What's New in McAfee WebScan v2.0.0 (9609) for Windows 3.1x and Windows 95 Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's WebScan for Windows 3.1x and Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. __________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Additional Information - Contact McAfee ____________ NEW FEATURES * NEW VIRUSES DETECTED * This DAT file (9609) detects the following 68 new viruses. In addition, locations that have experienced problems with a particular virus are identified. _1194 Spain ACCOUNT.AVENGER.873 ALLIANCE ARCV.255 ARCV.679 ARCV.745 ASH.743 BEDA.1530 BEER.2620 BEER.3164.B BEER.3192.B BIRTHDAY:DE (*) Germany BLEAH BUERO:DE Germany BW-525 CASTELLO.3742 Spain CHEGUEVA Spain COMPBACK.3783 CORDOBES.3334 Spain DEI.8772 DEI.DR.8772 DELWIN.1199 DIETZEL:DE (*) DODGER HASSLE HASTA.884 HLLP.NAZI.5984 IVP.665 JERUSALEM.BUPT.1220 JERUSALEM.BUPT.1279 JERUSALEM.BUPT.1367 KABOUT.1804 (*) KARNAVALI.1972 Europe KDG KITTY LAMEGO.729 Portugal LIBERTY.2857.D LITTLEPEST.4243 (*) MANNEQUIN MANZON.1404 Europe MENDOZA.3380 Spain MSU.297 NECROS.1164.A NECROS.1164.B PHALCON.1117 PINDONGA.B PS-MPC.578.C PS-MPC.611.J PS-MPC.753 PS-MPC.AOS PULCE.1840 RADYUM.509 RAHACK.936 Netherlands RDA FIGHTER.5871 RIOT.ETERNITY.565 SALMAN.2000 US SATRIA.RZ Europe SCREAMING_FIST.652 SCREAMING_FIST.709 SIRIUS.ALIVE.4608 TANPRO.749 TEQUILA.2468 TURNER.3276 TV V3.1765 VACSINA.1206.A VERWOLF VICTOR.2442.A (*) Requires DOS/Win 2.5.2 engine ____________ KNOWN ISSUES * GENERAL ISSUES * 1. Netscape 2.x saves downloaded files to the Temporary Directory defined in the Apps tab of Netscape's General Preferences. Netscape 3.0 saves downloaded files to the Netscape\Program directory. WebScan receives this path from Netscape and, after scanning the file, opens the Save As dialog with the same path. When you exit Netscape, all files downloaded to this directory are deleted. It is recommended that you do not save files in this directory. 2. Web browsers typically download files to a temporary directory, then call a helper or viewer application to process or display the file. WebScan acts as a helper application to scan the temporary file for viruses before providing an opportunity to save the file. If the save operation is cancelled (because the file is infected or by user request), the temporary file is deleted to prevent the possibility of infection. This may cause problems when using a Web browser to browse files on your local drive. 3. Cancelling a download in some browsers may call WebScan to scan the partial file. 4. When WebScan detects a virus in a Lotus cc:Mail attachment, the e-mail virus notification message sent to the sender only lists the first recipient of the notification message, even if the message was sent to more recipients. 5. WebScan may scan a Pegasus Mail message with no attachments. No save option is offered, and Pegasus Mail will continue without further interruption. 6. If you use Netscape Navigator or Microsoft Internet Explorer, right-clicking on a file's hypertext link and selecting Save Link As will not call WebScan to scan the file. Similarly, if you are using Internet Explorer, double-clicking a file's hypertext link and selecting Save It to Disk will also bypass WebScan. To call WebScan to scan a file in Internet Explorer, you must first elect to Open the File, then Save it using WebScan's Save As dialog box. 7. HTML source code cannot be viewed from Microsoft Internet Explorer 3.0. If you select View/Source, WebScan's flash screen will appear, but source code will not be displayed. 8. The SPRY Dialer may display a Fatal Dialer error if you click on its shortcut from the Start menu. This error message is caused by a configuration problem, which can be solved by using the SPRY switcher to change from a LAN-based connection to a ppp or slip connection. * INSTALLATION ISSUES * 1. When installing WebScan on Windows 3.1x with Win32s and linking to Lotus cc:Mail, the cc:Scan Configuration window appears momentarily and remains open in the background. Configuration settings should be saved once the setup is complete. 2. If you perform multiple installations of WebScan on a workstation without running the Uninstaller, the Uninstaller will remove only the components installed the last time setup was run. 3. If cc:Scan is running when WebScan is uninstalled, the uninstall performs properly, but there is a possibility of cc:Scan causing a general protection fault since the supporting files have been removed. Exit all other Windows applications before running the Uninstaller. 