What's New in VirusScan for Windows 95 v3.0.2 (3004) Copyright 1994-1997 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Contact McAfee ____________ NEW FEATURES * NEW VIRUSES DETECTED * This DAT file (3004) detects the following 537 new viruses. _5850 MONSTER.664 ABC.A MR TWISTER.209 AIWED.678 MR TWISTER.12288 ALIEN.C MUCK.B ALLA (BOOT/MBR) MUCK.C ALLA.1325 W97M/MUCK.D ANTHRAX DROPPER MUMMY.1489 ANTICAD DROPPER MVDK1.A ANTICONCEPT.A MVDK1.B APRIL1ST NEVER ONE.442 ARMADILLO.A NG.914 ASH.270 DROPPER NICEDAY.C ATOM.G:DE NICHOLS DROPPER ATOM.H NIKITA.A AUSTRALIAN PARASITE.424 NJ-WMCVK1 AVALANCHE.2908 NJ-WMCVK2.A BABY.A NJ-WMCVK2.B BABY.COMP.128 NJ-WMDLK1.A BAD BRAINS.554 NJ-WMDLK1.B BADBOY.B NJ-WMDLK1.C BADBOY.C NJ-WMDLK1.D BALU.A:DE NJ-WMDLK1.E BANDUNG.D NO-F.A BANDUNG.H NOMENKLATURA.1024.B BANDUNG.I NOMVIR.A:DE BANDUNG.J NOMVIR.B:DE BANDUNG.K NONDES.2328:TPE BANDUNG.L NOP.D BANDUNG.M NOP.E:DE BANDUNG.N NOP.F:DE BANDUNG.O NOPMN BANDUNG.P NPAD.C BANDUNG.Q NPAD.E BANDUNG.R NPAD.F BANDUNG.S NPAD.M BANDUNG.T NPAD.N BISHOP.2855 NPAD.O BLEAH.A NPAD.P BLEAH.B NPAD.Q BLEAH.C NPAD.R BOOM.B:DE NPAD.S BOX.A:TW NPAD.T BUG COMP.73 NPAD.U BURGER.560 DROPPER NPAD.V BURGER.560.AX NPAD.W BW.372 NPAD.X BW.372.DROPPER NPAD.Y BW.VICK DROPPER NPAD.Z CANCERBERO.1000.C NPAD.AA CAP.A NPAD.AB CAP.B NPAD.AC CEEFOUR.A NPAD.AD CHAOS.A NPAD.AE CHEAP.828 NPAD.AF CHINESE FISH DROPPER NPAD.AG CIVIL WAR.2248:TPE NPAD.AH CLOCK.E:DE NPAD.AI CLOCK.F:DE NPAD.AJ CLOCK.G:DE NPAD.AK CLOCK.H:DE NPAD.AL CODE.1289 NPAD.AM COLORS.C NPAD.AN COLORS.F NPAD.AO COLORS.G NRLG.719 COLORS.H NUCLEAR.E COLORS.I NUCLEAR.F COLORS.J NUCLEAR.G COLORS.K OFFSPRING.1555 COLORS.L OLYMPIC.B:TW COLORS.M OUTLAW.A COLORS.N OUTLAW.B COLORS.O OUTLAW.C COLORS.P OVERKILL.1191 COLORS.Q PANDANIA.3566 COLORS.S PARITY BOOT.X COLORS.T PHALCON DROPPER COLORS.U PHALCON.1117.B COLORS.V PHALCON.MINISTRY.1168 COLORS.W PHARDERA.D COLORS.X PHARDERA.E COLORS.Y PHOENIX EVIL DROPPER COLORS.Z PHOENIX.2000 DROPPER COLORS.AA PIZELUN.3599 COLORS.AB PMBS DROPPER COLORS.AC POSSESSED.2446 COLORS.AD PREDATOR.1072 DROPPER COLORS.AE PS-MPC.326.B COLORS.AF PS-MPC.444 COLORS.AG PS-MPC.570 DROPPER COLORS.AH PS-MPC.577 DROPPER COLORS.AI PURCYST DROPPER COLORS.AJ PURPLE DROPPER COMPA.4561 PYTHON.1142 COMPA.4894 RANDOM.A (INTENDED) CONCEPT.C RANDY.3072.B CONCEPT.J RAPE.626 CONCEPT.L RAPI.E CONCEPT.M RAPI.E1 CONCEPT.N RAPI.E2 CONCEPT.P RAPI.F CONCEPT.T RAPI.F1 CONCEPT.U RAPI.F2 CONCEPT.W RAPI.G CONCEPT.X RAPI.G1 CONCEPT.Y RAPI.H CONCEPT.Z RAPI.H1 CONCEPT.AA RAPI.H2 CONCEPT.AB RAPI.I CONCEPT.AC RAPI.I1 CONCEPT.AD RAPI.I2 CONCEPT.AE RAPI.J CONCEPT.AF RAPI.J1 CONCEPT.AG RAPI.J2 CONCEPT.AH RAPI.K CONCEPT.AI RAPI.K1 DALIAN.1361 RAPI.K2 DANIEL.A RAPI.L DANIEL.B RAPI.L1 DANIEL.C RAPI.L2 DARK MANKO.764 RAPI.M DARK.A RAPI.M1 DARK_AVENGER.2000.H RAPI.M2 DATACRIME.1280.A DROPPER RAPI.N DAVE.A RAPI.O DELTA PLUS.1328 RAPI.O1 DELTA PLUS.1328 RAPI.O2 DEMON.4390 RAPI.P DIEG2.1586 RAPI.Q DIVINA.E RAPI.Q1 DJ11 DROPPER RAPI.Q2 DOGGIE.B RAPI.R2 DOGGIE.C RAPI.S2 DOGGIE.D RAPI.T DZT.A RAPI.T1 DZT.B RAPI.T2 DZT.C RAPI.U2 EIGHT TUNES DROPPER RAPI.V2 EPIDEMIC.A:TW RAPI.W2 EQUALS.1448 RATS.A ERASER.A:TW RATS.B ERASER.B:TW RATS.C ERASER.C:TW RUSTY.1423 FALUS.1181 SABOTAGER.3133 FELICES.1121 SCORPIO.1000 FIST.401 SETMD.A:TW FRIDAY.A:DE SHAREFUN.A FRODO.146 SHARK.1661 FURY.A:IT SHOWOFF.B FUTURENOT.A SHOWOFF.C GABLE.A SHOWOFF.D GANGSTERZ.A SHOWOFF.E GETIT.754 TROJAN