The
custom DAT package file is a temporary detection file created by the Advanced Research Center. It contains the full production DATs and other detections and cleaning for a new threat that is too complex to be addressed in an
Extra.DAT. (For more information, see
KB55986 - FAQs for V2 DAT file.)
This article explains the different forms and ways to use the custom DAT package.
WARNING: A custom DAT package is released with limited testing. It is provided with the sole purpose of addressing a specific, complex threat while maintaining production DAT coverage. It is recommended that when you must deploy a custom DAT package to more than a few nodes, you test with a subset of these nodes first. Deploy the custom DAT package to this subset regardless of the method used for the deployment. Then, deploy the custom DAT package to all affected nodes only after you have verified that there is no problem with it.
Custom DATs can come in two different variants and are provided together:
- Basic DAT files (avvscan.dat, avvnames.dat, avvclean.dat) in a zip package
- ePO deployable package in the format awepo7146.zip.
Custom DAT version numbers and naming:
- The file name of a custom DAT package usually reflects the regular DAT version it contains, the name of the threat it contains, and new detection and cleaning drivers, for example, Xpaj_6885_ePO_SDAT.zip.
- The DAT version of a custom DAT package usually starts from 9999 for the first custom DAT that was built and counts down from there. For example, the regular DATs inside count up (6882, 6883, 6884) where the custom DAT version counts down (9999, 9998, 9997).
IMPORTANT: Because of the DAT version numbering of custom DAT packages, you must read and follow the Problem and Solution sections below to avoid unexpected update behavior.
