PC World Komputer 1998 November

home *** CD-ROM | disk | FTP | other *** search

/ PC World Komputer 1998 November / pcwk_11_98a.iso / AV / Vscan320 / WHATSNEW.TXT < prev

Wrap

Text File | 1998-09-03 | 44.1 KB | 1,441 lines

What's New in McAfee VirusScan v3.2.0 for Windows 95 and Windows 98 (3108) Copyright (c) 1994-1998 by Network Associates, Inc. and its Affiliated Companies. All Rights Reserved. Thank you for using McAfee VirusScan for Windows 95 and Windows 98. This What's New file contains important information regarding the current version of this product. Network Associates strongly recommends that you read the entire document. Network Associates welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issues - Installation - Documentation - Frequently Asked Questions - Contacting Network Associates ____________ NEW FEATURES 1. New versions of standby VirusScan Command Line components give VirusScan for Windows 95 and Windows 98 powerful and up-to-date backup protection with the highest detection and cleaning rates in the industry. 2. The scan engine included with VirusScan features improved cleaning for Microsoft Excel files infected with the Laroux virus. This version also protects your system against the dangerous CIH and Marburg viruses, which infect Windows portable executable (PE) files. A portable executable file is a Windows resource file that other executable files can share--examples include dynamic linking library (.DLL) files. 3. This VirusScan version also includes improved detection and cleaning capability for the TEOCATL virus and for a new strain of the XF/PAIX virus. 4. VirusScan now detects macro viruses that infect Microsoft Access database files. 5. VirusScan and VShield fully support floppy disk scanning on LS-120 drives. 6. VirusScan and VShield both send Desktop Management Interface (DMI) alerts to desktop or network management applications that support the DMI standard. This capability supplements each program's existing alert options. 7. VirusScan scans files compressed in most of the popular file formats available on the PC platform. When it detects an infection in a file compressed in the ZIP, LHA, or UUencode format, VirusScan can clean, delete, or move the file. VirusScan cannot clean, delete, or move an infected file compressed in .CAB or in ZIP-SFX format, which might include an Authenticode certification. Network Associates recommends that you first decompress files encoded in either of these formats before running a VirusScan clean operation on them. 8. VirusScan scans files embedded within Microsoft Office files, including Microsoft Word and Microsoft Excel files. 9. VirusScan can detect macro virus infections in password-protected Microsoft Word 95 files in all languages that Word supports. 10. If a macro virus plants its own password in a password-protected Word 97 file, VirusScan cleans the file and removes the password that the virus planted. If, on the other hand, the macro virus cannot plant its own password, VirusScan cleans the password-protected Word 97 file without disturbing its user-assigned password. 11. VirusScan checks the .DAT file version in use for compatibility with its newer scan engines. It will prompt you to update incompatible .DAT files. * NEW VIRUSES DETECTED * The 3108 .DAT files included with this release of VirusScan detect the following 165 new viruses: _3141 _.8772 AETA.5315 AI22.1659 ANIMO.518 ANTIHEURISTICA.672 ANXIETY.POPPY.III APPDER.S AREF.670 AREF.890 ASK.352 AZNAR.666 BANDUNG.BG BEL.2124 BOX.I:TW BUPT.BOO CACHACA.400 CAP.GW CAP.GX CARTMAN.C CHINA.882 CLASS.A CLASS.B COCA.509 COLORS.CC COMPANION.181 CONCEPT.CM COWABUNGA.2193 DROPPER COWABUNGA.2298 DROPPER CRASHER.439 CRASHER.659 CROW.A DARKMAN TROJAN DEICIDE.622 DIE.490 DIE.513 DIKSHEV.1334 DM.400.C DMV.M DRE.756 DUTCH.TINY.98 DUTCH.TINY.99.A EARLE.1431 EXEHEADER.337 EXEHEADER.352 EXEHEADER.360B FATAL ELLUSION.GR FREK.COMP GOLLUM.7167 GOLLUM.7167.DROPPER GOODNIGHT.N HDM.BOOT HIDE AND SEEK.709 HLL.5381 HLLT.4630 HLLT.4709.A HLLT.4709.B HLLT.4725 HLLT.4805 HLLT.4869 HLLT.4949.A HLLT.4949.B HLLT.5413 INCOM.648 IVP.351 JDAY.412 JEDI.A JEFF.812 JOHNNY.W JSB.498 JUNE16TH.879 KERNEL.616 KNIGHT-7 KOMPU.M KURE.5337 LAMEJOKE.A LANCELOT.342 LEO.1965 LEO.333 LIGHT.1060 MASHA.1338 MDMA.BC MDRG.544 MIRC/GERR_EXE MIRC/GERR_INI MIREA.925 MIREA.950 MIREA.958 MONO.1063 NIKNAT.M NILZ.1000 NOP.W:DE NOTTICE.E NPAD.IF NPAD.IG NPAD.IH NPAD.II NPAD.IJ NPAD.IK NPAD.IL NUCLEAR.AC NUCLEII.200 OMEGA.A:BR OPA.90 OPA.200 OPA.600 PARAGUAY.367 PARAGUAY.1650 PARAGUAY.1726 PARAGUAY.2618 PARAGUAY.2867 PINDONGA.3551 POLYPOSTER.A POSSESSED.2167 QRES.236 REVENGER.505 SATAN.599 SEMISOFT.59391 