        What's New in McAfee ScanPM v3.2.2 (3112)
    Copyright (c) 1992-1998 by Network Associates, Inc.,
     and its Affiliated Companies. All Rights Reserved.

                
Thank you for using McAfee ScanPM. This What's New file
contains important information regarding the current version
of this product. Network Associates strongly recommends that
you read the entire document.

ScanPM is a command-line scanner with a reduced conventional
memory footprint that operates in protected mode command-
line environments such as DOS.

Network Associates welcomes your comments and suggestions.
Please use the information provided in this file to contact
Customer Care and technical support.


___________________
WHAT'S IN THIS FILE

- New Features
- Known Issues
- Installation
- Documentation
- Frequently Asked Questions
- Contacting Network Associates

____________
NEW FEATURES

ScanPM features a completely new method for cleaning macro
viruses. Previous versions removed the payload and the
replicating code from an infecting virus, but left inert
portions of code introduced with the virus in the newly
cleaned file.

The new cleaning method judiciously removes the replicating
virus code and the supporting macro code the virus used
as a method of infection. Doing so prevents Microsoft Office
applications from displaying a macro alert message, and also
prevents anti-virus products from other vendors from falsely
identifying cleaned files as infected.

* NEW VIRUSES DETECTED *

The 3112 .DAT files included with this release of ScanPM
detect these 89 new viruses:

ALICIA.6554
ALLIANCE.I
ASTIA.A
BRENDA.A
CDC-BO.ADDON.D2
CDC-BO.B
CHACK.I
CLASS.V
DARK.MATTER.1077.COM/MIRC
EDDS.C
ENMITY.808
ERASER.V
GIPSY.A
GIT.A
GODZILLA.A
HARK.C
HARK.D
HLLP.16196
HONTE.A
HORN.A
HOU.A
ICQ.ICKILLER
IIS.A
JEDI.D
KID.A
L'AMOUR.3420
LAROUX.FR
LIH.A
LITERATURA.1966
MACARONI.B
MANUEL.A
MBUG.A
MBUG.B
MBUG.C
MBUG.D
MBUG.E
MBUG.F
MBUG.G
MBUG.H
MBUG.I
MDMA.BI
MDMA.BJ
MERCADO.C
MERCADO.D
MINIMAL.AA
MINIMAL.AB
MINIMAL.Q
MINIMAL.T
MINIMAL.U
MINIMAL.V
MTE.4167
MULTI.B
NOTTICE.I
NOTTICE.K
PARINT.GR3.1598
PASSBOX.B
PROTECED.A
RAVEN.BOOT
RIGEUR
SAILOR.PLUTO.3672B
STEALTH_BOOT.A
STEROID.F
STEROID.G
STEROID.J
STRYX.A
SWLABS.T
SWLABS.U
TOTEN.D
VAMPIRE.P
VBS.HTML/INTERNAL.A
VBS.HTML/INTERNAL.B
VBS.HTML/INTERNAL.C
VERM.A
VMPCK1.BA
VMPCK1.C
WAZZU.FO
WIN_95/INCA-REVENGE
WIN95/APPARITION.A
WIN95/HAZLO.3030
XF/SIC.A
XM/CAULI.A
XM/LAROUX.DP
XM/LAROUX.EL
XM/LAROUX.EU
XM/LAROUX.FC
XM/LAROUX.FG
XM/LAROUX.FK
XM/LAROUX.FV
XM/SHIVER.B

* NEW VIRUSES REMOVED *

The 3112 .DAT files remove the 69 new viruses shown in the 
list below. Network Associates software removes a virus
either by removing the infecting virus code from files or
by removing the file from your computer.

ALLIANCE.I
ASTIA.A
BRENDA.A
CDC-BO.B
CHACK.I
CLASS.V
DARK.MATTER.1077.COM/MIRC
EDDS.C
ERASER.V
GIPSY.A
GIT.A
GODZILLA.A
HARK.C
HARK.D
HONTE.A
HORN.A
HOU.A
ICQ.ICKILLER
IIS.A
JEDI.D
KID.A
LAROUX.FR
LIH.A
LITERATURA.1966
MANUEL.A
MBUG.A
MBUG.B
MBUG.C
MBUG.D
MBUG.E
MBUG.F
MBUG.G
MBUG.H
MBUG.I
MDMA.BI
MDMA.BJ
MERCADO.C
MERCADO.D
MINIMAL.AB
MULTI.B
NOTTICE.I
NOTTICE.K
PADANIA.2730
PASSBOX.B
PROTECED.A
RAVEN.BOOT
RIGEUR
STEALTH_BOOT.A
STEROID.F
STEROID.G
STEROID.J
STRYX.A
SWLABS.T
SWLABS.U
TOTEN.D
VAMPIRE.P
VERM.A
VMPCK1.BA
VMPCK1.C
WAZZU.FO
XM/CAULI.A
XM/LAROUX.DP
XM/LAROUX.EL
XM/LAROUX.EU
XM/LAROUX.FC
XM/LAROUX.FG
XM/LAROUX.FK
XM/LAROUX.FV
XM/SHIVER.B

