home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
DP Tool Club 31
/
CDASC_31_1996_juillet_aout.iso
/
win
/
95
/
vs95i204
/
whatsnew.txt
< prev
Wrap
Text File
|
1996-06-13
|
25KB
|
780 lines
What's New in VirusScan 2.04 for Windows 95 (9606)
Copyright 1994-1996 by McAfee, Inc.
All Rights Reserved.
___________________
What's In This File
- Eicar Installation Test.
- New VirusScan95 features.
- Known issues.
- New Viruses Detected and Removed.
- Installing VirusScan95.
- If a Virus is Detected in Memory.
- Scanning with VirusScan95.
- Customizing VirusScan95.
- Documentation.
- Frequently Asked Questions.
- Reporting Problems.
- How to contact us.
- Registering VirusScan95.
- McAfee Training.
- Upgrading McAfee Products.
______________________________
Eicar Standard AntiVirus Test.
A few words about the Eicar Standard AntiVirus Test File:
The Eicar Standard AntiVirus Test File is a combined effort by
antivirus vendors throughout the world to come up with one
standard by which customers can verify their antivirus installations.
To test your installation, you would copy the following line into its
own file and name it EICAR.COM.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
When done, you will have a 69 or 70 byte file.
When VirusScan is applied to this file, SCAN will report finding the
EICAR-STANDARD-AV-TEST-FILE virus.
It is very important to know that THIS IS NOT A VIRUS! However,
users often have the need to test that their installations function
correctly. The antivirus industry, through the European Institute
for Computer Antivirus Research, has adopted this standard to
facilitate this need.
Please delete the file when installation testing is completed so
unsuspecting users are not unnecessarily alarmed.
Notes:
The next DAT update is scheduled for July with another in Sep.
Intermediate "emergency" updates will be available only through the
BBS.
____________________________
New Features for VirusScan95
* Added support for ZIP file scanning from the On-Demand scanner.
* Added MS-DOS scanning component prior to loading Windows 95.
* VirusScan95 now CLEANS MS Word macro infections.
* Added the ability to scan the boot sector on local hard drives
(enabled by default).
* Added support for multiple scan targets (see FAQs under Section II
below).
* Added support for the "Scan in:" field to scan Local Drives as well
as Network Drives.
* Added support for scanning Word documents when launching from Word
or Mail.
* Added an AutoExit switch in VirusScan Configuration (VSC) files
(see item 4 below).
* Enabled the ability for launching VirusScan95 in a minimized or
maximized window by using shortcuts.
* Installation directory defaults to
"C:\Program Files\McAfee\VirusScan95".
* To save disk space, the installation searches for previously
installed versions of McAfee VirusScan95.
__________________________
New Features for VShield95
McAfee has re-vitalized the classic VShield product for an entirely
new generation of Windows products. McAfee's chief architect stated
when asked, "We overhauled the entire product by dropping in a 32-bit
engine, and a series of VXD modules then, gave the interface a
completely new look & feel. Customers who are familiar with the older
product will be completely amazed at the improvements and features we
have added. New users will really enjoy how VShield has been
seamlessly blended into the workings of Windows95."
Unlike its predecessor, VShield no longer relies on a DOS TSR;
everything is done directly in the Windows95 environment.
"We assembled customers' feedback and attempted to develop a product
which, we believe the customer really wants. In the marketplace, I
believe McAfee will be the first to develop an on-access product which
is completely independent of MS-DOS."
Here's what we did:
* On Access scanning of floppy diskettes.
* UNC aware.
* Long file and directory name support.
* Netware and MS-Network awareness.
* Log file support with real-time logging.
* Exclusions table.
* Detection rate equivalent to existing products.
____________
Known Issues
Symptom: VirusScan95 appears to continue scanning endlessly
even after pressing the 'Stop' button.
Cause: If VirusScan95 finds a corrupted zip file, an
information box appears behind the main window.
This leaves it appearing as if the scan is continuing,
when it is really waiting for user
input.
Resolution: If you encounter this situation, simply move the
VirusScan95 window in any direction to reveal the
"DynaZip UnZip Error" window behind it. Then click OK,
responding as requested by the dialog box.
