Symantec First To Provide Cure For Melissa Variant Computer Virus

New Variant of Melissa Computer Virus Infects PCs

CUPERTINO, Calif. Oct. 18, 1999 - Symantec Corporation (NASDAQ: SYMC) today announced that the researchers at the Symantec AntiVirus Research Center (SARC) have analyzed and posted a virus definition set to protect against the W97M.Melissa.U(Gen1) virus. The W97M.Melissa.U(Gen1) virus is a modified version of another virus that was discovered last week named W97M.Melissa.U. Both viruses are variants of the infamous W97M.Melissa.A virus that infected PC users worldwide in late March 1999.

When the new variant, W97M.Melissa.U(Gen1) infects other files, they will become infected with W97M.Melissa.U. It will however e-mail itself as W97M.Melissa.U(Gen1) when sending itself to other systems. It is critical that users have protection against both variants to keep their systems safe. Symantec was the first anti-virus vendor to provide protection against both W97M.Melissa.U and W97M.Melissa.U(Gen1).

Both Melissa variants attempt to delete some system files, insert text into documents and e-mail the infected file to the first four entries in the users Microsoft Outlook address book.

"The Melissa virus and its variants have the ability to self-replicate through e-mail which means that the virus can spread very quickly, especially within corporations utilizing large address lists," said Enrique Salem, vice president of Symantec's Security and Assistance Business Unit. "Our team of dedicated virus researchers backed by Symantec's state-of-the-art automated technology, were able to turn around a cure for the virus very quickly to ensure that our customers received protection from the virus before being infected."

Characteristics of Infection
The document infected with W97M.Melissa.U(Gen1) will arrive in an e-mail with the following subject line and text body with a Microsoft Word document attachment:

Subject: pictures
Body: whats up?

The username will be the name registered in the local copy of Word. For example, it may be ³Subject: pictures John Doe².

Virus Payload
Those infected with the virus will experience the following:

1. The virus will attempt to use Microsoft Outlook to e-mail a copy of the infected document to up to four e-mail addresses (this may include an e-mail address that contains an entire address book). Corporations using Microsoft Exchange are the primary targets of W97M.Melissa.U(Gen1) because the virus searches for Outlook's address book.

2. The virus will insert the following text into the active document ­ ³Please Check Outlook Inbox Mail.²

3. The virus will delete the following files when the infected file is opened making the system un-bootable:

• c:\command.com
• c:\io.sys
• d:\command.com
• d:\io.sys
• c:\Ntdetect.com
• c:\Suhdlog.dat
• c:\Ntdetect.com
• d:\Suhdlog.dat

How to Protect Against the Virus
Computer users can protect their PCs by updating their virus definitions to ensure protection against both variants, and by confirming that macro virus protection is set to High in Microsoft 2000 and enabled in Word 97. Norton AntiVirus customers can currently download the virus definition set through Symantec's LiveUpdate feature or from the Symantec Web site at www.symantec.com/avcenter/download.html.

Symantec AntiVirus Research Center (SARC)
SARC is the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec is a world leader in Internet security technology and technology solutions that help companies manage and support workforces that use laptop computers and other mobile devices.

The company is a leading provider of software products for the consumer market and is rapidly growing its presence as a provider of solutions to enterprise organizations

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, view the Symantec Press Center at www.symantec.com/PressCenter/ on Symantec's Website.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.