SYMANTEC CORPORATION - PETER NORTON GROUP
READ.ME file for The Norton AntiVirus Michelangelo Edition
February 15, 1992


Welcome to The Norton AntiVirus Michelangelo Edition!

This file contains information about The Norton AntiVirus
Michelangelo Edition, and the complete version of The Norton
AntiVirus for DOS and Windows.

To print this file from the DOS prompt, type:

COPY READ.ME PRN:


This document has three sections:

1) Ordering Information: tells you how to order the complete
version of The Norton AntiVirus.
2) Michelangelo Information
3) Technical Information: includes information on how to obtain
Virus Definition Updates for the complete version of The Norton
AntiVirus.
4) General Virus Information: describes the 10 most common DOS
viruses.


1) ORDERING INFORMATION

To get the complete DOS and Windows version of The Norton
AntiVirus Version 2.0 for DOS and Windows, see your local
dealer or, for a special limited time $99 U.S. offer, call:

in USA and Canada: 1-800-441-7234
in Europe: 31-71-353-111
in UK: 0628-776343
in Asia Pacific, Africa & Latin America: 0101-408-252-3570
in Australia: 02-879-6577

To obtain additional copies of The Norton AntiVirus
Michelangelo Edition, download them from the Symantec BBS
or CompuServe:

Symantec BBS (2400 baud)1-408-973-9598
Symantec BBS (9600 baud)1-408-973-9834

CompuServe:Enter "GO NORTON"

In USA and Canada, Phone: 1-800-343-4714, Ext. 707


2) MORE INFORMATION ON MICHELANGELO

The Michelangelo virus activates itself on March 6th, the
anniversary of Michelangelo's birth. The Michelangelo virus is
spread only by floppy disks - not over networks or by connecting
to electronic on line services and bulletin boards. The virus is
transferred to memory and hard disks when an attempt is made to
start up (boot) your computer from a floppy disk that is infected.
The floppy does not have to be a bootable floppy disk; it can be
simply a floppy disk with data files on it. Once the virus is on
the hard disk, it will infect every floppy that you put in your
computer, thereby creating further infections that help it
continue to spread.

On March 6th, if the machine is infected when it is started, the
virus will be activated and will begin formatting the hard disk.
This will cause all data on the hard disk to be irretrievably
destroyed.

The Norton AntiVirus Michelangelo Edition detects and removes the
Michelangelo virus, and will restore the hard disk partition table
to its original location. Remember, however, that once the virus
activates, even though it can be removed after it activates, the
damage that it causes is unrecoverable.

For recorded answers to frequently asked technical questions about
this free software and for additional information on the
Michelangelo virus, phone the Symantec Virus Newsline at
1-310-828-2906.



3) TECHNICAL INFORMATION

The complete Norton AntiVirus Version 2.0 for DOS and Windows is a
comprehensive solution for preventing viruses from infecting your
PC. It detects and removes over 1000 known viruses and strains, and
protects against unknown viruses by monitoring your system for file
irregularities that could signal an unknown virus at work. Should
Norton AntiVirus detect an infection, it can repair most infected
files quickly and easily. An exclusive self-update feature lets you
instantly protect your system from newly discovered viruses by
calling Symantec's Virus Newsline at 1-310-828-2906.

The Norton AntiVirus features:

Virus Intercept - A memory resident program that protects against
infected files entering your system. Virus Intercept requires as
little as 1K RAM, and can load in high memory.

Virus Clinic - A program that scans your system for the presence
of known viruses and file irregularities, and repairs infections
caused by most known viruses.

Flexible Scanning Features - The Norton AntiVirus can be
configured to quickly check your entire computer system for virus
infection, or check executable files only. Scanning can be set to
occur every time you start your computer, or only on demand.

Virus Updates - The Norton AntiVirus lets you immediately update
your protection without having to wait for software updates.
Symantec's 24-hour Virus Newsline offers access to the latest-
breaking news about new viruses and instructions on how to
instantly protect your system from them. Virus updates can be
downloaded from the Symantec BBS or CompuServe, entered manually
with information obtained from the Symantec Virus Newsline, or
obtained on disk from the Symantec Virus Definition Disk Service.

Configurable Options - Gives you control over the way The Norton
AntiVirus operates. You can customize scanning options, customize
the "virus alert" message, select from three different levels of
virus defense, and more. Your settings can be locked to provide
complete protection.

Audit Trail - Tracks all virus-related activity.

Integrated DOS and Windows application - The Norton AntiVirus is
both a complete Windows application, and an easy-to-use DOS
program, offering comprehensive virus defense for both DOS and
Windows users.

Network Support - Scans for viruses on any network drive, and
prevents viruses from launching across a network.

The Norton AntiVirus protects against more than 1,000 viruses and
strains. It takes as little as 1K RAM and can load high.

System Requirements:

IBM PC, XT, AT, PS/2 and compatibles
DOS 3.1 or higher
384K RAM
RAM-resident option requires as little as 1K RAM
Compatible with Microsoft Windows 3.0
Works with any floppy disk, hard disk, or removable media
Mouse support
Network compatible with Novell Netware 286 and 386, 3COM Open,
OS/2 LAN Manager and more




4) GENERAL VIRUS INFORMATION

The 10 most common DOS viruses are:

Stoned:
The most common virus. Infects hard disk partition table and
floppy diskette boot sector.

Jerusalem-B:
Activates on Friday the 13th. The second most common virus.
Strain will delete any files executed on a Friday the 13th. Can
cause enormous amount of file growth due to multiple infections.

Disk Killer :
Activates after 48 hours of computer usage time. Single most
destructive MS-DOS virus. It XORs the entire hard disk and
irrevocably destroys all data.

Frodo (4096):
Activates on September 22.
This destructive memory-resident virus uses stealth technique on
cross-link files and may even corrupt data files. On September
22, it activates and the system hangs.

Ping-Pong (Italian-A):
An infector of boot sectors, activates on a (Ping Pong) random
basis, sending a 'pong-like' white ball bouncing around the
screen.

Joshi:
Activates on January 5th. A stealth infector of floppy diskette
boot sector and hard disk partition tables. On January 5th, it
displays a message asking the user to type "Happy Birthday Joshi".

Michelangelo: (see above)

Yankee Doodle:
A memory-resident infector that plays "Yankee Doodle" at 5:00 PM
and increases the infected program size.

Azusa:
This virus infects hard disk partition table and floppy diskette
boot sectors. It occasionally disables the LPT1 and COM1 ports. It
can also cause floppy drives to refuse to acknowledge that disks
have been swapped.

Dark Avenger:
Infects .COM, .EXE and .SYS files. After every 16th file has been
infected, the virus overwrites a random sector of the hard disk
destroying programs and data files in that sector.

For additional virus information, phone the Symantec Virus
Newsline at 1-310-828-2906.