         What's New in ScanPM v3.0.2 (3006)
         Copyright 1994-1997 by McAfee, Inc.
                All Rights Reserved.

                
Thank you for using McAfee's ScanPM protected mode scanner.
This What's New file contains important information
regarding the current version of this product. It is highly
recommended that you read the entire document.

ScanPM is a command-line scanner with a reduced conventional
memory footprint, that operates in protected mode command-
line environments such as DOS.

McAfee welcomes your comments and suggestions. Please use
the information provided in this file to contact us.

___________________
WHAT'S IN THIS FILE

- New Features
- Known Issues
- Installation
- Documentation
- Frequently Asked Questions
- Contact McAfee

____________
NEW FEATURES

1.  New command-line option for cleaning macros. Use the
    new /CLEANDOCALL switch to clean all macros from
    infected MSWord and MSOffice documents including the
    the LAROUX Excel macro virus from .XLS files.
    
2.  New command-line option for scanning specific file
    sizes. Use the new /MAXFILESIZE xxx.x (where xxx.x is,
    specify file size in megabytes) switch to scan only
    files with sizes under the amount specified.  
    
3.  ScanPM continues to provide the exceptional virus 
    detection rates and fast scanning performance of the 
    3.0 engine series.
       
    The 3.0 engine series offers users maximum defense 
    against the newest threats to data. The 3.0 engine
    series detects all virus types including Word and
    Excel macros, boot-sector infections, file, multi-
    partite, stealth, polymorphic and encrypted viruses.
    

* ENHANCEMENTS *

1.  When running ScanPM on a system with two local drives,
    the SCANPM /ADL (All Drives Local) command-line option 
    is equivalent to the SCANPM C: D: command-line option.

2.  Enhanced command-line option for cleaning diskette boot 
    sectors. Use the /FORCE switch to clean infected boot 
    sectors of diskettes. The /FORCE switch can be used 
    even when a remover is not yet available for the boot 
    sector virus. 


* NEW VIRUSES DETECTED *

This DAT file, 3006, detects the following 204 new 
viruses. Locations that have experienced particular
problems with specific viruses are also identified.

_925
1205
ALIEN.D
ALIEN.E
ANAK.A			(Australia)
ANARCHY.6093
ANDR.2374
ANEMKOE.1965
ANEMKOE.1965 DROPPER
ATTACK.A
BANDUNG.AF
BANDUNG.AG
BANDUNG.AH
BANDUNG.AI
BANDUNG.AJ
BANDUNG.AK
BANDUNG.AL
BANDUNG.AM
BANDUNG.AN
BANDUNG.AO
BEEPER.A
BEEPER.B
BERTIK.A
BISMARK.A
BISMARK.B
BISMARK.C
BISMARK.D
CAP.L
CAP.M
CASTELLO.3730
CEBU.B
CEEFOUR.B
CHAKA.A
CHANDIGARH.A
COE.A
COLORS.AU
COLORS.AV
COLORS.AW
COLORS.AX
COLORS.AY
COLORS.AZ
COLORS.BA
COLORS.BB
CONCEPT.AO
CONCEPT.AP
CONCEPT.AQ
CONCEPT.AR
CONCEPT.AS
CULT.A(INTENDED)
CVCK1.B
CVCK1.C
CVCK1.D
CVCK1.E
CZECH.A
DAKOTA.A
DAKOTA.B
DARK_APOCALYPSE.Z
DATE.B
DEDICATO.A:IT
DEFENDER.A
DOGGIE.E
DONOS.A
ENVADER.A
ERASER.E:TW
ERASER.F:TW
GAMBLER.A
GAMBLER.B
GAMBLER.C
GAMBLER.D
GIPPO_JUMPINGJ.905
GOLDFISH.B
GOODNIGH.A
HAGGIS.A
HARK.A
HELPER.C
HELPER.D
HELPER.E
HOLIDAY.2900
HYPER.A
HYPER.A1
IRISH.M
IRISH.N
IRISH.O
IRISH.P
IVP.1131
IWASHERE.710		(Philippines)
JAJA.A
JOHNNY.K1
JOHNNY.M
JOHNNY.M1
JULY13TH.1201
JUNKFACE.C
LAVOT			      (Europe)
LEMENA.3681
LEMON.A
LUCIFER.1707
LUNCH.C
MAINMAN.200
MAINMAN.213
MAINMAN.315
MAINMAN.356
MAINMAN_OVER.232
MARK.A:TW
MARK.B:TW
MDMA.P
MDMA.Q
MDMA.R
MERCY.B
MINIMAL.N
MINIMAL.O
MINIMORPH.A
MJ13.80/86
MTF.A
MUTT.1394		      (Argentina)
NICEDAY.D
NICEDAY.E
NICEDAY.F
NICEDAY.G
NICEDAY.H
NICEDAY.I
NICEDAY.J
NOP.H:FR
NOP.I
NOP.J:DE
NPAD.BC
NPAD.BD
NPAD.BE
NPAD.BF
NPAD.BG
NPAD.BH
NPAD.BI
NPAD.BJ
NPAD.BK
NPAD.BM
NPAD.BN
NPAD.BO
NPAD.BP
NUCLEAR.K
OPIM.A
ORDO.A
PAYCHECK.B
PAYCHECK.C
PESAN.A
PIG.D:TW
PIG.E:TW
RANDOMIC.A
RAPI.AI2
ROETE5.753		      (Europe)
RUSHER3
SERBU.3493
SHOWOFF.AV
SHOWOFF.AW
SHOWOFF.AX
SHOWOFF.AY
SHOWOFF.AZ
SHOWOFF.BA
SHOWOFF.BB
SHOWOFF.BC
SIMPLE.B
SLOW
SMILEY.1983
SPANSKA.1500		(Internet)
STREZZ.A
SUNBEAM.A
SWITCHER.A
SWITCHER.B
TALON.A
TALON.H
TALON.I
TEAR.A
TEMPLE.A
TENERIFE.1550
TERRON.2538
TOTEN.A:DE
TWNO.G:TW
TWOLINES.A1
TWOLINES.B
TWOLINES.C1
TWOLINES.D
TWOLINES.D1
TWOLINES.E
TWOLINES.E1
TWOLINES.F
TWOLINES.F1
TWOLINES.G
TWOLINES.G1
TWOLINES.H
TWOLINES.H1
TWOLINES.I
TWOLINES.I1
UGLYKID.A
VENENO.A:SP
VIENNA.751
WAZZU.CB
WAZZU.CC
WAZZU.CD
WEREWOLF.1361.A
WHY.A
WIPEOUT
WMVH1.A:TW
XM/EMPEROR.A
XM/LMV.D
XM/TJORO.A
ZY-X.2545


* NEW VIRUSES REMOVED *

This DAT file, 3006, removes the following 187 new
viruses. Locations that have experienced particular 
problems with specific viruses are also identified.

