        What's New in McAfee VirusScan Command Line
               for Windows NT v3.2.1 (3111)
    Copyright (c) 1992-1998 by Network Associates, Inc.,
     and its Affiliated Companies. All Rights Reserved.


Thank you for using McAfee VirusScan Command Line for
Windows NT. This What's New file contains important
information regarding the current version of this product.
Network Associates strongly recommends that you read the
entire document.

Network Associates welcomes your comments and suggestions.
Please use the information provided in this file to contact
Customer Care and technical support.

___________________
WHAT'S IN THIS FILE

- New Features          
- Known Issues
- Installation          
- Documentation         
- Frequently Asked Questions  
- Contacting Network Associates

____________
NEW FEATURES

1.  An updated scanning engine allows VirusScan Command
    Line for Windows NT to detect files infected with
    the CIH and Marburg viruses. These viruses infect
    Windows 95 and Windows 98 portable executable (PE)
    files. A portable executable file is a Windows
    resource file that other executable files can share
    --examples include dynamic linking library (.DLL)
    files. Although these viruses do not infect Windows
    NT resource files directly, they can still spread
    via Windows NT servers that host Windows 95 or
    Windows 98 client computers.

2.  The updated scanning engine also includes improved
    detection and cleaning capability for the TEOCATL
    virus and for a new strain of the XF/PAIX virus.
    Other improvements include detection and cleaning
    capability for the GROOV, COMPAT and CABANAS.A and
    CABANAS.B viruses, and fixes for minor cleaning issues.

3.  VirusScan Command Line for Windows NT now detects
    macro viruses in Microsoft Access database files.

4.  VirusScan checks the .DAT file version in use for
    compatibility with its newer scan engines. It will
    prompt you to update incompatible .DAT files. 


* NEW VIRUSES DETECTED *

The 3111 .DAT files included with this release of VirusScan
Command Line for Windows NT detect these 159 new viruses:

AARDWOLF.448
ACUREV.666
ACUREV.670
ANDRIOD
ANTIMARC.A
APPDER.X
APSTROJAN.GEN
ATTENTION.B
AUTOD.A
BABYLON.3081
BAP.1536
BEEP
BERNIE.A
BLURP.4733
CARRIER
CARRIERS.6580
CHACK.A
CHACK.D
CHACK.E
CHACK.F
CHACK.H
CHAOS
CHRIS.597
CLASS.C
CLASS.D
CONFIG.BOOT 
COWA.2193
CROSS.B
CROSS.C
CYRUS.186
DEBE.1229
DG.378
DMV.L
DMV.M
DNA.1206
DOGPAW.720
DRAW.A
DREAMS.A
DWMVCK1.E
FAYTE.494
FOO.956
GABI.A
GRADE.956
GROOV.D
GWAR
HARK.B
HAVJIVA.492
HEPATITIS.1270
HINDER.380
HMA.BOOT.A 
HYSTERIA.1784
HYSTERIA.1852
IMPLANT
INSERT.292
INTO.708
IVANA.D
IVP.858
JEDI.B
JEDI.E
JEDI.F
JPAGE.821
KELLIE.521
KEYKILLER.665
KOMPU.M
LULUNG.A
LUPITA.A
MANDRAGORE.664
MARBLE.A
MDRG.533
MDRG.669
MESSEV.3158
MINIMAL.AC
NETBUS.153
NOTTICE.B
NUCLEII
PADANIA.D:IT
PB.742
PRION.CAV.313
PRIVIET.1931
PUNKY.543
RAME.965
RAT.848
RUBY.1055
SANDRINA.1091
SETMD.C
SISORUEN.453
SISORUEN.465
SLUG.872
SMILE.5504
SNARK.819
SOLDIER.1480
SPICE.2125
STEROID.G
STEROID.I
TANJUNG.A
TOPOL
TORRERO.1427
TRIP.1952
TRIVIAL.628
TSUNAMI.3001
TSUNAMI.3011
TWIN.351
VALHALA.758
VB.529
VCC.573
VECNA.TRON.B
W32.CABANAS
W32.CABANAS.A
W32.CABANAS.B
W95/MARKJ.B
W95/MURKRY
W95/PADANIA
W97M/VMPCK1.D
WAZZU.FG
WAZZU.FI
WAZZU.FK
WIN32.NETBUS.160
WIN95.JACKY.1440
WINSTART.900 
WINTERMUTE.1052
WINTERMUTE.1060
WM/DHANUPOL
WOESTI.200
X97M/LAROUX.EM
XCHG.118
XM.2379
XM.828
XM/DISASTER.A
XM/HIDEMOD.A
XM/LAROUX.CL
XM/LAROUX.CX
XM/LAROUX.CZ
XM/LAROUX.DA
XM/LAROUX.DF
XM/LAROUX.DJ
XM/LAROUX.DM
XM/LAROUX.EB
XM/LAROUX.EC
XM/LAROUX.EL
XM/LAROUX.FA
XM/LAROUX.NEW18
XM/LAROUX.NEW19
XM/LAROUX.NEW20
XM/LAROUX.NEW21
XM/NEG.C
XM/NINJA.E
XM/SHIVER.D
XM/SW.A
XM/TABEJ.C
XM/TEOCATL.B
XM/TSTVR
XRES.395
YEZ.1155
ZLODIC.52
ZLODIC.999
ZMK.G
ZMK.I
ZMK.K
ZMK.N
ZOHRA.4516
ZOMBIE.15467


