Updated Virus Definition Set Available Now Via LiveUpdate, Symantec Web Site

Toronto, ON. June 11, 1999 - Symantec Corporation (Nasdaq: SYMC) today announced that a virus definition set is immediately available to detect and repair the Worm.ExploreZip worm, which contains a malicious payload that can result in non-recoverable data and/or inoperable computer systems. Norton AntiVirus users are advised to protect themselves from this worm by downloading the current virus definitions through LiveUpdate or from the Symantec web site at www.symantec.com/avcenter/download.html.

"Symantec continues to outpace competitors in the speed at which it counters even the most prolific and destructive viruses," said Enrique Salem, vice president of Symantec's Security and Assistance Business Unit. "We remain determined to continue to respond swiftly to the public's needs for technology that eliminates the potential destruction that viruses such as Worm.ExploreZip can cause."

Worm.ExploreZip is a worm that contains a malicious payload. The worm utilizes MAPI commands and Microsoft Outlook on Windows systems to propagate itself. The worm was first discovered in Israel and submitted to the Symantec AntiVirus Research Center (SARC) on June 6, 1999.

The worm e-mails itself out as an attachment with the filename "zipped_files.exe"; the body of the e-mail message might appear to come from a known e-mail correspondent and contains the following text: "Hi [recipient name]! I received your email and I shall send you a reply ASAP. Till then, take a look at the attached zipped docs. Bye" The worm determines the recipient by going through received messages in the user's Inbox. Once the attachment is executed, it might display an Error window, which contains the following text: "Cannot open file: it does not appear to be a valid archive. If this file is part of a ZIP format backup set, insert the last disk of the backup set and try again. Please press F1 for help."

The worm proceeds to copy itself to the c:\windows\system directory with the filename "Explore.exe" and then modifies the WIN.INI file so that the program is executed each time Windows is started. The worm then utilizes the user's e-mail client to harvest e-mail addresses in order to propagate itself. Users might notice that their e-mail client starts when this occurs.

In addition, when Worm.ExploreZip is executed, it also searches through the C through Z drives of the user's computer system and selects files with extensions .c, .cpp, .h, .asm, .doc, .ppt, .xls to destroy by making them 0 bytes long. This can result in non-recoverable data and inoperable computers.

Symantec AntiVirus Research Center (SARC)
SARC is the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec in Canada:
With 250 employees, Symantec's Canadian operations are headquartered in Toronto with offices in Montreal, Ottawa and Vancouver. For information on Symantec products or current promotions, contact the Canadian office at (416) 441-3676 or access Symantec's Canadian Web Site. Symantec is an active member of the Canadian Alliance Against Software Theft (CAAST).

About Symantec
Symantec is the world leader in utility software for business and personal computing. Symantec products and solutions help make users productive and keep their computers safe and reliable anywhere and anytime. Symantec offers a broad range of solutions and is acclaimed as a leader in both customer satisfaction and product brand recognition. Symantec is traded on Nasdaq under the symbol SYMC. More information on the company and its products can be obtained at www.symantec.com.

Founded in 1982, the company's global operations span North America, Europe, Japan and several fast growing markets throughout Asia Pacific and Latin America. Traded on Nasdaq under the symbol SYMC, Symantec Corporation is based in Cupertino, Calif., and employs more than 2,000 people. Information on the company and its products can be obtained by calling (800) 441-7234 toll free, (541) 334-6054 or accessed on the World Wide Web.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Centre on Symantec's web site. Brands and products referenced herein are the trademarks or registered trademarks of their respective holders.