What's New in McAfee VirusScan for Windows 9x v3.1.6 (3102) Copyright (c) 1994-1998 by Network Associates, Inc., and its Affiliated Companies. All Rights Reserved. Thank you for using McAfee VirusScan for Windows 9x. This What's New file contains important information regarding the current version of this product. Network Associates strongly recommends that you read the entire document. Network Associates welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Contacting Network Associates ____________ NEW FEATURES 1. The new AutoUpdate feature (corporate version only) allows you to configure VirusScan so that it effortlessly updates .DAT files and upgrades the entire product to protect your system from the latest virus threats. Updates and upgrades can be performed automatically on a scheduled basis, or they can be performed on demand. VirusScan supports obtaining updates and upgrades via a FTP site or UNC pathname, and includes support for proxy servers. Note: A default ftp site has been provided for AutoUpdate. It is recommended that an administrator pull the .DAT package down to a local server for deployment. To fully implement new .DAT files, your system must be restarted. 2. VirusScan's on-access and on-demand scanners include full support for floppy disk scanning on LS-120 drives. 3. In addition to existing alert methods, VirusScan and VShield can now send Desktop Management Interface (DMI) alerts to desktop or network management applications that support the DMI standard. 4. VirusScan scans most major types of compressed files on PC platforms. When an infection is detected in a file of the compression type ZIP, LHA, or UUencode, VirusScan is able to clean, delete, or move the file. When an infection is detected in a file of the compression type CAB or ZIP-SFX, which may be Authenticoded, VirusScan does not support cleaning, deleting, or moving the file. When VirusScan detects an infection in a CAB or ZIP-SFX compressed file, Network Associates recommends that you decompress the file to clean it. 5. VirusScan features improved technology for detecting polymorphic viruses. This new technology uses the file POLYSCAN.DAT, which replaces the file MCALYZE.DAT. 6. VirusScan scans files embedded within MS Office files (Word and Excel). 7. VirusScan has the ability to detect macro virus infections in password-protected Word 7.0 (Word for Office 95) files in all languages supported by Word. 8. If a password-protected Word 7.0 (Word for Office 95) file is infected by a virus that can plant its own password, VirusScan now cleans the file and removes the password. If a password-protected Word 7.0 (Word for Office 95) file is infected by a virus that cannot plant its own password, VirusScan now cleans the file without disturbing the password. * NEW VIRUSES DETECTED * The 3102 .DAT files are compatible with VirusScan's v3.x engines only. These .DAT files are not intended for use with the VirusScan v2.x engine products. The 3102 .DAT files detect the following 232 new viruses. Locations that have experienced particular problems with specific viruses are also identified. 500 AB6A.3500 ALAR.5088 ANDROMEDA.1140 ANTINUKE.TROJAN ANXIETY.POPPY (Internet) ANXIETY.POPPY.II (Internet) ARARA.1375 AUSPAR BANDUNG.BF BLEE.A BLEE.B BLEE.D (Internet) BLEE.E (Internet) BOOT.666 BOX.D BOX.F BREEDER.A BRR.BOO BURMA.442.D CAP.BZ CAP.CA CAP.CB CAP.CC CAP.CD CAP.CE CAP.CF CAP.CG CAP.CH CAP.CI CAP.CJ CAP.CK CAP.CL CAP.CM CAP.CN CAP.CO CAP.CP CAP.CQ CAP.CR CAP.CS CAP.CT CAP.CU CAP.CV CAP.CW CAP.CX CIUDAD.590 (Europe) CLEANUP.A (Europe) COAHUILA CONCEPT.CA CONCEPT.CB CONCEPT.CC CONCEPT.CD CONCEPT.CE COOKIE.MONSTER.TROJAN DEMON.B DENZUKO.V1526 DIAMETRIC.3514 DRIVEL EDDY.1386 EIGHT-CLOCK.A (US) ERMUA.A ERMUA.B ERMUA.C FAKE.A FEINT_7F_(BS/MBR) GOODNIGHT.M GROG.1146 HABIR.A HASSLE.B HLLP.FECI.6000 HLLT.KRILE.4608 (Internet) HLLT.KRILE.5831 (Internet) HNL.A (US) HOT.B IBLIS.252 IBLIS.252 DROPPER IVP.967 IWASHERE.710 JERUSALEM.1808.CT.B DROPPER JOHNNY.S JOHNNY.T KELA.1171 KHIZHNJAK.1011 KHIZHNJAK.509 KHIZHNJAK.565 KILLDOS.A:TW KLA.A