_925
1205 
ALIEN.D
ALIEN.E
ANAK.A			(Australia)
ANEMKOE.1965 DROPPER
ATTACK.A
BANDUNG.AF
BANDUNG.AG
BANDUNG.AH
BANDUNG.AI
BANDUNG.AJ
BANDUNG.AK
BANDUNG.AL
BANDUNG.AM
BANDUNG.AN
BANDUNG.AO
BEEPER.A
BEEPER.B
BERTIK.A
BISMARK.A
BISMARK.B
BISMARK.C
BISMARK.D
BLACK_ADDER.1015	      (Florida)
CAP.L
CAP.M
CASTELLO.3730
CEBU.B
CEEFOUR.B
CHAKA.A
CHANDIGARH.A
COE.A
COLORS.AU
COLORS.AV
COLORS.AW
COLORS.AX
COLORS.AY
COLORS.AZ
COLORS.BA
COLORS.BB
CONCEPT.AO
CONCEPT.AP
CONCEPT.AQ
CONCEPT.AR
CONCEPT.AS
CVCK1.B
CVCK1.C
CVCK1.D
CVCK1.E
CZECH.A
DAKOTA.A
DAKOTA.B
DATE.B
DEDICATO.A:IT
DEFENDER.A
DOGGIE.E
DONOS.A
ENVADER.A
ERASER.E:TW
ERASER.F:TW
GAMBLER.A
GAMBLER.B
GAMBLER.C
GAMBLER.D
GIPPO_JUMPINGJ.905
GOLDFISH.B
HAGGIS.A
HARK.A
HELPER.C
HELPER.D
HELPER.E
HOLIDAY.2900
HYPER.A
HYPER.A1
IRISH.M
IRISH.N
IRISH.O
IRISH.P
IVP.1131
IWASHERE.710		(Philippines)
JAJA.A
JOHNNY.K1
JOHNNY.M
JOHNNY.M1
JULY13TH.1201
JUNKFACE.C
LAVOT			      (Europe)
LEMON.A
LUCIFER.1707
LUNCH.C
MAINMAN.200
MAINMAN.213
MARK.A:TW
MARK.B:TW
MDMA.P
MDMA.Q
MDMA.R
MINIMAL.N
MINIMAL.O
MINIMORPH.A
MTF.A
MUTT.1394		      (Argentina)
NICEDAY.D
NICEDAY.E
NICEDAY.F
NICEDAY.G
NICEDAY.H
NICEDAY.I
NICEDAY.J
NOP.H:FR
NOP.I
NOP.J:DE  
NPAD.BC
NPAD.BD
NPAD.BE
NPAD.BF
NPAD.BG
NPAD.BH
NPAD.BI
NPAD.BJ
NPAD.BK
NPAD.BM
NPAD.BN
NPAD.BO
NPAD.BP
OPIM.A
ORDO.A
PAYCHECK.B
PAYCHECK.C
PESAN.A
PIG.D:TW
PIG.E:TW
RANDOMIC.A
RAPI.AI2
RUSHER3
SHOWOFF.AV
SHOWOFF.AW
SHOWOFF.AX
SHOWOFF.AY
SHOWOFF.AZ
SHOWOFF.BA
SHOWOFF.BB
SHOWOFF.BC
SIMPLE.B
SLOW
SMILEY.1983
SPANSKA.1500		(Internet)
STREZZ.A
SUNBEAM.A
SWITCHER.A
SWITCHER.B
TALON.A
TALON.H
TALON.I
TEAR.A
TEMPLE.A
TENERIFE.1550
TERRON.2538
TOTEN.A:DE
TWNO.G:TW
TWOLINES.A1
TWOLINES.B
TWOLINES.C1
TWOLINES.D
TWOLINES.D1
TWOLINES.E
TWOLINES.E1
TWOLINES.F
TWOLINES.F1
TWOLINES.G
TWOLINES.G1
TWOLINES.H
TWOLINES.H1
TWOLINES.I
TWOLINES.I1
UGLYKID.A
VENENO.A:SP
VIENNA.751
WAZZU.CB
WAZZU.CC
WAZZU.CD
WHY.A
WMVH1.A:TW
XM/EMPEROR.A
XM/LMV.D
ZY-X.2545

____________
KNOWN ISSUES

1.  This DAT file, 3006, is compatible with VirusScan's and 
    NetShield's v3.0 series engines only. This DAT file is
    not intended for use with the VirusScan v2.5x series.

2.  ScanPM does not support Windows 95 or Windows NT.
    To scan Windows 95 or Windows NT systems, use a McAfee
    product that is native to those operating systems, such
    as VirusScan for Windows 95, VirusScan for Windows NT,
    or NetShield NT.

3.  If CTRL+C is applied when running the SCANPM /VIRLIST
    command, ScanPM generates a false scanning summary and
    "SCAN terminated by user" message.

4.  ScanPM does not generate a summary report after
    CTRL+BREAK is applied.

5.  It is recommended that SMARTDrive be enabled and buffers
    increased for maximum performance. When SMARTDrive is
    not present and/or buffers settings are low, ScanPM may
    operate considerably slower than VirusScan for DOS.

6.  Using the /MANY or /PAUSE options without the CLEAN.DAT 
    file present, may result in system lockup when ScanPM 
    pauses to display more than one screen of information.

____________
INSTALLATION

* PRIMARY PROGRAM FILES FOR SCANPM *

       PACKING.LST = Packing list
        README.1ST = McAfee information
      WHATSNEW.TXT = What's New document
          SCAN.DAT = Virus scan definition data              
         NAMES.DAT = Virus names definition data
         CLEAN.DAT = Virus clean definition data
        SCANPM.EXE = ScanPM program
      VALIDATE.EXE = McAfee file validation program
      RESELLER.TXT = McAfee authorized resellers


* SYSTEM REQUIREMENTS *

Because ScanPM is designed to operate in the protected mode
environment, its system requirements differ slightly from
those for VirusScan for DOS. Before installing ScanPM,
please review the system requirements listed below:

-  386 CPU or higher
-  MS DOS version 3.3 or higher
-  minimal conventional memory
-  1.5 megabytes of free hard drive space


* INSTALLING THE PRODUCT *
                        
1.  Make a directory on your hard disk drive.
2.  Copy the files to that directory.
3.  Add the directory to the path statement in
    your AUTOEXEC.BAT file.

