********************************************************************** ** ** ** What's New in the NAV Virus Definitions Files WHATSNEW.TXT ** ** ** ** Symantec Security Response November 24, 2001 ** ** ** ********************************************************************** This document contains the following topics: * Virus Alerts * New Technologies * Changes Incorporated Into This Update * Enabling Scanning Features * Additional Information ********************************************************************** ** Virus Alerts ** ********************************************************************** The ten most commonly reported viruses, worldwide: 1 W95.Hybris.worm 2 W95.MTX 3 Wscript.KakWorm 4 W32.HLLW.Bymer 5 W32.Magistr.24876@mm 6 W32.Badtrans.13312@mm 7 W32.Navidad.16896 8 Happy99.Worm 9 VBS.LoveLetter 10 W32.HLLW.Qaz ********************************************************************** ** New Technologies ** ********************************************************************** DATE Technologies Added ---- ------------------ 02/18/99 * Detection and repair of macro viruses in Word and Excel 2000 documents. 05/15/99 * Added repair for PowerPoint viruses. * Improved heuristics to detect more WORD 97 related viruses. 06/10/99 * Menu repair technology for WORD macro viruses that change command bar customizations in NORMAL.DOT. 07/12/99 * Added support for scanning of Ichitaro 8/9 documents. (Ichitaro is a Japanese word processing program). 08/19/99 * Added detection and repair for embedded documents inside PowerPoint 97. 11/22/99 * Added detection and repair for Trojans embedded in OLE files, such as Windows scrap files and MS Office documents. * Added detection for viruses which infect Microsoft Project documents (P98M.Corner.A, for example). 02/10/00 * Added support for scanning of UNIX executables. * Added detection for infected Visio documents. 12/18/00 * Added heuristics for for 32-bit Windows viruses. * Added a script scanner which increases our capabilities for detecting script based threats. 08/02/01 * Engine Update 08/02/01 * All products that use the NAVEX 1.5 architecture (in other words, most major Symantec products released over the last 3 - 4 years) will receive the new functionality. * This enhanced technology provides improved script scanning as well as more proactive detection of unknown script-based threats. ********************************************************************** ** Changes Incorporated Into This Virus Definitions Update ** ********************************************************************** DATE ---- New virus definitions (sorted by Virus Name): Virus Name Infection Type Date added ---------- -------------- ---------- AWVCK.kit.gen File infector 11/06/01 Altx.2663 File infector 11/06/01 Altx.2675 File infector 11/06/01 Altx.2748 File infector 11/06/01 Altx.2889 File infector 11/06/01 Altx.Trojan Boot infector 11/09/01 Archiver.1555 File infector 11/02/01 BGHT.gen File infector 11/08/01 Backdoor.Freddy File infector 11/16/01 Backdoor.Nerte File infector 11/09/01 Backdoor.Uncap File infector 11/24/01 Bat.Buffer File infector 11/06/01 Bat.Bvir.2600 File infector 11/09/01 Bat.Falken.B File infector 11/06/01 Bat.Funtime File infector 11/06/01 Bat.Godog.Trojan File infector 11/06/01 Bat.StartV File infector 11/06/01 