      Release Notes for McAfee(R) SpamKiller(R)
        Version 2.1.1 for Microsoft Exchange
                       Patch 1
 Copyright (C) 2004 Networks Associates Technology,
                        Inc.
                 All Rights Reserved


==========================================================

Patch Release:         October 15, 2004

This release was developed and tested with:

- McAfee SpamKiller    Version 2.1.1 for Microsoft
                       Exchange
- Anti-spam Rules:     1214
- Engine Version:      1214

Make sure you have installed these versions before
using this release.

==========================================================


Thank you for using SpamKiller(R) software. This
file contains important information regarding this
release. We strongly recommend that you read the
entire document.


The attached files are provided as is, and with no
warranty either expressed or implied as to their
suitability for any particular use or purpose.
McAfee, Inc. assumes no liability for damages
incurred either directly or indirectly as a result
of the use of these files, including but not limited
to the loss or damage of data or systems, loss of
business or revenue, or incidental damages arising
from their use. Patch files should be applied only
on the advice of McAfee Technical Support, and only
when you are actually experiencing the issue being
addressed by the Patch. Patch files should not be
proactively applied in order to prevent potential
product issues. You are responsible for reading and
following all instructions for preparation,
configuration, and installation of Patch files.
Patch files are not a substitute or replacement for
product Service Packs which may be released by
McAfee, Inc. It is a violation of your software
license agreement to distribute or share these files
with any other person or entity without written
permission from McAfee, Inc. Further, posting of
McAfee Patch files to publicly available Internet
sites is prohibited. McAfee, Inc. reserves the right
to refuse distribution of Patch files to any company
or person guilty of unlawful distribution of McAfee
software products. Questions or issues with McAfee
Patch files should be directed to McAfee Technical
Support.



__________________________________________________________
WHAT'S IN THIS FILE

-   About This Release
   -   Purpose
   -   Resolved Issues
   -   Known Issues
   -   Files Included with This Release
-   Installation
   -   Installation Requirements
   -   Installation Steps
   -   Testing Your Installation {optional}
   -   Removing This Release {optional}
-   Contact Information
-   Copyright & Trademark Attributions
-   License & Patent Information



IMPORTANT NOTE

    This patch is for the SpamKiller 2.1.1 software
    (Service Pack 1). If you currently have
    SpamKiller 2.10 installed, you can download
    Service Pack 1 from the McAfee web site at:

       https://secure.nai.com/us/forms/downloads/upgrades/login.asp

    You will need to supply your customer grant
    number or user name and password to access this
    site.


__________________________________________________________
ABOUT THIS RELEASE

This patch resolves all of the following issues:

PURPOSE

This Patch includes one file for use with McAfee
SpamKiller version 2.1.1 for Microsoft Exchange.
This new file resolves the issues listed in the
section "Resolved Issues."


RESOLVED ISSUES

1.  Policies based on Active Directory groups that
    contain Swedish characters as part of their name
    do not take effect.

2.  When using the SpamKiller standalone interface,
    importing a configuration file whose filename
    contained Swedish characters resulted in an
    error message.

3.  E-mail messages that contained odd numbers of
    "%" characters in its subject resulted in a
    distorted alert e-mail message being sent to the
    Administrator's mailbox.

4.  Servers with SpamKiller installed and managed
    through ePolicy Orchestrator, CPU usage by
    NaPrdMgr.exe will rise up to 80-90% after
    approximately 24 hours.

5.  ePolicy Orchestrator policy enforcement changes
    the MCAFEECONFIG.XML file's time stamp on every
    policy enforcement interval, though there is no
    change made in the configuration of SpamKiller
    from ePolicy Orchestrator console.

6.  When attempting to upgrade the ePolicy
    Orchestrator agent version 3.1.1.184 from an
    ePolicy Orchestrator 3.01 server, the upgrade
    fails on computers running SpamKiller.

7.  After few hours of scheduled task completion,
    the 'Last Run' and 'Next Run' values are
    displayed as 'unknown' with SpamKiller.

