**********************************************************************
**                                                                  **
**  What's New in the NAV Virus Definitions Files      WHATSNEW.TXT **
**                                                                  **
**  Symantec AntiVirus Research Center (SARC)     December 15, 1999 **
**                                                                  **
**********************************************************************
This document contains the following topics:

 * Virus Alerts
 * New Technologies
 * Changes Incorporated Into This Update
 * Enabling/Disabling PowerPoint Scanning
 * Additional Information

**********************************************************************
** Virus Alerts                                                     **
**********************************************************************
The ten most commonly reported viruses, worldwide:

    1  W97M.Class
    2  XM.Laroux
    3  O97M.Tristate
    4  W95.CIH
    5  Happy99.Worm
    6  WM.Cap
    7  W97M.ColdApe
    8  W97M.Ethan
    9  W97M.Melissa
   10  Worm.ExploreZip

**********************************************************************
** New Technologies 												**
**********************************************************************

DATE		 Technologies Added
----		 ------------------
8/19/98    * Excel heuristics which detect and repair new and unknown
             macro viruses in Excel 95 & 97 documents.

9/16/98    * Added repair for encrypted Excel 97 documents.

10/21/98   * Heuristics to detect AOL Password Stealer Trojans.
           * WORD Heuristics improvement to increase detection rate.

12/17/98   * Macro Exclusion Engine to speed up the scanning for Word
             and Excel documents.
           * PowerPoint engine to scan PowerPoint related viruses.
             To enable this technology please read "Enabling/Disabling
             PowerPoint Scanning" section later in this document.

02/18/99   * Detection and repair of macro viruses in Word and Excel
             2000 documents.

05/12/99   * Added repair for PowerPoint viruses.
           * Improved heuristics to detect more WORD 97 related
             viruses.

06/10/99   * Menu repair technology for WORD macro viruses that change
             command bar customizations in NORMAL.DOT.

07/12/99   * Added support for scanning of Ichitaro 8/9 documents.
             (Ichitaro is a Japanese word processing program).

08/19/99   * Added detection and repair for embedded documents inside
             PowerPoint 97.

11/22/99   * Added detection and repair for Trojans embedded in OLE
             files, such as Windows scrap files and MS Office
             documents.
           * Added detection for viruses which infect Microsoft
             Project documents (P98M.Corner.A, for example).


**********************************************************************
** Changes Incorporated Into This Virus Definitions Update			**
**********************************************************************
New virus definitions:

        Virus Name                Infection Type          Week added
        ----------                --------------          ----------
        Backdoor-G.ldr            File infector           12/06/99
        Backdoor.Netspy (2)       File infector           11/29/99
        Backdoor.Netspy (3)       File infector           11/29/99
        Backdoor.Netspy (4)       File infector           11/29/99
        Backdoor.Netspy.10        File infector           11/29/99
        Backdoor.Netspy.10.e      File infector           11/29/99
        Backdoor.Subs.1.9 (2)     File infector           11/15/99
        Backdoor.Subs.1.9 (3)     File infector           11/15/99
        Backdoor.Subs.1.9 (4)     File infector           11/15/99
        Backdoor.Subs.1.9 (5)     File infector           11/15/99
        Backdoor.Subseven.1.9     File infector           11/15/99
        CVirus.Trojan             File infector           11/15/99
        Delpart.Trojan            File infector           11/22/99
        Fixit.Trojan              File infector           11/29/99
        Flip.2365                 File and Boot infector  11/15/99
        HLLC.5355                 File infector           11/15/99
        HLLC.5355 (2)             File infector           11/15/99
        HLLC.5355 (unp)           File infector           11/15/99
        HLLC.5355 (unp2)          File infector           11/15/99
        HLLC.Odani.11184          File infector           11/15/99
        HLLC.Odani.11184 (2)      File infector           11/15/99
        HLLO.DPOG.4224            File infector           11/15/99
        HLLO.DPOG.4224 (2)        File infector           11/15/99
        HLLP.10932                File infector           11/15/99
        HLLP.21356                File infector           11/15/99
        HLLP.21356 (2)            File infector           11/15/99
        HLLP.Dexter.5296          File infector           11/15/99
        HLLP.Dexter.5296 (2)      File infector           11/15/99
        IExpand.trojan            File infector           12/06/99
        Info.trojan               File infector           12/15/99
        Logo                      File infector           11/22/99
        Macro Family (2)          File infector           12/15/99
        Macro Family (3)          File infector           12/15/99
        Marzia.C (b)              File and Boot infector  11/29/99
        Marzia.C (x)              File and Boot infector  11/29/99
        Marzia.D                  File and Boot infector  11/29/99
        menem.1372                File infector           11/18/99
        O97M.Tristate.S           File infector           12/10/99
        Orifice2K.plugin          File infector           11/22/99
        QScare.cascade            File infector           12/15/99
        SillyRCE.664              File infector           12/15/99
        SpyingKing.Trojan         File infector           12/06/99
        SubSeven 2.0              File infector           11/15/99
        Time.Y2K                  File infector           11/15/99
        Trivial.104               File infector           11/15/99
        Trivial.115               File infector           11/15/99
        Trivial.115 (2)           File infector           11/15/99
        Trivial.54.d              File infector           11/15/99
        Trivial.61.c              File infector           11/15/99
        Trivial.61.c (2)          File infector           11/15/99
        Trivial.69.b              File infector           11/15/99
        Trivial.69.b (2)          File infector           11/15/99
        Trojan.AOL.PS.ok          File infector           11/29/99
        Trojan.Bugshell           File infector           11/15/99
        Trojan.Test2000           File infector           11/15/99
        Trojan.Test2000 (2)       File infector           11/15/99
        Trojan.Test2000 (3)       File infector           11/15/99
        Trojan.Test2000 (scr)     File infector           11/15/99
        Trojan.Test2000 (x)       File infector           11/15/99
        Trojan.Test2000 (x2)      File infector           11/15/99
        Trojan.Test2000 (x3)      File infector           11/15/99
        VBS.BubbleBoy(2)          File infector           11/15/99
        VBS.BubbleBoy(3)          File infector           11/15/99
        VBS.BubbleBoy(4)          File infector           11/15/99
        VBS.BubbleBoy.B           File infector           11/15/99
        VBS.BubbleBoy.B(2)        File infector           11/15/99
        VBS.BubbleBoy.B(3)        File infector           11/15/99
        W32.Bolzano.R             File infector           11/29/99
        W32.HLLC.StupRed.A        File infector           11/29/99
        W32.HLLO.Fed.A            File infector           11/29/99
        W32.HLLP.Pawel.9000       File infector           11/29/99
        W32.HLLP.Text.A           File infector           11/29/99
        W32.HLLP.Text.B           File infector           11/29/99
        W32.HLLP.Text.C           File infector           11/29/99
        W32.HLLP.Zomby.17920      File infector           12/06/99
        W32.HLLW.Soft6            File infector           12/06/99
        W32.HLLW.Soft6.B          File infector           12/15/99
