home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
BUG 15
/
BUGCD1998_06.ISO
/
_util
/
_virscan
/
w95
/
data.z
/
WhatsNew.TXT
< prev
Wrap
Text File
|
1998-03-31
|
44KB
|
1,444 lines
What's New in McAfee VirusScan for Windows 9x v3.1.6 (3102)
Copyright (c) 1994-1998 by Network Associates, Inc.,
and its Affiliated Companies. All Rights Reserved.
Thank you for using McAfee VirusScan for Windows 9x. This
What's New file contains important information regarding the
current version of this product. Network Associates strongly
recommends that you read the entire document.
Network Associates welcomes your comments and suggestions.
Please use the information provided in this file to contact
us.
___________________
WHAT'S IN THIS FILE
- New Features
- Known Issues
- Installation
- Documentation
- Frequently Asked Questions
- Contacting Network Associates
____________
NEW FEATURES
1. The new AutoUpdate feature (corporate version only)
allows you to configure VirusScan so that it
effortlessly updates .DAT files and upgrades the entire
product to protect your system from the latest virus
threats. Updates and upgrades can be performed
automatically on a scheduled basis, or they can be
performed on demand. VirusScan supports obtaining
updates and upgrades via a FTP site or UNC pathname, and
includes support for proxy servers.
Note: A default ftp site has been provided for
AutoUpdate. It is recommended that an administrator pull
the .DAT package down to a local server for deployment.
To fully implement new .DAT files, your system must be
restarted.
2. VirusScan's on-access and on-demand scanners include full
support for floppy disk scanning on LS-120 drives.
3. In addition to existing alert methods, VirusScan and
VShield can now send Desktop Management Interface (DMI)
alerts to desktop or network management applications
that support the DMI standard.
4. VirusScan scans most major types of compressed files on
PC platforms. When an infection is detected in a file
of the compression type ZIP, LHA, or UUencode,
VirusScan is able to clean, delete, or move the file.
When an infection is detected in a file of the
compression type CAB or ZIP-SFX, which may be
Authenticoded, VirusScan does not support cleaning,
deleting, or moving the file. When VirusScan detects an
infection in a CAB or ZIP-SFX compressed file, Network
Associates recommends that you decompress the file to
clean it.
5. VirusScan features improved technology for detecting
polymorphic viruses. This new technology uses the file
POLYSCAN.DAT, which replaces the file MCALYZE.DAT.
6. VirusScan scans files embedded within MS Office files
(Word and Excel).
7. VirusScan has the ability to detect macro virus
infections in password-protected Word 7.0 (Word for
Office 95) files in all languages supported by Word.
8. If a password-protected Word 7.0 (Word for Office 95)
file is infected by a virus that can plant its own
password, VirusScan now cleans the file and removes the
password.
If a password-protected Word 7.0 (Word for Office 95)
file is infected by a virus that cannot plant its own
password, VirusScan now cleans the file without
disturbing the password.
* NEW VIRUSES DETECTED *
The 3102 .DAT files are compatible with VirusScan's v3.x
engines only. These .DAT files are not intended for use with
the VirusScan v2.x engine products.
The 3102 .DAT files detect the following 232 new viruses.
Locations that have experienced particular problems with
