Release Notes for McAfee(R) AntiSpyware Enterprise Version 8.5sa Copyright (C) 2006 McAfee, Inc. All Rights Reserved ========================================================== - DAT Version: 4862 - Engine Version: 5100.0194 ========================================================== Thank you for using AntiSpyware Enterprise 8.5sa software. This file contains important information regarding this release. We strongly recommend that you read the entire document. IMPORTANT: McAfee does not support automatic upgrading of a pre-release version of the software. To upgrade to a production release of the software, you must first uninstall the existing version of the software. __________________________________________________________ WHAT'S IN THIS FILE - Introduction - Compatible Products - Installation & System Requirements - Known Issues - Installation - Supported Operating Systems - Compatibility with Other Products - Managing With ePolicy Orchestrator(R) and ProtectionPilot(TM) - Access Protection - Alerts (SNMP) - Cookie Detections - EXTRA.DAT - Documentation - Participating in the McAfee Beta Program - Contact Information - Copyright & Trademark Attributions - License & Patent Information __________________________________________________________ INTRODUCTION McAfee AntiSpyware Enterprise 8.5sa runs as a stand-alone anti-spyware product or with non-McAfee anti-virus software. It provides enterprise-class protection from potential threats such as spyware, adware, cookies, jokes, and Trojans. It uses on-access scanning and on-demand scan tasks in combination with spyware-specific access protection rules and detection definitions to protect you from these threats. You can also manage AntiSpyware Enterprise from ePolicy Orchestrator 3.6 or Protection Pilot 1.1.1. IMPORTANT: You cannot install AntiSpyware Enterprise 8.5sa on a computer where McAfee VirusScan Enterprise resides, as these two products are not compatible. To get information about the anti-spyware module that is compatible with VirusScan Enterprise, review the information on your product CD or the McAfee download web site. __________________________________________________________ COMPATIBLE PRODUCTS AntiSpyware Enterprise 8.5sa is compatible with these products and versions: - CA eTrust(R) Antivirus version 7.1. - F-Secure(R) Anti-Virus Client Security(TM) versions 5 and 6. - Symantec AntiVirus(TM) versions 9 and 10. - Symantec Norton AntiVirus(TM) versions 2004 and 2005. - Panda Secure Resolutions versions 2004 and 2005. - Sophos Anti-Virus Desktop versions 3.97 and 5.0.5. - Trend Micro(TM) OfficeScan(TM) versions 6 and 7. - AhnLab V3Net version 6. - AhnLab V3Pro version 2004. __________________________________________________________ INSTALLATION AND SYSTEM REQUIREMENTS Please see product documentation for complete information on installation and system requirements. TESTING YOUR INSTALLATION You can test the operation of the AntiSpyware Enterprise 8.5sa software by running the EICAR Standard AntiVirus Test File on any computer where you have installed the AntiSpyware Enterprise software. Although this test was originally developed to test anti-virus software, it can also be used to test the AntiSpyware Enterprise 8.5sa software. The EICAR Standard AntiVirus Test File is a combined effort by anti-virus vendors throughout the world to implement one standard by which customers can verify their installations. To test your installation: 1. To ensure this test is valid for AntiSpyware Enterprise, disable any anti-virus or other anti-spyware products before performing this test. This ensures that the EICAR test file will be detected only by the AntiSpyware Enterprise software. 2. Copy the following line into its own file, making sure you do not include any spaces or line breaks. Save the file with the name EICAR.COM. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* The file size will be 68 or 70 bytes. 3. Start the AntiSpyware Enterprise software and allow it to scan the directory that contains EICAR.COM. When your software scans this file, it will report finding the EICAR test file. 4. Delete the file when you have finished testing your installation to avoid alarming unsuspecting users. For more information on the EICAR test file, visit: http://www.eicar.org __________________________________________________________ KNOWN ISSUES INSTALLATION 1. You cannot install AntiSpyware Enterprise 8.5sa as Console Only. 2. When using the SYSTEM account to install AntiSpyware Enterprise on 64-bit systems, the AntiSpyware shield icon does not display until the system is restarted. 