KOMCON.A (US) KOMPU.J KYOKUSHINKAI LAPIDARIO.766 LARRY LEONARD.1194 LIGHT.A LIZARD.1967 (Portugal, US) MBR-COM.1410 MDMA.AO MDMA.AP MDMA.AQ MDMA.AR MDMA.AS MINIMAL.AA MINIMAL.Y MINIMAL.Z MIRC/7TH_SPERE MIRC/REPRO_V1 MUCK.AP MUCK.AQ MULTI MWIM.BOO NGKOEN NICEDAY.P NICEDAY.Q NIKNAT.D NIKNAT.E NIKNAT.F NIKNAT.G NJVCK2.D NJVCK2.E NJVCK2.F NJVCK2.G NJVCK2.H NJVCK2.I NJVCK2.J NJVCK2.K NJVCK2.L NJVCK2.M NJVCK2.N NO2.A (TWNO variant) (Taiwan) NOP.R:BR NOP.S:ES NOP.T:IT NOSTARDAMUS.3584 NPAD.FD NPAD.FE NPAD.FF NPAD.FG NPAD.FH NPAD.FI NPAD.FJ NPAD.FK NPAD.FL NPAD.FM NPAD.FN NPAD.FO NPAD.FP NPAD.FQ NPAD.FR NPAD.FS NPAD.FT NPAD.FU NPAD.FV NPAD.FW NPAD.FX NPAD.FY ORPHAN.174 PASTIK.2049 PAYCHECK.J PAYCHECK.K PINGPONG.M PRESIDENT.MP.1504 RAZER.B SARCOMA.1328 SCHUMANN.G (Europe) SCHUMANN.H (Europe) SCHUMANN.I SCHUMANN.J (Europe) SCHUMANN.L (Europe) SEEYOU SHOWOFF.CN SHOWOFF.CO SHOWOFF.CP SHOWOFF.CQ SHOWOFF.CR SHOWOFF.CS SILLYC.124 SILLYC.144 SILLYC.166 SILLYC.169 SILLYC.264 SILLYC.302 SILLYC.331 SILLYC.343 SILLYC.498 SILLYC.511 SILLYC.563 SILLYC.626 SILLYC.657 SPHINX.2520 SPHINX.2536 SPHINX.2548 SWISS_BOOT (Switzerland) SWISS_BOOT_2 (Switzerland) SWLABS.H TAGUCHI.A (Brazil) TALON.L TEDY.4350 TEMPLE.L TPVO.3463 TPVO.3626 TPVO.3654 TPVO-OPEN.1569 TRASH.B TROUT.6787 TWNO.AB:TW VAMPIRE.K:TW VAMPIRE.L/M:TW VHDL.B:TW VIENNA.BETABOYS DROPPER WAZZU.DM WAZZU.DN WAZZU.DP WAZZU.DQ WAZZU.DR XF/PAIX.A (Requires 3.1.6 engine or later) XM/LAROUX.AF XM/LAROUX.AH XM/LAROUX.AP XM/LAROUX.BC XM/LAROUX.BE XM/LAROUX.BG XM/LAROUX.BH XM/LAROUX.BI XM/LAROUX.BJ XM/LAROUX.BK XM/LAROUX.BL XM/LAROUX.BM XM/LAROUX.BN XM/LMV.A (TROJAN) XM/NINJA.D (Japan) XM/NOCAL.A (Japan) ZHENGZHOU.3584.B * NEW VIRUSES CLEANED * These .DAT files clean the following 167 new viruses: ANDROMEDA.1140 BANDUNG.BF BLEE.A BLEE.B BLEE.D (Internet) BLEE.E (Internet) BOX.F BREEDER.A CAP.BZ CAP.CA CAP.CB CAP.CC CAP.CD CAP.CE CAP.CF CAP.CG CAP.CH CAP.CI CAP.CJ CAP.CK CAP.CL CAP.CM CAP.CN CAP.CO CAP.CP CAP.CQ CAP.CR CAP.CS CAP.CT CAP.CU CAP.CV CAP.CW CAP.CX CIUDAD.590 (Europe) CLEANUP.A (Europe) COAHUILA CONCEPT.CA CONCEPT.CB CONCEPT.CC CONCEPT.CD CONCEPT.CE DEMON.B DIAMETRIC.3514 EIGHT-CLOCK.A (US) ERMUA.A ERMUA.B ERMUA.C FAKE.A FEINT_7F_(BS/MBR) GOODNIGHT.M GROG.1146 HABIR.A HASSLE.B HNL.A (US) HOT.B IBLIS.252 IBLIS.252 DROPPER IWASHERE.710 JERUSALEM.1808.CT.B DROPPER JOHNNY.S JOHNNY.T KILLDOS.A:TW KLA.A KOMCON.A (US) KOMPU.J LARRY LEONARD.1194 LIZARD.1967 (Portugal, US) MDMA.AP MDMA.AQ MDMA.AR MDMA.AS MINIMAL.Y MINIMAL.Z MINIMAL.AA MUCK.AP MUCK.AQ MWIM.BOO NICEDAY.P NICEDAY.Q NIKNAT.E NIKNAT.F NIKNAT.G NJVCK2.D NJVCK2.E NJVCK2.F NJVCK2.G NJVCK2.H NJVCK2.I NJVCK2.J NJVCK2.K NJVCK2.L NJVCK2.M NJVCK2.N NO2.A (TWNO variant) (Taiwan) NOP.R:BR NOP.S:ES NOP.T:IT NPAD.FD NPAD.FE NPAD.FF NPAD.FG NPAD.FH NPAD.FI NPAD.FJ NPAD.FK NPAD.FL NPAD.FM NPAD.FN NPAD.FO NPAD.FP NPAD.FQ NPAD.FR NPAD.FS NPAD.FT NPAD.FU NPAD.FV NPAD.FW NPAD.FX NPAD.FY PAYCHECK.J PAYCHECK.K RAZER.B SARCOMA.1328 SCHUMANN.G (Europe) SCHUMANN.H (Europe) SCHUMANN.J (Europe) SCHUMANN.L (Europe) SHOWOFF.CN SHOWOFF.CO SHOWOFF.CP SHOWOFF.CQ SHOWOFF.CR SHOWOFF.CS SWISS_BOOT (Switzerland) SWISS_BOOT_2 (Switzerland) SWLABS.H TAGUCHI.A (Brazil) TALON.L TEDY.4350 TEMPLE.L TRASH.B TWNO.AB:TW VAMPIRE.K:TW VAMPIRE.L/M:TW VHDL.B:TW VIENNA.BETABOYS DROPPER WAZZU.DM WAZZU.DN WAZZU.DP WAZZU.DQ WAZZU.DR XM/LAROUX.AF XM/LAROUX.AP XM/LAROUX.BC XM/LAROUX.BE XM/LAROUX.BG XM/LAROUX.BH XM/LAROUX.BI XM/LAROUX.BJ XM/LAROUX.BK XM/LAROUX.BL XM/LAROUX.BM XM/LAROUX.BN XM/LMV.A (TROJAN) XM/NINJA.D (Japan) XM/NOCAL.A (Japan) ____________ KNOWN ISSUES 1. If you uninstall McAfee VirusScan, Windows changes your default screen saver to None. To choose a screen saver to use, right-click anywhere on your desktop, then choose Properties from the shortcut menu that appears. Next, click the Screen Saver tab in the Display Properties dialog box, then choose a new screen saver from the Screen Saver list. Click OK to use the screen saver you chose. 