**********************************************************************
**                                                                  **
**  What's New in the NAV Virus Definitions Files      WHATSNEW.TXT **
**                                                                  **
**  Symantec AntiVirus Research Center (SARC)          June 22,2000 **
**                                                                  **
**********************************************************************
This document contains the following topics:

 * Virus Alerts
 * New Technologies
 * Changes Incorporated Into This Update
 * Enabling Scanning Features
 * Additional Information

**********************************************************************
** Virus Alerts                                                     **
**********************************************************************
VBS.LoveLetter, a new worm which has been wide-spread since May 4th,
is detected by this definition set.  

The ten most commonly reported viruses, worldwide:

    1  VBS.LoveLetter.A
    2  WScript.KakWorm
    3  VBS.Network
    4  W95.CIH
    5  Happy99.Worm
    6  Worm.ExploreZip
    7  W97M.ColdApe
    8  W97M.Ethan
    9  W97M.Melissa
   10  WM.Cap

**********************************************************************
** New Technologies                                                 **
**********************************************************************

DATE         Technologies Added
----         ------------------
8/19/98    * Excel heuristics which detect and repair new and unknown
             macro viruses in Excel 95 & 97 documents.

9/16/98    * Added repair for encrypted Excel 97 documents.

10/21/98   * Heuristics to detect AOL Password Stealer Trojans.
           * WORD Heuristics improvement to increase detection rate.

12/17/98   * Macro Exclusion Engine to speed up the scanning for Word
             and Excel documents.
           * PowerPoint engine to scan PowerPoint related viruses.
             To enable this technology please read "Enabling/Disabling
             PowerPoint Scanning" section later in this document.

02/18/99   * Detection and repair of macro viruses in Word and Excel
             2000 documents.

05/15/99   * Added repair for PowerPoint viruses.
           * Improved heuristics to detect more WORD 97 related
             viruses.

06/10/99   * Menu repair technology for WORD macro viruses that change
             command bar customizations in NORMAL.DOT.

07/12/99   * Added support for scanning of Ichitaro 8/9 documents.
             (Ichitaro is a Japanese word processing program).

08/19/99   * Added detection and repair for embedded documents inside
             PowerPoint 97.

11/22/99   * Added detection and repair for Trojans embedded in OLE
             files, such as Windows scrap files and MS Office
             documents.
           * Added detection for viruses which infect Microsoft
             Project documents (P98M.Corner.A, for example).

02/10/00   * Added support for scanning of UNIX executables.
           * Added detection for infected Visio documents.

**********************************************************************
** Changes Incorporated Into This Virus Definitions Update          **
**********************************************************************
New virus definitions:

