What's New in VirusScan for Windows 95 v2.0.5 (9608)
         Copyright 1994-1996 by McAfee, Inc.
                All Rights Reserved.

                
Thank you for using McAfee's VirusScan for Windows 95. 
This What's New file contains important information 
regarding the current version of this product. It is 
highly recommended that you read the entire document.

McAfee welcomes your comments and suggestions. Please 
use the information provided in this file to contact us.

___________________
WHAT'S IN THIS FILE

- New Features
- Known Issues
- Installation
- Documentation
- Frequently Asked Questions
- Additional Information
- Contact McAfee

____________
NEW FEATURES
 
1.  The new Administrator Mode provides the ability
    to lock VirusScan95 configuration settings.
   
2.  VirusScan95 configuration files have been enhanced. 
    Right-clicking on a VirusScan configuration
    file (VSC) displays the file's properties and two
    new tabs: Options and Actions. One of the new
    properties is Start Automatically, located in the
    Options tab. Start Automatically is necessary for
    scheduled scanning from the optional System
    Agent and for Startup group on-demand scanning.


* NEW VIRUSES DETECTED *
 
This DAT file (9608) detects the 278 new viruses
listed below.

-  Detection for 258 viruses was incorporated from
   DAT file 9607.
-  Detection for 20 new macro viruses was added.  

Also, locations that have experienced problems with
a particular virus are identified.
 
