*****************************************************************

Norton AntiVirus for Windows 95 README.TXT

December 1995

*****************************************************************

Copyright (c) 1995 Symantec Corporation

***************************************************************************

HOW TO USE THIS DOCUMENT

***************************************************************************

To view README.TXT on screen in Notepad or WordPad, maximize the Notepad

or WordPad window.

To print README.TXT in Notepad or WordPad, choose Print from the File menu.

If you use another word processor, select the entire document and format

the text in 10-point Courier before printing to ensure proper spacing.

To print README.TXT from the DOS prompt, type COPY README.TXT PRN:

***************************************************************************

NORTON ANTIVIRUS NOTES

***************************************************************************

This README.TXT file covers compatibility information, late-breaking news,

and usage tips for Norton AntiVirus for Windows 95. The following topics

are discussed:

* VIRSPEC.TXT

* Reinstalling Windows 95 and Inoculation Change Alerts

* Earlier Versions of Norton AntiVirus (Windows 3.x and DOS)

* NAVBOOT.EXE

* AUTOEXEC.BAT and NAVBOOT.EXE

* Command-Line Switch Enhancements (NAVBOOT.EXE and NAVW32.EXE)

* Automatic Protection and Updating Software

* Automatic Protection and Downloading Software

* Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)

* Modifying Rescue Disks

* Preventing the NAV Startup Logo Screen from Displaying

* Win 95 System Shutdown and Auto-Protect

VIRSPEC.TXT

-----------

In addition to README.TXT, Norton AntiVirus for Windows 95 provides a file

called VIRSPEC.TXT, which is located in the folder where Norton AntiVirus

is installed.

VIRSPEC.TXT contains information about viruses that cause unique problems

and require special handling, as well as statistics about recent virus

outbreaks. Please refer to this file for important instructions about the

One Half virus and other special cases.

The VIRSPEC.TXT file is updated monthly by Symantec. The new version is

distributed with an updated virus definitions file, which Norton AntiVirus

uses to catch newly discovered viruses. See Chapter 8, "Keeping Up with

New Viruses," in the User's Guide for information on how to get the

updates.

Reinstalling Windows 95 and Inoculation Change Alerts

-----------------------------------------------------

If you are running Norton AntiVirus for Windows 95 and reinstalling

Windows 95 (or upgrading from a beta version), you may receive more than

one inoculation change alert. Choose Inoculate, not Repair, to respond to

the alert.

Windows 95 modifies boot records and system files during the install

operation and restarts your system more than once. Each time your system

is restarted, these changes are properly detected by Norton AntiVirus. If

you choose Repair, you are undoing some of the changes that Windows 95 is

making and, therefore, corrupting your system files. You may not be able

to start your system from its hard disk. If this occurs, start up from a

floppy disk and reinstall Windows 95.

Earlier Versions of Norton AntiVirus (Windows 3.x and DOS)

-------------------------------------------------------------------

Norton AntiVirus for Windows 95 is a new program for a new operating

system. It is not an upgrade to previous versions of Norton AntiVirus.

Unlike Windows 3.x and DOS, Windows 95 defines a standard installation

folder for applications. For Norton AntiVirus for Windows 95, the default

location is the C:\Program Files\Norton AntiVirus folder instead of the

C:\NAV directory. During installation older versions of NAV are disabled

(because they don't work with Windows 95), but are not deleted. If you

boot into your old operating system, you need to use your old version of

NAV instead. If you do not intend to use your old operating system, you

can delete the old NAV directory to free up some disk space.

The NAVINOC.DAT files (inoculation data stored in \NCDTREE) from earlier

NAV versions are reused automatically.

The NAVOPTS.DAT (options settings) and EXCLUDE.DAT (exclusions list) files

from earlier NAV versions are compatible, but not reused automatically.

Because the NAV implementation for Windows 95 is sufficiently different

from older versions, you should, at the very least, review your settings

to maximize protection. See "Determining Your Risk Level" in Chapter 4 of

the User's Guide for specific suggestions. If, however, you want to reuse

the options and exclusions files from earlier versions of NAV, simply copy

them into your Norton AntiVirus for Windows 95 folder.

If you maintain an older operating system and use an earlier NAV version

as well as Windows 95, you must keep your virus definition files current

for both versions. When you update your virus definition files, copy

them to both the old NAV directory and the new NAV for Windows 95 folder.

