog box, select Direct Dial Modem to transmit your credit card information via modem. Q: While downloading a licensed copy of VirusScan for Windows 95, the installation was interrupted and/or canceled. Where can I find my licensed VirusScan files and how do I proceed with the installation? A: The files are in the VSint folder located in the Windows Temp directory. Double click on SETUP.EXE within the VSint folder to continue with the installation. Q: I have created my own Emergency diskette without using the Emergency Disk creation utility, how must I optimize it's performance? A: To enable your own Emergency Disk, you must create a CONFIG.SYS file on the boot diskette and add the following lines: [CONFIG.SYS] DEVICE=HIMEM.SYS DOS=HIGH Add the HIMEM.SYS file from the DOS directory or if you are using Windows 95 system files, add HIMEM.SYS from the \WINDOWS\COMMAND directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in your online documentation. Q: How do I scan multiple drives? A: #1 Enter LocalDrives or NetworkDrives in the Scan In text dialog on the Where & What property page. Click Scan Now and all LocalDrives or all NetworkDrives will be scanned. A: #2 VirusScan for Windows 95 can scan many locations simultaneously. To do this, take these steps: 1. Launch Explorer. 2. Highlight the drives or folders you want to scan. 3. Right-click to reveal the Context Menu. 4. Select Scan for Viruses. 5. Click Scan Now to begin scans. Q: I moved a VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan for Windows 95, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved VSC file. 2. While pointing to the VSC file, right-click to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Options Tab on the property sheet. 5. Check the Start Automatically box. By enabling this option, scanning will begin automatically. If viruses are not detected VirusScan for Windows 95 will automatically close and free up system resources. Q: When VirusScan for Windows 95 is launched, how does it determine the default settings? A: VirusScan for Windows 95 default settings may be found in the DEFAULT.VSC file located in the install directory. Q: How can I tell that ScreenScan is working? A: ScreenScan does not alert you when it is scanning your system. However, if you enable the logging option during your configuration, all ScreenScan activity will be recorded in a log file in the Installation directory. Q: Can I update McAfee's data files to detect new viruses? A: Yes. If your data files are out-of-date, VirusScan for Windows 95 will periodically prompt you to update them. If you have a modem or Internet connection, you can use VirusScan's new electronic update feature for easy data file updates, technical support, and registration. Note: VirusScan's electronic update feature applies to the retail and evaluation copies of VirusScan only. If you own a corporate copy of VirusScan, please notify your System Administrator to receive your data file updates. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________________ ADDITIONAL INFORMATION The new Administrative Mode feature allows System Administrators to lock VirusScan for Windows 95 configur- ations on users' systems. To use this feature, take the following steps: 1. Start VirusScan for Windows 95 by double-clicking on the VirusScan icon. 2. Press and hold the Ctrl+Shift+Alt keys and double-click the magnifying glass icon. 3. Open the File menu. 4. Select Administrator Mode. a. Enter a new password. b. Confirm your new password. 5. Choose your configurations from the What & Where, Actions, and Reports tabs. 6. To retain these settings as an individual custom configuration file, save the file to the desktop or Program Menu for execution. Context-sensitive scanning (right-clicking) will draw upon the original DEFAULT.VSC configuration file and scan the selected item with the pre-established default settings. 7. To establish your configuration as the default setting, save the new settings by overwriting C:\PROGRAM FILES\MCAFEE\VIRUSSCAN\DEFAULT.VSC 8. After saving your configuration and leaving Administrator Mode or closing VirusScan, the optional settings will be locked and cannot be altered without knowledge of the access keys, hotspot, and established password. 9. To view and confirm your changes, restart VirusScan for Windows 95 from the shortcut if you overwrote the DEFAULT.VSC file or from your saved configuration file (VSC). To alter your configuration settings or make additional changes, repeat this process. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.70 4. World Wide Web: http://www.mcafee.com or http://205.227.129.161 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you. * MCAFEE BETA SITE * Get pre-release software, including DAT files, through http://beta.mcafee.com/public/datafiles. You will have access to Public Beta and External Test Areas. Your feedback CAN make a difference.