**********************************************************************
Norton AntiVirus for Windows 95                             README.TXT
Copyright (c) 1995-1996 Symantec Corporation             December 1996

**********************************************************************
HOW TO USE THIS DOCUMENT
**********************************************************************
To view README.TXT on screen in Notepad or WordPad, maximize the
Notepad or WordPad window.

To print README.TXT in Notepad or WordPad, choose Print from the File
menu.  If you use another word processor, select the entire document
and format the text in 10-point Courier before printing to ensure
proper spacing.

To print README.TXT from the DOS prompt, type COPY README.TXT PRN:

**********************************************************************
NORTON ANTIVIRUS NOTES
**********************************************************************
This README.TXT file covers compatibility information, late-breaking
news, and usage tips for Norton AntiVirus for Windows 95. The
following topics are discussed:

 * TECHNOTE.TXT and Virus Definitions Files
 * Internet Protection with Norton AntiVirus for Windows 95
 * Microsoft Excel Macro Viruses Detected
 * Norton AntiVirus for Windows 3.x and DOS
 * Removing Viruses Before Installation on FAT32 File Systems
 * Inoculation Change Alerts
 * AUTOEXEC.BAT and NAVBOOT.EXE
 * Automatic Protection and Upgrading Software
 * Automatic Protection and Downloading Software
 * Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)
 * Modifying Rescue Disks
 * Win 95 System Shutdown and Auto-Protect
 * LiveUpdate and Internet Firewalls
 * Novell Client32 for Windows 95
 * "HIMEM.SYS is missing" Message when Restarting Your Computer
 * CTL3D32.DLL Error Message
 * Installing from LFN Folders
 * Startup Scans and Removable-Media Drives
 * Pre-installed Dell P6 Power-Management Software

TECHNOTE.TXT and Virus Definitions Files
----------------------------------------
In addition to README.TXT, Norton AntiVirus for Windows 95 includes a
file called TECHNOTE.TXT, which is located in the folder where Norton
AntiVirus is installed.

TECHNOTE.TXT contains information about viruses that cause unique
problems and require special handling, as well as statistics about
recent virus outbreaks. Please refer to this file for important
instructions about the One Half virus and other special cases.

The TECHNOTE.TXT file is updated monthly by Symantec. The new version
is distributed with updated virus definitions files, which Norton
AntiVirus uses to catch newly discovered viruses. See Chapter 4,
"Keeping Up with New Viruses," in the User's Guide for information on
how to get the updates.

Internet Protection with Norton AntiVirus for Windows 95
--------------------------------------------------------
As part of regular operation, Norton AntiVirus for Windows 95 with
its default settings gives complete protection from Internet-borne
viruses. No separate programs or Norton AntiVirus options changes are
necessary. Auto-Protect scans program and document files automatically
as they are downloaded and files within compressed files when they
are extracted (Options\Auto-Protect tab\Scan on Created option).

For users who disable Auto-Protect, Norton AntiVirus integrates
seamlessly with Internet browsers.

 * Netscape and Norton AntiVirus

   At installation, Norton AntiVirus detects whether Netscape is
   already installed. If so, Norton AntiVirus installs itself as a
   Netscape helper application so that downloaded files are scanned
   for viruses automatically. If you install Netscape after Norton
   AntiVirus is installed, the easiest way take advantage of this
   protection is to reinstall Norton AntiVirus.

 * Other Internet Browsers and Norton AntiVirus

   If you choose not to use Auto-Protect, you can configure other
   browsers to use Norton AntiVirus as a helper application as well.
   To configure Internet browsers to use Norton AntiVirus, use
   the following command line as the application to launch for each
   MIME type and set of extensions:

      "C:\Program Files\Norton AntiVirus\NAVW32" /DOWNLOAD

   Don't forget to include the double quotes ("). If you've installed
   Norton AntiVirus in a different folder, change the command line to
   the proper location.

   The following table lists the standard MIME types and associated
   extensions.

   MIME type                        Extensions
   ----------------------------------------------------------------
   application/octet-stream         (Program Files Extensions List)
   application/binary               (Program Files Extensions List)
   application/zip                  zip, lha, lzh
   application/msword               doc, dot
   application/word                 doc, dot
   application/msexcel              xlb, xlm, xls, xlt, xlw
   application/x-excel              xlb, xlm, xls, xlt, xlw
  
   The Program Files Extensions List includes: 386, BIN, CLA, COM,
   CPL, DLL, DRV, EXE, NCP, NED, NNL, OCX, OVL, SCR, SYS, VBX, VXD

For more information about helper applications and MIME types, consult
your Internet browser documentation or help system.

Microsoft Excel Macro Viruses Detected
--------------------------------------
Norton AntiVirus now scans Microsoft Excel spreadsheets for macro
viruses. To stay protected from all newly discovered viruses, be sure
to use the new LiveUpdate feature so that Norton AntiVirus always has
the latest virus definitions files. See Chapter 4, "Keeping Up with
New Viruses," in the User's Guide for more information.

Norton AntiVirus for Windows 3.x and DOS
----------------------------------------
Unlike Windows 3.x and DOS, Windows 95 defines a standard
installation folder for applications. For Norton AntiVirus for
Windows 95, the C:\Program Files\Norton AntiVirus folder is the
default location instead of the C:\NAV directory. During installation
older versions of NAV are disabled (because they don't work with
Windows 95), but are not deleted. If you boot into your old operating
system, you need to use your old version of NAV instead. If you do
not intend to use your old operating system, you can delete the old
NAV directory to free up some disk space.

