SYMANTEC CORPORATION - PETER NORTON GROUP README.TXT file for Norton Virus Scan Welcome to Norton Virus Scan! This file contains information about Norton Virus Scan, a scan-only version of Norton AntiVirus. Full versions of Norton AntiVirus are available for DOS/Windows 3.1, Windows 95, and Novell NetWare. Please read the WIN95NAV.TXT file if you have downloaded Norton Virus Scan to check for viruses before you install Windows 95. To print this file from the DOS prompt, type: COPY README.TXT PRN: This document has four sections: 1. Technical Support Information: where to go for help on using Norton Virus Scan. 2. Ordering Information: tells you how to order the complete version of Norton AntiVirus. 3. Technical Information: includes information about the complete version of Norton AntiVirus. 4. General Virus Information: describes the most common DOS viruses. TECHNICAL SUPPORT INFORMATION Recorded technical support information for the Norton Virus Scan is available from our 24-hour Virus Newsline at 1-503-465-8555. ORDERING INFORMATION To purchase the complete version of Norton AntiVirus for Windows and DOS, see your local dealer or call one of the following numbers: United States: 1-800-441-7234 Europe(Holland): 31-71-353-111 United Kingdom: 01628-592-222 Germany: 02-11-99170 France: 01-41-38-69-69 Australia: 02-879-6577 Canada: 1-416-366-0423 Italy: 2-550-12266 Other countries: 1-503-334-6054 TECHNICAL INFORMATION To launch Norton Virus Scan, type NAVSCAN at the DOS prompt. This freeware version of Norton AntiVirus does not offer all of the features available in the complete version of Norton AntiVirus. It is designed to scan executable files for viruses (viruses cannot infect data files), remove boot infector viruses (viruses that infect boot MBR or boot records) and give you an overview of the full Norton AntiVirus program. This version will NOT repair infected files and does NOT provide an automatic monitoring program. The complete version of Norton AntiVirus is a comprehensive solution for preventing viruses from infecting your computer. It detects and removes over 5,300 known viruses and virus strains. In addition, it protects against unknown viruses by monitoring your system for irregular file activity. Should Norton AntiVirus detect an infection, it can repair most infected files quickly and easily before the virus damages your system. Norton AntiVirus is available for DOS/Windows 3.1 and Windows 95. In addition, Norton AntiVirus features the following: Auto-Protect - A memory-resident device driver or TSR (VxD on Windows 95) that protects your system against infection while you are working in other applications. It detects both known and unknown viruses. With its patent-pending Virus Sensor Technology, it will catch unknown viruses BEFORE they infect your system. It can repair, delete, or even halt your computer when a virus is found. With its unique ability to scan files when they are created, you are assured that a virus won't end up on your computer after uncompressing an archived ZIP file, for example. It can protect your system areas from alteration and will also check floppy disks when first accessed and when you reboot your computer. The DOS Auto-Protect TSR can be loaded in EMS, HMA, UMBs, High Memory, or conventional memory. In fact, it can load different parts of itself in different types of memory. It is a dynamic-memory protection system. That means that the memory usage will grow and shrink depending upon which features you enable or disable. Auto-Protect requires as little as 5K RAM. The Windows 95 Auto-Protect VxD takes no DOS memory. Scanner - The full screen application that scans your computer's memory and drives for the presence of known and unknown viruses. It is here that you can also configure all aspects of Norton AntiVirus, view the Virus List, or view the Activity Log or Infection Log (these features are described later in this file). The Scanner can check ZIP 1.x or 2.x compressed files for viruses, without the need to first uncompress them. It is the fastest virus scanner on the market today. Flexible scanning features - Norton AntiVirus can be configured to quickly check your entire computer system for virus infection. Scanning can be set to occur every time you start your computer, or only on demand. Also included is a Windows Scheduler, so you can specify the exact time to perform a scan. You can execute a scan of your entire system in the background, while working within your word processor or other application. Virus updates - Norton AntiVirus lets you upgrade your virus protection without having to wait for software updates. Symantec's 24-hour Virus Newsline offers access to the latest- breaking news about new viruses and instructions on how to protect your system from them. Virus updates can be downloaded from the Symantec BBS or CompuServe, or obtained on disk from the Norton AntiVirus subscription update service. Configurable options - Gives you complete control over the way Norton AntiVirus operates. Norton AntiVirus is the most configurable anti-virus product on the market. For example, when a virus is found, you can specify exactly what to do with it (delete it, repair it, prompt the user, halt the computer, or just notify the user). Another example is the ability to specify how to alert the user or others when a virus is found (generate audible alerts, display a custom message, alert network users, alert the network console, or alert Norton AntiVirus for NetWare NLM). Unique Exclusions List - You can exclude a drive, directory, or list of files from being checked for different operations. For example, suppose you want your FORMAT program to be able to write to the boot record of a floppy disk. You can easily exclude it from being checked. There are 8 different operations from which you can exclude particular files or directories of your choice. Norton AntiVirus is the only anti-virus product that provides this type of flexibility. Inoculation - For industrial-strength