DOS Days

McAfee Associates, Inc.

McAfee Associates opened in 1987 after company founder, John McAfee, learned of the Brain boot sector virus and became fascinated by it. At the time he was running computer company Interpath but after reading about the Alvi brothers and their novel code he wrote a small program to counter it. Posting it up on an electronic bulletin board, within two weeks he had a million users of his program.

British-born John was the first to come up with the idea of a virus scanner that would deal with all computer viruses in a single sweep - up to this point, computer viruses were scanned for and dealt with individually, with a specific program dedicated to eliminate just that one virus. Admittedly, there were not many viruses around back in 1987, but the concept was a good one. Another model he used to great success was to give his product away for free, only charging for customer support. This made the product very popular. In 1994, McAfee Associates were acquired by Network Associates for $100m and John McAfee left the business. Network Associates were later bought by Intel in 2010 for £7.68bn.

McAfee VirusScan

The virus definition files used by McAfee VirusScan are those with a .DAT file extension. In earlier releases there were typically 3 or 4 .DAT files:

  • CLEAN.DAT
  • INSTALL.DAT
  • NAMES.DAT
  • SCAN.DAT

Licenced versions also came with a LICENSE.DAT file. Another one you may see is MESSAGES.DAT. There are also some that have an "EM" prefix, such as EMCLEAN.DAT, EMNAMES.DAT and EMSCAN.DAT. My advice is to just copy all of them into your antivirus directory.

I don't have any information on version 1.0 of VirusScan, McAfee's anti-virus product, but it is known that early versions of VirusScan had very high version numbers, such as 86, 89, 89B, 90, and 91.

Version 86 was released in early 1992.
No versions 87 and 88 were released because trojan horse versions with these numbers were put onto a BBS by unknown persons.
Version 89B was released on 25th March 1992. It added a "generic virus" detection feature.
Version 90 was released on 20th May 1992. Added a second validation technique, new /AF, /CF and /RF flags, and more ERRORLEVEL values.
Version 91 was released on 27th May 1992. Patched a bug in v90 and added the /NOREMOVE flag to VSHIELD.

In November 1995, version 2.2.7 was released for DOS and Windows 3.1. The single floppy disk contained the main SCAN program, a CHECK.EXE utility that verified SCAN had not been altered in any way, and a Windows-only SETUP utility to install it. SCAN.DAT, dated 30th October 1995 (which contains the virus definitions) was 184 KB in size. Somewhat strangely, it is V9510, while other later DAT files have an earlier version number. It appears to be able to detect 5,821 viruses and remove 1,424 of them.

In September 1997, version 3.0.4 was launched for DOS and Windows, retailing for $65 USD. It was available on either 3.5" floppy disks or a single CD-ROM. For the floppy version, a single disk contained the DOS utilities, two disks held the Windows 3.1 software, and a further four disks were for the Windows 95 software. Using the SCAN.DAT virus data file V3.0.3008 (created 19th August 1997 and coming in at 336 KB in size), this version could detect 10,860 viruses and remove 2,480 of them. The DOS utilities included VSHIELD, a memory-resident virus scanner which used 75 KB of XMS and 30 KB of Upper Memory, and the main SCAN program to scan memory, boot sector and files for viruses. The installer adds a line to automatically start VSHIELD when your computer restarts.
 


Version 3.1.4 was released in December 1997, and was much the same. It came with a SCAN.DAT virus data file V3.0.3011 (created 8th December 1997 and coming in at 351 KB in size), this version could detect 11,335 viruses and remove 2,768 of them.

   
VirusScan v4.0 for Windows 95/98, DOS and OS/2

Version 4.5.0, of which I have an evaluation version (works for 30 days), comes with virus definition V4054 created 1st December 1999. This was able to detect 48,143 viruses, trojans and variants.

Network Associates continued to release VirusScan after they acquired McAfee Associates, though it was called VirusScan Command Line as their primary products were now all running in Windows. Once installed it had these files in the install directory:

Directory of C:\NETA\SCAN\.
   .              <DIR>            05-04-2022 10:58
   ..             <DIR>            05-04-2022 10:55
   AUTOEXEC NAI                454 05-04-2022 10:57
   AVPARAM  DLL             45,073 05-04-2022 10:56
   BOOTSCAN EXE            162,569 05-04-2022 10:56
   CLEAN    DAT            255,477 05-04-2022 10:55
   EMCLEAN  DAT             93,570 05-04-2022 10:56
   EMNAMES  DAT             77,267 05-04-2022 10:56
   EMSCAN   DAT            505,415 05-04-2022 10:56
   LICENSE  DAT              1,056 05-04-2022 10:56
   LICENSE  TXT             17,620 05-04-2022 10:56
   MCSCAN32 DLL            897,041 05-04-2022 10:56
   MCTOOL   EXE             38,029 05-04-2022 10:56
   MESSAGES DAT             55,307 05-04-2022 10:56
   NAMES    DAT            258,657 05-04-2022 10:55
   PACKING  LST              1,393 05-04-2022 10:56
   README   TXT             42,320 05-04-2022 10:56
   RESELLER TXT             53,895 05-04-2022 10:56
   RWABS16  DLL              7,449 05-04-2022 10:56
   RWABS32  DLL             16,921 05-04-2022 10:56
   SCAN     DAT          1,361,511 05-04-2022 10:56
   SCAN     EXE            192,519 05-04-2022 10:56
   SCAN86   EXE            658,839 05-04-2022 10:56
   SCANPM   EXE          1,195,327 05-04-2022 10:55
   VALIDATE EXE             51,200 05-04-2022 10:56
   VSHIELD  EXE             35,887 05-04-2022 10:56
 24 File(s)         6,024,796 Bytes.

 

This version v4.12.0 included a 1.3 MB virus definition DAT file V4106, dated 15th November 2000. This file was able to detect 55,453 viruses, and I believe is one of the last versions that worked for the DOS version of VirusScan. An additional SCANPM utility was now included alongside the old SCAN tool, which runs under a DOS Extender (PM most likely means 'protected mode'). I think that actually running the older SCAN executable simply calls SCANPM in these versions and later.

VirusScan 5.1 was launched in July 2000, and came with a single floppy disk and a CD-ROM. On the floppy disk were the SCAN v3.2.0 utility and a SCAN.DAT file containing the virus definitions. This was V3108, created 15th August 1998, and appears to be able to detect 12,978 viruses and remove 3,271 of them. The CD-ROM was designed only for use with Windows [95, 98, 2000 Pro, ME and NT 4.0], and used scan engine v4.0.70 with a DAT file V4088. As before, the key tools were the SCAN utility and VSHIELD memory-resident scanner. I don't believe this version works in pure DOS, but since it seems to have a much older set of virus definitions using v4.12.0 is recommended.

To download any of these versions or just the separate virus definition files, please visit the Anti-Virus Utilities page.