User Guide

Updating and Mirroring Tasks
66 McAfee VirusScan TC
Deploying routine .DAT file updates
Whenan outbreakconditionexists,thenewdriversare,as usual,addedtothe
routine, weekly .DAT files. However, instead ofwaiting untilthe next weekly
distribution day to incorporate the new virus definition, a new incremental
.DAT file is created to deal with the new virus, and is included with the .DAT
filesavailablefrom theMcAfeeFTPsite.Thus,by performingaroutineupdate
at any time, youare assured of received the most current .DAT files,including
the most current drivers. If variants of the original virus appear, additional
incrementals are created, as needed, and added to the downloadable .DAT
package. Administrators can now schedule very frequent updates during an
outbreak,evendailyorhourlyupdates,ifrequiredandfeasibleintermsof the
size and topology of the network and its traffic.
This approach requires that McAfee change the .DAT file naming convention
thatcurrentusersalreadyknow.Inthepast,eachweekly.DATfilerelease was
assignedanumberinseries.Forexample,ifthe.DAT setcreatedonJune7was
designed 4.0.4081,youcouldexpect the.DAT release ofJune14 to be4.0.4082,
and the release of June 21 to be 4.0.4083, and so on.
Inan outbreaksituation,several releasesmay occur duringa singleweek.For
example, all three .DAT release described above (4.0.4081 through 4.0.4083)
might all be released in a single week. In this case, the routine .DAT file
released on the next weekly release day will be 4.0.4084.
Although McAfee has not yet discontinued issuing EXTRA.DAT files during
outbreaks, for many users, the new approach of simply deploying the
standard .DAT file will replace thecurrent practice of relying on EXTRA.DAT
to protect their networks.
Deploying an EXTRA.DAT file
Independently of the weekly .DAT update
The McAfee AVERT research organization sometimes provides EXTRA.DAT
files to combat high-risk viruses between regular .DAT and SuperDAT
releases. In ordinary circumstances, McAfee researchers publish these files
when they determine that these situations warrant one:
• A virus presents a “medium on-watch, “high” risk threat of infection, or
“high” risk outbreak situation. To learn about what constitutes a medium
on-watch or highrisk,or to learnaboutMcAfeeAVERT riskassessmentin
general,visit the AVERT website at:
http://www.mcafeeb2b.com/asp_set/anti_virus/alerts/ara.asp
• A high-prevalence virus threatens an outbreak situation.