**********************************************************************
**                                                                  **
**  What's New in the NAV Virus Definitions Files      WHATSNEW.TXT **
**                                                                  **
**  Symantec AntiVirus Research Center (SARC)        August 28,2000 **
**                                                                  **
**********************************************************************
This document contains the following topics:

 * Virus Alerts
 * New Technologies
 * Changes Incorporated Into This Update
 * Enabling Scanning Features
 * Additional Information

**********************************************************************
** Virus Alerts                                                     **
**********************************************************************
VBS.LoveLetter, a new worm which has been wide-spread since May 4th,
is detected by this definition set.  

The ten most commonly reported viruses, worldwide:

    1  VBS.LoveLetter.A
    2  WScript.KakWorm
    3  VBS.Network
    4  W95.CIH
    5  Happy99.Worm
    6  Worm.ExploreZip
    7  W97M.ColdApe
    8  W97M.Ethan
    9  W97M.Melissa
   10  WM.Cap

**********************************************************************
** New Technologies                                                 **
**********************************************************************

DATE         Technologies Added
----         ------------------
8/19/98    * Excel heuristics which detect and repair new and unknown
             macro viruses in Excel 95 & 97 documents.

9/16/98    * Added repair for encrypted Excel 97 documents.

10/21/98   * Heuristics to detect AOL Password Stealer Trojans.
           * WORD Heuristics improvement to increase detection rate.

12/17/98   * Macro Exclusion Engine to speed up the scanning for Word
             and Excel documents.
           * PowerPoint engine to scan PowerPoint related viruses.
             To enable this technology please read "Enabling/Disabling
             PowerPoint Scanning" section later in this document.

02/18/99   * Detection and repair of macro viruses in Word and Excel
             2000 documents.

05/15/99   * Added repair for PowerPoint viruses.
           * Improved heuristics to detect more WORD 97 related
             viruses.

06/10/99   * Menu repair technology for WORD macro viruses that change
             command bar customizations in NORMAL.DOT.

07/12/99   * Added support for scanning of Ichitaro 8/9 documents.
             (Ichitaro is a Japanese word processing program).

08/19/99   * Added detection and repair for embedded documents inside
             PowerPoint 97.

11/22/99   * Added detection and repair for Trojans embedded in OLE
             files, such as Windows scrap files and MS Office
             documents.
           * Added detection for viruses which infect Microsoft
             Project documents (P98M.Corner.A, for example).

02/10/00   * Added support for scanning of UNIX executables.
           * Added detection for infected Visio documents.

**********************************************************************
** Changes Incorporated Into This Virus Definitions Update          **
**********************************************************************
New virus definitions (by Virus Name):