Bat.Tomb.Trojan File infector 11/06/01 Beda.gen File infector 11/07/01 Bin.Auto.ARN File infector 11/07/01 Bloodhound.JS.1 File infector 11/14/01 Bloodhound.JS.2 File infector 11/14/01 Bloodhound.JS.3 File infector 11/14/01 Bloodhound.VBS.3 File infector 11/14/01 Bloodhound.VBS.4 File infector 11/14/01 Bloodhound.VBS.5 File infector 11/14/01 Bloodhound.W32.Simple File infector 11/09/01 Bloodhound.W32.VBWORM File infector 11/09/01 Bloodhound.W32.WSWORM File infector 11/09/01 BlueSky.1360 File infector 11/09/01 CW.219 File infector 11/08/01 CW.317 File infector 11/08/01 CYB.195 File infector 11/09/01 Champaigne.749 File infector 11/02/01 Crec.7000 File infector 11/11/01 Cri.Cri.5595.dr File infector 11/09/01 Dead.328 File infector 11/08/01 Girl.Worm File infector 11/16/01 Gob.381 File infector 11/08/01 HDBreak.Trojan Boot infector 11/02/01 HLLC.8001.E File infector 11/09/01 HLLO.Picked.4505 File infector 11/20/01 HackTool.AddrSteal File infector 11/20/01 IRC.Antas File infector 11/06/01 IRC.Jeepwarz File infector 11/05/01 IRC.Jerret File infector 11/05/01 IRC.Melanie File infector 11/06/01 IRC.Pron File infector 11/06/01 IRC.Toolame File infector 11/05/01 IRC.Unable File infector 11/05/01 IRC.Wonder File infector 11/05/01 Insert.282 File infector 11/11/01 JS.Xiro.Trojan File infector 11/08/01 JS.Yama@m File infector 11/15/01 June8.1898 File infector 11/08/01 Keyb.gen File infector 11/07/01 Koths.2962 File infector 11/09/01 Mpoc.804 File infector 11/02/01 O97M.Ethan.A File infector 11/24/01 PS-MPC.Abraxas.1200 File infector 11/02/01 Perl.Atvi@mm File infector 11/07/01 Relax.884 File infector 11/01/01 SH.Sizer File infector 11/13/01 SME.Demo File infector 11/01/01 SillyC.183.b File infector 11/06/01 Sillyc.gen File infector 11/08/01 Slowly.gen File infector 11/09/01 Soldier.747 File infector 11/08/01 Soldier.781.B File infector 11/08/01 TBG.951 File infector 11/09/01 TsuPNG.gen File infector 11/11/01 Txtdj.gen File infector 11/08/01 V.272 File infector 11/02/01 V.323 File infector 11/08/01 V.454 File infector 11/09/01 VBS.Bici (demo) File infector 11/05/01 VBS.Loveletter.BL(2) File infector 11/08/01 VBS.Magique.Int File infector 11/09/01 VBS.Paukor.B@mm File infector 11/08/01 VBS.Protest File infector 11/07/01 VBS.Snav File infector 11/20/01 VBS.Zeta.A@mm File infector 11/01/01 VCL.Jerk.294 File infector 11/09/01 Vofca.277 File infector 11/09/01 W32.Antites File infector 11/11/01 W32.Badtrans.B@mm File infector 11/24/01 W32.Bumran File infector 11/15/01 W32.Cblade.Worm File infector 11/24/01 W32.Ciosor File infector 11/07/01 W32.Datus File infector 11/24/01 W32.Delalot.Trojan File infector 11/15/01 W32.Dexes File infector 11/15/01 W32.Drea.Irc File infector 11/07/01 W32.Elem.Trojan File infector 11/24/01 W32.Finaldo.B.enc File infector 11/07/01 W32.Finaldo.B.enc(1) File infector 11/07/01 W32.Finaldo.B@mm File infector 11/07/01 W32.Finaldo.B@mm(html) File infector 11/13/01 W32.Finaldo.dll File infector 11/07/01 W32.Funsoul@mm File infector 11/11/01 W32.HLLW.Bloack File infector 11/07/01 W32.Klez.B@mm File infector 11/08/01 W32.Klez.gen@mm File infector 11/11/01 W32.Nimda.E@mm (dr) File infector 11/01/01 W32.Nimda.enc(dr) File infector 11/09/01 W32.Paukor.B@mm File infector 11/07/01 W32.Redal File infector 11/02/01 W32.SST@mm (dr) File infector 11/01/01 W32.Silwarr