8.  Email sent to a user's secondary email address
    was not being scanned for spam content.

9.  If the domain name to which the user (who
    configures the user level BW list entries)
    belongs to has more than one dot, the user's
    e-mail address would not be resolved properly.
    That is, the e-mail address in <install
    location>\spamkiller\bin\mailboxes\<user>\config"
    file would be empty.

10. Whitelist entries from one user were being
    applied to other users.

11. File samples may cause high CPU utilization or
    File sample causes SpamKiller to stop scanning.

12. The anti-spam events do not contain local and
    GMT time stamps. Due to this, these events are
    not getting reflected in the anti-spam reports.

13. SpamKiller Banned File counter increases when
    File Filtering is enabled but no rules are
    applied or enabled.

__________________________________________________________
SpamKiller service issues

14. This patch corrects several McAfee SpamKiller
    service exceptions, including those at the
    following addresses:
   -   005B4E4F
   -   780C256C
   -   77f48787

15. The McAfee SpamKiller service causes an
    exception when a restart request is received
    shortly after a Stop request.

__________________________________________________________
RPC Server issues

16. This patch corrects several RPCSERV.EXE
    exceptions, including those at the following
    addresses:
   -   04746fad
   -   04xx10c3
   -   0446AB24
   -   77FCB980
   -   008C44B8
   -   045631C5
   -   04929FDB
   -   0423154B
   -   007a90a5


17. RPCSERV.EXE locked with no response.

18. RPCSERV.EXE crash due to very high frequency of
    scan.

19. RPCSERV.EXE using high CPU, causing users to be
    unable to connect.

20. RPCSERV.EXE runs at 50% CPU after applying
    SpamKiller 2.1.1.


KNOWN ISSUES

The following issues have been found during the
testing of this patch, but have not been resolved by
this patch:

1.  On deploying SpamKiller Patch 1 through ePolicy
    Orchestrator, the ePolicy Orchestrator console
    does not indicate the end of the patch
    installation, due to the restarting of the
    Framework service.

2.  Depending upon your system configuration, the
    SpamKiller interface may stop responding after a
    period of time if you have McAfee VirusScan
    Enterprise 8.0i installed on the same computer.
    To work around this issue, please close the
    SpamKiller interface when you have finished
    using it.

3.  If you install the SpamKiller patch 1 on a
    computer that already has SpamKiller and McAfee
    VirusScan Enterprise 8.0i installed, the SMTP
    service may stop responding. To work around this
    issue, ensure that Port 25 is not blocked by
    VirusScan Enterprise (Check this from the Port
    Blocking tab, found on the Access Protection
    Properties screen).

FILES INCLUDED WITH THIS RELEASE

This release consists of a package called
Sk211PATCH1.ZIP, which contains the following
files:

    SK211PATCH1.EXE =
       SpamKiller Patch executable file, replaces
       the following files:

       EXCHANGEEMAILRESOLVER.DLL
       EVALUATEPOLICY.DLL
       GSNOTIFICATION.DLL
       PICKER.DLL
       EXCHANGESTOREITERATOR.DLL
       TRANSPORTSCAN.DLL
       GSCOMMON.DLL
       UPDATECALLBACK.DLL
       SPAMROUTER.DLL
       ESERVICESSCANNER.DLL
       LISTSTORE.DLL
       CONFIGUI.EXE
       SAFESERVICE.EXE
       EPOPLUGIN.DLL
       REPORTER.DLL
       SERVERSIDEUI.DLL
       REPOSITORY.DLL
       COMMON.DLL
       CONFIGSERVER.DLL
       RPCSERV.EXE
       PROXYSTUB.DLL
       EFMTMIMEMSG.DLL
       EFMTDOCSCAN.DLL
       IMPSI2.FLT
       POLICYUI.JAR
       RESOURCES.JAR
       SCCCA.DLL
       SCCCH.DLL
       SCCDA.DLL
       SCCFA.DLL
       SCCFI.DLL
       SCCFMT.DLL
       SCCLO.DLL
       SCCOLE.DLL
       SCCTA.DLL
       SCCUT.DLL
       VSACAD.DLL
       VSAMI.DLL
       VSEMF.DLL
       VSESHR.DLL
       VSFLW.DLL
       VSGDSF.DLL
       VSGIF.DLL
       VSHTML.DLL
       VSHWP.DLL
       VSICH.DLL
       VSLWP.DLL
       VSMPP.DLL
       VSMSG.DLL
       VSMSW.DLL
       VSPDF.DLL
       VSPNG.DLL
       VSPP97.DLL
       VSQP6.DLL
       VSQP9.DLL
       VSRTF.DLL
       VSSHW3.DLL
       VSSO6.DLL
       VSTAZ.DLL
       VSTEXT.DLL
       VSTIF6.DLL
       VSVCRD.DLL
       VSVISO.DLL
       VSW6.DLL
       VSW97.DLL
       VSWK6.DLL
       VSWMF.DLL
       VSWP5.DLL
       VSWP6.DLL
       VSWPG2.DLL
       VSXL5.DLL
       VSZIP.DLL

