What's New in McAfee VirusScan for OS/2 v3.1.7 (3102) Copyright (c) 1992-1998 by Network Associates, Inc., and its Affiliated Companies. All Rights Reserved. Thank you for using McAfee VirusScan for OS/2. This What's New file contains important information regarding the current version of this product. Network Associates strongly recommends that you read the entire document. Network Associates welcomes your comments and suggestions. Please use the information provided in this file to contact us. ___________________ WHAT'S IN THIS FILE - New Features - Known Issue - Installation - Documentation - Frequently Asked Questions - Contacting Network Associates ____________ NEW FEATURES 1. VirusScan now scans Microsoft Excel spreadsheets for Formula-based macro viruses. It is able to detect and clean the XF/PAIX virus. 2. VirusScan now scans files embedded within Microsoft Office files (Word and Excel). When infections are detected in these embedded files, VirusScan allows you to clean, delete, or move the files. 3. VirusScan now detects mIRC script viruses by scanning files with the .INI extension. To take advantage of this new feature, update to the 3103 or later .DAT files, then use the /ALL scanning option. 4. VirusScan now has the ability to detect macro virus infections in password-protected Word 7.0 (Word for Office 95) files in all languages supported by Word. 5. VirusScan now scans files with the .VXD extension by default. * NEW VIRUSES DETECTED * The 3102 .DAT files included with VirusScan are compatible with VirusScan's v3.x engines only. The 3102 .DAT files are not intended for use with VirusScan v2.5.x products. These .DAT files detect the following 232 new viruses. Locations that have experienced particular problems with specific viruses are also identified. 500 AB6A.3500 ALAR.5088 ANDROMEDA.1140 ANTINUKE.TROJAN ANXIETY.POPPY (Internet) ANXIETY.POPPY.II (Internet) ARARA.1375 AUSPAR BANDUNG.BF BLEE.A BLEE.B BLEE.D (Internet) BLEE.E (Internet) BOOT.666 BOX.D BOX.F BREEDER.A BRR.BOO BURMA.442.D CAP.BZ CAP.CA CAP.CB CAP.CC CAP.CD CAP.CE CAP.CF CAP.CG CAP.CH CAP.CI CAP.CJ CAP.CK CAP.CL CAP.CM CAP.CN CAP.CO CAP.CP CAP.CQ CAP.CR CAP.CS CAP.CT CAP.CU CAP.CV CAP.CW CAP.CX CIUDAD.590 (Europe) CLEANUP.A (Europe) COAHUILA CONCEPT.CA CONCEPT.CB CONCEPT.CC CONCEPT.CD CONCEPT.CE COOKIE.MONSTER.TROJAN DEMON.B DENZUKO.V1526 DIAMETRIC.3514 DRIVEL EDDY.1386 EIGHT-CLOCK.A (US) ERMUA.A ERMUA.B ERMUA.C FAKE.A FEINT_7F_(BS/MBR) GOODNIGHT.M GROG.1146 HABIR.A HASSLE.B HLLP.FECI.6000 HLLT.KRILE.4608 (Internet) HLLT.KRILE.5831 (Internet) HNL.A (US) HOT.B IBLIS.252 IBLIS.252 DROPPER IVP.967 IWASHERE.710 JERUSALEM.1808.CT.B DROPPER JOHNNY.S JOHNNY.T KELA.1171 KHIZHNJAK.1011 KHIZHNJAK.509 KHIZHNJAK.565 KILLDOS.A:TW KLA.A KOMCON.A (US) KOMPU.J KYOKUSHINKAI LAPIDARIO.766 LARRY LEONARD.1194 LIGHT.A LIZARD.1967 (Portugal, US) MBR-COM.1410 MDMA.AO MDMA.AP MDMA.AQ MDMA.AR MDMA.AS MINIMAL.AA MINIMAL.Y MINIMAL.Z MIRC/7TH_SPERE MIRC/REPRO_V1 MUCK.AP MUCK.AQ MULTI MWIM.BOO NGKOEN NICEDAY.P NICEDAY.Q NIKNAT.D NIKNAT.E NIKNAT.F NIKNAT.G NJVCK2.D NJVCK2.E NJVCK2.F NJVCK2.G NJVCK2.H NJVCK2.I NJVCK2.J NJVCK2.K NJVCK2.L NJVCK2.M NJVCK2.N NO2.A (TWNO variant) (Taiwan) NOP.R:BR NOP.S:ES NOP.T:IT NOSTARDAMUS.3584 NPAD.FD NPAD.FE NPAD.FF NPAD.FG NPAD.FH NPAD.FI NPAD.FJ NPAD.FK NPAD.FL NPAD.FM NPAD.FN NPAD.FO NPAD.FP NPAD.FQ NPAD.FR NPAD.FS NPAD.FT NPAD.FU NPAD.FV NPAD.FW NPAD.FX NPAD.FY ORPHAN.174 PASTIK.2049 PAYCHECK.J PAYCHECK.K PINGPONG.M PRESIDENT.MP.1504 RAZER.B