New Computer Virus Spreads by E-Mail and Triggers on Christmas Day

Symantec Automatically Provides Cure for W97M.Prilissa.A Through its Macro Engine and Heuristic Technologies

CUPERTINO, Calif. – Nov. 22, 1999 - Symantec Corp. (Nasdaq: SYMC) today announced that users of Norton AntiVirus are automatically protected against a new self-propagating virus called W97M.Prilissa.A, by using the industry's most advanced and effective virus detection technology.

The virus, which has been reported to be circulating on computers worldwide, infects Microsoft Word 97 documents and spreads itself by sending the infected document as an e-mail attachment using MS Outlook to the first 50 addresses in each address book. The subject line reads "Message From ." The text in the body of the message reads "This document is very Important and you've GOT to read this!!!" When the infected document is opened, the virus disables virus protection security settings, conversion confirmation and recently opened file list.

Additionally, the W97M.Prilissa.A virus checks the system date to trigger its payloads. On December 25, the following text will be displayed in a message box when users boot their machines: "Vine!... Vide!... Vice!...Moslem Power Never End! You Dare Rise Against Me! The Human Era is Over, The CyberNET Era Has Come!!!" It then overlays several colored shapes onto the opened document, overwrites the AUTOEXEC.BAT file to format the C: drive, and displays the following text when the system is rebooted: "Vine!...Vide!...Vice!... Moslem Power Never End! Your Computer Have Just Been Terminated By -= CyberNET =- Virus!!"

"Symantec was able to provide automatic detection and repair using our state-of-the-art macro virus detection and heuristic technologies," said Vincent Weafer, director of the Symantec AntiVirus Research Center at Symantec Corp. "Our customers can be assured that by continuing to update their definitions on a regular basis, they will be protected with the industry"s most advanced anti-virus technology."

Symantec's advanced macro variant and heuristic technology detected W97M.Prilissa.A as a variant of the W97M.AntiSocial.G and W97M.Melissa viruses. Macro variant technology analyzes the actions and commands used by a set of viruses and leverages this to detect unknown viruses with the same characteristics. Heuristic technology enables virus detection by analyzing a multitude of viruses, and identifying certain common traits that all viruses share. All Norton AntiVirus products incorporate both macro variant detection technology and Symantec's advanced heuristic technology, Bloodhound, which has to date been able to detect more than 90 percent of new and unknown macro viruses. Norton AntiVirus customers can download the current virus definition set, which includes a cure for the W97M.Prilissa.A virus, through Symantec's LiveUpdate feature or from the Symantec Web site at www.symantec.com/avcenter/download.html.

Symantec AntiVirus Research Center
SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec is a world leader in Internet security technology and technology solutions that help companies manage and support workforces that use laptop computers and other mobile devices.

The company is a leading provider of software products for the consumer market and is rapidly growing its presence as a provider of solutions to enterprise organizations

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, view the Symantec Press Center at www.symantec.com/PressCenter/ on Symantec's Website.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.