        What's New in McAfee VirusScan Command Line
               for Windows NT v3.2.0 (3108)
    Copyright (c) 1992-1998 by Network Associates, Inc.,
     and its Affiliated Companies. All Rights Reserved.


Thank you for using McAfee VirusScan Command Line for
Windows NT. This What's New file contains important
information regarding the current version of this product.
Network Associates strongly recommends that you read the
entire document.

Network Associates welcomes your comments and suggestions.
Please use the information provided in this file to contact
us.

___________________
WHAT'S IN THIS FILE

- New Features          
- Known Issues
- Installation          
- Documentation         
- Frequently Asked Questions  
- Contacting Network Associates

____________
NEW FEATURES

1.  An updated scanning engine allows VirusScan Command
    Line for Windows NT to detect files infected with
    the CIH and Marburg viruses. These viruses infect
    Windows 95 and Windows 98 portable executable (PE)
    files. A portable executable file is a Windows
    resource file that other executable files can share
    --examples include dynamic linking library (.DLL)
    files. Although these viruses do not infect Windows
    NT resource files directly, they can still spread
    via Windows NT servers that host Windows 95 or
    Windows 98 client computers.

2.  The updated scanning engine also includes improved
    detection and cleaning capability for the TEOCATL
    virus and for a new strain of the XF/PAIX virus.

3.  VirusScan Command Line for Windows NT now detects
    macro viruses in Microsoft Access database files.

4.  When you start VirusScan Command Line for Windows NT
    with the /CLEAN and /MOVE options enabled, the
    program now copies infected files to the quarantine
    directory, or copies them in place with a new
    extension, before it tries to remove infecting
    viruses. If it cannot remove a virus from an original
    file, VirusScan will delete the file, but will retain
    the copy. If VirusScan can clean the original file,
    it will leave it in place. This allows you to keep
    copies of infected files in order to track them or
    forward them to Network Associates for evaluation.

    VirusScan will follow this same procedure when it finds
    viruses in files embedded within Microsoft Office files.
    If, for example, VirusScan detects a virus in an Excel
    spreadsheet file embedded in a Word document, it will
    move the entire file--the embedded file and its host
    file--to a quarantine directory or copy it in place
    with a new extension before it tries to remove the
    infecting virus.

5.  VirusScan checks the .DAT file version in use for
    compatibility with its newer scan engines. It will
    prompt you to update incompatible .DAT files. 

6.  VirusScan includes improvements in its ability to detect
    and clean the Laroux virus in Microsoft Excel spreadsheets.


* NEW VIRUSES DETECTED *

The 3108 .DAT files included with this release of VirusScan
Command Line for Windows NT detect these 165 new viruses:

_3141
_.8772
AETA.5315
AI22.1659
ANIMO.518
ANTIHEURISTICA.672
ANXIETY.POPPY.III
APPDER.S
AREF.670
AREF.890
ASK.352
AZNAR.666
BANDUNG.BG
BEL.2124
BOX.I:TW
BUPT.BOO
CACHACA.400
CAP.GW
CAP.GX
CARTMAN.C
CHINA.882
CLASS.A
CLASS.B
COCA.509
COLORS.CC
COMPANION.181
CONCEPT.CM
COWABUNGA.2193 DROPPER
COWABUNGA.2298 DROPPER
CRASHER.439
CRASHER.659
CROW.A
DARKMAN TROJAN
DEICIDE.622
DIE.490
DIE.513
DIKSHEV.1334
DM.400.C
DMV.M
DRE.756
DUTCH.TINY.98
DUTCH.TINY.99.A
EARLE.1431
EXEHEADER.337
EXEHEADER.352
EXEHEADER.360B
FATAL ELLUSION.GR
FREK.COMP
GOLLUM.7167
GOLLUM.7167.DROPPER
GOODNIGHT.N
HDM.BOOT
HIDE AND SEEK.709
HLL.5381
HLLT.4630
HLLT.4709.A
HLLT.4709.B
HLLT.4725
HLLT.4805
HLLT.4869
HLLT.4949.A
HLLT.4949.B
HLLT.5413
INCOM.648
IVP.351
JDAY.412
JEDI.A
JEFF.812
JOHNNY.W
JSB.498
JUNE16TH.879
KERNEL.616
KNIGHT-7
KOMPU.M
KURE.5337
LAMEJOKE.A
LANCELOT.342
LEO.1965
LEO.333
LIGHT.1060
MASHA.1338
MDMA.BC
MDRG.544
MIRC/GERR_EXE
MIRC/GERR_INI
MIREA.925
MIREA.950
MIREA.958
MONO.1063
NIKNAT.M
NILZ.1000
NOP.W:DE
NOTTICE.E
NPAD.IF
NPAD.IG
NPAD.IH
NPAD.II
NPAD.IJ
NPAD.IK
NPAD.IL
NUCLEAR.AC
NUCLEII.200
OMEGA.A:BR
OPA.90
OPA.200
OPA.600
PARAGUAY.367
PARAGUAY.1650
PARAGUAY.1726
PARAGUAY.2618
PARAGUAY.2867
PINDONGA.3551
POLYPOSTER.A
POSSESSED.2167
QRES.236
REVENGER.505
SATAN.599
SEMISOFT.59391
SERGEANT.229
SHOWOFF.DJ
SHOWOFF.DK
SPANSKA.1008
SPANSKA.1509
SPOOKY.323
SPOOKY.440
STRATO.1597
SUELA.1042
SWLABS.S
TCV
TOUT.275
TRIPLEK.471
T_POWER.4564
VANITAS.3712
VICKY.304
VICKY.567
VICKY.1015
VICKY.1109
VICKY.1186
W32.CIH.SPACEFILLER
W95.MARBURG.A
W95/HPS
W97/CLASS.A (SYS)
W97/CLASS.B (SYS)
WAZZU.EX
WAZZU.EY
WAZZU.EZ
WAZZU.FA
WME.A
WRZOD.1016
XF/PAIX.B
XM/IMPORT.B
XM/LAROUX.DL
XM/LAROUX.DM
XM/LAROUX.DO
XM/LAROUX.DQ
XM/LAROUX.DR
XM/LAROUX.DS
XM/LAROUX.DX
XM/LAROUX.DY
XM/LAROUX.DZ
XM/LAROUX.EA
XRES.432
YUSONG.1471
ZLODIC.666
ZMK.J:DR



