Symantec protects against new computer worm - W32.Goner.A@mm

Symantec Security Response rates worm level 4 security threat

Hong Kong -- December 5 2001 - Symantec Corp. (NASDAQ: SYMC), the world leader in Internet security, has warned against W32.Goner.A@mm - a mass-mailing worm that spreads itself through e-mail by accessing the Microsoft Outlook address book and through the ICQ network messaging system. W32.Goner.A@mm, also attempts to delete critical files associated with anti-virus and personal firewall programs.

If mIRC, an Internet Relay Chat program, is installed on an infected computer, the worm can also insert mIRC scripts that will create a backdoor. This will enable the infected computer to be able to be used in a Denial of Service (DOS) attack.

"At this time we are not seeing the high level of infected file submissions that we received with some of the more widespread viruses such as VBS.LoveLetter and CodeRed," said David Banes, regional manger of Symantec Security Response Asia Pacific. "Customers who utilise Symantec's LiveUpdate feature to obtain the most current virus definitions are already protected from this latest threat."

The subject line reads "Hi." The text in the body of the email reads, "How are you? When I saw this screen saver, I immediately thought about you. I am in a harry, I promise you will love it!" When the attached document - Gone.scr - is executed, the worm modifies the registry, attempting to delete files of common anti-virus and personal firewall products. If the files are in use and cannot be deleted, the worm will create the file %SYSTEM%\Wininit.ini, which causes the files to be deleted when the computer restarts.

Symantec recommends customers use the LiveUpdate feature built into Symantec's Norton AntiVirus software to protect their systems. Updates are also available at the Symantec Security Response Web site: http://securityresponse.symantec.com

About Symantec
Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to individuals, enterprises and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering, remote management technologies and security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, California, Symantec has worldwide operations in 37 countries. For more information, please visit www.symantec.com .

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site.

Symantec and the Symantec logo are trademarks or registered trademarks of Symantec Corporation. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.

###

Issued on behalf of Symantec by Newell Public Relations.