SARCOMA.1328 SCHUMANN.G (Europe) SCHUMANN.H (Europe) SCHUMANN.I SCHUMANN.J (Europe) SCHUMANN.L (Europe) SEEYOU SHOWOFF.CN SHOWOFF.CO SHOWOFF.CP SHOWOFF.CQ SHOWOFF.CR SHOWOFF.CS SILLYC.124 SILLYC.144 SILLYC.166 SILLYC.169 SILLYC.264 SILLYC.302 SILLYC.331 SILLYC.343 SILLYC.498 SILLYC.511 SILLYC.563 SILLYC.626 SILLYC.657 SPHINX.2520 SPHINX.2536 SPHINX.2548 SWISS_BOOT (Switzerland) SWISS_BOOT_2 (Switzerland) SWLABS.H TAGUCHI.A (Brazil) TALON.L TEDY.4350 TEMPLE.L TPVO.3463 TPVO.3626 TPVO.3654 TPVO-OPEN.1569 TRASH.B TROUT.6787 TWNO.AB:TW VAMPIRE.K:TW VAMPIRE.L/M:TW VHDL.B:TW VIENNA.BETABOYS DROPPER WAZZU.DM WAZZU.DN WAZZU.DP WAZZU.DQ WAZZU.DR XF/PAIX.A (Requires 3.1.6 engine or later) XM/LAROUX.AF XM/LAROUX.AH XM/LAROUX.AP XM/LAROUX.BC XM/LAROUX.BE XM/LAROUX.BG XM/LAROUX.BH XM/LAROUX.BI XM/LAROUX.BJ XM/LAROUX.BK XM/LAROUX.BL XM/LAROUX.BM XM/LAROUX.BN XM/LMV.A (TROJAN) XM/NINJA.D (Japan) XM/NOCAL.A (Japan) ZHENGZHOU.3584.B * NEW VIRUSES CLEANED * These .DAT files clean the following 167 new viruses: ANDROMEDA.1140 BANDUNG.BF BLEE.A BLEE.B BLEE.D (Internet) BLEE.E (Internet) BOX.F BREEDER.A CAP.BZ CAP.CA CAP.CB CAP.CC CAP.CD CAP.CE CAP.CF CAP.CG CAP.CH CAP.CI CAP.CJ CAP.CK CAP.CL CAP.CM CAP.CN CAP.CO CAP.CP CAP.CQ CAP.CR CAP.CS CAP.CT CAP.CU CAP.CV CAP.CW CAP.CX CIUDAD.590 (Europe) CLEANUP.A (Europe) COAHUILA CONCEPT.CA CONCEPT.CB CONCEPT.CC CONCEPT.CD CONCEPT.CE DEMON.B DIAMETRIC.3514 EIGHT-CLOCK.A (US) ERMUA.A ERMUA.B ERMUA.C FAKE.A FEINT_7F_(BS/MBR) GOODNIGHT.M GROG.1146 HABIR.A HASSLE.B HNL.A (US) HOT.B IBLIS.252 IBLIS.252 DROPPER IWASHERE.710 JERUSALEM.1808.CT.B DROPPER JOHNNY.S JOHNNY.T KILLDOS.A:TW KLA.A KOMCON.A (US) KOMPU.J LARRY LEONARD.1194 LIZARD.1967 (Portugal, US) MDMA.AP MDMA.AQ MDMA.AR MDMA.AS MINIMAL.Y MINIMAL.Z MINIMAL.AA MUCK.AP MUCK.AQ MWIM.BOO NICEDAY.P NICEDAY.Q NIKNAT.E NIKNAT.F NIKNAT.G NJVCK2.D NJVCK2.E NJVCK2.F NJVCK2.G NJVCK2.H NJVCK2.I NJVCK2.J NJVCK2.K NJVCK2.L NJVCK2.M NJVCK2.N NO2.A (TWNO variant) (Taiwan) NOP.R:BR NOP.S:ES NOP.T:IT NPAD.FD NPAD.FE NPAD.FF NPAD.FG NPAD.FH NPAD.FI NPAD.FJ NPAD.FK NPAD.FL NPAD.FM NPAD.FN NPAD.FO NPAD.FP NPAD.FQ NPAD.FR NPAD.FS NPAD.FT NPAD.FU NPAD.FV NPAD.FW NPAD.FX NPAD.FY PAYCHECK.J PAYCHECK.K RAZER.B SARCOMA.1328 SCHUMANN.G (Europe) SCHUMANN.H (Europe) SCHUMANN.J (Europe) SCHUMANN.L (Europe) SHOWOFF.CN SHOWOFF.CO SHOWOFF.CP SHOWOFF.CQ SHOWOFF.CR SHOWOFF.CS SWISS_BOOT (Switzerland) SWISS_BOOT_2 (Switzerland) SWLABS.H TAGUCHI.A (Brazil) TALON.L TEDY.4350 TEMPLE.L TRASH.B TWNO.AB:TW VAMPIRE.K:TW VAMPIRE.L/M:TW VHDL.B:TW VIENNA.BETABOYS DROPPER WAZZU.DM WAZZU.DN WAZZU.DP WAZZU.DQ WAZZU.DR XM/LAROUX.AF XM/LAROUX.AP XM/LAROUX.BC XM/LAROUX.BE XM/LAROUX.BG XM/LAROUX.BH XM/LAROUX.BI XM/LAROUX.BJ XM/LAROUX.BK XM/LAROUX.BL XM/LAROUX.BM XM/LAROUX.BN XM/LMV.A (TROJAN) XM/NINJA.D (Japan) XM/NOCAL.A (Japan) ___________ KNOWN ISSUE 1. VirusScan's delete and move operations are not currently supported for infected objects detected within Microsoft Office binder files. ____________ INSTALLATION * INSTALLING THE PRODUCT * Perform procedure 1 to use the installable version of VirusScan for OS/2, or procedure 2 to use the non-installable version. 