SHOWOFF.F GURU.1196 SHOWOFF.G HELLGATE.A SHOWOFF.H HELLIS.624 SHOWOFF.I HELPER.A (TROJAN97) SHOWOFF.J HELPER.B SHOWOFF.K HIDER.A SHOWOFF.L HIDOS DROPPER SHOWOFF.M HLLC.4000 SHOWOFF.N HLLC.4870 SHOWOFF.O HLLC.5008 SHOWOFF.P HLLC.5129 SHOWOFF.Q HLLC.10832 SHOWOFF.S HLLC.14692 SHOWOFF.T HLLC.CRAWEN.8516 SHOWOFF.U HLLC.EVENBEEP.B SHOWOFF.V HLLO.2162 SHOWOFF.W HLLO.15788 SHOWOFF.X HLLO.52480 SHOWOFF.Y HLLP.4080 SHOWOFF.Z HLLP.5153 SHOWOFF.AA HLLP.5667.A SHOWOFF.AB HLLP.5667.B SILICON-AVENGER.980 HLLP.16470 SILLYCR.131 HLLT.4400 SIMPLE.A HLLT.6988 SKAM.A HLLT.7234 SKELETON.673 HLLT.17408 SLAMSPED.101 HOMER.426 SMILEY.A:DE HYBRID.B SMILEY.B:DE HYBRID.C SNICKERS.A IMPOSTER.C SOVA.4060 IRISH.B SPANSKA.1120 IRISH.C SPIRAL.A IRISH.D SPLIT.4300 IRISH.E SQUISHER.238 DROPPER IRISH.F STEALTH BOOT.H IRISH.G STEALTH_BOOT.KOH.C IVP.1052 SWITCHES.A IVP.491 SWORD.A IVP.846 TARGET.B:DE JOHNNY.A1 TELEPHONICA DROPPER JOHNNY.B TENTATRICKLE.10496 JOHNNY.D TESTDOT.A:TW JOHNNY.E THEATRE.B:TW JOHNNY.E1 THEATRE.C:TW JOSHI DROPPER TRASH.512 JTEMP.316 TRIVIAL.62 KAMPANA.3784 DROPPER TWISTER.A KASZANA.1920 TWISTER209.1632 KATIELOU.894 TWNO.E:TW KERRANG.A TWNO.F:TW KHIZHNJAK.515 TWNO.H:TW KILLPROT.B TWNO.I:TW KLUBB TWNO.J:TW W97M/KOMPU.A UGLY_JO L-BOOT UMB.1276 LEWD.4455 UMB.1760 LION.996 UUCCKK.475 LOOK.A:TW V2PX LOOK.B:TW VAMPIRUS.1499 LOOK.C:TW VCL.2037 LUCIFER.1707 VCL.641 DROPPER MADDOG.B VIENNA.618 MARKUS.5415 VIKING.DEC3 MAX.347 VIRDEM.1542 DROPPER MDMA.B WARPCOM TROJAN MDMA.F W97M/WAZZU.C MDMA.G WAZZU.AA MEGADETH.3973:MTE WAZZU.AB MIND.A WAZZU.AC MINIMAL.A WAZZU.AD MINIMAL.B WAZZU.AE W97M/MINIMAL.C WAZZU.AF MINIMAL.D WAZZU.AG MIXX.570 WAZZU.AH MONSTER.217 WAZZU.AI MONSTER.323 WAZZU.AJ MONSTER.327 WAZZU.AK MONSTER.535 WAZZU.AL MONSTER.536 WAZZU.AM MONSTER.538 WAZZU.AN MONSTER.570 WAZZU.AO MONSTER.572 WAZZU.AP MONSTER.577 WAZZU.AQ MONSTER.578 WAZZU.AR MONSTER.579 WAZZU.AS MONSTER.580 WAZZU.AU MONSTER.581 WAZZU.AV MONSTER.582 WAZZU.AW MONSTER.583 WAZZU.AX MONSTER.584 WAZZU.AY MONSTER.594 WAZZU.AZ MONSTER.596 WAZZU.BA MONSTER.598 WAZZU.BB MONSTER.599 WAZZU.BC MONSTER.600 WAZZU.BD MONSTER.601.A WAZZU.BE MONSTER.601.B WAZZU.BF MONSTER.602 WAZZU.BG MONSTER.603.A WAZZU.BH MONSTER.603.B WAZZU.BI MONSTER.604 WAZZU.BJ MONSTER.605.A WAZZU.BK MONSTER.605.B WAZZU.BL MONSTER.607 WAZZU.BM MONSTER.614 WAZZU.BN MONSTER.622 WAZZU.BO MONSTER.633 WAZZU.BP MONSTER.638 WAZZU.BQ MONSTER.640 WIEDEROEFFNEN.A MONSTER.641 WPC_ALAEH.3161 MONSTER.642 XENIXOS.B:DE MONSTER.643 XTINY.264 MONSTER.645 YEAR_1992.1731.C MONSTER.657 ZERO.A:DE MONSTER.661 ZIPCRK MONSTER.662 * NEW VIRUSES REMOVED * This DAT file (3004) removes the following 393 new viruses. ABC.A NPAD.F AIWED.678 NPAD.M ALIEN.C NPAD.N ALLA (BOOT/MBR) NPAD.O ALLA.1325 NPAD.P ANTICONCEPT.A NPAD.Q ARMADILLO.A NPAD.R ATOM.G:DE NPAD.S ATOM.H NPAD.T BABY.A NPAD.U BABY.COMP.128 NPAD.V BADBOY.B NPAD.W BADBOY.C NPAD.X BALU.A:DE NPAD.Y BANDUNG.D NPAD.Z BANDUNG.H NPAD.AA BANDUNG.I NPAD.AB BANDUNG.J NPAD.AC BANDUNG.K NPAD.AD BANDUNG.L NPAD.AE BANDUNG.M NPAD.AF BANDUNG.N NPAD.AG BANDUNG.O NPAD.AH BANDUNG.P NPAD.AI BANDUNG.Q NPAD.AJ BANDUNG.R NPAD.AK BANDUNG.S NPAD.AL BANDUNG.T NPAD.AM BLEAH.A NPAD.AN BLEAH.B NPAD.AO BLEAH.C NUCLEAR.E BOOM.B:DE NUCLEAR.F BOX.A:TW NUCLEAR.G BW.372 OLYMPIC.B:TW CANCERBERO.1000.C OUTLAW.A CAP.A OUTLAW.B CAP.B OUTLAW.C CEEFOUR.A PANDANIA.3566 CHAOS.A PARITY PARITY BOOT.X CHEAP.828 PHALCON.MINISTRY.1168 CLOCK.E:DE PHARDERA.D