See Chapter 8, "Keeping Up with New Viruses," in the User's Guide for

information on how to get the updates.

NAVBOOT.EXE

-----------

NAVBOOT is the Norton AntiVirus for Windows 95 component that performs

startup scans as part of its regular operation, and scans in emergency

situations after a virus alert system shutdown.

NAVBOOT requires about 470K of free memory to load. If NAVBOOT won't load

at startup or from your NAV Rescue Disk because there isn't enough memory,

make sure HIMEM.SYS is loaded and remove any unnecessary drivers from your

startup disk's AUTOEXEC.BAT and CONFIG.SYS files. For example, after making

backup copies of AUTOEXEC.BAT and CONFIG.SYS, remove driver lines that

initialize CD-ROM drives, sound cards, tape drives, or any other items that

Windows 95 supports directly.

AUTOEXEC.BAT and NAVBOOT.EXE

----------------------------

During installation an entry is placed in your AUTOEXEC.BAT file to run

NAVBOOT for startup scans, which run before Windows 95 starts (for example,

@C:\PROGRA~1\NORTON~1\NAVBOOT.EXE /STARTUP). Whether or not the startup

scan actually takes place is determined by your Startup tab settings in

the Norton AntiVirus Options window. If, however, you remove the NAVBOOT

line from your AUTOEXEC.BAT file, the startup scans can never occur,

irrespective of your Startup tab settings.

NAVBOOT is loaded from AUTOEXEC.BAT rather than WINSTART.BAT to ensure

that it scans as early as possible during the system startup sequence.

Command-Line Switch Enhancements (NAVBOOT.EXE and NAVW32.EXE)

-------------------------------------------------------------

The optional /S switch (Subfolders) for NAVBOOT.EXE and NAVW32.EXE has

been enhanced. The /S switch now takes an additional parameter (+ or -)

to indicate whether or not subfolders of the specified folder should be

scanned as well.

NAVBOOT pathname /S[+|-] If omitted, /S- is assumed and subfolders

of the specified folder are not scanned.

NAVW32 pathname /S[+|-] If omitted, /S+ is assumed and subfolders

of the specified folder are scanned.

The defaults are different for NAVBOOT and NAVW32 to facilitate the

expected usages of the two programs.

Automatic Protection and Updating Software

------------------------------------------

If you configure Norton AntiVirus to detect unknown viruses using the

Virus Sensor Technology feature, you may get unknown virus alerts when

installing or updating software. This does not necessarily mean a file is

infected with an unknown virus. As part of the process of installation and

expanding compressed files you may be overwriting existing files, which

will trigger an alert.

To prevent these alerts, right click the Auto-Protect icon in the Windows

taskbar tray and choose Disable to disable Auto-Protect temporarily before

upgrading software. Afterwards, right click the Auto-Protect icon again

and choose Enable. Be sure to scan all new files.

Similarly, if you use inoculation protection for program files, NAV

reports an inoculation change when the newly installed file is accessed

(or during a manual scan). Choose Inoculate, not Repair, to respond to the

alert. In this case, the inoculation change is legitimate because it is a

new file.

Automatic Protection and Downloading Software

---------------------------------------------

If you configure Norton AntiVirus to monitor for virus-like activities or

use the Virus Sensor Technology feature, you may get unknown virus alerts

when downloading program files from some on-line services. These alerts do

not necessarily mean a file is infected with an unknown virus. The alert

may be generated due to the way the file is transferred.

For example, the CompuServe WinCIM program creates a file the size of the

expected download when you begin a file transfer. During the transfer, the

contents of this file are replaced with the data being downloaded. If you

are downloading an executable program, Auto-Protect will properly notice

that the file is being modified and alert you.

Simply select Continue when the alert is generated to complete the

download. If you frequently download programs, you can add exclusions for

this behavior so that the alerts are not generated at all. For example,

you could add exclusions for WinCIM for "Unknown virus detection" and

"Write to program files." See "Managing exclusions" in Chapter 10 of the

User's Guide for directions.

Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)

-------------------------------------------------------

Auto-Protect and Inoculation ignore disk label (volume label) changes

to prevent false virus alerts. Viruses cannot use the disk label to

infect your system. For the same reason, changes to the OEM ID in a

boot record are not reported.

By design, Auto-Protect does not report writes to a boot sector or master

boot record if the new sector is identical to the one previously on the

drive. For example, you may use a disk editor to write back the same data

to a boot sector or master boot record.

Modifying Rescue Disks

----------------------

Due to the number of product specific technologies used by manufacturers

to configure and initialize hard disks, Norton AntiVirus cannot always

create a bootable Rescue Disk automatically.

To test your Rescue Disk, restart your computer from Rescue Disk 1,

Emergency Startup, and type C: to change to your hard drive. If you can

access your hard drive, you can rely on the Rescue Disk in an emergency

situation. Write-protect the disk and store it in a safe place. If,

however, you cannot pass this test, you must modify the disk.

In all cases, restart your computer from the newly modified Rescue Disk

to verify proper operation.

* Modifying Rescue Disks for NT Dual Boot Systems

Typically, you'll see the message "Can't find NT Loader" if you try to

startup from the unmodified disk on an NT Dual Boot System.

To modify the disk, start up from your hard disk, insert NAV Rescue

Disk 1 in the A: drive, and, from a DOS prompt, issue the following

command to transfer the operating system to the Rescue Disk:

SYS A:

* Modifying Rescue Disks for OnTrack Systems

1 Choose Shutdown from the Start menu and select "Restart the computer

in MS-DOS mode."

2 After your computer restarts, insert your Ontrack Disk Manager disk

in the A: drive.

3 Type A:\DM and press Enter to run the Disk Manager program.

4 Choose "Maintenance Menu" from the main window Select an Installation

menu.

5 Choose "Create Ontrack Boot Diskette."

6 Choose "Make this diskette an Ontrack Boot Diskette."

7 Remove the Ontrack Disk Manager disk and insert NAV Rescue Disk 1

in the A: drive. Make sure the disk is not write-protected.

8 Press Enter to accept the default switches (/P-).

9 When the operation is completed, write-protect NAV Rescue Disk 1.

10 Restart your computer using NAV Rescue Disk 1 and type C: to change

to your hard drive to verify proper operation.

* Modifying Rescue Disks for embedded driver systems

Because embedded driver implementations are hard drive specific, you

must refer to the documentation that came with your hard disk for

instructions on how to create a bootable floppy disk that gives you

access to the hard disk. In some cases, you will have to contact the

manufacturer's technical support department.

Preventing the Norton AntiVirus Startup Logo Screen from Displaying

-------------------------------------------------------------------

Some users prefer not to see the startup logo screens that display when

Norton AntiVirus components are loaded. They can be disabled or enabled

by merging the following Registry Entry files with your Registry:

LOGO_OFF.REG Disables the startup logo screen

LOGO_ON.REG Enables the startup logo screen

To merge a Registry Entry file with your Registry, simply double click

the file from the Explorer or a My Computer window. Both files are

located where Norton AntiVirus is installed. By default, this is the

C:\Program Files\Norton AntiVirus folder.

Win 95 System Shutdown and Auto-Protect

---------------------------------------

Auto-Protect is often configured to scan removable media devices for

boot sector viruses during WIN 95 shutdown. While scanning the boot

sector, Auto-Protect displays a text mode message that notes it is

currently scanning a boot record. Some video boards and video drivers

have problems switching to text mode after the WIN 95 shutdown screen

is displayed and cause a system lockup.

You can control whether or not the text message is displayed by merging

the following Registry Entry files with your Registry:

APMSGOFF.REG Prevents the AP text message from displaying

APMSGON.REG Permits the AP text message to be displayed

To merge a Registry Entry file with your Registry, simply double click

the file from the Explorer or a My Computer window. Both files are

located where Norton AntiVirus is installed. By default, this is the

C:\Program Files\Norton AntiVirus folder.

Note that if a virus is found, Auto-Protect will attempt to display a

message irrespective of this setting.

***************************************************************************

END OF FILE

***************************************************************************


© BugNet material copyright 1994-1999 by BugNet.
® BugNet is a Registered Trademark of KeyLabs.
Astonisher.com material is

© Copyright 1973 - 2015 by Bruce Brown and BF Communications Inc.
Astonisher.com is a trademark of BF Communications Inc.

This historic replica of BugNet from the period 1994-1999
is presented by astonisher.com with the permission of BugNet.

BF Communications Inc.
P.O. Box 393
Sumas, WA 98295 USA
(360) 927-3234

Website by Running Dog


* Here's Bruce Brown's BugNet Memoir...
* Here's the free BugNet from 1999...
BugNet