4. If you select the Compact installation option when installing WebScan on Windows 3.1, WebScan will place its own dialer and Internet connection utilities on the hard drive without notifying you, overwriting any exiting dialers and Internet connection utilities. The Compact option is not recommended on 3.1 systems with existing dial-up connections. ____________ INSTALLATION * INSTALLING THE PRODUCT * If you would like to perform a "silent" installation of WebScan, requiring no user interaction and using and default settings, take the steps described below. (*) In Windows 95, execute setup with the following command: SETUP.EXE -s In Windows 3.1x, take the following steps: 1. Rename the file SETUP.ISS to SETUP95.ISS. 2. Rename SETUP31X.ISS to SETUP.ISS 3. Execute the setup command with the following command: SETUP.EXE -s (*) NOTE: If cc:Mail is installed on your system, the WebScan silent installation will require user interaction for cc:Scan setting configuration. At the Select Desired Configuration dialog box, click Save to continue. * PRIMARY PROGRAM FILES FOR WEBSCAN * Files located in the Install directory: ======================================= 1. Installed for all components of WebScan: VALIDATE.EXE = McAfee file validation program README.1ST = McAfee information WHATSNEW.TXT = What's New document PACKING.LST = Packing list WCMDR.INI = Windows Commander configuration settings WCMDR.EXE = Windows Commander program DEISL1 = Command line for Uninstall program Files located in the Windows System directory: ============================================== 1. Installed for all components of WebScan: CTL3D32.DLL = 32-bit 3D Windows controls library file * CTL3D.DLL = 16-bit 3D Windows controls library file * (*) File will be installed upon installation of WebScan if it does not already exist, or if an older version is found. Files located in the AV directory: ================================== 1. Installed with Internet Explorer IEWEBON.REG = WebScan linking settings for Internet Explorer IEWEBOFF.REG = WebScan unlinking settings for Internet Explorer 2. Installed for WebScan Anti-virus component: NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data WEBSCAN.EXE = WebScan anti-virus program 3. Installed if you have a 16-bit Operating System: MCSCAN16.DLL = Library file UZDLL16.DLL = 16-bit decompression library file 4. Installed if you have a 32-bit Operating System: MCSCAN32.DLL = Library file UZDLL32.DLL = 32-bit decompression library file 5. Installed if you have cc:Mail: CCSCAN.EXE = cc:Scan anti-virus for cc:Mail program Files located in the Windows directory: ======================================= 1. Installed for WebScan Anti-virus component: WEBSCAN.INI = WebScan anti-virus configuration settings 2. Installed if you have cc:Mail: CCSCAN.INI = cc:Scan configuration settings * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When WebScan is applied to this file, Scan will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. * UNINSTALLING THE PRODUCT * 1. Automatically uninstalling WebScan. To automatically uninstall WebScan, double-click the uninstall icon from the McAfee WebScan Program Group. This procedure only breaks links that were automatically created during installation. Browsers linked manually must be removed manually. WARNING: Do not stop the uninstall procedure once it begins. If the uninstall procedure is interrupted, it must be completed manually. 2. Manually uninstalling WebScan. NOTE: If you find you must uninstall WebScan manually, we recommend first trying a full re-installation of WebScan (using the Typical installation option), then running the Uninstaller. If this is insufficient, the following procedure may help. a. If the files WCMDR.EXE and WCMDR.INI still exist in the Install directory, type the following command (supplying the appropriate directory) to remove the settings: WCMDR -I C:\MCAFEE\WEBSCAN\WCMDR.INI (for Win 3.1x) WCMDR -I "C:\PROGRAM FILES\MCAFEE\WEBSCAN\WCMDR.INI" (for Windows 95) Remove any remaining files or directories in the WebScan installation directory. or b. If the above files do not exist but WEBSCAN.EXE does exist (DO NOT remove it yet), and you are running Windows 95 with Internet Explorer installed, WebScan extensions must be unregistered in the registry first. To do this, browse to the \WEBSCAN\AV directory, then run the IEWEBOFF.REG (Registry Settings) file. IMPORTANT: If this is not done properly and the WEBSCAN.EXE file is removed prior to this step, the computer will not function normally. The computer can be returned to normal operation by performing the following workaround: (1) Start a DOS prompt (.PIF extensions work fine). (2) Ensure that the current directory is the Windows 95 directory, then type: COPY /V REGEDIT.EXE REGEDIT.SCR (3) Exit the DOS Prompt. (4) Choose Run from the Start Menu, then type (supplying the appropriate directory, if needed): REGEDIT.SCR C:\MCAFEE\WEBSCAN\AV\IEWEBOFF.REG (for Windows 3.1x) REGEDIT.SCR "C:\PROGRAM FILES\MCAFEE\WEBSCAN\ AV\IEWEBOFF.REG" (for Windows 95) This launches the Registry Editor and a message appears indicating that the appropriate changes have been made. The computer will function properly and any additional procedures can be performed. If all of the files have been removed, including the .REG files, the Registry settings will need to be modified manually. a. Follow steps (1)-(3) above. b. Choose Run from the Start Menu and type the following command (supplying the appropriate directory, if needed) to launch the Registry editor: REGEDIT.SCR c. Next, browse to each of the updated extensions (.ARC, .ARJ, .COM, .DOC, .DOT, .EXE, .ZIP) under HKEY_CLASSES_ROOT. Each of these will refer to another key, which is more descriptive and without the .extension format. An example is "exefiles." d. Browse to the referenced key and examine the SHELL\OPEN\COMMAND key. There will be a setting entitled Old Default. Using the copy and paste commands, replicate