        Virus Name                Infection Type          Week added
        ----------                --------------          ----------
        Ani (b)                   Boot infector            08/28/00
        Backdoor.Bla.Trojan       File infector            08/17/00
        Backdoor.ColdLoad         File infector            07/31/00
        Backdoor.DRA              File infector            08/17/00
        Backdoor.DeepThroat.C     File infector            08/07/00
        Backdoor.DialUp           File infector            08/14/00
        Backdoor.GOL              File infector            08/17/00
        Backdoor.Gecky            File infector            07/31/00
        Backdoor.HackTack         File infector            08/14/00
        Backdoor.IRC.Pure         File infector            08/14/00
        Backdoor.Iexplore5        File infector            08/17/00
        Backdoor.Intended         File infector            07/31/00
        Backdoor.LittleWitch      File infector            07/31/00
        Backdoor.Matrix           File infector            08/07/00
        Backdoor.Mosuc            File infector            08/07/00
        Backdoor.Vampire          File infector            08/14/00
        Backdoor.Zomby            File infector            07/31/00
        BarokPWSteal.Trojan       File infector            07/31/00
        Cute.707                  File infector            08/17/00
        Dial900.Aga               File infector            08/17/00
        HTA.Xoom.Trojan           File infector            07/31/00
        HackTool.PWSteal          File infector            08/28/00
        Halloween.1839            File infector            08/28/00
        IRC.Plus.Worm             File infector            08/28/00
        IRCWorm.Sleeper.p         File infector            08/17/00
        IRCWorm.Wally             File infector            08/28/00
        Initwo.Trojan             File infector            08/17/00
        Interna.Trojan            File infector            07/31/00
        Irok.7840                 File infector            08/28/00
        Irok.7840 (2)             File infector            08/28/00
        JeruVespa.1143            File infector            08/14/00
        JeruVespa.1143            File infector            08/17/00
        Kill98.Absturz            File infector            08/17/00
        Mag.Trojan                File infector            08/14/00
        Mag.Trojan                File infector            08/17/00
        Malatinec.2396            File infector            08/07/00
        Malatinec.2396 (m)        File infector            08/07/00
        O97M.Codemas.A            File infector            08/14/00
        O97M.Codemas.A            File infector            08/17/00
        O97M.Toraja.D             File infector            08/14/00
        O97M.Toraja.D             File infector            08/17/00
        PWS.Gif.Trojan            File infector            08/07/00
        PWS.PKG.Trojan            File infector            08/17/00
        PWSTEAL.AcidShivers       File infector            08/17/00
        PWSteal.DUN.Trojan        File infector            07/31/00
        PWSteal.Enjoy             File infector            07/31/00
        PWSteal.KeyGen            File infector            08/28/00
        PWSteal.OneTime           File infector            07/31/00
        Palm.Liberty.A            File infector            08/28/00
        Plage.Worm                File infector            08/28/00
        Qaz.Trojan                File infector            07/31/00
        SSIWG.Worm                File infector            08/28/00
        Trojan.Chico              File infector            08/28/00
        Trojan.Sexu               File infector            08/28/00
        VBS.Jackal                File infector            08/28/00
        VBS.LoveLetter.BD         File infector            08/14/00
        VBS.Rename.Trojan         File infector            08/14/00
        VBS.Saur.A                File infector            07/31/00
        VBS.Token                 File infector            07/31/00
        VBS.Winter                File infector            07/31/00
        VBS.Winter.B              File infector            08/07/00
        W2000M.Gargle             File infector            08/28/00
        W32.FunLove.4099(drop)    File infector            07/31/00
        W32.FunLove.4099.dr       File infector            08/28/00
        W32.FunLove.4099.dr 2     File infector            08/28/00
        W32.HLLP.GhostDog.B       File infector            08/14/00
        W32.HLLP.STD.A            File infector            08/14/00
        W32.HLLP.STD.B            File infector            08/14/00
        W32.HLLP.STD.B.Mirc       File infector            08/14/00
        W32.HLLP.Semisoft.J       File infector            08/14/00
        W32.HLLW.Qaz.B            File infector            08/14/00
        W32.HLLW.Qaz.C            File infector            08/14/00
        W32.HLLW.Qaz.D            File infector            08/14/00
        W32.Infinite.1661         File infector            08/14/00
        W32.Mircup.A              File infector            08/07/00
        W32.Mircup.A.Mirc         File infector            08/07/00
        W32.Resure.38400          File infector            08/14/00
        W32.Ultratt.8152          File infector            07/31/00
        W32.Ultratt.8152.Mirc     File infector            07/31/00
        W32.Wolf.4096.B.Int       File infector            08/07/00
        W95.Chime.1542            File infector            08/07/00
        W95.Daw.1262              File infector            08/28/00
        W95.Merinos.1704          File infector            08/07/00
        W95.Mystery.2544          File infector            08/07/00
        W95.Oisdbo                File infector            08/17/00
        W95.Oisdbo (dll)          File infector            08/17/00
        W95.Oisdbo.dr             File infector            08/28/00
        W95.Oisdbo.dr (2)         File infector            08/28/00
        W95.Oisdbo.dr (3)         File infector            08/28/00
        W95.Oisdbo.worm           File infector            08/17/00
        W97M.AntiCor              File infector            08/28/00
        W97M.Astia.AI             File infector            08/07/00
        W97M.Bablas.AJ            File infector            08/07/00
        W97M.Bablas.AV            File infector            08/07/00
        W97M.Basic                File infector            08/17/00
        W97M.Dariem.A             File infector            07/31/00
        W97M.Este.A               File infector            07/31/00
        W97M.Jackal               File infector            08/28/00
        W97M.Marker.T             File infector            08/28/00
        W97M.Nidoc.B              File infector            08/17/00
        W97M.Onex.B               File infector            08/14/00
        W97M.Onex.B               File infector            08/17/00
        W97M.Rendra.B             File infector            08/07/00
        W97M.Sap                  File infector            08/28/00
        W97M.Scar.Int             File infector            08/28/00
        W97M.Serpent              File infector            08/28/00
        W97M.String               File infector            08/28/00
        W97M.Thus.AC              File infector            08/07/00
        W97M.Thus.AJ              File infector            08/17/00
        W97M.Thus.X.Family        File infector            08/28/00
        W97M.VMPCK1.BL            File infector            07/31/00
        W97M.VMPCK1.BP            File infector            08/17/00
        W97M.VMPCK1.BQ            File infector            08/28/00
        W97M.VMPCK1.BR            File infector            08/28/00
        W97M.WallyDrop            File infector            08/28/00
        WM.Concept.ZZ             File infector            08/07/00
        WM.Wazzu.Intd             File infector            08/07/00
        WScript.GodMessage.int    File infector            08/17/00
        Win.Non.31995.B           File infector            08/07/00
        X97M.BadBoy               File infector            08/28/00
        X97M.BadBoy.B             File infector            08/28/00
        X97M.Barisada.B           File infector            08/07/00
        X97M.Barisada.C           File infector            08/17/00
        X97M.Barisada.D           File infector            08/28/00
        X97M.Barisada.Var         File infector            08/28/00
        X97M.Confused             File infector            08/28/00
        X97M.Jini.A1              File infector            08/28/00
        X97M.Killer               File infector            07/31/00
        X97M.Laroux.TX            File infector            07/31/00
        X97M.Laroux.TZ            File infector            08/17/00
        X97M.Manalo.Intd          File infector            08/07/00
        X97M.Swap.int             File infector            08/28/00


