
README for Norton AntiVirus 4.0 Beta
=====================================================================
Copyright (c) 1997 by Symantec Corporation. All Rights Reserved.


Table of Contents:
I.     Welcome
II.    System Requirements
III.   Installation Notes
IV.    User Tips, Known Problems, and Problem Work Workarounds
V.     Submitting bug reports and contacting Symantec 


I.  Welcome!
=====================================================================
Welcome to Symantec's Norton AntiVirus Beta for Windows 95. Please
take a few minutes to read this file, which contains the latest
information regarding this release.

We release beta software to provide an opportunity to work with the
product before it's released and for testing purposes.  Beta means
that the product is still under development and is likely to contain
bugs.  We would like your feedback on the product, however, technical
support is not available for beta software.  Please see section VI
for information on contacting Symantec.


II. System Requirements
======================================================================
Norton AntiVirus 4.0 for Windows 95

* IBM PC or 100% compatible
* Windows 95
* Intel 80386 DX or higher (80486 DX or higher recommended) 
* 8 MB of RAM required (16 MB recommended)
* 16 MB hard disk required


III.  Installation Notes
======================================================================
Copy NAV954B.EXE into an empty directory and run the file to expand
the installation files.  As with any new software, please install
Norton AntiVirus into a clean directory. 

The software contains a time-out feature causing it to expire on 
September 22, 1997.  Please note that the final, shipping version 
will not have a time-out feature.


IV.  User Tips, Known Problems, and Problem Work Workarounds  
======================================================================

 1.  Problems with Helix Nuts & Bolts
 2.  NAVHEAVY.DAT and NAVFALSE.DAT
 3.  Inoculation Change Alerts
 4.  AUTOEXEC.BAT and NAVDX.EXE
 5.  Automatic Protection and Downloading Software
 6.  Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)
 7.  Modifying Rescue Disks
 8.  Win 95 System Shutdown and Auto-Protect
 9.  Novell Client32 for Windows 95
 10. "HIMEM.SYS is missing" Message when Restarting Your Computer
 11. Named Pipes and Auto-Protect
 12. Creating a test text file that looks like a virus


1. Problems with Helix Nuts & Bolts
-----------------------------------
Helix Software's Nuts & Bolts has compatibility problems with Norton
AntiVirus at this time. We do not recommend running these programs
simultaneously.

2. NAVHEAVY.DAT and NAVFALSE.DAT
--------------------------------
This beta version of Norton AntiVirus creates special debug output
files when scanning for viruses. The debug files are called
NAVHEAVY.DAT and NAVFALSE.DAT and are located in the root of your
C: drive. If possible, please attach these files to an e-mail and
send it to:

        nav95ws.feedback@symantec.com

3. Inoculation Change Alerts
----------------------------
When responding to an inoculation change alert, you must determine if
the change is legitimate (choose Inoculate to let Norton AntiVirus
generate new inoculation data) or the change indicates the activity
of a virus (choose Repair to let Norton AntiVirus restore the item).

The following examples demonstrate legitimate changes. In these cases
you should choose Inoculate to let Norton AntiVirus generate new
inoculation data.

 * Installing or Upgrading Windows

   If you are running Norton AntiVirus and reinstalling or upgrading 
   Windows, you may receive more than one inoculation change alert. 
   Choose Inoculate, not Repair, to respond to the alert.

   Windows modifies boot records and system files during the install 
   operation and restarts your system more than once. Each time your 
   system is restarted, these changes are properly detected by Norton 
   AntiVirus. If you choose Repair, you are undoing some of the changes 
   that Windows is making and, therefore, corrupting your system files. 
   You may not be able to start your system from its hard disk. If this 
   occurs, start up from a floppy disk and reinstall Windows.

 * System Files

   Similarly, you may receive an inoculation alert at startup if
   system files have been modified as part of a legitimate change.
   For example, the Microsoft Powertoys Tweak UI applet modifies the
   MSDOS.SYS file. Choose Inoculate, not Repair, to respond to this
   alert.