1. For the installable version of VirusScan for OS/2, take these steps: a. Execute the INSTALL.CMD program. b. Follow the on-screen instructions. By default, the installation program makes a directory on the hard disk drive named C:\NETA\OS2SCAN and copies the program files to that directory. The installation script also adds the directory to the path statement in your AUTOEXEC.BAT file and adds one line to the file that references the VShield program to provide on-access virus protec- tion. For the most complete virus protection, Network Associates recommends using the /ANYACCESS switch. or 2. For the non-installable version of VirusScan for OS/2, take these installation steps: a. Make a directory on your hard disk drive. b. Copy the files to that directory. c. Add that directory to the path statement in your AUTOEXEC.BAT file. * PRIMARY PROGRAM FILES FOR VIRUSSCAN FOR OS/2 * Files located in the Install directory: ======================================= OS2SCAN.EXE = VirusScan for OS/2 program CLEAN.DAT = Virus clean definition data NAMES.DAT = Virus names definition data SCAN.DAT = Virus scan definition data OS2VAL.EXE = Network Associates OS/2 file validation program README.1ST = License and registration information PACKING.LST = Packing list WHATSNEW.TXT = What's New document PH_OS2PL.EXE = OS/2 process monitoring daemon RESELLER.TXT = Network Associates authorized resellers * TESTING YOUR INSTALLATION * The Eicar Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to come up with one standard by which customers can verify their anti-virus installations. To test your installation, copy the following line into its own file and name it EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* When done, you will have a 69- or 70-byte file. When VirusScan is applied to this file, SCAN will report finding the EICAR-STANDARD-AV-TEST-FILE virus. It is important to know that THIS IS NOT A VIRUS. However, users often have the need to test that their installations function correctly. The anti-virus industry, through the European Institute for Computer Antivirus Research, has adopted this standard to facilitate this need. Please delete the file when installation testing is completed so unsuspecting users are not unnecessarily alarmed. * UNINSTALLING THE PRODUCT * 1. Execute VSHIELD /REMOVE to remove VShield from memory, then remove the files from your hard disk drive and remove any lines in your AUTOEXEC.BAT file that reference VShield. If an error message is displayed indicating that VShield cannot be removed from memory, take the next step. 2. Edit your AUTOEXEC.BAT file and remove the lines that reference VShield, then reboot your system. Upon restarting your system, VShield will not be loaded into memory and you can remove the files from your hard disk drive. Note: If the files are removed from your hard disk drive prior to removing VShield from memory, an error message will be displayed until you remove VShield from memory or restart your system. _____________ DOCUMENTATION For more information, refer to the VirusScan User's Guide, included on the CD-ROM version of this program or available from the Network Associates BBS and FTP site. This file is in Adobe Acrobat Portable Document Format (.PDF) and can be viewed using Adobe Acrobat Reader. This form of electronic documentation includes hypertext links and easy navigation to assist you in finding answers to questions about your Network Associates product. Adobe Acrobat Reader is available on CD-ROM in the ACROREAD subdirectory. Adobe Acrobat Reader also can be downloaded from the World Wide Web at: http://www.adobe.com/Acrobat/readstep.html VirusScan documentation can be downloaded from the Network Associates BBS or the World Wide Web at: http://www.nai.com For more information on viruses and virus prevention, see