New Computer Worm - W32.Goner.A@mm

Symantec Security Response Rates Worm Level 4 Security Threat

CUPERTINO, Calif. - Dec. 4, 2001- Symantec Corp. (NASDAQ: SYMC), the world leader in Internet security, warns against W32.Goner.A@mm - a mass mailing worm that spreads itself through e-mail by accessing the Microsoft Outlook address book and through the ICQ network messaging system. W32.Goner.A@mm, also attempts to delete critical files associated with anti-virus and personal firewall programs.

The subject line reads "Hi." The text in the body of the email reads, "How are you? When I saw this screen saver, I immediately thought about you. I am in a harry, I promise you will love it!" When the attached document - Gone.scr - is executed, the worm modifies the registry, attempting to delete files of common anti-virus and personal firewall products. If the files are in use and cannot be deleted, the worm will create the file %SYSTEM%\Wininit.ini, which causes the files to be deleted when the computer restarts.

If mIRC, an Internet Relay Chat program, is installed on an infected computer, the worm can also insert mIRC scripts that will create a backdoor. This will enable the infected computer to be able to be used in a Denial of Service (DOS) attack.

Symantec recommends customers use the LiveUpdate feature built into Symantec's Norton AntiVirus software to protect their systems. Updates are also available at the Symantec Security Response Web site: http://securityresponse.symantec.com.