____________
KNOWN ISSUES

1.  ScanPM does not support Windows 95 or Windows NT. To
    scan Windows 95 or Windows NT systems, use a Network
    Associates product that is native to those operating
    systems, such as McAfee VirusScan for Windows 95,
    McAfee VirusScan for Windows NT, or NetShield NT.

2.  If CTRL+C is applied when running the SCANPM /VIRLIST
    command, ScanPM generates a false scanning summary and
    "SCAN terminated by user" message.

3.  ScanPM does not generate a summary report after
    CTRL+BREAK is applied.

4.  Network Associates recommends that you enable 
    SMARTDrive and increase buffers for maximum performance.
    When SMARTDrive is not present or buffers settings are
    low, ScanPM may operate considerably more slowly than
    VirusScan for DOS.

5.  ScanPM's delete and move operations are not currently
    supported for infected objects detected within Microsoft
    Office binder files.


____________
INSTALLATION

* PRIMARY PROGRAM FILES FOR SCANPM *

       PACKING.LST = Packing list
        README.1ST = Network Associates information
      WHATSNEW.TXT = What's New document
          SCAN.DAT = Virus scan definition data              
         NAMES.DAT = Virus names definition data
         CLEAN.DAT = Virus clean definition data
        SCANPM.EXE = ScanPM program
      VALIDATE.EXE = Network Associates file validation
                     program
      RESELLER.TXT = Network Associates authorized resellers


* SYSTEM REQUIREMENTS *

Because this version of ScanPM is designed to operate in
the protected mode environment, its system requirements
differ slightly from those for VirusScan for DOS. Before
installing ScanPM, please review the system requirements
listed below:

-  386 CPU or higher
-  MS DOS version 5.0 or higher
-  minimal conventional memory
-  1.5 megabytes of free hard drive space


* INSTALLING SCANPM *

Follow the first set of steps to set up the ScanPM
version with the included installation utility.
This version scans your hard disk for viruses before
setup.

Follow the second set of steps to copy the ScanPM
version that does not have an installation
utility. This version does not scan your hard disk
automatically before setup.

1.  To install ScanPM on your computer with the
    included installation utility follow these steps:

    a.  Change your command line prompt to point to
        the directory that contains your copy of
        VirusScan.        
    
    b.  Type INSTALL.BAT at the DOS prompt.

        VirusScan will begin scanning your hard disk
        for infected files.

    c.  When VirusScan completes its scanning operation,
        you'll see the VirusScan welcome screen. Follow 
        the instructions that appear in order to complete
        your installation.

    By default, the installation utility makes a
    directory on your hard disk named
    C:\NETA\VIRUSCAN and copies the program files
    to that directory.

    The installation script then adds the directory
    to the path statement in your AUTOEXEC.BAT file.
    It also adds two lines that enable VShield, the
    Network Associates on-access virus scanner,
    whenever you start your computer. For complete
    virus protection, Network Associates recommends
    starting VShield with the /ANYACCESS switch.

2.  To copy the the ScanPM version that does not 
    include an installation utility to your hard
    disk, follow these steps:

    a.  Make a directory for ScanPM on your hard disk.
    b.  Copy the ScanPM files to that directory.
    c.  Use any DOS text editor to open your AUTOEXEC.BAT
        file, then add the directory you just created to
        the path statement in that file. To learn how
        to edit your AUTOEXEC.BAT file, consult your DOS
        documentation.

         
* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined effort
by anti-virus vendors throughout the world to implement one
standard by which customers can verify their anti-virus
installations.

To test your installation, copy the following line into its
own file, then save the file with the name EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file size will be 69 or 70 bytes.