specific viruses are also identified.
500
AB6A.3500
ALAR.5088
ANDROMEDA.1140
ANTINUKE.TROJAN
ANXIETY.POPPY (Internet)
ANXIETY.POPPY.II (Internet)
ARARA.1375
AUSPAR
BANDUNG.BF
BLEE.A
BLEE.B
BLEE.D (Internet)
BLEE.E (Internet)
BOOT.666
BOX.D
BOX.F
BREEDER.A
BRR.BOO
BURMA.442.D
CAP.BZ
CAP.CA
CAP.CB
CAP.CC
CAP.CD
CAP.CE
CAP.CF
CAP.CG
CAP.CH
CAP.CI
CAP.CJ
CAP.CK
CAP.CL
CAP.CM
CAP.CN
CAP.CO
CAP.CP
CAP.CQ
CAP.CR
CAP.CS
CAP.CT
CAP.CU
CAP.CV
CAP.CW
CAP.CX
CIUDAD.590 (Europe)
CLEANUP.A (Europe)
COAHUILA
CONCEPT.CA
CONCEPT.CB
CONCEPT.CC
CONCEPT.CD
CONCEPT.CE
COOKIE.MONSTER.TROJAN
DEMON.B
DENZUKO.V1526
DIAMETRIC.3514
DRIVEL
EDDY.1386
EIGHT-CLOCK.A (US)
ERMUA.A
ERMUA.B
ERMUA.C
FAKE.A
FEINT_7F_(BS/MBR)
GOODNIGHT.M
GROG.1146
HABIR.A
HASSLE.B
HLLP.FECI.6000
HLLT.KRILE.4608 (Internet)
HLLT.KRILE.5831 (Internet)
HNL.A (US)
HOT.B
IBLIS.252
IBLIS.252 DROPPER
IVP.967
IWASHERE.710
JERUSALEM.1808.CT.B DROPPER
JOHNNY.S
JOHNNY.T
KELA.1171
KHIZHNJAK.1011
KHIZHNJAK.509
KHIZHNJAK.565
KILLDOS.A:TW
KLA.A
KOMCON.A (US)
KOMPU.J
KYOKUSHINKAI
LAPIDARIO.766
LARRY
LEONARD.1194
LIGHT.A
LIZARD.1967 (Portugal, US)
MBR-COM.1410
MDMA.AO
MDMA.AP
MDMA.AQ
MDMA.AR
MDMA.AS
MINIMAL.AA
MINIMAL.Y
MINIMAL.Z
MIRC/7TH_SPERE
MIRC/REPRO_V1
MUCK.AP
MUCK.AQ
MULTI
MWIM.BOO
NGKOEN
NICEDAY.P
NICEDAY.Q
NIKNAT.D
NIKNAT.E
NIKNAT.F
NIKNAT.G
NJVCK2.D
NJVCK2.E
NJVCK2.F
NJVCK2.G
NJVCK2.H
NJVCK2.I
NJVCK2.J
NJVCK2.K
NJVCK2.L
NJVCK2.M
NJVCK2.N
NO2.A (TWNO variant) (Taiwan)
NOP.R:BR
NOP.S:ES
NOP.T:IT
NOSTARDAMUS.3584
NPAD.FD
NPAD.FE
NPAD.FF
NPAD.FG
NPAD.FH
NPAD.FI
NPAD.FJ
NPAD.FK
NPAD.FL
NPAD.FM
NPAD.FN
NPAD.FO
NPAD.FP
NPAD.FQ
NPAD.FR
NPAD.FS
NPAD.FT
NPAD.FU
NPAD.FV
NPAD.FW
NPAD.FX
NPAD.FY
ORPHAN.174
PASTIK.2049
PAYCHECK.J
PAYCHECK.K
PINGPONG.M
PRESIDENT.MP.1504
RAZER.B
SARCOMA.1328
SCHUMANN.G (Europe)
SCHUMANN.H (Europe)
SCHUMANN.I
SCHUMANN.J (Europe)
SCHUMANN.L (Europe)
SEEYOU
SHOWOFF.CN
SHOWOFF.CO
SHOWOFF.CP
SHOWOFF.CQ
SHOWOFF.CR
SHOWOFF.CS
SILLYC.124
SILLYC.144
SILLYC.166
SILLYC.169
SILLYC.264
SILLYC.302
SILLYC.331
SILLYC.343
SILLYC.498
SILLYC.511
SILLYC.563
SILLYC.626
SILLYC.657
SPHINX.2520
SPHINX.2536
SPHINX.2548
SWISS_BOOT (Switzerland)
SWISS_BOOT_2 (Switzerland)
SWLABS.H
TAGUCHI.A (Brazil)
TALON.L
TEDY.4350
TEMPLE.L
TPVO.3463
TPVO.3626
TPVO.3654
TPVO-OPEN.1569
TRASH.B
TROUT.6787
TWNO.AB:TW
VAMPIRE.K:TW
VAMPIRE.L/M:TW
VHDL.B:TW
VIENNA.BETABOYS DROPPER
WAZZU.DM
WAZZU.DN
WAZZU.DP
WAZZU.DQ
WAZZU.DR
XF/PAIX.A (Requires 3.1.6 engine or later)
XM/LAROUX.AF
XM/LAROUX.AH
XM/LAROUX.AP
XM/LAROUX.BC
XM/LAROUX.BE
XM/LAROUX.BG
XM/LAROUX.BH
XM/LAROUX.BI
XM/LAROUX.BJ
XM/LAROUX.BK
XM/LAROUX.BL
XM/LAROUX.BM
XM/LAROUX.BN
XM/LMV.A (TROJAN)
XM/NINJA.D (Japan)
XM/NOCAL.A (Japan)
ZHENGZHOU.3584.B
* NEW VIRUSES CLEANED *
These .DAT files clean the following 167 new viruses:
ANDROMEDA.1140
BANDUNG.BF
BLEE.A
BLEE.B
BLEE.D (Internet)
BLEE.E (Internet)
BOX.F
BREEDER.A
CAP.BZ
CAP.CA
CAP.CB
CAP.CC
CAP.CD
CAP.CE
CAP.CF
CAP.CG
CAP.CH
CAP.CI
CAP.CJ
CAP.CK
CAP.CL
CAP.CM
CAP.CN
CAP.CO
CAP.CP
CAP.CQ
CAP.CR
CAP.CS
CAP.CT
CAP.CU
CAP.CV
CAP.CW
CAP.CX
CIUDAD.590 (Europe)
CLEANUP.A (Europe)
COAHUILA
CONCEPT.CA
CONCEPT.CB
CONCEPT.CC
CONCEPT.CD
CONCEPT.CE
DEMON.B
DIAMETRIC.3514
EIGHT-CLOCK.A (US)
ERMUA.A
ERMUA.B
ERMUA.C
FAKE.A
FEINT_7F_(BS/MBR)
GOODNIGHT.M
GROG.1146
HABIR.A
HASSLE.B
HNL.A (US)
HOT.B
IBLIS.252
IBLIS.252 DROPPER
IWASHERE.710
JERUSALEM.1808.CT.B DROPPER
JOHNNY.S
JOHNNY.T
KILLDOS.A:TW
KLA.A
KOMCON.A (US)
KOMPU.J
LARRY
LEONARD.1194
LIZARD.1967 (Portugal, US)
MDMA.AP
MDMA.AQ