    README.TXT =
       This text file
    VALIDATE.TXT =
       Validate codes for this Patch

__________________________________________________________
INSTALLATION

To use this release, you must have McAfee SpamKiller
version 2.1.1 for Microsoft Exchange software
installed on the computer you intend to update with
this release.

    NOTES:
    This release does not work with earlier versions
    of McAfee SpamKiller version 2.1 for Microsoft
    Exchange software.

    If required, installing this Patch will stop and
    restart the following services (if they are
    present):

       1.  McAfee SpamKiller
       2.  McAfee Framework
       3.  MS Exchange Information Store
       4.  MS Exchange Routing Engine
       5.  MS Exchange IMAP4
       6.  MS Exchange POP3
       7.  MS Exchange MTA Stacks
       8.  SMTP Service
       9.  NNTP service
       10. WWW service
       11. IIS Admin service

    When you install this patch, the original
    SpamKiller files are backed up to the "mcafee
    spamkiller\bin\backup" folder before being
    replaced by the files contained within this
    patch.

INSTALLATION STEPS

1.  Close all SpamKiller Administration consoles
    that are running on the server or on any
    management console.

2.  Extract the following file:

    SK211PATCH1.EXE

    from the Patch package into the C:\Temporary
    directory.

3.  Run the SK211PATCH1.EXE

    The Patch will display a wizard-style interface
    and produce a SuperDAT.log file (in the folder
    where the Patch has been executed from) where it
    will list all actions taken.

INSTALLATION THROUGH ePOLICY ORCHESTRATOR VERSION
3.0.1

1.  Extract the following file:

    SK211PATCH1.EXE

    from the Patch package into the C:\Temporary
    directory of your ePO machine.

2.  Using the "Add Package" option given under
    Master Repository in ePO, add the SuperDAT
    package.

3.  Schedule an immediate update using ePolicy
    Orchestrator agent-"Update" option given under
    the "schedule" tab.

    NOTE:
    You may have to restart the SpamKiller server
    for the update to take effect.

INSTALLATION STEPS FOR CLUSTER SERVERS

To install this Patch on a Microsoft Cluster Server,
repeat the process above on all the cluster nodes in
the cluster.


TESTING YOUR INSTALLATION

You can check that the Patch is applied correctly by
verifying the file version information of the
following files, now resident in the \SpamKiller
directory:

    ExchangeEmailResolver.dll6.0.765.0
    EvaluatePolicy.dll6.0.765.0
    gsNotification.dll6.0.765.0
    picker.dll6.0.765.0
    ExchangeStoreIterator.dll6.0.765.0
    TransportScan.dll6.0.765.0
    GSCommon.dll6.0.765.0
    UpdateCallback.dll6.0.765.0
    SpamRouter.dll6.0.765.0
    EservicesScanner.dll1.0.768.0
    liststore.dll1.0.768.0
    configui.exe1.0.768.0
    SAFeService.exe1.0.768.0
    epoPlugin.dll1.0.768.0
    Reporter.dll1.0.768.0
    ServersideUI.dll1.0.768.0
    Repository.dll1.0.768.0
    Common.dll1.0.768.0
    ConfigServer.dll1.0.768.0
    RPCServ.exe1.0.768.0
    ProxyStub.dll1.0.768.0
    EFMTmimemsg.dll3.2.830.0
    EFMTdocscan.dll3.2.830.0