New virus definitions (by Week added):

        Virus Name                Infection Type          Week added
        ----------                --------------          ----------
        Irok.7840                 File infector            08/28/00
        Irok.7840 (2)             File infector            08/28/00
        W32.FunLove.4099.dr       File infector            08/28/00
        W32.FunLove.4099.dr 2     File infector            08/28/00
        W95.Oisdbo.dr             File infector            08/28/00
        W95.Oisdbo.dr (2)         File infector            08/28/00
        W95.Oisdbo.dr (3)         File infector            08/28/00
        W97M.Scar.Int             File infector            08/28/00
        X97M.BadBoy.B             File infector            08/28/00
        X97M.Barisada.Var         File infector            08/28/00
        Ani (b)                   Boot infector            08/28/00
        Palm.Liberty.A            File infector            08/28/00
        Trojan.Sexu               File infector            08/28/00
        W97M.VMPCK1.BQ            File infector            08/28/00
        W97M.Serpent              File infector            08/28/00
        W97M.AntiCor              File infector            08/28/00
        W97M.String               File infector            08/28/00
        W97M.WallyDrop            File infector            08/28/00
        IRCWorm.Wally             File infector            08/28/00
        W2000M.Gargle             File infector            08/28/00
        W97M.Sap                  File infector            08/28/00
        W97M.Thus.X.Family        File infector            08/28/00
        W97M.VMPCK1.BR            File infector            08/28/00
        X97M.Confused             File infector            08/28/00
        X97M.Swap.int             File infector            08/28/00
        SSIWG.Worm                File infector            08/28/00
        Trojan.Chico              File infector            08/28/00
        Plage.Worm                File infector            08/28/00
        PWSteal.KeyGen            File infector            08/28/00
        IRC.Plus.Worm             File infector            08/28/00
        Halloween.1839            File infector            08/28/00
        W97M.Marker.T             File infector            08/28/00
        W95.Daw.1262              File infector            08/28/00
        W97M.Jackal               File infector            08/28/00
        VBS.Jackal                File infector            08/28/00
        X97M.BadBoy               File infector            08/28/00
        X97M.Barisada.D           File infector            08/28/00
        HackTool.PWSteal          File infector            08/28/00
        X97M.Jini.A1              File infector            08/28/00
        Kill98.Absturz            File infector            08/17/00
        Backdoor.DRA              File infector            08/17/00
        X97M.Laroux.TZ            File infector            08/17/00
        Backdoor.GOL              File infector            08/17/00
        Backdoor.Iexplore5        File infector            08/17/00
        Backdoor.Bla.Trojan       File infector            08/17/00
        Cute.707                  File infector            08/17/00
        Dial900.Aga               File infector            08/17/00
        X97M.Barisada.C           File infector            08/17/00
        IRCWorm.Sleeper.p         File infector            08/17/00
        Initwo.Trojan             File infector            08/17/00
        JeruVespa.1143            File infector            08/17/00
        WScript.GodMessage.int    File infector            08/17/00
        W97M.Basic                File infector            08/17/00
        Mag.Trojan                File infector            08/17/00
        O97M.Codemas.A            File infector            08/17/00
        W97M.VMPCK1.BP            File infector            08/17/00
        O97M.Toraja.D             File infector            08/17/00
        PWS.PKG.Trojan            File infector            08/17/00
        W97M.Thus.AJ              File infector            08/17/00
        PWSTEAL.AcidShivers       File infector            08/17/00
        W95.Oisdbo                File infector            08/17/00
        W95.Oisdbo (dll)          File infector            08/17/00
        W95.Oisdbo.worm           File infector            08/17/00
        W97M.Onex.B               File infector            08/17/00
        W97M.Nidoc.B              File infector            08/17/00
        W97M.Onex.B               File infector            08/14/00
        W32.HLLP.GhostDog.B       File infector            08/14/00
        Mag.Trojan                File infector            08/14/00
