ABOUT SYMANTEC

Press Release

Symantec Offers Detection and Elimination of First Known Macintosh Worm

Symantec AntiVirus for Macintosh Users Protected From AutoStart 9805

Cupertino, Calif. --May 13, 1998-- Symantec Corporation (Nasdaq: SYMC), the worldwide leader in utilities and anti-virus software, announced today that the Norton AntiVirus for NetWare users, can download the worm definition update immediately from Symantec's BBS, FTP or web site or from Symantec's forums on CompuServe and AOL.

"As soon as the first reports of AutoStart 9805 surfaced, Symantec's AntiVirus Research Center worked immediately to provide complete protection for our customers from the first known Macintosh worm in existence," said Enrique Salem, vice president of Symantec's Security and Assistance Business Unit. "Viruses on the Macintosh platform have been quite rare, but Symantec is committed to providing comprehensive and timely solutions for the needs of our Macintosh customers, as the latest computer threats arise."

AutoStart 9805 is known to affect only Macintosh PowerPC-based computers running QuickTime and an active CD-ROM AutoPlay feature. As a worm rather than a virus, AutoStart 9805 does not infect programs or documents. Instead, it replicates itself from computer to computer as a self-contained, stand-alone file, usually causing performance problems and corruption to other files. It is transmitted via HFS or HFS+ Macintosh-formatted disk volumes including floppy disks, most removable cartridge drives, hard disks and disk images. Files corrupted by the AutoStart worm are irreparable.

AutoStart 9805 is seeded as a hidden, AutoStart application file called "DB" in the root directory of the mounted volume. The worm begins its program routine automatically when QuickTime's CD-ROM Auto-Play feature, which automatically launches an application or document when a disk volume is mounted, is active. The DB application attempts to transform itself into a hidden system extensions file called "Desktop Print Spooler". About every thirty minutes, Desktop Print Spooler completely searches all mounted volumes for an extensions folder to continue propagating itself, a process resulting in periodic decreased performance. After searching the mounted volumes, AutoStart 9805 begins checking for files ending in .dat, .cod, .csa. and .data and attempts to overwrite them with random data.

SAM 4.5 customers are automatically protected by SAM Intercept, which detects the worm whenever it is launched from an infected volume. Once AutoStart 9805 is detected, SAM 4.5 removes the worm completely before it has a chance to damage the data on the computer. From then on, SAM 4.5 automatically scans every downloaded or installed file or program for this worm, as well as other viruses and Trojan Horses, keeping customers protected and productive.

With a single mouseclick, Symantec AntiVirus for Macintosh users can access the latest virus definition update by connecting to the Symantec BBS. Even easier, with SAM's Automatic Update feature activated, users can receive the update in the next scheduled automatic download. Customers with Norton AntiVirus for Netware, which can scan the Macintosh platform, can simply click the LiveUpdate button to be automatically protected. Users can also download the definition files through Symantec's FTP site located at ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/symantec_antivirus_macintosh/05sam98_virus_defs.sea.hqx or through the SARC web site located at www.symantec.com/avcenter/download.html. The update is also available to users on CompuServe (Go SYMMAC) and America Online (keyword=SYMANTEC).

Symantec AntiVirus for Macintosh 4.5
Symantec AntiVirus for Macintosh provides effortless up-to-date protection against most viruses inadvertently downloaded from the Internet. SAM can simply and easily be updated with the click of a button using Automatic Update. SAM also continues to provide detection and repair for all known Macintosh viruses including known HyperCard viruses, Trojan Horses, Word Macro Viruses and worms. SAM's SafeZone feature acts as a "virtual clean-room" so copied or downloaded files can be scanned in isolation and declared "clean" before being used. In addition, SAM is the only Macintosh anti-virus solution that allows scanning of Microsoft Word and Excel files shared via File Sharing on Open. This greatly decreases the potential for transmission of Macro viruses through Macintosh File Sharing.

Norton AntiVirus for NetWare 4.0
NAV for NetWare 4.0 is part of the Norton multi-tier anti-virus family of products designed to protect the enterprise at the desktop, server, Internet, and gateway levels. The most complete virus protection available for NetWare servers, Norton AntiVirus for NetWare 4.0 offers administrators comprehensive virus detection and repair capabilities for the NetWare platform through the latest advancements in anti-virus technologies from the Symantec AntiVirus Research Center (SARC), including LiveUpdate, Bloodhound and Striker technologies. Norton AntiVirus for NetWare scans all files whether they come from a DOS, Windows 3.x, Windows 95, Windows NT, or Macintosh system.

Symantec AntiVirus Research Center
SARC is the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec Corporation helps make users productive and keep their computers safe and reliable anywhere and anytime. Symantec offers a broad range of solutions and is acclaimed as a leader in both customer satisfaction and product brand recognition. The company is focused on addressing customer needs in three main application areas: the Norton product line of anti-virus and PC-assistance products; the pcANYWHERE, WinFax and ACT! product lines that cater to remote user productivity; and the Cafe product lines in Internet development tools.

Founded in 1982, the company's global operations span North America, Europe, Japan and several fast growing markets throughout Asia Pacific and Latin America. Traded on Nasdaq under the symbol SYMC, Symantec Corporation is based in Cupertino, California and employs more than 2,000 people. Information on the company and its products can be obtained by calling (800) 441-7234 toll free, (541) 334-6054 or accessed on the World Wide Web at http://www.symantec.com.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders.