SYMANTEC CORPORATION - PETER NORTON GROUP
READ.ME file for The Norton Virus Scan
August 15, 1992

Welcome to The Norton Virus Scan!

This file contains information about The Norton Virus Scan, a scan-only
version of The Norton AntiVirus.

To print this file from the DOS prompt, type:

COPY READ.ME PRN:


This document has four sections:

1. Technical Support Information: where to go for help on using The Norton
Virus Scan.
2. Ordering Information: tells you how to order the complete version of The
Norton AntiVirus.
3. Technical Information: includes information about the complete version of
The Norton AntiVirus.
4. General Virus Information: describes the ten most common DOS viruses.


TECHNICAL SUPPORT INFORMATION

Recorded technical support information for the The Norton Virus Scan is
available from our 24-hour Virus Newsline at 1-310-828-2906, or you can speak
with an experienced virus technician by dialing 1-900-INFO-NAV (at a fee of
$1.00 per minute). Free technical support is not available for The Norton
Virus Scan, but is available for registered owners of the complete version
of The Norton AntiVirus.


ORDERING INFORMATION

To purchase the complete version of The Norton AntiVirus for DOS and Windows,
see your local dealer or call one of the following numbers:

United States: 1-800-343-4714 Ext. 766
Europe: 31-71-353-100
United Kingdom: 0628-776-343
Germany: 02-11-99170
France: 01-47-72-16-50
Australia: 02-879-6577
Canada: 1-416-366-0423
Other countries: 1-408-252-3570

To obtain additional copies of The Norton Virus Scan, download them from the
Symantec BBS or CompuServe:

Symantec BBS (2400 baud): 1-408-973-9598
Symantec BBS (9600 baud): 1-408-973-9834

CompuServe: Enter "GO NORUTL" at any prompt.


TECHNICAL INFORMATION

To launch The Norton Virus Scan, type NAVSCAN at the DOS prompt.

WARNING: Do not run The Norton Virus Scan on Tandy 1000 computers!
Unpredictable results may occur.

This freeware version of The Norton AntiVirus does not offer all of the
features available in the complete version of The Norton AntiVirus. It is
designed to allow scanning of executable files only for viruses (viruses
cannot infect data files) and to give you an overall feeling for the program.
Options that are not available will still appear on the menus; when you
select such an option, a dialog box explaining its main features will appear.

The complete version of The Norton AntiVirus for DOS and Windows is a
comprehensive solution for preventing viruses from infecting your computer. It
detects and removes over 1300 known viruses and virus strains. In addition, it
protects against unknown viruses by monitoring your system for irregular file
activity. Should The Norton AntiVirus detect an infection, it can repair most
infected files quickly and easily before the virus damages your system. An
exclusive self-update feature lets you instantly protect your system from
newly discovered viruses by calling Symantec's Virus Newsline at (310)
828-2906 (available in the USA only).

In addition, The Norton AntiVirus features the following:

Virus Intercept - A memory-resident device driver that protects your system
against infection by monitoring file execution. It detects known viruses
and even keeps watch for "virus-like" file activity. "Virus-like" activity may
mean the presence of a new and unknown virus. Virus Intercept requires as
little as 1K RAM, and can load into high memory.

Virus Clinic - The full screen application that scans your memory and drives
for the presence of known and unknown viruses. It is here that you can
configure the Virus Intercept, network and user options, as well as attempt
to repair virus-infected files.

Flexible scanning features - The Norton AntiVirus can be configured to quickly
check your entire computer system for virus infection. Scanning can be set to
occur every time you start your computer, or only on demand.


Virus updates - The Norton AntiVirus lets you immediately upgrade your
protection without having to wait for software updates. Symantec's 24-hour
Virus Newsline offers access to the latest-breaking news about new viruses
and instructions on how to instantly protect your system from them. Virus
updates can be downloaded from the Symantec BBS or CompuServe, entered
manually with information obtained from the Symantec Virus Faxline, or
obtained on disk from the Symantec AntiVirus Update subscription (SAV-U)
program.

Configurable options - Gives you control over the way The Norton AntiVirus
operates. You can customize scanning options and the virus alert messages,
select from three different levels of virus defense, and more. Your settings
can be password-protected to provide complete protection.

Audit trail - Tracks all virus-related activity and saves that information to
an ASCII text file.

Integrated DOS and Windows application - The Norton AntiVirus is both a
complete Windows application and an easy-to-use DOS program, offering
comprehensive virus defense for both DOS and Windows users.

Network support - The Norton AntiVirus supports Novell NetWare, 3Com OPEN, OS/2
LAN Manager, AT&T Starlan and more.

System Requirements:

IBM PC, PC XT, PC AT, PS/2 and compatibles
DOS 3.1 or higher
512K RAM
RAM-resident option requires as little as 1K RAM
Compatible with Microsoft Windows 3.0 or later
Works with any floppy disk, hard disk, or removable media
Mouse support
Network compatible with Novell Netware, 3Com OPEN, OS/2 LAN Manager and more


GENERAL VIRUS INFORMATION

The ten most common DOS viruses are as follows:

Stoned:
The most common virus. Infects the hard disk partition table and floppy
diskette boot sectors.

Jerusalem-B:
Activates on Friday the 13th. The second most common virus. Strain will delete
any files executed on a Friday the 13th. Can cause an enormous amount of file
growth due to multiple infections.

Disk Killer:
Activates after 48 hours of computer usage time. The single most destructive
MS-DOS virus. It writes over the entire hard disk and irrevocably destroys all
data.

Frodo (4096):
Activates on September 22nd. This destructive memory-resident virus uses
stealth techniques to cross-link files and may corrupt data files.

Ping-Pong (Italian-A):
A boot-sector infector that activates on a random basis, sending a white ball
bouncing around the screen.

Joshi:
Activates on January 5th. A stealth infector of floppy diskette boot sectors
and hard disk partition tables. It displays a message asking the user to type
"Happy Birthday Joshi."

Michelangelo:
The Michelangelo virus activates itself on March 6th, the anniversary of
Michelangelo's birth. The Michelangelo virus is spread only by floppy disks,
not over networks or by connecting to electronic on-line services and bulletin
boards. The virus is transferred to memory and hard disks when an attempt is
made to start (boot) your computer from a floppy disk that is infected. The
floppy disk does not have to be a bootable floppy disk; it can be a floppy disk
with data files on it. Once the virus is on your hard disk, it will infect
every floppy disk that you put in your computer, thereby creating further
infections that help it continue to spread.

If a computer is infected with Michelangelo when it is started on March 6th,
the virus will be activated and will begin formatting the hard disk. This will
cause all data on the hard disk to be irretrievably destroyed.

Yankee Doodle:
A memory-resident infector that plays "Yankee Doodle" at 5:00 P.M. and
increases the infected program size.

Azusa:
This virus infects hard disk partition tables and floppy diskette boot sectors.
It occasionally disables the LPT1 and COM1 ports. It can also cause floppy
drives to refuse to acknowledge that disks have been swapped.

Dark Avenger:
Infects .COM, .EXE and .SYS files. After every sixteenth file has been
infected, the virus overwrites a random sector of the hard disk, destroying
programs and data files in that sector.

For additional virus information, phone the Symantec Virus Newsline at
1-310-828-2906 (available in the USA only).

** END OF READ.ME **