What's New in VirusScan for Windows 95 v2.0.7 (9609) Copyright 1994-1996 by McAfee, Inc. All Rights Reserved. Thank you for using McAfee's VirusScan for Windows 95. This What's New file contains important information regarding the current version of this product. It is highly recommended that you read the entire document. McAfee welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Additional Information - Contact McAfee ____________ NEW FEATURES * ENHANCEMENTS * 1. McAfee's new online update feature allows users to license products and update DAT files with the push of a button. 2. The new Administrator Mode provides the ability to lock VirusScan95 configuration settings. 3. VirusScan95 configuration files have been enhanced. Right-clicking on a VirusScan configuration file (VSC) displays the file's properties and two new tabs: Options and Actions. One of the new properties is Start Automatically, located in the Options tab. Start Automatically is necessary for scheduled scanning from the optional System Agent and for Startup group on-demand scanning. 4. McAfee's new ScreenScan utility automatically scans your system for infected files when your screen saver is active, alerting you when viruses are found and prompting you to launch VirusScan. ScreenScan maintains a separate log file of its activities in the installation directory. * NEW VIRUSES DETECTED * This DAT file (9609) detects the following 68 new viruses. In addition, locations that have experienced problems with a particular virus are identified. _1194 Spain ACCOUNT.AVENGER.873 ALLIANCE ARCV.255 ARCV.679 ARCV.745 ASH.743 BEDA.1530 BEER.2620 BEER.3164.B BEER.3192.B BIRTHDAY:DE (*) Germany BLEAH BUERO:DE Germany BW-525 CASTELLO.3742 Spain CHEGUEVA Spain COMPBACK.3783 CORDOBES.3334 Spain DEI.8772 DEI.DR.8772 DELWIN.1199 DIETZEL:DE (*) DODGER HASSLE HASTA.884 HLLP.NAZI.5984 IVP.665 JERUSALEM.BUPT.1220 JERUSALEM.BUPT.1279 JERUSALEM.BUPT.1367 KABOUT.1804 (*) KARNAVALI.1972 Europe KDG KITTY LAMEGO.729 Portugal LIBERTY.2857.D LITTLEPEST.4243 (*) MANNEQUIN MANZON.1404 Europe MENDOZA.3380 Spain MSU.297 NECROS.1164.A NECROS.1164.B PHALCON.1117 PINDONGA.B PS-MPC.578.C PS-MPC.611.J PS-MPC.753 PS-MPC.AOS PULCE.1840 RADYUM.509 RAHACK.936 Netherlands RDA FIGHTER.5871 RIOT.ETERNITY.565 SALMAN.2000 US SATRIA.RZ Europe SCREAMING_FIST.652 SCREAMING_FIST.709 SIRIUS.ALIVE.4608 TANPRO.749 TEQUILA.2468 TURNER.3276 TV V3.1765 VACSINA.1206.A VERWOLF VICTOR.2442.A (*) Requires Scan95 2.0.6 or DOS/Win 2.5.2 engine * NEW VIRUSES REMOVED * This DAT file (9609) removes the following 38 new viruses. In addition, locations that have experienced problems with a particular virus are identified. _1194 Spain ACCOUNT.AVENGER.873 ALLIANCE England ARCV.255 ARCV.657 ARCV.679 ARCV.745 ASH.743 BIRTHDAY:DE (*) Germany BLEAH BUERO:DE Germany CHEGUEVA Spain COMPBACK.3783 CORDOBES.3334 Spain DEI.8772 DEI.DR.8772 DIETZEL:DE (*) HASSLE HASTA.884 HLLP.NAZI.5984 IVP.665 LAMEGO.729 Portugal LITTLE_BROTHER Germany NO_FRILL.835 Australia PS-MPC.611.J PS-MPC.753 RAHACK.936 Netherlands SALMAN.2000 US SATRIA.RZ Europe SCREAMING_FIST.652 SHELL.10634 Internet TANPRO.524 TANPRO.749 TEQUILA.2468 TV V3.1765 VICTOR.2442.A ZYX Europe (*) Requires Scan95 2.0.6 or DOS/Win 2.5.2 engine ____________ KNOWN ISSUES 1. VirusScan95 appears to continue scanning after clicking STOP. If this occurs, move the VirusScan95 window to reveal the DynaZip UnZip Error window. Click OK and respond appropriately to the dialog box. 2. Files with the "-" (dash) character in the filename that are compressed in Zipped files will not be scanned by the on-demand scanner. 3. When a macro virus is detected in conjunction with other viruses, the macro virus remover will not work. If this occurs, remove the other virus first or work in a separate area. 4. Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS memory managers may cause VirusScan95 to falsely detect viruses in memory. To eliminate false warnings, remark (Rem) the memory manager lines from your CONFIG.SYS to deactivate them. 5. ScreenScan only runs with Windows 95 screen savers, and will not scan if no Windows 95 screen savers are selected. 6. If you uninstall ScreenScan, you must go into Display Properties and select a screen saver. 7. ScreenScan's log file has a maximum size of 100K. If the file reaches this size, the oldest data will be deleted. To retain logging data, you should edit the content to keep the log file under 100K or save the oldest data to another file. 8. ScreenScan will stop scanning after it detects a virus and prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until the next time it activates. McAfee recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. ____________ INSTALLATION * INSTALLING THE PRODUCT * If you would like to perform a "silent" installation of VirusScan, requiring minimal user interaction and using all default or "Typical" installation settings, add -s (i.e. SETUP.EXE -s) to the setup command when you install the product. Network Administrators can customize the silent installation by following the steps below. 1. Check in the Windows directory to ensure that a file named SETUP.ISS does not already exist. If it does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r switch, (i.e. SETUP.EXE -r). 