_751
3DEVIL.A
3DEVIL.B
ACE.1872
AGA.3000
AHAV.336
AIDS.872
ALEVIRUS.690              (Brazil)
ALEVIRUS.1613             (Brazil)
ALFONS.1536
ANARKEY.475
ANDREW
AOS.833
AOS.847
AOS.854
ASMO.1800
AT.1648
ATC-321
AVATAR.POSITRON.512
BABOSE
BADTOWN.684
BADTOWN.687
BE.451.B
BIGDEATH.1153
BISHDKEY.4160 (*)
BISHK.319
BISHKEKE.4240 (*)
BISHOP.4240 (*)
BLACKTIDE.2419
BLAD.1015
BLTD.2419
BODY.884
BUGS.282
CEIB.4629
CHER.2266
CIVIL IV.586
CMOS_DEATH.B
COMPIAC.379
CONCEPT.E
CONJURER
CONZOULE.240
CORDOBES.3334             (Uruguay)
COSENZA.3205
CRAZYFROG.1477
CREEPER.252
CRITTER.1015
CROATIA.683
DARK_APOCALYPSE.1600.B
DARK_REVENGE.1024
DAYTON.792
DEADWIN.1228              (Bolivia)
DEDA.1000
DEI.1780
DELTA.1163                (Brazil)
DFLKFD
DIALOGOS.1350
DIALOGOS.1522
DONB.444
DRD-4634
DRUID.1888
DVA.445
DVA.749
EATRITCH.946
EI-CUAREIM.800
ENJOY
EPSILON.513
EUSK.811
EVC.161.D
EXORCIST.212
FINDME
FINPOLY.2368 (*)
FIZZLE.313
FLYING.633
GATE
GOSH.1831
GRREP
H8.1173
HARE.7610 (*)             (Internet)
HARE.7750 (*)             (Internet)
HARE.7786 (*)
HH
HI.680
HI.764
HI.802
HLLC.4528 (*)
HLLC.5000 (*)
HLLC.8224 (*)
HLLC.12573 (*)
HLLC.14880 (*)
HLLC.AIDS.8064 (*)
HLLC.BOLEK.8096 (*)
HLLC.CRAWEN.8306 (*)      (Italy)
HLLC.CRAWEN.8516 (*)
HLLC.CUMULUS (*)
HLLC.EIB.5000 (*)
HLLC.ENRICO (*)
HLLC.EVEN.PC (*)
HLLC.EVENBEEP.B (*)
HLLC.KRAD.4658 (*)
HLLC.LANC.7376 (*)
HLLC.TREE2.14186 (*)
HLLC.VSW.5936 (*)
HLLC.WORM.16412 (*)
HLLC.XMAS.15264 (*)
HLLO.3008 (*)
HLLO.3855 (*)
HLLO.4032 (*)
HLLO.4317.B (*)
HLLO.4734 (*)
HLLO.4830 (*)
HLLO.5760 (*)
HLLO.6144 (*)
HLLO.BIG&FAT.6561 (*)
HLLO.CRASH.7227 (*)
HLLO.F-SOFT.3521 (*)
HLLO.FU.8608 (*)
HLLO.HEPATITUS (*)
HLLO.KAMIKAZE (*)
HLLO.TU.4752 (*)
HLLO.VSW.3836 (*)
HLLO.VSW.4017 (*)
HLLP.3678 (*)
HLLP.5792 (*)
HLLP.5824 (*)
HLLP.7408 (*)
HLLP.7529 (*)
HLLP.7808 (*)
HLLP.15392 (*)
HLLP.BDAAGWA.4984 (*)
HLLP.BISHKEK.4160 (*)
HLLP.BISHKEK.4240 (*)
HLLP.BWA.4984 (*)
HLLP.CEIB.4629 (*)
HLLP.CHSU.4484 (*)
HLLP.DUPALEC (*)
HLLP.KASIENKA.8192 (*)
HLLP.NOTFOUND.6176 (*)
HLLP.RANGEL.5000 (*)
HLLP.RUNNER.9312 (*)
HLLP.SAURON.4568 (*)
HLLP.SON.4731 (*)
HLLP.UPI.4641 (*)
HLLP.VOVA.12560 (*)
HORSA.1185
HUE.482
ID.248
IMI.1536.H
IMMORTAL.2185
IVP.667
I_LOVE_D.3618
JASI.666
JULY_29TH
JUNKIE.1308
KALN.3225
KALN.3612
KASIUNIA
KBWI.1349
KERS.923
KONKOOR.3072
KOSKO.313
KUNS.168
KWX.1458
LAB
LEATH
LEDA.820
LINC.196
LINC.307
LOSL.535
LYUBA.381
MAD.2631
MADMAX.507
MAR.1972.D
MARVIN
MARYR
MDMA                      (Texas, Illinois, Georgia)
MESSAN.B
MG.500.C
MICROB.431
MIPT-PHYSTECH.2000
MIREA.703
MOJHOO.1405
MRTI.576
MTZ-PINK
NADO.LOVE.602
NADO.REDV.584
NEXIV
NICHOLS
NO5.1235
NUCLEAR.B
PC KNIGHT.2083            (Europe)
PCW:DE                    (Europe)
PEMPE.1811                (France)
PHANTOM1 (*)
PIZELUN.3599
PMM.575
PRES.7760
PRIMUS.512
PRIMUS.528
PS-MPC.AOS
QRES.224
RADYUM.503
RENE.4509
RETALIATOR.1535.A
RETALIATOR.1535.B
RIOT.304
RIOT.IR8.928
RIOT.MARI.1125
ROMA
RUSSEL.3072
SANDRA.1809
SENORITA.885              (Europe)
SEPULTURA:MTE
SHELL.10634               (Australia)
SHIRE.117
SILLYC.96
SILLYC.115.B
SILLYC.186
SILLYC.208
SILLYC.228
SILLYC.710
SINAI.1208
SIRIUS.ALIVE.4000
SMEG.V0_3.DEMO.B
STEALTH.F
STONED.KILL
STRAT.486
STRIKE
SZATAN
TANKAR.236
TCHECHNYA.1919
TIMID.497
TORNADO.759
TPED.1760
TRIVIAL.35.B
TRIVIAL.44.D
TRIVIAL.86
TRIVIAL.963
TRIVIALSMEG
UFO.1468
UNGAME.823
UPI.4641
VCL.O.610
VIV 524
VOYAGER.1134
VOYAGER2.508
VSV.3836
VSW.3966
VSW.4017
VSW.5063
VSW.5176
VSW.5936
WASP.1312
WRLK.1672
ZIBBERT.1268              (Brazil)
ZNOS.1730
ZNOSK.509
ZYX.5739
(*) Requires VirusScan for Windows 95 2.0.5 engine

Detection for the following 20 new macro viruses
was added in DAT file 9608. Locations that have
experienced problems with a particular virus are
identified.