CLOCK.F:DE PHARDERA.E CLOCK.G:DE POSSESSED.2446 CLOCK.H:DE RANDOM.A (INTENDED) COLORS.C RAPI.E COLORS.F RAPI.E1 COLORS.G RAPI.E2 COLORS.H RAPI.F COLORS.I RAPI.F1 COLORS.J RAPI.F2 COLORS.K RAPI.G COLORS.L RAPI.G1 COLORS.M RAPI.H COLORS.N RAPI.H1 COLORS.O RAPI.H2 COLORS.P RAPI.I COLORS.Q RAPI.I1 COLORS.S RAPI.I2 COLORS.T RAPI.J COLORS.U RAPI.J1 COLORS.V RAPI.J2 COLORS.W RAPI.K COLORS.X RAPI.K1 COLORS.Y RAPI.K2 COLORS.Z RAPI.L COLORS.AA RAPI.L1 COLORS.AB RAPI.L2 COLORS.AC RAPI.M COLORS.AD RAPI.M1 COLORS.AE RAPI.M2 COLORS.AF RAPI.N COLORS.AG RAPI.O COLORS.AH RAPI.O1 COLORS.AI RAPI.O2 COLORS.AJ RAPI.P COMPA.4561 RAPI.Q COMPA.4894 RAPI.Q1 CONCEPT.C RAPI.Q2 CONCEPT.J RAPI.R2 CONCEPT.L RAPI.S2 CONCEPT.M RAPI.T CONCEPT.N RAPI.T1 CONCEPT.P RAPI.T2 CONCEPT.T RAPI.U2 CONCEPT.U RAPI.V2 CONCEPT.W RAPI.W2 CONCEPT.X RATS.A CONCEPT.Y RATS.B CONCEPT.Z RATS.C CONCEPT.AA RUSTY.1423 CONCEPT.AB SCORPIO.1000 CONCEPT.AC SETMD.A:TW CONCEPT.AD SHAREFUN.A CONCEPT.AE SHOWOFF.B CONCEPT.AF SHOWOFF.C CONCEPT.AG SHOWOFF.D CONCEPT.AH SHOWOFF.E CONCEPT.AI SHOWOFF.F DANIEL.A SHOWOFF.G DANIEL.B SHOWOFF.H DANIEL.C SHOWOFF.I DARK.A SHOWOFF.J DARK_AVENGER.2000.H SHOWOFF.K DAVE.A SHOWOFF.L DELTA PLUS.1328 SHOWOFF.M DIEG2.1586 SHOWOFF.N DIVINA.E SHOWOFF.O DOGGIE.B SHOWOFF.P DOGGIE.C SHOWOFF.Q DOGGIE.D SHOWOFF.S DZT.A SHOWOFF.T DZT.B SHOWOFF.U DZT.C SHOWOFF.V EPIDEMIC.A:TW SHOWOFF.W ERASER.A:TW SHOWOFF.X ERASER.B:TW SHOWOFF.Y ERASER.C:TW SHOWOFF.Z FALUS.1181 SHOWOFF.AA FELICES.1121 SHOWOFF.AB FRIDAY.A:DE SILLYCR.131 FURY.A:IT SIMPLE.A FUTURENOT.A SKAM.A GABLE.A SKELETON.673 GANGSTERZ.A SMILEY.A:DE GURU.1196 SMILEY.B:DE HELLGATE.A SNICKERS.A HELPER.B SOVA.4060 HIDER.A SPANSKA.1120 HLLC.CRAWEN.8516 SPIRAL.A HLLC.EVENBEEP.B SPLIT.4300 HLLP.4080 STEALTH BOOT.H HLLT.4400 SWITCHES.A HYBRID.B SWORD.A HYBRID.C TARGET.B:DE IMPOSTER.C TENTATRICKLE.10496 INVISIBLE_MAN.3223 TESTDOT.A:TW IRISH.B THEATRE.B:TW IRISH.C THEATRE.C:TW IRISH.D TWISTER.A IRISH.E TWNO.E:TW IRISH.F TWNO.F:TW IRISH.G TWNO.H:TW IVP.1052 TWNO.I:TW IVP.846 TWNO.J:TW JERUSALEM.BUPT.1261 UGLY_JO JOHNNY.A1 V2PX JOHNNY.B VIENNA.618 JOHNNY.D VIKING.DEC3 JOHNNY.E W97M/WAZZU.C JOHNNY.E1 WAZZU.AA KERRANG.A WAZZU.AB KILLPROT.B WAZZU.AC W97M/KOMPU.A WAZZU.AD L-BOOT WAZZU.AE LION.996 WAZZU.AF LOOK.A:TW WAZZU.AG LOOK.B:TW WAZZU.AH LOOK.C:TW WAZZU.AI LUCIFER.1707 WAZZU.AJ MADDOG.B WAZZU.AK MARKUS.5415 WAZZU.AL MARZIA.2048 WAZZU.AM MAX.347 WAZZU.AN MDMA.B WAZZU.AO MDMA.F WAZZU.AP MDMA.G WAZZU.AQ MIND.A WAZZU.AR MING.CLME.1528 WAZZU.AS MINIMAL.A WAZZU.AU MINIMAL.B WAZZU.AV W97M/MINIMAL.C WAZZU.AW MINIMAL.D WAZZU.AX MUCK.B WAZZU.AY MUCK.C WAZZU.AZ W97M/MUCK.D WAZZU.BA MVDK1.A WAZZU.BB MVDK1.B WAZZU.BC NICEDAY.C WAZZU.BD NIKITA.A WAZZU.BE NJ-WMCVK1 WAZZU.BF NJ-WMCVK1 WAZZU.BG NJ-WMCVK2.A WAZZU.BH NJ-WMCVK2.B WAZZU.BI NJ-WMDLK1.A WAZZU.BJ NJ-WMDLK1.B WAZZU.BK NJ-WMDLK1.C WAZZU.BL NJ-WMDLK1.D WAZZU.BM NJ-WMDLK1.E WAZZU.BN NO-F.A WAZZU.BO NOMVIR.A:DE WAZZU.BP NOMVIR.B:DE WAZZU.BQ NOP.D WIEDEROEFFNEN.A NOP.E:DE WPC_ALAEH.3161 NOP.F:DE XENIXOS.B:DE NOPMN XTINY.264 NPAD.C ZERO.A:DE NPAD.E ____________ KNOWN ISSUES 1. The new 3000 series DATs contained in VirusScan v3.0.2 are not backward compatible with the VirusScan v2.x series. The 3000 series DATs should not be used with VirusScan v2.x products. 2. When using the Microsoft Plus Pack for scheduled scans with VirusScan for Windows 95, the command- line call to VIRUSCAN95\SCAN95.EXE must be changed to VIRUSCAN\SCAN32.EXE to maintain your scheduled scan functionality. 