Compressed Files:
Files with the "-" (dash) character in the filename which are
compressed in Zipped files will not be scanned by the On Demand
Scanner.
Macro Viruses:
When a macro virus is detected in conjunction with other viruses, the
macro virus remover will not work. We are still working on this. If
you encounter this, you can remove the other virus first or work in
a separate area.
Memory Managers:
Windows 95 no longer requires MS-DOS memory managers. Using MS-DOS
memory managers, may cause VirusScan95 to falsely detect viruses in
memory. To eliminate the possibility of false warnings, remark (Rem)
the memory manager lines from your CONFIG.SYS to deactivate them.
____________________
New Viruses Detected
This DAT file (9606) detects the new viruses listed below.
In addition, locations that have experienced problems with
a particular virus are identified (172).
_1660
_2869 (Europe)
1STVIR.3032/3173
ABBAS.5660
ALLFOOLS
ANGEL_2.661
ANGEL_2.1671
ANTITRACE.1864
AS.594
ASMODEOUS.1450
AVALGASIL.666
AWAITS.500
BABY.962
BABY_L.674
BADCOM.600
BADSIZE.369
BAGNARA.694
BBO.1000.D
BERT.2294
BIRTHDAY.512
BLACK_ADDER.1015
BLACK_SUNDAY.2372
BOLERO.1000.A
BOLERO.1000.B
BOLERO.1300
BOWL.737.B
BRBI.KOBRIN.492
BUFFALO.486
BUNNY.497
CARRYON.534
CGA.1024
CHAPA.447
CHAPA.448
CHAPA.450.C
CHAPA.450.D
CHAPA.566
CHAPA.572
CHAPA.586
CHEK.282
CIVIL_WAR.533
CIVIL_WAR.837
CMOS DEATH (US)
CNTV.2630
CONV.321.B
CPW.1395
CRLC.484
CROVIR.625
DAN.1500
DEBIT.2000
DESTRUCTOR.2082
DOPERLAND.490
DRONE.1024
DUNE.483
DUNE.579
EBOL.313
EBOL.378
ELIZA.1282
EXEHEADER.RENEGADE.416
FASOLA.2215
FIFO.333
FORMAS.1146
GAD_FLY.629
GAD_FLY.646
HALLO.524
HELLOWEEN.1377
HI.512
SIRIUS.HOMUNCULUS.3000
IMI.1536.G
IMI.1536.H
IMPOSTER
INCH.386
INSIDE.752
INT4B.231
INT4B.242
JERUSALEM.CURSE.1653.A
JERUSALEM.CURSE.1653.B
JERUSALEM.CURSE.1653.C
JERUSALEM.KEEPER.1570
JUNE_24TH
JUNKIE.1308
KATE.582
KPOBOCOC.335
L2.2000.B
LOUSE.919
LOVEBUZZ.381
LOVEBUZZ.591
MAJOR.1644 (Europe)
MANTRA.719
MEF.1481
MEF.1538
MEMORY_LAPSE.LUPUS.886
MEP.295
MEPH.615
MEPH.914
MEPH.928
MEPHISTO.1235
MEPH.1242
NADO.838
NADO.841
NOT_JERUSALEM.1008
NOV_17.1045
NUKER.SYNDROME.1485
OFT.1500
OPPRESSOR-B
PATR.1536
PIXEL.ILL.573
POLITE (*)
PROBLEM.857
PUPPETS.960
RATSOFT.753
RATSOFT.821
RATSOFT.828
RAVING_II.1195
SENORITA.885
SILLYC.90
SILLYC.101.B
SILLYC.155.B
SILLYC.165
SILLYC.200.B
SILLYC.202
SILLYC.226
SILLYC.316
SILLYC.373
SILLYE.398
SILLYE.512
SILLYORCE.76.B
SILLYRC.214
SILLYRC.224
SILLYRC.248
SILLYRC.303
SILLYRC.670
SMALL_COMP.116
SOFIATERMINATOR.1487
SUPERVISOR.2221
TANPRO.524 (Europe)
TENTACLES (Worldwide)
TIE.619
TIJUANA (Mexico/US)
TIP.554
TRIVIAL.32.F
TRIVIAL.32.G
TRUST.687
TULA.1540
TULA.1656
TURBOEXE.854
UNHANDLED.495
V.334
V.719
V.864
V.1906
VERONIKA.1549.B
VIAGGIO.1051
VIENNA.534.F
VIENNA.BBOD.896
VIK.480
VIK.550
VIRUS.655
VOTADC.591
WAZZU (*) (US)
WILDY.354.B
WILDY.354.C
WILLY_WONKA.1088
WORDMACRO.NOP (Germany)
WZ-436.A
WZ-436.B
XPH-DR&E.EXE
XPH.2010
XUTE.1182
XUXA.1045
XWG.1333
ZUB.792
ZVER.512
(*) Requires 2.5 executable
___________________
New Viruses Removed
This DAT file (9606) removes the viruses listed below.
