**********************************************************************
**                                                                  **
**  Special Information about Unique Computer Viruses  VIRSPEC.TXT  **
**                                                                  **
**  Symantec AntiVirus Research Center (SARC)    September 1, 1996  **
**                                                                  **
**********************************************************************


 * General Information
 * Adding Program File extensions to Detect/Repair Excel Viruses
 * Microsoft Word Macro Viruses
 * Disappearing Hard Drives


**********************************************************************
**  General Information                                             **
**********************************************************************
Please read the SEP96.TXT file included with this update. It contains
a detailed list of the new virus definitions and a summary of current
virus activity around the world.


**********************************************************************
** Adding Program File Extensions to Detect/Repair Excel Viruses   **
**********************************************************************
In order for NAV (all versions and platforms) to detect and repair the 
XM.Laroux virus, you must add ".XL?" to the program files extension 
list. Without this addition, NAV will ignore all Excel spreadsheets and 
not report infections.
     
Detailed instructions on making the additions are available in the NAV 
User's Guides.
     
Norton AntiVirus 3.0
     Chapter 8, Customizing Virus Checking, "Adding Program File 
     Extensions"
     
Norton AntiVirus 95
     Chapter 10, Customizing scanning, "Specifying program file 
     Extensions"
     
Norton AntiVirus Scanner for Windows NT
     Chapter 6, Customizing Norton AntiVirus, "Specifying program file 
     Extensions"
     
Norton AntiVirus for NetWare 2.0
     Chapter 6, Defining Program Files and Extension, "Protecting Program 
     Files"

**********************************************************************
**  Microsoft Word Macro Viruses                                    **
**********************************************************************
Macro viruses use the WordBasic macro language to infect and, in some
cases, implant binary viruses into host programs.  Currently, there
are several known macro viruses: Concept is the most widespread.

Macro viruses reside within Microsoft Word document and template
files.  Notably, macro viruses are platform-independent. They can
infect documents and templates on the DOS, Windows, Window 95,
Windows NT, and Mac operating systems.

All current versions of Norton AntiVirus detect and eliminate the
macro viruses. 

If your installed version of Norton AntiVirus 3.0 (NAV.EXE or
NAVW.EXE) is dated earlier than February 23, 1996, or your installed
version of Norton AntiVirus for Windows 95 (NAVW32.EXE) is dated
earlier than December 1, 1995, you need to upgrade. The Norton
AntiVirus upgrade installs the NAV Macro Engine automatically, which
detects and eliminates macro viruses.

To upgrade your Norton AntiVirus 3.0 program:

  * Download the file called UPDATEME.EXE
  * Place the file in an empty directory and execute the file
    to extract.

To upgrade your Norton AntiVirus for Windows 95 program:

  * Download the file called NAV95PCH.EXE
  * Place the file in an empty folder and execute the file
    to extract.

Step-by-step instructions are included with each file.  If you
need additional instructions, a FaxBack service is available
at (541) 984-2490 to assist you.

UPDATEME.EXE and NAV95PCH.EXE are located where the monthly virus
definitions files update are normally found. It is available for
download from the Symantec BBS, the Symantec FTP or Web sites,
CompuServe, America Online, or Microsoft Network. You can also call
Customer Service at (800) 441-7234 to order a disk set.

**********************************************************************
**  Disappearing Hard Drives                                        **
**********************************************************************
Several viruses, such as Frankenstein and Stoned.Empire.Monkey, cause
your hard disk to "disappear" when booting from a clean floppy disk.
This occurs because the virus either encrypts or relocates the hard
disk partition table (a vital part of the disk's system area). 

All "appears" well when you boot from your hard disk because the
virus actives in memory and tells DOS where the partition table is
relocated, or acts as the partition table itself. If you boot clean,
DOS can't find the partition table and the virus isn't around to give
directions. You may receive an "Invalid drive specification" or
similar error when trying to access the hard disk.

When you boot clean so NAV can repair such an infection, the hard
disk will not appear in the drive list. Don't worry! NAV, with the
default options enabled, will bypass DOS and look directly at the
hard disk to check the system area for infection, no matter what you
scan. For example, scanning a floppy disk will scan memory, the
floppy disk, and the system area of the hard disk. If such an
infection is discovered, you are alerted appropriately.

NOTE: IDE hard drives larger than 1024 cylinders often require the
use of additional driver or overlay files. If you have such a drive,
you may need to include these additional files on your Norton
AntiVirus Rescue Disk to ensure recovery from virus emergencies. Make
sure that any special driver or overlay files for your hard drive,
which are part of your normal system configuration, are included on
your rescue disk.