         What's New in ScanPM v2.5.3 (9611)
         Copyright 1994-1996 by McAfee, Inc.
                All Rights Reserved.

                
Thank you for using McAfee's ScanPM protected mode
scanner. This What's New file contains important
information regarding the current version of this
product. It is highly recommended that you read the
entire document.

ScanPM is a command-line scanner with a reduced
conventional memory footprint, that operates in
protected mode command-line environments such as
DOS.

McAfee welcomes your comments and suggestions. Please 
use the information provided in this file to contact us.

___________________
WHAT'S IN THIS FILE

- New Features
- Known Issues
- Installation
- Documentation
- Frequently Asked Questions
- Contact McAfee

____________
NEW FEATURES
    
    ScanPM now supports centralized alerting and reporting
    to a remote NetWare or Windows NT server. Using
    NetShield for NetWare v2.3.3 or NetShield for
    Windows NT v2.5.3, client alerts and reports can be
    redistributed or compiled at the central server
    location for ease of management.


* ENHANCEMENTS *

1.  Significantly increased Master Boot Record and
    Boot Sector virus detection and removal.
    
2.  Enhanced the DOS ErrorCodes feature for increased
    compatibility with SCAN.EXE.


* NEW VIRUSES DETECTED *

This DAT file (9611) detects the following 129
new viruses. Locations that have experienced
particular problems with specific viruses are also
identified.

_922				Germany
_1000				US
_2673                           Philippines
APOCALIPSE.1685 		Portugal
APRIL1A.798
APRIL1B.797
AREQUIPA.1994			Peru
ASBV
ASH.302
ASMODEOUS.1437
ASSIGN.653
ATOM
BANDUNG.A			US/Indonesia
BANDUNG.B
BARAN.2978
BARAN.3001
BNB.498
BR.1180
BW.790
CACO.3310			Peru
CHANDI				US
CHAPA.447
CHAPA.448
CHERRY.2266
COMP.180
CONCEPT.I
CONCEPT.L
CONCEPT.M
CONCEPT.N
CONCEPT.P
COOL.929
COREA.926
COUP.2062
CRAWLER.545
CRIM_WW
CYBERTECH.668
DAN.1784
DELTREE TROJAN
DEMON3B.4313
DINA.271
DINA.283
DIR-II.1536.G
DIR-II.AS
DREAMER.8869
DST.330
DST.347
DST.396
DSTAR.223
EASY				Internet
EDOL.832
EXEHEADER.VLAD.337
EXTRACTJPG.TROJAN
FATHER_MAC.1382
FAULT.9209
FORMATC:TROJAN                  
FSN.1279
GANGSTERZ			Internet
H-ANDROMED.594
HELGA.666.B
HELPER				US
HIDER.2143
INCH
INFERNO.781
JASON.626
JOVIAL.503
JUICE.305
KALO.1464
KOSKON.313
LATER.981.B
LD93.1217			Australia
LUNCH.783
MACGYVER.4112 (MBR)		Taiwan
MAIDEN.891
MARKUS.5415
MBRK.714
MDMA.C				US
MINZ.470
MIXTURA.1000
MOSCA.1278
MURCIA.4651
NPOX.1186
OKTUBRE.1784
OUTLAW				Internet
PELIGRO.1206			Peru
PHARDERA			Internet
PIRANIA.1617
PROTOVIRUS.720
PS-MPC.504			Peru
RESCUE 911.3774 		Saudi Arabia
ROTATOR.864
SALAMANDER.888
SANLORENO.1025
SAVER:DE			Internet
SCROLL.600
SHOWOFXX			Australia
SIERRA.D			US
SILLY.745
SMILEY:DE			Germany
SPEC.907
SPOOKY:DE			Internet
STEATODA.1623			Israel
STRYX:DE			Internet
SUPERF.1175
SVC.3103			South America
SYSKLL.290
T555.556
TAURUS.1852
THEATRE:TW  (*)                 Taiwan
THEATRE.A:TW  (*)               Taiwan
TREBUJENA.1094
TRIVIAL.44.F
TRIVIAL.45.H
TRIVIAL.52
TRIVIAL.53.A
TRIVIAL.119
TRIVIAL.284
TROOPER.2259                    
TWNO:TW  (*)                    Taiwan
TWNO.B:TW  (*)                  Taiwan
TWNO.C:TW  (*)                  Taiwan
UNHAPPY.763.A
UNHAPPY.763.B
VCC.620
VCS.799
WAZZU.J
WAZZU.O
WAZZU.P 			US
WAZZU.Q 			US
WEATHER:TW  (*)                 Taiwan
ZGENRAT.785			US
(*)  Infects double-byte (omnicode) versions of Microsoft
     Word which include Japanese, Korean, Chinese, and
     Simplified Chinese.
                                       

* NEW VIRUSES REMOVED *

This DAT file (9611) removes the following 112 new
viruses. Locations that have experienced particular
problems with specific viruses are also identified.
 
