What's New in the Network Associates 3108 .DAT Files Copyright (c) 1992-1998 by Network Associates, Inc., and its Affiliated Companies. All Rights Reserved. Thank you for using Network Associates products. This What's New file contains important information regarding the current data (.DAT) files. Network Associates strongly recommends that you read the entire document. Network Associates welcomes your comments and suggestions. Please use the information provided in this file to contact us. ***** IMPORTANT NOTE ***** Limitations in DOS memory management capability and increases in the size of these .DAT files have made it necessary to revise the VShield on-access scanner included with VirusScan for DOS and OS/2, and ScanPM in order for VShield to continue providing you with comprehensive virus detection. Network Associates strongly recommends that you upgrade any VShield version you have installed on your computer to the latest VShield version. Beginning with the release of .DAT version 3106, you MUST upgrade to the latest version of VirusScan for DOS, VirusScan for OS/2, or ScanPM in order to continue to use the VShield memory-resident (TSR) scanner with any new .DAT releases. Note that older versions of the VShield TSR scanner will not work with .DAT version 3106 or later. The new .DAT files do not affect earlier versions of the VShield VxD. ************************** ___________________ WHAT'S IN THIS FILE - What are .DAT files? - New Features - Known Issues - Installation - Additional Information - Contacting Network Associates ____________________ WHAT ARE .DAT FILES? DAT files contain up-to-date virus signatures and other information that Network Associates anti-virus products use to protect your computer against the thousands of computer viruses in circulation. New .DAT files are released monthly to provide protection against the 100 to 300 new viruses that are discovered each month. To ensure that you are protected against the latest virus threats, download and install the latest .DAT files every month. ____________ NEW FEATURES * NEW VIRUSES DETECTED * The 3108 .DAT files are compatible with Network Associates anti-virus products that use v3.x or later scan engines only. Although you may use these files with any v3.x scan engine, Network Associates recommends that for optimal detection you use these .DAT files with v3.1.8 or later scan engines. These .DAT files are not compatible with McAfee v2.x scan engines. The 3108 .DAT files detect the 165 new viruses listed below. The names in parentheses to the right of the virus names identify the geographical areas with the most reported cases of the listed virus. _3141 _8772 AETA.5315 AI22.1659 ANIMO.518 ANTIHEURISTICA.672 ANXIETY.POPPY.III APPDER.S AREF.670 AREF.890 ASK.352 AZNAR.666 BANDUNG.BG BEL.2124 BOX.I:TW BUPT.BOO CACHACA.400 CAP.GW CAP.GX CARTMAN.C CHINA.882 CLASS.A CLASS.B COCA.509 COLORS.CC COMPANION.181 CONCEPT.CM COWABUNGA.2193 DROPPER COWABUNGA.2298 DROPPER CRASHER.439 CRASHER.659 CROW.A DARKMAN TROJAN DEICIDE.622 DIE.490 DIE.513 DIKSHEV.1334 DM.400.C DMV.M DRE.756 DUTCH.TINY.98 DUTCH.TINY.99.A EARLE.1431 EXEHEADER.337 EXEHEADER.352 EXEHEADER.360B FATAL ELLUSION.GR FREK.COMP GOLLUM.7167 GOLLUM.7167.DROPPER GOODNIGHT.N HDM.BOOT HIDE AND SEEK.709 HLL.5381 HLLT.4630 HLLT.4709.A HLLT.4709.B HLLT.4725 HLLT.4805 HLLT.4869 HLLT.4949.A HLLT.4949.B HLLT.5413 INCOM.648 IVP.351 JDAY.412 JEDI.A JEFF.812 JOHNNY.W JSB.498 JUNE16TH.879 KERNEL.616 KNIGHT-7 KOMPU.M KURE.5337 LAMEJOKE.A LANCELOT.342 LEO.1965 LEO.333 LIGHT.1060 MASHA.1338 MDMA.BC MDRG.544 MIRC/GERR_EXE MIRC/GERR_INI MIREA.925 MIREA.950 MIREA.958 MONO.1063 NIKNAT.M