3. To repair the AntiSpyware Enterprise 8.5sa product installation, we recommend that you use one of these methods: - From the AntiSpyware Enterprise Console, select "Repair" from the "Help" menu. - Disable the on-access scanner, then access the Windows Control Panel Add/Remove Programs window. For the McAfee AntiSpyware Enterprise product, select "Change" then "Repair." When finished with the repair, enable the on-access scanner again. SUPPORTED OPERATING SYSTEMS 1. Although the Microsoft Windows NT operating system is not supported for this release of the AntiSpyware Enterprise product, it is still a supported target in the ePolicy Orchestrator and ProtectionPilot .NAP file. COMPATIBILITY WITH OTHER PRODUCTS 1. AntiSpyware Enterprise blocks Trend Micro OfficeScan Remote Push Install when Maximum Protection rules are enabled. We recommend that you temporarily disable access protection before you begin the remote push install, then enable it again after the installation completes. 2. If using Symantec Norton AntiVirus version 2005 and AntiSpyware Enterprise 8.5sa, the AntiSpyware on-access scanner appears to detect threats written to the disk even when the "When writing to disk" option is deselected. This occurs because Symantec Norton AntiVirus version 2005 opens the file for "read" before it scans the file and AntiSpyware Enterprise sees the file open for "read" and scans it. MANAGING WITH EPOLICY ORCHESTRATOR AND PROTECTIONPILOT 1. The version of ePolicy Orchestrator that is required to manage AntiSpyware Enterprise 8.5sa differs depending on the language version of AntiSpyware Enterprise 8.5sa. - ePolicy Orchestrator 3.6 is required to manage English, French, German, Spanish, Italian, Dutch, Polish, Brazilian Portuguese and Swedish versions of AntiSpyware Enterprise 8.5sa. - ePolicy Orchestrator 3.6 with Patch 1 is required to manage Japanese, Chinese Simplified, Chinese Traditional, and Korean versions of AntiSpyware Enterprise 8.5sa. 2. If you are using ePolicy Orchestrator 3.6 or ProtectionPilot 1.1.1 to manage both VirusScan Enterprise 8.0i and AntiSpyware Enterprise 8.5sa, you must make sure that the AntiSpyware Enterprise 8.5sa reports .NAP file (ASE850REPORTS.NAP) was checked in last to ensure that AntiSpyware events are parsed. This should only be an issue if you check in an updated version of the VirusScan Enterprise reports .NAP file. If this occurs, you must check the AntiSpyware Enterprise 8.5sa reports .NAP file in to the repository again. 3. Common Management Agent version 3.5.0 with Patch 6 is required to perform a "DAT Rollback" from ePolicy Orchestrator. This version of the agent is posted on the McAfee download web site under the AntiSpyware Enterprise 8.5sa product and can also be found on the product CD. 4. If using either ePolicy Orchestrator 3.6 or ProtectionPilot 1.1.1 to deploy both VirusScan Enterprise 8.0i and AntiSpyware Enterprise 8.5sa to the same computer or a new computer, AntiSpyware Enterprise 8.5sa takes precedence. 5. The ePolicy Orchestrator "Products by Custom Data Group" report does not display AntiSpyware Enterprise details unless you set the "Product Type" filter to "AntiVirus." 6. When using ePolicy Orchestrator to manage a computer with Windows 2003 Enterprise operating system, the ePolicy Orchestrator "Summary of Detection Sources Sorted by First Occurrence" report does not display AntiSpyware Enterprise details until the client computer is restarted. 7. When ePolicy Orchestrator 3.6 generates notifications, it is unable to distinguish between events from VirusScan Enterprise and AntiSpyware Enterprise 8.5sa. If you wish to receive notifications from AntiSpyware Enterprise 8.5sa events, you must select VirusScan Enterprise as the product. 8. When removing AntiSpyware Enterprise 8.5sa from a computer that is managed by ePolicy Orchestrator 3.6 or ProtectionPilot 1.1.1, a "Can’t get uninstall command from plug-in area" message is recorded in the agent log file. This message can be safely ignored. ACCESS PROTECTION 1. Registry Access Protection rules do not work on 64-bit systems. 