2. Using MS-DOS memory managers might cause VirusScan to falsely detect viruses in memory. Since Windows 95 no longer requires MS-DOS memory managers, you can eliminate false warnings by preceding each line in your CONFIG.SYS file that includes settings for an MS-DOS memory manager with REM. This deactivates the memory manager. To learn more about working with your CONFIG.SYS file, see your MS-DOS or Windows documentation. 3. To create a VirusScan Emergency Disk, you must first create a bootable floppy disk using the following command at a DOS prompt: c:\>FORMAT A: /S/U 4. If you protect VShield or any scan task with a password, you will be prompted to enter your password whenever you launch an associated program. Use your mouse to click in the text field provided in order to enter the password -- keyboard shortcuts will not work. Microsoft acknowledges this issue in its Knowledge Base Article ID #Q84133. To close the password verification dialog box, click Cancel. 5. The Status properties page for VShield in the VirusScan Console can only be updated by closing and reopening VShield's Task Properties window. 6. ScreenScan will stop scanning after it detects a virus and prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until the next time it activates. Network Associates recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. 7. Disk defragmentation programs move files as they work to maximize hard disk efficiency. If you have VShield, VirusScan or other applications active during a disk defragmentation operation, your disk defragmentation program might tell you that it cannot find the active application files. This is normal and does not mean that the files do not exist. To avoid error messages like this, close all open applications and disable VShield, then run your disk defragmentation operation again. 8. If you unzip a virus-infected file in a directory on a Novell server, VShield does not detect the infection as the file is created. For maximum security, use VirusScan to scan the Novell server after you have extracted the files to the server. 9. If you press CTRL+ALT+DEL to shut down a Windows 95 system with VShield or any other VxD enabled, Windows does not shut down. Instead, Windows disables VShield or the active VxD. To shut down your computer, you must press CTRL+ALT+DEL again. 10. When running two or more instances of Scan32.EXE, and scanning two or more Microsoft cabinet (CAB) files simultaneously, Scan32.EXE will terminate with a page fault. ____________ INSTALLATION * INSTALLING THE PRODUCT * 1. Do one of the following: - If installing from diskette or compact disc, insert it into your floppy disk drive or CD-ROM drive. - If installing from files downloaded from a BBS or the Network Associates website, decompress the zipped files into a directory on the network or your local drive. 2 Choose Run from the Start menu. 3. If installing from diskette, type x:\setup.exe where x is the drive in which you placed the diskette. Click OK. If installing from compact disc, type x:\win95\setup.exe where x is the drive in which you placed the CD-ROM. Click OK. If installing from downloaded files, type x:\path\setup.exe where x:\path is the location of the files (for example, C:\DOWNLOAD\SETUP.EXE). Click OK. 4. Follow the on-screen installation instructions to complete VirusScan installation. NOTE: Network Associates recommends that you include a step in your setup script that reboots the target computer after installation. * PERFORMING A SILENT INSTALLATION * To perform a "silent" installation of this product, with minimal user interaction and with all default or "Typical" installation settings, add -s (i.e., SETUP.EXE -s) to the setup command when you install the product. Network administrators can customize the silent installation feature by following these steps: 1. Check the Windows directory to ensure that a file named SETUP.ISS does not already exist. If one does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e., SETUP.EXE -r). 3. Select the components you want to install during the silent installation. Your choices will be recorded. Note: If a virus is detected during the recording of a silent install, both the recording and the install will abort. 