 * Program Files

   If you use inoculation protection for program files, Norton
   AntiVirus reports an inoculation change when the newly installed
   file is accessed (or during a manual scan). Choose Inoculate, not
   Repair, to respond to the alert. In this case, the inoculation
   change is legitimate because it is a new file.

 * Partitioning Software

   If you use partitioning software (such as Partition Magic) or
   drive overlay software (such as Disk Manager and EZ drive), you
   may receive inoculation alerts for legitimate changes. When you
   set or modify partitions after Norton AntiVirus is installed,
   choose Inoculate, not Repair, to respond to these alerts.

   For example, Partition Magic may generate several legitimate
   inoculation alerts when setting or modifying partitions. If you
   choose Repair, your drive may be rendered inaccessible with little
   chance of recovery.

4. AUTOEXEC.BAT and NAVDX.EXE
-----------------------------
During installation, an entry is placed in your AUTOEXEC.BAT file to
run NAVDX for startup scans, which run before Windows starts (for 
example, @C:\PROGRA~1\NORTON~1\NAVDX.EXE /STARTUP). Whether or not 
the startup scan actually takes place is determined by your Startup 
tab settings in the Norton AntiVirus Options window. If, however, you 
remove the NAVDX line from your AUTOEXEC.BAT file, the startup scans 
can never occur, irrespective of your Startup tab settings.

NAVDX is loaded from AUTOEXEC.BAT rather than WINSTART.BAT to
ensure that it scans as early as possible during the system startup
sequence.

5. Automatic Protection and Downloading Software
------------------------------------------------
If you configure Norton AntiVirus to monitor for virus-like activities
or use the Virus Sensor feature, you may get unknown virus alerts when
downloading program files from some online services. These alerts do
not necessarily mean a file is infected with an unknown virus. The
alert may be generated due to the way the file is transferred.

For example, the CompuServe WinCIM program creates a file the size of
the expected download when you begin a file transfer. During the
transfer, the contents of this file are replaced with the data being
downloaded. If you are downloading an executable program,
Auto-Protect will properly notice that the file is being modified and
alert you.

Simply select Continue when the alert is generated to complete the
download. If you frequently download programs, you can add exclusions
for this behavior so that the alerts are not generated at all. For
example, you could add exclusions for WinCIM for "Unknown virus
detection" and "Write to program files." 

6. Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)
----------------------------------------------------------
Auto-Protect and Inoculation ignore disk label (volume label) changes
to prevent false virus alerts. Viruses cannot use the disk label to
infect your system. For the same reason, changes to the OEM ID in a
boot record are not reported.

By design, Auto-Protect does not report writes to a boot sector or
master boot record if the new sector is identical to the one
previously on the drive. For example, you may use a disk editor to
write back the same data to a boot sector or master boot record.

7. Modifying Rescue Disks
-------------------------
Due to the number of product specific technologies used by
manufacturers to configure and initialize hard disks, Norton
AntiVirus cannot always create a bootable Norton Rescue Boot Disk
automatically.

To test your rescue disk, restart your computer from rescue disk 1,
"Norton Rescue Boot Disk," and type C: to change to your hard drive.
If you can access your hard drive, you can rely on the rescue disk in
an emergency situation. Write-protect the disk and store it in a safe
place.  If, however, you cannot pass this test, you must modify the
disk.

In all cases, restart your computer from the newly modified rescue
disk to verify proper operation.

 * Modifying a Norton Rescue Boot Disk for Ontrack Systems

   1 Choose Shutdown from the Start menu and select "Restart the
     computer in MS-DOS mode."
   2 After your computer restarts, insert your Ontrack Disk Manager
     disk in the A: drive.
   3 Type A:\DM and press Enter to run the Disk Manager program.
   4 Choose "Maintenance Menu" from the main window Select an
     Installation menu.
   5 Choose "Create Ontrack Boot Diskette."
   6 Choose "Make this diskette an Ontrack Boot Diskette."
   7 Remove the Ontrack Disk Manager disk and insert rescue disk 1,
     "Norton Rescue Boot Disk," in the A: drive. Make sure the disk
     is not write-protected.
   8 Press Enter to accept the default switches (/P-).
   9 When the operation is completed, write-protect the rescue disk.
  10 Restart your computer using you Norton Rescue Boot Disk and
     type C: to change to your hard drive to verify proper operation.