In addition, locations that have experienced problems
with a particular virus are identified (10).
CMOS DEATH
CONCEPT.B:FR
IMPOSTER
MAJOR.1644
POLITE
TENTACLE
TIJUANA
WAZZU
WORDMACRO.NOP
XENIXOS
______________________
Installing VirusScan95
VirusScan is a single file install. This means all program files are
located directly within the installation executable. The installation
adds the following files to your system:
NOTE: Due to the nature of the VShield component and how it is
integrated into the Windows95 Operating System, it is important to
confirm that VShield for MS-DOS or any other virus protection software
is not currently loaded from MS-DOS or Windows95. If you are aware of
any other Virus Detection program loading from within Windows95, please
disable them accordingly before proceeding with VirusScan installation.
VirusScan Files & Location (primary program files are listed)
File Name Location Installed For* Description
------------ -------------- ----------- ---------------------
SCAN.DAT Install dir scn/vsh/DOS Virus Definition Data
NAMES.DAT Install dir scn/vsh/DOS Virus Definition Data
CLEAN.DAT Install dir scn/vsh/DOS Virus Definition Data
VALIDATE.EXE Install dir scn/vsh/DOS Verify authenticity of
VirusScan files
CHKVSH32.EXE Install dir scn/vsh/DOS VShield VxD Checking
Utility
UINSTALL.EXE Install dir scn/vsh/DOS Uninstall program
VSUINST.EXE Install dir scn/vsh/DOS Uninstall assistant
DPMI16.DLL Install dir scn/vsh Boot sector Scan Engine
DPMI32.DLL Install dir scn/vsh Boot sector Scan Engine
MCKRNL95.DLL Install dir scn/vsh McAfee tools library
MCUTIL95.DLL Install dir scn/vsh Run time support DLL
DEFAULT.VSC Install dir scn Default settings when
Scan is launched
DZIP32.DLL Install dir scn De-Archive Run Time
Library
DUNZIP32.DLL Install dir scn De-Archive Run Time
Library
MCSCAN32.DLL Install dir scn Main Scan Engine
SCAN32.EXE Install dir scn Main Scan GUI
SHUTIL95.DLL Install dir scn Run time support DLL
DEFAULT.VSH Install dir vsh Default VShield settings
VSHCFG32.EXE Install dir vsh Main VShield GUI
VSHWIN32.EXE Install dir vsh Main VShield Engine
SCAN.EXE Install dir DOS MS-DOS scanning engine
MCKRNL.VXD WINDOWS\SYSTEM scn/vsh McAfee tools device
driver (memory scanning
engine)
MCSCAN32.VXD WINDOWS\SYSTEM scn/vsh Scan Engine device
driver
MCUTIL.VXD WINDOWS\SYSTEM scn/vsh McAfee utility device
driver
S95EXT.DLL WINDOWS\SYSTEM scn Shell Extension (Adds
two "TABs" to .VSC file
properties UI)
VSHIELD.VXD WINDOWS\SYSTEM vsh VShield device driver
SCANEXT.HLP WINDOWS\HELP scn Help file for Shell
Extension
VIRUSCAN.HLP WINDOWS\HELP scn On-Line help file
VIRUSCAN.CNT WINDOWS\HELP scn Context help file
VSHLDCFG.HLP WINDOWS\HELP vsh Help file
Note: WINDOWS refers to the directory that Windows 95 is installed to,
not the Windows 3.1x directory that may exist on systems containing a
previous version of Windows.
* Legend:
vsh = VShield scn = Scan32
DOS = Command Line MS-Word = Microsoft Word, if present
When the installation is complete, the user is prompted to restart
their system. This is recommended.
Note: DOSSTART.BAT will load if you still have your previous version
of Windows or MS-DOS installed. Do not be alarmed. If this occurs,
reboot manually.
________________________
Uninstalling VirusScan95
We have included two methods for Uninstalling VirusScan95:
METHOD 1
* From the McAfee VirusScan95 program group, execute the McAfee VShield
Uninstall program.
METHOD 2
* Launch the Add/Remove Programs applet from the Control Panel.
* Select the Install/Uninstall Tab.
* Double-click on 'McAfee VirusScan95 Version 2.x'.
* Reboot your System.
All files, groups, and registry entries related to McAfee VirusScan95
will be automatically removed from your system. Log files such as
Vslog.txt are not removed however, and as a result, any directories
related to VirusScan95 that contain these files will not be removed
during uninstall.
________________________________
If a virus is detected in memory
If you have eliminated the possibility of memory manager conflicts and
suspect a virus in memory, 'clean boot' to MS-DOS then use McAfee
VirusScan for MS-DOS to perform a detection and cleaning procedure.
To perform the detection and cleaning procedure, boot from a known,
clean, bootable floppy diskette; an original set of MS-DOS setup disks
is ideal. Then put the diskette containing the McAfee VirusScan for
MS-DOS into the floppy drive, and enter the following command at the
prompt:
SCAN /ADL /ALL /CLEAN
If you do not have a copy of the McAfee VirusScan product for MS-DOS,
you can contact McAfee Customer Service at (408) 988-3832 to order a
fully licensed version of the product.
_________________________
Scanning with VirusScan95
VirusScan95 is directly incorporated into the Windows 95 interface by
means of Context Menus. To access VirusScan from a Context Menu,
launch Explorer and right mouse click on any Folder, Drive, EXE, or
COM icon. This will generate a Context Menu with the Scan for Viruses
selection.
To Scan multiple items, select multiple Folders or Drives through
Explorer and right mouse click to reveal the Context Menu. Choose Scan
for Viruses.
Try it out right now!
Double-Clicking on any of your hard drive ICONs to launch Explorer.
Then right mouse click on any Folder to reveal the Context Menu. Look
for Scan for Viruses on that menu.
_______________________
Scanning with VShield95
VShield provides ON-ACCESS scanning. This means that, once enabled,
VShield will provide real-time protection against the contracting and
spreading of viruses.
VShield scan options are extremely customizable. Through the VShield
Configuration Manager, users can customize just about every component
of VShield including what to scan and when to scan.
To access the VShield Configuration Manager, double-click on the
VShield icon in the taskbar or double-click on the VShield icon in the
McAfee VirusScan95 program group.
_______________________
Customizing VirusScan95
VirusScan95 has a default set of options that are stored in
DEFAULT.VSC. This file is located in the MCAFEE subfolder in the
PROGRAM FILES folder. This is a standard text file with line items
associated with each option in the VirusScan95 User Interface.
The majority of options are configurable through the user interface.
The following options are not:
szDefaultProgramExtensions The default list of file extensions
used by the Default" button in the
Program File Extension dialog.
bAutoStart Set to "1" for Scan to automatically
start scanning.
bAutoExit Set to "1" for Scan to automatically
exit when scanning is complete.
bSkipMemoryScan Set to "1" to skip a scan of memory.
bSkipBootScan Set to "1" to skip boot sector
scanning.
bSkipSplash Set to "1" to suppress initial splash
screen.
bPreserveAccessDate Set to "1" to preserve file access
date.
_____________________
Customizing VShield95
VShield has a default set of options that are stored in DEFAULT.VSH.
This file is stored in "C:\Program Files\McAfee ". This is a standard
text file with line items associated with each option in the VShield
Configuration Manager.
All items in the DEFAULT.VSH file are directly referenced by the
VShield User Interface. When you apply changes through the user
interface, the DEFAULT.VSH file will be updated immediately.
_____________
Documentation
All documentation is available on-line. To access documentation,
launch VirusScan95 and select Help from the Menu bar for a list of
available help options.
________________________________________
VirusScan95 - Frequently Asked Questions
Question: How do I scan multiple drives?
Answer#1: VirusScan95 is a true 32 bit application that can run
in multiple instances at the same time. This means you
can Scan many locations simultaneously.
To do so:
* Launch Explorer.
* Highlight the drives or folders you want scanned.
* Right mouse click to reveal the Context Menu.
* Select Scan for Viruses.
* Press the Scan Now button to begin Scans.
Answer#2: Use the word "LocalDrives" or "NetworkDrives" in the
Scan In text dialog on the Where&What property page.
Press the Scan Now button and all network or all local
drives will be scanned.
Question: How do I save my Scan settings ?
Answer: VirusScan Configuration (VSC) files can be saved by
selecting File | Save Settings. The default save
location will be your Desktop.
Question: I moved a VSC file to my Startup Folder. Whenever I
turn-on my PC it launches VirusScan95 but, does not
begin scanning. How can I make it start automatically?
Answer: There are options within the VSC file which can be
customized. Many of these options are easily
accessible by doing the following:
* Navigate to the location of the Saved VSC file.
* While pointing to the VSC file, right mouse click to
reveal the Context Menu.
* From the Context Menu, select Properties.
* Notice the added property sheets.
* Select the Options Tab on the property sheet.
* Check the Start Automatically box.
By enabling this option, Scanning will now begin
automatically. If viruses are not detected,
VirusScan95 will automatically close thus, freeing up
system resources. Other VSC configuration options are
also accessible from the properties dialog.
Question: Virus Definition files get old and need to be updated.
Answer: For information on how to update your definition files,
contact McAfee at 408-988-3832.
Question: The System Agent is a utility included in Microsoft's
Plus Pack. How do I schedule VirusScan95 through the
System Agent and have scans launch automatically?
Answer: VirusScan95 saves VirusScan Configuration (VSC) files
for automating repetitive scan jobs. In order to have
System Agent automate scanning of your system, you must
create a VSC file which meet your needs.
Follow these steps to create and customize a VSC file:
1.) Use the VirusScan95 interface to configure a Scan
then, Save the Scan settings through the File|Save menu
option. This will create a VSC file.
2.) Use Explorer to navigate to the VSC file, right
mouse click on the file, and select properties from the
Context Menu. Refer to the extra property sheets that
are available for the VSC file. Make sure 'Start
Automatically' under the 'Options' tab is checked.
This will allow VirusScan95 to start scanning
automatically.
Once you've created a VSC file which meets your needs,
use the System Agent to schedule this VSC file.
Question: When VirusScan95 is launched, how does it determine the
default settings?
Answer: VirusScan95 default settings may be found in the
DEFAULT.VSC file, located in the install directory.
This file contains default startup options. The
DEFAULT.VSC file is like any other VSC file, except
that it is named DEFAULT.VSC and located in the install
directory.
To customize your default settings:
1.) Use Explorer to navigate to the DEFAULT.VSC file,
right mouse click on the file, and select properties
from the Context Menu. Refer to the extra property
sheets that are available for the VSC file.
2.) Make modifications as you see fit.
If the DEFAULT.VSC file is missing, VirusScan95 will
use default settings internal to the program.
Question: Why doesn't VShield find any infections with Action set
to "Deny access to infected file and continue" ?
Answer: Actually, the viruses are being found but, if Action is
set to 'Deny access and continue', no messages will be
sent to the user if an infection is found. Instead,
VShield will deny the user access to the infected file
on any subsequent attempts to copy, move or execute the
file.
