Symantec Integrates State-of-the Art Heuristic Technology for Excel Viruses into Norton AntiVirus
- Bloodhound for Excel Detects and Safely Repairs Excel Files Infected with Unknown Macro Viruses -
Cupertino, Calif --September 14, 1998-- Symantec Corporation (Nasdaq:
SYMC), the world leader in utility software for business and personal
computing, today announced that it has integrated a state-of-the-art
heuristic detection technology for viruses that infect Microsoft Excel
spreadsheets into Norton AntiVirus. Available today with the current
set of virus definitions, Bloodhound for Excel detects and safely
repairs Excel files infected with unknown macro viruses.
Currently, there are approximately 200 known viruses created
specifically for Microsoft Excel, compared to several thousand created
specifically for Microsoft Word. While the numbers are not as large,
the threat of Excel viruses is beginning to grow. The Symantec
AntiVirus Research Center (SARC) reports that there is a new Excel
virus every two days. In addition, nearly 20 percent of the virus
issues reported into SARC by Norton AntiVirus customers relate to new
"We work very closely with our customers when we develop new
technologies for Norton AntiVirus to make sure we are addressing their
most pressing needs," said Enrique Salem, vice president of Symantec's
Security and Assistance Business Unit. "With Bloodhound for Excel,
only Norton AntiVirus customers have real-time protection against the
growing threat of Excel viruses and the security of knowing their
documents can be safely repaired if they do get infected."
Proven 95 percent effective, Symantec's exclusive Bloodhound for Excel
technology uses code analysis techniques to scrutinize the macro
portions of Microsoft Excel documents for viruses. It analyzes the
macros of an Excel document in the same way an expert anti-virus
researcher would in determining whether or not they are viral. First
it will look for properties in the macros that indicate they could
possibly contain a virus. For each such indication, Bloodhound will
analyze in detail the context of the macro operations. If the context
has the characteristics of a virus, Bloodhound will let the user know
the document is infected and will start the AutoRepair wizard
interface to help the user fix the file.
With Norton AntiVirus 5.0, users now also have the option to send that
file to SARC for analysis using the Scan and Deliver feature. SARC
will evaluate the potential virus and provide an updated virus
definition to the user by e-mail. Through this process, users who
submit samples to SARC are protecting Norton AntiVirus customers
Bloodhound for Excel comprises a radical departure from the
traditional variant detection technologies used by other anti-virus
products. Variant detection is based on simple pattern matching
techniques and is only capable of detecting new virus strains that are
similar to existing "known" viruses. Bloodhound for Excel is able to
detect the same simple variants as well as more complex variants and
entirely new virus strains. In addition, Bloodhound does not require
pattern updates to detect new strains and their variants like the
variant detection technique. The biggest advantage of Bloodhound for
Excel is that it can safely repair documents infected by new Excel
viruses because it understands the virus and how it is comprised. This
technology provides Norton AntiVirus users full protection without
having to wait for a virus definition update when a new Excel macro
virus strain appears.
Pricing and Avaliability
Bloodhound for Excel is available for free to all Norton AntiVirus for
Windows and Norton AntiVirus for Mac customers and is compatible with
versions 4.0 and above for both the server and workstation products.
Customers can update their systems with this new technology by running
the program's exclusive LiveUpdate feature or by downloading the
latest package of virus definitions and program updates from
Symantec's web site at www.symantec.com.
The Norton AntiVirus product line includes a multi-tier strategy that
integrates products at the desktop, server, GroupWare server, Internet
gateway and firewall levels to provide users with the most
comprehensive virus detection and repair. The products provide users
the security of knowing they have the most complete protection
available whether downloading files from the Internet, opening
attached word documents or accessing floppy disks. Norton AntiVirus
provides users with 100 percent detection of in-the-wild viruses,
according to recent tests by Virus Bulletin.
LiveUpdate Provides Constant, Current Protection
LiveUpdate provides customers an easy, automatic way to keep their
anti-virus protection current. LiveUpdate automatically detects an
Internet connection or modem and connects to a Symantec server, then
downloads and installs the latest virus definitions. Norton AntiVirus
users can schedule LiveUpdate to run at regular intervals or can
trigger it manually by pressing the LiveUpdate button.
In addition to receiving Symantec's weekly virus definition updates,
LiveUpdate also may be used to install software updates and obtain
product information. Norton AntiVirus features a modular engine called
NAVEX that allows Symantec to ship fundamental changes and updates to
the engine technology. LiveUpdate delivers this engine, but NAVEX is
what keeps these changes small enough to download over the Internet.
Symantec AntiVirus Research Center
SARC is the industry's largest dedicated team of virus experts. With
offices located in the United States, Japan, Australia, and the
Netherlands, the sun never sets on SARC. The center's mission is to
provide swift, global responses to computer virus threats, proactively
research and develop technologies that eliminate such threats, and
educate the public on safe computing practices. As new computer viruses
appear, SARC develops identification and detection for these viruses,
and provides either a repair or delete operation, thus keeping users
protected against the latest virus threats.
Symantec is the world leader in utility software for business and personal computing.
Symantec products and solutions help make users productive and keep their computers
safe and reliable anywhere and anytime. Symantec offers a broad range of solutions
and is acclaimed as a leader in both customer satisfaction and product brand
recognition. Symantec is traded on Nasdaq under the symbol SYMC. More information
on the company and its products can be obtained at www.symantec.com.
NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products,
view the Symantec Press Center at www.symantec.com/PressCenter/ on Symantec's Website.
Brands and products referenced herein are the trademarks or registered trademarks of their
respective holders. All prices noted are in US dollars and are valid only in the United States.