        W32.Mypics.worm           File infector           12/03/99
        W32.Mypics.worm (2)       File infector           12/03/99
        W32.Mypics.worm (3)       File infector           12/03/99
        W32.Mypics.worm (4)       File infector           12/03/99
        W32.Mypics.worm (5)       File infector           12/03/99
        W32.Mypics.worm (6)       File infector           12/03/99
        W32.Mypics.Worm (bat)     File infector           12/03/99
        W32.Mypics.Worm (bat2)    File infector           12/03/99
        W32.Mypics.Worm (bat3)    File infector           12/03/99
        W32.Mypics.Worm (com)     File infector           12/03/99
        W32.NewApt.Worm           File infector           12/14/99
        W32.NewApt.Worm(2)        File infector           12/14/99
        W32.NewApt.Worm(3)        File infector           12/14/99
        W32.NewApt.Worm(4)        File infector           12/14/99
        W32.Passion.27648         File infector           12/10/99
        W32.Passion.27648(2)      File infector           12/10/99
        W32.Video.25600.Worm      File infector           12/14/99
        W32.Video.25600.Wrm2      File infector           12/14/99
        W32.Video.25600.Wrm3      File infector           12/14/99
        W95.Babylonia             File infector           12/06/99
        W95.Babylonia (dat)       File infector           12/06/99
        W95.Babylonia (HLP)       File infector           12/15/99
        W95.Sign.2028             File infector           11/29/99
        W97M.Aleja5.C             File infector           11/29/99
        W97M.Aleja5.D             File infector           12/15/99
        W97M.Automat.U            File infector           11/15/99
        W97M.Automat.W            File infector           11/15/99
        W97M.Biolord              File infector           12/15/99
        W97M.Class.ED             File infector           12/15/99
        W97M.Corner.A             File infector           11/22/99
        W97M.CyberHack.b          File infector           12/15/99
        W97M.Destro               File infector           12/06/99
        W97M.Evolution            File infector           11/29/99
        W97M.Example.B            File infector           12/15/99
        W97M.Fabi.9608            File infector           11/22/99
        W97M.FF                   File infector           11/15/99
        W97M.Goober.A             File infector           11/22/99
        W97M.Goober.B             File infector           12/15/99
        W97M.IIS.P                File infector           11/15/99
        W97M.Internal.A           File infector           11/15/99
        W97M.Ipid                 File infector           12/15/99
        W97M.Iseng                File infector           12/15/99
        W97M.Marker.BA            File infector           12/15/99
        W97M.Marker.R             File infector           12/06/99
        W97M.Melissa.AA           File infector           12/03/99
        W97M.Melissa.M.var        File infector           11/15/99
        W97M.Meltdown.Troj        File infector           11/15/99
        W97M.Overlord             File infector           12/15/99
        W97M.Poc.B/C              File infector           12/15/99
        W97M.Prilissa.A           File infector           11/22/99
        W97M.Proteced.B           File infector           11/29/99
        W97M.Quoter.A             File infector           11/29/99
        W97M.Remplace.G           File infector           11/22/99
        W97M.Starsend             File infector           11/15/99
        W97M.Tolose               File infector           11/15/99
        W97M.Yoda.A               File infector           12/15/99
        W98.Bagamot (gen1)        File infector           11/15/99
        W98.Bagamot.8192          File infector           11/15/99
        W98.Yobe.24576 (DOS)      File infector           11/29/99
        W98.Yobe.24576 (DOS)2     File infector           11/29/99
        WB.Method                 File infector           11/29/99
        WinError.Trojan           File infector           12/15/99
        WizKiD.RaDD               File infector           12/15/99
        WizKiD.RaDD (Gen1)        File infector           12/15/99
        Worm.ExploreZip(pack)     File infector           11/29/99
        Worm.ExploreZip.B         File infector           12/10/99
        X97M.Automat.Y            File infector           11/29/99
        X97M.Base.A               File infector           11/15/99
        X97M.Boliers.A            File infector           11/22/99
        X97M.Hopper.N             File infector           12/15/99
        XM.Automat.X              File infector           11/22/99
        XM.Laroux.TM              File infector           11/22/99
        Yankee.44.A               File infector           11/29/99
        Yankee.44.A(2)            File infector           11/29/99
        Yankee.44.A(x)            File infector           11/29/99
        Yankee.44.A(x2)           File infector           11/29/99
        Yankee.44.B               File infector           11/29/99
        Yankee.44.B(2)            File infector           11/29/99
        Yankee.44.B(x)            File infector           11/29/99
        Yankee.44.B(x2)           File infector           11/29/99