the string into the {default} setting. e. Repeat steps c. and d. for each of the updated extensions. f. Delete the Old Default and WebScan Installed settings. g. Unlink all of the updated applications and manual links to WebScan by removing WebScan from all of the settings. Each of the updated applications has a configuration dialog that allows you choose the correct helper application once WebScan has been removed. h. Remove the WebScan program group and its program items. i. Delete the WebScan directory and its files. A few minor settings will remain, depending on the components installed. Advanced users can refer to the WCMDR.INI file for further details. _____________ DOCUMENTATION For more information, refer to the WebScan User's Guide, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. This file is in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee product. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html WebScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: With which e-mail utilities does WebScan work? A: WebScan 2.0.0 works with Pegasus Mail, Netscape Mail, and Lotus cc:Mail. Q: With what Internet browsers does WebScan work? A: WebScan 2.0.0 automatically works with and installs to the following browsers: - Microsoft Internet Explorer - SPRY Mosaic - Netscape Navigator - NetCruiser With some manual connection, WebScan will work with AOL's WebCrawler and GNN Works. Q: Why doesn't my Internet connection work after I install WebScan? A: If you choose to install the dialer component during the installation process, WebScan will place its own dialer and Internet connection utilities on the hard drive. This action usually overwrites the current Internet connection. To overcome this problem, choose the Custom installation option. Q: How can I tell if WebScan is working? A: Point your browser at the following URL: http://www.mcafee.com/prod/av/webscan/test.html. This location contains two files that test positive with a false virus. Q: Why doesn't my Windows 95 system work properly when I uninstall WebScan Version 2.0.0? My system continues to look for every program I execute. A: If this occurs, follow the instructions in the installation section of this file. The instructions will describe the changes to make in the registry file. Q: Can I update WebScan's data files to detect new viruses? A: Yes. If you have Internet access, you can download updated McAfee data files from the McAfee Web Site, BBS, or other online resources. To download from the McAfee Web Site, follow these steps: 1. Go to the McAfee Web Site (http:\\www.mcafee.com or 205.227.129.97). 2. Click on the Download McAfee button. 3. Scroll down, and select either McAfee for Home (for personal evaluation copies) or McAfee for Business (for corporate evaluation copies). If you select McAfee for Business, you will be asked to provide some contact information. Use Tab to move from line to line within the form. 4. Click on either Evaluation Copies of McAfee Products or the McAfee Public Beta Site. 5. Click on Anti-virus, then select Index.txt to view descriptions of the products available on this site. Find the most recent virus data file for your product. 6. Return to the Anti-virus page and click on the file. Download the file by saving it to your Desktop. 7. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 8. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________________ ADDITIONAL INFORMATION WebScan currently supports automatic linking to the following software applications: Microsoft Internet Explorer SPRY Mosaic America Online's World Wide Web Browser Netcom NetCruiser Netscape Navigator, 16-bit Netscape Navigator, 32-bit Lotus cc:Mail Pegasus Mail WebScan's browser, Internet Explorer, is automatically linked during installation. If you install additional browsers or e-mail packages, you can uninstall and re-install WebScan to automatically link these applications, or take these steps to create the links manually. 1. Launch the browser to link to WebScan. 2. Configure the browser's helper applications or viewer applications. Usually this is done in the application's Preferences, Properties, or Options dialog. 3. Create or edit entries for executable application types and/or compressed files. These are files with extensions such as *.EXE, *.COM, *.SYS, *.BIN, *.DLL, *.SYS, *.ZIP, *.ARC, *.ARJ, and so forth. 4. In the Application field, enter the path to the WebScan executable and append the switch /SAVE. Following is a typical entry: C:\MCAFEE\WEBSCAN\AV\WEBSCAN.EXE /SAVE (for Windows 3.1x) C:\PROGRA~1\MCAFEE\WEBSCAN\AV\WEBSCAN.EXE /SAVE (for Windows 95) 5. After completing steps 3. and 4. for each executable file type, exit and relaunch the browser. Due to the variety of World Wide Web browsers available, the procedure for your browser may vary from the description given. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, or COMMENTS * Contact McAfee's Customer Care department 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III Fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations: McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.134 4. World Wide Web: http://www.mcafee.com or http://205.227.129.97 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.