BOOM:DE (**)
COLORS.D
CONCEPT.G                 (US)
CONCEPT.H
DIVINA                    (Italy)
DOGGIE
FRIENDLY:DE (**)
GUESS
IMPOSTER.B
IRISH
KILLDLL
LBYNJ:DE (**)
MADDOG                    (US)
NF
NPAD                      (Pacific Rim)
REFLEX             
SATANIC                   (Internet)
WAZZU.B                   (US)
WAZZU.C
WAZZU.D                   (US)
(**) Some viruses can only spread in the Word for Windows
     environment of specific localized languages, denoted
     by a colon and two letters following the virus name.
     The viruses indicated above, followed by :DE, can
     only spread in the German Word for Windows
     environment.


* NEW VIRUSES REMOVED *
 
This DAT file (9608) removes the 55 new viruses listed
below.

-  Removal of 35 viruses was incorporated from
   DAT file 9607.
-  Removal of 20 new macro viruses was added.  

Also, locations that have experienced problems with
a particular virus are identified.
 
_751
ALEVIRUS.690              (Brazil)
ALEVIRUS.1613             (Brazil)
ALFONS.1344
CONCEPT.E                 (Belgium)
DARK_REVENGE.1024
DEADWIN.1228              (Bolivia)
DELTA.1163                (Brazil)
DEMON3B.5610 (*)          (Europe)
DIGI.3547 (*)             (Czech Republic)
EPSILON.513
FITW.7924/7448 (*)        (Europe)
H8.1173
HARE.7610 (*)             (Internet)
HARE.7750 (*)             (Internet)
HARE.7786 (*)
HLLC.CRAWEN.8306          (Italy)
IMMORTAL.2185
KARNIVALI.1972            (US - East Coast)
LEDA.820
MDMA                      (Texas, Illinois, Georgia)
NATAS.4926
NUCLEAR.B
PC KNIGHT.2083            (Europe)
PCW:DE
PEMPE.1811                (France)
RUSSEL.3072 (*)
SILLYC.96
SILLYC.186
SILLYC.710
SIRIUS.ALIVE.4000
SKATER.819                (Australia)
VCL.O.702                 (Internet)
VOYAGER.1134
ZIBBERT.1268        (Brazil)
(*) Requires VirusScan for Windows 95 2.0.5 engine

DAT file 9608 removes the following 20 new macro
viruses. Locations that have experienced problems
with a particular virus are identified.

BOOM:DE (**)
COLORS.D
CONCEPT.G                 (US)
CONCEPT.H
DIVINA                    (Italy)
DOGGIE
FRIENDLY:DE (**)
GUESS
IMPOSTER.B
IRISH
KILLDLL
LBYNJ:DE (**)
MADDOG                    (US)
NF
NPAD                      (Pacific Rim)
REFLEX             
SATANIC                   (Internet)
WAZZU.B                   (US)
WAZZU.C
WAZZU.D                   (US)
(**) Some viruses can only spread in the Word for Windows
     environment of specific localized languages, denoted
     by a colon and two letters following the virus name.
     The viruses indicated above, followed by :DE, can
     only spread in the German Word for Windows
     environment.

____________
KNOWN ISSUES

1.  VirusScan95 appears to continue scanning after
    clicking STOP. If this occurs, move the VirusScan95 
    window to reveal the DynaZip UnZip Error window.
    Click OK and respond appropriately to the dialog
    box.
  
2.  Files with the "-" (dash) character in the filename that
    are compressed in Zipped files will not be scanned by
    the on-demand scanner.

3.  When a macro virus is detected in conjunction with
    other viruses, the macro virus remover will not work.
    If this occurs, remove the other virus first or work
    in a separate area.