File infector 11/07/01 W32.Small.gen File infector 11/07/01 W32.Surse.Mirc File infector 11/07/01 W32.Usen File infector 11/24/01 W32.Viled@mm File infector 11/11/01 W32.Yerg File infector 11/06/01 W95.Epip@m File infector 11/07/01 W95.Opa.1103 File infector 11/08/01 W95.Rufoll File infector 11/20/01 W97M.Brando File infector 11/20/01 W97M.Chack.BS File infector 11/09/01 W97M.Coldape.B File infector 11/19/01 W97M.Death.C File infector 11/13/01 W97M.Hope.AE File infector 11/11/01 W97M.Jedi.O File infector 11/08/01 W97M.Kiek.A File infector 11/08/01 W97M.Lucia.A@mm File infector 11/08/01 W97M.Luck File infector 11/08/01 W97M.Marfan.C File infector 11/13/01 W97M.Mesmoth.A File infector 11/08/01 W97M.Mike File infector 11/09/01 W97M.Mxfile.K File infector 11/08/01 W97M.No_va.F File infector 11/13/01 W97M.Progsatz.Gen File infector 11/20/01 W97M.Progsatz.kit File infector 11/20/01 W97M.Twopey.B File infector 11/16/01 W97M.Zina.intd File infector 11/07/01 X97M.Codemas.D File infector 11/01/01 X97M.Laroux.EB File infector 11/19/01 X97M.RChan.A File infector 11/09/01 X97M.Slacker.E File infector 11/05/01 YRGMule.gen File infector 11/08/01 New virus definitions (sorted by Date added): Virus Name Infection Type Date added ---------- -------------- ---------- Backdoor.Uncap File infector 11/24/01 O97M.Ethan.A File infector 11/24/01 W32.Badtrans.B@mm File infector 11/24/01 W32.Cblade.Worm File infector 11/24/01 W32.Datus File infector 11/24/01 W32.Elem.Trojan File infector 11/24/01 W32.Usen File infector 11/24/01 W97M.Brando File infector 11/20/01 W97M.Progsatz.Gen File infector 11/20/01 W97M.Progsatz.kit File infector 11/20/01 HLLO.Picked.4505 File infector 11/20/01 VBS.Snav File infector 11/20/01 HackTool.AddrSteal File infector 11/20/01 W95.Rufoll File infector 11/20/01 W97M.Coldape.B File infector 11/19/01 X97M.Laroux.EB File infector 11/19/01 Backdoor.Freddy File infector 11/16/01 Girl.Worm File infector 11/16/01 W97M.Twopey.B File infector 11/16/01 JS.Yama@m File infector 11/15/01 W32.Bumran File infector 11/15/01 W32.Delalot.Trojan File infector 11/15/01 W32.Dexes File infector 11/15/01 Bloodhound.JS.1 File infector 11/14/01 Bloodhound.JS.2 File infector 11/14/01 Bloodhound.JS.3 File infector 11/14/01 Bloodhound.VBS.3 File infector 11/14/01 Bloodhound.VBS.4 File infector 11/14/01 Bloodhound.VBS.5 File infector 11/14/01 SH.Sizer File infector 11/13/01 W32.Finaldo.B@mm(html) File infector 11/13/01 W97M.Death.C File infector 11/13/01 W97M.Marfan.C File infector 11/13/01 W97M.No_va.F File infector 11/13/01 Crec.7000 File infector 11/11/01 Insert.282 File infector 11/11/01 TsuPNG.gen File infector 11/11/01 W32.Antites File infector 11/11/01 W32.Funsoul@mm File infector 11/11/01 W32.Klez.gen@mm File infector 11/11/01 W32.Viled@mm File infector 11/11/01 W97M.Hope.AE File infector 11/11/01 Altx.Trojan Boot infector 11/09/01 Backdoor.Nerte File infector 11/09/01 Bat.Bvir.2600 File infector 11/09/01 Bloodhound.W32.Simple File infector 11/09/01 Bloodhound.W32.VBWORM File infector 11/09/01 Bloodhound.W32.WSWORM File infector 11/09/01 BlueSky.1360 File infector 11/09/01 CYB.195 File infector 11/09/01 Cri.Cri.5595.dr File infector 11/09/01 HLLC.8001.E File infector 11/09/01 Koths.2962 File infector 11/09/01 Slowly.gen File infector 11/09/01 TBG.951 File infector 11/09/01 