Next, start your anti-virus software and allow it to scan
the directory that contains EICAR.COM. When your software
scans this file, it will report finding the
EICAR-STANDARD-AV-TEST-FILE virus.

Note that this file is NOT A VIRUS. Delete the file
when you have finished testing your installation to
avoid alarming unsuspecting users.


* UNINSTALLING SCANPM * 

To remove ScanPM from your hard disk, follow these
steps:

1.  If you have VShield running on your computer,
    first remove it from memory by typing VSHIELD
    /REMOVE at the command prompt.

    If you see an error message that tells you
    that you cannot remove VShield from memory,
    use any DOS text editor to open your
    AUTOEXEC.BAT file, then remove all lines that
    refer to VShield. Next, reboot your computer.
    VShield will not load and will not remain in
    memory.

    Note: If you remove ScanPM files from your
    hard disk before you remove VShield from
    memory, you'll see an error message that will
    remain until you remove VShield from memory
    or restart your computer.

2.  Delete all ScanPM files from your hard disk.

_____________
DOCUMENTATION

For more information, refer to the VirusScan Command
Line User's Guide included on the CD-ROM or available
from Network Associates electronic services. Each user's
guide is saved in Adobe Acrobat Portable Document Format
(.PDF). You can view and print this document with Adobe's
Acrobat Reader. PDF files can include hypertext links and
other navigation features to assist you in finding answers
to questions about your Network Associates product.

To download Adobe Acrobat Reader from the World Wide Web,
visit Adobe's website at:

http://www.adobe.com/prodindex/acrobat/readstep.html

To download Network Associates documentation, visit the
Network Associates website at:

http://www.nai.com

Additional contact information appears in the following
section.

Documentation feedback is welcome. Send e-mail to
tvd_documentation@nai.com.

__________________________
FREQUENTLY ASKED QUESTIONS 

Regularly updated lists of frequently asked questions 
about Network Associates products also are available on
the Network Associates BBS and website, and on CompuServe
and America Online.
   
Q:  How do I enable the Centralized Alerting and Reporting
    option?

A:  VirusScan now supports Centralized Alerting and
    Reporting to remote NetWare or Windows NT servers
    running NetShield for Windows NT v2.5.3 and later
    or NetShield for NetWare v2.3.3 and later. To 
    configure this option on your VirusScan client,
    use the /ALERTPATH <directory> option, where the 
    <directory> is the path to the remote NetWare 
    volume or NT directory. From this directory, 
    NetShield can broadcast or compile the alerts 
    and reports according to its established
    configuration.

    NOTE: The client must have write access to this
    <directory> location and the directory must contain
    the NetShield-supplied CENTALRT.TXT file.

    To send a complete alert file that identifies the
    infected system and its user, establish the following
    environment variables or add them to the AUTOEXEC.BAT
    file.

      Set COMPUTERNAME=<name of computer>
      Set USERNAME=<user name>

    VirusScan sends an .alr text file to the server when
    it detects an infected file. When the server receives
    the alert file,  NetShield for Windows NT or NetShield
    for NetWare will send an alert message to an
    administrator and to other appropriate recipients.


Q:  How can I scan my Zip drive?

A:  If you have trouble scanning your Zip drive, start
    ScanPM with the /NODDA option. For example, enter
    SCANPM X: /NODDA (where X is the letter of your
    Zip drive). 

    Note: Using /NODDA with the /ADN or /ADL switches 
    might generate errors when scanning empty CD-ROM 
    drives or empty Zip drives. If this occurs, type 
    F (for Fail) to respond to the error message and
    allow the scan to continue.


Q:  How does ScanPM differ from VirusScan for DOS?

A:  ScanPM is a command-line scanner with a reduced
    conventional memory footprint that operates in
    protected mode command-line environments. You can
    use it as a limited substitute for VirusScan for
    DOS in some situations.


Q:  How can I minimize the time needed to scan my
    hard drive with ScanPM?

A:  Network Associates recommends two methods to minimize
    scanning time. The most effective method is using
    SMARTDrive and increasing buffer size. To learn how
    to increase your computer's  buffer size, consult your
    DOS documentation.

    If you do not have SMARTDrive enabled, you can minimize
    scanning time by scanning only critical areas at system
    startup. To specify critical areas for scanning, open
    your AUTOEXEC.BAT file with any DOS text editor, then
    add the command SCANPM C:\. Save and close the
    AUTOEXEC.BAT file. When you next start your computer,
    ScanPM will scan memory and the root directory of your
    hard disk, where a virus would most likely reside.
    Perform a full scan at a regularly scheduled, off-peak
    time when your system would otherwise be idle.


