New Computer Virus Spreads by E-mail and Triggers On Christmas Day; Symantec Automatically Provides Cure for W97M.Prilissa.A Through Its Macro Engine and Heuristic Technologies.

CUPERTINO, Calif.--(BUSINESS WIRE)--Nov. 22, 1999--

Symantec Corp. (Nasdaq:SYMC) today announced that users of Norton AntiVirus are automatically protected against a new self-propagating virus called W97M.Prilissa.A, by using the industry's most advanced and effective virus detection technology.

The virus, which has been reported to be circulating on computers worldwide, infects Microsoft Word 97 documents and spreads itself by sending the infected document as an e-mail attachment using MS Outlook to the first 50 addresses in each address book. The subject line reads "Message From (username)." The text in the body of the message reads "This document is very Important and you've GOT to read this!!!" When the infected document is opened, the virus disables virus protection security settings, conversion confirmation and recently opened file list.

Additionally, the W97M.Prilissa.A virus checks the system date to trigger its payloads. On December 25, the following text will be displayed in a message box when users boot their machines: "Vine... Vide... Vice... Moslem Power Never End...You Dare Rise Against Me...The Human Era is Over, The CyberNET Era Has Come!!!" It then overlays several colored shapes onto the opened document, overwrites the AUTOEXEC.BAT file to format the C: drive, and displays the following text when the system is rebooted: "Vine...Vide...Vice...Moslem Power Never End...Your Computer Have Just Been Terminated By -= CyberNET =- Virus!!"

"Symantec was able to provide automatic detection and repair using our state-of-the-art macro virus detection and heuristic technologies," said Vincent Weafer, director of the Symantec AntiVirus Research Center at Symantec Corp. "Our customers can be assured that by continuing to update their definitions on a regular basis, they will be protected with the industry's most advanced anti-virus technology."

Symantec's advanced macro variant and heuristic technology detected W97M.Prilissa.A as a variant of the W97M.AntiSocial.G and W97M.Melissa viruses. Macro variant technology analyzes the actions and commands used by a set of viruses and leverages this to detect unknown viruses with the same characteristics. Heuristic technology enables virus detection by analyzing a multitude of viruses, and identifying certain common traits that all viruses share. All Norton AntiVirus products incorporate both macro variant detection technology and Symantec's advanced heuristic technology, Bloodhound, which has to date been able to detect more than 90 percent of new and unknown macro viruses. Norton AntiVirus customers can download the current virus definition set, which includes a cure for the W97M.Prilissa.A virus, through Symantec's LiveUpdate feature or from the Symantec Web site at www.symantec.com/avcenter/download.html.

Symantec AntiVirus Research Center

SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec

Symantec, a world leader in Internet security technology, provides content security solutions to enterprise organizations and helps companies manage and support workforces that use laptop computers and other mobile devices.

FORWARD LOOKING STATEMENT: This press release contains forward-looking statements. There are certain important factors that could cause Symantec's future development efforts to differ materially from those anticipated by some of the statements made above. Among these are the anticipation of the growth of certain market segments, the positioning of Symantec's products in those segments, the competitive environment in the software industry, dependence on other products, changes to operating systems and product strategy by vendors of operating systems, and the importance of new Symantec products. Additional information concerning those and other factors is contained in the "Risk Factors" section of the company's annual report on Form 10-K for the fiscal year ended April 2, 1999.

Note to Editors: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.