3. On some systems, after running the VirusScan for Windows 95 uninstaller, the right mouse click option to "Scan for Viruses" is not always removed. 4. Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS memory managers may cause VirusScan for Windows 95 to falsely detect viruses in memory. To eliminate false warnings, remark (Rem) the memory manager lines from your CONFIG.SYS to deactivate them. 5. ScreenScan's log file has a maximum size of 100K. If the file reaches this size, the oldest data will be deleted. To retain logging data, you should edit the content to keep the log file under 100K or save the oldest data to another file. 6. ScreenScan is designed to display the Centralized Alerting and Reporting settings as declared in the DEFAULT.VSC file. Actual configuration of ScreenScan Centralized Alerting and Reporting must be done through the procedures outlined in the Frequently Asked Questions section below. 7. ScreenScan will stop scanning after it detects a virus and prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until the next time it activates. McAfee recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. 8. After uninstalling ScreenScan, the screen saver will be set to None. You can reactivate your screen saver from the Display Properties. 9. If using CTRL+ALT+DEL to shut down a Windows 95 system when VShield or any other VxD is enabled, Windows will not shut down. However, VShield or the VxD will be disabled. Windows will not shut down unless the shut down process is repeated. This is a known issue with Microsoft's Windows 95 operating system. 10. When creating an Emergency Disk, you must close all open windows to the floppy drives. The Emergency Disk creation utility must have exclusive access to the floppy or the system file transfer will fail, making the disk non-bootable. ____________ INSTALLATION * INSTALLING THE PRODUCT * 1. Do one of the following: - If installing from diskette or compact disc, insert it into your floppy disk drive or CD-ROM drive. - If installing from files downloaded from a BBS or the McAfee Web Site, decompress the zipped files into a directory on the network or your local drive. 2 Select Run from the Start menu. 3. If installing from diskette, type x:\setup.exe where x is the drive in which you placed the diskette. Click OK. If installing from compact disc, type x:\win95\setup.exe where x is the drive in which you placed the CD-ROM. Click OK. If installing from downloaded files, type x:\path\setup.exe where x:\path is the location of the files (for example, C:\DOWNLOAD\SETUP.EXE). Click OK. Response: The Welcome screen is displayed. Click Next to continue. 4. Follow the on-screen installation instructions to complete VirusScan installation. * PERFORMING A SILENT INSTALLATION * If you would like to perform a "silent" installation of VirusScan, requiring minimal user interaction and using all default or "Typical" installation settings, add -s (i.e. SETUP.EXE -s) to the setup command when you install the product. Network Administrators can customize the silent installation feature by following the steps outlined below. 1. Check in the Windows directory to ensure that a file named SETUP.ISS does not already exist. If it does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e. SETUP.EXE -r). 