2. When Maximum Protection rules are enabled, you may not be able to install or uninstall software. To install or uninstall software when Maximum Protection rules are enabled, we recommend that you disable Access Protection before installing or uninstalling, then enable it again when finished. ALERTS (SNMP) 1. If you plan to use the AntiSpyware Enterprise SNMP alerting feature, you must stop the Microsoft SNMP service before installing the AntiSpyware Enterprise SNMP component, then restart the Microsoft SNMP service after installation completes. Type this command line at the command prompt to perform this automatically: Setup.exe STARTSTOPSNMP=True NOTE: Be certain that the SNMP service is configured within the Microsoft Computer Management "Services" snap-in. For more information about configuring your SNMP management system, refer to the documentation for your SNMP management product. COOKIE DETECTIONS 1. The right-click scan feature is not configured to detect cookies. To detect cookies in the cookies folder, use either the on-demand "Targeted Scan" or the "Full Scan." You can also configure the on-access scanner to detect cookies. EXTRA.DAT 1. To use an EXTRA.DAT, you must place it in the Engine folder where the DAT files are located. The AntiSpyware Enterprise product protects itself by preventing users from placing files in the product folder. To place the EXTRA.DAT in the engine folder: a. Disable the on-access scanner. b. Copy and paste the EXTRA.DAT file in the Engine folder at this location: :\Program Files\Common Files\McAfee\Engine c. Enable the on-access scanner. __________________________________________________________ DOCUMENTATION Documentation is included on the product CD and/or is available with a valid grant number from the McAfee download site: https://secure.nai.com/us/forms/downloads/upgrades/login.asp NOTE: Unless otherwise noted, product documentation comes as Adobe Acrobat .PDF files. The product CD includes the latest version of Acrobat Reader, or you can download any version from the Adobe web site: http://www.adobe.com/products/acrobat/readstep2.html STANDARD DOCUMENTATION This product includes the following documentation set: - Installation Guide System requirements and instructions for installing and starting the software. - Product Guide Introduction to the product and its features; detailed instructions for configuring the software; information on deployment, recurring tasks, and operating procedures. - Help High-level and detailed information accessed from the software application: Help menu and/or Help button for page-level help; right-click option for What’s This? help. - Configuration Guide For use with ePolicy Orchestrator 3.6 and ProtectionPilot 1.1.1. Procedures for deploying and managing supported products through the ePolicy Orchestrator and ProtectionPilot management software. - Release Notes (this ReadMe file). - LICENSE Agreement The McAfee License Agreement booklet that includes all of the license types you can purchase for your product. The License Agreement presents general terms and conditions for use of the licensed product. - CONTACTS Contact information for McAfee services and resources: technical support, customer service, Security Headquarters (AVERT), beta program, and training. A text file is included with the software application and on the product CD. ADDITIONAL DOCUMENTATION - Quick Reference Card A handy card with information on basic product features, routine tasks that you perform often, and critical tasks that you perform occasionally. A printed card accompanies the product CD. SUPPLEMENTAL DOCUMENTATION - ePolicy Orchestrator(R) 3.6 documentation. - ProtectionPilot(TM) Product 1.0, 1.1, and 1.1.1 documentation. - McAfee Installation Designer(TM) 8.2 documentation. __________________________________________________________ PARTICIPATING IN THE MCAFEE BETA PROGRAM To download new beta software or to read about the latest beta information, visit the McAfee beta web site located at: http://www.mcafeesecurity.com/us/downloads/beta/mcafeebetahome.htm To submit beta feedback on any McAfee product, send e-mail to: mcafee_beta@mcafee.com McAfee is devoted to providing solutions based on your input. __________________________________________________________ CONTACT INFORMATION SECURITY HEADQUARTERS: AVERT (Anti-Virus & Vulnerability Emergency Response Team) Home Page