 * Modifying a Norton Rescue Boot Disk for embedded driver systems

   Because embedded driver implementations are hard drive specific,
   you must refer to the documentation that came with your hard disk
   for instructions on how to create a bootable floppy disk that
   gives you access to the hard disk. In some cases, you will have
   to contact the manufacturer's technical support department.


8. System Shutdown and Auto-Protect
-----------------------------------
Auto-Protect is often configured to scan removable media devices for
boot sector viruses during system shutdown. While scanning the boot
sector, Auto-Protect displays a text mode message that notes it is
currently scanning a boot record. Some video boards and video drivers
have problems switching to text mode after the shutdown screen is 
displayed and cause a system lockup.

You can control whether or not the text message is displayed by
merging the following Registry Entry files with your Registry:

   APMSGOFF.REG      Prevents the AP text message from displaying
   APMSGON.REG       Permits the AP text message to be displayed

To merge a Registry Entry file with your Registry, simply double
click the file from the Explorer or a My Computer window. Both files
are located where Norton AntiVirus is installed. By default, this is
the C:\Program Files\Norton AntiVirus folder.

Note that if a virus is found, Auto-Protect will attempt to display a
message irrespective of this setting.

9. Novell Client32 for Windows 95
---------------------------------
A problem has been identified with the initial release of the Novell
Client32 for Windows 95 and Auto-Protect. Under some circumstances,
Auto-Protect can miss infected files when files are going between a
NetWare 4.1 server and a Windows 95 client running the Novell Client32
software. Contact Novell for an upgraded version of Client32.

10. "HIMEM.SYS is missing" Message when Restarting Your Computer
----------------------------------------------------------------
On certain computers, you may see the following message when 
restarting your computer:

   HIMEM.SYS is missing.
   Make sure that the file is in your Windows directory.

This error occurs only if you restart your computer with a warm boot 
(Ctrl-Alt-Del). If you turn the power off and then on again, or press
the reset button, your computer starts properly.

To prevent the problem from occurring, add the following line to the
beginning of your AUTOEXEC.BAT file:

   SET DOS16M=2

After making the modification and saving your AUTOEXEC.BAT file, turn
the power off and then on (or press the reset butoon) to restart your
computer.

11. Named Pipes and Auto-Protect
--------------------------------
Auto-Protect is not compatible with the named pipes protocol, used by
products such as Microsoft SQL Server 6.0. To prevent Auto-Protect
scans of pipe files, select the Program Files option (the default) in
the What To Scan group box on the Options/Auto-Protect tab. Do not
select the All Files option. Contact technical support if you want to
be notified when the program fix becomes available.

12. Creating a test text file that looks like a virus
-----------------------------------------------------
To create a harmless text file that will be detected as a virus,
which you can then use to verify detection of viruses, logging and
functioning of alerts, copy the following line in to a separate file,
saving it as trigger.com. This file is NOT a virus, but will be
detected as the "EICAR Test String.70" virus.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

V. Contacting Symantec and submitting bug reports
=====================================================================
Please send bug reports to the following address:

        nav95ws.feedback@symantec.com

Before submitting bug reports, please see section IV for known issues.

Please include the exact steps to reproduce the problem, operating
system (NT or Windows 95), email address, and daytime phone number in
case we need to reach you.

Symantec values all input from our customers. Depending on email
volume levels, you may not receive a response from us unless we need
additional information to isolate the problem. Be assured all
reports will be read and reviewed. Thank you in advance for your support.  


			    *  *  *  *  *

Thank you for trying Norton AntiVirus.  We are confident it will 
help you compute virus-free.

Sincerely,
The Norton AntiVirus Team 
			
