What's New in VirusScan for Windows 95 v2.0.8 (9611) Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Additional Information - Contact McAfee ____________ NEW FEATURES 1. VirusScan now supports centralized alerting and reporting to a remote NetWare or Windows NT server. Using NetShield for NetWare v2.3.3 or NetShield for Windows NT v2.5.3, client alerts and reports can be redistributed or compiled at the central server location for ease of management. 2. VirusScan95 now has a new Web Support feature. This new feature provides easy access from the Help Menu to McAfee's online Web Support forum with a push of a button. 3. McAfee's new online update feature allows users to purchase and license their McAfee products and update DAT files with the push of a button. 4. McAfee's new ScreenScan utility automatically scans your system for infected files when your screen saver is active. ScreenScan alerts you when viruses are found and prompts you to launch VirusScan. ScreenScan maintains a separate log file of its activities in the installation directory. 5. The new Administrator Mode provides the ability to lock VirusScan95 configuration settings. * ENHANCEMENTS * 1. VirusScan95 configuration files have been enhanced. Right-clicking on a VirusScan configuration file (VSC) displays the file's properties and two new tabs: Options and Actions. One of the new properties is Start Automatically, located in the Options tab. Start Automatically is necessary for scheduled scanning from the optional System Agent and for Startup group on- demand scanning. * NEW VIRUSES DETECTED * This DAT file (9611) detects the following 129 new viruses. Locations that have experienced particular problems with specific viruses are also identified. _922 Germany _1000 US _2673 Philippines APOCALIPSE.1685 Portugal APRIL1A.798 APRIL1B.797 AREQUIPA.1994 Peru ASBV ASH.302 ASMODEOUS.1437 ASSIGN.653 ATOM BANDUNG.A US/Indonesia BANDUNG.B BARAN.2978 BARAN.3001 BNB.498 BR.1180 BW.790 CACO.3310 Peru CHANDI US CHAPA.447 CHAPA.448 CHERRY.2266 COMP.180 CONCEPT.I CONCEPT.L CONCEPT.M CONCEPT.N CONCEPT.P COOL.929 COREA.926 COUP.2062 CRAWLER.545 CRIM_WW CYBERTECH.668 DAN.1784 DELTREE TROJAN DEMON3B.4313 DINA.271 DINA.283 DIR-II.1536.G DIR-II.AS DREAMER.8869 DST.330 DST.347 DST.396 DSTAR.223 EASY Internet EDOL.832 EXEHEADER.VLAD.337 EXTRACTJPG.TROJAN FATHER_MAC.1382 FAULT.9209 FORMATC:TROJAN FSN.1279 GANGSTERZ Internet H-ANDROMED.594 HELGA.666.B HELPER US HIDER.2143 INCH INFERNO.781 JASON.626 JOVIAL.503 JUICE.305 KALO.1464 KOSKON.313 LATER.981.B LD93.1217 Australia LUNCH.783 MACGYVER.4112 (MBR) Taiwan MAIDEN.891 MARKUS.5415 MBRK.714 MDMA.C US MINZ.470 MIXTURA.1000 MOSCA.1278 MURCIA.4651 NPOX.1186 OKTUBRE.1784 OUTLAW Internet PELIGRO.1206 Peru PHARDERA Internet PIRANIA.1617 PROTOVIRUS.720 PS-MPC.504 Peru RESCUE 911.3774 Saudi Arabia ROTATOR.864 SALAMANDER.888 SANLORENO.1025 SAVER:DE Internet SCROLL.600 SHOWOFXX Australia SIERRA.D US SILLY.745 SMILEY:DE Germany SPEC.907 SPOOKY:DE Internet STEATODA.1623 Israel STRYX:DE Internet SUPERF.1175 SVC.3103 South America SYSKLL.290 T555.556 TAURUS.1852 THEATRE:TW (*) Taiwan THEATRE.A:TW (*) Taiwan TREBUJENA.1094 TRIVIAL.44.F TRIVIAL.45.H TRIVIAL.52 TRIVIAL.53.A TRIVIAL.119 TRIVIAL.284 TROOPER.2259 TWNO:TW (*) Taiwan TWNO.B:TW (*) Taiwan TWNO.C:TW (*) Taiwan UNHAPPY.763.A UNHAPPY.763.B VCC.620 VCS.799 WAZZU.J WAZZU.O WAZZU.P US WEATHER:TW(*) Taiwan WAZZU.Q US ZGENRAT.785 US (*) Infects double-byte (omnicode) versions of Word, which include Japanese, Korean, Chinese, and Simplified Chinese. * NEW VIRUSES REMOVED * This DAT file (9611) removes the following 112 new viruses. Locations that have experienced particular problems with specific viruses are also identified. 666 _922 Germany _1000 US 1946 _2673 Philippines ARALE AREQUIPA.1994 Peru ASBV AWAITS.500 BABY_L.674 BADSIZE.369 BANDUNG.B BARAN.2978 BARAN.3001 BARROTES.840 Spain BNB.498 BR.1180 BRBI.KOBRIN.492 CACO.2965 CACO.3310 Peru CARRYON.534 CHANDI US CHAPA.447 CHAPA.448 CONCEPT.I CONCEPT.L CONCEPT.M CONCEPT.N CONCEPT.P COOL.929 COREA.926 COUP.2062 DEARFRIEND.524 DOPERLAND.490 DREAMER.4808 DREAMER.8869 DUNE.483 EASY Internet EUPM.1731 F-YOU FIFO.333 FORMAS.1146 FORMATC:FORMAT GANGSTERZ Internet GENE.1991 GENIUS H-ANDROMED.594 HELPER US INCH.386 INT4B.231 INT4B.242 IVP.BUBBLES.684 US KALI-4 KOSKON.313 LD93.1217 Australia LOVEBUZZ.591 LUNCH MACGYVER.4112 Taiwan MANTRA.719 MARKUS.5415 MDMA.C US