      Release Notes for McAfee 4139 .DAT Files
    Copyright (c) 1992-2001 Networks Associates
       Technology, Inc. All Rights Reserved.

////////////////////////////////////////////////
   DAT 4139 Release Date:       May 17, 2001
   Current SuperDAT Engine Version:   4.1.40
////////////////////////////////////////////////


Thank you for using McAfee products. This Read Me
file contains important information regarding the
current data (.DAT) files. McAfee strongly
recommends that you read the entire document.

McAfee welcomes your comments and suggestions.
Please use the information provided in this file to
contact Customer Care, technical support, or the
documentation team for this product.


___________________
WHAT'S IN THIS FILE

- WD1  What Are .DAT files?
- WX1  What Is The 4139XDAT.EXE File?
- WU1  Which File To Use
       - WU2  When to Use the 4139XDAT.EXE 
              Utility
       - WU3  When to Use DAT-4139.ZIP or
              DAT-4139.TAR
- DC1  Documentation
- IN1  Installation
       - IN2  Preparing to Install .DAT Files
       - IN3  Using 4139XDAT.EXE to Update .DAT
              Files
       - IN4  Using DAT-4139.ZIP or DAT-4139.TAR
              to Update VirusScan Command Line and
              VirusScan for UNIX Software
       - IN5  Using DAT-4139.ZIP to Update
              Other Products
       - IN6  Primary Program Files for Virus
              Definitions
       - IN7  Testing Your Installation
- DV1  New Viruses Detected and Removed
       - DV2  New Detections
       - DV3  New Removals
       - DV4  INTERNET.DAT Detections
- UV1  Understanding Virus Names
       - UV2  Prefix
       - UV3  Infix
       - UV4  Suffix
       - UV5  Generic Detections
- NA1  Contacting Network Associates
       - NA2  Download Support 
       - NA3  For Product Upgrades 
       - NA4  For Reporting Problems 
       - NA5  for On-site Training Information 
       - NA6  Mcafee Beta Site 
       - NA7  AVERT Anti-virus Research Site 
- CT1  Copyright and Trademark Attributions
       - CT2  Trademarks
       - CT3  License Agreement

NOTE:
  A unique identifying code precedes each heading
  in this file. To jump to a particular heading
  within the file, copy the three-character
  code -- NA1, for example -- from the list above
  into your text editor's Find dialog box, or
  equivalent, then search for the identifying code
  to move directly to that heading.

             ****IMPORTANT NOTES****
*  Notice: This emergency DAT release has been 
   produced to provide protection for the 
   VBS/VBSWG virus variant also known as "Mawanella".

*  NOTICE: McAfee no longer provides the weekly
   40XXUPDT.EXE utility for .DAT-only updates.
   Instead, McAfee now provides 4139XDAT.EXE, an
   update utility for the same purpose.
   4139XDAT.EXE uses the same technology that the
   weekly SuperDAT utility uses. This change does
   NOT affect the release and distribution of
   regular SuperDAT packages in any way.

   You may use 4139XDAT.EXE to update all
   supported v4.0.1 and later anti-virus product
   releases, including v4.5 releases. As with the
   current SuperDAT package, 4139XDAT.EXE does
   not support GroupShield Notes v4.x or NetShield
   for Novell NetWare versions, nor any version of
   Dr Solomon Anti-Virus Toolkit software. The
   package DOES support GroupShield Domino v5.0
   software, however.

*  The 4139 .DAT files are compatible with McAfee
   anti-virus products that use any 4.x.xx scan
   engine version. This does NOT include VirusScan
   v4.0.0 anti-virus software, which uses a v3.2.2
   scanning engine. These .DAT files will NOT work
   with v3.x or v2.x scan engines. McAfee recommends
   that you upgrade to the latest version of the
   v4.x.xx engine for optimal virus detection and
   repair.

                     *****
__________________________
WD1 - WHAT ARE .DAT FILES?

Virus definition, or .DAT, files contain up-to-date
virus signatures and other information that McAfee
anti-virus products use to protect your computer
against the thousands of computer viruses in
circulation. McAfee releases new .DAT files
regularly to provide protection against the
approximately 500 new viruses that appear each
month. To ensure that your anti-virus software
can protect your system or network against the
latest virus threats, download and install the
latest .DAT files.

____________________________________
WX1 - WHAT IS THE 4139XDAT.EXE FILE?

This new utility installs updated .DAT files for
your McAfee anti-virus products. It replaces the
4139UPDT.EXE utility, which means that you now get
a double-clickable Setup package you can use to update
your McAfee anti-virus product .DAT files, but with
wider platform and product support.

The utility uses SuperDAT technology to shut down
any active scan operations, services, or other
memory-resident software components that might
interfere with your updates. It then copies the new
files to their proper locations and enables your
software to use them immediately. It differs from a
regular SuperDAT package in that it updates ONLY
your .DAT files, which means you can download this
package if you already have a current scan engine
and want to save time and bandwidth.

NOTE:
  The 4139XDAT.EXE utility platform and product
  support is the same as that for the SuperDAT
  utility. To learn more, see the SuperDAT package
  README.TXT file.

_______________________
WU1 - WHICH FILE TO USE

* WU2 - WHEN TO USE THE 4139XDAT.EXE UTILITY *

McAfee provides the 4139XDAT.EXE utility to make
.DAT file updating quick and simple. The utility
uses SuperDAT technology, but does not update the
scan engine for your anti-virus software. Use the
utility when your scan engine is current and
you want to download a smaller SuperDAT upgrade and
update package.

The 4139XDAT.EXE utility is compatible with most
McAfee v4.x anti-virus products, including most
v4.5 product versions. The utility does NOT
support these products:

*  McAfee product versions that incorporate an
   engine version earlier than 4.x. This includes
   all v3.x products, all v2.x products, and the
   retail version of VirusScan v4.0.0 anti-virus
   software for Windows 95 and Windows 98.