MDMA.AR
MDMA.AS
MINIMAL.Y
MINIMAL.Z
MINIMAL.AA
MUCK.AP
MUCK.AQ
MWIM.BOO
NICEDAY.P
NICEDAY.Q
NIKNAT.E
NIKNAT.F
NIKNAT.G
NJVCK2.D
NJVCK2.E
NJVCK2.F
NJVCK2.G
NJVCK2.H
NJVCK2.I
NJVCK2.J
NJVCK2.K
NJVCK2.L
NJVCK2.M
NJVCK2.N
NO2.A (TWNO variant) (Taiwan)
NOP.R:BR
NOP.S:ES
NOP.T:IT
NPAD.FD
NPAD.FE
NPAD.FF
NPAD.FG
NPAD.FH
NPAD.FI
NPAD.FJ
NPAD.FK
NPAD.FL
NPAD.FM
NPAD.FN
NPAD.FO
NPAD.FP
NPAD.FQ
NPAD.FR
NPAD.FS
NPAD.FT
NPAD.FU
NPAD.FV
NPAD.FW
NPAD.FX
NPAD.FY
PAYCHECK.J
PAYCHECK.K
RAZER.B
SARCOMA.1328
SCHUMANN.G (Europe)
SCHUMANN.H (Europe)
SCHUMANN.J (Europe)
SCHUMANN.L (Europe)
SHOWOFF.CN
SHOWOFF.CO
SHOWOFF.CP
SHOWOFF.CQ
SHOWOFF.CR
SHOWOFF.CS
SWISS_BOOT (Switzerland)
SWISS_BOOT_2 (Switzerland)
SWLABS.H
TAGUCHI.A (Brazil)
TALON.L
TEDY.4350
TEMPLE.L
TRASH.B
TWNO.AB:TW
VAMPIRE.K:TW
VAMPIRE.L/M:TW
VHDL.B:TW
VIENNA.BETABOYS DROPPER
WAZZU.DM
WAZZU.DN
WAZZU.DP
WAZZU.DQ
WAZZU.DR
XM/LAROUX.AF
XM/LAROUX.AP
XM/LAROUX.BC
XM/LAROUX.BE
XM/LAROUX.BG
XM/LAROUX.BH
XM/LAROUX.BI
XM/LAROUX.BJ
XM/LAROUX.BK
XM/LAROUX.BL
XM/LAROUX.BM
XM/LAROUX.BN
XM/LMV.A (TROJAN)
XM/NINJA.D (Japan)
XM/NOCAL.A (Japan)
____________
KNOWN ISSUES
1. If you uninstall McAfee VirusScan, Windows changes your
default screen saver to None. To choose a screen saver
to use, right-click anywhere on your desktop, then
choose Properties from the shortcut menu that appears.
Next, click the Screen Saver tab in the Display
Properties dialog box, then choose a new screen saver
from the Screen Saver list. Click OK to use the screen
saver you chose.
2. Using MS-DOS memory managers might cause VirusScan to
falsely detect viruses in memory. Since Windows 95 no
longer requires MS-DOS memory managers, you can
eliminate false warnings by preceding each line in your
CONFIG.SYS file that includes settings for an MS-DOS
memory manager with REM. This deactivates the memory
manager. To learn more about working with your
CONFIG.SYS file, see your MS-DOS or Windows
documentation.
3. To create a VirusScan Emergency Disk, you must first
create a bootable floppy disk using the following
command at a DOS prompt:
c:\>FORMAT A: /S/U
4. If you protect VShield or any scan task with a password,
you will be prompted to enter your password whenever you
launch an associated program. Use your mouse to click in
the text field provided in order to enter the
password -- keyboard shortcuts will not work. Microsoft
acknowledges this issue in its Knowledge Base Article ID
#Q84133. To close the password verification dialog box,
click Cancel.
5. The Status properties page for VShield in the VirusScan
Console can only be updated by closing and reopening
VShield's Task Properties window.
6. ScreenScan will stop scanning after it detects a
virus and prompt you to launch VirusScan. If you have
additional viruses on your system, ScreenScan will not
notify you until the next time it activates. Network
Associates recommends that you scan and clean your
entire system with VirusScan whenever ScreenScan
detects a virus.
7. Disk defragmentation programs move files as they work to
maximize hard disk efficiency. If you have VShield,
VirusScan or other applications active during a disk
defragmentation operation, your disk defragmentation
program might tell you that it cannot find the active
application files. This is normal and does not mean that
the files do not exist. To avoid error messages like
this, close all open applications and disable VShield,
then run your disk defragmentation operation again.