* NEW VIRUSES CLEANED *

The 3108 .DAT files clean these 84 new viruses:

_3141
_.8772
ANTIHEURISTICA.672
ANXIETY.POPPY.III
APPDER.S
BANDUNG.BG
BOX.I:TW
BUPT.BOO
CAP.GW
CAP.GX
CARTMAN.C
COLORS.CC
CONCEPT.CM
COWABUNGA.2193 DROPPER
COWABUNGA.2298 DROPPER
CROW.A
DEICIDE.622
DM.400.C
DMV.M
DUTCH.TINY.98
DUTCH.TINY.99.A
FATAL ELLUSION.GR
FREK.COMP
GOLLUM.7167
GOLLUM.7167.DROPPER
GOODNIGHT.N
HDM.BOOT
HIDE AND SEEK.709
INCOM.648
IVP.351
JEDI.A
JEFF.812
JOHNNY.W
JSB.498
JUNE16TH.879
KERNEL.616
KNIGHT-7
KOMPU.M
LAMEJOKE.A
MDMA.BC
MDRG.544
MIREA.925
MIREA.950
MIREA.958
MONO.1063
NIKNAT.M
NILZ.1000
NOP.W:DE
NOTTICE.E
NPAD.IF
NPAD.IG
NPAD.IH
NPAD.II
NPAD.IJ
NPAD.IK
NPAD.IL
NUCLEAR.AC
OMEGA.A:BR
QRES.236
SATAN.599
SHOWOFF.DJ
SHOWOFF.DK
SWLABS.S
W97/CLASS.A (SYS)
W97/CLASS.B (SYS)
WAZZU.EX
WAZZU.EY
WAZZU.EZ
WAZZU.FA
WME.A
WRZOD.1016
XF/PAIX.B
XM/IMPORT.B
XM/LAROUX.DL
XM/LAROUX.DM
XM/LAROUX.DO
XM/LAROUX.DQ
XM/LAROUX.DR
XM/LAROUX.DS
XM/LAROUX.DX
XM/LAROUX.DY
XM/LAROUX.DZ
XM/LAROUX.EA
ZMK.J:DR

____________
KNOWN ISSUES

1.  Because Windows NT includes security features that
    protect your system from unauthorized tampering,
    VirusScan cannot scan certain files on your system.
    These files include PAGEFILE.SYS, registry hive
    files, and user profiles. When VirusScan tries to
    scan these files, your system will beep and display
    a Read Access Denied error message. This message is
    not critical and does not affect how your system
    functions.

2.  VirusScan Command Line for Windows NT cannot scan the
    boot sectors or the Master Boot Record on your hard
    disk unless you have administrative rights. To use
    VirusScan to scan these areas, you must log in as a
    user that has administrative rights.