SERGEANT.229 SHOWOFF.DJ SHOWOFF.DK SPANSKA.1008 SPANSKA.1509 SPOOKY.323 SPOOKY.440 STRATO.1597 SUELA.1042 SWLABS.S TCV TOUT.275 TRIPLEK.471 T_POWER.4564 VANITAS.3712 VICKY.304 VICKY.567 VICKY.1015 VICKY.1109 VICKY.1186 W32.CIH.SPACEFILLER W95.MARBURG.A W95/HPS W97/CLASS.A (SYS) W97/CLASS.B (SYS) WAZZU.EX WAZZU.EY WAZZU.EZ WAZZU.FA WME.A WRZOD.1016 XF/PAIX.B XM/IMPORT.B XM/LAROUX.DL XM/LAROUX.DM XM/LAROUX.DO XM/LAROUX.DQ XM/LAROUX.DR XM/LAROUX.DS XM/LAROUX.DX XM/LAROUX.DY XM/LAROUX.DZ XM/LAROUX.EA XRES.432 YUSONG.1471 ZLODIC.666 ZMK.J:DR * NEW VIRUSES CLEANED * The 3108 .DAT files clean these 84 new viruses: _3141 _.8772 ANTIHEURISTICA.672 ANXIETY.POPPY.III APPDER.S BANDUNG.BG BOX.I:TW BUPT.BOO CAP.GW CAP.GX CARTMAN.C COLORS.CC CONCEPT.CM COWABUNGA.2193 DROPPER COWABUNGA.2298 DROPPER CROW.A DEICIDE.622 DM.400.C DMV.M DUTCH.TINY.98 DUTCH.TINY.99.A FATAL ELLUSION.GR FREK.COMP GOLLUM.7167 GOLLUM.7167.DROPPER GOODNIGHT.N HDM.BOOT HIDE AND SEEK.709 INCOM.648 IVP.351 JEDI.A JEFF.812 JOHNNY.W JSB.498 JUNE16TH.879 KERNEL.616 KNIGHT-7 KOMPU.M LAMEJOKE.A MDMA.BC MDRG.544 MIREA.925 MIREA.950 MIREA.958 MONO.1063 NIKNAT.M NILZ.1000 NOP.W:DE NOTTICE.E NPAD.IF NPAD.IG NPAD.IH NPAD.II NPAD.IJ NPAD.IK NPAD.IL NUCLEAR.AC OMEGA.A:BR QRES.236 SATAN.599 SHOWOFF.DJ SHOWOFF.DK SWLABS.S W97/CLASS.A (SYS) W97/CLASS.B (SYS) WAZZU.EX WAZZU.EY WAZZU.EZ WAZZU.FA WME.A WRZOD.1016 XF/PAIX.B XM/IMPORT.B XM/LAROUX.DL XM/LAROUX.DM XM/LAROUX.DO XM/LAROUX.DQ XM/LAROUX.DR XM/LAROUX.DS XM/LAROUX.DX XM/LAROUX.DY XM/LAROUX.DZ XM/LAROUX.EA ZMK.J:DR ____________ KNOWN ISSUES 1. Using MS-DOS memory managers might cause VirusScan to falsely detect viruses in memory. Since Windows 95/98 no longer requires MS-DOS memory managers, you can eliminate false warnings by preceding each line in your CONFIG.SYS file that includes settings for an MS-DOS memory manager with REM. This deactivates the memory manager. To learn more about working with your CONFIG.SYS file, see your MS-DOS or Windows documentation. 2. To create a VirusScan Emergency Disk, you must first create a bootable floppy disk using the following command at a DOS prompt: c:\>FORMAT A: /S/U 3. If you use a password to protect VShield or any scan task you have scheduled, VirusScan will ask you for that password whenever you start any program you have not excluded from scanning. Use your mouse to click inside the text box provided in order to enter the password--keyboard shortcuts will not work. Microsoft acknowledges this issue in its Knowledge Base Article ID #Q84133. Next, click OK to use the password you enter. To close the password verification dialog box without entering a password, click Cancel. 4. ScreenScan will stop scanning after it detects a virus and will prompt you to launch VirusScan. If you have additional viruses on your system, ScreenScan will not notify you until it next runs. Network Associates recommends that you scan and clean your entire system with VirusScan whenever ScreenScan detects a virus. 5. Disk defragmentation programs move files as they work to maximize hard disk efficiency. If you have VShield, VirusScan, or other applications active during a disk defragmentation operation, your disk defragmentation program might tell you that it cannot find the active application files. This is normal and does not mean that the files do not exist. To avoid error messages like this, close all open applications and disable VShield, then run your disk defragmentation operation again. 6. If you unzip a virus-infected file into a directory on a Novell server, VShield does not detect the infection as the file is created. For maximum security, use VirusScan to scan the Novell server after you have extracted the files to the server. 7. If you press CTRL+ALT+DEL to shut down a Windows 95 system with VShield or any other VxD enabled, Windows does not shut down. Instead, Windows disables VShield or the active VxD. To shut down your computer, you must press CTRL+ALT+DEL again. ____________ INSTALLATION * INSTALLING VIRUSSCAN * 1. Insert the floppy disk or compact disc with your copy of VirusScan into your floppy disk drive or CD-ROM drive. If you downloaded a compressed copy of VirusScan from the Network Associates website or other electronic service, create a temporary directory on your hard disk or on a disk available on your network, then extract the files you downloaded into that directory. 