3. Select the components you would like to be installed during the silent installation. All responses will be recorded. 4. Finish the installation, and locate the file SETUP.ISS in the Windows directory. 5. Open the file using any ASCII editor (e.g., NOTEPAD.EXE) and delete the section titled APPLICATION. 6. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result=x where x is equal to 301 (Typical installation) 302 (Compact installation) 303 (Custom installation) 7. Add 100 to the above value, so that the Result variable is equal to 401, 402, or 403. Modifying this file will allow the installation to copy the VirusScan files to the drive where the operating system resides instead of defaulting to the C: drive. 8. Rename, back up, or delete SETUP.ISS on the first installation disk (floppies only). For CD-ROM versions of the product, you must copy the installation files onto the hard drive before taking this step. 9. Copy the new SETUP.ISS from the Windows directory to the location of the installation files. 10. Run SETUP.EXE with the -s switch (i.e. SETUP.EXE -s). NOTE: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. Also, the file used for the silent installation, SETUP.ISS, may not work properly across different operating systems. For example, if the silent install is generated for Windows 95, it may not work properly in Windows 3.1x or Windows NT. 11. When the silent installation is complete, you should reboot the machine manually. * PRIMARY PROGRAM FILES FOR VIRUSSCAN95 * Files located in the Install directory: ======================================= 1. Installed for VShield/Scan95/DOS/ScreenScan: README.1ST = McAfee information SCAN.DAT = Virus scan definition data NAMES.DAT = Virus names definition data CLEAN.DAT = Virus clean definition data VALIDATE.EXE = McAfee file validation program CHKVSH32.EXE = VShield virtual device driver checking utility PACKING.LST = Packing list UINSTALL.EXE = Uninstall program WHATSNEW.TXT = What's New document VSUINST.EXE = Uninstall assistant UPDATE.MSG = Update message file AGENTS.TXT = McAfee authorized agents SLFSRVSW.EXE = SelfServe client program MCAFEE.SCU = Temporary SelfServe catalog file DELSL1.ISU = Uninstall file VALIDATE.EXE = McAfee file validation program WCMDR.EXE = Windows Commander program WCMDR.INI = Windows Commander configuration settings 2. Installed for VShield/Scan95: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library DUNZIP32.DLL = File decompression library file DZIP32.DLL = File decompression library file MCKRNL95.DLL = Library files MCUTIL95.DLL = Library files MCSCAN32.DLL = Library files 3. Installed for VShield: VSHCFG32.EXE = VShield configuration manager VSHWIN32.EXE = Detection engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan95: SCAN95.EXE = VirusScan95 program SHUTIL95.DLL = Run-time support library DZIP32.DLL = File compression library DUNZIP32.DLL = File decompression library DEFAULT.VSC = Default Scan95 settings 5. Installed for DOS: SCAN.EXE = MS-DOS scan program 6. Installed for ScreenScan: SCRSCAN.EXE = ScreenScan program file SCRSCAN.HLP = ScreenScan online help file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file ScreenScan Activity Log.TXT = ScreenScan activity log MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan95/DOS: CDISSS.OCX = SelfServe library file 2. Installed for VShield/Scan95: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver 4. Installed for Scan95: S95EXT.DLL = Shell extension Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan95: SCANEXT.HLP = Scan95 Extension help VIRUSCAN.HLP = VirusScan help VIRUSCAN.CNT = VirusScan context-sensitive help Note: WINDOWS refers to the directory to which Windows 95 is installed, not the Windows 3.1x directory. * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. _____________ DOCUMENTATION For more information, refer to the User's Guides, included on the CD-ROM versions of this program or available from McAfee's BBS and FTP site. These files are in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your McAfee products. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan and ScreenScan documentation can be downloaded from McAfee's BBS or the World Wide Web at: http://www.McAfee.com or http://205.227.129.97 For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from McAfee's BBS and FTP site. A ViaGraphix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the McAfee Web Site. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about McAfee products also are available on McAfee's BBS, website, and CompuServe and AOL forums. Q: How do I scan multiple drives? A: #1 VirusScan95 can scan many locations simultaneously. To do this, take these steps: 1. Launch Explorer. 2. Highlight the drives or folders you want to scan. 3. Right-click to reveal the Context Menu. 4. Select Scan for Viruses. 