http://www.mcafeesecurity.com/us/security/home.asp Virus Information Library http://vil.mcafeesecurity.com/ AVERT WebImmune & Submit a Virus Sample (Logon credentials required) https://www.webimmune.net/default.asp AVERT DAT Notification Service http://vil.mcafeesecurity.com/vil/join-DAT-list.asp DOWNLOAD SITE Home Page http://www.mcafeesecurity.com/us/downloads/ Anti-Virus DAT File and Engine Updates http://www.mcafeesecurity.com/us/downloads/updates/ ftp://ftp.mcafee.com/pub/antivirus/datfiles/4.x Anti-Spam Rules File and Engine Updates ftp://ftp.mcafee.com/spamdefs/1.x/ Product Upgrades https://secure.nai.com/us/forms/downloads/upgrades/login.asp Valid grant number required (contact Customer Service) HotFix and Patch Releases - For Security Vulnerabilities (Available to the public) http://www.mcafeesecurity.com/us/downloads/updates/hotfixes.asp - For Products (ServicePortal account and McAfee Technical Support grant number required) https://mysupport.nai.com/products/products.asp Product End-of-Life Support http://www.mcafeesecurity.com/us/products/mcafee/end_of_life.htm SOFTWARE AND HARDWARE TECHNICAL SUPPORT Home Page http://www.mcafeesecurity.com/us/support/technical_support KnowledgeBase Search http://knowledgemap.nai.com/ McAfee Technical Support ServicePortal (Logon credentials required) https://mysupport.mcafeesecurity.com McAfee Security Alerting Service (MSAS) http://mysupport.nai.com/supportinfo/pvans_info.asp CUSTOMER SERVICE US, Canada, and Latin America toll-free: Phone: +1-888-VIRUS NO or +1-888-847-8766 Monday-Friday, 8am-8pm, Central Time E-mail: https://secure.nai.com/us/forms/support/request_form.asp Web: http://www.mcafeesecurity.com/us/support/default.asp MCAFEE BETA PROGRAM Download Site: http://www.mcafeesecurity.com/us/downloads/beta/mcafeebetahome.htm E-mail to Submit Beta Feedback: mcafee_beta@mcafee.com TRAINING: MCAFEE UNIVERSITY http://www.mcafeesecurity.com/us/services/education/mcafee/university.htm WORLDWIDE OFFICES For addresses and phone numbers of worldwide offices: http://www.mcafeesecurity.com/us/contact/home.htm _____________________________________________________ COPYRIGHT AND TRADEMARK ATTRIBUTIONS Copyright (C) 2005 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARKS ACTIVE FIREWALL, ACTIVE SECURITY, ACTIVESECURITY (AND IN KATAKANA), ACTIVESHIELD, CLEAN-UP, DESIGN (STYLIZED E), DESIGN (STYLIZED N), ENTERCEPT, EPOLICY ORCHESTRATOR, FIRST AID, FOUNDSTONE, GROUPSHIELD, GROUPSHIELD (AND IN KATAKANA), INTRUSHIELD, INTRUSION PREVENTION THROUGH INNOVATION, MCAFEE, MCAFEE (AND IN KATAKANA), MCAFEE AND DESIGN, MCAFEE.COM, MCAFEE VIRUSSCAN, NET TOOLS, NET TOOLS (AND IN KATAKANA), NETSCAN, NETSHIELD, NUTS & BOLTS, OIL CHANGE, PRIMESUPPORT, SPAMKILLER, THREATSCAN, TOTAL VIRUS DEFENSE, VIREX, VIRUS FORUM, VIRUSCAN, VIRUSSCAN, VIRUSSCAN (AND IN KATAKANA), WEBSCAN, WEBSHIELD, WEBSHIELD (AND IN KATAKANA) are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. The color red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. _____________________________________________________ LICENSE & PATENT INFORMATION LICENSE AGREEMENT NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. LICENSE ATTRIBUTIONS This product includes or may include: * Software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/). * Cryptographic software written by Eric A. Young and software written by Tim J. Hudson. * Some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL, which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that McAfee provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. * Software originally written by Henry Spencer, Copyright 1992, 1993, 1994, 1997 Henry Spencer. * Software originally written by Robert Nordier, Copyright (C) 1996-7 Robert Nordier. * Software written by Douglas W. Sauder. * Software developed by the Apache Software Foundation (http://www.apache.org/). A copy of the license agreement for this software can be found at www.apache.org/licenses/LICENSE-2.0.txt. * International Components for Unicode ("ICU") Copyright (C) 1995-2002 International Business Machines Corporation and others. * Software developed by CrystalClear Software, Inc., Copyright (C) 2000 CrystalClear Software, Inc. * FEAD(R) Optimizer(R) technology, Copyright Netopsystems AG, Berlin, Germany. * Outside In(R) Viewer Technology (C) 1992-2001 Stellent Chicago, Inc. and/or