Q:  Can I update ScanPM data files so that ScanPM detects
    new viruses?

A:  Yes. If you have Internet access, you can download
    updated ScanPM data files from the Network Associates
    website, BBS, or other electronic resources. To download 
    data files from the Network Associates website, follow
    these steps:
 
    1.  Use a web browser to connect to the Network Associates
        website at http://www.nai.com.

    2.  Click the Download tab.

    3.  Click Update Virus .DAT Files, then click Download
        Virus DAT File.

    4.  Follow the on-screen downloading instructions.

    5.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the new files to
        your existing ScanPM directory, replacing your
        old files.    

    6.  Before performing any scans, shut down your
        computer, wait a few seconds, then turn it on again.

    If you need additional assistance with downloading, 
    contact Network Associates Download Support at
    (408) 988-3832.

_____________________________
CONTACTING NETWORK ASSOCIATES

On December 1, 1997, McAfee Associates merged with
Network General Corporation, Pretty Good Privacy, Inc.,
and Helix Software, Inc. to form Network Associates, Inc.
The combined Company subsequently acquired Dr Solomon's
Software and CyberMedia, Inc.

Network Associates continues to market and support the
product lines from each of the former entities. You may
direct all questions, comments and technical support
requests to the Network Associates Customer Care department
at any of the addresses or phone numbers listed below.

Contact the Network Associates Customer Care
department at: 

1.  Phone (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III Fax 

3.  Fax-back automated response system (408) 346-3414

 
Send correspondence to any of the following Network
Associates locations:
  
     Network Associates Corporate Headquarters  
     3965 Freedom Circle
     McCandless Towers   
     Santa Clara, CA 95054

     Phone numbers for corporate-licensed customers:
     Phone: (408) 988-3832
     Fax:   (408) 970-9727

     Phone numbers for retail-licensed customers:
     Phone: (972) 278-6100
     Fax:   (408) 970-9727

Network Associates offices outside the United States:

     Network Associates Australia
     Level 1, 500 Pacific Highway
     St. Leonards, NSW
     Sydney, Australia 2065
     Phone: 61-2-8425-4200
     Fax:   61-2-9439-5166 

     Network Associates Austria
     Pulvermuehlstrasse 17
     Linz, Austria
     Postal Code A-4040
     Phone: 43-732-757-244
     Fax:   43-732-757-244-20

     Network Associates Belgium
     Bessenveldtstraat 25a
     Diegem, Belgium - 1831
     Phone: 32-3-716-4070
     Fax:   61-2-716-4770

     Network Associates do Brasil
     Rua Geraldo Flausino Gomez 78
     Cj. - 51 Brooklin Novo - So Paulo
     SP - 04575-060 - Brasil
     Phone:  (55 11) 5505 1009
     Fax:    (55 11) 5505 1006

     Network Associates Canada
     139 Main Street, Suite 201
     Unionville, Ontario
     Canada L3R 2G6
     Phone: (905) 479-4189
     Fax:   (905) 479-4540

     Network Associates People's Republic of China
     New Century Office Tower, Room 1557
     No. 6 Southern Road Capitol Gym 
     Beijing
     People's Republic of China 100044
     Phone: 86 10 6849-2650
     Fax:   86 10 6849-2069

     NA Network Associates Oy
     Kielotie 14 B
     01300 Vantaa
     Finland
     Phone: 358 9 836 2620
     Fax:   358 9 836 26222 

     Network Associates France S.A.   
     50 Rue de Londres    
     75008 Paris     
     France
     Phone: 33 1 44 908 737
     Fax:   33 1 45 227 554  

     Network Associates Deutschland GmbH
     Industriestrasse 1
     D-82110 Germering
     Germany
     Phone: 49 8989 43 5600
     Fax:   49 8989 43 5699 

     Network Associates Hong Kong
     19/F, Matheson Centre
     3 Matheson Street
     Causeway Bay
     Hong Kong
     Phone: 852-2832-9525
     Fax:   852-2832-9530

     Network Associates Srl
     Centro Direzionale Summit     
     Palazzo D/1
     Via Brescia, 28
     20063 - Cernusco sul Naviglio (MI)
     ITALY  
     Phone: 39 (0)2 9214 1555   
     Fax:   39 (0)2 9214 1644

     Network Associates Japan, Inc.
     Toranomon 33 Mori Bldg.
     3-8-21 Toranomon Minato-ku
     Tokyo 105-0001 Japan
     Phone: 81 3 5408 0700
     Fax:   81 3 5408 0781

     Network Associates Latin America
     150 South Pine Island Road, Suite 205
     Plantation, Florida 33324
     United States
     Phone: (954) 452-1731
     Fax:   (954) 236-8031

     Network Associates de Mexico
     Andres Bello No. 10, 4 Piso
     4th Floor
     Col. Polanco
     Mexico City, Mexico D.F. 11560
     Phone: (525) 282-9180
     Fax:   (525) 282-9183

     Network Associates International B.V.   
     Gatwickstraat 25   
     1043 GL Amsterdam    
     The Netherlands    
     Phone: 31 20 586 6100
     Fax:   31 20 586 6101

     Network Associates Portugal
     Av. da Liberdade, 114
     1269-046 Lisboa
     Portugal
     Phone:  351 1 340 4543
     Fax:    351 1 340 4575

     Net Tools Network Associates South Africa
     Bardev House, St. Andrews
     Meadowbrook Lane
     Epson Downs, P.O. Box 7062
     Bryanston, Johannesburg
     South Africa 2021
     Phone: 27 11 706-1629
     Fax:   27 11 706-1569

     Network Associates South East Asia
     7 Temasek Boulevard
     The Penthouse
     #44-01, Suntec Tower One
     Singapore 038987
     Phone: 65 430-6670
     Fax:   65 430-6671

     Network Associates Spain
     Orense 4, 4th Floor
     Edificio Trieste
     28020 Madrid
     Spain
     Phone: 34 91 598 18 00
     Fax:   34 91 556 14 01

     Network Associates Sweden
     Datavgen 3A
     Box 596
     S-175 26 Jrflla
     Sweden
     Phone: 46 (0) 8 580 88 400
     Fax:   46 (0) 8 580 88 405

     Network Associates AG
     Baeulerwisenstrasse 3
     8152 Glattbrugg
     Switzerland
     Phone: 0041 1 808 99 66
     Fax:   0041 1 808 99 77

     Network Associates International Ltd.
     Minton Place, Victoria Street
     Windsor, Berkshire
     SL4 1EF
     United Kingdom
     Phone: 44 (0)1753 827 500
     Fax:   44 (0)1753 827 520


Or, you can receive online assistance through any
of the following resources:

 1.  Internet E-mail: support@nai.com

 2.  Internet FTP: ftp.nai.com

 3.  World Wide Web: http://support.nai.com

 4.  America Online: keyword MCAFEE

 5.  CompuServe: GO NAI

To provide the answers you need quickly and efficiently,
the Network Associates technical support staff needs
some information about your computer and your software.
Please have this information ready when you call:
                          
 - Program name and version number
 - Computer brand and model
 - Any additional hardware or peripherals connected to
   your computer
 - Operating system type and version numbers
 - Network name, operating system, and version
 - Network card installed, where applicable
 - Modem manufacturer, model, and baud, where applicable
 - Relevant browsers or applications and their version 
   numbers, where applicable
 - How to reproduce your problem: when it occurs, whether
   you can reproduce it regularly, and under what 
   conditions
 - Information needed to contact you by voice, fax, or 
   e-mail

We also seek and appreciate general feedback.

 
* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use Network
Associates products, we have established a reseller's
program to provide service, sales, and support for our
products worldwide. For a listing of resellers, see the
resellers.txt file or contact Network Associates
Customer Care for resellers near you.

 
* FOR REPORTING PROBLEMS *

Network Associates prides itself on delivering a
high-quality product. If you find any problems, please
take a moment to review the contents of this file. If
the problem you've encountered is documented, there is
no need to report the problem to Network Associates.

If you find any feature that does not appear to
function properly on your system, or if you believe
an application would benefit greatly from enhancement,
please contact Network Associates with your suggestions
or concerns.


* FOR ON-SITE TRAINING INFORMATION *

Contact Network Associates Customer Service at
(800) 338-8754.


* NETWORK ASSOCIATES BETA SITE *

Get pre-release software, including .DAT files, through
http://beta.nai.com. You will have access to Public
Beta and External Test Areas. Your feedback will make
a difference.