V.454 File infector 11/09/01 VBS.Magique.Int File infector 11/09/01 VCL.Jerk.294 File infector 11/09/01 Vofca.277 File infector 11/09/01 X97M.RChan.A File infector 11/09/01 W32.Nimda.enc(dr) File infector 11/09/01 W97M.Chack.BS File infector 11/09/01 W97M.Mike File infector 11/09/01 YRGMule.gen File infector 11/08/01 BGHT.gen File infector 11/08/01 Sillyc.gen File infector 11/08/01 Txtdj.gen File infector 11/08/01 CW.219 File infector 11/08/01 CW.317 File infector 11/08/01 Dead.328 File infector 11/08/01 Gob.381 File infector 11/08/01 V.323 File infector 11/08/01 Soldier.781.B File infector 11/08/01 Soldier.747 File infector 11/08/01 June8.1898 File infector 11/08/01 VBS.Paukor.B@mm File infector 11/08/01 W97M.Mxfile.K File infector 11/08/01 W32.Klez.B@mm File infector 11/08/01 VBS.Loveletter.BL(2) File infector 11/08/01 JS.Xiro.Trojan File infector 11/08/01 W97M.Jedi.O File infector 11/08/01 W97M.Kiek.A File infector 11/08/01 W97M.Mesmoth.A File infector 11/08/01 W97M.Lucia.A@mm File infector 11/08/01 W97M.Luck File infector 11/08/01 W95.Opa.1103 File infector 11/08/01 W95.Epip@m File infector 11/07/01 Beda.gen File infector 11/07/01 Keyb.gen File infector 11/07/01 W32.Paukor.B@mm File infector 11/07/01 VBS.Protest File infector 11/07/01 W32.Finaldo.B.enc File infector 11/07/01 W32.Finaldo.B.enc(1) File infector 11/07/01 W97M.Zina.intd File infector 11/07/01 Perl.Atvi@mm File infector 11/07/01 W32.Finaldo.B@mm File infector 11/07/01 W32.Finaldo.dll File infector 11/07/01 W32.Small.gen File infector 11/07/01 W32.HLLW.Bloack File infector 11/07/01 W32.Drea.Irc File infector 11/07/01 W32.Ciosor File infector 11/07/01 W32.Silwarr File infector 11/07/01 W32.Surse.Mirc File infector 11/07/01 Bin.Auto.ARN File infector 11/07/01 AWVCK.kit.gen File infector 11/06/01 Altx.2663 File infector 11/06/01 Altx.2675 File infector 11/06/01 Altx.2748 File infector 11/06/01 Altx.2889 File infector 11/06/01 Bat.Buffer File infector 11/06/01 Bat.Falken.B File infector 11/06/01 Bat.Funtime File infector 11/06/01 Bat.Godog.Trojan File infector 11/06/01 Bat.StartV File infector 11/06/01 Bat.Tomb.Trojan File infector 11/06/01 IRC.Antas File infector 11/06/01 IRC.Melanie File infector 11/06/01 IRC.Pron File infector 11/06/01 SillyC.183.b File infector 11/06/01 W32.Yerg File infector 11/06/01 VBS.Bici (demo) File infector 11/05/01 X97M.Slacker.E File infector 11/05/01 IRC.Jeepwarz File infector 11/05/01 IRC.Jerret File infector 11/05/01 IRC.Toolame File infector 11/05/01 IRC.Unable File infector 11/05/01 IRC.Wonder File infector 11/05/01 Champaigne.749 File infector 11/02/01 V.272 File infector 11/02/01 Mpoc.804 File infector 11/02/01 Archiver.1555 File infector 11/02/01 PS-MPC.Abraxas.1200 File infector 11/02/01 HDBreak.Trojan Boot infector 11/02/01 W32.Redal File infector 11/02/01 Relax.884 File infector 11/01/01 SME.Demo File infector 11/01/01 VBS.Zeta.A@mm File infector 11/01/01 W32.Nimda.E@mm (dr) File infector 11/01/01 W32.SST@mm (dr) File infector 11/01/01 X97M.Codemas.D File infector 11/01/01 Name Changes (sorted by Old Virus Name): Old Virus Name New Virus Name Date changed -------------- -------------- ------------ AntiPas.1108 to Flex.1108 10/18/01 Backdoor.IRC.SubSeven to Backdoor.IRC.Flood(2) 10/22/01 Bat.Putes to Bat.Stupe 10/01/01 Bloodhound.JS.Threat to Bloodhound.VBS.2 