2. Click Start in the Windows taskbar, then choose Run. 3. Type x:\setup.exe in the Run dialog box to start the installation utility from a floppy disk. To start the utility from a CD-ROM, type x:\win95\setup.exe. In both cases, x is the drive letter that designates your floppy drive or your CD-ROM drive. If you extracted files that you downloaded to your hard disk or to a disk on your network, specify the path to the correct directory. For example, type C:\DOWNLOAD\SETUP.EXE. 4. Click OK to continue. The VirusScan installation wizard will start. Follow the instructions shown on each wizard pane to choose the VirusScan options you want. 5. When you finish your installation, restart your computer. * PERFORMING A SILENT INSTALLATION * To install copies of VirusScan with a uniform configuration on client computers on your network, run SETUP.EXE with the -s option -- that is, type SETUP.EXE -s in the Run dialog box. This tells VirusScan to install itself with little or no interaction with end users. If you do not customize this installation, VirusScan installs itself with all of the default or "typical" installation settings activated. Network administrators can customize the silent installation feature by following these steps: 1. Check the Windows directory to ensure that a file named SETUP.ISS does not already exist. If one does, rename it, back it up, or delete it. 2. Run SETUP.EXE with the -r option, (i.e., SETUP.EXE -r) to install it to your computer or to a chosen server on your network. 3. Select the components and choose the settings you want each of your client computers to have. The VirusScan installation utility will record your choices. Note: If VirusScan detects a virus as it records your choices, both the recording operation and the installation will abort. Result: The VirusScan installation utility creates a SETUP.ISS file in the Windows directory. This file lists the options you chose during your installation. 4. Finish the installation. If you have chosen all of your options correctly, move to Step 5. To change any of the options you chose, see the following notes. The .ISS file specifies an installation directory in the szDir parameter listed beneath the [SdSetupType-0] header. The installation directory you specify here overrides the default installation directory on each client machine, which might vary on machines that run different operating systems. Having the same directory name on every client helps to ease administration; for example, you might assign all client machines the directory C:\ANTIVIRUS. If, however, you want to allow SETUP.EXE to determine where to locate the installed files, follow these steps to modify the SETUP.ISS file so that the target machine will disregard the szDir parameter: A. Locate the section [SdSetupType-0] in the SETUP.ISS file and go to the line: Result = xxx. The actual value will most likely be 301, 302, or 303, depending on which options you selected when you recorded your installation. B. Add 100 to this number so that, for example, 301 becomes 401. This tells each target machine to disregard the szDir and assign a directory according to its own particular operating system. 5. Copy the installation files onto a local or a mapped network drive, then rename, back up, or delete the SETUP.ISS file stored in that directory. You'll use the new SETUP.ISS file you just created instead. Note: You cannot perform a silent installation from files that span more than one floppy disk or other storage medium because the installation utility will prompt the end user on each client computer for the next disk. 6. Copy the new SETUP.ISS from the Windows directory to the directory that contains the installation files. Note: The SETUP.ISS file is unique for each VirusScan product. You cannot, for example, use a SETUP.ISS file created during a VirusScan for Windows 95 installation to control a VirusScan for Windows NT installation. 7. Run SETUP.EXE with the -s option--that is, type SETUP.EXE -s in the Run dialog box. Note: If you do not specify a "recorded" answer for all dialog boxes during the initial installation, the silent installation will fail. 8. When the silent installation is complete, the computer reboots automatically if you did so during your recorded installation. The default SETUP.ISS script reboots the target computer automatically. * PRIMARY PROGRAM FILES FOR VIRUSSCAN * Note: The specific files you see on your computer will depend on the type of license you purchased. Your VirusScan copy might not include some of these files. Files located in the Install directory: ======================================= 1. Installed for VShield/Scan32/DOS/ScreenScan: README.1ST = License and registration information CLEAN.DAT = Virus clean definition data POLYSCAN.DAT = Data file for advanced polymorphic virus detection NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data VS-MAIN.HLP = VirusScan