8. If you unzip a virus-infected file in a directory on a
Novell server, VShield does not detect the infection as
the file is created. For maximum security, use VirusScan
to scan the Novell server after you have extracted the
files to the server.
9. If you press CTRL+ALT+DEL to shut down a Windows 95
system with VShield or any other VxD enabled, Windows
does not shut down. Instead, Windows disables VShield or
the active VxD. To shut down your computer, you must
press CTRL+ALT+DEL again.
10. When running two or more instances of Scan32.EXE, and
scanning two or more Microsoft cabinet (CAB) files
simultaneously, Scan32.EXE will terminate with a page
fault.
____________
INSTALLATION
* INSTALLING THE PRODUCT *
1. Do one of the following:
- If installing from diskette or compact disc, insert it
into your floppy disk drive or CD-ROM drive.
- If installing from files downloaded from a BBS or the
Network Associates website, decompress the zipped
files into a directory on the network or your local
drive.
2 Choose Run from the Start menu.
3. If installing from diskette, type x:\setup.exe where x
is the drive in which you placed the diskette. Click OK.
If installing from compact disc, type x:\win95\setup.exe
where x is the drive in which you placed the CD-ROM.
Click OK.
If installing from downloaded files, type
x:\path\setup.exe where x:\path is the location of the
files (for example, C:\DOWNLOAD\SETUP.EXE). Click OK.
4. Follow the on-screen installation instructions to
complete VirusScan installation.
NOTE: Network Associates recommends that you include a
step in your setup script that reboots the target
computer after installation.
* PERFORMING A SILENT INSTALLATION *
To perform a "silent" installation of this product, with
minimal user interaction and with all default or "Typical"
installation settings, add -s (i.e., SETUP.EXE -s) to the
setup command when you install the product.
Network administrators can customize the silent installation
feature by following these steps:
1. Check the Windows directory to ensure that a file named
SETUP.ISS does not already exist. If one does, rename
it, back it up, or delete it.
2. Run SETUP.EXE with the -r switch, (i.e., SETUP.EXE -r).
3. Select the components you want to install during the
silent installation. Your choices will be recorded.
Note: If a virus is detected during the recording of a
silent install, both the recording and the install will
abort.
4. Finish the installation.
Result: A SETUP.ISS file is created in the Windows
directory that has your installation options recorded.
Use this file to install all product files to the same
installation directory on every client machine.
The .ISS file specifies the installation directory under
the [SdSetupType-0] header, szDir parameter, which was
recorded in step 3. This overrides the default
installation directory on each client machine, which
might vary according to operating system. Having the
same directory name on every client helps to ease
administration in the future; for example, you might
assign all client machines the directory C:\ANTIVIRUS.
Note: If, however, you want to allow SETUP.EXE to
determine where to locate the installed files, modify
the SETUP.ISS file so that the target machine will
disregard the szDir, as follows:
A. Locate the section [SdSetupType-0] in the SETUP.ISS
file and go to the line: Result = xxx.
The actual value will most likely be 301, 302,
or 303, depending on what options you selected
during the ISS file creation process.
B. Add 100 to this number so that, for example, 301
becomes 401. This tells each target machine to
disregard the szDir and assign a directory according
to its own particular operating system.
5. Copy the installation files onto a local or mapped
drive; then rename, back up, or delete the SETUP.ISS
file.
Note: You cannot perform a silent install from multiple
media because the silent operation will be compromised
when the install prompts the user for more media.
6. Copy the new SETUP.ISS from the Windows directory to the
location of the installation files.
Note: The file used for the silent installation,
SETUP.ISS, is product-specific. For example, you cannot
use a SETUP.ISS file created by a VirusScan for Windows
95 installation for a VirusScan for Windows NT
installation.
7. Run SETUP.EXE with the -s switch (i.e., SETUP.EXE -s).
Note: If you do not specify a "recorded" answer for
all dialog boxes during the initial installation, the
silent installation will fail.
8. When the silent installation is complete, the computer
reboots automatically if you recorded actions that
do so. By default, the setup.iss script reboots the
computer automatically.
* PRIMARY PROGRAM FILES FOR VIRUSSCAN *
Note: Depending on the type of license you purchased, some
of these files may not be installed.