4.  Windows 95 no longer requires MS-DOS memory managers. 
    Using MS-DOS memory managers may cause VirusScan95
    to falsely detect viruses in memory. To eliminate
    false warnings, remark (Rem) the memory manager lines
    from your CONFIG.SYS to deactivate them.

____________
INSTALLATION         

* PRIMARY PROGRAM FILES FOR VIRUSSCAN95 *

Files located in the Install directory:
=======================================

1.  Installed for VShield/Scan95/DOS:

      README.1ST = McAfee information
        SCAN.DAT = Virus scan definition data
       NAMES.DAT = Virus names definition data
       CLEAN.DAT = Virus clean definition data
    VALIDATE.EXE = McAfee file validation program
    CHKVSH32.EXE = VShield virtual device driver
                   checking utility
     PACKING.LST = Packing list 
    UINSTALL.EXE = Uninstall program
    WHATSNEW.TXT = What's New document
     VSUINST.EXE = Uninstall assistant
      UPDATE.MSG = Update message file


2.  Installed for VShield/Scan95:

      DPMI16.DLL = 16-bit DOS protected mode
                   interface library
      DPMI32.DLL = 32-bit DOS protected mode
                   interface library
    MCKRNL95.DLL = Library files
    MCUTIL95.DLL = Library files
    MCSCAN32.DLL = Library files          


3.  Installed for VShield:

    VSHCFG32.EXE = VShield configuration manager
    VSHWIN32.EXE = Detection engine
     DEFAULT.VSH = Default VShield settings


4.  Installed for Scan95:

      SCAN95.EXE = VirusScan95 program
    SHUTIL95.DLL = Run-time support library   
      DZIP32.DLL = File compression library
    DUNZIP32.DLL = File decompression library
     DEFAULT.VSC = Default Scan95 settings 

                
5.  Installed for DOS:

        SCAN.EXE = MS-DOS scan program
  

Files located in WINDOWS\SYSTEM directory:
==========================================

1.  Installed for VShield/Scan95:

      MCKRNL.VXD = Detection virtual device driver
    MCSCAN32.VXD = Detection virtual device driver
      MCUTIL.VXD = Support virtual device driver


2.  Installed for VShield:

     VSHIELD.VXD = Detection virtual device driver


3.  Installed for Scan95:

      S95EXT.DLL = Shell extension


Files located in the WINDOWS\HELP directory:
============================================ 

1.  Installed for VShield:

    VSHLDCFG.HLP = VShield help


2.  Installed for Scan95:

     SCANEXT.HLP = Scan95 Extension help
    VIRUSCAN.HLP = VirusScan help
    VIRUSCAN.CNT = VirusScan context-sensitive help 

Note: WINDOWS refers to the directory to which Windows 95
is installed, not the Windows 3.1x directory.

         
* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined 
effort by anti-virus vendors throughout the world to 
come up with one standard by which customers can verify 
their anti-virus installations. To test your 
installation, copy the following line into its own 
file and name it EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

When done, you will have a 69 or 70 byte file.

When VirusScan is applied to this file, SCAN will report 
finding the EICAR-STANDARD-AV-TEST-FILE virus.

It is important to know that THIS IS NOT A VIRUS.
However, users often have the need to test that their 
installations function correctly. The anti-virus industry, 
through the European Institute for Computer Antivirus 
Research, has adopted this standard to facilitate this need.

Please delete the file when installation testing is completed
so unsuspecting users are not unnecessarily alarmed.

_____________
DOCUMENTATION

For more information, refer to the User's Guide, included 
on the CD-ROM versions of this program or available 
from McAfee's BBS and FTP site. This file is in Adobe Acrobat 
Portable Document Format (.PDF) and can be viewed using Adobe 
Acrobat Reader. This form of electronic documentation includes 
hypertext links and easy navigation to assist you in finding 
answers to questions about your McAfee product.