4. Finish the installation. Result: A SETUP.ISS file is created in the Windows directory that has your installation options recorded. Use this file to install all product files to the same installation directory on every client machine. The .ISS file specifies the installation directory under the [SdSetupType-0] header, szDir parameter, which was recorded in step 3. This overrides the default installation directory on each client machine, which might vary according to operating system. Having the same directory name on every client helps to ease administration in the future; for example, you might assign all client machines the directory C:\ANTIVIRUS. Note: If, however, you want to allow SETUP.EXE to determine where to locate the installed files, modify the SETUP.ISS file so that the target machine will disregard the szDir, as follows: A. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result = xxx. The actual value will most likely be 301, 302, or 303, depending on what options you selected during the ISS file creation process. B. Add 100 to this number so that, for example, 301 becomes 401. This tells each target machine to disregard the szDir and assign a directory according to its own particular operating system. 5. Copy the installation files onto a local or mapped drive; then rename, back up, or delete the SETUP.ISS file. Note: You cannot perform a silent install from multiple media because the silent operation will be compromised when the install prompts the user for more media. 6. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. Note: The file used for the silent installation, SETUP.ISS, is product-specific. For example, you cannot use a SETUP.ISS file created by a VirusScan for Windows 95 installation for a VirusScan for Windows NT installation. 7. Run SETUP.EXE with the -s switch (i.e., SETUP.EXE -s). Note: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. 8. When the silent installation is complete, the computer reboots automatically if you recorded actions that do so. By default, the setup.iss script reboots the computer automatically. * PRIMARY PROGRAM FILES FOR VIRUSSCAN * Note: Depending on the type of license you purchased, some of these files may not be installed. Files located in the Install directory: ======================================= 1. Installed for VShield/Scan32/DOS/ScreenScan: README.1ST = License and registration information CLEAN.DAT = Virus clean definition data POLYSCAN.DAT = Data file for advanced polymorphic virus detection NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data VS-MAIN.HLP = VirusScan help file VSCHED.EXE = VirusScan console scheduler file DMIALERT.DLL = Library file ADVGUI.DLL = Advanced interface library file MCGUI32.DLL = AV Console library file S95EXT.DLL = Library file CFGCOM32.DLL = Library file INETWH16.DLL = Internet library help file INETWH32.DLL = Internet library help file AVCONSOL.EXE = VirusScan Console program file MCECOM.EXE = Automatic product update program file CHKVXD.EXE = VShield virtual device CONFIG32.EXE = VirusScan configuration program SETBROWS.EXE = Set browser program VIRLST32.EXE = McAfee Virus List VALIDATE.EXE = McAfee file validation program VSECOMR.EXE = Electronic Commerce program file WCMDR.EXE = Windows Commander program driver checking utility AVCONSOL.HLP = AV Console help file SCAN32.HLP = Scan32 help file PHONELST.INI = Electronic commerce file AVCONSOL.INI = AV Console initialization file WCMDR.INI = Windows Commander configuration settings WCMDRSIL.INI = unInstallShield helper configuration DELSL?.ISU = Uninstall file PACKING.LST = Packing list FAXFORM.TXT = Fax registration form RESELLER.TXT = Network Associates authorized resellers WHATSNEW.TXT = What's New document 2. Installed for VShield/Scan32: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library POLYSCAN.DLL = Library files for advanced polymorphic virus detection MCARCHIV.DLL = Compressed file scanning library MCKRNL32.DLL = Library files MCSCAN32.DLL = Library