        Virus Name                Infection Type          Week added
        ----------                --------------          ----------
        BAT.Rhapsody              File infector            06/22/00
        BackOrifice2k.Cfg         File infector            06/12/00
        Backdoor.Admire           File infector            06/22/00
        Backdoor.DU               File infector            06/12/00
        Backdoor.Eclipse          File infector            06/05/00
        Backdoor.Explorer32       File infector            06/22/00
        Backdoor.Fof              File infector            06/12/00
        Backdoor.GDoor            File infector            05/30/00
        Backdoor.GateCrasher      File infector            06/12/00
        Backdoor.ICQ.Syphillis    File infector            06/12/00
        Backdoor.Millenium        File infector            06/22/00
        Backdoor.NetBus.svr       File infector            06/12/00
        Backdoor.Netbus.drop      File infector            06/12/00
        Backdoor.OneTime          File infector            06/22/00
        Backdoor.Onliner          File infector            06/12/00
        Backdoor.RipClient        File infector            06/05/00
        Backdoor.Satan            File infector            06/12/00
        Backdoor.Servidor         File infector            05/30/00
        Backdoor.Silence          File infector            06/12/00
        Backdoor.WinMap           File infector            06/22/00
        Backdoor.WinMapClient     File infector            06/22/00
        Bat.Winstart_II.511       File infector            05/30/00
        Crash.Trojan              File infector            06/22/00
        DrZip.512                 File infector            05/22/00
        GIP.Trojan                File infector            05/22/00
        HLP.Dream                 File infector            06/12/00
        HTML.DayDream2            File infector            06/05/00
        HTML.StartMe              File infector            06/12/00
        ICQ.Trojan                File infector            06/22/00
        INI.Aphex                 File infector            06/12/00
        IRC.Trojan.Fabio          File infector            06/22/00
        Ini.Scrambler             File infector            06/12/00
        JPEG.Trojan               File infector            05/30/00
        JS.Aphex                  File infector            06/12/00
        Linux.DDoS.MStream        File infector            05/22/00
        Maze.Trojan               File infector            05/30/00
        O97M.CyberNet.A           File infector            05/22/00
        PWSteal.Winup             File infector            06/12/00
        PriceDoc.Trojan           File infector            05/30/00
        Serbian.Trojan            File infector            06/12/00
        Shnaz.Trojan.A            File infector            06/22/00
        Simpsons.Trojan           File infector            06/22/00
        Solaris.DDoS.MStream      File infector            05/22/00
        TD.1536.B                 File infector            06/12/00
        TD.1536.B (2)             File infector            06/12/00
        Trojan.Ansibomb           File infector            05/30/00
        Trojan.Nariz              File infector            06/22/00
        Trojan.Smile              File infector            06/22/00
        VBS.Aphex                 File infector            06/12/00
        VBS.CoolNote              File infector            05/30/00
        VBS.Fireburn.A            File infector            05/30/00
        VBS.Gnutella              File infector            06/05/00
        VBS.LoveLetter.AD         File infector            06/05/00
        VBS.Lowjo                 File infector            05/30/00
        VBS.MP3Free.A             File infector            05/22/00
        VBS.Plan.A                File infector            06/12/00
        VBS.Scrambled             File infector            05/30/00
        VBS.Stages                File infector            06/16/00
        VBS.Timofonica            File infector            06/12/00
        VBS.Zuke.Worm             File infector            06/05/00
        VCG.Belka                 File infector            05/22/00
        W32.Android.Worm          File infector            05/22/00
        W32.Cargo.B.Int           File infector            05/22/00
        W32.Demo.Worm             File infector            05/22/00
        W32.Dream                 File infector            06/12/00
        W32.Ghost.1667            File infector            06/05/00
        W32.Guorm.Worm            File infector            06/05/00
        W32.HLLO.Job.22528        File infector            06/12/00
        W32.HLLO.ZMK.30030        File infector            05/22/00
        W32.HLLP.Cramb.B          File infector            05/22/00
        W32.HLLP.Scrambler.A      File infector            06/05/00
        W32.HLLP.Scrambler.B      File infector            06/05/00
        W32.HLLP.This.16896       File infector            05/22/00
        W32.HLLW.Tress            File infector            06/22/00
        W32.Hellfire.Mirc         File infector            05/22/00
        W32.Knight.2350           File infector            06/22/00
        W32.Magic.1922            File infector            05/22/00
        W32.Pokey.Worm            File infector            06/22/00
        W32.Rhapsody.Gen          File infector            06/05/00
        W32.Riccy.A               File infector            05/22/00
        W32.Riccy.B               File infector            05/22/00
        W32.Riccy.C               File infector            05/22/00
        W32.Segax.Gen             File infector            05/30/00
        W32.Silver.B.Mirc         File infector            06/12/00
        W32.Silver.Mirc           File infector            05/22/00
        W32.TheSpy.A.Mirc         File infector            06/12/00
        W32.TheSpy.B.Mirc         File infector            06/12/00
        W95.CIH.1103.Int          File infector            05/30/00