   In addition, if you have a RETAIL version of
   VirusScan v4.0.1 anti-virus software for
   Windows 95 and Windows 98, the SuperDAT
   utility will update your .DAT files only -- it
   will not upgrade the scanning engine for that
   software version. This same issue occurs with
   v4.0.2 of the same software package, but only
   if you install it silently.

*  Any Dr Solomon Anti-Virus Toolkit product.

*  NetShield anti-virus software for NetWare

*  GroupShield anti-virus software for Lotus
   Notes.

   WARNING:
     Do NOT install the SuperDAT version for Intel
     architecture on Digital Alpha computers, or the
     SuperDAT version for Digital Alpha computers on
     Intel-architecture computers.


* WU3 - WHEN TO USE DAT-4139.ZIP OR DAT-4139.TAR *

The DAT-4139.ZIP and dat-4139.tar packages allow you
to update the .DAT files for any McAfee v4.x anti-
virus product except for VirusScan v4.0.0 anti-virus
software.

The difference between these files and the other,
executable, files is that you must stop any scan
operations or scan services and unload any
Terminate-and-Stay-Resident (TSR) programs from your
computer's memory yourself. You must then copy the
new files to your anti-virus software's program
directory, then restart the services or background
scanning software your application uses.

Alternatively, if your anti-virus software has an
AutoUpdate feature, you can configure it to download
and install one of these packages. Version 4.5-series
anti-virus packages can also use incremental .DAT
file updating. To learn more about incremental .DAT
files, consult your product documentation.

These McAfee products require you to use the
DAT-4139.ZIP or the DAT-4139.TAR files to update
your .DAT files:

 * VirusScan for UNIX
 * GroupShield* for Lotus Notes
 * WebShieldX* Proxy

To learn how to use these utilities, see "IN1 -
Installation" later in this file.

___________________
DC1 - DOCUMENTATION

McAfee, a division of Network Associates, Inc.,
provides each of its products with an extensive set
of documentation, which usually consists of one or
more product guides saved in Adobe Acrobat Portable
Document Format (.PDF), and an online help system,
whose form can vary, depending on the platform on
which the product runs.

Acrobat .PDF files are flexible online documents
that contain hyperlinks, outlines and other aids
for easy navigation and information retrieval.
You can also install an Acrobat plug-in file
that allows you to read .PDF documents from
within your web browser while online. Copies
of the product documentation come with the
product CD-ROM or are available on the Network
Associates website at:

ftp://ftp.nai.com/pub/manuals/total_virus_defense

A copy of the latest version of the free Acrobat
Reader also comes with the product CD-ROM, or
you can download the latest English-language
version from the Network Associates FTP site at:

ftp://ftp.nai.com/pub/manuals/acrobat_reader

To download other Acrobat Reader versions, visit
the Adobe website at:

http://www.adobe.com/prodindex/acrobat/readstep.html

IMPORTANT:
  Most McAfee product documentation produced during
  and after September 1999 requires the use of
  Adobe Acrobat Reader v4.0. Exceptions include
  documentation for products that run on Windows 3.1x
  systems and products that run on OS/2 systems. The
  most current Acrobat Reader versions available for
  these platforms are v3.x versions.

To comment, ask about, or suggest improvements
to McAfee anti-virus product documentation, send
e-mail to:

tvd_documentation@nai.com

To get answers to your technical support
questions, send messages to:

techsupport@mcafee.com

To ask about your eligibility for updates and
upgrades, check your registration, or ask
general questions related to McAfee anti-virus
software, send messages to:

services_corporate_division@nai.com

__________________
IN1 - INSTALLATION

* IN2 - PREPARING TO INSTALL .DAT FILES *

McAfee stores .DAT file updates on its website in a
compressed format to reduce transmission time, and
makes the updates available in three formats: as an
executable file that includes a setup feature; as a
.ZIP or tar archive that you can extract and install
yourself to update some, though not all, McAfee
anti-virus software; and as part of a SuperDAT
executable package that often includes scan engine
and other program component upgrades. Your options
are:

*  4139XDAT.EXE. Down load this package to update
   the .DAT files in most McAfee anti-virus
   software. Visit the Network Associates website
   at:

   http://www.nai.com/asp_set/download/dats/mcafee_4x.asp

*  DAT-4139.ZIP and dat-4139.tar. Download
   either of these packages specifically to
   update the VirusScan for UNIX application,
   the GroupShield Notes applications, or the
   NetShield NetWare application. You can also
   use this file to update the .DAT files for any
   other McAfee anti-virus software, should you
   wish. Visit the Network Associates website at:

   http://www.nai.com/asp_set/download/dats/mcafee_4x.asp

*  SDAT4139.EXE. Download the SuperDAT executable
   package to update a range of McAfee anti-virus
   software. See the README.TXT file for the
   SuperDAT utility for a complete list of
   supported products. The SuperDAT package can
   also include scan engine upgrades and upgrades
   to other program components. Visit the Network
   Associates website at:

   http://www.nai.com/asp_set/download/dats/superdat.asp

   NOTE:
     This file does NOT discuss how to use the
     SuperDAT package to update and upgrade your
     anti-virus software. To learn about the
     SuperDAT executable package, see the README.TXT
     file posted with the SuperDAT package.

* IN3 - USING 4139XDAT.EXE TO UPDATE .DAT FILES *

To install new .DAT file updates quickly and easily,
first create a temporary directory on your hard
disk, then copy the 4139XDAT.EXE utility to that
directory. Next, locate the file you downloaded,
then double-click it to start the update. Follow the
wizard panel instructions that appear to update your
.DAT files.

The utility will unload McAfee memory-resident
software or stop Windows NT services that use your
current .DAT files before it copies updated .DAT
files to the appropriate program directories. It
will then restart the software components needed to
continue scan operations with your updated .DAT
files.

WARNING:
  Do NOT attempt to install the utility versions for
  Digital Alpha computers on Intel-architecture
  computers, or vice-versa.