11/14/01 Bloodhound.VBS.Threat to Bloodhound.VBS.1 11/14/01 Girlgif.Trojan to Girl.Worm 11/20/01 IRC.Glitch.Trojan to Backdoor.IRC.Flood(3) 10/22/01 JS.Radirc.A to JS.Rootlet.A@m 11/01/01 JS.Rootlet.A@m to JS.Radirc.A 10/23/01 O97M.HalfCross.A to O97M.HalfCross.gen 10/04/01 O97M.SweetestThing to O97M.Weete.A 10/16/01 Trojan.BAT.Regbomb.A to BAT.Regbomb.A.Trojan 10/03/01 Trojan.Bat.AntiDN to Bat.AntiDN.Trojan 10/03/01 Trojan.Bat.Autorun to Bat.Autorun.Trojan 10/03/01 Trojan.Bat.BatKiller to Bat.BatKiller.Trojan 10/03/01 Trojan.Bat.DelFiles to Bat.DelFiles.Trojan 10/03/01 Trojan.Bat.DelFolder to Bat.DelFolder.Trojan 10/03/01 Trojan.Bat.Delauto to Bat.Delauto.Trojan 10/03/01 Trojan.Bat.Delini.192 to Bat.Delini.192.Trojan 10/03/01 Trojan.Bat.Delsys to Bat.Delsys.Trojan 10/03/01 Trojan.Bat.Deltree to Bat.Deltree.Trojan 10/03/01 Trojan.Bat.DirMaker to Bat.DirMaker.Trojan 10/03/01 Trojan.Bat.FakeAV.A to Bat.FakeAV.A.Trojan 10/03/01 Trojan.Bat.FakeAV.B to Bat.FakeAV.B.Trojan 10/03/01 Trojan.Bat.HDFill to Bat.HDFill.Trojan 10/03/01 Trojan.Bat.Hardhead to Bat.Hardhead.Trojan 10/03/01 Trojan.Bat.Loop to Bat.Loop.Trojan 10/03/01 Trojan.Bat.NTHack to Bat.NTHack.Trojan 10/03/01 Trojan.Bat.NTHack.vbs to Bat.NTHack.vbs.Trojan 10/03/01 Trojan.Bat.Phat to Bat.Phat.Trojan 10/03/01 Trojan.Bat.QuickFormat to Bat.QuickFormat.Trojan 10/03/01 Trojan.Bat.Rude to Bat.Rude.Trojan 10/04/01 Trojan.Bat.Season.A to Bat.Season.A.Trojan 10/03/01 Trojan.IRC.Gribble to IRC.Gribble.Trojan 10/22/01 Trojan.W97M.Flush.A to W97M.DSFT.Trojan 10/22/01 VBS.Doggie to VBS.Crypter 10/18/01 VBS.Lee.B@mm to VBS.VBSWG.B 10/18/01 VBS.Lee@mm to VBS.VBSWG.D@mm 10/15/01 VBS.Magique.Int to VBS.Loveletter.Int 11/12/01 VBS.Natiday.A@mm to VBS.Loveletter.CU@mm 11/11/01 VBS.Protest to VBS.Crim.A 11/12/01 VBS.Retnal.A@mm to VBS.Loveletter.CW@mm 10/23/01 VBS.Saur.A to IRC.Bulbas 11/06/01 VBS.VWC.A@mm to VBS.VBSWG.AE@mm 10/16/01 VBS.Vbswg.gen to VBS.VBSWG.gen 10/16/01 VBS.Vbswg.gen(2) to VBS.VBSWG.gen(2) 10/16/01 VBS.Vbswg.gen(3) to VBS.VBSWG.gen(3) 10/16/01 VBS.Vbswg.gen(4) to VBS.VBSWG.gen(4) 10/16/01 W32.Badtrans.13312@mm to W32.Badtrans.gen@mm 10/22/01 W32.Dela.Worm to W32.Delarm.Worm 11/06/01 W32.HLLW.Giwin to W32.HLLW.Giwin.gen 10/04/01 W32.HLLW.Giwin.gen to W32.Giwin.gen 10/10/01 W32.Jasmine to W32.Seppuku.28160 10/11/01 W32.Klez.B@mm to W32.Klez.D@mm 11/09/01 W32.Viled@mm to W32.Viled.gen 11/13/01 W32.Vote.C.int to W32.Kiray.A@mm 10/23/01 W95.Dedobe to W95.Dedo 10/23/01 W97M.Contamin.A to W97M.Ramza.B 10/04/01 W97M.Ethan.EL (2) to W97M.Ethan.EL 11/01/01 W97M.Gub to O97M.Gub 10/03/01 W97M.Luar.A to W97M.Trado.A 10/24/01 W97M.Peat to W97M.Titch.J 10/16/01 W97M.Philippines.A to W97M.Liberate.A 10/03/01 W97M.Rusmod.A:Ru to W97M.NotHere.A:Ru 10/22/01 W97M.Tester.A to W97M.Strings.I 10/16/01 W97M.Thus.ES to W97M.Thus.FC 10/01/01 W97M.Trado.A to W97M.Luar.A 11/01/01 W97M.Wrath to W97M.Trolox.A 10/16/01 X97M.Automat.AH to X97M.Divi.I 10/03/01 X97M.Automat.AK to X97M.Divi.K 10/03/01 X97M.Codemas.D to X97M.Slacker.D 11/02/01 X97M.DIVI.K to X97M.DIVI.Family 10/03/01 X97M.Killer to X97M.Oblivion.A 10/04/01 X97M.Manalo.D to X97M.Manalo.E 10/04/01 X97M.Sugar.Dropper to X97M.Sugar.E 10/11/01 X97M.Xif.B to X97M.Xif.A 10/16/01 XM.Automat.AG to XM.Manalo.J 10/04/01 XM.Automat.S to XM.Clonar.A 10/03/01 XM.Diablos to