help file VSCHED.EXE = VirusScan console scheduler file DMIALERT.DLL = Library file ADVGUI.DLL = Advanced interface library file MCGUI32.DLL = AV Console library file S95EXT.DLL = Library file CFGCOM32.DLL = Library file INETWH16.DLL = Internet library help file INETWH32.DLL = Internet library help file AVCONSOL.EXE = VirusScan Console program file MCECOM.EXE = Automatic product update program file CHKVXD.EXE = VShield virtual device CONFIG32.EXE = VirusScan configuration program SETBROWS.EXE = Set browser program VIRLST32.EXE = McAfee Virus List VALIDATE.EXE = McAfee file validation program VSECOMR.EXE = Electronic Commerce program file WCMDR.EXE = Windows Commander program driver checking utility AVCONSOL.HLP = AV Console help file SCAN32.HLP = Scan32 help file PHONELST.INI = Electronic commerce file AVCONSOL.INI = AV Console initialization file WCMDR.INI = Windows Commander configuration settings WCMDRSIL.INI = unInstallShield helper configuration DELSL?.ISU = Uninstall file PACKING.LST = Packing list FAXFORM.TXT = Fax registration form RESELLER.TXT = Network Associates authorized resellers WHATSNEW.TXT = What's New document 2. Installed for VShield/Scan32: DPMI16.DLL = 16-bit DOS protected mode interface library DPMI32.DLL = 32-bit DOS protected mode interface library POLYSCAN.DLL = Library files for advanced polymorphic virus detection MCARCHIV.DLL = Compressed file scanning library MCKRNL32.DLL = Library files MCSCAN32.DLL = Library files MCUTIL32.DLL = Library files VSECOM.DLL = Library files 3. Installed for VShield: CONFIG32.EXE = VShield configuration program VSHWIN32.EXE = VShield engine DEFAULT.VSH = Default VShield settings 4. Installed for Scan32: SHUTIL.DLL = Run-time support library SCAN32.EXE = VirusScan program DEFAULT.VSC = Default Scan32 settings ALLDRIVE.VSC = Scan32 settings file SCAN_C.VSC = Scan32 settings file 5. Installed for Emergency Disk Creation Utility: BOOTSCAN.EXE = MS-DOS scan program SCAN.EXE = MS-DOS scan program SCANPM.EXE = Protected mode scanner EDISK.EXE = Emergency Disk creation utility GETREPLY.EXE = Emergency diskette program component EDAT.1 = Emergency Disk batch file EDAT.2 = Emergency Disk program information file EDAT.3 = Emergency Disk file EDAT.4 = Emergency Disk file EDAT.5 = Emergency Disk file EDAT.6 = Emergency Disk file ESCAN.BAT = Emergency Disk file EDISK.SCR = Emergency Disk script MCKRNL16.DLL = Emergency Disk library file MCUTIL16.DLL = Emergency Disk library file EMSCAN.DAT = Virus scan definition data EMCLEAN.DAT = Virus clean definition data EMNAMES.DAT = Virus names definition data 6. Installed for ScreenScan: MCKRNL32.DLL = Library file MCUTIL32.DLL = Library file SCRSCANP.DLL = Library file SCRSCANR.DLL = Library file DUNZIP32.DLL = ScreenScan compression library file DZIP32.DLL = ScreenScan compression library file SCRSCAN.EXE = ScreenScan program file SCRSCAN.HLP = ScreenScan help file Files located in WINDOWS directory: ========================================== SECCAST.ICO = Secure Cast icon Files located in WINDOWS\SYSTEM directory: ========================================== 1. Installed for VShield/Scan32/DOS: MCAFECOM.DLL = Network Associates Electronic Commerce library file 2. Installed for VShield/Scan32: MCKRNL.VXD = Detection virtual device driver MCSCAN32.VXD = Detection virtual device driver MCUTIL.VXD = Support virtual device driver 3. Installed for VShield: VSHIELD.VXD = Detection virtual device driver VSHINIT.VXD = VShield virtual device driver Files located in the WINDOWS\HELP directory: ============================================ 1. Installed for VShield: VSHLDCFG.HLP = VShield help 2. Installed for Scan32: SCANEXT.HLP = Scan32 Extension help * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to implement one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file, then save the file with the name EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* The file size will be 69 or 70 bytes. Next, start VirusScan and allow it to scan the directory that contains EICAR.COM. When VirusScan scans this file, it will report finding the EICAR-STANDARD-AV-TEST-FILE virus. Note that this file is NOT A VIRUS. Delete the file when you have finished testing your installation to avoid alarming unsuspecting users. ______________________ UNINSTALLING VIRUSSCAN Network Associates recommends using the VirusScan uninstall utility provided with the program. To start the uninstall utility, click Start in the Windows taskbar, point to Programs, then to McAfee VirusScan. Next, choose Uninstall VirusScan. To remove VirusScan without using the uninstall utility, follow these steps: 1. Remove references to