* NEW VIRUSES REMOVED *

The 3111 .DAT files remove the 92 new viruses shown in the 
list below. Network Associates software removes a virus
either by removing the infecting virus code from files or
by removing the file from your computer.

AARDWOLF.448
ANTIMARC.A
APPDER.X
APSTROJAN.GEN
ATTENTION.B
AUTOD.A
BAP.1536
BEEP
BERNIE.A
CARRIER
CHACK.A
CHACK.D
CHACK.E
CHACK.F
CHACK.H
CHAOS
CLASS.C
CLASS.D
CONFIG.BOOT 
CROSS.B
CROSS.C
CYRUS.186
DMV.L
DMV.M
DNA.1206
DRAW.A
DREAMS.A
DWMVCK1.E
FOO.956
GABI.A
GROOV.D
HARK.B
HMA.BOOT.A 
IVANA.D
IVANA.D
JEDI.B
JEDI.E
JEDI.F
KOMPU.M
LULUNG.A
LUPITA.A
MARBLE.A
MDRG.533
MDRG.669
MINIMAL.AC
NETBUS.153
NOTTICE.B
PADANIA.D:IT
SETMD.C
STEROID.G
STEROID.I
TANJUNG.A
W32.CABANAS.A
W32.CABANAS.B
W97M/VMPCK1.D
WAZZU.FG
WAZZU.FI
WAZZU.FK
WIN32.NETBUS.160
WINSTART.900 
WM/DHANUPOL
X97M/LAROUX.EM
XM/DISASTER.A
XM/HIDEMOD.A
XM/LAROUX.CL
XM/LAROUX.CX
XM/LAROUX.CZ
XM/LAROUX.DA
XM/LAROUX.DF
XM/LAROUX.DJ
XM/LAROUX.DM
XM/LAROUX.EB
XM/LAROUX.EC
XM/LAROUX.EL
XM/LAROUX.FA
XM/LAROUX.NEW18
XM/LAROUX.NEW19
XM/LAROUX.NEW20
XM/LAROUX.NEW21
XM/NEG.C
XM/NINJA.E
XM/SHIVER.D
XM/SW.A
XM/TABEJ.C
XM/TEOCATL.B
XM/TSTVR
ZMK.G
ZMK.I
ZMK.K
ZMK.N
ZOHRA.4516
ZOMBIE.15467

____________
KNOWN ISSUES

1.  Because Windows NT includes security features that
    protect your system from unauthorized tampering,
    VirusScan cannot scan certain files on your system.
    These files include PAGEFILE.SYS, registry hive
    files, and user profiles. When VirusScan tries to
    scan these files, your system will beep and display
    a Read Access Denied error message. This message is
    not critical and does not affect how your system
    functions.