____________
INSTALLATION

* INSTALLING VIRUSSCAN COMMAND LINE FOR WINDOWS NT *

To install VirusScan Command Line for Windows NT,
follow these steps:

1.  Make a directory for VirusScan on your hard disk.

2.  Copy the VirusScan files to that directory.

3.  Use any text editor to open your AUTOEXEC.BAT
    file, then add the directory you just created to
    the path statement in that file. To learn how
    to edit your AUTOEXEC.BAT file, consult your 
    Windows NT documentation.
                              

* PRIMARY PROGRAM FILES FOR VIRUSSCAN COMMAND LINE *

Files located in the Install directory:
=======================================

      NTSCAN.EXE = VirusScan for Windows NT Command
                   Line program
      README.1ST = License and registration information
        SCAN.DAT = Virus scan definition data
       NAMES.DAT = Virus names definition data
       CLEAN.DAT = Virus clean definition data
    POLYSCAN.DAT = Data file for advanced polymorphic virus
                   detection
        SCAN.EXE = MS-DOS scan program
    VALIDATE.EXE = Network Associates file validation
                   program
    MCARCHCL.DLL = Compression library file
    MCUTILCL.DLL = Compression library file
    MCKRNLCL.DLL = Compression library file
    WHATSNEW.TXT = What's New document
     PACKING.LST = Packing list
    RESELLER.TXT = Network Associates authorized resellers


* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined
effort by anti-virus vendors throughout the world to
implement one standard by which customers can verify
their anti-virus installations.

To test your installation, copy the following line
into its own file, then save the file with the name
EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file size will be 69 or 70 bytes.

Next, start VirusScan and allow it to scan the
directory that contains EICAR.COM. When VirusScan
scans this file, it will report finding the
EICAR-STANDARD-AV-TEST-FILE virus.

Note that this file is NOT A VIRUS. Delete the file
when you have finished testing your installation to
avoid alarming unsuspecting users.

_____________
DOCUMENTATION

For more information, refer to the VirusScan Command
Line User's Guide included on the CD-ROM or available
from Network Associates electronic services. Each user's
guide is saved in Adobe Acrobat Portable Document Format
(.PDF). You can view and print this document with Adobe's
Acrobat Reader. PDF files can include hypertext links and
other navigation features to assist you in finding answers
to questions about your Network Associates product.

To download Adobe Acrobat Reader from the World Wide Web,
visit Adobe's website at:

http://www.adobe.com/prodindex/acrobat/readstep.html

To download Network Associates documentation, visit the
Network Associates website at:

http://www.nai.com

Additional contact information appears in the following
section.

Documentation feedback is welcome. Send e-mail to
tvd_documentation@nai.com.

__________________________
FREQUENTLY ASKED QUESTIONS

Regularly updated lists of frequently asked questions 
about Network Associates products also are available on
the Network Associates BBS and website, and on CompuServe
and America Online.
     

Q:  What is VirusScan Command Line for Windows NT
    (NTSCAN)?

A:  VirusScan Command Line for Windows NT is a virus scanning
    product that can run on Windows NT, examine hard disk
    partitions in NTFS (NT File System) and perform the
    same functions as VirusScan for DOS. It uses the same
    command-line interface as VirusScan for DOS and includes
    most of the same options. It differs substantially from 
    VirusScan for Windows NT and does not include
    a graphical user interface.


Q:  How do I enable the Centralized Alerting and Reporting
    option?

A:  VirusScan now supports Centralized Alerting and
    Reporting to remote NetWare or Windows NT servers
    running NetShield for Windows NT v2.5.3 and later
    or NetShield for NetWare v2.3.3 and later. To 
    configure this option on your VirusScan client,
    use the /ALERTPATH <directory> option, where the 
    <directory> is the path to the remote NetWare 
    volume or NT directory. From this directory, 
    NetShield can broadcast or compile the alerts 
    and reports according to its established
    configuration.

    NOTE: The client must have write access to this
    <directory> location and the directory must contain
    the NetShield-supplied CENTALRT.TXT file.

    To send a complete alert file that identifies the
    infected system and its user, establish the following
    environment variables or add them to the AUTOEXEC.BAT
    file.

      Set COMPUTERNAME=<name of computer>
      Set USERNAME=<user name>

    VirusScan sends an .alr text file to the server when
    it detects an infected file. When the server receives
    the alert file,  NetShield for Windows NT or NetShield
    for NetWare will send an alert message to an
    administrator and to other appropriate recipients.


Q:  Is this the only Network Associates scanning product
    with a command-line interface that runs on Windows NT?

