Products Header

McAfee LATEST .DAT FILE:
4.0 4040

VirusScan -- McAfee's VirusScan is an excellent utility for catching any viruses that may be hiding out in the darkest recesses of your hard drive. Its graphical interface is both visually appealing and intuitive. VirusScan's VShield component can run in the background, allowing you to continue working on other projects while it does its job. VirusScan's on-line help documentation provides useful insight into the program's many options. These options include the ability to configure the level of scanning desired, the ability to keep and/or print an activity log, and several additional user-configurable preferences.

The latest release of VirusScan, Version 4.x, diverges radically from previous releases -- not so much externally as internally. The biggest change is in the virus scanning engine itself. The Dr. Solomon's virus scanning engine is at the heart of VirusScan 4.x, replacing the various engines used in earlier releases of VirusScan. Because the previous scanning engines and the new Dr. Solomon's scanning engine identify and classify viruses in different ways, the virus definition updates (DAT files) for earlier releases of VirusScan will not work on the 4.x releases; conversely, the DAT files for v4.x and above will not work on earlier releases of VirusScan.

The VShield component of VirusScan has also been expanded in the latest release with the addition of three new network- and Internet-specific modules. The new E-Mail Scan module detects viruses in e-mail attachments that are sent over your internal network mail system. The Download Scan module monitors e-mail received over the Internet as well as downloaded files. Finally, the Internet Filter module detects and protects you against hostile Java applets and ActiveX Controls. The filter module can also be used to block access to specific Web sites.

The interface for VShield has been redesigned to group the configuration options for all four of the modules (the three new ones plus the existing System Scan module) and a configuration wizard has been designed to get you up and running quickly with the most common scanning options. The new release also sports a revamped VShield Security module that allows you to protect the individual properties for any VShield module against unauthorized changes.

The most recent releases of VirusScan also support virus detection and removal of polymorphic and macro viruses (including Office97 viruses) using enhanced heuristic scanning technology. Additional features in these releases include ZIP file scanning, an Emergency Disk creation utility, activity log reports, compressed file scanning support (ZIPs, CABs, etc.), and ScanPM (a command-line scanner that operates in protected mode environments like DOS). All in all, VirusScan is arguably the best virus scanner in the industry.

Pros: Easy to use, scans in the background, cool interface, advanced virus scanning engine
Cons: The older releases (v2.5.x) do not remove (or scan) viruses as well as other scanners

New in v3.2.0: Improved Command Line components, more effective cleaning for MS Excel files infected with the Laroux virus, detection of macro viruses in MS Access database files, compressed file scanning support (ZIPs, CABs, etc.), improved detection technology for polymorphic viruses, scanning support for LS-120 floppy drives, Desktop Management Interface (DMI) alerts, scanning support for files embedded within MS Office files and for password-protected MS Word files; v3.2.0 includes the v3108 DAT (August '98); Release Notes

New in v4.0.x:  (4.03) Dr Solomon's virus scanning engine; new VShield System Scan modules -- E-Mail Scan, Internet Filter (detects hostile Java applets and ActiveX Controls), and Download Scan modules; enhanced heuristic scanning technology, revamped VShield Security module, new versions of VirusScan Command Line components, specialized scanners for protecting MAPI-based and cc:Mail e-mail systems; Release Notes

New for June DAT 3206: Detection of 26 and removal of 19 new viruses, including detection and removal for the new W32/EXPLOREZIP.WORM -- the "ExploreZip" worm; complete list Note: This DAT file will only work with VScan v3.x - do not install it with the new v4.x releases

New for June DAT 4031: Detection of 52 new viruses (bringing total to 44,600+), including detection and removal for the new W32/EXPLOREZIP.WORM -- the "ExploreZip" worm; detects 130 hostile Java classes and 6 hostile ActiveX controls; complete list
Note: This DAT file will only work with VScan v4.x - do not install it with earlier releases

BE Alert for toadie virus

Anti-virus vendors are warning their users of a new virus, toadie.exe, which is spreading across Internet chat sites and e-mail in the form of an executable program. Toadie is classified as a direct infector style virus, because it searches out other executable programs and infects them with itself when it is activated by a user. Toadie is not capable of automatically sending itself over e-mail as the infamous Melissa virus did, but it will tag along on executable files from one system to another. Toadie can rapidly replicate itself across Internet chat sites using the Internet Relay Command (IRC), however, without the knowledge of the sender, according to Anti-virus vendor Network Associates Inc. (NAI), which will issue an alert on the virus tomorrow.

"It will attempt to send itself via IRC if you happen to be using Internet chat at the time. People will think you are sending this to them, when in fact you don't realize it," said Sal Viveros, group marketing manager for Total Virus Defense at Network Associates. "It would be similar to what happened with the 'Frog in a Blender' " executable file that carried the Chernobyl virus with it, he added.

There are currently four different variants of Toadie that NAI is researching, two of which are in "the wild," or infecting systems across the Internet, and so far no dangerous payload has been discovered. The virus can corrupt infected files, however, and make them unusable, according to Viveros. Infected users will be able to see a DOS box appear whenever they open an executable file, which says "you are infected with Toadie," but users with faster and more powerful systems will only see the message for a moment.

While only categorizing toadie.exe as a medium risk virus, NAI has received several copies of the virus from its users and recommends they update their anti-virus software. "We believe at this point that it is just going out and spreading and showing this message saying you've been infected with Toadie," Viveros said. "But as always, you need to make sure you are keeping your anti-virus software updated regularly."

Network Associates Inc., in Santa Clara, Calif., is at www.nai.com.

 

W32/Kriz.3862

Christmas Computer Virus Discovered

NEW YORK (AP) _ A computer virus timed to strike Windows PCs on Christmas Day has yet to pose a significant threat because of its low prevalence, but anti-virus software makers are gearing up to help computer users combat it.

The new virus, named W32/Kriz.3862, is designed to damage Windows 95, Windows 98 and Windows NT machines. The virus overwrites data on hard drives and destroys the memory that stores a computer's setup, sometimes making a computer unbootable.

Only two cases of the virus have been detected ``in the wild'' so far, said Sal Viveros, group marketing manager in the virus defense division of Santa-Clara, Calif.-based Network Associates, maker of the McAfee virus protection software.

Network Associates ranks the virus as a ``medium risk'' because of its low prevalence. Viveros said Network Associates would upgrade the assessment if more cases of the virus are reported. The virus contains a profane, anti-religious message, Viveros said Thursday.

"That could be why it may hit on Christmas," he said.

Another maker of virus protection software, Central Command Inc., said the W32/Kriz virus is more destructive than the Chernobyl virus that recently attacked 300,000 computers in Asia and the Middle East.

That virus did not affect Windows NT machines, used by businesses, as the W32/Kriz virus does.

"This virus contains lethal instructions," said Keith Peer, president of Medina, Ohio-based Central Command. "Unlike the Chernobyl virus, it can infiltrate a business environment."

Both companies have developed software that detects and disables the virus.