files MCUTIL32.DLL = Library files VSECOM.DLL = Library files 3. Installed for VShield: CONFIG32.EXE = VShield configuration program VSHWIN32.EXE = VShield engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan32: SHUTIL.DLL = Run-time support library SCAN32.EXE = VirusScan program DEFAULT.VSC = Default Scan32 settings ALLDRIVE.VSC = Scan32 settings file SCAN_C.VSC = Scan32 settings file 5. Installed for Emergency Disk Creation Utility: SCAN.EXE = MS-DOS scan program SCANPM.EXE = Protected mode scanner EDISK.EXE = Emergency Disk creation utility GETREPLY.EXE = Emergency diskette program component EDAT.1 = Emergency Disk batch file EDAT.2 = Emergency Disk program information file EDAT.3 = Emergency Disk file EDAT.4 = Emergency Disk file EDAT.5 = Emergency Disk file EDAT.6 = Emergency Disk file ESCAN.BAT = Emergency Disk file EDISK.SCR = Emergency Disk script MCKRNL16.DLL = Emergency Disk library file MCUTIL16.DLL = Emergency Disk library file EMSCAN.DAT = Virus scan definition data EMCLEAN.DAT = Virus clean definition data EMNAMES.DAT = Virus names definition data 6. Installed for ScreenScan: MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file DUNZIP32.DLL = ScreenScan compression library file DZIP32.DLL = ScreenScan compression library file SCRSCAN.EXE = ScreenScan program file SCRSCAN.HLP = ScreenScan help file Files located in WINDOWS directory: ========================================== SECCAST.ICO = Secure Cast icon Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan32/DOS: MCAFECOM.DLL = Network Associates Electronic Commerce library file 2. Installed for VShield/Scan32: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver VSHINIT.VXD = VShield virtual device driver Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan32: SCANEXT.HLP = Scan32 Extension help * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _________________________________ MANUALLY UNINSTALLING THE PRODUCT Network Associates recommends using VirusScan's unInstall program provided. You can access the unInstaller from the Start menu in Programs/McAfee VirusScan. If, however, you choose to manually uninstall VirusScan, follow the instructions outlined below: 1. Remove VirusScan from the AUTOEXEC.BAT file: 1. Go to the System Configuration Editor window by typing SYSEDIT in the Start/Run dialog box and press Enter. 2. In the first file, the AUTOEXEC.BAT, delete the VirusScan entry and the @IF ERRORLEVEL 1 PAUSE line if present. 3. Save the changes and close the System Configuration Editor window. 2. Remove VirusScan icons: The VirusScan icons can be removed from the Taskbar properties page in Start/Settings/Taskbar. Follow the instructions below to remove VirusScan icons. 1. From the Taskbar properties page, click Remove. 2. Highlight the VirusScan folder. 3. Click the Remove button to remove the icons. 4. Click OK. 3. Edit the Registry: 1. To get to the Registry, type REGEDIT in the Start/Run dialog box and press Enter. 2. In HKEY_CLASSES_ROOT, delete the key "VirusScan" from the following: comfile\\shell\\VirusScan Directory\\shell\\VirusScan Drive\\shell\\VirusScan exefile\\shell\\VirusScan Excel.Addin\\shell\\VirusScan Excel.Chart.5\\shell\\VirusScan Excel.Chart.8\\shell\\VirusScan Excel.Macrosheet\\shell\\VirusScan Excel.Sheet.5\\shell\\VirusScan Excel.Sheet.8\\shell\\VirusScan Excel.Template\\shell\\VirusScan Excel.Workspace\\shell\\VirusScan Excel.XLL\\shell\\VirusScan WinZip\\shell\\VirusScan Word.Document.6\\shell\\VirusScan Word.Document.8\\shell\\VirusScan Word.Template\\shell\\VirusScan Delete the key "VSConfigFile" Delete the key "VSHConfigFile" 3. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run, delete the names "Vshwin32.EXE", "VSCHED.EXE", and "VSECOMR.EXE". 4. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\RunServices, delete the name "Vshwin32EXE". 5. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall, delete the key "McAfee VirusScan". 6. In HKEY_LOCAL_MACHINE\SOFTWARE\McAfee, delete the keys "Scan95" and "ScreenScan." 7. In HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates, delete the key "McAfee VirusScan". 