666
_922				Germany
_1000				US
1946
_2673                           Philippines
ARALE
AREQUIPA.1994			Peru
ASBV
AWAITS.500
BABY_L.674
BADSIZE.369
BANDUNG.B
BARAN.2978
BARAN.3001
BARROTES.840			Spain
BNB.498
BR.1180
BRBI.KOBRIN.492
CACO.2965
CACO.3310			Peru
CARRYON.534
CHANDI				US
CHAPA.447
CHAPA.448
CONCEPT.I
CONCEPT.L
CONCEPT.M
CONCEPT.N
CONCEPT.P
COOL.929
COREA.926
COUP.2062
DEARFRIEND.524
DOPERLAND.490
DREAMER.4808
DREAMER.8869
DUNE.483
EASY				Internet
EUPM.1731
F-YOU
FIFO.333
FORMAS.1146
FORMATC:FORMAT
GANGSTERZ			Internet
GENE.1991
GENIUS
H-ANDROMED.594
HELPER				US
INCH.386
INT4B.231
INT4B.242
IVP.BUBBLES.684 		US
KALI-4
KOSKON.313
LD93.1217			Australia
LOVEBUZZ.591
LUNCH
MACGYVER.4112			Taiwan
MANTRA.719
MARKUS.5415
MDMA.C				US
NPOX.1186
OMEGA
OUTLAW				Internet
PELIGRO.1206			Peru
PHARDERA			Internet
PS-MPC.504			Peru
PUPPETS.960
RESCUE 911.3774 		Saudi Arabia
SAVER:DE			Internet
SHOWOFXX			Australia
SIERRA.D			US
SILLYC.90
SILLYC.155.B
SILLYC.165
SILLYC.200.B
SILLYC.202
SILLYC.226
SILLYC.316
SILLYC.373
SILLYORCE.76.B
SILLYRC.214
SILLYRC.248
SILLYRC.303
SMILEY:DE			Germany
SPOOKY:DE			Internet
STEATODA.1623			Israel
STRYX:DE			Internet
SUPERVISOR.2221
SVC.3103			South America
T555.556
THEATRE:TW  (*)                 Taiwan
THEATRE.A:TW  (*)               Taiwan
TIE.619                
TIP.554
TULA.1540
TULA.1656
TURBOEXE.854
TWNO:TW  (*)                    Taiwan
TWNO.B:TW  (*)                  Taiwan
TWNO.C:TW  (*)                  Taiwan
UNHANDLED.495
UNHAPPY.763.A
UNHAPPY.763.B
VIAGGIO.1051
VOTADC.591
WAZZU.J
WAZZU.O
WAZZU.P 			US
WAZZU.Q 			US
WEATHER:TW (*)                 Taiwan  
WILDY.354.B
WILDY.354.C
(*)  Infects double-byte (omnicode) versions of Microsoft
     Word, which include Japanese, Korean, Chinese, and
     Simplified Chinese.     
                                       
____________
KNOWN ISSUES

1.  ScanPM does not support Windows 95 or Windows NT.
    To scan 95 or NT systems, use a McAfee product
    that is native to those operating systems, such
    as VirusScan95, VirusScan for Windows NT, or
    NetShield NT.

2.  If CTRL+C is applied when running the SCANPM /VIRLIST
    command, ScanPM generates a false scanning summary and
    "SCAN terminated by user" message.

3.  ScanPM does not generate a summary report after
    CTRL+BREAK is applied.

4.  It is recommended that SMARTDrive be enabled and
    buffers increased for maximum performance. When
    SMARTDrive is not present and/or buffers settings
    are low, ScanPM may operate considerably slower
    than VirusScan for DOS.

____________
INSTALLATION

* PRIMARY PROGRAM FILES FOR SCANPM *

 PACKING.LST = Packing list
  README.1ST = McAfee information
WHATSNEW.TXT = What's New document
    SCAN.DAT = Virus scan definition data              
   NAMES.DAT = Virus names definition data
   CLEAN.DAT = Virus clean definition data
  SCANPM.EXE = ScanPM program
VALIDATE.EXE = McAfee file validation program
  AGENTS.TXT = McAfee authorized agents


* SYSTEM REQUIREMENTS *

Because ScanPM is designed to operate in the protected mode
environment, its system requirements differ slightly from
those for VirusScan for DOS. Before installing ScanPM,
please review the system requirements listed below:

-  386 CPU or higher
-  MS DOS version 3.3 or higher
-  75 kilobytes of conventional memory
-  1.5 megabytes of free hard drive space


* INSTALLING THE PRODUCT *
                        
1.  Make a directory on your hard disk drive.
2.  Copy the files to that directory.
3.  Add the directory to the path statement in
    your AUTOEXEC.BAT file.

         
* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined 
effort by anti-virus vendors throughout the world to 
come up with one standard by which customers can verify 
their anti-virus installations. To test your 
installation, copy the following line into its own 
file and name it EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

When done, you will have a 69- or 70-byte file.

When ScanPM is applied to this file, SCAN will report 
finding the EICAR-STANDARD-AV-TEST-FILE virus.

It is important to know that THIS IS NOT A VIRUS.
However, users often have the need to test that their 
installations function correctly. The anti-virus industry, 
through the European Institute for Computer Antivirus 
Research, has adopted this standard to facilitate this
need.

Please delete the file when installation testing is
completed so unsuspecting users are not unnecessarily
alarmed.


* UNINSTALLING THE PRODUCT *

1.  Remove the directory from the path statement in
    your AUTOEXEC.BAT file.
2.  Delete the files from the directory.
3.  Remove the directory.

_____________
DOCUMENTATION

For more information, refer to the DOS section of the
VirusScan User's Guide, available from McAfee's BBS and
FTP site. This file is in Adobe Acrobat Portable Document
Format (.PDF) and can be viewed using Adobe Acrobat
Reader. This form of electronic documentation includes
hypertext links and easy navigation to assist you in
finding answers to questions about your McAfee product.

Adobe Acrobat Reader can be downloaded from the World
Wide Web at:

http://www.adobe.com/Acrobat/readstep.html

VirusScan documentation can be downloaded from McAfee's
BBS or the World Wide Web at:

http://www.McAfee.com or http://205.227.129.97

__________________________
FREQUENTLY ASKED QUESTIONS 

Regularly updated lists of frequently asked questions 
about McAfee products also are available on McAfee's 
BBS, website, and CompuServe and AOL forums.

Q:  How do I enable McAfee's centralized alerting and
    reporting option?

A:  ScanPM now supports centralized alerting and reporting
    to a remote NetWare or Windows NT server running
    NetShield for Windows NT v2.5.3 or NetShield for NetWare
    v2.3.3. To set up this option on your VirusScan client,
    use the /ALERTPATH <directory> option, where the
    <directory> is the path to the remote NetWare volume or
    NT directory. From this directory, NetShield can broad-
    cast or compile the alerts and reports according to its
    established configuration.

    NOTE: The client must have write access to this
    <directory> location and the directory must contain
    the NetShield-supplied CENTALRT.TXT file.

    To send a complete alerting file that identifies the
    system and user, establish the following environment
    variables or add them to the AUTOEXEC.BAT file.

      Set COMPUTERNAME=<name of computer>
      Set USERNAME=<user name>

    The alert file sent to the server is an .alr text
    file. Upon receipt of the alert file, NetShield NT
    or NetShield for NetWare sends an alert message to
    an administrator and/or appropriate personnel.


Q:  How does ScanPM differ from VirusScan for DOS?

A:  ScanPM is a limited substitute for VirusScan for DOS
    to be used for reduced memory footprint. A minimum 
    of 490K of free conventional memory is recommended
    to run VirusScan for DOS. ScanPM operates in protected
    mode and only requires 75K of conventional memory.


Q:  Can I clean the Master Boot Record (MBR) of a
    Windows NT file system (NTFS) formatted hard drive?

A:  Yes. Take these steps to clean the MBR. Boot the
    Windows NT computer from a virus-free DOS bootable
    (system) diskette. Then run ScanPM:
    SCANPM C: /BOOT /CLEAN. This will clean the NTFS
    Master Boot Sector and allow Windows NT to
    successfully reboot from the hard disk drive.
    However, ScanPM will not be able to read the rest
    of the NTFS partition.