REMOVING THIS RELEASE

    NOTE:
    We recommend that you do NOT remove the Patch
    files from your McAfee SpamKiller version 2.1.1
    for Microsoft Exchange installation once you
    install them. If you reinstall your McAfee
    SpamKiller version 2.1.1 for Microsoft Exchange
    software, we recommend that you also reinstall
    the Patch.

__________________________________________________________
PARTICIPATING IN THE MCAFEE BETA PROGRAM

To download new beta software or to read about the
latest beta information, visit the McAfee beta web
site located at:
       http://www.mcafeesecurity.com/us/downloads/beta/mcafeebetahome.htm

To submit beta feedback on any McAfee product, send
e-mail to:

       mcafee_beta@mcafee.com

McAfee is devoted to providing solutions based on
your input.


__________________________________________________________
CONTACT INFORMATION

Technical Support
    Home Page
       http://www.mcafeesecurity.com/us/support/

    KnowledgeBase Search
       https://knowledgemap.mcafeesecurity.com/phpclient/homepage.aspx

    PrimeSupport Service Portal
       https://mysupport.mcafeesecurity.com

    Login credentials required.


McAfee Beta Program
    Beta Web Site
       http://www.mcafeesecurity.com/us/downloads/beta/mcafeebetahome.htm


Security Headquarters:  AVERT
(Anti-Virus & Vulnerability Emergency Response
Team)
    Home Page
       http://www.mcafeesecurity.com/us/security/home.asp

    Virus Information Library
       http://vil.mcafeesecurity.com/

    AVERT WebImmune & Submit a Virus Sample
       https://www.webimmune.net/default.asp

    AVERT DAT Notification Service
       http://vil.mcafeesecurity.com/vil/join-DAT-list.asp


Download Site
    Home Page
       http://www.mcafeesecurity.com/us/downloads/

    DAT File and Engine Updates
       http://www.mcafeesecurity.com/us/downloads/updates/

       ftp://ftp.mcafeesecurity.com/pub/antivirus/datfiles/4.x

    Product Upgrades
       https://secure.nai.com/us/forms/downloads/upgrades/login.asp

    Valid grant number required.
    Contact Customer Service


Training
    On-Site Training
       http://www.mcafeesecurity.com/us/services/security/home.htm
    McAfee University
       http://www.mcafeesecurity.com/us/services/education/mcafee/university.htm


Customer Service
    US, Canada, and Latin America toll-free:
   Phone:     +1-888-VIRUS NO or +1-888-847-8766
              Monday-Friday, 8am-8pm, Central Time

   E-mail:    https://secure.mcafeesecurity.com/us/forms/support/request_form.asp

   Web:       http://www.mcafee.com/us/default.asp
              http://www.mcafeesecurity.com/us/support/default.asp

For additional contact information (including
addresses and toll-free numbers for worldwide
offices), see the CONTACT file that accompanied your
original product release.


_____________________________________________________
COPYRIGHT AND TRADEMARK ATTRIBUTIONS

Copyright (C) 2004 Networks Associates Technology,
Inc. All Rights Reserved. No part of this
publication may be reproduced, transmitted,
transcribed, stored in a retrieval system, or
translated into any language in any form or by any
means without the written permission of Networks
Associates Technology, Inc., or its suppliers or
affiliate companies. To obtain this permission,
write to the attention of the McAfee department at:
5000 Headquarters Drive, Plano, Texas 75024, or call
+1-972-963-8000.