         
* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined 
effort by anti-virus vendors throughout the world to 
come up with one standard by which customers can verify 
their anti-virus installations. To test your 
installation, copy the following line into its own 
file and name it EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

When done, you will have a 69- or 70-byte file.

When ScanPM is applied to this file, SCAN will report 
finding the EICAR-STANDARD-AV-TEST-FILE virus.

It is important to know that THIS IS NOT A VIRUS.
However, users often have the need to test that their 
installations function correctly. The anti-virus industry, 
through the European Institute for Computer Antivirus 
Research, has adopted this standard to facilitate this
need.

Please delete the file when installation testing is
completed so unsuspecting users are not unnecessarily
alarmed.


* UNINSTALLING THE PRODUCT *

1.  Remove the directory from the path statement in
    your AUTOEXEC.BAT file.
2.  Delete the files from the directory.
3.  Remove the directory.

_____________
DOCUMENTATION

For more information, refer to the DOS section of the
VirusScan User's Guide, available from McAfee's BBS and
FTP site. This file is in Adobe Acrobat Portable Document
Format (.PDF) and can be viewed using Adobe Acrobat
Reader. This form of electronic documentation includes
hypertext links and easy navigation to assist you in
finding answers to questions about your McAfee product.

Adobe Acrobat Reader can be downloaded from the World
Wide Web at:

http://www.adobe.com/Acrobat/readstep.html

VirusScan documentation can be downloaded from McAfee's
BBS or the World Wide Web at:

http://www.McAfee.com or http://205.227.129.164

__________________________
FREQUENTLY ASKED QUESTIONS 

Regularly updated lists of frequently asked questions 
about McAfee products also are available on McAfee's 
BBS, website, and CompuServe and AOL forums.

Q:  How do I enable McAfee's centralized alerting and
    reporting option?

A:  ScanPM now supports centralized alerting and reporting
    to a remote NetWare or Windows NT server running
    NetShield for Windows NT v2.5.3 or NetShield for NetWare
    v2.3.3. To set up this option on your VirusScan client,
    use the /ALERTPATH <directory> option, where the
    <directory> is the path to the remote NetWare volume or
    NT directory. From this directory, NetShield can broad-
    cast or compile the alerts and reports according to its
    established configuration.

    NOTE: The client must have write access to this
    <directory> location and the directory must contain
    the NetShield-supplied CENTALRT.TXT file.

    To send a complete alerting file that identifies the
    system and user, establish the following environment
    variables or add them to the AUTOEXEC.BAT file.

      Set COMPUTERNAME=<name of computer>
      Set USERNAME=<user name>

    The alert file sent to the server is an .alr text
    file. Upon receipt of the alert file, NetShield NT
    or NetShield for NetWare sends an alert message to
    an administrator and/or appropriate personnel.


Q:  How does ScanPM differ from VirusScan for DOS?

A:  ScanPM is a limited substitute for VirusScan for DOS
    to be used for reduced memory footprint. ScanPM operates
    in protected mode and requires less conventional memory
    than SCAN.EXE.


Q:  Can I clean the Master Boot Record (MBR) of a
    Windows NT file system (NTFS) formatted hard drive?

A:  Yes. Take these steps to clean the MBR. Boot the
    Windows NT computer from a virus-free DOS bootable
    (system) diskette. Then run ScanPM:
    SCANPM C: /BOOT /CLEAN. This will clean the NTFS
    Master Boot Sector and allow Windows NT to
    successfully reboot from the hard disk drive.
    However, ScanPM will not be able to read the rest
    of the NTFS partition.

    After starting Windows NT, execute VirusScan for
    Windows NT to detect and clean Windows NT file
    infections.


Q:  How can I minimize the time needed for scanning my
    hard drive with ScanPM?

A:  McAfee recommends two methods for minimizing scanning
    time. The most effective method is using SMARTDrive and
    increasing buffer size. For information on increasing
    buffer size, consult your DOS manual.