3. Select the components you would like to be installed during the silent installation. All responses will be recorded. 4. Finish the installation, and locate the file SETUP.ISS in the Windows directory. 5. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result=x where x is equal to 301 (Typical installation) 302 (Compact installation) 303 (Custom installation) 6. Add 100 to the above value, so that the Result variable is equal to 401, 402, or 403. Modifying this file will allow the installation to copy the VirusScan files to the drive where the operating system resides instead of defaulting to the C: drive. 7. Copy the installation files onto a local or mapped drive, then rename, back up, or delete the SETUP.ISS file. Note: A silent install cannot be performed from multiple media as the silent operation will be comprimised when the install prompts the user for more media. 8. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. 9. Run SETUP.EXE with the -s switch (i.e. SETUP.EXE -s). NOTE: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. Also, the file used for the silent installation, SETUP.ISS, may not work properly across different operating systems. For example, if the silent install is generated for Windows 95, it may not work properly in Windows 3.1x or Windows NT. 10. When the silent installation is complete, you should reboot the machine manually. * PRIMARY PROGRAM FILES FOR VIRUSSCAN FOR WINDOWS 95 * Files located in the Install directory: ======================================= 1. Installed for VShield/Scan32/DOS/ScreenScan: README.1ST = License and registration information CLEAN.DAT = Virus clean definition data MCALYZE.DAT = Virus definition data NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data CHKVXD.EXE = VShield virtual device VALIDATE.EXE = McAfee file validation program WCMDR.EXE = Windows Commander program driver checking utility WCMDR.INI = Windows Commander configuration settings WCMDRSIL.INI = unInstallShield helper configuration DELSL?.ISU = Uninstall file PACKING.LST = Packing list RESELLER.TXT = McAfee authorized agents WHATSNEW.TXT = What's New document MCAFEE.SCU = Temporary SelfServe catalog file 2. Installed for VShield/Scan32: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library MCALYZE.DLL = Library files MCCOD32.DLL = Library files MCKRNL32.DLL = Library files MCSCAN32.DLL = Library files MCUTIL32.DLL = Library files 3. Installed for VShield: VSHCFG32.EXE = VShield configuration manager VSHWIN32.EXE = Detection engine DEFAULT.VSH = Default VShield settings DUNZIP32.DLL = File decompression library file DZIP32.DLL = File decompression library file 4. Installed for Scan32: SHUTIL.DLL = Run-time support library SCAN32.EXE = VirusScan for Windows 95 program DEFAULT.VSC = Default Scan32 settings 5. Installed for Emergency Disk Creation Utility: SCAN.EXE = MS-DOS scan program SCANPM.EXE = Protected mode scanner GETREPLY.EXE = Emergency diskette program component EDISK32.EXE = Emergency Disk creation utility EDISK32.INF = Emergency Disk information file EDISKDOS.IN = Emergency Disk file EDISKDOS.PIF = Emergency Disk program information file EDISKDOS.BAT = Emergency Disk batch file 6. Installed for ScreenScan: MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file SCRSCAN.EXE = ScreenScan program file Files located in WINDOWS directory: ========================================== SECCAST.ICO = Secure Cast