the McAfee Virus Information Library, MCAFEE.HLP, included on the CD-ROM version of this product or available from the Network Associates BBS or FTP site. A ViaGrafix Interactive Anti-virus Training program also is available on the CD-ROM version, or can be purchased from the Network Associates website. __________________________ FREQUENTLY ASKED QUESTIONS Regularly updated lists of frequently asked questions about Network Associates products also are available on the Network Associates BBS, website, and CompuServe and AOL forums. Q: How do I enable the centralized alerting and reporting option? A: VirusScan now supports centralized alerting and report- ing to a remote NetWare or Windows NT server running NetShield for Windows NT v2.5.3 or NetShield for NetWare v2.3.3 and later. To set up this option on your VirusScan client, use the /ALERTPATH option, where the is the path to the remote NetWare volume or NT directory. From this directory, NetShield can broadcast or compile the alerts and reports according to its established configuration. NOTE: The client must have write access to this location and the directory must contain the NetShield-supplied CENTALRT.TXT file. To send a complete alerting file that identifies the system and user, establish the following environment variables, or add them to the AUTOEXEC.BAT file for DOS and CONFIG.SYS for OS/2. Set COMPUTERNAME= Set USERNAME= The alert file sent to the server is an .alr text file. Upon receipt of the alert file, NetShield NT or NetShield for NetWare sends an alert message to an administrator and/or appropriate personnel. Q: I have created my own DOS Emergency diskette. How can I optimize its performance? A: For optimal performance, create a CONFIG.SYS file on the boot diskette and add the following lines: [CONFIG.SYS] DEVICE=HIMEM.SYS DOS=HIGH Also, add the HIMEM.SYS file from the DOS directory to the boot diskette. Note: For detailed instructions on creating an Emergency diskette, refer to the instructions outlined in your online documentation. Q: Does VirusScan for OS/2 detect Word Macro viruses? A: Yes, it detects Macro viruses with the same accuracy as other Network Associates anti-virus software. Q. Is there a VShield program that works in OS/2? A: There is no constant TSR-type protection available in OS/2. Included in the package is the DOS/Windows version of VShield, but it is only active while the system is running a DOS or Windows session. Q: Is there a Graphical User Interface (GUI) for VirusScan for OS/2? A: No. There is no GUI. OS/2 is a command line controlled product only. Q: Can I update VirusScan's data files to detect new viruses? A: Yes. If you have Internet access, you can download updated VirusScan data files from the Network Associates website, BBS, or other online resources. To download from the Network Associates website, follow these steps: 1. Go to the Network Associates website (http://www.nai.com). 2. Click the Download tab. 3. Click Update Virus DAT Files, then click Download Virus DAT File. 4. Follow the on-screen downloading instructions. 5. Data file updates are stored in a compressed form to reduce transmission time. Unzip the files into a temporary directory, then copy the files to the appropriate directory, replacing your old files. 