    After starting Windows NT, execute VirusScan for
    Windows NT to detect and clean Windows NT file
    infections.


Q:  How can I minimize the time needed for scanning my
    hard drive with ScanPM?

A:  McAfee recommends two methods for minimizing scanning
    time. The most effective method is using SMARTDrive and
    increasing buffer size. For information on increasing
    buffer size, consult your DOS manual.

    If you do not have SMARTDrive enabled, you can minimize
    scanning time by only scanning critical areas at system
    startup. In the AUTOEXEC.BAT, use the command SCANPM C:\
    to scan memory and the root directory, where a virus
    would most likely reside. Perform a full scan at a
    regularly scheduled, off-peak time when your system
    would otherwise be idle.


Q:  Can I update ScanPM's data files to detect
    new viruses?

A:  Yes. If you have Internet access, you can download
    updated McAfee data files from the McAfee Web 
    Site, BBS, or other online resources. To download 
    from the McAfee Web Site, follow these steps:

    1.  Go to the McAfee Web Site (http://www.mcafee.com
        or http://205.227.129.97).

    2.  Click on the Download McAfee button in the upper
        left hand column or frame.

    3.  Click on Update Your DAT Files to update DAT files.

    4.  View the information provided on new DAT files
        and downloading.

    5.  Click on Download this Month's DAT.
   
    6.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the files to the
        appropriate directory, replacing your old files.    

    7.  Before performing any scans, shut down your
        computer, wait a few seconds, and turn it on again.

    If you need additional assistance with downloading, 
    contact McAfee Download Support at (408) 988-3832.

______________
CONTACT McAFEE

* FOR QUESTIONS, ORDERS, PROBLEMS, OR COMMENTS *

Contact McAfee's Customer Care department: 

1.  Call (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III fax 
		
3.  Fax-back automated response system (408) 988-3034
    24-hour fax

Send correspondence to any of the following McAfee
locations.
    	
    McAfee Corporate Headquarters		
    2710 Walsh Avenue			
    Santa Clara, CA 95051-0963		
	
    McAfee East Coast Office					
    Jerral West Center
    766 Shrewsbury Avenue
    Tinton Falls, NJ 07724-3298

    McAfee Central Office			
    5944 Luther Lane, Suite 117		
    Dallas, TX 75225				
						
    McAfee Canada
    178 Main Street
    Unionville, Ontario
    Canada L2R 2G9

    McAfee Europe B.V.			
    Orlyplein 81 - Busitel 1		
    1043 DS Amsterdam				
    The Netherlands	 		

    McAfee (UK) Ltd.
    Hayley House, London Road
    Bracknell, Berkshire  RG12 2TH
    United Kingdom 

    McAfee France S.A.			
    50 rue de Londres				
    75008 Paris					
    France					
				
    McAfee Deutschland GmbH
    Industriestrasse 1
    D-82110 Germering
    Germany

Or, you can receive online assistance through any of the 
following resources:

1.  Bulletin Board System: (408) 988-4004
    24-hour US Robotics HST DS

2.  Internet e-mail: support@mcafee.com

3.  Internet FTP: ftp.mcafee.com or 205.227.129.134

4.  World Wide Web: http://www.mcafee.com
    or http://205.227.129.97

5.  America Online: keyword MCAFEE

6.  CompuServe: GO MCAFEE

7.  The Microsoft Network: GO MCAFEE

Before contacting McAfee, please make note of the following 
information. When sending correspondence, please include 
the same details.

- Program name and version number
- Type and brand of your computer, hard drive, and any 
  peripherals
- Operating system type and version
- Network name, operating system, and version
- Contents of your AUTOEXEC.BAT, CONFIG.SYS, and 
  system LOGIN script
- Microsoft service pack, where applicable
- Network card installed, where applicable
- Modem manufacturer, model, and baud, where 
  applicable
- Relevant browsers/applications and version number,
  where applicable

- Problem
- Specific scenario where problem occurs
- Conditions required to reproduce problem
- Statement of whether problem is reproducible on demand

- Your contact information: voice, fax, and e-mail

Other general feedback is also appreciated.


* FOR ON-SITE TRAINING INFORMATION *
 
Contact McAfee Customer Service at (800) 338-8754.


* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use McAfee's
products, we have established an Agents program to 
provide service, sales, and support for our products 
worldwide. For a listing of agents, see the file 
AGENTS.TXT, where applicable, or contact McAfee 
Customer Service for agents near you.