NPOX.1186 OMEGA OUTLAW Internet PELIGRO.1206 Peru PHARDERA Internet PS-MPC.504 Peru PUPPETS.960 RESCUE 911.3774 Saudi Arabia SAVER:DE Internet SHOWOFXX Australia SIERRA.D US SILLYC.90 SILLYC.155.B SILLYC.165 SILLYC.200.B SILLYC.202 SILLYC.226 SILLYC.316 SILLYC.373 SILLYORCE.76.B SILLYRC.214 SILLYRC.248 SILLYRC.303 SMILEY:DE Germany SPOOKY:DE Internet STEATODA.1623 Israel STRYX:DE Internet SUPERVISOR.2221 SVC.3103 South America T555.556 THEATRE:TW (*) Taiwan THEATRE.A:TW (*) Taiwan TIE.619 TIP.554 TULA.1540 TULA.1656 TURBOEXE.854 TWNO:TW (*) Taiwan TWNO.B:TW (*) Taiwan TWNO.C:TW (*) Taiwan UNHANDLED.495 UNHAPPY.763.A UNHAPPY.763.B VIAGGIO.1051 VOTADC.591 WAZZU.J WAZZU.O WAZZU.P US WAZZU.Q US WEATHER:TW (*) Taiwan WILDY.354.B WILDY.354.C (*) Infects double-byte (omnicode) versions of Word, which include Japanese, Korean, Chinese, and Simplified Chinese. ____________ KNOWN ISSUES 1. VirusScan95 appears to continue scanning after clicking STOP. If this occurs, move the VirusScan95 window to reveal the DynaZip UnZip Error window. Click OK and respond appropriately to the dialog box. 2. Files with the "-" (dash) character in the filename that are compressed in Zipped files will not be scanned by the on-demand scanner. 3. Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS memory managers may cause VirusScan95 to falsely detect viruses in memory. To eliminate false warnings, remark (Rem) the memory manager lines from your CONFIG.SYS to deactivate them. 4. ScreenScan only runs with Windows 95 screen savers, and will not scan if no Windows 95 screen savers are selected. 5. If you uninstall ScreenScan, you must go into Display Properties and select a screen saver. 6. ScreenScan's log file has a maximum size of 100K. If the file reaches this size, the oldest data will be deleted. To retain logging data, you should edit the content to keep the log file under 100K or save the oldest data to another file. 7. ScreenScan will stop scanning after it detects a virus and prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until the next time it activates. McAfee recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. ____________ INSTALLATION * INSTALLING THE PRODUCT * If you would like to perform a "silent" installation of VirusScan, requiring minimal user interaction and using all default or "Typical" installation settings, add -s (i.e. SETUP.EXE -s) to the setup command when you install the product. Network Administrators can customize the silent installation by following the steps below. 1. Check in the Windows directory to ensure that a file named SETUP.ISS does not already exist. If it does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e. SETUP.EXE -r). 3. Select the components you would like to be installed during the silent installation. All responses will be recorded. 4. Finish the installation, and locate the file SETUP.ISS in the Windows directory. 5. Open the file using any ASCII editor (e.g., NOTEPAD.EXE) and delete the section titled APPLICATION. 6. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result=x where x is equal to 301 (Typical installation) 302 (Compact installation) 303 (Custom installation) 7. Add 100 to the above value, so that the Result variable is equal to 401, 402, or 403. Modifying this file will allow the installation to copy the VirusScan files to the drive where the operating system resides instead of defaulting to the C: drive. 8. Rename, back up, or delete SETUP.ISS on the first installation disk (floppies only). For CD-ROM versions of the product, you must copy the installation files onto the hard drive before taking this step. 9. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. 10. Run SETUP.EXE with the -s switch (i.e. SETUP.EXE -s). NOTE: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. Also, the file used for the silent installation, SETUP.ISS, may not work properly across different operating systems. For example, if the silent install is generated for Windows 95, it may not work properly in Windows 3.1x or Windows NT. 11. When the silent installation is complete, you should reboot the machine manually. * PRIMARY PROGRAM FILES FOR VIRUSSCAN95 * Files located in the Install directory: ======================================= 1. Installed for VShield/Scan95/DOS/ScreenScan: README.1ST = McAfee information SCAN.DAT = Virus scan definition data NAMES.DAT = Virus names definition data CLEAN.DAT = Virus clean definition data VALIDATE.EXE = McAfee file validation program CHKVSD.EXE = VShield virtual device driver checking utility PACKING.LST = Packing list UINSTALL.EXE = Uninstall program WHATSNEW.TXT = What's New document VSUINST.EXE = Uninstall assistant UPDATE.MSG = Update message file AGENTS.TXT = McAfee authorized agents SLFSRVSW.EXE = SelfServe client program MCAFEE.SCU = Temporary SelfServe catalog file DELSL1.ISU = Uninstall file VALIDATE.EXE = McAfee file validation program WCMDR.EXE = Windows Commander program WCMDR.INI = Windows Commander configuration settings 2. Installed for VShield/Scan95: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library DUNZIP32.DLL = File decompression library file DZIP32.DLL = File decompression library file MCKRNL95.DLL = Library files MCUTIL95.DLL = Library files MCSCAN32.DLL = Library files 3. Installed for VShield: VSHCFG32.EXE = VShield configuration manager VSHWIN32.EXE = Detection engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan95: SCAN95.EXE = VirusScan95 program SHUTIL.DLL = Run-time support library DEFAULT.VSC = Default Scan95 settings 5. Installed for DOS: SCAN.EXE = MS-DOS scan program 6. Installed for ScreenScan: SCRSCAN.EXE = ScreenScan program file SCRSCAN.HLP = ScreenScan online help file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file ScreenScan Activity Log.TXT = ScreenScan activity log MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan95/DOS: CDISSS.OCX = SelfServe library file 2. Installed for VShield/Scan95: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver 4. Installed for Scan95: S95EXT.DLL = Shell extension Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan95: SCANEXT.HLP = Scan95 Extension help VIRUSCAN.HLP = VirusScan help VIRUSCAN.CNT = VirusScan context-sensitive help Note: WINDOWS refers to the directory to which Windows 95 is installed, not the Windows 3.1x directory. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _____________ DOCUMENTATION For more information, refer to the User's Guides, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. These files are in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee products. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan and ScreenScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: How do I enable McAfee's Centralized Alerting and Reporting? A: VirusScan now supports Centralized Alerting and Reporting to a remote NetWare or Windows NT server running NetShield for Windows NT v2.5.3 or NetShield for NetWare v2.3.3. To configure this option on your VirusScan client, modify Scan95's DEFAULT.VSH and DEFAULT.VSC, and/or your custom settings file to read the following: Note: Administrators will need to configure the AlertOptions section in both the .VSH and .VSC files for complete Centralized Alerting & Reporting. Add the following lines to the AlertOptions section: Note: The AlertOptions section already exists in the .VSC file. You must manually create this section in the .VSH file. szNetworkAlertPath= bNetworkAlert=1 Where the is the path to the remote NetWare volume or NT directory. From this directory, NetShield can broadcast or compile the alerts and reports according to its established configuration. NOTE: The client must have write access to this location and the directory must contain the NetShield-supplied CENTALRT.TXT file. To send a complete alerting file identifying the system and user, establish the following environment variables or add them to the AUTOEXEC.BAT file. Set COMPUTERNAME= Set USERNAME= The alert file sent to the server is an .alr text file. Upon receipt of the alert file, NetShield NT or NetShield for NetWare sends an alert message to an administrator and/or appropriate personnel. Q: I would like to electronically purchase and download the latest version of VirusScan95. I don't feel comfortable giving my credit card information over the Internet and my modem is very slow. Is there a way I can purchase VirusScan via modem but download the product via the Internet? A: Yes. The first time you download VirusScan95, the McAfee Online Purchase Wizard will prompt you to select the transmission method you prefer to download and to transmit your encrypted credit card information. At the Transaction Connection Type dialog box, select Internet to download your order via the Internet. At the Security Connection Type dialog box, select