8. Exit the Registry Editor by choosing the REGISTRY option from the File Menu and selecting the EXIT option. 4. Delete VirusScan files and directories. 1. Using CTRL+ALT+DEL, end the VSHWIN32.EXE task. 2. Close any other components that are open. 3. Delete the folder in which VirusScan is installed. Typically, VirusScan is installed in Program Files\Network Associates\McAfee VirusScan 4. From \Windows\system directory, remove the following files: MCKRNL.VXD MCSCAN32.VXD MCUTIL.VXD VSHIELD.VXD 5. VirusScan is uninstalled. Reboot your system for the changes to take effect. _____________ DOCUMENTATION For more information, refer to the VirusScan User's Guides, included on the CD-ROM versions of this program or available from the Network Associates BBS and FTP sites. These files are in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your Network Associates products. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/acrobat/readstep.html VirusScan and ScreenScan documentation can be downloaded from the Network Associates BBS, or the World Wide Web at: http://www.nai.com For more information on viruses and virus prevention, see the Network Associates Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from Network Associates BBS and FTP sites. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the Network Associates website. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about Network Associates products also are available on the Network Associates BBS and website, and CompuServe and AOL forums. Q: I am installing new software on my computer, and the manual recommends disabling any anti-virus software. How do I disable VirusScan without uninstalling it? A: Right-click on the VShield icon located in your system tray next to the system clock, then click Disable. After installing the software, right-click on the VShield icon, then click Enable. Q: When VirusScan detects an infection in compressed files of the CAB or ZIP-SFX type, why doesn't VirusScan clean, delete, or move the file? A: Because files of the compression types CAB and ZIP-SFX may use Microsoft's Authenticode technology, they could be rendered unusable if they are altered. To avoid this possibility, VirusScan does not clean, delete, or move infected files of the CAB or ZIP-SFX compression types. When VirusScan detects an infection in a CAB or ZIP-SFX compressed file, Network Associates recommends that you decompress the file to clean it. Q: When my screen saver starts, I suddenly see a lot of activity on my hard disk. What's happening? How do I stop this activity? A: The ScreenScan component is designed to scan your hard disk for viruses when your computer is idle. To do so it starts your screen saver, if one is enabled, then begins a scan operation. The hard disk activity you see is ScreenScan examining your hard disk for viruses. To deactivate ScreenScan, follow these steps: 1. Move your cursor to the Windows 95 desktop, then click your right mouse button. 2. Choose Properties from the shortcut menu that appears. 3. Click the ScreenScan tab in the Display Properties dialog box. 4. Clear the Enable Scanning While in Screen Saver Mode check box. Q: VirusScan detected a virus on my system, but it is not a document, spreadsheet, or executable file (.EXE, .COM, .DO?, .XL?). Therefore, I suspect it might be a false detection. What can I do to verify a detected virus? A: If you suspect a false detection on a non-executable file, run VirusScan's command line scanner, SCAN.EXE, to verify an infection. If VirusScan detects a virus and SCAN.EXE does not, please download the latest .DAT files to update your virus definition files and scan your system again. If VirusScan still detects a virus that you suspect to be a false detection, please report the issue to Network Associates technical support. Q: I would like to electronically purchase and download the latest version of VirusScan. I do not want to give my credit card information over the Internet for security purposes. Can I purchase