TRADEMARKS

Active Firewall, Active Security, ActiveSecurity
(and in Katakana), ActiveShield, AntiVirus Anyware
and design, Clean-Up, Design (Stylized E), Design
(Stylized N), Entercept, Enterprise SecureCast,
Enterprise SecureCast (and in Katakana), ePolicy
Orchestrator,  First Aid, ForceField, GMT,
SpamKiller, SpamKiller (and in Katakana), Guard Dog,
HomeGuard, Hunter, IntruShield, Intrusion Prevention
Through Innovation, M and Design, McAfee, McAfee
(and in Katakana), McAfee and Design, McAfee.com,
McAfee VirusScan, NA Network Associates, Net Tools,
Net Tools (and in Katakana), NetCrypto, NetOctopus,
NetScan, NetShield, Network Associates, Network
Associates Colliseum, NetXray, NotesGuard, Nuts &
Bolts, Oil Change, PC Medic, PCNotary,
PrimeSupport, RingFence, Router PM, SecureCast,
SecureSelect, SpamKiller, Stalker, ThreatScan, TIS,
TMEG, Total Virus Defense, Trusted Mail,
Uninstaller, Virex, Virus Forum, Viruscan,
Virusscan, Virusscan (And In Katakana), Webscan,
Webshield, Webshield (And In Katakana), Webstalker,
WebWall, What’s The State Of Your IDS?, Who’s
Watching Your Network, Your E-Business Defender,
Your Network. Our Business. are registered
trademarks or trademarks of McAfee, Inc. and/or its
affiliates in the US and/or other countries. Red in
connection with security is distinctive of McAfee(R)
brand products.  All other registered and
unregistered trademarks herein are the sole property
of their respective owners.



_____________________________________________________
LICENSE & PATENT INFORMATION

LICENSE AGREEMENT

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE
LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU
PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND
CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF
YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE
ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED
LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT
ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE
RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A
BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE
AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED
THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF
THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL
THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE
PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A
FULL REFUND.