When 4139XDAT.EXE has finished updating your .DAT
files, you may delete the archive file you downloaded
from your hard disk, unless you want to keep a copy
available for further updates.

IMPORTANT:
  The 4139XDAT.EXE utility does not support
  VirusScan for UNIX software, GroupShield Notes
  software, or NetShield NetWare software.


* IN4 - USING DAT-4139.ZIP OR DAT-4139.TAR TO
  UPDATE VIRUSSCAN COMMAND LINE AND VIRUSSCAN FOR
  UNIX SOFTWARE *

Some McAfee anti-virus products, such as NetShield
for Novell NetWare, cannot use the executable
version of the .DAT file update. Instead, you must
copy .DAT file updates directly to the product
directory.

To do so, follow these steps:

1. Create a temporary directory on your hard disk,
   then copy the .DAT file .ZIP or tar archive
   that you downloaded to that directory.

2. Unload the VShield* TSR software from memory,
   if your anti-virus software has a VShield version
   and you have it running. To do so, type VSHIELD
   /REMOVE at the command-line prompt. This step
   is not necessary if you have not started the
   VShield scanner or if your anti-virus software
   does not include a background or on-access
   scanner.

3. Back up or rename the existing .DAT files
   stored in the program directory for your
   anti-virus software. See "Primary Program
   Files for Virus Definitions" later in this
   file for a complete .DAT file list.

4. Use WinZip, PKUnzip, or a similar utility
   to open the .ZIP archive and extract the
   updated .DAT files. You can save the
   extracted files directly to the program
   directory for your anti-virus software.
   Allow the updated files to overwrite the
   existing .DAT files.

   To extract .DAT files stored in a tar
   archive, use a compression utility that
   can read and extract tar files, or follow
   these steps from a UNIX command prompt:

   a.  Change to the directory into which you
       want to extract the new .DAT files. This
       could mean the program directory for your
       anti-virus software, or a temporary
       directory from which you intend to copy
       the new files.

   b.  Type this command at the command prompt:

       tar xf <directory path>/dat-4139.tar

   Here, <directory path> is the path to the
   tar file you downloaded. The tar utility
   will extract the .DAT files into your current
   working directory.

   NOTE:
     The syntax for the tar command might vary in
     different UNIX versions. Consult your manual
     pages or other product documentation for more
     details.

5. Copy the new .DAT files to the program
   directory for the software you want to
   update. Allow the new files to replace
   the existing files.

6. Restart the VShield TSR, if your anti-virus
   software includes a VShield component, to
   enable background or on-access scanning. To
   do so, type VSHIELD, followed by the scanning
   options you want to use, at the command-line
   prompt.

NOTE:
  When you have finished using DAT-4139.ZIP to
  update your .DAT files, you may delete it
  from your hard disk, unless you want to keep
  a copy available for further updates.


* IN5 - USING DAT-4139.ZIP TO UPDATE OTHER
  PRODUCTS *

McAfee recommends that you use either the SuperDAT
utility, or the 4139XDAT.EXE utility to install
new .DAT file versions for supported anti-virus
products. These utilities offer an easy and
foolproof method for correctly updating .DAT files.

If you want to install .DAT file updates directly
from the .ZIP archive, however, locate the heading
for the anti-virus product you use in the list
below, then follow the corresponding steps.

VIRUSSCAN V4.5 ANTI-VIRUS SOFTWARE FOR WINDOWS 95,
WINDOWS 98, WINDOWS NT WORKSTATION V4.0, AND
WINDOWS 2000 PROFESSIONAL

To use the DAT-4139-.ZIP package to update VirusScan
v4.5 anti-virus software, follow these steps:

1.  Click Start in the Windows task bar, point to
    Settings, then choose Control Panel.

2.  Locate the VirusScan control panel, then
    double-click it to open it.

3.  Click the Stop button on the Service page. Leave
    the VirusScan control panel open -- you'll need
    to return to it in Step 7.

4.  Create a temporary directory on your hard
    disk, then copy the .DAT file .ZIP archive
    you downloaded to that directory.

5.  Back up or rename the existing .DAT files stored
    in the Network Associates Common Files
    directory. If you installed VirusScan software
    to its default location, you'll find this
    directory here:

    C:\Program Files\Common Files\Network Associates
    \VirusScan Engine\4.0.xx

    See "Primary Program Files for Virus
    Definitions" later in this file for a
    complete .DAT file list.

6.  Use WinZip, PKUnzip, or a similar utility
    to open the .ZIP archive and extract the
    updated .DAT files.

    Save the extracted files directly to the
    Network Associates Common Files directory. Allow
    the new files to overwrite the existing .DAT
    files.

7.  Return to the VirusScan control panel, then
    click Start in the Service page.

    The VShield scanner and the VirusScan Console
    will start again. Your VirusScan software is up
    to date.

VIRUSSCAN V4.0.1 to V4.0.3 ANTI-VIRUS SOFTWARE FOR
WINDOWS 95 AND WINDOWS 98

To use the DAT-4139.ZIP package to update
VirusScan anti-virus software, versions 4.0.1 to
4.0.3, on a Windows 95 or Windows 98 system, follow
these steps:

1.  Right-click the VShield icon that appears
    in your Windows system tray at the bottom,
    right-hand corner of your screen to display
    the VShield shortcut menu.

2.  Point to Enable, then choose System Scan to
    remove the checkmark beside the name. This
    disables the VShield System Scan module.

3.  Repeat Steps 1 and 2 to disable all of the
    remaining VShield modules: E-Mail Scan,
    Download Scan, and Internet Filter.

4.  Restart your computer to remove all VShield
    modules from memory.

5.  Create a temporary directory on your hard
    disk, then copy the .DAT file .ZIP archive
    you downloaded to that directory.

6.  Back up or rename the existing .DAT files
    stored in the VirusScan program directory.
    See "Primary Program Files for Virus
    Definitions" later in this file for a
    complete .DAT file list.