Files located in the Install directory:
=======================================
1. Installed for VShield/Scan32/DOS/ScreenScan:
README.1ST = License and registration
information
CLEAN.DAT = Virus clean definition data
POLYSCAN.DAT = Data file for advanced
polymorphic virus detection
NAMES.DAT = Virus names definition data
SCAN.DAT = Virus scan definition data
VS-MAIN.HLP = VirusScan help file
VSCHED.EXE = VirusScan console scheduler
file
DMIALERT.DLL = Library file
ADVGUI.DLL = Advanced interface library
file
MCGUI32.DLL = AV Console library file
S95EXT.DLL = Library file
CFGCOM32.DLL = Library file
INETWH16.DLL = Internet library help file
INETWH32.DLL = Internet library help file
AVCONSOL.EXE = VirusScan Console program
file
MCECOM.EXE = Automatic product update
program file
CHKVXD.EXE = VShield virtual device
CONFIG32.EXE = VirusScan configuration
program
SETBROWS.EXE = Set browser program
VIRLST32.EXE = McAfee Virus List
VALIDATE.EXE = McAfee file validation
program
VSECOMR.EXE = Electronic Commerce program
file
WCMDR.EXE = Windows Commander program
driver checking utility
AVCONSOL.HLP = AV Console help file
SCAN32.HLP = Scan32 help file
PHONELST.INI = Electronic commerce file
AVCONSOL.INI = AV Console initialization
file
WCMDR.INI = Windows Commander
configuration settings
WCMDRSIL.INI = unInstallShield helper
configuration
DELSL?.ISU = Uninstall file
PACKING.LST = Packing list
FAXFORM.TXT = Fax registration form
RESELLER.TXT = Network Associates
authorized resellers
WHATSNEW.TXT = What's New document
2. Installed for VShield/Scan32:
DPMI16.DLL = 16-bit DOS protected mode
interface library
DPMI32.DLL = 32-bit DOS protected mode
interface library
POLYSCAN.DLL = Library files for advanced
polymorphic virus detection
MCARCHIV.DLL = Compressed file scanning
library
MCKRNL32.DLL = Library files
MCSCAN32.DLL = Library files
MCUTIL32.DLL = Library files
VSECOM.DLL = Library files
3. Installed for VShield:
CONFIG32.EXE = VShield configuration
program
VSHWIN32.EXE = VShield engine
DEFAULT.VSH = Default VShield settings
4. Installed for Scan32:
SHUTIL.DLL = Run-time support library
SCAN32.EXE = VirusScan program
DEFAULT.VSC = Default Scan32 settings
ALLDRIVE.VSC = Scan32 settings file
SCAN_C.VSC = Scan32 settings file
5. Installed for Emergency Disk Creation Utility:
SCAN.EXE = MS-DOS scan program
SCANPM.EXE = Protected mode scanner
EDISK.EXE = Emergency Disk creation
utility
GETREPLY.EXE = Emergency diskette program
component
EDAT.1 = Emergency Disk batch file
EDAT.2 = Emergency Disk program
information file
EDAT.3 = Emergency Disk file
EDAT.4 = Emergency Disk file
EDAT.5 = Emergency Disk file
EDAT.6 = Emergency Disk file
ESCAN.BAT = Emergency Disk file
EDISK.SCR = Emergency Disk script
MCKRNL16.DLL = Emergency Disk library file
MCUTIL16.DLL = Emergency Disk library file
EMSCAN.DAT = Virus scan definition data
EMCLEAN.DAT = Virus clean definition data
EMNAMES.DAT = Virus names definition data
6. Installed for ScreenScan:
MCKRNL32.DLL = Library file
MCUTIL32.DLL = Library file
SCRSCANP.DLL = Library file
SCRSCANR.DLL = Library file
DUNZIP32.DLL = ScreenScan compression
library file
DZIP32.DLL = ScreenScan compression
library file
SCRSCAN.EXE = ScreenScan program file
SCRSCAN.HLP = ScreenScan help file
Files located in WINDOWS directory:
==========================================
SECCAST.ICO = Secure Cast icon
Files located in WINDOWS\SYSTEM directory:
==========================================
1. Installed for VShield/Scan32/DOS:
MCAFECOM.DLL = Network Associates Electronic
Commerce library file
2. Installed for VShield/Scan32:
MCKRNL.VXD = Detection virtual device
driver
MCSCAN32.VXD = Detection virtual device
driver
MCUTIL.VXD = Support virtual device
driver
3. Installed for VShield:
VSHIELD.VXD = Detection virtual device
driver
VSHINIT.VXD = VShield virtual device driver
Files located in the WINDOWS\HELP directory:
============================================
1. Installed for VShield:
VSHLDCFG.HLP = VShield help
2. Installed for Scan32:
SCANEXT.HLP = Scan32 Extension help
* TESTING YOUR INSTALLATION *
The Eicar Standard AntiVirus Test File is a combined
effort by anti-virus vendors throughout the world to
come up with one standard by which customers can verify
their anti-virus installations. To test your
installation, copy the following line into its own
file and name it EICAR.COM.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
When done, you will have a 69- or 70-byte file.
When VirusScan is applied to this file, SCAN will report
finding the EICAR-STANDARD-AV-TEST-FILE virus.
THIS IS NOT A VIRUS. However, users often have the need to
test that their installations function correctly. The
anti-virus industry, through the European Institute for
Computer Antivirus Research, has adopted this standard to
facilitate this need.
Please delete the file when installation testing is
completed so unsuspecting users are not unnecessarily
alarmed.
_________________________________
MANUALLY UNINSTALLING THE PRODUCT
Network Associates recommends using VirusScan's unInstall
program provided. You can access the unInstaller from the
Start menu in Programs/McAfee VirusScan. If, however, you
choose to manually uninstall VirusScan, follow the
instructions outlined below:
1. Remove VirusScan from the AUTOEXEC.BAT file:
1. Go to the System Configuration Editor window by
typing SYSEDIT in the Start/Run dialog box and press
Enter.