NILZ.1000 NOP.W:DE NOTTICE.E NPAD.IF NPAD.IG NPAD.IH NPAD.II NPAD.IJ NPAD.IK NPAD.IL NUCLEAR.AC NUCLEII.200 OMEGA.A:BR OPA.90 OPA.200 OPA.600 PARAGUAY.367 PARAGUAY.1650 PARAGUAY.1726 PARAGUAY.2618 PARAGUAY.2867 PINDONGA.3551 POLYPOSTER.A POSSESSED.2167 QRES.236 REVENGER.505 SATAN.599 SEMISOFT.59391 SERGEANT.229 SHOWOFF.DJ SHOWOFF.DK SPANSKA.1008 SPANSKA.1509 SPOOKY.323 SPOOKY.440 STRATO.1597 SUELA.1042 SWLABS.S TCV TOUT.275 TRIPLEK.471 T_POWER.4564 VANITAS.3712 VICKY.304 VICKY.567 VICKY.1015 VICKY.1109 VICKY.1186 W32.CIH.SPACEFILLER W95.MARBURG.A W95/HPS W97/CLASS.A (SYS) W97/CLASS.B (SYS) WAZZU.EX WAZZU.EY WAZZU.EZ WAZZU.FA WME.A WRZOD.1016 XF/PAIX.B XM/IMPORT.B XM/LAROUX.DL XM/LAROUX.DM XM/LAROUX.DO XM/LAROUX.DQ XM/LAROUX.DR XM/LAROUX.DS XM/LAROUX.DX XM/LAROUX.DY XM/LAROUX.DZ XM/LAROUX.EA XRES.432 YUSONG.1471 ZLODIC.666 ZMK.J:DR * NEW VIRUSES CLEANED * The 3108 .DAT files clean these 84 new viruses: _3141 _8772 ANTIHEURISTICA.672 ANXIETY.POPPY.III APPDER.S BANDUNG.BG BOX.I:TW BUPT.BOO CAP.GW CAP.GX CARTMAN.C COLORS.CC CONCEPT.CM COWABUNGA.2193 DROPPER COWABUNGA.2298 DROPPER CROW.A DEICIDE.622 DM.400.C DMV.M DUTCH.TINY.98 DUTCH.TINY.99.A FATAL ELLUSION.GR FREK.COMP GOLLUM.7167 GOLLUM.7167.DROPPER GOODNIGHT.N HDM.BOOT HIDE AND SEEK.709 INCOM.648 IVP.351 JEDI.A JEFF.812 JOHNNY.W JSB.498 JUNE16TH.879 KERNEL.616 KNIGHT-7 KOMPU.M LAMEJOKE.A MDMA.BC MDRG.544 MIREA.925 MIREA.950 MIREA.958 MONO.1063 NIKNAT.M NILZ.1000 NOP.W:DE NOTTICE.E NPAD.IF NPAD.IG NPAD.IH NPAD.II NPAD.IJ NPAD.IK NPAD.IL NUCLEAR.AC OMEGA.A:BR QRES.236 SATAN.599 SHOWOFF.DJ SHOWOFF.DK SWLABS.S W97/CLASS.A (SYS) W97/CLASS.B (SYS) WAZZU.EX WAZZU.EY WAZZU.EZ WAZZU.FA WME.A WRZOD.1016 XF/PAIX.B XM/IMPORT.B XM/LAROUX.DL XM/LAROUX.DM XM/LAROUX.DO XM/LAROUX.DQ XM/LAROUX.DR XM/LAROUX.DS XM/LAROUX.DX XM/LAROUX.DY XM/LAROUX.DZ XM/LAROUX.EA ZMK.J:DR The INTERNET.DAT component of the 3108 .DAT files enables McAfee WebScanX and WebShieldX Proxy to detect these 128 hostile Java classes: ALLTARGETS.CLASS ANIMATIONSOURCE.CLASS ANIMATIONSOURCEAPPLET.CLASS APPLETKILLER.CLASS APPSTATUS.CLASS ARCTEST.CLASS ASSASSIN.CLASS ATTACKER.CLASS ATTACKTH.CLASS AUDIOKILLER.CLASS BANKINSPECT.CLASS BARAPPLET.CLASS BEGINNER.CLASS BLINK.CLASS BLUESCREEN.CLASS BUMCHANGE.CLASS CALCULAT.CLASS CHANGEBANK.CLASS CHART.CLASS CHATOUREXPRESS.CLASS CLIENT.CLASS CONSUME.CLASS CRASHCOM405.CLASS DELETEFILE.CLASS DGCLOCK.CLASS DISKHOG.CLASS DOMYWORK.CLASS DOUBLETROUBLE.CLASS DUPE.CLASS DYNAPPLET.CLASS EI.CLASS ERRORMES.CLASS EXAMPLE0.CLASS EXECTEST.CLASS EXITTEST.CLASS FILEINFO.CLASS FIXJAVA.CLASS FORGER.CLASS FRACTION.CLASS FTPUSERSAPPLET.CLASS GEN.CLASS GENFRACTION.CLASS GETAPPLETCL.CLASS GRAPH.CLASS HIJACKER.CLASS HOSECOM404.CLASS HOSEMOCH.CLASS HOSTILETHREADS.CLASS HUGOBANE1.CLASS HUGOBANE3.CLASS HUGOBANE5.CLASS IMAGEBANK.CLASS INSPECTCLIENT3.CLASS INSPECTSERVERTHREAD.CLASS IRRITANT.CLASS JAVAMAIL.CLASS JFSAPPLET.CLASS JLPR.CLASS JMUSH.CLASS LETTERBOARD.CLASS LETTERBUTTON.CLASS LIFEGAME.CLASS LOADLIBRARY.CLASS LOGIN.CLASS LOGINSER.CLASS MANDELTEST.CLASS MOUSECHASE.CLASS MOUSECHASEEXCEPTION.CLASS MUTATOR.CLASS MYTIMER.CLASS NERVOUSI.CLASS NETSCOPE.CLASS NEWLOADER.CLASS NOISYBEAR.CLASS OWNNET.CLASS PENPAL.CLASS PORT25.CLASS PUBLICEN.CLASS READFILE.CLASS REPLACEPROPERTIESFILE.CLASS REPORT.CLASS REPORTSERVERSOCKET.CLASS RM.CLASS SCANALYZER.CLASS SCAPEGOAT.CLASS SEETHEWEB.CLASS SELLDRUGS.CLASS SENDMAILAPPLET.CLASS SENDTEST.CLASS SEXY.CLASS SHORTCUT.CLASS SHOWBASICREADS.CLASS SILENTTH.CLASS SIMPLETEXT.CLASS SLOWERKILLER.CLASS SOLARVENGEANCERT.CLASS STARFIELD3.CLASS STARSMEN.CLASS STEALSTUFF.CLASS TARGET.CLASS TELESCRIVENTE.CLASS TELNET.CLASS TELNETGUI.CLASS TELNETGUI2.CLASS