7.  Use WinZip, PKUnzip, or a similar utility
    to open the .ZIP archive and extract the
    updated .DAT files.

    You can save the extracted files directly
    to the VirusScan program directory. Allow
    the updated files to overwrite the existing
    .DAT files.

8.  Restart your computer.

9.  Right-click the VShield icon that appears
    in your Windows system tray at the bottom,
    right-hand corner of your screen to display
    the VShield shortcut menu.

10. Point to Enable, then choose one of the
    listed VShield modules to add a checkmark
    beside the name. This enables that VShield
    module again.

    Begin with the System Scan module, then
    repeat Steps 9 and 10 to enable these
    remaining VShield modules: E-Mail Scan,
    Download Scan, and Internet Filter.


VIRUSSCAN ANTI-VIRUS SOFTWARE FOR WINDOWS NT
AND NETSHIELD ANTI-VIRUS SOFTWARE FOR WINDOWS NT,
VERSIONS 4.0.1 TO 4.0.3

If you have Administrator rights for the server
or workstation you want to update, the VirusScan
software for Windows NT and the NetShield
software for Windows NT allow you to initiate
update requests at any time. Simply use the
AntiVirus Console to connect to the workstation
or server you want to update, double-click the
AutoUpdate task to open it, then click Update
Now. The program will retrieve updated files
from the location specified in the task
settings, and will install the new files
correctly.

To install .DAT file updates directly from a
.ZIP archive WITHOUT using the AutoUpdate
utility, follow these steps:

NOTE:
  McAfee does not recommend that you use this
  method to update your .DAT files.

1.  Create a temporary directory on your hard
    disk, then copy the .DAT file .ZIP archive
    you downloaded to that directory.

2.  Back up or rename the existing .DAT files
    stored in the program directory. See
    "Primary Program Files for Virus
    Definitions" later in this file for a
    complete .DAT file list.

3.  Use WinZip, PKUnzip, or a similar utility
    to open the .ZIP archive and extract the
    updated .DAT files.

4.  Log on to the server or workstation you
    want to update. You must have Administrator
    rights for the target computer.

5.  Click Start, point to Settings, then choose
    Control Panel to open the Control Panel
    window. Next, locate and double-click the
    Services control panel to open it.

    If the computer is running Windows NT 3.51,
    start Program Manager, then locate the
    Control Panels program group. Double-click
    the program group to open it, then locate
    and double-click the Services control panel.

    NOTE:
      VirusScan v4.0.2 software for Windows NT
      and NetShield v4.0.2 software for Windows
      NT do NOT include Windows 3.51 support.
      Later versions of these products DO include
      support for this operating system.

6.  Select the Network Associates McShield
    Service, then click Stop.

7.  Copy the .DAT files you extracted from
    the .ZIP archive to the program directory.

8.  Return to the Services control panel,
    select the McShield Service, then click
    Start.

    Next, close the Services control panel.

NetShield software for Windows NT and VirusScan
software for Windows NT will use the updated
.DAT files in scan operations immediately.

NETSHIELD ANTI-VIRUS SOFTWARE FOR NOVELL NETWARE

To install .DAT file updates directly from a
.ZIP archive WITHOUT using the AutoUpdate
utility, follow these steps:

NOTE:
  McAfee does not recommend using this method to
  update your .DAT files.

1.  Create a temporary directory on your hard
    disk, then copy the .DAT file .ZIP archive
    you downloaded to that directory.

2.  Use WinZip, PKUnzip, or a similar utility
    to open the .ZIP archive and extract the
    updated .DAT files.

3.  Log on to the server you want to update.
    You must have administrative rights for
    the target server.

4.  Type this line at the NetWare Console
    prompt:

    unload netshld

5.  Back up or rename the existing .DAT files
    stored in your NetShield program directory.
    If you installed NetShield to the default
    program directory, you'll find the .DAT
    files here:

    SYS:MCAFEE\NETSHLD

    See "Primary Program Files for Virus
    Definitions" later in this file for a
    complete .DAT file list.

6.  Copy the files you extracted from the
    temporary directory you created in Step 1
    to the NetShield program directory on your
    server.

7.  Type this line at the NetWare Console prompt
    to restart the NetShield NetWare server
    software:

    netshld

    The NetShield software will begin to use the
    new .DAT files immediately.


GROUPSHIELD NOTES ANTI-VIRUS SOFTWARE

The GroupShield Notes software allows you to
download and install .DAT file updates with an
included automatic update component. McAfee
recommends this method, but you can also update
your .DAT files directly. Follow these steps:

1.  Create a temporary directory on your hard
    disk, then copy the .DAT file .ZIP archive
    you downloaded to that directory.

2.  Back up or rename the existing .DAT files
    stored in the GSUPDATE.NSF database. See
    "Primary Program Files for Virus
    Definitions" later in this file for a
    complete .DAT file list.

3.  Use WinZip, PKUnzip, or a similar utility
    to open the .zip archive and extract the
    updated .DAT files.

4.  Start Lotus Notes, then right-click
    Workspace. Next, choose Open Database from
    the menu that appears.

5.  Locate the database GSUPDATE.NSF, then add
    to that database those files that you
    extracted into the temporary directory
    you created in Step 1.

    GroupShield Notes will use the new .DAT
    files as soon as they replicate across
    the network. If you have partitioned Notes
    servers, you must shut down and restart
    each of the partitioned servers for the
    update to take effect.


* IN6 - PRIMARY PROGRAM FILES FOR VIRUS
  DEFINITIONS *

Files contained in the .DAT file set are:
=========================================

        SCAN.DAT = Data file for virus scanning 
       NAMES.DAT = Data file for virus names
       CLEAN.DAT = Data file for virus cleaning
    INTERNET.DAT = Data file to detect hostile
                    Java/ActiveX objects.