icon Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan32/DOS: MCAFECOM.DLL = McAfee Electronic Commerce library file 2. Installed for VShield/Scan32: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver 4. Installed for Scan32: S95EXT.DLL = Shell extension Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan32: SCANEXT.HLP = Scan32 Extension help VIRUSCAN.HLP = VirusScan help VIRUSCAN.CNT = VirusScan context-sensitive help 3. Installed for ScreenScan: SCRSCAN.HLP = ScreenScan help Note: WINDOWS refers to the directory to which Windows 95 is installed, not the Windows 3.1x directory. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti- virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _________________________________ MANUALLY UNINSTALLING THE PRODUCT McAfee recommends using VirusScan's uninstall program provided. You can access the uninstaller from the Start menu in Programs/ McAfee VirusScan. If, however, UNINSTALLER.EXE is not present on your system, follow the instructions outlined below to manually uninstall VirusScan: 1. Remove VirusScan from the AUTOEXEC.BAT file: 1. Go to the System Configuration Editor window by typing SYSEDIT in the Start/Run dialog box and press Enter. 2. In the first file, the AUTOEXEC.BAT, delete the Virus- Scan entry and the @IF ERRORLEVEL 1 PAUSE line if present. 3. Save the changes and close the Configuration Editor window. 2. Remove VirusScan icons: The VirusScan icons can be removed from the Taskbar properties page in Start/Settings/Taskbar. Follow the instructions below to remove VirusScan icons. 1. From the Taskbar properties page, click Remove. 2. Highlight the McAfee VirusScan folder. 3. Click the Remove button to remove the icons. 4. Click Okay. 3. Edit the Registry: 1. To get to the Registry, type REGEDIT in the Start/Run dialog box and press Enter. 2. In HKEY_CLASSES_ROOT, delete the key "VirusScan" from the following: comfile\\shell\\VirusScan Directory\\shell\\VirusScan Drive\\shell\\VirusScan exefile\\shell\\VirusScan Excel.Addin\\shell\\VirusScan Excel.Chart.5\\shell\\VirusScan Excel.Chart.8\\shell\\VirusScan Excel.Macrosheet\\shell\\VirusScan Excel.Sheet.5\\shell\\VirusScan Excel.Sheet.8\\shell\\VirusScan Excel.Template\\shell\\VirusScan Excel.Workspace\\shell\\VirusScan Excel.XLL\\shell\\VirusScan WinZip\\shell\\VirusScan Word.Document.6\\shell\\VirusScan Word.Document.8\\shell\\VirusScan Word.Template\\shell\\VirusScan Delete the key "VSConfigFile" Delete the key "VSHConfigFile" 3. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run, delete the name "Vshwin32EXE". 4. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\RunServices, delete the name "Vshwin32EXE". 5. In HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\ CurrentVersion\Uninstall, delete the key "VirusScan". 6. Exit the Registry Editor by choosing the REGISTRY option from the File Menu and selecting the EXIT option. 4. Delete VirusScan files and directories. 1. Using CTRL+ALT+DEL, end the VSHWIN32.EXE task. 2. Delete the McAfee directory under Program Files. 3. From \Windows\system directory, remove the following files: MCKRNL.VXD MCSCAN32.VXD MCUTIL.VXD VSHIELD.VXD 5. VirusScan is uninstalled. Reboot your system for the changes to take effect. _____________ DOCUMENTATION For more information, refer to the User's Guides, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. These files are in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee products. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/acrobat/readstep.html VirusScan and ScreenScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.164 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: VirusScan detected a virus on my system, but it is not a document, spreadsheet, or executable file (.EXE, .COM, .DO?, .XL?). Therefore, I suspect it may be a false detection. What can I do to verify a detected virus? A: If you suspect a false detection on a non-executable file, run VirusScan's command line scanner, SCAN.EXE, to verify an infection. If VirusScan for Windows95 detects a virus and SCAN.EXE does not, please download the latest DAT files to upgrade your virus definition files and scan your system again. If VirusScan still detects a virus that you suspect to be a false detection, please report the issue to McAfee technical support. Q: How do I enable McAfee's Centralized Alerting and Reporting feature? A: VirusScan now supports Centralized Alerting and Reporting to a remote NetWare or Windows NT server running NetShield v2.5.3 or later for Windows NT or NetShield v2.3.3 or later for NetWare. Centralized Alerting and Reporting can be enabled from the VirusScan console on your client workstation. To set up this option on your VirusScan client, follow the instructions outlined below: 1. Select Standard from the Tools menu on the VirusScan console. 2. Click the Alert tab to configure alert settings. 3. Check the Send Network Alert checkbox. Enter the directory where the CENTALRT.TXT file is located or click the Browse button to locate the file. NOTE: The client must have write access to this location and the directory must contain the NetShield-supplied CENTALRT.TXT file. 4. Select Save Settings from the File menu to save the new alert settings. Q: I would like to electronically purchase and download the latest version of VirusScan for Windows 95. I do not want to give my credit card information over the Internet for security purposes. Can I purchase VirusScan via modem and download the product via the Internet? A: Yes. The first time you download VirusScan for Windows 95, the McAfee electronic Wizard will prompt you to select the transmission method you prefer to download and to transmit your encrypted credit card information. At the Transaction Connection Type dialog box, select Internet to download your order via the Internet. At the Security Connection Type dialog box, select Direct Dial Modem to transmit your credit card information via modem. Q: While downloading a licensed copy of VirusScan for Windows 95, the installation was interrupted and/or canceled. Where can I find my licensed VirusScan files and how do I proceed with the installation? A: The files are in the VSint folder located in the Windows Temp directory. Double click on SETUP.EXE within the VSint folder to continue with the installation. Q: I have created my own Emergency diskette without using the Emergency Disk creation utility. How must I optimize my emergency disks' performance? A: To enable your own Emergency Disk, you must create a CONFIG.SYS file on the boot diskette and add the following lines: [CONFIG.SYS] DEVICE=HIMEM.SYS DOS=HIGH Add the HIMEM.SYS file from the DOS directory or if you are using Windows 95 system files, add HIMEM.SYS from the \WINDOWS\COMMAND directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in the electronic documentation (.PDF file) included in your VirusScan package. Q: I moved a .VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan for Windows 95, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved .VSC file. 2. While pointing to the .VSC file, right-click to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Options Tab on the property sheet. 