Outside In(R) HTML Export, (C) 2001 Stellent Chicago, Inc. * Software copyrighted by Thai Open Source Software Center Ltd. and Clark Cooper, (C) 1998, 1999, 2000. * Software copyrighted by Expat maintainers. * Software copyrighted by The Regents of the University of California, (C) 1996, 1989, 1998-2000. * Software copyrighted by Gunnar Ritter. * Software copyrighted by Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A., (C) 2003. * Software copyrighted by Gisle Aas. (C) 1995-2003. * Software copyrighted by Michael A. Chase, (C) 1999-2000. * Software copyrighted by Neil Winton, (C) 1995-1996. * Software copyrighted by RSA Data Security, Inc., (C) 1990-1992. * Software copyrighted by Sean M. Burke, (C) 1999, 2000. * Software copyrighted by Martijn Koster, (C) 1995. * Software copyrighted by Brad Appleton, (C) 1996-1999. * Software copyrighted by Michael G. Schwern, (C) 2001. * Software copyrighted by Graham Barr, (C) 1998. * Software copyrighted by Larry Wall and Clark Cooper, (C) 1998-2000. * Software copyrighted by Frodo Looijaard, (C) 1997. * Software copyrighted by the Python Software Foundation, Copyright (C) 2001, 2002, 2003. A copy of the license agreement for this software can be found at www.python.org. * Software copyrighted by Beman Dawes, (C) 1994-1999, 2002. * Software written by Andrew Lumsdaine, Lie-Quan Lee, Jeremy G. Siek (C) 1997-2000 University of Notre Dame. * Software copyrighted by Simone Bordet & Marco Cravero, (C) 2002. * Software copyrighted by Stephen Purcell, (C) 2001. * Software developed by the Indiana University Extreme! Lab (http://www.extreme.indiana.edu/). * Software copyrighted by International Business Machines Corporation and others, (C) 1995-2003. * Software developed by the University of California, Berkeley and its contributors. * Software developed by Ralf S. Engelschall for use in the mod_ssl project (http:// www.modssl.org/). * Software copyrighted by Kevlin Henney, (C) 2000-2002. * Software copyrighted by Peter Dimov and Multi Media Ltd. (C) 2001, 2002. * Software copyrighted by David Abrahams, (C) 2001, 2002. See http://www.boost.org/libs/bind/bind.html for documentation. * Software copyrighted by Steve Cleary, Beman Dawes, Howard Hinnant & John Maddock, (C) 2000. * Software copyrighted by Boost.org, (C) 1999-2002. * Software copyrighted by Nicolai M. Josuttis, (C) 1999. * Software copyrighted by Jeremy Siek, (C) 1999-2001. * Software copyrighted by Daryle Walker, (C) 2001. * Software copyrighted by Chuck Allison and Jeremy Siek, (C) 2001, 2002. * Software copyrighted by Samuel Krempp, (C) 2001. See http://www.boost.org for updates, documentation, and revision history. * Software copyrighted by Doug Gregor (gregod@cs.rpi.edu), (C) 2001, 2002. * Software copyrighted by Cadenza New Zealand Ltd., (C) 2000. * Software copyrighted by Jens Maurer, (C) 2000, 2001. * Software copyrighted by Jaakko Järvi (jaakko.jarvi@cs.utu.fi), (C) 1999, 2000. * Software copyrighted by Ronald Garcia, (C) 2002. * Software copyrighted by David Abrahams, Jeremy Siek, and Daryle Walker, (C) 1999-2001. * Software copyrighted by Stephen Cleary (shammah@voyager.net), (C) 2000. * Software copyrighted by Housemarque Oy , (C) 2001. * Software copyrighted by Paul Moore, (C) 1999. * Software copyrighted by Dr. John Maddock, (C) 1998-2002. * Software copyrighted by Greg Colvin and Beman Dawes, (C) 1998, 1999. * Software copyrighted by Peter Dimov, (C) 2001, 2002. * Software copyrighted by Jeremy Siek and John R. Bandela, (C) 2001. * Software copyrighted by Joerg Walter and Mathias Koch, (C) 2000-2002. * Software copyrighted by Carnegie Mellon University (C) 1989, 1991, 1992. * Software copyrighted by Cambridge Broadband Ltd., (C) 2001-2003. * Software copyrighted by Sparta, Inc., (C) 2003-2004. * Software copyrighted by Cisco, Inc and Information Network Center of Beijing University of Posts and Telecommunications, (C) 2004. * Software copyrighted by Simon Josefsson, (C) 2003. * Software copyrighted by Thomas Jacob, (C) 2003-2004. * Software copyrighted by Advanced Software Engineering Limited, (C) 2004. * Software copyrighted by Todd C. Miller, (C) 1998. * Software copyrighted by The Regents of the University of California, (C) 1990, 1993, with code derived from software contributed to Berkeley by Chris Torek. PATENTS Protected by U.S. Patents 6,496,875 and 6,668,289. DBN-005-EN V3.1.3