A:  Although VirusScan Command Line for Windows NT
    is the only Windows NT scanner with a command-line
    interface, the SCAN32 program included with NetShield 
    for Windows NT and VirusScan for Windows NT can use a
    custom VirusScan Configuration file (.VSC) to perform
    the same functions. Network Associates does not offer
    SCAN32 as a separate, stand-alone product.


Q:  How do I use VirusScan Command Line for Windows NT?

A:  To use VirusScan to scan your hard disk, network disks
    or other disks, open a Windows NT command prompt window,
    then type NTSCAN <target drive specification> /<option1>
    /<option2> /<option3> at the command prompt. You can 
    choose to scan more than one disk, and you may combine
    options to run a narrowly targeted scan, if you wish.
    To learn more about the options available in VirusScan
    Command Line, see the User's Guide included with your
    copy.


Q:  What if my DOS session is infected? How can I avoid 
    spreading the infection to other areas of my hard
    disk?

A:  If your hard disk is formatted with File Allocation
    Table (FAT) partitions, use an uninfected, DOS boot
    floppy disk to start your computer, then run NTSCAN
    to check the remaining files on your hard disk.
    
    If your hard disk is formatted with an NT File System
    (NTFS) partition, follow these steps:

    a.  If VirusScan does not report that your command
        shell (CMD.EXE) is infected, open a new command
        prompt window, then run NTSCAN. Because all DOS
        sessions you run from your Windows NT system
        share the same file area but use different
        protected memory locations, you will avoid
        infecting any applications you run in the new
        DOS session.

    b.  If VirusScan reports that your command shell
        (CMD.EXE) is infected, either:

        1. Use the System control panel to change your 
           system's command shell to COMMAND.COM. To do
           this, click open the Control Panel window, 
           then double-click the System control panel.
           Next, click the Environment tab, then select
           ComSpec from the list of variables shown. At
           the bottom of the dialog box, enter the path
           to COMMAND.COM in the Value text box. Click
           Set to save your changes, then click OK to
           close the System Properties dialog box.

        OR

        2. Locate an uninfected copy of CMD.EXE, copy it
           to your system, and allow the copy to overwrite
           the infected CMD.EXE.


Q:  Can I use the same data files to update VirusScan
    Command Line for Windows NT as I would use to
    update VirusScan for DOS?

A:  Yes. VirusScan for Windows NT and VirusScan for DOS use
    the same virus definition files for scanning. If you
    have Internet access, you can download updated Network
    Associates data files from the Network Associates
    website, BBS, or other online resources. To download
    from the Network Associates website, follow these steps:
 
    1.  Go to the Network Associates website
        (http://www.nai.com).

    2.  Click the Download tab.

    3.  Click Update Virus DAT Files, then click Download
        Virus DAT File.

    4.  Follow the on-screen downloading instructions.

    5.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the files to the
        appropriate directory, replacing your old files.    

    6.  Before performing any scans, shut down your
        computer, wait a few seconds, and turn it on again.

    If you need additional assistance with downloading, 
    contact Network Associates Download Support at
    (408) 988-3832.

_____________________________
CONTACTING NETWORK ASSOCIATES

On December 1, 1997, McAfee Associates merged with
Network General Corporation, Pretty Good Privacy, Inc.,
and Helix Software, Inc. to form Network Associates, Inc.
You may direct all questions, comments and technical
support requests to the Network Associates Customer Care
department at any of the addresses or phone numbers
listed below.

Contact the Network Associates Customer Care
department at: 

1.  Phone (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III Fax 

3.  Fax-back automated response system (408) 988-3034

 
Send correspondence to any of the following Network
Associates locations:
  
     Network Associates Corporate Headquarters  
     3965 Freedom Circle
     McCandless Towers   
     Santa Clara, CA 95054

     Phone numbers for corporate-licensed customers:
     Phone: (408) 988-3832
     Fax:   (408) 970-9727

     Phone numbers for retail-licensed customers:
     Phone: (972) 278-6100
     Fax:   (408) 970-9727

Network Associates offices outside the United States:

     NA Network Associates Oy
     Kielotie 14 B
     01300 Vantaa
     FINLAND
     Phone: 358 9 836 2620
     Fax:   358 9 836 26222     

     Network Associates AG
     Baeulerwisenstrasse 3
     8152 Glattbrugg
     Switzerland
     Phone: 0041 1 808 99 66
     Fax:   0041 1 808 99 77

     Network Associates Australia
     Level 1, 500 Pacific Highway
     St. Leonards, NSW 2065
     Phone: 61-2-9437-5866
     Fax:   61-2-9439-5166  
  
