Symantec Warns Of New Computer Worm With File Damaging Payload

CUPERTINO, Calif. - May 26, 2000 - Symantec Corp. (NASDAQ: SYMC) today announced that researchers at the Symantec AntiVirus Research Centre (SARC) identified W97M.Melissa.BG (alias W97.Resume.A) - an extremely fast-spreading computer worm that uses Microsoft Outlook to e-mail itself as an attachment.

Characteristics of Infection
W97M.Melissa.BG is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "Resume - Janet Simons" along with an attachment called "RESUME1.DOC."

Payload
W97M.Melissa.BG is a macro virus that has an unusual payload. When a user opens an infected document, the virus will attempt to e-mail a copy of the document to everyone in the user's Microsoft Outlook address book. The virus also copies itself to "C:\Data\Normal.dot" and to "C:\WINDOWS\StartMenu\Programs\StartUp\Explorer.doc." Once the user closes the document, the virus attempts to delete the following files:

C:\*.*
C:\My Documents\*.*
C:\WINDOWS\*.*
C:\WINDOWS\SYSTEM\*.*
C:\WINNT\*.*
C:\WINNT\SYSTEM32\*.*
All files in drives A through Z

The body of the e-mail sent is as follows:

To: Director of Sales/Marketing,
Attached is my resume with a list of references contained within. Please feel free to call or email me if you have any further questions regarding my experience. I am looking forward to hearing from you.
Sincerely,
Janet Simons.

Recommendations/ Protection
SARC recommends administrators filter for the attachment name and subject line immediately.

Symantec AntiVirus Research Center
SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec, a world leader in Internet security technology, provides content security solutions to enterprise organisations and helps companies manage and support workforces that use computers and other mobile devices.

Symantec's Canadian operations are headquartered in Toronto with offices in Montreal, Ottawa, and Vancouver. For more information on Symantec products or current promotions, contact the Canadian office at (416) 441-3676 or access Symantec's Canadian web-site at www.symantec.ca. Symantec is an active member of the Canadian Alliance Against Software Theft (CAAST).

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Centre on Symantec's web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders.