What's New in the Network Associates 3103 DAT Files
    Copyright (c) 1992-1998 by Network Associates, Inc.,
     and its Affiliated Companies. All Rights Reserved.


Thank you for using Network Associates products. This
What's New file contains important information regarding
the current data (.DAT) files. Network Associates strongly
recommends that you read the entire document.

Network Associates welcomes your comments and suggestions.
Please use the information provided in this file to contact
us.

___________________
WHAT'S IN THIS FILE

- What are .DAT files?
- New Features
- Known Issues
- Installation
- Additional Information
- Contacting Network Associates

____________________
WHAT ARE .DAT FILES?

DAT files contain up-to-date virus signatures and other
information that Network Associates anti-virus products use
to protect your computer against the thousands of computer
viruses in circulation. New .DAT files are released each
month to provide protection against the 100 to 300 new
viruses that are discovered each month. To ensure that you
are protected against the latest virus threats, download and
install the latest .DAT files every month.

____________
NEW FEATURES 

* NEW VIRUSES DETECTED *

The 3103 .DAT files are compatible with Network Associates
and McAfee anti-virus products that use v3.x or later scan
engines only. For optimal detection, Network Associates
recommends that these .DAT files be used with v3.1.7 or
later scan engines. These .DAT files are not intended for
use with McAfee v2.x scan engines.

These .DAT files detect the following 139 new viruses.
Locations that have experienced particular problems with
specific viruses are also identified.

ALLIANCE.H
ANAK.D
ANGUS.A
ANTISR1.A (INTENDED)
ANTISR1.B
AOS.A (Requires v3.1.7 engine or later)
APPDER.Q
ATTENTION.B
BARRETT.TROJAN
BISMARK.F
BUERO.B:DE
CAMILA.2126             (Paraguay)
CAP.CY
CAP.CZ
CAP.DA
CAP.DB
CAP.DC
CAP.DD
CAP.DE
CAP.DF
CAP.DG
CAP.DH
CAP.DI
CAP.DJ
CAP.DK
CAP.DL
CAP.DM
CAP.DN
CONCEPT.CF
CONCEPT.CG
COUP.2260
COUP.2260 (MBR)
DISCO.B
DISCO.C
DIVINA.O
DIVINA.P
DIVINA.Q
DRAZIL.2869             (Switzerland)
DRAZIL.2869 VXD         (Switzerland)
FUNFUN.A
GOZAR
GRASS.A:DE
GSIS.B
GURRE.A
HARK.A                  (Texas)
HLLT.5330               (Peru)
HLLT.5696
HLLT.KRILE.4537
HLLT.KRILE.4592
HLLT.KRILE.5504
HLLT.KRILE.5696         (Internet)
HLLT.KRILE.5762         (Internet)
HOODLUM.777
INNUENDO.A
JACK.A:INTENDED
MDMA.AR
MDMA.AU
MDMA.AV                 (Brazil)
MINIMAL.V
MUCK.AQ
MUCK.AR
MUCK.AS
NICEDAY.R
NIGHTSHADE.B            (California)
NJ-WMVCK2.J
NJ-WMVCK2.L
NOP.K
NOP.R:BR
NOP.S:ES
NOP.T:IT
NOPRINT.B
NOTTICE.B
NOTTICE.C
NPAD.FZ
NPAD.GA
NPAD.GB
NPAD.GC
NPAD.GD
NPAD.GE
NPAD.GF
NPAD.GG
NPAD.GH
NUCLEAR.Z
REDTEAM.5145 (NE)
ROETVIR.1876
SC.A
SEMISOFT.59904          (New Zealand)
SEMISOFT.59904-B        (New Zealand)
SEMISOFT.60416          (Texas)
SERBU.3322
SHOWOFF.CT
SHOWOFF.CU
SHOWOFF.CV
SHOWOFF.CW
SIDOR.A
SKULLBONE.A
SMMD.A
SPELL.A
STEPH.A
STEROID.A
STEROID.B
SWLABS.F (Word97)
SWLABS.K                (US/Canada)
TABULA.A:DE
TAMANNA
TELEFOON TROJAN         (Netherlands)
TEMPLE.M
THEATRE.D:TW
TMC:LEVEL42             (Czech Rep./Slovak)
    (TMC:LEVEL42 requires v3.1.7 engine or later)
TROUT.6787              (Canada/Chicago)
TROUT.6787.B            (Canada/Chicago)
TROUT.6804              (Canada/Chicago)
    (Trouts require 3.1.7 engine or later)
TWNO.AF:TW
TWNO.AG:TW
TWNO.AH:TW
TWNO.AI:TW
UKA.B
UKA.C
UNHAS.A
URCHIN.A
WAZZU.DS
WAZZU.DT
WAZZU.DU
WAZZU.DV
XM/LAROUX.BD
XM/LAROUX.BF
XM/LAROUX.BI
XM/LAROUX.BM
XM/LAROUX.BO
XM/LAROUX.BR
XM/LAROUX.BS
XM/LAROUX.BU
XM/LAROUX.BV
XM/LAROUX.BW
XM/LAROUX.BX
XM/LAROUX.BY
XM/LAROUX.BZ
XM/YOHIMBE.B
XRES.786