2. In the first file, the AUTOEXEC.BAT, delete the
VirusScan entry and the @IF ERRORLEVEL 1 PAUSE line
if present.
3. Save the changes and close the System Configuration
Editor window.
2. Remove VirusScan icons:
The VirusScan icons can be removed from the Taskbar
properties page in Start/Settings/Taskbar. Follow the
instructions below to remove VirusScan icons.
1. From the Taskbar properties page, click Remove.
2. Highlight the VirusScan folder.
3. Click the Remove button to remove the icons.
4. Click OK.
3. Edit the Registry:
1. To get to the Registry, type REGEDIT in the
Start/Run dialog box and press Enter.
2. In HKEY_CLASSES_ROOT, delete the key "VirusScan"
from the following:
comfile\\shell\\VirusScan
Directory\\shell\\VirusScan
Drive\\shell\\VirusScan
exefile\\shell\\VirusScan
Excel.Addin\\shell\\VirusScan
Excel.Chart.5\\shell\\VirusScan
Excel.Chart.8\\shell\\VirusScan
Excel.Macrosheet\\shell\\VirusScan
Excel.Sheet.5\\shell\\VirusScan
Excel.Sheet.8\\shell\\VirusScan
Excel.Template\\shell\\VirusScan
Excel.Workspace\\shell\\VirusScan
Excel.XLL\\shell\\VirusScan
WinZip\\shell\\VirusScan
Word.Document.6\\shell\\VirusScan
Word.Document.8\\shell\\VirusScan
Word.Template\\shell\\VirusScan
Delete the key "VSConfigFile"
Delete the key "VSHConfigFile"
3. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run, delete the names "Vshwin32.EXE",
"VSCHED.EXE", and "VSECOMR.EXE".
4. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\RunServices, delete the name
"Vshwin32EXE".
5. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall, delete the key
"McAfee VirusScan".
6. In HKEY_LOCAL_MACHINE\SOFTWARE\McAfee, delete the
keys "Scan95" and "ScreenScan."
7. In HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates,
delete the key "McAfee VirusScan".
8. Exit the Registry Editor by choosing the REGISTRY
option from the File Menu and selecting the EXIT
option.
4. Delete VirusScan files and directories.
1. Using CTRL+ALT+DEL, end the VSHWIN32.EXE task.
2. Close any other components that are open.
3. Delete the folder in which VirusScan is installed.
Typically, VirusScan is installed in
Program Files\Network Associates\McAfee VirusScan
4. From \Windows\system directory, remove the following
files:
MCKRNL.VXD
MCSCAN32.VXD
MCUTIL.VXD
VSHIELD.VXD
5. VirusScan is uninstalled. Reboot your system for the
changes to take effect.
_____________
DOCUMENTATION
For more information, refer to the VirusScan User's Guides,
included on the CD-ROM versions of this program or available
from the Network Associates BBS and FTP sites. These files
are in Adobe Acrobat Portable Document Format (.PDF) and can
be viewed using Adobe Acrobat Reader. This form of
electronic documentation includes hypertext links and easy
navigation to assist you in finding answers to questions
about your Network Associates products.
Adobe Acrobat Reader is available on CD-ROM in the ACROREAD
subdirectory. Adobe Acrobat Reader also can be downloaded
from the World Wide Web at:
http://www.adobe.com/acrobat/readstep.html
VirusScan and ScreenScan documentation can be downloaded
from the Network Associates BBS, or the World Wide Web at:
http://www.nai.com
For more information on viruses and virus prevention,
see the Network Associates Virus Information Library,
MCAFEE.HLP, included on the CD-ROM version of this product
or available from Network Associates BBS and FTP sites. A
ViaGraphix Interactive Anti-virus Training program also is
available on the CD-ROM version, or can be purchased
from the Network Associates website.
__________________________
FREQUENTLY ASKED QUESTIONS
Regularly updated lists of frequently asked questions
about Network Associates products also are available on the
Network Associates BBS and website, and CompuServe and AOL
forums.
Q: I am installing new software on my computer, and the
manual recommends disabling any anti-virus software.
How do I disable VirusScan without uninstalling it?
A: Right-click on the VShield icon located in your system
tray next to the system clock, then click Disable. After
installing the software, right-click on the VShield
icon, then click Enable.
Q: When VirusScan detects an infection in compressed files
of the CAB or ZIP-SFX type, why doesn't VirusScan clean,
delete, or move the file?
A: Because files of the compression types CAB and ZIP-SFX
may use Microsoft's Authenticode technology, they could
be rendered unusable if they are altered. To avoid this
possibility, VirusScan does not clean, delete, or move
infected files of the CAB or ZIP-SFX compression types.
When VirusScan detects an infection in a CAB or ZIP-SFX
compressed file, Network Associates recommends that you
decompress the file to clean it.
Q: When my screen saver starts, I suddenly see a lot
of activity on my hard disk. What's happening? How do
I stop this activity?