* IN7 - TESTING YOUR INSTALLATION *

The EICAR Standard AntiVirus Test File is a
combined effort by anti-virus vendors
throughout the world to implement one
standard by which customers can verify their
anti-virus installations.

To test your installation, copy the following
line into its own file, then save the file
with the name EICAR.COM.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The file size will be 68 or 70 bytes.

Next, start your anti-virus software and allow
it to scan the directory that contains
EICAR.COM. When your software scans this file,
it will report finding the EICAR test file.

Note that this file is NOT A VIRUS. Delete the
file when you have finished testing your
installation to avoid alarming unsuspecting
users.

______________________________________
DV1 - NEW VIRUSES DETECTED AND REMOVED

Hundreds of new viruses and variants appear each month. 
Those which are detected and cleaned by AVERT's generic methods  
are added to the total virus count listed but they are not 
listed separately here. 

Total viruses and variants, Trojan horse programs,
and other malicious software detected: 57667

* DV2 - NEW DETECTIONS *

Total number of new items detected with this
release: 1


BOOT-SECTOR VIRUSES (0)
-----------------------
No new detections

DOS FILE-INFECTING VIRUSES (0)
------------------------------
No new detections

INTERNET WORM (1)
-----------------
VBS/VBSWG@MM

LINUX/UNIX FILE-INFECTING VIRUSES (0)
-------------------------------------
No new detections

MACRO VIRUSES (0)
-----------------
No new detections

MULTIPARTITE VIRUSES (0)
------------------------
No new detections

WINDOWS PORTABLE EXECUTABLE FILE VIRUSES (0)
--------------------------------------------
No new detections

SCRIPT VIRUSES (0)
------------------
No new detections

TROJAN HORSE PROGRAMS/MALWARE (0)
-----------------------------------
No new detections


* DV3 - NEW REMOVALS *

Total number of new items removed with this
release: 1

McAfee software removes a virus either by deleting
the infecting virus code from files or by deleting
the file from your computer.

NOTE:
  The New Removals list notes when the .DAT files do
  not include the ability to remove certain types of
  viruses. In these cases you must remove the virus
  yourself, either by deleting the infected file or
  by removing harmful code. For more information, 
  see the McAfee Virus Information Library at:

  http://vil.nai.com/villib/alpha.asp


BOOT-SECTOR VIRUSES (0)
-----------------------
No new removals

DOS FILE-INFECTING VIRUSES (0)
------------------------------
No new removals

INTERNET WORM (1)
-----------------
VBS/VBSWG@MM

LINUX/UNIX FILE-INFECTING VIRUSES (0)
-------------------------------------
No new removals

MACRO VIRUSES (0)
-----------------
No new removals

MULTIPARTITE VIRUSES (0)
------------------------
No new removals

WINDOWS PORTABLE EXECUTABLE FILE VIRUSES (0)
--------------------------------------------
No new removals

SCRIPT VIRUSES (0)
------------------
No new removals

TROJAN HORSE PROGRAMS/MALWARE (0)
-----------------------------------
No new removals


* DV4 - INTERNET.DAT DETECTIONS *

The INTERNET.DAT component included with the .DAT
files enables VirusScan* anti-virus software v4.x
for Windows 95 and Windows 98 to detect 130
hostile Java classes and six hostile ActiveX
controls. This list has not changed from that shown
in the README.TXT file that accompanied the 4050
.DAT file set.



_______________________________
UV1 - UNDERSTANDING VIRUS NAMES

McAfee anti-virus software typically follows
industry-wide naming conventions to identify the
viruses that it detects and cleans. Occasionally,
some virus names deviate from strict industry
standards.

The first virus with a given set of characteristics
that mark it as a distinctly new entity receives a
"family" name. Virus researchers draw the family
name from some identifying quirk in the virus -- a
text string, perhaps, or a payload effect.

A family name can also include a numeric string
that designates the byte size of the virus.
Researchers use this name as a convenient shorthand
to distinguish among very closely allied virus
variants.

Names for variants within a virus family consist
of the family name and a suffix -- <VIRUS>.A, for
example. The suffix designations continue in
alphabetical order until they reach .Z. At that
point, they begin again with .AA and continue
until they reach .AZ. Still later variants
receive the suffix .BA through .BZ, and so forth,
until the suffix designations reach .ZZ. If yet
another variant appears after that, it would get
the suffix .AAA.

As new virus strains appeared, industry naming
conventions evolved to include more information.
Some names, for instance, include parts that
identify the platform on which the virus can
run. Macro viruses, the most prevalent of the
virus types, can have a complex names that
consists of a number of parts.

Among anti-virus vendors, virus names can
include:

* UV2 - PREFIX *

The prefix designates the type of file that
the virus infects or the platform on which it
can run. Viruses that infect DOS executables
do not receive a prefix. McAfee virus names can
include these prefixes:

 A97M/        Macro virus. Infects Microsoft
               Access 97 files
 APM/         Macro virus or Trojan horse program.
               Infects Ami Pro document and
               template files
 BV/          Batch-file virus or Trojan horse
               program. These viruses usually run
               as batch or script files that affect
               a particular program that interprets
               the script or batch commands they
               include. They are very portable and
               can affect nearly any platform that
               can run batch or script files. The
               files themselves often have a .BAT
               extension.
 CSC/         Corel Script virus or Trojan horse
               program. Infects Corel Draw document
               files, template files, and scripts.
 HLL/         File-infector virus written in a
               high-level programming language
 HTML/        Script virus. Infects HTML files
 IRC/         Internet Relay Chat script virus.
               This virus type can use early
               versions of the mIRC client
               software to distribute a virus
               or payload
 JS/          JavaScript virus or Trojan horse
               program
 JV/          Java application or applet that
               functions as malicious software.
 JVS/         JavaScript virus or Trojan horse
               program