Adobe Acrobat Reader is available on CD-ROM in the ACROREAD
subdirectory. Adobe Acrobat Reader also can be downloaded 
from the World Wide Web at:

http://www.adobe.com/Acrobat/readstep.html

VirusScan documentation can be downloaded from McAfee's BBS
or the World Wide Web at:

http://www.McAfee.com or 205.227.129.97

For more information on viruses and virus prevention,
see the McAfee Virus Information Library, MCAFEE.HLP,
included on the CD-ROM version of this product or
available from McAfee's BBS and FTP site. A ViaGraphix
Interactive Anti-virus Training program also is
available on the CD-ROM version, or can be purchased
from the McAfee Web Site.

__________________________
FREQUENTLY ASKED QUESTIONS 

Regularly updated lists of frequently asked questions 
about McAfee products also are available on McAfee's 
BBS, website, and CompuServe and AOL forums.

Q:  How do I scan multiple drives?

A: #1  VirusScan95 can scan many locations simultaneously.
       To do this, take these steps:
       1.  Launch Explorer.
       2.  Highlight the drives or folders you want to
           scan.
       3.  Right-click to reveal the Context Menu.
       4.  Select Scan for Viruses.
       5.  Click Scan Now to begin scans.

A: #2  Enter LocalDrives or NetworkDrives in the 
       Scan In text dialog on the Where & What property
       page. Click Scan Now and all LocalDrives or all
       NetworkDrives will be scanned.


Q:  I moved a VSC file to my Startup folder.
    Whenever I turn on my PC, it launches VirusScan95,
    but it does not begin scanning. How can I make it
    start scanning automatically?

A:  You need to customize your options. Take these
    steps:

    1.  Navigate to the location of the saved VSC file.
    2.  While pointing to the VSC file, right-click to
        reveal the Context Menu.
    3.  From the Context Menu, select Properties.  
    4.  Select the Options Tab on the property sheet. 
    5.  Check the Start Automatically box.

    By enabling this option, scanning will begin 
    automatically. If viruses are not detected, 
    VirusScan95 will automatically close and free up 
    system resources.


Q:  When VirusScan95 is launched, how does it determine
    the default settings?

A:  VirusScan95 default settings may be found in the 
    DEFAULT.VSC file located in the install directory. 


Q:  My executable files were set to shareable and read-only
    before I ran VirusScan95, now they are read-only. How
    can I retain the shareable attribute?

A:  Mark the files Execute Only. Then create a dummy account
    called SCAN on the server and grant only Read and
    Filescan rights to that account. Log in as SCAN before
    scanning your Novell volumes.


Q:  Can I update VirusScan's data files to detect
    new viruses?

A:  Yes. If you have Internet access, you can download
    updated VirusScan data files from the McAfee Web 
    Site, BBS, or other online resources. To download 
    from the McAfee Web Site, follow these steps:

    1.  Go to the McAfee Web Site (http://www.mcafee.com
        or 205.227.129.97).

    2.  Click on the Download McAfee button.

    3.  Scroll down, and select either McAfee for Home
        (for personal evaluation copies) or McAfee 
        for Business (for corporate evaluation copies).
        If you select McAfee for Business, you will be
        asked to provide some contact information. Use
        Tab to move from line to line within the form.

    4.  Click on either Evaluation Copies of McAfee
        Products or the McAfee Public Beta Site.

    5.  Click on Anti-virus, then select Index.txt to
        view descriptions of the products available on
        this site. Find the most recent virus data file
        for your product.

    6.  Return to the Anti-virus page and click on the
        file. Download the file by saving it to your
        Desktop.

    7.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the files to the
        appropriate directory, replacing your old files.

    8.  Before performing any scans, shut down your computer,
        wait a few seconds, and turn it on again.

    If you need additional assistance with downloading, 
    contact McAfee Download Support at (408) 988-3832.

______________________
ADDITIONAL INFORMATION

The new Administrative Mode feature allows System
Administrators to lock VirusScan95 configurations on
users' systems. To use this feature, take the following
steps:

1.  Start VirusScan95 by double-clicking on the
    VirusScan icon.

2.  Press and hold the Ctrl+Shift+Alt keys and
    double-click the magnifying glass icon.

3.  Open the File menu.

4.  Select Administrator Mode.

    a.  Enter a new password.
    b.  Confirm your new password.
     
