where to get McAfee ScanPM 4.3.2?, version inconsistencies

[=?iso-8859-1?Q?Eep=B2?=]

Where can I get it? There is only scan.exe 4.3.2 in http://bin.mcafee.com/molbin/iss-loc/vso/cmdscan/dailyscan.zip but I want scanpm.exe so I can run it at will without having to restart in safe mode command prompt.

I tried downloading the command-line trial from (can't find it now) but I got some script error after "registering" <eyeroll> just to download it. Whatever...

That scan.exe uses DAT 4100 (3/30/04) yet the latest DAT is 4345 (3/29/04). Huh?

It also claims I have a boot sector Form virus but ScanPM 4.2.6 does not. Huh? The Form virus is hardly a new virus so why would the newer engine detect it but the older one not? McAfee's virus info page, http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=473, says DAT 4002 is required to detect it. Uh...

The free online virusscan doesn't show I have a boot sector virus either. Uh...


Also, what's up with the version numbering inconsistencies?

"McAfee VirusScan for DOS/PM v4.7.0
Copyright (c) 1992-2000 Networks Associates Technology, Inc. All rights reserved.
(408) 988-3832 LICENSED COPY - Mar 21 2000

Scan engine v4.0.70 for DOS/PM."

"McAfee VirusScan for DOS/PM v4.26.0
Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights reserved.
(408) 988-3832 LICENSED COPY - May 16 2003

Scan engine v4.2.60 for DOS/PM."

Huh? Why do the first lines say 4.xx.0 but the "scan engine" lines say 4.x.x0?

 

[Shane]

http://download.mcafee.com/updates/superDat.asp?real=0

Shane

 

[=?iso-8859-1?Q?Eep=B2?=]

Um, I don't want a DAT (or SuperDAT) update. I want scanpm.exe version 4.3.2. I don't use VirusScan 8. I use ScanPM 4.2.6. Hence, the SuperDATs don't apply.

 

[=?iso-8859-1?Q?Eep=B2?=]

OK, I found out how to extract the contents and, sure enough, scanpm.exe 4.3.2 was there. Thanks.

But back to my other problem:

"This disk is identified as having Form virus !!!
Please examine the boot sector."

scanpm.exe (or scan86.exe or bootscan.exe) 4.3.2 doesn't detect any boot sector Form virus but scan.exe 4.3.2 does. Why? And if I try to clean the boot sector I get "128 ... unknown error (code 0)".

 

[David H. Lipman]

SCAN.EXE is the better utility. SCANPM is a DOS only protected Mode scanner while SCAN is a
dual-mode DOS and Win32 executable.

Dave



| Where can I get it? There is only scan.exe 4.3.2 in
http://bin.mcafee.com/molbin/iss-loc/vso/cmdscan/dailyscan.zip but I want scanpm.exe so I
can run it at will without having to restart in safe mode command prompt.
|
| I tried downloading the command-line trial from (can't find it now) but I got some script
error after "registering" <eyeroll> just to download it. Whatever...
|
| That scan.exe uses DAT 4100 (3/30/04) yet the latest DAT is 4345 (3/29/04). Huh?
|
| It also claims I have a boot sector Form virus but ScanPM 4.2.6 does not. Huh? The Form
virus is hardly a new virus so why would the newer engine detect it but the older one not?
McAfee's virus info page,
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=473, says DAT 4002 is
required to detect it. Uh...
|
| The free online virusscan doesn't show I have a boot sector virus either. Uh...
|
|
| Also, what's up with the version numbering inconsistencies?
|
| "McAfee VirusScan for DOS/PM v4.7.0
| Copyright (c) 1992-2000 Networks Associates Technology, Inc. All rights reserved.
| (408) 988-3832 LICENSED COPY - Mar 21 2000
|
| Scan engine v4.0.70 for DOS/PM."
|
| "McAfee VirusScan for DOS/PM v4.26.0
| Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights reserved.
| (408) 988-3832 LICENSED COPY - May 16 2003
|
| Scan engine v4.2.60 for DOS/PM."
|
| Huh? Why do the first lines say 4.xx.0 but the "scan engine" lines say 4.x.x0?

 

[zack]

SCAN.EXE is the better utility. SCANPM is a DOS only protected Mode scanner while SCAN is a
dual-mode DOS and Win32 executable.

Dave

Correct. scan.exe will select which virus scanner to use depending on
the environment it is executed in..