VirusScan via modem and download the product via the Internet? A: Yes. The first time you download VirusScan, the Network Associates electronic Wizard will prompt you to select the transmission method you prefer to download and to transmit your encrypted credit card information. At the Transaction Connection Type dialog box, select Internet to download your order via the Internet. At the Security Connection Type dialog box, select Direct Dial Modem to transmit your credit card information via modem. Q: I have created my own Emergency diskette without using the Emergency Disk creation utility. How must I optimize my emergency disk's performance? A: To enable your own Emergency Disk, you must create a CONFIG.SYS file on the boot diskette and add the following lines: DEVICE=HIMEM.SYS DOS=HIGH Add the HIMEM.SYS file from the DOS directory or if you are using Windows 95 system files, add HIMEM.SYS from the \WINDOWS\COMMAND directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in the electronic documentation (.PDF file) included in your VirusScan package. Q: I moved a .VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved .VSC file. 2. Right-click on the .VSC file to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Detection Tab on the property sheet. 5. Check the Start Automatically box. 6. Click OK. Q: When VirusScan is launched, how does it determine the default settings? A: VirusScan default settings may be found in the DEFAULT.VSC file located in the install directory. Q: What are the possible error codes returned by CHKVXD.EXE? A: The possible CHKVXD.EXE error level codes and their descriptions are listed below: 65535(-1)= VShield not installed 0 = VShield enabled 1 = VShield disabled Q: How can I tell that ScreenScan is working? A: ScreenScan does not alert you when it is scanning your system. However, if you enable the logging option during your configuration, all ScreenScan activity will be recorded in a log file in the Installation directory. Q: How can I scan multiple or network drives with VirusScan? A: You can configure scans of multiple or network drives from the Detection property page. To see the page, choose Advanced from the Tools menu in VirusScan. To scan more than one drive or a network drive, follow these steps: 1. Click the Detection tab. 2. Click Add. 3. Do one of the following: - To add all network drives to the Detection list, click Select Item to Scan, then select All Network Drives. - To add drives to the Detection list, click Select Drive or Folder to Scan. Enter a drive letter or click Browse to locate the drive you want scanned. 4. Click OK. 5. Repeat this procedure to add more drives to the Detection list. 6. Choose Save Settings from the File menu to save your settings. Q: Can I update Network Associates data files to detect new viruses? A: Yes. If your data files are out-of-date, VirusScan will periodically prompt you to update them. If you have a modem or Internet connection, you can use VirusScan's new electronic update feature for easy data file updates, technical support, and registration. Note: VirusScan's electronic update feature applies to retail copies and any copies bundled with your computer. If you own a corporate version of VirusScan, AutoUpdate and AutoUpgrade can be configured to pull updates via the VirusScan Console. If you need additional assistance with downloading, contact Network Associates Download Support. Q: How do I use the new AutoUpdate and AutoUpgrade features in VirusScan v3.1.6? A: You can use these features to automatically update to the latest .DAT files and upgrade to the latest version of VirusScan. To do so, configure VirusScan to use AutoUpgrade and AutoUpdate on a scheduled basis: 1. Launch the VirusScan Console. 2. Double-click on the AutoUpdate task. 3. Click Configure. 4. Choose a method of transfer. While in this configuration screen, you may also set up AutoUpgrade options. 5. Click Update Now to test your configuration. 6. Click OK. 7. Click the Schedule tab. 8. Click Enable, then choose a schedule (.DAT files are updated monthly). 