Question: So why would I use an option that does not tell me when
I have a virus?!
Answer: Setting Action to Deny access and continue can be
useful on PC's that require little or infrequent user
intervention. Using Deny access and continue, will
allow the PC to run without halting to display a virus
warning message if an infected file is copied to it.
However, the next time someone goes to that PC and
tries to access that infected file, VShield will Deny
access to the file.
IT IS STRONGLY RECOMMENDED THAT YOU DO NOT SET ACTION
TO DENY ACCESS, ON WORKSTATIONS THAT ARE IN REGULAR
USE BY USERS!
Question: If a virus is found while running an MS-DOS Window,
why does my screen go blank after the alert?
Answer: When the VShield VxD detects a virus and must alert the
user, Windows automatically switches from whatever is
being displayed to a full size text screen displaying
the error. Once the user has responded to the message
and VShield is through, Windows restores the display
to its former state. Unfortunately, some video drivers
do not properly handle switching from a VxD error
message back to a windowed DOS box. Instead of setting
the display back into a graphical mode, it leaves the
screen "blanked out" in text mode. Windows continues
to run, but mistakenly believes that it is still using
graphics. To restore the screen to normal, set Windows
to display the DOS program full-screen. This is
accomplished by pressing the <ALT> and <ENTER> keys in
combination, the normal way to switch between windowed
and full screen modes. Your screen will now show the
DOS program in full screen. Pressing <ALT> and <ENTER>
will then return you to graphical mode.
Question: What happened to my Novell (S)harable file attribute?
My executable files were set to Sharable and Read Only
before I ran VirusScan95, and now they are just Read
Only!!
Answer: This is a known bug, and will be fixed in the next
elease of VS95. Possible work-around: mark the files
EXECUTE only. Create a dummy account called SCAN on the
server, and grant only Read and Filescan rights to that
account. Login as SCAN before scanning your Novell
volumes.
__________________
Reporting Problems
When you encounter a problem or have general questions, you may contact
McAfee Technical Support at (408) 988-3832.
__________________________
McAfee Contact Information
For questions, orders and problems call Customer Service
Monday-Friday, 6:00AM - 5:00PM PST at (408) 988-3832
For Faxes (24 hour, Group III FAX), call (408) 970-9727
To receive information from our Fax-back automated response system,
call (408) 988-3034.
In addition, you can receive online assistance through any of the
following resources:
Bulletin Board System (24 hour US Robotics HST DS) at (408) 988-4004
Internet Email: support@mcafee.com
Internet FTP: ftp.mcafee.com
World Wide Web: http://www.mcafee.com
America Online: keyword:MCAFEE
CompuServe: GO MCAFEE
The Microsoft Network: GO MCAFEE
You can send correspondence to any of our McAfee locations:
McAfee Corporate Headquarters McAfee East Coast Office
2710 Walsh Avenue 766 Shrewsbury Avenue
Santa Clara, CA 95051-0963 Jerral West Center
Tinton Falls, NJ 07724-3298
McAfee Central Office McAfee Canada
5944 Luther Lane, Suite 117 178 Main Street
Dallas, TX 75225 Unionville, Ontario
Canada L2R 2G9
McAfee Europe B.V. McAfee (UK) Ltd.
Orlyplein 81 - Busitel 1 Hayley House, London Road
1043 DS Amsterdam Bracknell, Berkshire
The Netherlands RG12 2th United Kingdom
McAfee France S.A. McAfee Deutschland GmbH
50 rue de Londres Industriestrasse 1
75008 Paris D-82110 Germering
France Germany
_______________________
Registering VirusScan95
Refer to the README.1ST file for more information. README.1ST may be
found in the installation directory or as an ICON labeled "McAfee
Information" in the McAfee VirusScan95 Program Group.
_______________
McAfee Training
For more information about scheduling onsite training for
any McAfee product, call Customer Service at (800) 338-8754.
_________________________
Upgrading McAfee Products
To make it easier for you to receive and use McAfee's products, we
have established an Agents program to provide service, sales, and
support around the world for our products. A listing of United States
and International agents is provided in the file README.1ST.