Symantec Warns of New Computer Worm With File Damaging Payload.

Business Editors & High-tech Writers

CUPERTINO, Calif.--(BUSINESS WIRE)--May 26, 2000

Symantec Corp. (Nasdaq:SYMC) today announced that researchers at the Symantec AntiVirus Research Center (SARC) identified W97M.Melissa.BG (alias W97.Resume.A) -- an extremely fast-spreading computer worm that uses Microsoft Outlook to e-mail itself as an attachment.

Characteristics of Infection

W97M.Melissa.BG is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "Resume - Janet Simmons" along with an attachment called "RESUME1.DOC."

Payload

W97M.Melissa.BG a macro virus that has an unusual payload. When a user opens an infected document, the virus will attempt to e-mail a copy of the document to everyone in the user's Microsoft Outlook address book. The virus also copies itself to "C:\Data\Normal.dot" and to "C:\WINDOWS\Start Menu\Programs\StartUp\Explorer.doc."

Once the user closes the document, the virus attempts to delete the following files:

C:\*.* C:\My Documents\*.* C:\WINDOWS\*.* C:\WINDOWS\SYSTEM\*.* C:\WINNT\*.* C:\WINNT\SYSTEM32\*.* All files in drives A through Z

The body of the e-mail sent is as follows:

To: Director of Sales/Marketing,

Attached is my resume with a list of references contained within. Please feel free to call or email me if you have any further questions regarding my experience. I am looking forward to hearing from you.

Sincerely,

Janet Simons.

Recommendations/Protection

SARC recommends administrators filter for the attachment name and subject line immediately.

Symantec AntiVirus Research Center

SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec

Symantec, a world leader in Internet security technology, provides a broad range of content and network security solutions to individuals and companies. The company is a leading provider of virus protection, risk management, Internet content and e-mail filtering, and mobile code detection technologies to enterprise customers. Headquartered in Cupertino, Symantec has worldwide operations in more than 24 countries.

Note to Editors: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in U.S. dollars and are valid only in the United States.