LICENSE ATTRIBUTIONS

This product includes or may include:
* Software developed by the OpenSSL Project for use
in the OpenSSL Toolkit (http://www.openssl.org/).
* Cryptographic software written by Eric A. Young
and software written by Tim J. Hudson. * Some
software programs that are licensed (or sublicensed)
to the user under the GNU General Public License
(GPL) or other similar Free Software licenses which,
among other rights, permit the user to copy, modify
and redistribute certain programs, or portions
thereof, and have access to the source code. The GPL
requires that for any software covered under the GPL
which is distributed to someone in an executable
binary format, that the source code also be made
available to those users. For any such software
covered under the GPL, the source code is made
available on this CD. If any Free Software licenses
require that Network Associates provide rights to
use, copy or modify a software program that are
broader than the rights granted in this agreement,
then such rights shall take precedence over the
rights and restrictions herein.  * Software
originally written by Henry Spencer, Copyright 1992,
1993, 1994, 1997 Henry Spencer.  * Software
originally written by Robert Nordier, Copyright
(C) 1996-7 Robert Nordier.  * Software written by
Douglas W. Sauder.  * Software developed by the
Apache Software Foundation (http://www.apache.org/).
A copy of the license agreement for this software
can be found at
www.apache.org/licenses/LICENSE-2.0.txt.
* International Components for Unicode ("ICU")
Copyright (C) 1995-2002 International Business
Machines Corporation and others.  * Software
developed by CrystalClear Software, Inc., Copyright
(C) 2000 CrystalClear Software, Inc. * FEAD(R)
Optimizer(R)  technology, Copyright Netopsystems AG,
Berlin, Germany. * Outside In(R)  Viewer Technology
(C) 1992-2001 Stellent Chicago, Inc. and/or Outside
In(R) HTML Export, (C) 2001 Stellent Chicago, Inc.
* Software copyrighted by Thai Open Source Software
Center Ltd. and Clark Cooper, (C) 1998, 1999, 2000.
* Software copyrighted by Expat maintainers.
* Software copyrighted by The Regents of the
University of California, (C) 1989.  * Software
copyrighted by Gunnar Ritter.  * Software
copyrighted by Sun Microsystems(R), Inc. (C) 2003.
* Software copyrighted by Gisle Aas. (C) 1995-2003.
* Software copyrighted by Michael A. Chase,
(C) 1999-2000.  * Software copyrighted by Neil
Winton, (C) 1995-1996.  * Software copyrighted by
RSA Data Security, Inc., (C) 1990-1992.  * Software
copyrighted by Sean M. Burke, (C) 1999, 2000.
* Software copyrighted by Martijn Koster, (C) 1995.
* Software copyrighted by Brad Appleton,
(C) 1996-1999.  * Software copyrighted by Michael G.
Schwern, (C) 2001.  * Software copyrighted by Graham
Barr, (C) 1998.  * Software copyrighted by Larry
Wall and Clark Cooper, (C) 1998-2000.  * Software
copyrighted by Frodo Looijaard, (C) 1997.
* Software copyrighted by the Python Software
Foundation, Copyright (C) 2001, 2002, 2003. A copy
of the license agreement for this software can be
found at www.python.org.  * Software copyrighted by
Beman Dawes, (C) 1994-1999, 2002.  * Software
written by Andrew Lumsdaine, Lie-Quan Lee, Jeremy G.
Siek (C) 1997-2000 University of Notre Dame.
* Software copyrighted by Simone Bordet & Marco
Cravero, (C) 2002.  * Software copyrighted by
Stephen Purcell, (C) 2001.  * Software developed by
the Indiana University Extreme! Lab
http://www.extreme.indiana.edu/).  * Software
copyrighted by International Business Machines
Corporation and others, (C) 1995-2003.  * Software
developed by the University of California, Berkeley
and its contributors.  * Software developed by Ralf
S. Engelschall <rse@engelschall.com> for use in the
mod_ssl project (http://www.modssl.org/).
* Software copyrighted by Kevlin Henney,
(C) 2000-2002.  * Software copyrighted by Peter
Dimov and Multi Media Ltd. (C) 2001, 2002.
* Software copyrighted by David Abrahams, (C) 2001,
2002. See http://www.boost.org/libs/bind/ bind.html
for documentation.  * Software copyrighted by Steve
Cleary, Beman Dawes, Howard Hinnant & John Maddock,
(C) 2000.  * Software copyrighted by Boost.org,
(C) 1999-2002.  * Software copyrighted by Nicolai M.
Josuttis, (C) 1999.  * Software copyrighted by
Jeremy Siek, (C) 1999-2001.  * Software copyrighted
by Daryle Walker, (C) 2001.  * Software copyrighted
by Chuck Allison and Jeremy Siek, (C) 2001, 2002.
* Software copyrighted by Samuel Krempp, (C) 2001.
See http://www.boost.org for updates, documentation,
and revision history.  * Software copyrighted by
Doug Gregor (gregod@cs.rpi.edu), (C) 2001, 2002.
* Software copyrighted by Cadenza New Zealand Ltd.,
(C) 2000.  * Software copyrighted by Jens Maurer,
(C) 2000, 2001.  * Software copyrighted by Jaakko
Järvi (jaakko.jarvi@cs.utu.fi), (C) 1999, 2000.
* Software copyrighted by Ronald Garcia, (C) 2002.
* Software copyrighted by David Abrahams, Jeremy
Siek, and Daryle Walker, (C) 1999-2001.  * Software
copyrighted by Stephen Cleary (shammah@voyager.net),
(C) 2000.  * Software copyrighted by Housemarque Oy
<http:// www.housemarque.com>, (C) 2001.  * Software
copyrighted by Paul Moore, (C) 1999.  * Software
copyrighted by Dr. John Maddock, (C) 1998-2002.
* Software copyrighted by Greg Colvin and Beman
Dawes, (C) 1998, 1999.  * Software copyrighted by
Peter Dimov, (C) 2001, 2002.  * Software copyrighted
by Jeremy Siek and John R. Bandela, (C) 2001.
* Software copyrighted by Joerg Walter and Mathias
Koch, (C) 2000-2002.


PATENTS
Protected by US Patents 6,006,035; 6,029,256;
6,035,423; 6,151,643; 6,230,288; 6,266,811;
6,269,456; 6,457,076; 6,496,875; 6,542,943;
6,594,686; 6,611,925; 6,622,150; 6,668,289


DBN 011-EN

V3.1.1
