SYMANTEC CORPORATION - PETER NORTON GROUP
README.TXT file for Norton Virus Scan

Welcome to Norton Virus Scan!

This file contains information about Norton Virus Scan, a scan-only 
version of Norton AntiVirus. Full versions of Norton AntiVirus are 
available for DOS/Windows 3.1, Windows 95, and Novell NetWare.

Please read the WIN95NAV.TXT file if you have downloaded Norton 
Virus Scan to check for viruses before you install Windows 95.

To print this file from the DOS prompt, type:
		
		COPY README.TXT PRN:

This document has four sections:

1. Technical Support Information: where to go for help on using 
   Norton Virus Scan.
2. Ordering Information: tells you how to order the complete version 
   of Norton AntiVirus.
3. Technical Information: includes information about the complete 
   version of Norton AntiVirus.
4. General Virus Information: describes the most common DOS viruses.


TECHNICAL SUPPORT INFORMATION

Recorded technical support information for the Norton Virus Scan is 
available from our 24-hour Virus Newsline at 1-503-465-8555.


ORDERING INFORMATION

To purchase the complete version of Norton AntiVirus for Windows and 
DOS, see your local dealer or call one of the following numbers:

United States:          1-800-441-7234
Europe(Holland):        31-71-353-111
United Kingdom:         01628-592-222
Germany:                02-11-99170
France:                 01-41-38-69-69
Australia:              02-879-6577
Canada:                 1-416-366-0423
Italy:                  2-550-12266
Other countries:        1-503-334-6054


TECHNICAL INFORMATION

To launch Norton Virus Scan, type NAVSCAN at the DOS prompt.

This freeware version of Norton AntiVirus does not offer all of 
the features available in the complete version of Norton 
AntiVirus.  It is designed to scan executable files for viruses
(viruses cannot infect data files), remove boot infector viruses
(viruses that infect boot MBR or boot records) and give you an
overview of the full Norton AntiVirus program.  This version will 
NOT repair infected files and does NOT provide an automatic
monitoring program.

The complete version of Norton AntiVirus is a comprehensive 
solution for preventing viruses from infecting your computer.  
It detects and removes over 5,300 known viruses and virus 
strains. In addition, it protects against unknown viruses by 
monitoring your system for irregular file activity. Should 
Norton AntiVirus detect an infection, it can repair most 
infected files quickly and easily before the virus damages your 
system. Norton AntiVirus is available for DOS/Windows 3.1 and
Windows 95.

In addition, Norton AntiVirus features the following:

Auto-Protect - A memory-resident device driver or TSR (VxD on
Windows 95) that protects your system against infection while 
you are working in other applications.  It detects both known 
and unknown viruses.  With its patent-pending Virus Sensor 
Technology, it will catch unknown viruses BEFORE they infect 
your system.  It can repair, delete, or even halt your computer 
when a virus is found.  With its unique ability to scan files 
when they are created, you are assured that a virus won't end 
up on your computer after uncompressing an archived ZIP file, 
for example.  It can protect your system areas from alteration 
and will also check floppy disks when first accessed and when 
you reboot your computer.  The DOS Auto-Protect TSR can be 
loaded in EMS, HMA, UMBs, High Memory, or conventional memory.  
In fact, it can load different parts of itself in different 
types of memory.  It is a dynamic-memory protection system.  
That means that the memory usage will grow and shrink depending 
upon which features you enable or disable.  Auto-Protect 
requires as little as 5K RAM. The Windows 95 Auto-Protect VxD 
takes no DOS memory. 

Scanner - The full screen application that scans your 
computer's memory and drives for the presence of known and 
unknown viruses.  It is here that you can also configure all 
aspects of Norton AntiVirus, view the Virus List, or view the 
Activity Log or Infection Log (these features are described 
later in this file).  The Scanner can check ZIP 1.x or 2.x 
compressed files for viruses, without the need to first 
uncompress them.  It is the fastest virus scanner on the market 
today. 

Flexible scanning features - Norton AntiVirus can be configured 
to quickly check your entire computer system for virus 
infection.  Scanning can be set to occur every time you start
your computer, or only on demand.  Also included is a Windows 
Scheduler, so you can specify the exact time to perform a scan. 
You can execute a scan of your entire system in the background, 
while working within your word processor or other application.

Virus updates - Norton AntiVirus lets you upgrade your virus
protection without having to wait for software updates. 
Symantec's 24-hour Virus Newsline offers access to the latest- 
breaking news about new viruses and instructions on how to 
protect your system from them.  Virus updates can be downloaded
from the Symantec BBS or CompuServe, or obtained on disk from 
the Norton AntiVirus subscription update service.

Configurable options - Gives you complete control over the way 
Norton AntiVirus operates. Norton AntiVirus is the most
configurable anti-virus product on the market. For example, 
when a virus is found, you can specify exactly what to do with 
it (delete it, repair it, prompt the user, halt the computer, 
or just notify the user). Another example is the ability to
specify how to alert the user or others when a virus is found 
(generate audible alerts, display a custom message, alert 
network users, alert the network console, or alert Norton
AntiVirus for NetWare NLM). 

Unique Exclusions List - You can exclude a drive, directory, or 
list of files from being checked for different operations. For 
example, suppose you want your FORMAT program to be able to 
write to the boot record of a floppy disk. You can easily 
exclude it from being checked. There are 8 different 
operations from which you can exclude particular files or 
directories of your choice. Norton AntiVirus is the only 
anti-virus product that provides this type of flexibility. 

Inoculation - For industrial-strength protection, you can 
inoculate your system against future unknown viruses. Norton 
AntiVirus can inoculate not only your files, but also your 
system areas, such as the boot records and master boot records. 