        Backdoor.DialUp           File infector            08/14/00
        Backdoor.HackTack         File infector            08/14/00
        W32.Resure.38400          File infector            08/14/00
        O97M.Codemas.A            File infector            08/14/00
        VBS.LoveLetter.BD         File infector            08/14/00
        Backdoor.IRC.Pure         File infector            08/14/00
        W32.HLLP.STD.A            File infector            08/14/00
        Backdoor.Vampire          File infector            08/14/00
        W32.HLLP.STD.B            File infector            08/14/00
        W32.HLLP.STD.B.Mirc       File infector            08/14/00
        JeruVespa.1143            File infector            08/14/00
        W32.HLLP.Semisoft.J       File infector            08/14/00
        VBS.Rename.Trojan         File infector            08/14/00
        O97M.Toraja.D             File infector            08/14/00
        W32.HLLW.Qaz.C            File infector            08/14/00
        W32.HLLW.Qaz.B            File infector            08/14/00
        W32.Infinite.1661         File infector            08/14/00
        W32.HLLW.Qaz.D            File infector            08/14/00
        W32.Mircup.A              File infector            08/07/00
        W32.Wolf.4096.B.Int       File infector            08/07/00
        W95.Chime.1542            File infector            08/07/00
        W95.Merinos.1704          File infector            08/07/00
        W95.Mystery.2544          File infector            08/07/00
        W97M.Rendra.B             File infector            08/07/00
        W97M.Astia.AI             File infector            08/07/00
        W32.Mircup.A.Mirc         File infector            08/07/00
        W97M.Bablas.AJ            File infector            08/07/00
        W97M.Bablas.AV            File infector            08/07/00
        W97M.Thus.AC              File infector            08/07/00
        VBS.Winter.B              File infector            08/07/00
        Backdoor.Matrix           File infector            08/07/00
        PWS.Gif.Trojan            File infector            08/07/00
        Win.Non.31995.B           File infector            08/07/00
        WM.Concept.ZZ             File infector            08/07/00
        X97M.Manalo.Intd          File infector            08/07/00
        WM.Wazzu.Intd             File infector            08/07/00
        Backdoor.DeepThroat.C     File infector            08/07/00
        Malatinec.2396 (m)        File infector            08/07/00
        X97M.Barisada.B           File infector            08/07/00
        Malatinec.2396            File infector            08/07/00
        Backdoor.Mosuc            File infector            08/07/00
        PWSteal.Enjoy             File infector            07/31/00
        W32.FunLove.4099(drop)    File infector            07/31/00
        Backdoor.ColdLoad         File infector            07/31/00
        W97M.Este.A               File infector            07/31/00
        W32.Ultratt.8152          File infector            07/31/00
        PWSteal.DUN.Trojan        File infector            07/31/00
        Qaz.Trojan                File infector            07/31/00
        PWSteal.OneTime           File infector            07/31/00
        W97M.VMPCK1.BL            File infector            07/31/00
        VBS.Saur.A                File infector            07/31/00
        W32.Ultratt.8152.Mirc     File infector            07/31/00
        VBS.Token                 File infector            07/31/00
        Interna.Trojan            File infector            07/31/00
        X97M.Killer               File infector            07/31/00
        VBS.Winter                File infector            07/31/00
        W97M.Dariem.A             File infector            07/31/00
        HTA.Xoom.Trojan           File infector            07/31/00
        X97M.Laroux.TX            File infector            07/31/00
        Backdoor.Intended         File infector            07/31/00
        Backdoor.LittleWitch      File infector            07/31/00
        BarokPWSteal.Trojan       File infector            07/31/00
        Backdoor.Zomby            File infector            07/31/00
        Backdoor.Gecky            File infector            07/31/00


Name Changes (by Old Virus Name):

        Old Virus Name            New Virus Name          Date changed
        --------------            --------------          ------------
        Qaz.Trojan             to W32.HLLW.Qaz.A           08/14/00
        W32.Evol.A             to W32.Evol.Gen             07/24/00
        X97M.HJB               to X97M.Barisada.A          08/07/00

Name Changes (by Date changed):

        Old Virus Name            New Virus Name          Date changed
        --------------            --------------          ------------
        Qaz.Trojan             to W32.HLLW.Qaz.A           08/14/00
        X97M.HJB               to X97M.Barisada.A          08/07/00

Deletions (by Virus Name):

        Virus Name                Infection Type          Date removed
        ----------                --------------          ------------
        Infector.10217            File infector            08/14/00
        Netbus 2.01 Trojan 7      File infector            07/31/00
        Netbus 2.01 Trojan 8      File infector            08/17/00
        Netbus 2.01 Trojan 9      File infector            08/17/00
        Netbus 2.01 Trojan 10     File infector            07/31/00        
        Netbus 2.01 Trojan 11     File infector            08/17/00
        Netbus 2.01 Trojan 12     File infector            08/17/00

Deletions (by Date removed):

        Virus Name                Infection Type          Date removed
        ----------                --------------          ------------
        Netbus 2.01 Trojan 9      File infector            08/17/00
        Netbus 2.01 Trojan 12     File infector            08/17/00
        Netbus 2.01 Trojan 11     File infector            08/17/00
        Netbus 2.01 Trojan 8      File infector            08/17/00
        Infector.10217            File infector            08/14/00
        Netbus 2.01 Trojan 10     File infector            07/31/00        
        Netbus 2.01 Trojan 7      File infector            07/31/00
        AntiCAD.4096.Dan (x)      File and Boot infector   07/24/00
        Bloodhound.VBS.Worm       File infector            07/24/00

**********************************************************************
**  Enabling Scanning Features                                      **
**********************************************************************

Several scanning features can be enabled through the use of an INF 
configuration file.  For NAV for Windows 95/NT version 4.x and later, 
or NAV for OS/2, this configuration file should be called NAVEX15.INF
and should be placed in the directory where NAV is installed (i.e.,
C:\Program Files\Norton AntiVirus).  For NAV for Netware version 4.x,
the file should be called NAVEX15.INF and should be placed in the 
directory where NAV 4.x is installed (i.e., sys:system\navnlm). For
NAV for Windows 95/NT version 2.0, NAV 4.x for Windows 3.1/DOS,
NAVIEG 1.x, or NAVFW 1.x, the file should be named NAVEX.INF and
should be placed in the directory where NAV is installed (i.e., C:\NAV).
If this configuration file does not exist, create one in the appropriate
directory if you want to change the default settings.

To enable a scanning feature for a particular component, one or more 
entries need to be added to the configuration file under the correct
section.  For each platform there is a corresponding section that is used 
in the INF file.  Below is a table of section names and platforms.

Section Name    Platform
------------    --------
NAVW32          Windows 95/98/NT
NAVAP           Windows 95/98/NT Auto-Protect
NAVDX           DOS
NAVNLM          Netware
NAVWIN          Windows 3.1
NAVOS2          OS/2
NAVAIX          AIX
NAVSOL          Solaris

Entries are case insensitive.  Below is a description of possible 
entries.

1. Files can be excluded from scans by the NAVEX engine.  To exclude a
specific file from the NAVEX engine scan, add an entry with the full
path and file name.  This is case insensitive.  No wildcards are allowed.
To exclude multiple files, add a separate entry for each file.  To exclude
a file, add an entry like the one below where <PATH> is the full path
and file name.
        ExcludeFile = <PATH>

2. Files within a directory can be excluded from scans by the NAVEX engine.
To exclude all files within a directory, add an entry with the full 
directory path.  This is case insensitive.  No wildcards are allowed.  This
does not exclude files located in subdirectories of the specified 
directory.  To exclude multiple directories, add a separate entry for each
directory. To exclude a directory, add an entry like the one below where
<DIRECTORY> is the full path.
        ExcludeDirectory = <DIRECTORY>

The following example of an INF configuration file excludes two files, 
NOSCAN.EXE and BIGFILE.DOC, from NAVEX scans for the Windows 95/98/NT 
scanner.  It excludes the D:\PRIVATE directory from Windows 95/98/NT 
Auto-Protect.

[NAVW32]
ExcludeFile = C:\PROGRAM FILES\NOSCAN.EXE
ExcludeFile = C:\TEMP\BIGFILE.DOC

[NAVAP]
ExcludeDirectory = D:\PRIVATE

**********************************************************************
**    Additional Information                                        **
**********************************************************************

Additional information regarding this virus definitions update can be
found in UPDATE.TXT and TECHNOTE.TXT.