A: The ScreenScan component is designed to scan your hard
disk for viruses when your computer is idle. To do so it
starts your screen saver, if one is enabled, then begins
a scan operation. The hard disk activity you see is
ScreenScan examining your hard disk for viruses.
To deactivate ScreenScan, follow these steps:
1. Move your cursor to the Windows 95 desktop, then
click your right mouse button.
2. Choose Properties from the shortcut menu that
appears.
3. Click the ScreenScan tab in the Display Properties
dialog box.
4. Clear the Enable Scanning While in Screen Saver Mode
check box.
Q: VirusScan detected a virus on my system, but it is not
a document, spreadsheet, or executable file (.EXE, .COM,
.DO?, .XL?). Therefore, I suspect it might be a false
detection. What can I do to verify a detected virus?
A: If you suspect a false detection on a non-executable
file, run VirusScan's command line scanner, SCAN.EXE,
to verify an infection. If VirusScan detects a virus and
SCAN.EXE does not, please download the latest .DAT files
to update your virus definition files and scan your
system again. If VirusScan still detects a virus that
you suspect to be a false detection, please report the
issue to Network Associates technical support.
Q: I would like to electronically purchase and download
the latest version of VirusScan. I do not want to give
my credit card information over the Internet for
security purposes. Can I purchase VirusScan via modem
and download the product via the Internet?
A: Yes. The first time you download VirusScan, the Network
Associates electronic Wizard will prompt you to select
the transmission method you
prefer to download and to transmit your encrypted credit
card information.
At the Transaction Connection Type dialog box, select
Internet to download your order via the Internet.
At the Security Connection Type dialog box, select
Direct Dial Modem to transmit your credit card
information via modem.
Q: I have created my own Emergency diskette without using
the Emergency Disk creation utility. How must I optimize
my emergency disk's performance?
A: To enable your own Emergency Disk, you must create a
CONFIG.SYS file on the boot diskette and add the
following lines:
DEVICE=HIMEM.SYS
DOS=HIGH
Add the HIMEM.SYS file from the DOS directory or if you
are using Windows 95 system files, add HIMEM.SYS from
the \WINDOWS\COMMAND directory to the boot diskette.
Note: For detailed instructions on creating an Emergency
diskette, refer to the instructions outlined in the
electronic documentation (.PDF file) included in your
VirusScan package.
Q: I moved a .VSC file to my Startup folder. Whenever I
turn on my PC, it launches VirusScan, but it does not
begin scanning. How can I make it start scanning
automatically?
A: You need to customize your options. Take these
steps:
1. Navigate to the location of the saved .VSC file.
2. Right-click on the .VSC file to reveal the
Context Menu.
3. From the Context Menu, select Properties.
4. Select the Detection Tab on the property sheet.
5. Check the Start Automatically box.
6. Click OK.
Q: When VirusScan is launched, how does it determine the
default settings?
A: VirusScan default settings may be found in the
DEFAULT.VSC file located in the install directory.
Q: What are the possible error codes returned by
CHKVXD.EXE?
A: The possible CHKVXD.EXE error level codes and their
descriptions are listed below:
65535(-1)= VShield not installed
0 = VShield enabled
1 = VShield disabled
Q: How can I tell that ScreenScan is working?
A: ScreenScan does not alert you when it is scanning your
system. However, if you enable the logging option during
your configuration, all ScreenScan activity will be
recorded in a log file in the Installation directory.
Q: How can I scan multiple or network drives with
VirusScan?
A: You can configure scans of multiple or network drives
from the Detection property page. To see the page,
choose Advanced from the Tools menu in VirusScan. To
scan more than one drive or a network drive, follow
these steps:
1. Click the Detection tab.
2. Click Add.
3. Do one of the following:
- To add all network drives to the Detection list,
click Select Item to Scan, then select All
Network Drives.
- To add drives to the Detection list, click Select
Drive or Folder to Scan. Enter a drive letter or
click Browse to locate the drive you want
scanned.
4. Click OK.
5. Repeat this procedure to add more drives to the
Detection list.
6. Choose Save Settings from the File menu to save your
settings.
Q: Can I update Network Associates data files to detect new
viruses?
A: Yes. If your data files are out-of-date, VirusScan will
periodically prompt you to update them. If you have a
modem or Internet connection, you can use VirusScan's
new electronic update feature for easy data file
updates, technical support, and registration.
Note: VirusScan's electronic update feature applies to
retail copies and any copies bundled with your computer.
If you own a corporate version of VirusScan, AutoUpdate
and AutoUpgrade can be configured to pull updates via
the VirusScan Console.
If you need additional assistance with downloading,
contact Network Associates Download Support.
Q: How do I use the new AutoUpdate and AutoUpgrade features
in VirusScan v3.1.6?
A: You can use these features to automatically update to
the latest .DAT files and upgrade to the latest version
of VirusScan. To do so, configure VirusScan to use
AutoUpgrade and AutoUpdate on a scheduled basis:
1. Launch the VirusScan Console.
2. Double-click on the AutoUpdate task.
3. Click Configure.
4. Choose a method of transfer. While in this
configuration screen, you may also set up
AutoUpgrade options.