Name Changes:

        Old Virus Name            New Virus Name          Date changed
        --------------            --------------          ------------
        W32.HLLO.XINF.17408    to W32.HLLP.XINF.17408     11/22/99
        W32.HLLO.XINF.18432    to W32.HLLP.XINF.18432     11/22/99
        W32.HLLW.Soft6         to W32.HLLW.Soft6.A        12/15/99
        W97M.Automat.R         to W97M.Titch.A            11/15/99
        W97M.Automat.U         to W97M.Eight941.D         11/22/99
        W97M.Melissa.AA        to W97M.Melissa.O          12/06/99
        W97M.Starsend          to W97M.Myna.B             12/06/99
        W97M.SWLABS.AB         to W97M.SWLAB.AB           11/22/99
        W97M.SWLabs.U          to W97M.SWLabs.AB          11/22/99
        WM.Swlabs.H            to WM.Swlabs.J             11/22/99

Deletions:

        Virus Name                Infection Type          Date removed
        ----------                --------------          ------------
        Backdoor.Netspy (2)       File infector           12/06/99
        Backdoor.Netspy (3)       File infector           12/06/99
        Backdoor.Netspy (4)       File infector           12/06/99
        Backdoor.Netspy.10.e      File infector           12/06/99
        Delpart.Trojan            File infector           12/06/99
        HLLT.4313                 File infector           12/06/99
        Marzia.C (x)              File and Boot infector  11/22/99
        Marzia.D                  File and Boot infector  11/22/99
        Trojan.Test2000 (x)       File infector           11/17/99
        Trojan.Test2000 (x2)      File infector           11/17/99
        Trojan.Test2000 (x3)      File infector           11/17/99
        W32.Autoworm.3072         File infector           10/13/99
        W95.Roma                  File infector           09/22/99
        W97M.Automat.W            File infector           11/22/99
        Yankee.44.A (COM)         File infector           11/29/99
        Yankee.44.A (EXE)         File infector           11/29/99

**********************************************************************
**	Enabling/Disabling PowerPoint Scanning							**
**********************************************************************
PowerPoint Scanning is now enabled by default and can be optionally
disabled.  However, you may want to verify that files with
PowerPoint extensions will be scanned by making sure that your
NAV options have both ".PPT" and ".POT" in the list of extensions
to scan.

To disable PowerPoint scanning in NAV for Windows 95/NT
version 4.x or NAV for OS/2, a text file named NAVEX15.INF should
be placed in the directory where NAV 4.x or NAV 5.x is installed
(i.e., C:\Program Files\Norton AntiVirus).

To disable PowerPoint scanning in NAV for Netware version 4.x, a text
file named NAVEX15.INF should be placed in the directory where NAV
4.x is installed (i.e., sys:system\navnlm).

To disable PowerPoint scanning in NAV for Windows 95/NT version 2.0,
NAV 4.x for Windows 3.1/DOS, NAVIEG 1.x, or NAVFW 1.x a text file
named NAVEX.INF should be placed in the directory where NAV is
installed (i.e., C:\NAV).

The contents of the text file, NAVEX15.INF or NAVEX.INF, determine
which components of NAV have PowerPoint scanning disabled.

To disable PowerPoint scanning for a particular component, use the
following table to determine the lines to add to the text file.
PowerPoint scanning can be disabled for more than one component if
needed by adding the required lines for the desired components.

+---------------------+--------------------------+--------------------+
|Windows 95/NT scanner|Windows 95/NT auto-protect|DOS scanner         |
+---------------------+--------------------------+--------------------+
|[NAVW32]             |[NAVAP]                   |[NAVDX]             |
|PowerPointScanning=0 |PowerPointScanning=0 	 |PowerPointScanning=0|
+---------------------+--------------------------+--------------------+

+----------------------+--------------------+--------------------+
|Windows 3.1 scanner/AP|Netware scanner         |OS/2 scanner/AP |
+----------------------+--------------------+--------------------+
|[NAVWIN]              |[NAVNLM]            |[NAVOS2]            |
|PowerPointScanning=0  |PowerPointScanning=0|PowerPointScanning=0|
+----------------------+--------------------+--------------------+

To enable PowerPoint scanning for a component, delete the lines
added for that component from the NAVEX15.INF or NAVEX.INF file.

**********************************************************************
**	Additional Information											**
**********************************************************************
SARC has equipped Norton AntiVirus with a new feature called
"Infestation Mode."  If a large number of new or unknown viruses
is found on the system during a scan, Norton AntiVirus will
automatically enable its highest level of detection.  This gives
users the most comprehensive protection in cases where a viral
infestation may have been detected.  If you would like to disable
this feature, you can do so by following these instructions:

1. Create a text File called NAVEX15.INF in your Norton AntiVirus
   directory,e.g., C:\Program Files\Norton AntiVirus. If this file
   already exist go to step two.

2. Place the following lines in this File on the left-hand margin:

[NAVW32]
infestmode=0

[NAVDX]
infestmode=0

3. Save the File.


Additional information regarding this virus definitions update can be
found in UPDATE.TXT and TECHNOTE.TXT.