2.  VirusScan Command Line for Windows NT cannot scan the
    boot sectors or the Master Boot Record on your hard
    disk unless you have administrative rights. To use
    VirusScan to scan these areas, you must log in as a
    user that has administrative rights.

____________
INSTALLATION

* INSTALLING VIRUSSCAN COMMAND LINE FOR WINDOWS NT *

To install VirusScan Command Line for Windows NT,
follow these steps:

1.  Make a directory for VirusScan on your hard disk.

2.  Copy the VirusScan files to that directory.

3.  Use any text editor to open your AUTOEXEC.BAT
    file, then add the directory you just created to
    the path statement in that file. To learn how
    to edit your AUTOEXEC.BAT file, consult your 
    Windows NT documentation.
                              

* PRIMARY PROGRAM FILES FOR VIRUSSCAN COMMAND LINE *

Files located in the Install directory:
=======================================

      NTSCAN.EXE = VirusScan for Windows NT Command
                   Line program
      README.1ST = License and registration information
        SCAN.DAT = Virus scan definition data
       NAMES.DAT = Virus names definition data
       CLEAN.DAT = Virus clean definition data
    POLYSCAN.DAT = Data file for advanced polymorphic virus
                   detection
        SCAN.EXE = MS-DOS scan program
    VALIDATE.EXE = Network Associates file validation
                   program
    MCARCHCL.DLL = Compression library file
    MCUTILCL.DLL = Compression library file
    MCKRNLCL.DLL = Compression library file
    WHATSNEW.TXT = What's New document
     PACKING.LST = Packing list
    RESELLER.TXT = Network Associates authorized resellers


* TESTING YOUR INSTALLATION *

The Eicar Standard AntiVirus Test File is a combined
effort by anti-virus vendors throughout the world to
implement one standard by which customers can verify
their anti-virus installations.

To test your installation, copy the following line
into its own file, then save the file with the name
EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file size will be 69 or 70 bytes.

Next, start VirusScan and allow it to scan the
directory that contains EICAR.COM. When VirusScan
scans this file, it will report finding the
EICAR-STANDARD-AV-TEST-FILE virus.

Note that this file is NOT A VIRUS. Delete the file
when you have finished testing your installation to
avoid alarming unsuspecting users.

_____________
DOCUMENTATION

For more information, refer to the VirusScan Command
Line User's Guide included on the CD-ROM or available
from Network Associates electronic services. Each user's
guide is saved in Adobe Acrobat Portable Document Format
(.PDF). You can view and print this document with Adobe's
Acrobat Reader. PDF files can include hypertext links and
other navigation features to assist you in finding answers
to questions about your Network Associates product.

To download Adobe Acrobat Reader from the World Wide Web,
visit Adobe's website at:

http://www.adobe.com/prodindex/acrobat/readstep.html

To download Network Associates documentation, visit the
Network Associates website at:

http://www.nai.com

Additional contact information appears in the following
section.

Documentation feedback is welcome. Send e-mail to
tvd_documentation@nai.com.

__________________________
FREQUENTLY ASKED QUESTIONS

Regularly updated lists of frequently asked questions 
about Network Associates products also are available on
the Network Associates BBS and website, and on CompuServe
and America Online.
     

Q:  What is VirusScan Command Line for Windows NT
    (NTSCAN)?

A:  VirusScan Command Line for Windows NT is a virus scanning
    product that can run on Windows NT, examine hard disk
    partitions in NTFS (NT File System) and perform the
    same functions as VirusScan for DOS. It uses the same
    command-line interface as VirusScan for DOS and includes
    most of the same options. It differs substantially from 
    VirusScan for Windows NT and does not include
    a graphical user interface.


Q:  How do I enable the Centralized Alerting and Reporting
    option?