    If you do not have SMARTDrive enabled, you can minimize
    scanning time by only scanning critical areas at system
    startup. In the AUTOEXEC.BAT, use the command SCANPM C:\
    to scan memory and the root directory, where a virus
    would most likely reside. Perform a full scan at a
    regularly scheduled, off-peak time when your system
    would otherwise be idle.


Q:  Can I update VirusScan's data files to detect new
    viruses?

A:  Yes. If you have Internet access, you can download
    updated VirusScan data files from the McAfee Web 
    Site, BBS, or other online resources. To download 
    from the McAfee Web Site, follow these steps:
 
    1.  Go to the McAfee Web Site (http://www.mcafee.com
        or 205.227.129.164.

    2.  Select Update DAT File in the left hand column
        or frame.

    3.  Scroll down, and click Update Your DAT Files to
        update your virus definition files.

    4.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the files to the
        appropriate directory, replacing your old files.    

    5.  Before performing any scans, shut down your
        computer, wait a few seconds, and turn it on again.

    If you need additional assistance with downloading, 
    contact McAfee Download Support at (408) 988-3832.

______________
CONTACT McAFEE

* FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS *

Contact McAfee's Customer Care department: 

1.  Corporate-licensed customers, call (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

    Retail-licensed customers, call (972) 278-6100
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III fax 
		
3.  Fax-back automated response system (408) 988-3034
    24-hour fax

Send correspondence to any of the following McAfee
locations.

    McAfee Corporate Headquarters
    2805 Bowers Avenue			
    Santa Clara, CA 95051-0963		
	
    McAfee East Coast Office					
    Jerral Center West
    766 Shrewsbury Avenue
    Tinton Falls, NJ 07724-3298

    McAfee Central Office			
    4099 McEwen
    Suites 500 and 700
    Dallas, TX 75244		
						
    McAfee Canada
    139 Main Street
    Suite 201
    Unionville, Ontario
    Canada L3R2G6

    McAfee Europe B.V.			
    Gatwickstraat 25	
    1043 GL Amsterdam				
    The Netherlands	 		

    McAfee (UK) Ltd.
    Hayley House, London Road
    Bracknell, Berkshire  RG12 2TH
    United Kingdom 

    McAfee France S.A.			
    50 rue de Londres				
    75008 Paris					
    France					
				
    McAfee Deutschland GmbH
    Industriestrasse 1
    D-82110 Germering
    Germany

    McAfee Japan KK
    4F Toranomon Mori bldg. 33
    3-8-21 Toranomon
    Minato-Ku
    Tokyo, 105
    Japan
    	
Or, you can receive online assistance through any of the 
following resources:

1.  Bulletin Board System: (408) 988-4004
    24-hour US Robotics HST DS

2.  Internet e-mail: support@mcafee.com

3.  Internet FTP: ftp.mcafee.com or 205.227.129.168

4.  World Wide Web: http://www.mcafee.com
    or http://205.227.129.164

5.  America Online: keyword MCAFEE

6.  CompuServe: GO MCAFEE

7.  The Microsoft Network: GO MCAFEE

Before contacting McAfee, please make note of the
following information. When sending correspondence,
please include the same details.

- Program name and version number
- Type and brand of your computer, hard drive, and any 
  peripherals
- Operating system type and version
- Network name, operating system, and version
- Contents of your AUTOEXEC.BAT, CONFIG.SYS, and 
  system LOGIN script
- Microsoft service pack, where applicable
- Network card installed, where applicable
- Modem manufacturer, model, and baud, where 
  applicable
- Relevant browsers/applications and version number,
  where applicable

- Problem
- Specific scenario where problem occurs
- Conditions required to reproduce problem
- Statement of whether problem is reproducible on demand

- Your contact information: voice, fax, and e-mail

Other general feedback is also appreciated.

Documentation feedback is welcome. Send e-mail to
documentation@cc.mcafee.com.


* FOR ON-SITE TRAINING INFORMATION *
 
Contact McAfee Customer Service at (800) 338-8754.


* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use McAfee's
products, we have established a Resellers program to 
provide service, sales, and support for our products 
worldwide. For a listing of resellers, see the file 
RESELLER.TXT, where applicable, or contact McAfee
Customer Service for resellers near you.


* MCAFEE BETA SITE *

Get pre-release software, including DAT files, through
http://beta.mcafee.com/public/datafiles. You will have
access to Public Beta and External Test Areas. Your
feedback CAN make a difference.

 


