[size=3][color=red]Important Notice for Users of McAfee Scan Engine 4240 for Windows Scan Engine 4260 for Windows Now Available[/color][/size]

With the release of the 4.2.40 engine McAfee has once again focused on bringing you the best of breed scanning technology. The 4.2.40 engine's features include the following to deliver the additional protection you need from today's threats in a more efficient and productive manner.[list][*]
Detection in memory of active viruses, worms and Trojans.
[*]Digitally signed scan engine and DATs.
[*]Improved handling of companion viruses.
[*]Many additional features required by AVERT to provide cutting-edge detection and repair capabilities.[/list]
Recently, we discovered a problem with the 4.2.40 engine during in-house code reviews for the next release of the engine. This issue was confirmed through testing of the products below and we subsequently received a notice from a single customer confirming the same issue in the field. This problem does not impact detection and is outlined below.

We have determined that this problem, though not widely reported, could produce a significant enough problem with new viruses in the future and that it was best addressed by releasing a newer version of the 4.2.40 engine. This engine we are calling the 4.2.60 release.

In addition to the problem summary below, we have also outlined the products affected and not affected, resolutions and recommendations, and more.

AVERT recommends you update to this new engine (4.2.60) as soon as possible, to keep your environment as fully protected as possible.

Thank you for allowing us to address this issue with you.


[size=3][color=red]Summary of the issue[/color][/size]


During the cleaning process, it is sometimes necessary to modify the Windows registry in order to remove rogue instructions placed there by a piece of malware.

We have found that, under certain circumstances, during the removal of the registry key data associated with a piece of malware, the scan engine will remove ALL values from that key.

Depending on the original data contained within the key and the host operating system, this may result in applications or services not being loaded at startup.


[size=3][color=red]Products affected[/color][/size][list][*]VirusScan 4.5.1 SP1
[*]VirusScan Retail 6 / 7
[*]VirusScan Thin Client 6.x
[*]NetShield NT 4.5 SP1 / Hotfix roll-up
[*]GroupShield for Domino NT 5.0a
[*]WebShield SMTP 4.5 pre MR1a HF5
[*]WebShield e50 pre HF2[/list]
[size=3][color=red]Products NOT affected[/color][/size][list][*]Non-Windows based products including WebShield Appliances e250/e500/e1000
[*]VirusScan Enterprise 7
[*]VirusScan ASaP
[*]VirusScan Online
[*]GroupShield for Exchange 5.5
[*]GroupShield for Exchange 2000
[*]GroupShield for Domino NT 5.2.x
[*]WebShield SMTP 4.5 MR1a HF5 +
[*]WebShield e50 HF2 +[/list]
[size=3][color=red]Resolution / Recommendations[/color][/size]
The McAfee Engine Team and AVERT have identified the cause of this issue and have taken the following steps.[list][*]A new interim scan engine, the 4.2.60 scan engine, has been released (See Update Schedule below).
[*]Since we became aware of the issue, we have used virus detection and removal techniques that avoid the issue and so do not result in the loss of registry data.[/list]
The new 4.2.60 scan engine is identical to the current shipping 4.2.40 engine with the exception of this specific fix. No additional functionality has been added.

Users may download the 4260 Engine-only SuperDAT [url=http://a64.g.akamai.net/7/64/2015/2003-06-02-11-00-00-300/download.nai.com/products/licensed/superdat/engine/intel/4260/4260eng.exe]here[/url] and its associated README [url=http://a64.g.akamai.net/7/64/2015/2003-06-02-11-00-00-300/download.nai.com/products/licensed/superdat/engine/intel/4260/readme_sdat.txt]here[/url].


[size=3][color=red]Update Schedule[/color][/size]

The 4260 scan engine will be available from the following dates, in the following packages posted to the standard McAfee update Web and FTP sites:


Engine-only SuperDAT: 2nd June 2003
Regular weekly SuperDAT: 25th June 2003
Engine package for use with
McAfee AutoUpdate Architect & ePO 3.0: 25th June 2003

Please note that due to the nature of this scan engine release it is categorized as an interim engine release and any commitments on the part of McAfee to include new features or requested changes do not apply to an interim release.


[size=3][color=red]When should you apply the update?[/color][/size][list=1][*]If you have not yet rolled out the 4.2.40 scan engine, AVERT recommends that you move straight to the 4.2.60 scan engine. As detailed above, any previous planning you have made to deploy or distribute the 4.2.40 scan engine within your organization is equally applicable to the new scan engine, due to the marked similarity of the 4.2.40 and 4.2.60 scan engines.

[*]If you have already deployed the 4.2.40 scan engine to affected products, we would recommend the immediate deployment of the 4.2.60 engine.

[*]If you are running the 4.2.40 scan engine on unaffected products, you will have the opportunity to update to the 4.2.60 scan engine immediately using the 4.2.60 Engine-only SuperDAT at the time of release, or using the regular weekly SuperDAT. However there is no immediate need to update the engine at this point.[/list]

[size=3][color=red]Continued use of the 4240 engine on unaffected products[/color][/size]


Customers wishing to continue using the 4.2.40 scan engine on unaffected products can do so using the weekly "XDAT" packages.

These packages provide the same functionality as the full SuperDAT, but exclude scan engine files.

However, you should update to the 4.2.60 scan engine before the End Of Life of the 4.2.40 scan engine on Windows platforms, as detailed below.


[size=3][color=red]End Of Life Policy for the 4240 scan engine for Windows[/color][/size]


The 4.2.40 scan engine for Windows ONLY - regardless of which product it is being used with - shall be considered End Of Life on November 30th 2003, in line with our standard End Of Life policy.

Other non-Windows 4.2.40 scan engines will continue to be supported beyond this date, in line with our standard End Of Life policy.

The End Of Life policy for the scan engine and other McAfee products can be found at http://www.networkassociates.com/us/products/mcafee/end_of_life.htm and will be updated to reflect any changes that result from this scan engine release.