6. Before performing any scans, shut down your computer, wait a few seconds, and turn it on again. If you need additional assistance with downloading, contact Network Associates Download Support at (408) 988-3832. _____________________________ CONTACTING NETWORK ASSOCIATES * FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS * Contact the Network Associates Customer Care department: 1. Corporate-licensed customers, call (408) 988-3832 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time Retail-licensed customers, call (972) 278-6100 Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time 2. Fax (408) 970-9727 24-hour, Group III fax 3. Fax-back automated response system (408) 988-3034 24-hour fax Send correspondence to any of the following Network Associates locations: Network Associates Corporate Headquarters 2805 Bowers Avenue Santa Clara, CA 95051-0963 Network Associates Canada 139 Main Street, Suite 201 Unionville, Ontario Canada L3R 2G6 Network Associates Europe B.V. Gatwickstraat 25 1043 GL Amsterdam The Netherlands Network Associates International Ltd. Minton Place, Victoria Street Windsor, Berkshire SL4 1EG United Kingdom Network Associates France S.A. 50 rue de Londres 75008 Paris France Network Associates Deutschland GmbH Industriestrasse 1 D-82110 Germering Germany Network Associates Japan Co, Ltd. Toranomon 33 Mori Bldg. 3-8-21 Toranomon Minato-Ku, Tokyo 105 Japan Network Associates Korea 135-090, 18th Fl., Kyoung Am Bldg. 157-27 Samsung-Dong, Kangnam-Ku Seoul, Korea Network Associates South East Asia 7 Temasek Boulevard The Penthouse #44-01, Suntec Tower One Singapore 038987 Network Associates Australia Level 1, 500 Pacific Highway St. Leonards, NSW 2065 Australia Network Associates Latin America 150 South Pine Island Road, Suite 205 Plantation, FL 33324 USA Or, you can receive online assistance through any of the following resources: 1. Bulletin Board System: (408) 988-4004 24-hour US Robotics HST DS 2. Internet e-mail: support@nai.com 3. Internet FTP: ftp.nai.com 4. World Wide Web: http://www.nai.com 5. America Online: keyword MCAFEE 6. CompuServe: GO MCAFEE Before contacting Network Associates, please make note of the following information. When sending correspondence, please include the same details. - Program name and version number - Type and brand of your computer, hard drive, and any peripherals - Operating system type and version - Network name, operating system, and version - Contents of your AUTOEXEC.BAT, CONFIG.SYS, and system LOGIN script - Network card installed, where applicable - Modem manufacturer, model, and baud, where applicable - Relevant browsers/applications and version number, where applicable - Problem - Specific scenario where problem occurs - Conditions required to reproduce problem - Statement of whether problem is reproducible on demand - Your contact information: voice, fax, and e-mail Other general feedback is also appreciated. Documentation feedback is welcome. Send e-mail to documentation@nai.com. * FOR ON-SITE TRAINING INFORMATION * Contact Network Associates Customer Service at (800) 338-8754. * FOR PRODUCT UPGRADES * To make it easier for you to receive and use Network Associates products, we have established a Reseller program to provide service, sales, and support for our products worldwide. For a listing of resellers, see the file RESELLER.TXT, where applicable, or contact Network Associates Customer Service for a reseller near you. * NETWORK ASSOCIATES BETA SITE * Get pre-release software, including .DAT files, through http://beta.nai.com/public/datafiles. You will have access to Public Beta and External Test Areas. Your feedback CAN make a difference.