5. Click Scan Now to begin scans. A: #2 Enter LocalDrives or NetworkDrives in the Scan In text dialog on the Where & What property page. Click Scan Now and all LocalDrives or all NetworkDrives will be scanned. Q: I moved a VSC file to my Startup folder. Whenever I turn on my PC, it launches VirusScan95, but it does not begin scanning. How can I make it start scanning automatically? A: You need to customize your options. Take these steps: 1. Navigate to the location of the saved VSC file. 2. While pointing to the VSC file, right-click to reveal the Context Menu. 3. From the Context Menu, select Properties. 4. Select the Options Tab on the property sheet. 5. Check the Start Automatically box. By enabling this option, scanning will begin automatically. If viruses are not detected, VirusScan95 will automatically close and free up system resources. Q: When VirusScan95 is launched, how does it determine the default settings? A: VirusScan95 default settings may be found in the DEFAULT.VSC file located in the install directory. Q: My executable files were set to shareable and read-only before I ran VirusScan95, now they are read-only. How can I retain the shareable attribute? A: Mark the files Execute Only. Then create a dummy account called SCAN on the server and grant only Read and Filescan rights to that account. Log in as SCAN before scanning your Novell volumes. Q: How can I tell that ScreenScan is working? A: ScreenScan does not alert you when it is scanning your system. However, if you enable the logging option during your configuration, all ScreenScan activity will be recorded in a log file in the Installation directory. Q: Can I update McAfee's data files to detect new viruses? A: Yes. If your data files are dangerously out-of-date, VirusScan95 will prompted you to update them. If you have Internet access, you can download updated VirusScan data files from the McAfee Web Site, BBS, or other online resources. To download from the McAfee Web Site, follow these steps: 1. Go to the McAfee Web Site (http://www.mcafee.com or http://205.227.129.97). 2. Click on the Download McAfee button in the upper left hand column or frame. 3. Click Get that DAT! to update DAT files. 4. View the information provided on new DAT files and downloading. 5. Click on Download this Month's DAT. 6. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 7. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact McAfee Download Support at (408) 988-3832. ______________________ ADDITIONAL INFORMATION The new Administrative Mode feature allows System Administrators to lock VirusScan95 configurations on users' systems. To use this feature, take the following steps: 1. Start VirusScan95 by double-clicking on the VirusScan icon. 2. Press and hold the Ctrl+Shift+Alt keys and double-click the magnifying glass icon. 3. Open the File menu. 4. Select Administrator Mode. a. Enter a new password. b. Confirm your new password. 5. Choose your configurations from the What & Where, Actions, and Reports tabs. 6. To retain these settings as an individual custom configuration file, save the file to the desktop or Program Menu for execution. Context-sensitive scanning (right-clicking) will draw upon the original DEFAULT.VSC configuration file and scan the selected item with the pre-established default settings. 7. To establish your configuration as the default setting, save the new settings by overwriting C:\PROGRAM FILES\MCAFEE\VIRUSSCAN95\DEFAULT.VSC 8. After saving your configuration and leaving Administator Mode or closing VirusScan95, the optional settings will be locked and cannot be altered without knowledge of the access keys, hotspot, and established password. 9. To view and confirm your changes, restart VirusScan95 from the shortcut if you overwrote the DEFAULT.VSC file or from your saved configuration file (VSC). To alter your configuration settings or make additional changes, repeat this process. ______________ CONTACT McAFEE * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact McAfee's Customer Care department: 1. Call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following McAfee locations. McAfee Corporate Headquarters 2710 Walsh Avenue Santa Clara, CA 95051-0963 McAfee East Coast Office Jerral West Center 766 Shrewsbury Avenue Tinton Falls, NJ 07724-3298 McAfee Central Office 5944 Luther Lane, Suite 117 Dallas, TX 75225 McAfee Canada 178 Main Street Unionville, Ontario Canada L2R 2G9 McAfee Europe B.V. Orlyplein 81 - Busitel 1 1043 DS Amsterdam The Netherlands McAfee (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom McAfee France S.A. 50 rue de Londres 75008 Paris France McAfee Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@mcafee.com 3. Internet FTP: ftp.mcafee.com or 205.227.129.134 4. World Wide Web: http://www.mcafee.com or http://205.227.129.97 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE 7. The Microsoft Network: GO MCAFEE Before contacting McAfee, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Microsoft service pack, where applicable - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. * FOR ON-SITE TRAINING INFORMATION * Contact McAfee Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use McAfee's products, we have established an Agents program to provide service, sales, and support for our products worldwide. For a listing of agents, see the file AGENTS.TXT, where applicable, or contact McAfee Customer Service for agents near you.