        W95.CIH.1297.Int          File infector            05/30/00
        W95.FYS.1728.Int          File infector            06/12/00
        W95.Hooy.8192             File infector            06/12/00
        W95.Hooy.8192.Dr          File infector            06/12/00
        W95.NB.Worm               File infector            06/12/00
        W95.Shaitan.3550          File infector            05/22/00
        W95.Smash (SYS)           File infector            06/22/00
        W95.ZOM                   File infector            05/22/00
        W95.ZOM.Gen               File infector            05/30/00
        W95.Zomb.432              File infector            05/22/00
        W95.Zperm.A               File infector            06/22/00
        W95.Zperm.B               File infector            06/22/00
        W97M.Aquil                File infector            05/30/00
        W97M.Bablas.AA            File infector            06/05/00
        W97M.Bablas.AB            File infector            06/05/00
        W97M.Bablas.AC            File infector            06/05/00
        W97M.Bablas.AD            File infector            06/22/00
        W97M.Bablas.W             File infector            05/30/00
        W97M.Bablas.X             File infector            05/30/00
        W97M.Bablas.Z             File infector            06/05/00
        W97M.Balblas.Y            File infector            05/30/00
        W97M.Beth.A               File infector            06/12/00
        W97M.Bobo.int             File infector            06/22/00
        W97M.Candle.B             File infector            05/30/00
        W97M.Claud.B              File infector            05/30/00
        W97M.Claud.C              File infector            06/05/00
        W97M.Claudio.B            File infector            05/30/00
        W97M.DIVI.I               File infector            06/22/00
        W97M.DogHack              File infector            05/30/00
        W97M.Donkey               File infector            05/30/00
        W97M.Eight941.J           File infector            06/05/00
        W97M.Eight941.K           File infector            06/22/00
        W97M.FF.A                 File infector            06/05/00
        W97M.Fly                  File infector            05/30/00
        W97M.Groov.F              File infector            05/30/00
        W97M.Homer                File infector            06/12/00
        W97M.Lafs.B               File infector            06/05/00
        W97M.LoveDrop             File infector            05/22/00
        W97M.Marker.BB            File infector            05/30/00
        W97M.Marker.BO            File infector            06/12/00
        W97M.Marker.BX            File infector            06/22/00
        W97M.Marker.CT            File infector            05/22/00
        W97M.Marker.CU            File infector            05/30/00
        W97M.Marker.CX            File infector            06/05/00
        W97M.Marker.CZ            File infector            06/05/00
        W97M.Marker.Intend        File infector            05/30/00
        W97M.Marker.S             File infector            05/22/00
        W97M.Melissa.BG           File infector            05/26/00
        W97M.NSI.B                File infector            06/12/00
        W97M.Opey.D               File infector            05/30/00
        W97M.OutlookWorm.Gen      File infector            05/26/00
        W97M.Passbox.I            File infector            06/22/00
        W97M.Service.B            File infector            06/22/00
        W97M.Shepmah.B            File infector            06/22/00
        W97M.Sherlock             File infector            06/22/00
        W97M.Smaller.A            File infector            06/12/00
        W97M.Sprite               File infector            05/22/00
        W97M.Stand                File infector            05/30/00
        W97M.Surround.Varian      File infector            06/19/00
        W97M.Thus.K               File infector            06/05/00
        W97M.Thus.V               File infector            05/22/00
        W97M.Thus.W               File infector            05/30/00
        W97M.Thus.X               File infector            06/22/00
        W97M.Thus.Y               File infector            06/22/00
        W97M.VMPCK1.DI            File infector            06/12/00
        W97M.VMPCK1.DK            File infector            06/22/00
        W97M.Verlor (dropped)     File infector            05/30/00
        W97M.Vortex               File infector            05/30/00
        WM.Berau                  File infector            06/05/00
        Win.HLLP.Sector           File infector            06/12/00
        Win.HLLP.Sector.Gen       File infector            06/12/00
        Win.Pada.B.Int            File infector            06/12/00
        Worms.Trojan.Intended     File infector            06/12/00
        X97M.Automat.AM           File infector            05/22/00
        X97M.DIVI.J               File infector            06/22/00
        X97M.DIVI.K               File infector            06/22/00
        X97M.Divi.G               File infector            05/30/00
        X97M.Divi.H               File infector            06/05/00
        X97M.HJB                  File infector            06/05/00
        X97M.Hongo.B              File infector            06/22/00
        X97M.Laroux.KV            File infector            05/26/00
        X97M.Laroux.KW            File infector            05/30/00
        X97M.Laroux.TT            File infector            06/05/00
        X97M.Manalo.H             File infector            06/05/00
        X97M.Manalo.I             File infector            06/22/00
        X97M.OutlookWorm.Gen      File infector            05/26/00
        X97M.Permnt.A             File infector            06/05/00
        X97M.Toraja.C             File infector            06/12/00
        Zombie.3592               File infector            05/22/00      