A:  VirusScan now supports Centralized Alerting and
    Reporting to remote NetWare or Windows NT servers
    running NetShield for Windows NT v2.5.3 and later
    or NetShield for NetWare v2.3.3 and later. To 
    configure this option on your VirusScan client,
    use the /ALERTPATH <directory> option, where the 
    <directory> is the path to the remote NetWare 
    volume or NT directory. From this directory, 
    NetShield can broadcast or compile the alerts 
    and reports according to its established
    configuration.

    NOTE: The client must have write access to this
    <directory> location and the directory must contain
    the NetShield-supplied CENTALRT.TXT file.

    To send a complete alert file that identifies the
    infected system and its user, establish the following
    environment variables or add them to the AUTOEXEC.BAT
    file.

      Set COMPUTERNAME=<name of computer>
      Set USERNAME=<user name>

    VirusScan sends an .alr text file to the server when
    it detects an infected file. When the server receives
    the alert file,  NetShield for Windows NT or NetShield
    for NetWare will send an alert message to an
    administrator and to other appropriate recipients.


Q:  Is this the only Network Associates scanning product
    with a command-line interface that runs on Windows NT?

A:  Although VirusScan Command Line for Windows NT
    is the only Windows NT scanner with a command-line
    interface, the SCAN32 program included with NetShield 
    for Windows NT and VirusScan for Windows NT can use a
    custom VirusScan Configuration file (.VSC) to perform
    the same functions. Network Associates does not offer
    SCAN32 as a separate, stand-alone product.


Q:  How do I use VirusScan Command Line for Windows NT?

A:  To use VirusScan to scan your hard disk, network disks
    or other disks, open a Windows NT command prompt window,
    then type NTSCAN <target drive specification> /<option1>
    /<option2> /<option3> at the command prompt. You can 
    choose to scan more than one disk, and you may combine
    options to run a narrowly targeted scan, if you wish.
    To learn more about the options available in VirusScan
    Command Line, see the User's Guide included with your
    copy.


Q:  What if my DOS session is infected? How can I avoid 
    spreading the infection to other areas of my hard
    disk?

A:  If your hard disk is formatted with File Allocation
    Table (FAT) partitions, use an uninfected, DOS boot
    floppy disk to start your computer, then run NTSCAN
    to check the remaining files on your hard disk.
    
    If your hard disk is formatted with an NT File System
    (NTFS) partition, follow these steps:

    a.  If VirusScan does not report that your command
        shell (CMD.EXE) is infected, open a new command
        prompt window, then run NTSCAN. Because all DOS
        sessions you run from your Windows NT system
        share the same file area but use different
        protected memory locations, you will avoid
        infecting any applications you run in the new
        DOS session.

    b.  If VirusScan reports that your command shell
        (CMD.EXE) is infected, either:

        1. Use the System control panel to change your 
           system's command shell to COMMAND.COM. To do
           this, click open the Control Panel window, 
           then double-click the System control panel.
           Next, click the Environment tab, then select
           ComSpec from the list of variables shown. At
           the bottom of the dialog box, enter the path
           to COMMAND.COM in the Value text box. Click
           Set to save your changes, then click OK to
           close the System Properties dialog box.

        OR

        2. Locate an uninfected copy of CMD.EXE, copy it
           to your system, and allow the copy to overwrite
           the infected CMD.EXE.


Q:  Can I use the same data files to update VirusScan
    Command Line for Windows NT as I would use to
    update VirusScan for DOS?

A:  Yes. VirusScan for Windows NT and VirusScan for DOS use
    the same virus definition files for scanning. If you
    have Internet access, you can download updated Network
    Associates data files from the Network Associates
    website, BBS, or other online resources. To download
    from the Network Associates website, follow these steps:
 
    1.  Go to the Network Associates website
        (http://www.nai.com).

    2.  Click the Download tab.

    3.  Click Update Virus DAT Files, then click Download
        Virus DAT File.

    4.  Follow the on-screen downloading instructions.

    5.  Data file updates are stored in a compressed form 
        to reduce transmission time. Unzip the files into
        a temporary directory, then copy the files to the
        appropriate directory, replacing your old files.    