* NEW VIRUSES CLEANED *

The 3103 .DAT files clean the following 109 new viruses:

ALLIANCE.H
ANAK.D
ANGUS.A
ANTISR1.A (INTENDED)
ANTISR1.B
AOS.A (Requires 3.1.7 engine or later)
APPDER.Q
ATTENTION.B
BISMARK.F
BUERO.B:DE
CAMILA.2126             (Paraguay)
CAP.CY
CAP.CZ
CAP.DA
CAP.DB
CAP.DC
CAP.DD
CAP.DE
CAP.DF
CAP.DG
CAP.DH
CAP.DI
CAP.DJ
CAP.DK
CAP.DL
CAP.DM
CAP.DN
CONCEPT.CF
CONCEPT.CG
COUP.2260
COUP.2260 (MBR)
DISCO.B
DISCO.C
DIVINA.O
DIVINA.P
DIVINA.Q
FUNFUN.A
GOZAR
GRASS.A:DE
GSIS.B
GURRE.A
HARK.A                  (Texas)
HOODLUM.777
INNUENDO.A
JACK.A:INTENDED
MDMA.AU
MDMA.AV                 (Brazil)
MINIMAL.V
MUCK.AQ
MUCK.AR
MUCK.AS
NICEDAY.R
NIGHTSHADE.B            (California)
NOPRINT.B
NPAD.FZ
NPAD.GA
NPAD.GB
NPAD.GC
NPAD.GD
NPAD.GE
NPAD.GF
NPAD.GG
NPAD.GH
NOTTICE.B
NOTTICE.C
NUCLEAR.Z
ROETVIR.1876
SC.A
SERBU.3322
SHOWOFF.CT
SHOWOFF.CU
SHOWOFF.CV
SHOWOFF.CW
SIDOR.A
SKULLBONE.A
SMMD.A
SPELL.A
STEPH.A
STEROID.A
STEROID.B
SWLABS.F (Word97)
SWLABS.K                (US/Canada)
TABULA.A:DE
TELEFOON TROJAN         (Netherlands)
TEMPLE.M
THEATRE.D:TW
TROUT.6787.B            (Canada/Chicago)
    (Trouts require v3.1.7 engine or later)
TWNO.AF:TW
TWNO.AG:TW
TWNO.AH:TW
TWNO.AI:TW
UKA.B
UKA.C
UNHAS.A
URCHIN.A
WAZZU.DS
WAZZU.DT
WAZZU.DU
WAZZU.DV
XF/PAIX.A (Requires v3.1.7 engine or later)
XM/LAROUX.BF
XM/LAROUX.BO
XM/LAROUX.BS
XM/LAROUX.BU
XM/LAROUX.BV
XM/LAROUX.BW
XM/LAROUX.BX
XM/LAROUX.BY
XM/LAROUX.BZ


* HOSTILE JAVA AND ACTIVEX OBJECTS DETECTED *

The following products use the file INTERNET.DAT:
WebScanX v3.1.2 and WebShieldX Proxy v3.1.0.

The 3103 .DAT files detect the following 95 hostile Java
applets when used with Network Associates and McAfee
anti-virus products enabled by INTERNET.DAT:

ALLTARGETS.CLASS
ANIMATIONSOURCEAPPLET.CLASS
APPLETKILLER.CLASS
APPSTATUS.CLASS
ATTACKER.CLASS
ATTACKTHREAD.CLASS
BEGINNER.CLASS
BENCHMARKAPPLET.CLASS
BLUESCREEN.CLASS
BUMCHANGE.CLASS
CALCULATOR.CLASS
CONSUME.CLASS
COOLBOARD_APPLET.CLASS
COSMO.CLASS
DELETEFILE.CLASS
DIMENSIONS.CLASS
DOMYWORK.CLASS
DOUBLETROUBLE.CLASS
DUPE.CLASS
EI.CLASS
ERRORMESSAGE.CLASS
EXAMPLEO.CLASS
EXECTEST.CLASS
EXITTEST.CLASS
FILEINFO.CLASS
FIXJAVA.CLASS
FORGER.CLASS
FTPUSERSAPPLET.CLASS
HIJACKER.CLASS
HOSEMOCHA.CLASS
HOSTILETHREADS.CLASS
HUGOBANE1.CLASS
HUGOBANE3.CLASS
HUGOBANE5.CLASS
IMAGEBANK.CLASS
INTRO.CLASS
IRRITANT.CLASS
JFSAPPLET.CLASS
LETTERBOARD.CLASS
LETTERBUTTON.CLASS
LOADLIBRARY.CLASS
LOGIN.CLASS
LOGINSERVERSOCKET.CLASS
MANDELTEST.CLASS
MOUSECHASE.CLASS
MOUSECHASEEXCEPTION.CLASS
MUTATOR.CLASS
MYTIMER.CLASS
NERVOUSIMAGE.CLASS
NEWLOADER.CLASS
NOISYBEAR.CLASS
OWNNET.CLASS
PENPAL.CLASS
PLAYERAPPLET.CLASS
PORT25.CLASS
PUBLICENEMY.CLASS
READFILE.CLASS
REPLACEPROPERTIESFILE.CLASS
REPORT.CLASS
REPORTSERVERSOCKET.CLASS
RM.CLASS
SCANALYZER.CLASS
SCAPEGOAT.CLASS
SEETHEWEB.CLASS
SELLDRUGS.CLASS
SENDMAILAPPLET.CLASS
SENDTEST.CLASS
SEXY.CLASS
SILENTTHREAT.CLASS
SIMPLETEXT.CLASS
SLOWERKILLER.CLASS
SOLARVENGEANCERT.CLASS
SPARKS.CLASS
STARFIELD3.CLASS
STARSMENU.CLASS
STEALSTUFF.CLASS
TARGET.CLASS
TELESCRIVENTE.CLASS
TELNET.CLASS
TELNETGUI.CLASS
TICKET.CLASS
TICKETHOLDER.CLASS
TICKETREADER.CLASS
TOURGUIDE.CLASS
TRIPLETHREAT.CLASS
TUMBLINTEXT.CLASS
TURNTRICKS.CLASS
UNGRATEFUL.CLASS
VALUEBOX.CLASS
WASTEFUL.CLASS
WEBMAILER.CLASS
WIDGET.CLASS
WORDMANAGER.CLASS
WORDMEISTER.CLASS
WRITEFILE.CLASS

The 3103 .DAT files detect the following four malicious
ActiveX controls when used with Network Associates
anti-virus products that use INTERNET.DAT:

EXPLODER.OCX
NETLIST.CAB
NETLIST.OCX
RUNNER.OCX

____________
KNOWN ISSUES

1.  Due to the size of Virus List, it is too large to load
    into memory under the following circumstances: when
    using these .DAT files with McAfee VirusScan v3.x for
    Windows 3.1x after a virus is detected and cleaned,
    viewing the Virus List more than once may cause your
    system to run out of memory.

2.  An invalid page fault may occur on some systems when
    the 3103 .DAT files are used with McAfee VirusScan for
    Windows 95 v3.0.0. If you encounter this problem,
    Network Associates recommends that you upgrade to the
    current version of McAfee VirusScan for Windows 9x by
    contacting Network Associates sales or connecting to
    the Network Associates website. Contact information
    appears at the end of this document.

____________
INSTALLATION

* INSTALLING THE PRODUCT *
   
DAT file updates are stored in a compressed format to reduce
transmission time. To install your update, create a
temporary directory and copy the downloaded file to the
directory. Unzip the files, then copy them to the
appropriate permanent directories, replacing your existing
files.

* PRIMARY PROGRAM FILES FOR VIRUS DEFINITIONS *

Files located in the Install directory:
=======================================

       CLEAN.DAT = Data file for virus cleaning
    POLYSCAN.DAT = Data file for advanced polymorphic virus
                   detection
       NAMES.DAT = Data file for virus names
        SCAN.DAT = Data file for virus scanning
    INTERNET.DAT = Data file to detect hostile Java/ActiveX
                   objects

* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined effort
by anti-virus vendors throughout the world to come up with
one standard by which customers can verify their anti-virus
installations. To test your installation, copy the following
line into its own file and name it EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

When done, you will have a 69- or 70-byte file.