 O2KM/        Macro virus. Infects Microsoft
               Office 2000 files
 P98M/        Macro virus or Trojan horse program.
               Infects Microsoft Project documents
               and templates.
 PP97M/       Macro virus. Infects Microsoft
               PowerPoint 97 files
 V5M/         Macro or script virus, or Trojan horse
               program. Infects Visio VBA (Visual
               Basic for Applications) macros or
               scripts.
 VBS/         Script virus. Infects Visual
               Basic scripts
 W32/         File-infector or boot-sector
               virus. Runs in 32-bit Windows
               environments (Windows 95,
               Windows 98 or Windows NT)
 WIN/         File-infector virus. Runs in
               16-bit and 32-bit Windows
               environments (Windows 3.1x,
               Windows 95, Windows 98, or
               Windows NT)
 W95/         File-infector virus. Runs in
               Windows 95 and Windows 98
               environments
 W97M/        Macro virus. Infects Microsoft
               Word 97 files
 WM/          Macro virus. Infects Microsoft
               Word 95 files
 X97F/        Macro virus. Infects Microsoft
               Excel 97 via Excel formulas
 X97M/        Macro virus. Infects Microsoft
               Excel 97 files
 XF/          Macro virus. Infects Microsoft
               Excel 95 or 97 via Excel
               formulas
 XM/          Macro virus. Infects Microsoft
               Excel 95 files

* UV3 - INFIX *

These designations usually appear in the middle
of a virus name. AVERT assigns these designations,
which will differ from industry conventions.

 .CMP.        Companion file. This designates a
               companion file that the virus
               adds to an existing executable
               file. McAfee software deletes the
               companion file to prevent later
               infections 
 .MP.         Multi-partite virus. A McAfee 
               designation
 .OW.         Overwriting. This identifies a
               virus that overwrites data in a file,
               thereby irreparably corrupting it.
               This file must be deleted.


* UV4 - SUFFIX *

These designations usually appear as the last
part of a virus name. A virus name can have
more than one suffix. One might designate a
variant, for example, while others give
additional information. AVERT assigns many of
these designations, which can differ from industry
conventions.

 @MM          Mass mailing distribution. This
               virus might use standard techniques
               to propagate itself, but will also,
               or in some cases primarily, use
               an e-mail system to spread
 .A  to .ZZZ  Virus variant designation
 .APP         Appended viruses. This designates
               a virus that appends its code to
               the file it infects, but fails to
               provide for correct replication.
               McAfee software detects these files
               in order to prevent false virus
               identifications
 .CAV         Cavity virus. This designates 
               a virus that copies itself into
               "cavities" (areas of all zeroes)
               in a program file. 
 .CLI         Client-side component of an Internet 
               Trojan-horse program.
 .DAM         Damaged file. This designates a
               file damaged or corrupted by an
               infection
 .DR          Dropper file. This file introduces
               the virus into the host program
 .GEN         Generic detection. Native routines
               in McAfee software detect this virus
               without using specific code strings
 .GR          Generic detection and removal.
               Native routines in McAfee software
               detect and remove this virus without
               using specific code strings
 .INTD        "Intended" virus. This designates
               a virus that has most of the
               usual virus characteristics, but
               cannot replicate correctly. McAfee
               anti-virus software will detect it in
               order to prevent false
               identifications of active viruses
 .SFX         Self-extracting installation
               utility for Trojan horse programs
 .SRC         Viral source code. This ordinarily
               cannot replicate or infect files,
               but some virus droppers add this
               to files as part of the infection
               cycle. McAfee products routinely flag
               files with additional code of this sort
               for deletion
 .SVR         Server-side component of an Internet 
               Trojan-horse program.


* UV5 - GENERIC DETECTIONS *

When a scanner reports W97M/Generic@MM or X97M/Generic@MM 
driver it means the engine (4070 or later only) has 
detected heuristically a highly suspicious VBA macro 
that is likely to be a mass-mailing virus. The cleaning 
for such viruses is also available but should be done with
extra caution  - users are advised to keep a copy of a file 
before cleaning and submit a sample to AVERT.


______________________________________________
NA1 - CONTACTING MCAFEE AND NETWORK ASSOCIATES

On December 1, 1997, McAfee Associates merged
with Network General Corporation, Pretty Good
Privacy, Inc., and Helix Software, Inc. to form
Network Associates, Inc. The combined Company
subsequently acquired Dr Solomon's Software,
Trusted Information Systems, Magic Solutions,
and CyberMedia, Inc.

A January 2000 company reorganization formed four 
independent business units, each concerned with a 
particular product line. These are:

* Magic Solutions. This division supplies the Total 
  Service desk product line and related products

* McAfee. This division provides the Active Virus 
  Defense product suite and related anti-virus 
  software solutions to corporate and retail 
  customers.

* PGP Security. This division provides award-winning 
  encryption and security solutions, including the 
  PGP data security and encryption product line, the 
  Gauntlet firewall product line, the WebShield 
  E-ppliance hardware line, and the CyberCop Scanner 
  and Monitor product series.

* Sniffer Technologies. This division supplies the 
  industry-leading Sniffer network monitoring, 
  reporting, and analysis utility and related 
  software.

Network Associates continues to market and support 
the product lines from each of the new independent 
business units. You may direct all questions, 
comments, or requests concerning the software you 
purchased, your registration status, or similar 
issues to the Network Associates Customer Service 
department at the addresses or phone numbers listed 
below.