VirusScan from your AUTOEXEC.BAT file. To do so, follow these steps: A. Start the Windows system editor. Click Start in the Windows taskbar, then choose Run. Type SYSEDIT in the Run dialog box, then click OK. A set of text files will open on your screen. Your AUTOEXEC.BAT file should appear as the first or topmost window in this set. If it does not, click the title bar for the AUTOEXEC.BAT window. B. Locate and delete the text of each line in the AUTOEXEC.BAT file that refers to VirusScan. Be sure also to delete @IF ERRORLEVEL 1 PAUSE if it appears in the file. To help you locate all references to VirusScan, choose Find from the SYSEDIT Search menu, then type VirusScan in the dialog box that appears. C. When you have deleted all VirusScan references, choose Save from the SYSEDIT File menu to save your changes, then choose Exit from the File menu to quit the SYSEDIT application. 2. Remove VirusScan icons from the Start menu. To do this, follow these steps: A. Click Start in the Windows taskbar, point to Settings, then choose Taskbar. B. Click the Start Menu Programs tab. C. Click the Remove button. D. Select the McAfee VirusScan folder in the list that appears in the Remove Shortcuts/Folders dialog box, then click Remove. E. Windows will ask you to confirm your action. Click Yes to continue. F. Click Close to close the Remove Shortcuts/Folders dialog box, then click OK to close the Taskbar Properties dialog box. 3. Edit the Registry. To do this, follow these steps: A. Start the Windows Registry editor. Click Start in the Windows taskbar, then choose Run. Type REGEDIT in the Run dialog box, then click OK. B. Click the title bar of the HKEY_CLASSES_ROOT window to bring it to the foreground, then delete the key "VirusScan" from these locations: comfile\\shell\\VirusScan Directory\\shell\\VirusScan Drive\\shell\\VirusScan exefile\\shell\\VirusScan Excel.Addin\\shell\\VirusScan Excel.Chart.5\\shell\\VirusScan Excel.Chart.8\\shell\\VirusScan Excel.Macrosheet\\shell\\VirusScan Excel.Sheet.5\\shell\\VirusScan Excel.Sheet.8\\shell\\VirusScan Excel.Template\\shell\\VirusScan Excel.Workspace\\shell\\VirusScan Excel.XLL\\shell\\VirusScan WinZip\\shell\\VirusScan Word.Document.6\\shell\\VirusScan Word.Document.8\\shell\\VirusScan Word.Template\\shell\\VirusScan Delete the key "VSConfigFile" and the key "VSHConfigFile" C. Click the title bar of the HKEY_LOCAL_MACHINE window to bring it to the foreground. Next, open the following series of folders, then delete the listed keys: 1. SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete these keys: Vshwin32.EXE VsSCHED.EXE VSCOMR.EXE 2. SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices Delete this key: Vshwin32EXE 3. SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Delete this key: McAfee VirusScan 4. SOFTWARE\McAfee Delete these keys: Scan95 ScreenScan 5. SOFTWARE\Network Associates Delete this key: McAfee VirusScan D. Choose Exit from the Registry menu to close the Registry Editor. 4. Delete VirusScan files and directories. To do so, follow these steps: A. Press CTRL+ALT+DEL to start the Windows Task Manager, then select the VSHWIN32.EXE task. Press End Task to stop the program from running. B. Quit any other open VirusScan components. C. Click Start, point to Programs, then choose Windows Explorer. D. Locate the folder that contains your copy of VirusScan. If you chose the default installation options, you should find VirusScan in this directory path: Program Files\Network Associates\McAfee VirusScan E. Remove the following files from the \Windows\system directory on your hard disk: MCKRNL.VXD MCSCAN32.VXD MCUTIL.VXD VSHIELD.VXD 5. You have now removed VirusScan from your system. Restart your computer to have your changes take effect. _____________ DOCUMENTATION For more information, refer to the users guides for each product included on the CD-ROM or available from Network Associates electronic services. Each product user's guide is saved in Adobe Acrobat Portable Document Format (.PDF). You can view and print this document with Adobe's Acrobat Reader. PDF files can include hypertext links and other navigation features to assist you in finding answers to questions about your Network Associates product. To download Adobe Acrobat Reader from the World Wide Web, visit Adobe's website at: http://www.adobe.com/prodindex/acrobat/readstep.html To download Network Associates documentation, visit the Network Associates website at: http://www.nai.com Additional contact information appears in the following section. Documentation feedback is welcome. Send e-mail to tvd_documentation@nai.com. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about Network Associates products also are available on the Network Associates website, and on CompuServe and America Online. Q: I am installing new software on my computer, and the manual recommends disabling any anti-virus software. How do I disable VShield without uninstalling it? A: Right-click the VShield icon located in your system tray next to the system clock, point to Enable, then choose System Scan from the shortcut menu. If System Scan does not have a checkmark beside it in this menu, it is already disabled. After you install your new software, reactivate VShield by right-clicking the VShield icon in the system tray, pointing to Enable, then choosing System Scan from the shortcut menu. If System Scan has a checkmark next to it in the menu, it is enabled. Q: When VirusScan detects an infection in files compressed in .CAB or ZIP-SFX format, why doesn't VirusScan clean, delete, or move the files? A: Because files compressed in .CAB and ZIP-SFX formats can include a Microsoft Authenticode certificate, altering the files can render them unusable. To avoid this possibility, VirusScan does not clean, delete, or move infected files compressed in .CAB or ZIP-SFX format. Network Associates recommends that you decompress any infected files compressed in these formats, then run VirusScan again to clean the uncompressed files. Q: When my screen saver starts, I suddenly see a lot of activity on my hard disk. What's happening? How do I stop this activity? A: VirusScan includes a component called ScreenScan that scans for viruses on your hard disk during periods when your computer is idle. In order to use ScreenScan, you must install it separately as part of a custom installation. Then, during idle periods, ScreenScan starts the screen saver you chose in your Windows preferences property page and begins scanning for viruses. You can disable ScreenScan by following these steps: 1. Move your cursor to the Windows 95/98 desktop, then click your right mouse button. 2. Choose Properties from the shortcut menu that appears. 3. Click the ScreenScan tab in the Display Properties dialog box. 4. Clear the Enable Scanning While in Screen Saver Mode check box. 5. Click OK to close the Display Properties dialog box. Q: VirusScan detected a virus on my system, but it is not one of the default files listed in its Program Extensions dialog box. Therefore, I suspect it might be a false detection. What can I do to verify a detected virus? A: If you suspect a false detection on a non-executable file, run VirusScan's command line scanner, SCAN.EXE, to verify the infection. If VirusScan detects a virus and SCAN.EXE does not, download the latest .DAT files to update your virus definition files, then scan your system again. If VirusScan still detects a virus that you suspect is a false detection, please report the issue to Network Associates technical support. Q: I would like to purchase and download the latest version of VirusScan from one of the Network Associates electronic services, but I do not want to give my credit card information over the Internet for security purposes. Can I purchase VirusScan via modem and download the product via the Internet? A: Yes. The first time you download VirusScan, the Network Associates SecureCast wizard will prompt you to select the transmission method you prefer to use to download your Network Associates product. It will also prompt you to transmit your encrypted credit card information. At the Transaction Connection Type dialog box, select Internet to download your order via the Internet. At the Security Connection Type dialog box, select Direct Dial Modem to transmit your credit card information via modem. Q: I have created my own Emergency diskette without using the Emergency Disk creation utility. How must I optimize my emergency disk's performance? A: To enable your own Emergency Disk, you must create a CONFIG.SYS file on the boot diskette, then add these lines: DEVICE=HIMEM.SYS DOS=HIGH Add the HIMEM.SYS file from the DOS directory or, if you are using Windows 95 system files, add HIMEM.SYS from the \WINDOWS\COMMAND directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in the electronic documentation (.PDF file) included in your VirusScan package. Q: I moved a .VSC file to my Startup folder. Whenever I turn on my computer, VirusScan starts, but does not begin scanning. How can I make VirusScan start scanning automatically? A: You need to customize your options. Follow these steps: 1. Location the .VSC file you saved. 2. Right-click the .VSC file, then choose Properties from the shortcut menu that appears. 