Name Changes:

        Old Virus Name            New Virus Name          Date changed
        --------------            --------------          ------------
        VBS.NewLove.A2(gen 1)  to VBS.NewLove.A2(Gen 1)   05/22/00
        W32.Inrar.B            to W32.Inrar.Gen           05/30/00
        W32.Magic.7045.B       to W32.Magic.7045.Gen      05/22/00
        W95.Fosforo.Int        to W95.Fosforo             06/22/00
        W97M.Aquil             to W97M.Heels.B            06/22/00


Deletions:

        Virus Name                Infection Type          Date removed
        ----------                --------------          ------------
        X97M.Automat.AJ           File infector           05/22/00
        XM.Automat.AL             File infector           05/22/00


**********************************************************************
**  Enabling Scanning Features                                      **
**********************************************************************

Several scanning features can be enabled through the use of an INF 
configuration file.  For NAV for Windows 95/NT version 4.x and later, 
or NAV for OS/2, this configuration file should be called NAVEX15.INF
and should be placed in the directory where NAV is installed (i.e.,
C:\Program Files\Norton AntiVirus).  For NAV for Netware version 4.x,
the file should be called NAVEX15.INF and should be placed in the 
directory where NAV 4.x is installed (i.e., sys:system\navnlm). For
NAV for Windows 95/NT version 2.0, NAV 4.x for Windows 3.1/DOS,
NAVIEG 1.x, or NAVFW 1.x, the file should be named NAVEX.INF and
should be placed in the directory where NAV is installed (i.e., C:\NAV).
If this configuration file does not exist, create one in the appropriate
directory if you want to change the default settings.

To enable a scanning feature for a particular component, one or more 
entries need to be added to the configuration file under the correct
section.  For each platform there is a corresponding section that is used 
in the INF file.  Below is a table of section names and platforms.

Section Name    Platform
------------    --------
NAVW32          Windows 95/98/NT
NAVAP           Windows 95/98/NT Auto-Protect
NAVDX           DOS
NAVNLM          Netware
NAVWIN          Windows 3.1
NAVOS2          OS/2
NAVAIX          AIX
NAVSOL          Solaris

Entries are case insensitive.  Below is a description of possible 
entries.

1. Files can be excluded from scans by the NAVEX engine.  To exclude a
specific file from the NAVEX engine scan, add an entry with the full
path and file name.  This is case insensitive.  No wildcards are allowed.
To exclude multiple files, add a separate entry for each file.  To exclude
a file, add an entry like the one below where <PATH> is the full path
and file name.
        ExcludeFile = <PATH>

2. Files within a directory can be excluded from scans by the NAVEX engine.
To exclude all files within a directory, add an entry with the full 
directory path.  This is case insensitive.  No wildcards are allowed.  This
does not exclude files located in subdirectories of the specified 
directory.  To exclude multiple directories, add a separate entry for each
directory. To exclude a directory, add an entry like the one below where
<DIRECTORY> is the full path.
        ExcludeDirectory = <DIRECTORY>

The following example of an INF configuration file excludes two files, 
NOSCAN.EXE and BIGFILE.DOC, from NAVEX scans for the Windows 95/98/NT 
scanner.  It excludes the D:\PRIVATE directory from Windows 95/98/NT 
Auto-Protect.

[NAVW32]
ExcludeFile = C:\PROGRAM FILES\NOSCAN.EXE
ExcludeFile = C:\TEMP\BIGFILE.DOC

[NAVAP]
ExcludeDirectory = D:\PRIVATE

**********************************************************************
**    Additional Information                                        **
**********************************************************************

Additional information regarding this virus definitions update can be
found in UPDATE.TXT and TECHNOTE.TXT.