Direct Dial Modem to transmit your credit card information via modem. Q: While downloading a licensed copy of VirusScan95, the installation was interrupted and/or canceled. Where can I find my licensed VirusScan files and how do I proceed with the installation? A: The files are in the VSint folder located in the Windows Temp directory. Double click on SETUP.EXE within the VSint folder to continue with the installation. Q: I have created my own Emergency diskette, how can I optimize it's performance? A: For optimal performance, create a CONFIG.SYS file on the boot diskette and add the following lines: [CONFIG.SYS] DEVICE=HIMEM.SYS DOS=HIGH Add the HIMEM.SYS file from the DOS directory or if you are using Windows 95 system files, add HIMEM.SYS from the \WINDOWS\COMMAND directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in your online documentation. Q: How do I scan multiple drives? A: #1 Enter LocalDrives or NetworkDrives in the Scan In text dialog on the Where & What property page. Click Scan Now and all LocalDrives or all NetworkDrives will be scanned. A: #2 VirusScan95 can scan many locations simultaneously. To do this, take these steps: 1. Launch Explorer. 2. Highlight the drives or folders you want to scan. 3. Right-click to reveal the Context Menu. 4. Select Scan for Viruses. 5. Click Scan Now to begin scans. Q: I moved a VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan95, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved VSC file. 2. While pointing to the VSC file, right-click to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Options Tab on the property sheet. 5. Check the Start Automatically box. By enabling this option, scanning will begin automatically. If viruses are not detected VirusScan95 will automatically close and free up system resources. Q: When VirusScan95 is launched, how does it determine the default settings? A: VirusScan95 default settings may be found in the DEFAULT.VSC file located in the install directory. Q: How can I tell that ScreenScan is working? A: ScreenScan does not alert you when it is scanning your system. However, if you enable the logging option during your configuration, all ScreenScan activity will be recorded in a log file in the Installation directory. Q: Can I update McAfee's data files to detect new viruses? A: Yes. If your data files are out-of-date, VirusScan95 will prompt you to update them. If you have a modem or Internet connection, you can use VirusScan's new electronic update feature for easy data file updates. The data file updates are free for the life of the scan engine. Through the electronic update feature, you can also purchase one year of data file updates, engine upgrades, and technical support. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________________ ADDITIONAL INFORMATION The new Administrative Mode feature allows System Administrators to lock VirusScan95 configurations on users' systems. To use this feature, take the following steps: 1. Start VirusScan95 by double-clicking on the VirusScan95 icon. 2. Press and hold the Ctrl+Shift+Alt keys and double-click the magnifying glass icon. 3. Open the File menu. 4. Select Administrator Mode. a. Enter a new password. b. Confirm your new password. 5. Choose your configurations from the What & Where, Actions, and Reports tabs. 6. To retain these settings as an individual custom configuration file, save the file to the desktop or Program Menu for execution. Context-sensitive scanning (right-clicking) will draw upon the original DEFAULT.VSC configuration file and scan the selected item with the pre-established default settings. 7. To establish your configuration as the default setting, save the new settings by overwriting C:\PROGRAM FILES\MCAFEE\VIRUSSCAN95\DEFAULT.VSC 8. After saving your configuration and leaving Administator Mode or closing VirusScan95, the optional settings will be locked and cannot be altered without knowledge of the access keys, hotspot, and established password. 9. To view and confirm your changes, restart VirusScan95 from the shortcut if you overwrote the DEFAULT.VSC file or from your saved configuration file (VSC). To alter your configuration settings or make additional changes, repeat this process. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.70 4. World Wide Web: http://www.mcafee.com or http://205.227.129.161 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.