5. Click Update Now to test your configuration.
6. Click OK.
7. Click the Schedule tab.
8. Click Enable, then choose a schedule (.DAT files are
updated monthly).
9. Your task is now configured and will be run on the
schedule you chose.
You may also launch the AutoUpdate and AutoUpgrade tasks
using the on-demand method by clicking either Update Now
in the task configuration or by clicking the Green Play
arrow in the console toolbar.
Q: Why are there two sets of data files available for
download from www.nai.com?
A: One set, which has a filename beginning with 30, is
compatible with VirusScan versions 3.0.0 and later.
This is the file you will download to update your
installation of VirusScan. The second set, which has a
filename beginning with 97, is designed to support
older versions of VirusScan (before v3.0.0) and
should not be used with this version of VirusScan.
Q: An error occurs when VirusScan's Setup is 95 percent
completed. Why does this occur on my system, but not on
others?
A: Using a non-standard Windows 95 winsock will cause the
electronic commerce portion of Setup to fail on some
systems at the 95 percent completed point. To prevent
this, use the default Windows 95 winsock.
Q: I removed the Recycle Bin from the VirusScan exclusions
list. How can I replace it?
A: Because the Recycle Bin is a system folder, it cannot be
added to the exclusions list using VirusScan's browse
feature. To restore it to the list, enter the Recycle
Bin's full path in the exclusions list:
\Recycled\
Q: Why are additional extensions added to the Program Files
Only list?
A: As the Network Associates Anti-Virus Emergency Response
Team finds virus types that can infect new file types,
they are added to the default extensions list to enhance
security.
Q: I have Microsoft Office installed, but cannot use the
right-click context menu to initiate a scan. Why?
A: If Office is installed after VirusScan, it may be
necessary to reinstall VirusScan in order to add
right-click functionality for DO?, XL, and OBD files.
_____________________________
CONTACTING NETWORK ASSOCIATES
* FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS *
Contact the Network Associates Customer Care department:
1. Corporate-licensed customers, call (408) 988-3832
Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time
Retail-licensed customers, call (972) 278-6100
Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time
2. Fax (408) 970-9727
24-hour, Group III fax
3. Fax-back automated response system (408) 988-3034
24-hour fax
Send correspondence to any of the following Network
Associates locations:
Network Associates Corporate Headquarters
2805 Bowers Avenue
Santa Clara, CA 95051-0963
Network Associates Canada
139 Main Street, Suite 201
Unionville, Ontario
Canada L3R 2G6
Network Associates Europe B.V.
Gatwickstraat 25
1043 GL Amsterdam
The Netherlands
Network Associates International Ltd.
Minton Place, Victoria Street
Windsor, Berkshire
SL4 1EG
United Kingdom
Network Associates France S.A.
50 rue de Londres
75008 Paris
France
Network Associates Deutschland GmbH
Industriestrasse 1
D-82110 Germering
Germany
Network Associates Japan Co, Ltd.
Toranomon 33 Mori Bldg.
3-8-21 Toranomon
Minato-Ku, Tokyo 105
Japan
Network Associates Korea
135-090, 18th Fl., Kyoung Am Bldg.
157-27 Samsung-Dong, Kangnam-Ku
Seoul, Korea
Network Associates South East Asia
7 Temasek Boulevard
The Penthouse
#44-01, Suntec Tower One
Singapore 038987
Network Associates Australia
Level 1, 500 Pacific Highway
St. Leonards, NSW 2065
Australia
Network Associates Latin America
150 South Pine Island Road, Suite 205
Plantation, FL 33324
USA
Or, you can receive online assistance through any of the
following resources:
1. Bulletin Board System: (408) 988-4004
24-hour US Robotics HST DS
2. Internet e-mail: support@nai.com
3. Download Support at (408) 988-3832
4. Internet FTP: ftp.nai.com
5. World Wide Web: http://www.nai.com
6. America Online: keyword MCAFEE
7. CompuServe: GO MCAFEE
Before contacting Network Associates, please make note of
the following information. When sending correspondence,
please include the same details.
- Program name and version number
- Type and brand of your computer, hard drive, and any
peripherals
- Operating system type and version
- Network name, operating system, and version
- Contents of your AUTOEXEC.BAT, CONFIG.SYS, and
system LOGIN script
- Microsoft service pack, where applicable
- Network card installed, where applicable
- Modem manufacturer, model, and baud, where
applicable
- Relevant browsers/applications and version number,
where applicable
- Problem
- Specific scenario where problem occurs
- Conditions required to reproduce problem
- Statement of whether problem is reproducible on demand
- Your contact information: voice, fax, and e-mail
Other general feedback is also appreciated.
Documentation feedback is welcome. Send e-mail to
documentation@nai.com.
* FOR ON-SITE TRAINING INFORMATION *
Contact Network Associates Customer Service at
(800) 338-8754.
* FOR PRODUCT UPGRADES *
To make it easier for you to receive and use Network
Associates products, we have established a Resellers program
to provide service, sales, and support for our products
worldwide. For a listing of Network Associates resellers
near you, click Contact under the Information section on the
Network Associates website.