Symantec Discovers New Computer Worm Infecting Thousands

Corporations Worldwide Infected by VBS.LoveLetter.A

CUPERTINO, Calif. -- May 4, 2000

What:
Researchers at the Symantec AntiVirus Research Centre have discovered VBS.LoveLetter.A, an extremely fast-spreading computer worm that uses mIRC and Microsoft Outlook to e-mail itself as an attachment.

Characteristics of infection:
VBS.LoveLetter.A is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "ILOVEYOU" along with an attachment called "LOVE-LETTER-FOR-YOU.TXT.vbs."

Payload:
Preliminary finding indicate that the worm sends itself to all addresses in the computer user's Outlook address book causing mail servers to clog.

The worm will infect files with the following extensions: vbs, vbe, je, jse, css, wsh, sct, hta, jpg, jpeg, mp3, and mp2.

Additionally, it will delete the following files:

• MSKernel32.vbs in the Windows system directory
• Win32DLL.vbs in the Windows directory
• LOVE-LETTER-FOR-YOU.TXT.vbs in the Windows System directory
• WinFAT32.EXE in the Internet download directory
• WIN-BUGSFIX.EXE in the Internet download directory
• Script.ini in the mIRC directory

Recommendations/Protection:
SARC recommends administrators filter for the attachment name and subject line immediately.

Symantec AntiVirus Research Centre:
SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The centre's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec, a world leader in Internet security technology, provides content security solutions to enterprise organisations and helps companies manage and support workforces that use computers and other mobile devices.

Symantec's Canadian operations are headquartered in Toronto with offices in Montreal, Ottawa, and Vancouver. For more information on Symantec products or current promotions, contact the Canadian office at (416) 441-3676 or access Symantec's Canadian web-site at www.symantec.ca. Symantec is an active member of the Canadian Alliance Against Software Theft (CAAST).

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Centre on Symantec's web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders.

FORWARD LOOKING STATEMENT: This press release contains forward-looking statements. There are certain important factors that could cause Symantec's future development efforts to differ materially from those anticipated by some of the statements made above. Among these are the anticipation of the growth of certain market segments, the positioning of Symantec's products in those segments, the competitive environment in the software industry, new security threats, dependence on other products, changes to operating systems and product strategy by vendors of operating systems, and the importance of new Symantec products. Additional information concerning those and other factors is contained in the "Risk Factors" section of the company's annual report on Form 10-K for the fiscal year ended April 2, 1999.