     Network Associates Canada
     139 Main Street, Suite 201
     Unionville, Ontario
     Canada L3R 2G6
     Phone: (905) 479-4189
     Fax:   (905) 479-4540

     Network Associates Deutschland GmbH
     Industriestrasse 1
     D-82110 Germering
     Germany
     Phone: 49 8989 43 5600
     Fax:   49 8989 43 5699

     Network Associates International B.V.   
     Gatwickstraat 25   
     1043 GL Amsterdam    
     The Netherlands    
     Phone: 31 20 586 6100
     Fax:   31 20 586 6101

     Network Associates France S.A.   
     50 rue de Londres    
     75008 Paris     
     France
     Phone: 33 1 44 908 737
     Fax:   33 1 45 227 554

     Network Associates International Ltd.
     Minton Place, Victoria Street
     Windsor, Berkshire
     SL4 1EG
     United Kingdom
     Phone: 44 (0)1753 827500
     Fax:   44 (0)1753 827520

     Network Associates Japan, Inc.
     Toranomon 33 Mori Bldg.
     3-8-21 Toranomon
     Minato-ku, Tokyo 105-0001
     Japan
     Phone: 81 3 5408 0700
     Fax:   81 3 5408 0780

     Network Associates Korea
     135-090, 18th Floor, Kyoung-Am Bldg.
     157-27 Samsung-Dong, Kangnam-Ku
     Seoul, Korea
     Phone: 82 2 555-6818
     Fax:   82 2 555-5779

     Network Associates Latin America
     150 South Pine Island Road, Suite 205
     Plantation, Florida 33324
     Phone: (954) 452-1731
     Fax:   (954) 236-8031

     Network Associates Portugal
     Rua Gen. Ferreira Marines, 10-6 C
     1495 ALGES PORTUGAL
     Phone:  351 1 412 1077
     Fax:    351 1 412 1488

     Network Associates South East Asia
     7 Temasek Boulevard
     The Penthouse
     #44-01, Suntec Tower One
     Singapore 038987
     Phone: 65 430-6670
     Fax:   65 430-6671

     Network Associates Spain
     Serrano 240, Plta. -1
     28016 Madrid SPAIN
     Phone: 34 91 458 52 21
     Fax:   34 91 457 45 17

     Network Associates Srl
     Centro Direzionale Summit     
     Palazzo D/1
     Via Brescia, 28
     20063 - Cernusco sul Naviglio (MI)
     ITALY  
     Phone: 39 (0)2 9214 1555   
     Fax:   39 (0)2 9214 1644

     Net Tools Network Associates South Africa
     St. Andrews
     Meadowbrook Lane
     P.O. Box 7062
     Bryanston 2021
     South Africa
     Phone: 27 11 706-1629
     Fax:   27 11 706-1569

Or, you can receive online assistance through any
of the following resources:

 1.  Internet E-mail: support@nai.com

 2.  Internet FTP: ftp.nai.com

 3.  World Wide Web: http://support.nai.com

 4.  America Online: keyword MCAFEE

 5.  CompuServe: GO NAI

To provide the answers you need quickly and efficiently,
the Network Associates technical support staff needs
some information about your computer and your software.
Please have this information ready when you call:
                          
 - Program name and version number
 - Computer brand and model
 - Any additional hardware or peripherals connected to
   your computer
 - Operating system type and version numbers
 - Network name, operating system, and version
 - Network card installed, where applicable
 - Modem manufacturer, model, and baud, where applicable
 - Relevant browsers or applications and their version 
   numbers, where applicable
 - How to reproduce your problem: when it occurs, whether
   you can reproduce it regularly, and under what 
   conditions
 - Information needed to contact you by voice, fax, or 
   e-mail

We also seek and appreciate general feedback.

 
* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use Network
Associates products, we have established a reseller's
program to provide service, sales, and support for our
products worldwide. For a listing of resellers, see the
resellers.txt file or contact Network Associates
Customer Care for resellers near you.

 
* FOR REPORTING PROBLEMS *

Network Associates prides itself on delivering a
high-quality product. If you find any problems, please
take a moment to review the contents of this file. If
the problem you've encountered is documented, there is
no need to report the problem to Network Associates.

If you find any feature that does not appear to
function properly on your system, or if you believe
an application would benefit greatly from enhancement,
please contact Network Associates with your suggestions
or concerns.


* FOR ON-SITE TRAINING INFORMATION *

Contact Network Associates Customer Service at
(800) 338-8754.


* NETWORK ASSOCIATES BETA SITE *

Get pre-release software, including DAT files, through
http://beta.nai.com. You will have access to Public
Beta and External Test Areas. Your feedback will make
a difference.