When McAfee VirusScan is applied to this file, Scan will
report finding the EICAR-STANDARD-AV-TEST-FILE virus.

It is important to know that THIS IS NOT A VIRUS. However,
users often have the need to test that their installations
function correctly. The anti-virus industry, through the
European Institute for Computer Antivirus Research, has
adopted this standard to facilitate this need.

Please delete the file when installation testing is
completed so unsuspecting users are not unnecessarily
alarmed.

______________________
ADDITIONAL INFORMATION

Macro viruses are named using this standard:

The first of a family is given "name.A". For each
subsequently discovered variant, the suffix letters progress
until .Z is reached. The next is given .AA until .AZ is
reached. The next is given .BA, etc. until .ZZ is reached.
The next would then be given .AAA and so on.

A macro virus name given without a variant notation means a 
non-specific variant is being referenced.
                                     
_____________________________
CONTACTING NETWORK ASSOCIATES

* FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS *

Contact the Network Associates Customer Care department: 

1.  Corporate-licensed customers, call (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

    Retail-licensed customers, call (972) 278-6100
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III fax 
        
3.  Fax-back automated response system (408) 988-3034
    24-hour fax

Send correspondence to any of the following
Network Associates locations:

    Network Associates Corporate Headquarters
    2805 Bowers Avenue
    Santa Clara, CA 95051-0963

    Network Associates Canada
    139 Main Street, Suite 201
    Unionville, Ontario
    Canada L3R 2G6

    Network Associates Europe B.V.
    Gatwickstraat 25
    1043 GL Amsterdam
    The Netherlands

    Network Associates International Ltd.
    Minton Place, Victoria Street
    Windsor, Berkshire
    SL4 1EG
    United Kingdom

    Network Associates France S.A.
    50 rue de Londres
    75008 Paris
    France

    Network Associates Deutschland GmbH
    Industriestrasse 1
    D-82110 Germering
    Germany

    Network Associates Japan Co, Ltd.
    Toranomon 33 Mori Bldg.
    3-8-21 Toranomon
    Minato-Ku, Tokyo 105
    Japan

    Network Associates Korea
    135-090, 18th Fl., Kyoung Am Bldg.
    157-27 Samsung-Dong, Kangnam-Ku
    Seoul, Korea

    Network Associates South East Asia
    7 Temasek Boulevard
    The Penthouse
    #44-01, Suntec Tower One
    Singapore 038987

    Network Associates Australia
    Level 1, 500 Pacific Highway
    St. Leonards, NSW 2065
    Australia

    Network Associates Latin America
    150 South Pine Island Road, Suite 205
    Plantation, FL 33324
    USA

Or, you can receive online assistance through any of the
following resources:

1.  Bulletin Board System: (408) 988-4004
    24-hour US Robotics HST DS

2.  Internet e-mail: support@nai.com

3.  Internet FTP: ftp.nai.com

4.  World Wide Web: http://www.nai.com

5.  America Online: keyword MCAFEE

6.  CompuServe: GO MCAFEE

Before contacting Network Associates, please make note of
the following information. When sending correspondence,
please include the same details.

- Program name and version number
- Type and brand of your computer, hard drive, and any 
  peripherals
- Operating system type and version
- Network name, operating system, and version
- Contents of your AUTOEXEC.BAT, CONFIG.SYS, and 
  system LOGIN script
- Microsoft service pack, where applicable
- Network card installed, where applicable
- Modem manufacturer, model, and baud, where 
  applicable
- Relevant browsers/applications and version number,
  where applicable

- Problem
- Specific scenario where problem occurs
- Conditions required to reproduce problem
- Statement of whether problem is reproducible on demand

- Your contact information: voice, fax, and e-mail

Other general feedback is also appreciated.

Documentation feedback is welcome. Send e-mail to
documentation@nai.com.


* FOR ON-SITE TRAINING INFORMATION *
 
Contact Network Associates Customer Service at
(800) 338-8754.


* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use
Network Associates products, we have established a
Resellers program to provide service, sales, and support
for our products worldwide. For a listing of resellers, see
the file RESELLER.TXT, where applicable, or contact
Network Associates Customer Service for a reseller near you.


* NETWORK ASSOCIATES BETA SITE *

Get pre-release software, including .DAT files, through
http://beta.nai.com. You will have access to Public Beta
and External Test Areas. Your feedback will make a
difference.