5.  Choose your configurations from the What & Where,
    Actions, and Reports tabs.        

6.  To retain these settings as an individual custom
    configuration file, save the file to the desktop
    or Program Menu for execution. Context-sensitive
    scanning (right-clicking) will draw upon the
    original DEFAULT.VSC configuration file and scan
    the selected item with the pre-established default
    settings.

7.  To establish your configuration as the default
    setting, save the new settings by overwriting
    C:\PROGRAM FILES\MCAFEE\VIRUSSCAN95\DEFAULT.VSC

8.  After saving your configuration and leaving
    Administator Mode or closing VirusScan95, the
    optional settings will be locked and cannot be
    altered without knowledge of the access keys,
    hotspot, and established password.
                 
9.  To view and confirm your changes, restart
    VirusScan95 from the shortcut if you overwrote the
    DEFAULT.VSC file or from your saved configuration
    file (VSC). To alter your configuration settings
    or make additional changes, repeat this process. 

______________
CONTACT McAFEE

* FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS *

Contact McAfee's Customer Care department: 

1.  Call (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III fax 
		
3.  Fax-back automated response system (408) 988-3034
    24-hour fax

Send correspondence to any of the following McAfee
locations.
    	
    McAfee Corporate Headquarters		
    2710 Walsh Avenue			
    Santa Clara, CA 95051-0963		
	
    McAfee East Coast Office					
    Jerral West Center
    766 Shrewsbury Avenue
    Tinton Falls, NJ 07724-3298

    McAfee Central Office			
    5944 Luther Lane, Suite 117		
    Dallas, TX 75225				
						
    McAfee Canada
    178 Main Street
    Unionville, Ontario
    Canada L2R 2G9

    McAfee Europe B.V.			
    Orlyplein 81 - Busitel 1		
    1043 DS Amsterdam				
    The Netherlands	 		

    McAfee (UK) Ltd.
    Hayley House, London Road
    Bracknell, Berkshire  RG12 2TH
    United Kingdom 

    McAfee France S.A.			
    50 rue de Londres				
    75008 Paris					
    France					
				
    McAfee Deutschland GmbH
    Industriestrasse 1
    D-82110 Germering
    Germany

Or, you can receive online assistance through any of the 
following resources:

1.  Bulletin Board System: (408) 988-4004
    24-hour US Robotics HST DS

2.  Internet e-mail: support@mcafee.com

3.  Internet FTP: ftp.mcafee.com or 205.227.129.134

4.  World Wide Web: http://www.mcafee.com or 205.227.129.97

5.  America Online: keyword MCAFEE

6.  CompuServe: GO MCAFEE

7.  The Microsoft Network: GO MCAFEE

Before contacting McAfee, please make note of the following 
information. When sending correspondence, please include 
the same details.

- Program name and version number
- Type and brand of your computer, hard drive, and any 
  peripherals
- Operating system type and version
- Network name, operating system, and version
- Contents of your AUTOEXEC.BAT, CONFIG.SYS, and 
  system LOGIN script
- Microsoft service pack, where applicable
- Network card installed, where applicable
- Modem manufacturer, model, and baud, where 
  applicable
- Relevant browsers/applications and version number,
  where applicable

- Problem
- Specific scenario where problem occurs
- Conditions required to reproduce problem
- Statement of whether problem is reproducible on demand

- Your contact information: voice, fax, and e-mail

Other general feedback is also appreciated.


* FOR ON-SITE TRAINING INFORMATION *
 
Contact McAfee Customer Service at (800) 338-8754.


* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use McAfee's
products, we have established an Agents program to 
provide service, sales, and support for our products 
worldwide. For a listing of agents, see the file 
AGENTS.TXT, where applicable, or contact McAfee
Customer Service for agents near you.
