Record number: H163569 Device: D/T6561 Service code: 33 ECA number: ECA019 Parts source: NONE EC number: EC000000 Publish flag: R Mandatory: Y Hit count: UHC00011 Automatic shipment: N Success count: USC0000 Availability date: 98/05 Publication code: PC50 Plant of control: 23 Date created: O98/05/01 Tip key: Date last altered: A98/05/06 Owning B.U.: USA Abstract: ECA019, DATA MISCOMPARE ERRORS USING IBM ANTIVIRUS V3.0 PURPOSE: The purpose of this ECA is to provide information regarding a potential data modification problem on systems using IBM Antivirus version 3.0, build 300.507. See the Physical Check section below on how to determine the build level. Data miscompare errors may be observed on servers running Microsoft WindowsNT 4.0 serving clients with WindowsNT 4.0 and IBM Antivirus v3.0 installed. FEATURES: Type, Machines Affected Model, With and/or Feature/Device B/M to be Service System Stage B/M Description Installed Hours Hours 6561 B/M0000000 PC300GL SYSTEMS PRE- B/M0000000 00.3 00.2 LOADED WITH MICROSOFT WINDOWSNT 4.0 6591 B/M0000000 PC300GL SYSTEMS PRE- B/M0000000 00.3 00.2 LOADED WITH MICROSOFT WINDOWSNT 4.0 PHYSICAL CHECK: IBM PC300GL systems running Microsoft WindowsNT 4.0 and IBM Antivirus v3.0, (Build level 300.507) connected to a server running Microsoft WindowsNT 4.0. To determine if the IBM Antivirus program currently installed is exposed to the problem, perform the following steps: 1. From the WindowsNT desktop, open the IBM Antivirus folder from the START, PROGRAMS menu or right click on the minimized IBM Antivirus icon on the right side of the Task Bar. 2. Click on "Log", then "Current Log" in the title bar of the IBM Antivirus for WindowsNT window. 3. The Current Log is displayed with the first line giving the version of the Antivirus program and the "Build" number. 4. THE AFFECTED VERSION OF THE IBM ANTIVIRUS PROGRAM IS VERSION 3.0 WITH BUILD NUMBER 300.507. 5. IBM ANTIVIRUS VERSION 3.0 WITH BUILD LEVELS OTHER THAN 300.507 ARE NOT AFFECTED BY THIS PROBLEM If the currently installed build level of IBM Antivirus is 300.507, open the IBM Antivirus - System Shield function. To do this, "Cancel" out of the Current Log screen and click on "System Shield" from the "Setup" pull down menu in the IBM Antivirus title bar. Verify that the option for "Check files when accessed" box is checked. If the box is checked, the system is exposed. PREREQUISITES: None COMPANION: None CONCURRENT: None DETAIL: Systems running Microsoft WindowsNT and IBM Antivirus v3.0 (Build level 300.507) may experience data loss or data modification if the IBM Antivirus program is configured for "Check files when accessed" in the Antivirus System Shield. When writing successive data files across a WindowsNT 4.0 network, WindowsNT opens and then closes files. IBM Antivirus synchronously analyzes the files from the server and then compares the data. The software layers involved in analyzing the data files may lose the correct sequence of file operations causing an open file not to be closed and possibly overwritten. The file may be modified without notice to the user. No error or warning message is displayed. The system continues to operate normally. The only indication that a user may experience as a result of this problem is an error condition when the corrupted or manipulated file is accessed. The use of some corrupted data files may not exhibit any failure symptom when accessed. Exposure to the failing condition can be eliminated by removing the check from the box labeled "Check files when accessed" in the IBM Antivirus System Shield function. Exposure to this problem can also be eliminated by upgrading the IBM Antivirus package. NOTE: THERE IS A DISTINCT DIFFERENCE BETWEEN AN UPDATE TO THE IBM ANTIVIRUS FOR WINDOWSNT PROGRAM AND A COMPLETE UPGRADE. THE RESOLUTION TO THIS PROBLEM REQUIRES A COMPLETE UPGRADE TO THE APPLICAITON RATHER THAN THE TYPICAL VIRUS SIGNATURE UPDATES. The latest available version of the IBM Antivirus upgrade may be obtained in the following manner: 1. Download the complete IBM Antivirus Upgrade via the Internet using the following FTP command: ftp://ftp.pc.ibm.com/pub/special/haze/avwsntea.exe To install this application, click on the Start button, click on Run, type the file path and name in the space provided, click on OK, and then follow the instructions on the screen. -OR- If diskettes are required, download the portable version files below: ftp://ftp.pc.ibm.com/pub/special/haze/avntea1.dsk ftp://ftp.pc.ibm.com/pub/special/haze/avntea2.dsk ftp://ftp.pc.ibm.com/pub/special/haze/avntea3.dsk These diskettes will perform a complete install of the updated version of IBM Antivirus for WindowsNT v3.0, build level 304.073. To extract the diskette images from their compressed format (.DSK), download the .DSK extraction utility LDF.COM from the following Internet URL: http://www.pc.ibm.com/files.html LDF.COM is a self-extracting file that contains the utility and instructions on how to build the instal- lation diskettes. 2. If further assistance is required, contact the IBM Personal Systems Group HelpCenter at 1-800-772-2227. The HelpCenter will NOT provide the IBM Antivirus package, only assistance in determining if the system is exposed and user assistance in downloading the required upgrade package. The upgrade package MUST be downloaded from the FTP site. Outside of the United States, use the normal support structure of Country Support and Local HelpCenters for additional assistance. NOTES: This is a customer installable fix or upgrade. This ECA will expire on December 31, 1999 Windows and WindowsNT are trademarks of the Microsoft Corporation. SAS KEYWORDS: CDT PWS INTELLISTATION SERVER NETFINITY PC SERVER PSVP IBMAV D/T6561 D/T6591 6561 6591 DESKTOP VIRUS UNCLASSIFIED