    6.  Before performing any scans, shut down your
        computer, wait a few seconds, and turn it on again.

    If you need additional assistance with downloading, 
    contact Network Associates Download Support at
    (408) 988-3832.

_____________________________
CONTACTING NETWORK ASSOCIATES

On December 1, 1997, McAfee Associates merged with
Network General Corporation, Pretty Good Privacy, Inc.,
and Helix Software, Inc. to form Network Associates, Inc.
You may direct all questions, comments and technical
support requests to the Network Associates Customer Care
department at any of the addresses or phone numbers
listed below.

Contact the Network Associates Customer Care
department at: 

1.  Phone (408) 988-3832
    Monday-Friday, 6:00 A.M. - 6:00 P.M. Pacific time

2.  Fax (408) 970-9727
    24-hour, Group III Fax 

3.  Fax-back automated response system (408) 346-3414

 
Send correspondence to any of the following Network
Associates locations:
  
     Network Associates Corporate Headquarters  
     3965 Freedom Circle
     McCandless Towers   
     Santa Clara, CA 95054

     Phone numbers for corporate-licensed customers:
     Phone: (408) 988-3832
     Fax:   (408) 970-9727

     Phone numbers for retail-licensed customers:
     Phone: (972) 278-6100
     Fax:   (408) 970-9727

Network Associates offices outside the United States:

     Network Associates Australia
     Level 1, 500 Pacific Highway
     St. Leonards, NSW
     Sydney, Australia 2065
     Phone: 61-2-8425-4200
     Fax:   61-2-9439-5166 

     Network Associates Austria
     Pulvermuehlstrasse 17
     Linz, Austria
     Postal Code A-4040
     Phone: 43-732-757-244
     Fax:   43-732-757-244-20

     Network Associates Belgium
     Bessenveldtstraat 25a
     Diegem, Belgium - 1831
     Phone: 32-3-716-4070
     Fax:   61-2-716-4770

     Network Associates do Brasil
     Rua Geraldo Flausino Gomez 78
     Cj. - 51 Brooklin Novo - So Paulo
     SP - 04575-060 - Brasil
     Phone:  (55 11) 5505 1009
     Fax:    (55 11) 5505 1006

     Network Associates Canada
     139 Main Street, Suite 201
     Unionville, Ontario
     Canada L3R 2G6
     Phone: (905) 479-4189
     Fax:   (905) 479-4540

     Network Associates People's Republic of China
     New Century Office Tower, Room 1557
     No. 6 Southern Road Capitol Gym 
     Beijing
     People's Republic of China 100044
     Phone: 86 10 6849-2650
     Fax:   86 10 6849-2069

     NA Network Associates Oy
     Kielotie 14 B
     01300 Vantaa
     Finland
     Phone: 358 9 836 2620
     Fax:   358 9 836 26222 

     Network Associates France S.A.   
     50 Rue de Londres    
     75008 Paris     
     France
     Phone: 33 1 44 908 737
     Fax:   33 1 45 227 554  

     Network Associates Deutschland GmbH
     Industriestrasse 1
     D-82110 Germering
     Germany
     Phone: 49 8989 43 5600
     Fax:   49 8989 43 5699 

     Network Associates Hong Kong
     19/F, Matheson Centre
     3 Matheson Street
     Causeway Bay
     Hong Kong
     Phone: 852-2832-9525
     Fax:   852-2832-9530

     Network Associates Srl
     Centro Direzionale Summit     
     Palazzo D/1
     Via Brescia, 28
     20063 - Cernusco sul Naviglio (MI)
     ITALY  
     Phone: 39 (0)2 9214 1555   
     Fax:   39 (0)2 9214 1644

     Network Associates Japan, Inc.
     Toranomon 33 Mori Bldg.
     3-8-21 Toranomon Minato-ku
     Tokyo 105-0001 Japan
     Phone: 81 3 5408 0700
     Fax:   81 3 5408 0781

     Network Associates Latin America
     150 South Pine Island Road, Suite 205
     Plantation, Florida 33324
     United States
     Phone: (954) 452-1731
     Fax:   (954) 236-8031