If you run scan.exe in DOS mode, it will invoke scanpm.exe, which
invokes protected mode. If protected mode is unavailable, aka you have
a 286 CPU or below. I would imagine that scan.exe invokes scan86.exe
in that case. the engine in scan86.exe is obsolete and no longer
being updated.

If you run scan.exe in Windows, it will initialize the scanning engine
which is in mcscan32.dll.

So, its always best to just run scan.exe and it will choose the best
scanner for your system.

 

[zack]

OK, I found out how to extract the contents and, sure enough, scanpm.exe 4.3.2 was there. Thanks.

But back to my other problem:

"This disk is identified as having Form virus !!!
Please examine the boot sector."

scanpm.exe (or scan86.exe or bootscan.exe) 4.3.2 doesn't detect any boot sector Form virus but scan.exe 4.3.2 does. Why? And if I try to clean the boot sector I get "128 ... unknown error (code 0)".

What version of windows are you using? If you are using NT, the
scanner will not write to the boot sector while in windows. I am not
sure about 2000 or XP. The only sure way to remove a boot sector
virus in an NT os is outside of the windows environment, running
scan.exe /boot /clean. You may have to put the scanner on a bootdisk
to do this.

 

[David H. Lipman]

Zack:

Using the MS Dependency Walker utility, I don't see SCAN.EXE calling MCSCAN32.DLL.

I do see it calls;

ADVAPI32.DLL
NTDLL.DLL
GDI32.DLL
KERNEL32.DLL
USER32.DLL
RPCRT4.DLL

Dave



| On Thu, 01 Apr 2004 23:09:26 GMT, "David H. Lipman"
|
| >SCAN.EXE is the better utility. SCANPM is a DOS only protected Mode scanner while SCAN
is a
| >dual-mode DOS and Win32 executable.
| >
| >Dave
| >
| >
|
|
| Correct. scan.exe will select which virus scanner to use depending on
| the environment it is executed in..
|
| If you run scan.exe in DOS mode, it will invoke scanpm.exe, which
| invokes protected mode. If protected mode is unavailable, aka you have
| a 286 CPU or below. I would imagine that scan.exe invokes scan86.exe
| in that case. the engine in scan86.exe is obsolete and no longer
| being updated.
|
| If you run scan.exe in Windows, it will initialize the scanning engine
| which is in mcscan32.dll.
|
| So, its always best to just run scan.exe and it will choose the best
| scanner for your system.

 

[null]

Zack:

Using the MS Dependency Walker utility, I don't see SCAN.EXE calling MCSCAN32.DLL.

I do see it calls;

ADVAPI32.DLL
NTDLL.DLL
GDI32.DLL
KERNEL32.DLL
USER32.DLL
RPCRT4.DLL

When you use SCAN.EXE as a stand-alone command line scanner, it
requires the following DLL files:

MSCAN32.DLL
RWABS16.DLL
RWABS32.DLL

in addition to the six DAT files.


Art
http://www.epix.net/~artnpeg

 

[kurt wismer]

Zack:

Using the MS Dependency Walker utility, I don't see SCAN.EXE calling MCSCAN32.DLL.

I do see it calls;

ADVAPI32.DLL
NTDLL.DLL
GDI32.DLL
KERNEL32.DLL
USER32.DLL
RPCRT4.DLL

dependency walker doesn't show you what it calls, only the dependencies
that were specified at compile time... it's possible to use LoadLibrary
calls that go completely unnoticed by dependency walker...

if you want to know what it actually uses, examine it with process
explorer while it's actually running...

 

[David H. Lipman]

Thanx for that !

Dave



| David H. Lipman wrote:
|
| > Zack:
| >
| > Using the MS Dependency Walker utility, I don't see SCAN.EXE calling MCSCAN32.DLL.
| >
| > I do see it calls;
| >
| > ADVAPI32.DLL
| > NTDLL.DLL
| > GDI32.DLL
| > KERNEL32.DLL
| > USER32.DLL
| > RPCRT4.DLL
|
| dependency walker doesn't show you what it calls, only the dependencies
| that were specified at compile time... it's possible to use LoadLibrary
| calls that go completely unnoticed by dependency walker...
|
| if you want to know what it actually uses, examine it with process
| explorer while it's actually running...
|
| --
| "we're the first ones to starve, we're the first ones to die
| the first ones in line for that pie in the sky
| and we're always the last when the cream is shared out
| for the worker is working when the fat cat's about"

 

[=?iso-8859-1?Q?Eep=B2?=]

I don't have rwabs16.dll or rwabs32.dll in the same directory as scan.exe (or anywhere in the path) yet scan.exe runs fine without them.