Contact the Network Associates Customer Service
department between 8:00 a.m. and 8:00 p.m. Central 
Time, Monday through Friday, at:

     Network Associates Customer Service
     4099 McEwen, Suite 500
     Dallas, Texas 75244

     Contact information for McAfee corporate-
     licensed customers:

     Phone:  (888) VIRUS NO or (888) 847-8766
     Fax:    (972) 619-7485 (24-hour, Group III fax)
     E-Mail: services_corporate_division@nai.com
     Web:    http://www.nai.com

     Contact information for retail licensed
     customers:

     Phone:  (972) 308-9960
     Fax:    (972) 619-7485 (24-hour, Group III fax)
     E-Mail: cust_care@nai.com
     Web:    http://www.mcafee.com


Send correspondence to any of the following
Network Associates locations:

     Network Associates Corporate Headquarters
     3965 Freedom Circle
     McCandless Towers
     Santa Clara, CA 95054


Network Associates offices outside the United
States:

     Network Associates Australia
     Level 1, 500 Pacific Highway
     St. Leonards, NSW
     Sydney, Australia 2065
     Phone: 61-2-8425-4200
     Fax:   61-2-9439-5166

     Network Associates Austria
     Pulvermuehlstrasse 17
     Linz, Austria
     Postal Code A-4040
     Phone: 43-732-757-244
     Fax:   43-732-757-244-20

     Network Associates Belgique
     BDC Heyzel Esplanade, bote 43
     1020 Bruxelles
     Belgique
     Phone: 0032-2-478.10.29
     Fax:   0032-2-478.66.21

     Network Associates do Brasil
     Rua Geraldo Flausino Gomez 78
     Cj. - 51 Brooklin Novo - So Paulo
     SP - 04575-060 - Brasil
     Phone:  (55 11) 5505 1009
     Fax:    (55 11) 5505 1006

     Network Associates Canada
     139 Main Street, Suite 201
     Unionville, Ontario
     Canada L3R 2G6
     Phone: (905) 479-4189
     Fax:   (905) 479-4540

     Network Associates
     People's Republic of China
     Room 913, Tower B
     Full Link Plaza
     No. 18 Chao Yang Men Wai Avenue
     Beijing
     People's Republic of China 100020
     Phone: 86 10 6538-3399
     Fax:   86 10 6588-5601

     Network Associates Denmark
     Lautruphoej 1-3
     2750  Ballerup
     Danmark
     Phone: 45 70 277 277
     Fax:   45 44 209 910

     NA Network Associates Oy
     Mikonkatu 9, 5. krs.
     00100 Helsinki
     Finland
     Phone: 358 9 5270 70
     Fax:   358 9 5270 7100

     Network Associates France S.A.
     50 Rue de Londres
     75008 Paris
     France
     Phone: 33 1 44 908 737
     Fax:   33 1 45 227 554

     Network Associates GmbH
     Ohmstrae 1
     D-85716 Unterschleiheim
     Deutschland
     Phone: 49 (0)89/3707-0
     Fax:   49 (0)89/3707-1199

     Network Associates Hong Kong
     14th Floor, Plaza 2000
     2-4 Russell Street
     Causeway Bay, Hong Kong
     Phone: 852-2892-9500
     Fax:   852-2832-9530

     Network Associates Srl
     Centro Direzionale Summit
     Palazzo D/1
     Via Brescia, 28
     20063 - Cernusco sul Naviglio (MI)
     ITALY
     Phone: 39 02 92 65 01
     Fax:   39 02 92 14 16 44

     Network Associates Japan, Inc.
     Shibuya Mark City West 20F
     1-12-1 Dougenzaka, Shibuya-ku
     Tokyo 150-0043, Japan
     Phone: 81 3 5428 1100
     Fax:   81 3 5428 1480

     Network Associates Latin America
     1200 South Pine Island Road, Suite 375
     Plantation, Florida 33324
     United States
     Phone: (954) 577-4290
     Fax:   (954) 236-8031

     Network Associates Mxico
     Andrs Bello No. 10
     4o. Piso
     Col. Polanco
     Mxico D.F.  C.P. 11560
     Phone: 52 (5) 282-9180
     Fax:   52 (5) 282-9183

     Network Associates International B.V.
     Gatwickstraat 25
     1043 GL Amsterdam
     The Netherlands
     Phone: 31 20 586 6100
     Fax:   31 20 586 6101

     Network Associates Portugal
     Av. da Liberdade, 114
     1269-046 Lisboa
     Portugal
     Phone:  351 1 340 4543
     Fax:    351 1 340 4575

     Net Tools Network Associates South Africa
     Hawthorne House
     St. Andrews Business Park
     Meadowbrook Lane
     Bryanston, Johannesburg
     South Africa 2021
     Phone: 27 11 700-8200
     Fax:   27 11 706-1569

     Network Associates South East Asia
     78 Shenton Way
     #29-02
     Singapore 079120
     Phone: 65 222-7555
     Fax:   65 222-7555

     Network Associates Spain
     Orense 4, 4a Planta.
     Edificio Trieste
     28020 Madrid
     Spain
     Phone: 34 9141 88 500
     Fax:   34 9155 61 404

     Network Associates Sweden
     Datavgen 3A
     Box 596
     S-175 26 Jrflla
     Sweden
     Phone: 46 (0) 8 580 88 400
     Fax:   46 (0) 8 580 88 405

     Network Associates AG
     Baeulerwisenstrasse 3
     8152 Glattbrugg
     Switzerland
     Phone: 0041 1 808 99 66
     Fax:   0041 1 808 99 77

     Network Associates Taiwan
     Suite 6, 11F
     No. 188, Sec. 5
     Nan King E. Rd.
     Taipei, Taiwan, Republic of China
     Phone: 886-2-27-474-8800
     Fax:   886-2-27-635-5864

     Network Associates International Ltd.
     227 Bath Road
     Slough, Berkshire
     SL1 5PP
     United Kingdom
     Phone: 44 (0)1753 217 500
     Fax:   44 (0)1753 217 520


Or, you can receive online assistance through
any of the following resources:

 1.  Internet E-mail:

     techsupport@mcafee.com

 2.  Telephone technical support

     Corporate-licensed customers:

     Contact Network Associates Customer Service for 
     information about technical support 
     subscription plans

     Retail-licensed customers:

     (972) 855-7044

 3.  Internet FTP:

     ftp://ftp.nai.com

 4.  World Wide Web:

     http://www.nai.com/asp_set/support/technical/intro.asp

 5.  America Online: keyword MCAFEE

 6.  CompuServe: GO NAI

To provide the answers you need quickly and
efficiently, the Network Associates technical
support staff needs some information about your 
computer and your software. Please have this 
information ready when you call:

 - Program name and version number
 - Computer brand and model
 - Any additional hardware or peripherals
   connected to your computer
 - Operating system type and version numbers
 - Network name, operating system, and version
 - Network card installed, where applicable
 - Modem manufacturer, model, and bits-per-
   second rate, where applicable
 - Relevant browsers or applications and their
   version numbers, where applicable
 - How to reproduce your problem: when it
   occurs, whether you can reproduce it
   regularly, and under what conditions
 - Information needed to contact you by voice,
   fax, or e-mail


* NA2 - DOWNLOAD SUPPORT *

To get help with navigating or downloading files
from the Network Associates website or FTP site,
call:

Corporate customers   (801) 492-2650
Retail customers      (801) 492-2600


* NA3 - FOR PRODUCT UPGRADES *

McAfee has a worldwide range of partnerships and 
reseller relationships with hundreds of independent 
vendors, each of which can provide you with 
consulting services, sales advice, and product 
support for McAfee and Network Associates software. 
To find a reseller near your location, see the 
RESELLER.TXT file located on your product CD-ROM or 
installed on your hard disk. For assistance in 
locating a local reseller, you can also contact 
McAfee Customer Service at (888) VIRUS NO 
or (888) 847-8766.


* NA4 - FOR REPORTING PROBLEMS *

McAfee prides itself on delivering a high-quality 
product. If you find any problems, please take a 
moment to review the contents of this file. If the 
problem you've encountered appears in the Known 
Issues section of this README.TXT file, McAfee is
already aware of the problem, and you need not
report it.

If you find any feature that does not appear to
function properly on your system, or if you
believe an application would benefit greatly
from enhancement, please contact Network
Associates or one of its resellers with your
suggestions or concerns.


* NA5 - FOR ON-SITE TRAINING INFORMATION *

Contact McAfee Customer Service at (888) VIRUS NO
or (888) 847-8766.


* NA6 - MCAFEE BETA SITE *

To test pre-release software and obtain update
files, including virus definition (.DAT) files,
visit the McAfee beta site at:

       http://www.mcafeeb2b.com/beta/

You will have access to Public Beta and External 
Test Areas. Your feedback will make a difference.


* NA7 - AVERT ANTI-VIRUS RESEARCH SITE *

To see the latest information about emerging
virus threats, submit samples of potentially
infected files, and download updated scanning
engine files, EXTRA.DAT files, and similar
anti-virus software for testing, visit the
AVERT research site at:

          http://www.avertlabs.com

McAfee also seeks and appreciates general feedback.


__________________________________________
CT1 - COPYRIGHT AND TRADEMARK ATTRIBUTIONS

Copyright (c) 1999-2000 Networks Associates
Technology, Inc. All Rights Reserved. No part
of this publication may be reproduced,
transmitted, transcribed, stored in a
retrieval system, or translated into any
language in any form or by any means without
the written permission of Networks Associates
Technology, Inc., or its suppliers or affiliate
companies.

* CT2 - TRADEMARKS *

* ActiveHelp, Bomb Shelter, Building a World of
Trust, CipherLink, Clean-Up, Cloaking, CNX,
Compass 7, CyberCop, CyberMedia, Data Security
Letter, Discover, Distributed Sniffer System,
Dr Solomon's, Enterprise Secure Cast, First
Aid, ForceField, Gauntlet, GMT, GroupShield,
HelpDesk, Hunter, ISDN Tel/Scope, LM 1,
LANGuru, LeadingHelp Desk Technology, Magic
Solutions, MagicSpy, MagicTree, Magic
University, MagicWin, MagicWord, McAfee,
McAfee Associates, MoneyMagic, More Power To
You, Multimedia Cloaking, NetCrypto,
NetOctopus, NetRoom, NetScan, Net Shield,
NetShield, NetStalker, Net Tools, Network
Associates, Network General, Network Uptime!,
NetXRay, Nuts & Bolts, PC Medic, PCNotary,
PGP, PGP (Pretty Good Privacy), PocketScope,
Pop-Up, PowerTelnet, Pretty Good Privacy,
PrimeSupport, RecoverKey, RecoverKey-
International, ReportMagic, RingFence, Router
PM, Safe & Sound, SalesMagic, SecureCast,
Service Level Manager, ServiceMagic, Site
Meter, Sniffer, SniffMaster, SniffNet,
Stalker, Statistical Information Retrieval
(SIR), SupportMagic, Switch PM, TeleSniffer,
TIS, TMach, TMeg, Total Network Security,
Total Network Visibility, Total Service Desk,
Total Virus Defense, T-POD, Trusted Mach,
Trusted Mail, Uninstaller, Virex, Virex-PC,
Virus Forum, ViruScan, VirusScan, VShield,
WebScan, WebShield, WebSniffer, WebStalker,
WebWall, and ZAC 2000 are registered
trademarks of Network Associates and/or its
affiliates in the US and/or other countries.
All other registered and unregistered
trademarks in this document are the sole
property of their respective owners.

* CT3 - LICENSE AGREEMENT *

NOTICE TO ALL USERS: FOR THE SPECIFIC TERMS OF YOUR 
LICENSE TO USE THE SOFTWARE THAT THIS DOCUMENTATION 
DESCRIBES, CONSULT THE LICENSE.TXT, README.1ST, OR 
OTHER LICENSE DOCUMENT THAT ACCOMPANIES YOUR 
SOFTWARE, EITHER AS A TEXT FILE OR AS PART OF THE 
SOFTWARE PACKAGING. IF YOU DO NOT AGREE TO ALL OF 
THE TERMS SET FORTH THEREIN, DO NOT INSTALL THE 
SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT 
TO THE PLACE OF PURCHASE FOR A FULL REFUND.