XM.Diablo.gen 10/03/01 XM.Manalo.E to XM.Manalo.H 10/04/01 XM.Tabej.B to XM.Tabej.C 10/03/01 XM.Tabej.C to XM.Tabej.B 10/03/01 XM.Yawn to XM.Yawn.Family 10/03/01 Name Changes (sorted by Date changed): Old Virus Name New Virus Name Date changed -------------- -------------- ------------ Girlgif.Trojan to Girl.Worm 11/20/01 Bloodhound.JS.Threat to Bloodhound.VBS.2 11/14/01 Bloodhound.VBS.Threat to Bloodhound.VBS.1 11/14/01 W32.Viled@mm to W32.Viled.gen 11/13/01 VBS.Magique.Int to VBS.Loveletter.Int 11/12/01 VBS.Protest to VBS.Crim.A 11/12/01 VBS.Natiday.A@mm to VBS.Loveletter.CU@mm 11/11/01 W32.Klez.B@mm to W32.Klez.D@mm 11/09/01 VBS.Saur.A to IRC.Bulbas 11/06/01 W32.Dela.Worm to W32.Delarm.Worm 11/06/01 X97M.Codemas.D to X97M.Slacker.D 11/02/01 JS.Radirc.A to JS.Rootlet.A@m 11/01/01 W97M.Ethan.EL (2) to W97M.Ethan.EL 11/01/01 W97M.Trado.A to W97M.Luar.A 11/01/01 W97M.Luar.A to W97M.Trado.A 10/24/01 JS.Rootlet.A@m to JS.Radirc.A 10/23/01 VBS.Retnal.A@mm to VBS.Loveletter.CW@mm 10/23/01 W32.Vote.C.int to W32.Kiray.A@mm 10/23/01 W95.Dedobe to W95.Dedo 10/23/01 Backdoor.IRC.SubSeven to Backdoor.IRC.Flood(2) 10/22/01 IRC.Glitch.Trojan to Backdoor.IRC.Flood(3) 10/22/01 Trojan.IRC.Gribble to IRC.Gribble.Trojan 10/22/01 Trojan.W97M.Flush.A to W97M.DSFT.Trojan 10/22/01 W32.Badtrans.13312@mm to W32.Badtrans.gen@mm 10/22/01 W97M.Rusmod.A:Ru to W97M.NotHere.A:Ru 10/22/01 AntiPas.1108 to Flex.1108 10/18/01 VBS.Doggie to VBS.Crypter 10/18/01 VBS.Lee.B@mm to VBS.VBSWG.B 10/18/01 O97M.SweetestThing to O97M.Weete.A 10/16/01 VBS.VWC.A@mm to VBS.VBSWG.AE@mm 10/16/01 VBS.Vbswg.gen to VBS.VBSWG.gen 10/16/01 VBS.Vbswg.gen(2) to VBS.VBSWG.gen(2) 10/16/01 VBS.Vbswg.gen(3) to VBS.VBSWG.gen(3) 10/16/01 VBS.Vbswg.gen(4) to VBS.VBSWG.gen(4) 10/16/01 W97M.Peat to W97M.Titch.J 10/16/01 W97M.Tester.A to W97M.Strings.I 10/16/01 W97M.Wrath to W97M.Trolox.A 10/16/01 X97M.Xif.B to X97M.Xif.A 10/16/01 VBS.Lee@mm to VBS.VBSWG.D@mm 10/15/01 X97M.Sugar.Dropper to X97M.Sugar.E 10/11/01 W32.Jasmine to W32.Seppuku.28160 10/11/01 W32.HLLW.Giwin.gen to W32.Giwin.gen 10/10/01 O97M.HalfCross.A to O97M.HalfCross.gen 10/04/01 Trojan.Bat.Rude to Bat.Rude.Trojan 10/04/01 W32.HLLW.Giwin to W32.HLLW.Giwin.gen 10/04/01 W97M.Contamin.A to W97M.Ramza.B 10/04/01 X97M.Killer to X97M.Oblivion.A 10/04/01 X97M.Manalo.D to X97M.Manalo.E 10/04/01 XM.Automat.AG to XM.Manalo.J 10/04/01 XM.Manalo.E to XM.Manalo.H 10/04/01 Trojan.BAT.Regbomb.A to BAT.Regbomb.A.Trojan 10/03/01 Trojan.Bat.AntiDN to Bat.AntiDN.Trojan 10/03/01 Trojan.Bat.Autorun to Bat.Autorun.Trojan 10/03/01 Trojan.Bat.BatKiller to Bat.BatKiller.Trojan 10/03/01 Trojan.Bat.DelFiles to Bat.DelFiles.Trojan 10/03/01 Trojan.Bat.DelFolder to Bat.DelFolder.Trojan 10/03/01 Trojan.Bat.Delauto to Bat.Delauto.Trojan 10/03/01 Trojan.Bat.Delini.192 to Bat.Delini.192.Trojan 10/03/01 Trojan.Bat.Delsys to Bat.Delsys.Trojan 10/03/01 Trojan.Bat.Deltree to Bat.Deltree.Trojan 10/03/01 Trojan.Bat.DirMaker to Bat.DirMaker.Trojan 10/03/01 Trojan.Bat.FakeAV.A to Bat.FakeAV.A.Trojan 10/03/01 Trojan.Bat.FakeAV.B to Bat.FakeAV.B.Trojan 10/03/01 Trojan.Bat.HDFill to Bat.HDFill.Trojan 10/03/01 Trojan.Bat.Hardhead to Bat.Hardhead.Trojan 10/03/01 Trojan.Bat.Loop to Bat.Loop.Trojan 10/03/01 Trojan.Bat.NTHack to Bat.NTHack.Trojan 10/03/01 Trojan.Bat.NTHack.vbs to Bat.NTHack.vbs.Trojan 10/03/01 