 

[null]

I don't have rwabs16.dll or rwabs32.dll in the same directory as scan.exe (or anywhere in the path) yet scan.exe runs fine without them.

SCAN.EXE Version 4.32.0 213,049 bytes 12-08-03

If those files aren't found by SCAN.EXE as it starts up, it stops and
puts out the error report they have failed their integrity check.

Art
http://www.epix.net/~artnpeg

 

[David H. Lipman]

Sorry Art:

Neither rwabs16.dll or rwabs32.dll exist on my PC and I have no problems with McAfee
VirusScan v7.1 Enterprise or in using SCAN.EXE.

Dave




|
| >I don't have rwabs16.dll or rwabs32.dll in the same directory as scan.exe (or anywhere in
the path) yet scan.exe runs fine without them.
|
| SCAN.EXE Version 4.32.0 213,049 bytes 12-08-03
|
| If those files aren't found by SCAN.EXE as it starts up, it stops and
| puts out the error report they have failed their integrity check.
|
| >[email protected] wrote:
| >>
| >> On Thu, 08 Apr 2004 14:34:00 GMT, "David H. Lipman" <[email protected]>
wrote:
| >>
| >> >Using the MS Dependency Walker utility, I don't see SCAN.EXE calling MCSCAN32.DLL.
| >>
| >> When you use SCAN.EXE as a stand-alone command line scanner, it
| >> requires the following DLL files:
| >>
| >> MSCAN32.DLL
| >> RWABS16.DLL
| >> RWABS32.DLL
| >>
| >> in addition to the six DAT files.
|
| Art
| http://www.epix.net/~artnpeg

 

[null]

Sorry Art:

Neither rwabs16.dll or rwabs32.dll exist on my PC and I have no problems with McAfee
VirusScan v7.1 Enterprise or in using SCAN.EXE.

Well, try it. The subject I was adressing is a stand-alone command
line scanner where you only have SCAN.EXE, the DATs and whatever else
is required in a folder somewhere. You'll find that "whatever else" in
that case includes the three .DLL files I mentioned or SCAN.EXE won't
run.


Art
http://www.epix.net/~artnpeg

 

[David H. Lipman]

Art:

I did. Neither DLL is required.

Dave



| On Sun, 11 Apr 2004 18:30:03 GMT, "David H. Lipman"
|
| >Sorry Art:
| >
| >Neither rwabs16.dll or rwabs32.dll exist on my PC and I have no problems with McAfee
| >VirusScan v7.1 Enterprise or in using SCAN.EXE.
|
| Well, try it. The subject I was adressing is a stand-alone command
| line scanner where you only have SCAN.EXE, the DATs and whatever else
| is required in a folder somewhere. You'll find that "whatever else" in
| that case includes the three .DLL files I mentioned or SCAN.EXE won't
| run.
|
|
| Art
| http://www.epix.net/~artnpeg

 

[null]

Art:

I did. Neither DLL is required.

Then it must be finding something in the PATH that makes it happy on
your PC. I don't have McAfee installed. You might have to try it on a
different PC or partition to see what I mean.


Art
http://www.epix.net/~artnpeg

 

[=?iso-8859-1?Q?Eep=B2?=]

Dunno, man; I don't have 'em ANYWHERE on my system. It complains if mscan32.dll isn't present, but that's it. <shrug> Same exact Scan.exe...

Try removing the rwabs*.dll files and see if scan.exe still runs without 'em. I suspect it will for you...

 

[=?iso-8859-1?Q?Eep=B2?=]

When did you last try to run scan.exe, Art? Seeing as how you don't have it installed, you might want to actually try it before replying again.

 

[David H. Lipman]

Here's the reason why:


FILES FOR VIRUSSCAN FOR MICROSOFT WINDOWS 95
AND WINDOWS 98

MCSCAN32.VXD Virus-scanning engine

RWABS16.DLL VirusScan 16-bit
support file

RWABS32.DLL VirusScan 32-bit
support file

VSHIELD.VXD VShield scanner that
runs in the background

Extracted from the README.TXT file from ENGINE v4320.

Dave



| On Sun, 11 Apr 2004 21:55:17 GMT, "David H. Lipman"
|
| >Art:
| >
| >I did. Neither DLL is required.
|
| Then it must be finding something in the PATH that makes it happy on
| your PC. I don't have McAfee installed. You might have to try it on a
| different PC or partition to see what I mean.
|
|
| Art
| http://www.epix.net/~artnpeg