5. Check the Start Automatically box. By enabling this option, scanning will begin automatically. If viruses are not detected VirusScan for Windows 95 will automatically close and free up system resources. Q: When VirusScan for Windows 95 is launched, how does it determine the default settings? A: VirusScan for Windows 95 default settings may be found in the DEFAULT.VSC file located in the install directory. Q: How can I tell that ScreenScan is working? A: ScreenScan does not alert you when it is scanning your system. However, if you enable the logging option during your configuration, all ScreenScan activity will be recorded in a log file in the Installation directory. Q: How do I scan multiple drives? A: #1 Enter LocalDrives or NetworkDrives in the Scan In text dialog on the Where & What property page. Click Scan Now and all LocalDrives or all NetworkDrives will be scanned. A: #2 VirusScan for Windows 95 can scan many locations simultaneously. To do this, take these steps: 1. Launch Explorer. 2. Highlight the drives or folders you want to scan. 3. Right-click to reveal the Context Menu. 4. Select Scan for Viruses. 5. Click Scan Now to begin scans. Q: Can I update McAfee's data files to detect new viruses? A: Yes. If your data files are out-of-date, VirusScan for Windows 95 will periodically prompt you to update them. If you have a modem or Internet connection, you can use VirusScan's new electronic update feature for easy data file updates, technical support, and registration. Note: VirusScan's electronic update feature applies to the retail and evaluation copies of VirusScan only. If you own a corporate copy of VirusScan, please notify your System Administrator to receive your data file updates. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Corporate-licensed customers, call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time Retail-licensed customers, call (972) 278-6100 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2805 Bowers Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral Center West 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 4099 McEwen Suites 500 and 700 Dallas, TX 75244 McAfee Canada 139 Main Street Suite 201 Unionville, Ontario Canada L3R2G6 McAfee Nederland B.V. Gatwickstraat 25 1043 GL Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany McAfee Japan KK 4F Toranomon Mori bldg. 33 3-8-21 Toranomon Minato-Ku Tokyo, 105 Japan Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.168 4. World Wide Web: http://www.mcafee.com or http://205.227.129.164 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. Documentation feedback is welcome. Send e-mail to documentation@cc.mcafee.com. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of McAfee agents near you, click Contact McAfee under the Information section on the McAfee website. * MCAFEE BETA SITE * Get pre-release software, including DAT files, through http://beta.mcafee.com/public/datafiles. You will have access to Public Beta and External Test Areas. Your feedback will make a difference.