     Network Associates de Mexico
     Andres Bello No. 10, 4 Piso
     4th Floor
     Col. Polanco
     Mexico City, Mexico D.F. 11560
     Phone: (525) 282-9180
     Fax:   (525) 282-9183

     Network Associates International B.V.   
     Gatwickstraat 25   
     1043 GL Amsterdam    
     The Netherlands    
     Phone: 31 20 586 6100
     Fax:   31 20 586 6101

     Network Associates Portugal
     Av. da Liberdade, 114
     1269-046 Lisboa
     Portugal
     Phone:  351 1 340 4543
     Fax:    351 1 340 4575

     Net Tools Network Associates South Africa
     Bardev House, St. Andrews
     Meadowbrook Lane
     Epson Downs, P.O. Box 7062
     Bryanston, Johannesburg
     South Africa 2021
     Phone: 27 11 706-1629
     Fax:   27 11 706-1569

     Network Associates South East Asia
     7 Temasek Boulevard
     The Penthouse
     #44-01, Suntec Tower One
     Singapore 038987
     Phone: 65 430-6670
     Fax:   65 430-6671

     Network Associates Spain
     Orense 4, 4th Floor
     Edificio Trieste
     28020 Madrid
     Spain
     Phone: 34 91 598 18 00
     Fax:   34 91 556 14 04

     Network Associates Sweden
     Datavgen 3A
     Box 596
     S-175 26 Jrflla
     Sweden
     Phone: 46 (0) 8 580 100 00
     Fax:   46 (0) 8 580 100 05

     Network Associates AG
     Baeulerwisenstrasse 3
     8152 Glattbrugg
     Switzerland
     Phone: 0041 1 808 99 66
     Fax:   0041 1 808 99 77

     Network Associates International Ltd.
     Minton Place, Victoria Street
     Windsor, Berkshire
     SL4 1EF
     United Kingdom
     Phone: 44 (0)1753 827 500
     Fax:   44 (0)1753 827 520


Or, you can receive online assistance through any
of the following resources:

 1.  Internet E-mail: support@nai.com

 2.  Internet FTP: ftp.nai.com

 3.  World Wide Web: http://support.nai.com

 4.  America Online: keyword MCAFEE

 5.  CompuServe: GO NAI

To provide the answers you need quickly and efficiently,
the Network Associates technical support staff needs
some information about your computer and your software.
Please have this information ready when you call:
                          
 - Program name and version number
 - Computer brand and model
 - Any additional hardware or peripherals connected to
   your computer
 - Operating system type and version numbers
 - Network name, operating system, and version
 - Network card installed, where applicable
 - Modem manufacturer, model, and baud, where applicable
 - Relevant browsers or applications and their version 
   numbers, where applicable
 - How to reproduce your problem: when it occurs, whether
   you can reproduce it regularly, and under what 
   conditions
 - Information needed to contact you by voice, fax, or 
   e-mail

We also seek and appreciate general feedback.

 
* FOR PRODUCT UPGRADES *

To make it easier for you to receive and use Network
Associates products, we have established a reseller's
program to provide service, sales, and support for our
products worldwide. For a listing of resellers, see the
resellers.txt file or contact Network Associates
Customer Care for resellers near you.

 
* FOR REPORTING PROBLEMS *

Network Associates prides itself on delivering a
high-quality product. If you find any problems, please
take a moment to review the contents of this file. If
the problem you've encountered is documented, there is
no need to report the problem to Network Associates.

If you find any feature that does not appear to
function properly on your system, or if you believe
an application would benefit greatly from enhancement,
please contact Network Associates with your suggestions
or concerns.


* FOR ON-SITE TRAINING INFORMATION *

Contact Network Associates Customer Service at
(800) 338-8754.


* NETWORK ASSOCIATES BETA SITE *

Get pre-release software, including DAT files, through
http://beta.nai.com. You will have access to Public
Beta and External Test Areas. Your feedback will make
a difference.