Trojan.Bat.Phat to Bat.Phat.Trojan 10/03/01 Trojan.Bat.QuickFormat to Bat.QuickFormat.Trojan 10/03/01 Trojan.Bat.Season.A to Bat.Season.A.Trojan 10/03/01 W97M.Gub to O97M.Gub 10/03/01 W97M.Philippines.A to W97M.Liberate.A 10/03/01 X97M.Automat.AH to X97M.Divi.I 10/03/01 X97M.Automat.AK to X97M.Divi.K 10/03/01 X97M.DIVI.K to X97M.DIVI.Family 10/03/01 XM.Automat.S to XM.Clonar.A 10/03/01 XM.Diablos to XM.Diablo.gen 10/03/01 XM.Tabej.B to XM.Tabej.C 10/03/01 XM.Tabej.C to XM.Tabej.B 10/03/01 XM.Yawn to XM.Yawn.Family 10/03/01 Bat.Putes to Bat.Stupe 10/01/01 W97M.Thus.ES to W97M.Thus.FC 10/01/01 Deletions (sorted by Virus Name): Virus Name Infection Type Date removed ---------- -------------- ------------ A97M.Amg.A File infector 06/15/01 AirCop Dropper Boot infector 11/13/01 Backdoor.Systsec File infector 10/12/01 Backdoor.Teste File infector 08/24/01 CLS.Win.Joke.34520(1) File infector 07/17/01 CLS.Win.Joke.34520(2) File infector 07/17/01 Denzuk Dropper Boot infector 11/13/01 Eumel.363.A File infector 08/20/01 HLLO.Picked.4505 File infector 11/20/01 ICQ.Junta.Trojan File infector 11/20/01 Invalid Certificate File infector 05/14/01 MtE.Groove (5) File infector 06/05/01 Neno.Trojan File infector 10/08/01 PS-MPC (1) File infector 10/22/01 PS-MPC (6) File infector 10/23/01 PWS.Cain.dr File infector 09/17/01 Sailor.1108 File infector 08/22/01 Trojan.Billrus.Texto File infector 07/13/01 Trojan.VBS.Autoexec File infector 08/29/01 Unlucky.2008 (2) File infector 06/11/01 Unlucky.2008 (3) File infector 06/11/01 VBS.Zeta.A@mm File infector 10/16/01 W32.Antiqfx.B.worm File infector 08/01/01 W32.Antiqfx.C.worm File infector 08/01/01 W32.Bedtime.2304 File infector 07/02/01 W32.Vote.B@mm File infector 09/27/01 W95.Mul.2012 File infector 05/31/01 W95.Smoker.Worm@mm File infector 07/12/01 W97M.Bottra.D File infector 10/15/01 W97M.Galero.A File infector 11/20/01 W97M.Marker.NW File infector 11/20/01 WM.Kam File infector 08/20/01 X97M.Activated.A File infector 10/03/01 X97M.DIVI.J File infector 10/03/01 X97M.Divi.G File infector 10/03/01 X97M.Divi.M File infector 10/03/01 Yosha.761 File infector 08/22/01 Deletions (sorted by Date removed): Virus Name Infection Type Date removed ---------- -------------- ------------ HLLO.Picked.4505 File infector 11/20/01 ICQ.Junta.Trojan File infector 11/20/01 W97M.Galero.A File infector 11/20/01 W97M.Marker.NW File infector 11/20/01 AirCop Dropper Boot infector 11/13/01 Denzuk Dropper Boot infector 11/13/01 PS-MPC (6) File infector 10/23/01 PS-MPC (1) File infector 10/22/01 VBS.Zeta.A@mm File infector 10/16/01 W97M.Bottra.D File infector 10/15/01 Backdoor.Systsec File infector 10/12/01 Neno.Trojan File infector 10/08/01 X97M.Activated.A File infector 10/03/01 X97M.DIVI.J File infector 10/03/01 X97M.Divi.G File infector 10/03/01 X97M.Divi.M File infector 10/03/01 W32.Vote.B@mm File infector 09/27/01 PWS.Cain.dr File infector 09/17/01 Trojan.VBS.Autoexec File infector 08/29/01 Backdoor.Teste File infector 08/24/01 Sailor.1108 File infector 08/22/01 Yosha.761 File infector 08/22/01 Eumel.363.A File infector 08/20/01 WM.Kam File infector 08/20/01 W32.Antiqfx.B.worm File infector 08/01/01 W32.Antiqfx.C.worm File infector 08/01/01 CLS.Win.Joke.34520(1) File infector 07/17/01 CLS.Win.Joke.34520(2) File infector 07/17/01 Trojan.Billrus.Texto File