3. Click the Detection tab. 5. Select the Start Automatically check box. 6. Click OK to close the properties dialog box. Q: When VirusScan starts, how does it determine its default settings? A: VirusScan reads its default settings from the DEFAULT.VSC file located in the installation directory. Q: What error codes can CHKVXD.EXE return? A: Possible CHKVXD.EXE error level codes, along with their descriptions, are: 65535(-1)= VShield not installed 0 = VShield enabled 1 = VShield disabled Q: How can I tell that ScreenScan is working? A: ScreenScan does not tell you when it scans your system, but if you enable the logging option when you configure it, VirusScan will record all ScreenScan activity in its log file. Q: How can I use VirusScan to scan more than one drive at a time or to scan network drives? A: You can configure VirusScan to scan more than one drive or drives elsewhere on your network from the Detection dialog box. To open the dialog box, start VirusScan, then choose Advanced from the Tools menu. Next, follow these steps: 1. Click the Detection tab. 2. Click Add. 3. To add all network drives to the Detection list, click Select Item to Scan, then select All Network Drives. To add local drives to the Detection list, click Select Drive or Folder to Scan, then enter a drive letter or click Browse to locate the drive you want to scan. 4. Click OK. 5. Choose Save Settings from the File menu to save your settings. Q: Can I update Network Associates data files to detect new viruses? A: Yes. If your data files are out-of-date, VirusScan will periodically prompt you to update them. If you have a modem or Internet connection, you can use VirusScan's new electronic update feature for easy data file updates, technical support, and registration. If you need additional assistance with downloading, contact Network Associates Download Support. Contact information appears later in this file. Q: An error occurs when VirusScan has completed 95 percent of its installation. Why does this occur on my system, but not on others? A: Using a non-standard Windows 95 WinSock will cause the Setup to fail on some systems at the 95 percent completed point. To prevent this, use the default Windows 95 WinSock. Q: I removed the Recycle Bin from the VirusScan exclusions list. How can I replace it? A: Because the Recycle Bin is a system folder, it cannot be added to the exclusions list using VirusScan's browse feature. To restore it to the list, enter the Recycle Bin's full path in the exclusions list: \Recycled\ Q: Why are additional extensions added to the Program Files Only list? A: As the Network Associates Anti-Virus Emergency Response Team finds viruses that can infect new file types, it adds new extensions to the default extensions list to enhance security. For instance, new viruses can infect Microsoft Office binder files, so the default extensions list now includes the file extension for these binder files so that VirusScan will examine them for viruses. Q: I have Microsoft Office installed, but cannot use the right-click context menu to start a scan operation. Why? A: If you installed Microsoft Office after you installed VirusScan, you might need to reinstall VirusScan in order to be able to right-click DO?, XL, and OBD files and have VirusScan examine them for viruses. Q: I am having trouble installing Service Pack 2 for Microsoft Exchange Client 5.0. Why? A: VShield uses files which the upgrade needs to write to. In order to successfully install the service pack, you must first close VShield by right-clicking the VShield icon the Windows tasktray, then selecting Exit. You will now be able to successfully run the service pack upgrade. Q: I'm running Microsoft Exchange Client 5.0, and VirusScan's On-Demand scan icons aren't showing on my taskbar. Why? A: If you're using Microsoft Exchange Client 5.0, the two Exchange On-Demand scan icons will not appear on the Windows taskbar. This is due to a limitation of Exchange. Please refer to your Exchange documentation for instructions on how to place these icons onto the taskbar within Exchange. _____________________________ CONTACTING NETWORK ASSOCIATES On December 1, 1997, McAfee Associates merged with Network General Corporation, Pretty Good Privacy, Inc., and Helix Software, Inc. to form Network Associates, Inc. You may direct all questions, comments and technical support requests to the Network Associates Customer Care department at any of the addresses or phone numbers listed below. Contact the Network Associates Customer Care department at: 1. Phone (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III Fax 3. Fax-back automated response system (408) 988-3034 Send correspondence to any