Password Protection - Almost every feature of Norton AntiVirus 
can be password protected. For example, you may not want 
anyone removing virus definitions from the Virus List. You can
protect only that feature of Norton AntiVirus, or you can 
password-protect all options. In this way you can ensure that
only you are able to make configuration changes. 

Virus List - Norton AntiVirus has full details on over 5,300
viruses and virus strains. You can look up the symptoms of a 
particular virus or what effect it will have once it is 
triggered.

Network Features - Norton AntiVirus has many features for the 
corporate environment. It has the most configuration options 
of all anti-virus products. This means you can configure it to
work the way your organization works. In addition, if a virus 
is found it can notify other users, notify Norton AntiVirus for
NetWare NLM, or notify network consoles. Norton AntiVirus can
be configured to password-protect specific features, so only
selected users can access certain features. With the multipack
version, you get NavUpdate, which provides centralized
configuration, installation, and updating of Norton AntiVirus
and virus definitions. You will no longer have to go from
workstation to workstation installing or updating Norton
AntiVirus. Also, Norton AntiVirus works on all major network
environments, including Novell NetWare, 3Com OPEN, OS/2 LAN
Manager, AT&T Starlan and more.

Activity Log and Infection Log - All activity is tracked in
an Activity Log and Infection Log. You can specify which events
should be logged and can also restrict the size of the log 
file. When you view the log file, you can filter it, so you 
can zoom in on exactly what you are looking for. 

Integrated DOS and Windows application - Norton AntiVirus is 
both a complete Windows application and an easy-to-use DOS 
program, offering comprehensive virus defense for both DOS and 
Windows users. 

System Requirements (DOS/Windows 3.1): 
IBM PC AT, PS/2 or compatible
DOS 3.1 or higher 
512K RAM 
RAM-resident option requires as little as 5K RAM 
Compatible with Microsoft Windows 3.1 or later 
Works with any floppy disk, hard disk, or removable media 
Mouse support 
Network compatible with Novell NetWare, 3Com OPEN, 
  OS/2 LAN Manager and more

System Requirements (Windows 95): 
IBM or 100% compatible 
Windows 95
Intel 80386DX or higher
4MB of RAM required (8MB recommended)
6MB hard disk required
Works with any floppy disk, hard disk, or removable media 
Network compatible with Novell NetWare, 3Com OPEN, 
  OS/2 LAN Manager and more


GENERAL VIRUS INFORMATION
 
The most common DOS viruses are as follows: 

Stoned: 
  This is the most common virus. It infects the hard disk
  partition table and floppy disk boot records. The virus often
  displays the message "Your PC is now stoned."

Michelangelo: 
  The Michelangelo virus activates itself on March 6th,
  the anniversary of Michelangelo's birth. The Michelangelo
  virus is spread only by floppy disks, not over networks or by
  connecting to electronic on-line services and bulletin boards.
  The virus is transferred to memory and hard disks when an
  attempt is made to start (boot) your computer from a floppy
  disk that is infected. The floppy disk does not have to be a
  bootable floppy disk; it can be a floppy disk with data files
  on it. Once the virus is on your hard disk, it will infect
  every floppy disk that you put in your computer, thereby
  creating further infections that help it continue to spread.

  If a computer is infected with Michelangelo when it is started
  on March 6th, the virus will format the hard disk, irretrievably 
  destroying all data.


NoINT (Bloomington, Stoned III):
  This virus is very similar to Stoned and Michelangelo. It
  infects the hard disk partition table and floppy disk boot
  records. It often causes corruption of root directory entries,
  making it difficult to properly retrieve your data.

Form:
  The Form virus is a very common infector of boot records.
  It sometimes displays the message "The FORM-Virus sends
  greetings to everyone who's reading this text."  It may
  also cause the system speaker to emit a "clicking" noise.

Joshi: 
  Activates on January 5th.
  The Joshi virus is a stealth infector of floppy disk boot
  records and hard disk partition tables. On January 5th, it
  activates and displays a message asking the user to type
  "Happy Birthday Joshi."

Jeru.1808 (Jerusalem, Friday the 13th Virus):
  This is the most common file-infecting virus. Some strains
  will delete any files executed on a Friday the 13th. The
  Jerusalem virus can cause an enormous amount of file growth
  due to multiple infections.

Green Caterpillar (1575, 1591):
  The Green Caterpillar virus is another very common file
  infector. It causes infected files to grow by approximately
  1575 to 1591 bytes. The virus may cause a "caterpillar" to
  travel across the user's screen (similar to the arcade game
  of the same name).

Ping-Pong (Italian-A): 
  Ping-Pong is a boot record infector that activates on a random
  basis, sending a white ball bouncing around the screen.

Yankee.44.A (Yankee Doodle, TP44):
  This virus is a memory-resident file infector that may play
  "Yankee Doodle" from the system speaker at 5:00 P.M. and also
  increases an infected program's size.

Azusa (Hong Kong): 
  This virus infects hard disk partition tables and floppy disk
  boot records. It occasionally disables the LPT1 and COM1
  ports. It can also cause floppy drives to fail to notice when
  a diskette is removed and a new one inserted.

DA.1800 (Dark Avenger):
  The Dark Avenger virus infects .COM, .EXE and .SYS files.
  After every sixteenth file is infected, the virus overwrites
  a random sector of the hard disk, destroying any programs or
  data files that happen to be using that sector.


For additional virus information, phone the Symantec Virus 
Newsline at 1-503-465-8555 (available in the USA only). 

** END OF README.TXT **