protection, you can inoculate your system against future unknown viruses. Norton AntiVirus can inoculate not only your files, but also your system areas, such as the boot records and master boot records. Password Protection - Almost every feature of Norton AntiVirus can be password protected. For example, you may not want anyone removing virus definitions from the Virus List. You can protect only that feature of Norton AntiVirus, or you can password-protect all options. In this way you can ensure that only you are able to make configuration changes. Virus List - Norton AntiVirus has full details on over 5,300 viruses and virus strains. You can look up the symptoms of a particular virus or what effect it will have once it is triggered. Network Features - Norton AntiVirus has many features for the corporate environment. It has the most configuration options of all anti-virus products. This means you can configure it to work the way your organization works. In addition, if a virus is found it can notify other users, notify Norton AntiVirus for NetWare NLM, or notify network consoles. Norton AntiVirus can be configured to password-protect specific features, so only selected users can access certain features. With the multipack version, you get NavUpdate, which provides centralized configuration, installation, and updating of Norton AntiVirus and virus definitions. You will no longer have to go from workstation to workstation installing or updating Norton AntiVirus. Also, Norton AntiVirus works on all major network environments, including Novell NetWare, 3Com OPEN, OS/2 LAN Manager, AT&T Starlan and more. Activity Log and Infection Log - All activity is tracked in an Activity Log and Infection Log. You can specify which events should be logged and can also restrict the size of the log file. When you view the log file, you can filter it, so you can zoom in on exactly what you are looking for. Integrated DOS and Windows application - Norton AntiVirus is both a complete Windows application and an easy-to-use DOS program, offering comprehensive virus defense for both DOS and Windows users. System Requirements (DOS/Windows 3.1): IBM PC AT, PS/2 or compatible DOS 3.1 or higher 512K RAM RAM-resident option requires as little as 5K RAM Compatible with Microsoft Windows 3.1 or later Works with any floppy disk, hard disk, or removable media Mouse support Network compatible with Novell NetWare, 3Com OPEN, OS/2 LAN Manager and more System Requirements (Windows 95): IBM or 100% compatible Windows 95 Intel 80386DX or higher 4MB of RAM required (8MB recommended) 6MB hard disk required Works with any floppy disk, hard disk, or removable media Network compatible with Novell NetWare, 3Com OPEN, OS/2 LAN Manager and more GENERAL VIRUS INFORMATION The most common DOS viruses are as follows: Stoned: This is the most common virus. It infects the hard disk partition table and floppy disk boot records. The virus often displays the message "Your PC is now stoned." Michelangelo: The Michelangelo virus activates itself on March 6th, the anniversary of Michelangelo's birth. The Michelangelo virus is spread only by floppy disks, not over networks or by connecting to electronic on-line services and bulletin boards. The virus is transferred to memory and hard disks when an attempt is made to start (boot) your computer from a floppy disk that is infected. The floppy disk does not have to be a bootable floppy disk; it can be a floppy disk with data files on it. Once the virus is on your hard disk, it will infect every floppy disk that you put in your computer, thereby creating further infections that help it continue to spread. If a computer is infected with Michelangelo when it is started on March 6th, the virus will format the hard disk, irretrievably destroying all data. NoINT (Bloomington, Stoned III): This virus is very similar to Stoned and Michelangelo. It infects the hard disk partition table and floppy disk boot records. It often causes corruption of root directory entries, making it difficult to properly retrieve your data. Form: The Form virus is a very common infector of boot records. It sometimes displays the message "The FORM-Virus sends greetings to everyone who's reading this text." It may also cause the system speaker to emit a "clicking" noise. Joshi: Activates on January 5th. The Joshi virus is a stealth infector of floppy disk boot records and hard disk partition tables. On January 5th, it activates and displays a message asking the user to type "Happy Birthday Joshi." Jeru.1808 (Jerusalem, Friday the 13th Virus): This is the most common file-infecting virus. Some strains will delete any files executed on a Friday the 13th. The Jerusalem virus can cause an enormous amount of file growth due to multiple infections. Green Caterpillar (1575, 1591): The Green Caterpillar virus is another very common file infector. It causes infected files to grow by approximately 1575 to 1591 bytes. The virus may cause a "caterpillar" to travel across the user's screen (similar to the arcade game of the same name). Ping-Pong (Italian-A): Ping-Pong is a boot record infector that activates on a random basis, sending a white ball bouncing around the screen. Yankee.44.A (Yankee Doodle, TP44): This virus is a memory-resident file infector that may play "Yankee Doodle" from the system speaker at 5:00 P.M. and also increases an infected program's size. Azusa (Hong Kong): This virus infects hard disk partition tables and floppy disk boot records. It occasionally disables the LPT1 and COM1 ports. It can also cause floppy drives to fail to notice when a diskette is removed and a new one inserted. DA.1800 (Dark Avenger): The Dark Avenger virus infects .COM, .EXE and .SYS files. After every sixteenth file is infected, the virus overwrites a random sector of the hard disk, destroying any programs or data files that happen to be using that sector. For additional virus information, phone the Symantec Virus Newsline at 1-503-465-8555 (available in the USA only). ** END OF README.TXT **