9. Your task is now configured and will be run on the schedule you chose. You may also launch the AutoUpdate and AutoUpgrade tasks using the on-demand method by clicking either Update Now in the task configuration or by clicking the Green Play arrow in the console toolbar. Q: Why are there two sets of data files available for download from www.nai.com? A: One set, which has a filename beginning with 30, is compatible with VirusScan versions 3.0.0 and later. This is the file you will download to update your installation of VirusScan. The second set, which has a filename beginning with 97, is designed to support older versions of VirusScan (before v3.0.0) and should not be used with this version of VirusScan. Q: An error occurs when VirusScan's Setup is 95 percent completed. Why does this occur on my system, but not on others? A: Using a non-standard Windows 95 winsock will cause the electronic commerce portion of Setup to fail on some systems at the 95 percent completed point. To prevent this, use the default Windows 95 winsock. Q: I removed the Recycle Bin from the VirusScan exclusions list. How can I replace it? A: Because the Recycle Bin is a system folder, it cannot be added to the exclusions list using VirusScan's browse feature. To restore it to the list, enter the Recycle Bin's full path in the exclusions list: \Recycled\ Q: Why are additional extensions added to the Program Files Only list? A: As the Network Associates Anti-Virus Emergency Response Team finds virus types that can infect new file types, they are added to the default extensions list to enhance security. Q: I have Microsoft Office installed, but cannot use the right-click context menu to initiate a scan. Why? A: If Office is installed after VirusScan, it may be necessary to reinstall VirusScan in order to add right-click functionality for DO?, XL, and OBD files. _____________________________ CONTACTING NETWORK ASSOCIATES * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact the Network Associates Customer Care department: 1. Corporate-licensed customers, call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time Retail-licensed customers, call (972) 278-6100 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following Network Associates locations: Network Associates Corporate Headquarters 2805 Bowers Avenue Santa Clara, CA 95051-0963 Network Associates Canada 139 Main Street, Suite 201 Unionville, Ontario Canada L3R 2G6 Network Associates Europe B.V. Gatwickstraat 25 1043 GL Amsterdam The Netherlands Network Associates International Ltd. Minton Place, Victoria Street Windsor, Berkshire SL4 1EG United Kingdom Network Associates France S.A. 50 rue de Londres 75008 Paris France Network Associates Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Network Associates Japan Co, Ltd. Toranomon 33 Mori Bldg. 3-8-21 Toranomon Minato-Ku, Tokyo 105 Japan Network Associates Korea 135-090, 18th Fl., Kyoung Am Bldg. 157-27 Samsung-Dong, Kangnam-Ku Seoul, Korea Network Associates South East Asia 7 Temasek Boulevard The Penthouse #44-01, Suntec Tower One Singapore 038987 Network Associates Australia Level 1, 500 Pacific Highway St. Leonards, NSW 2065 Australia Network Associates Latin America 150 South Pine Island Road, Suite 205 Plantation, FL 33324 USA Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@nai.com 3. Download Support at (408) 988-3832 4. Internet FTP: ftp.nai.com 5. World Wide Web: http://www.nai.com 6. America Online: keyword MCAFEE 7. CompuServe: GO MCAFEE Before contacting Network Associates, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. Documentation feedback is welcome. Send e-mail to documentation@nai.com. * FOR ON-SITE TRAINING INFORMATION * Contact Network Associates Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use Network Associates products, we have established a Resellers program to provide service, sales, and support for our products worldwide. For a listing of Network Associates resellers near you, click Contact under the Information section on the Network Associates website.