of the following Network Associates locations: Network Associates Corporate Headquarters 3965 Freedom Circle McCandless Towers Santa Clara, CA 95054 Phone numbers for corporate-licensed customers: Phone: (408) 988-3832 Fax: (408) 970-9727 Phone numbers for retail-licensed customers: Phone: (972) 278-6100 Fax: (408) 970-9727 Network Associates offices outside the United States: NA Network Associates Oy Kielotie 14 B 01300 Vantaa FINLAND Phone: 358 9 836 2620 Fax: 358 9 836 26222 Network Associates AG Baeulerwisenstrasse 3 8152 Glattbrugg Switzerland Phone: 0041 1 808 99 66 Fax: 0041 1 808 99 77 Network Associates Australia Level 1, 500 Pacific Highway St. Leonards, NSW 2065 Phone: 61-2-9437-5866 Fax: 61-2-9439-5166 Network Associates Canada 139 Main Street, Suite 201 Unionville, Ontario Canada L3R 2G6 Phone: (905) 479-4189 Fax: (905) 479-4540 Network Associates Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Phone: 49 8989 43 5600 Fax: 49 8989 43 5699 Network Associates International B.V. Gatwickstraat 25 1043 GL Amsterdam The Netherlands Phone: 31 20 586 6100 Fax: 31 20 586 6101 Network Associates France S.A. 50 rue de Londres 75008 Paris France Phone: 33 1 44 908 737 Fax: 33 1 45 227 554 Network Associates International Ltd. Minton Place, Victoria Street Windsor, Berkshire SL4 1EG United Kingdom Phone: 44 (0)1753 827500 Fax: 44 (0)1753 827520 Network Associates Japan, Inc. Toranomon 33 Mori Bldg. 3-8-21 Toranomon Minato-ku, Tokyo 105-0001 Japan Phone: 81 3 5408 0700 Fax: 81 3 5408 0780 Network Associates Korea 135-090, 18th Floor, Kyoung-Am Bldg. 157-27 Samsung-Dong, Kangnam-Ku Seoul, Korea Phone: 82 2 555-6818 Fax: 82 2 555-5779 Network Associates Latin America 150 South Pine Island Road, Suite 205 Plantation, Florida 33324 Phone: (954) 452-1731 Fax: (954) 236-8031 Network Associates Portugal Rua Gen. Ferreira Marines, 10-6 C 1495 ALGES PORTUGAL Phone: 351 1 412 1077 Fax: 351 1 412 1488 Network Associates South East Asia 7 Temasek Boulevard The Penthouse #44-01, Suntec Tower One Singapore 038987 Phone: 65 430-6670 Fax: 65 430-6671 Network Associates Spain Serrano 240, Plta. -1 28016 Madrid SPAIN Phone: 34 91 458 52 21 Fax: 34 91 457 45 17 Network Associates Srl Centro Direzionale Summit Palazzo D/1 Via Brescia, 28 20063 - Cernusco sul Naviglio (MI) ITALY Phone: 39 (0)2 9214 1555 Fax: 39 (0)2 9214 1644 Net Tools Network Associates South Africa St. Andrews Meadowbrook Lane P.O. Box 7062 Bryanston 2021 South Africa Phone: 27 11 706-1629 Fax: 27 11 706-1569 Or, you can receive online assistance through any of the following resources: 1. Internet E-mail: support@nai.com 2. Internet FTP: ftp.nai.com 3. World Wide Web: http://support.nai.com 4. America Online: keyword MCAFEE 5. CompuServe: GO NAI To provide the answers you need quickly and efficiently, the Network Associates technical support staff needs some information about your computer and your software. Please have this information ready when you call: - Program name and version number - Computer brand and model - Any additional hardware or peripherals connected to your computer - Operating system type and version numbers - Network name, operating system, and version - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers or applications and their version numbers, where applicable - How to reproduce your problem: when it occurs, whether you can reproduce it regularly, and under what conditions - Information needed to contact you by voice, fax, or e-mail We also seek and appreciate general feedback. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use Network Associates products, we have established a reseller's program to provide service, sales, and support for our products worldwide. For a listing of resellers, see the resellers.txt file or contact Network Associates Customer Care for resellers near you. * FOR REPORTING PROBLEMS * Network Associates prides itself on delivering a high-quality product. If you find any problems, please take a moment to review the contents of this file. If the problem you've encountered is documented, there is no need to report the problem to Network Associates. If you find any feature that does not appear to function properly on your system, or if you believe an application would benefit greatly from enhancement, please contact Network Associates with your suggestions or concerns. * FOR ON-SITE TRAINING INFORMATION * Contact Network Associates Customer Service at (800) 338-8754. * NETWORK ASSOCIATES BETA SITE * Get pre-release software, including DAT files, through http://beta.nai.com. You will have access to Public Beta and External Test Areas. Your feedback will make a difference.