infector 07/13/01 W95.Smoker.Worm@mm File infector 07/12/01 W32.Bedtime.2304 File infector 07/02/01 A97M.Amg.A File infector 06/15/01 Unlucky.2008 (2) File infector 06/11/01 Unlucky.2008 (3) File infector 06/11/01 MtE.Groove (5) File infector 06/05/01 W95.Mul.2012 File infector 05/31/01 Invalid Certificate File infector 05/14/01 ********************************************************************** ** Enabling Scanning Features ** ********************************************************************** Several scanning features can be enabled through the use of an INF configuration file. For NAV for Windows 95/NT version 4.x and later, or NAV for OS/2, this configuration file should be called NAVEX15.INF and should be placed in the directory where NAV is installed (i.e., C:\Program Files\Norton AntiVirus). For NAV for Netware version 4.x, the file should be called NAVEX15.INF and should be placed in the directory where NAV 4.x is installed (i.e., sys:system\navnlm). For NAV for Windows 95/NT version 2.0, NAV 4.x for Windows 3.1/DOS, NAVIEG 1.x, or NAVFW 1.x, the file should be named NAVEX.INF and should be placed in the directory where NAV is installed (i.e., C:\NAV). If this configuration file does not exist, create one in the appropriate directory if you want to change the default settings. To enable a scanning feature for a particular component, one or more entries need to be added to the configuration file under the correct section. For each platform there is a corresponding section that is used in the INF file. Below is a table of section names and platforms. Section Name Platform ------------ -------- NAVW32 Windows 95/98/NT NAVAP Windows 95/98/NT Auto-Protect NAVDX DOS NAVNLM Netware NAVWIN Windows 3.1 NAVOS2 OS/2 NAVAIX AIX NAVSOL Solaris Entries are case insensitive. Below is a description of possible entries. 1. Files can be excluded from scans by the NAVEX engine. To exclude a specific file from the NAVEX engine scan, add an entry with the full path and file name. This is case insensitive. No wildcards are allowed. To exclude multiple files, add a separate entry for each file. To exclude a file, add an entry like the one below where is the full path and file name. ExcludeFile = 2. Files within a directory can be excluded from scans by the NAVEX engine. To exclude all files within a directory, add an entry with the full directory path. This is case insensitive. No wildcards are allowed. This does not exclude files located in subdirectories of the specified directory. To exclude multiple directories, add a separate entry for each directory. To exclude a directory, add an entry like the one below where is the full path. ExcludeDirectory = The following example of an INF configuration file excludes two files, NOSCAN.EXE and BIGFILE.DOC, from NAVEX scans for the Windows 95/98/NT scanner. It excludes the D:\PRIVATE directory from Windows 95/98/NT Auto-Protect. [NAVW32] ExcludeFile = C:\PROGRAM FILES\NOSCAN.EXE ExcludeFile = C:\TEMP\BIGFILE.DOC [NAVAP] ExcludeDirectory = D:\PRIVATE ********************************************************************** ** Additional Information ** ********************************************************************** Additional information regarding this virus definitions update can be found in UPDATE.TXT and TECHNOTE.TXT.