THREADKILLER.CLASS TICKERTAPE.CLASS TICKET.CLASS TICKETHOLDER.CLASS TICKETREADER.CLASS TOURGUIDE.CLASS TRALLALA.CLASS TRIPLEFRAME.CLASS TRIPLETHREAT.CLASS TRIPLETHREAT2.CLASS TUMBLEITEM.CLASS TUMBLINTEXT.CLASS TURNTRICKS.CLASS UNGRATEFUL.CLASS UNPLUGGED.CLASS VALUEBOX.CLASS WASTEFUL.CLASS WEBMAILER.CLASS WIDGET.CLASS WORDMANAGER.CLASS WORDMEISTER.CLASS WRITEFILE.CLASS XYZAPP.CLASS ZEALAND.CLASS The INTERNET.DAT component of the 3108 .DAT files enables McAfee WebScanX and WebShieldX Proxy to detect these six hostile ActiveX controls: EXPLODER.OCX NETLIST.CAB NETLIST.OCX RUNNER.OCX SLINGSHOT.CAB SLINGSHOT1.CAB ____________ KNOWN ISSUES 1. If you use v3.1.0 or v3.1.1 of VirusScan for Windows 95 or for Windows 3.1x, loading the virus list will cause an invalid page fault. To avoid this problem, upgrade your copy of VirusScan to the latest version. 2. If you have already used VirusScan v3.x for Windows 3.1x to detect a virus or clean an infected file, you might not be able to load the Virus List into memory. Viewing the Virus List more than once might also cause your system to run out of memory. ____________ INSTALLATION * INSTALLING THE PRODUCT * DAT file updates are stored in a compressed format to reduce transmission time. To install your update, create a temporary directory and copy the downloaded file to the directory. Unzip the files, then copy them to the appropriate permanent directories, replacing your existing files. * PRIMARY PROGRAM FILES FOR VIRUS DEFINITIONS * Files located in the Install directory: ======================================= CLEAN.DAT = Data file for virus cleaning POLYSCAN.DAT = Data file for advanced polymorphic virus detection NAMES.DAT = Data file for virus names SCAN.DAT = Data file for virus scanning INTERNET.DAT = Data file to detect hostile Java/ActiveX objects * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to implement one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file, then save the file with the name EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* The file size will be 69 or 70 bytes. Next, start VirusScan and allow it to scan the directory that contains EICAR.COM. When VirusScan scans this file, it will report finding the EICAR-STANDARD-AV-TEST-FILE virus. Note that this file is NOT A VIRUS. Delete the file when you have finished testing your installation to avoid alarming unsuspecting users. ______________________ ADDITIONAL INFORMATION Macro viruses are named using this standard: The first of a family is given "name.A". For each subsequently discovered variant, the suffix letters progress until .Z is reached. The next is given .AA until .AZ is reached. The next is given .BA, etc. until .ZZ is reached. The next would then be given .AAA and so on. A macro virus name without a variant notation refers to all variants of that virus. _____________________________ CONTACTING NETWORK ASSOCIATES On December 1, 1997, McAfee Associates merged with Network General Corporation, Pretty Good Privacy, Inc., and Helix Software, Inc. to form Network Associates, Inc. You may direct all questions, comments and technical support requests to the Network Associates Customer Care department at any of the addresses or phone numbers listed below. Contact the Network Associates Customer Care department at: 1. Phone (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III Fax 3. Fax-back automated response system (408) 988-3034 Send correspondence to any of the following Network Associates locations: Network Associates Corporate Headquarters 3965 Freedom Circle McCandless Towers Santa Clara, CA 95054 Phone numbers for corporate-licensed customers: Phone: (408) 988-3832 Fax: (408) 970-9727 Phone numbers for retail-licensed customers: Phone: (972) 278-6100 Fax: (408) 970-9727 Network Associates offices outside the United States: Network Associates Canada 139 Main Street, Suite 201 Unionville, Ontario Canada L3R 2G6 Phone: (905) 479-4189 Fax: (905) 479-4540 Network Associates Europe B.V. Gatwickstraat 25 1043 GL Amsterdam The Netherlands Phone: 31 20 586 6100 Fax: 31 20 586 6101 Network Associates (UK) Ltd. Hayley House, London Road Bracknell, Berkshire RG12 2TH United Kingdom Phone: 44 1344 304 730 Fax: 44 1344 306 902 Network Associates France S.A. 50 rue de Londres 75008 Paris France Phone: 33 1 44 908 737 Fax: 33 1 45 227 554 Network Associates Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Phone: 49 8989 43 5600 Fax: 49 8989 43 5699 Network Associates Japan Co., Ltd. Toranomon 33 Mori Bldg. 3-8-21 Toranomon Minato-ku, Tokyo 105 Japan Phone: 81 3 5408 0700 Fax: 81 3 5408 0780 Network Associates Korea 135-090, 18th Floor, Kyoung-Am Bldg. 157-27 Samsung-Dong, Kangnam-Ku Seoul, Korea Phone: 82 2 555-6818 Fax: 82 2 555-5779 Network Associates South East Asia 7 Temasek Boulevard The Penthouse #44-01, Suntec Tower One Singapore 038987 Phone: 65 430-6670 Fax: 65 430-6671 Network Associates Australia Level 1, 500 Pacific Highway St. Leonards, NSW 2065 Phone: 61-2-9437-5866 Fax: 61-2-9439-5166 Network Associates Latin America 150 South Pine Island Road, Suite 205 Plantation, Florida 33324 Phone: (954) 452-1731 Fax: (954) 236-8031 Or, you can receive online assistance through any of the following resources: 1. Internet E-mail: support@nai.com 2. Internet FTP: ftp.nai.com 3. World Wide Web: http://www.nai.com 4. America Online: keyword MCAFEE 5. CompuServe: GO NAI To provide the answers you need quickly and efficiently, the Network Associates technical support staff needs some information about your computer and your software. Please have this information ready when you call: - Program name and version number - Computer brand and model - Any additional hardware or peripherals connected to your computer - Operating system type and version numbers - Network name, operating system, and version - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers or applications and their version numbers, where applicable - How to reproduce your problem: when it occurs, whether you can reproduce it regularly, and under what conditions - Information needed to contact you by voice, fax, or e-mail We also seek and appreciate general feedback. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use Network Associates products, we have established a reseller's program to provide service, sales, and support for our products worldwide. For a listing of resellers, see the resellers.txt file or contact Network Associates Customer Care for resellers near you. * FOR REPORTING PROBLEMS * Network Associates prides itself on delivering a high-quality product. If you find any problems, please take a moment to review the contents of this file. If the problem you've encountered is documented, there is no need to report the problem to Network Associates. If you find any feature that does not appear to function properly on your system, or that you believe would benefit greatly from enhancement, please contact Network Associates with your suggestion or concern. * FOR ON-SITE TRAINING INFORMATION * Contact Network Associates Customer Service at (800) 338-8754. * NETWORK ASSOCIATES BETA SITE * Get pre-release software, including DAT files, through http://beta.nai.com. You will have access to Public Beta and External Test Areas. Your feedback will make a difference.