The NAVINOC.DAT files (inoculation data stored in \NCDTREE) from
earlier NAV versions are reused automatically.

The NAVOPTS.DAT (options settings) and EXCLUDE.DAT (exclusions list)
files from earlier NAV versions are compatible, but not reused
automatically.  Because the NAV implementation for Windows 95 is
sufficiently different from older versions, you should, at the very
least, review your settings to maximize protection. See "Determining
Your Risk Level" in Chapter 5 of the User's Guide for specific
suggestions. If, however, you want to reuse the options and
exclusions files from earlier versions of NAV, simply copy them into
your Norton AntiVirus for Windows 95 folder.

If you maintain an older operating system and use an earlier NAV
version as well as Windows 95, you must keep your virus definitions
files current for both versions. See Chapter 4, "Keeping Up with New
Viruses," in the User's Guide for information on how to get the
updates.

Removing Viruses Before Installation on FAT32 File Systems
----------------------------------------------------------
If a virus is detected during Norton AntiVirus installation on your 
Large Volume Support (FAT32) file system computer, you must restart
using a FAT32 boot disk (Windows 95 OEM Service Release 2) to remove
the virus. Do not use earlier DOS versions. See the Norton AntiVirus
installation card for the virus removal procedure.

Inoculation Change Alerts
-------------------------
When responding to an inoculation change alert, you must determine if
the change is legitimate (choose Inoculate to let Norton AntiVirus
generate new inoculation data) or the change indicates the activity
of a virus (choose Repair to let Norton AntiVirus restore the item).

The following examples demonstrate legitimate changes. In these cases
you should choose Inoculate to let Norton AntiVirus generate new
inoculation data.

 * Windows 95

   If you are running Norton AntiVirus for Windows 95 and reinstalling
   Windows 95 (or upgrading from an earlier version), you may receive
   more than one inoculation change alert. Choose Inoculate, not
   Repair, to respond to the alert.

   Windows 95 modifies boot records and system files during the
   install operation and restarts your system more than once. Each
   time your system is restarted, these changes are properly detected
   by Norton AntiVirus. If you choose Repair, you are undoing some of
   the changes that Windows 95 is making and, therefore, corrupting
   your system files. You may not be able to start your system from
   its hard disk. If this occurs, start up from a floppy disk and
   reinstall Windows 95.

 * System Files

   Similarly, you may receive an inoculation alert at startup if
   system files have been modified as part of a legitimate change.
   For example, the Microsoft Powertoys Tweak UI applet modifies the
   MSDOS.SYS file. Choose Inoculate, not Repair, to respond to this
   alert.

 * Program Files

   If you use inoculation protection for program files, Norton
   AntiVirus reports an inoculation change when the newly installed
   file is accessed (or during a manual scan). Choose Inoculate, not
   Repair, to respond to the alert. In this case, the inoculation
   change is legitimate because it is a new file.

 * Partitioning Software

   If you use partitioning software (such as Partition Magic) or
   drive overlay software (such as Disk Manager and EZ drive), you
   may receive inoculation alerts for legitimate changes. When you
   set or modify partitions after Norton AntiVirus is installed,
   choose Inoculate, not Repair, to respond to these alerts.

   For example, Partition Magic may generate several legitimate
   inoculation alerts when setting or modifying partitions. If you
   choose Repair, your drive may be rendered inaccessible with little
   chance of recovery.

AUTOEXEC.BAT and NAVBOOT.EXE
----------------------------
During installation, an entry is placed in your AUTOEXEC.BAT file to
run NAVBOOT for startup scans, which run before Windows 95 starts
(for example, @C:\PROGRA~1\NORTON~1\NAVBOOT.EXE /STARTUP). Whether or
not the startup scan actually takes place is determined by your
Startup tab settings in the Norton AntiVirus Options window. If,
however, you remove the NAVBOOT line from your AUTOEXEC.BAT file, the
startup scans can never occur, irrespective of your Startup tab
settings.

NAVBOOT is loaded from AUTOEXEC.BAT rather than WINSTART.BAT to
ensure that it scans as early as possible during the system startup
sequence.

Automatic Protection and Upgrading Software
-------------------------------------------
If you configure Norton AntiVirus to detect unknown viruses using the
Virus Sensor feature, you may get unknown virus alerts when installing
or upgrading software. This does not necessarily mean a file is
infected with an unknown virus. As part of the process of
installation (and expansion of compressed files) you may be
overwriting existing files, which will trigger an alert.

To prevent these alerts, right-click the Auto-Protect icon in the
Windows taskbar tray and choose Disable to disable Auto-Protect
temporarily before upgrading software. Afterwards, right-click the
Auto-Protect icon again and choose Enable. Be sure to scan all new
files.

Automatic Protection and Downloading Software
---------------------------------------------
If you configure Norton AntiVirus to monitor for virus-like activities
or use the Virus Sensor feature, you may get unknown virus alerts when
downloading program files from some online services. These alerts do
not necessarily mean a file is infected with an unknown virus. The
alert may be generated due to the way the file is transferred.

For example, the CompuServe WinCIM program creates a file the size of
the expected download when you begin a file transfer. During the
transfer, the contents of this file are replaced with the data being
downloaded. If you are downloading an executable program,
Auto-Protect will properly notice that the file is being modified and
alert you.

Simply select Continue when the alert is generated to complete the
download. If you frequently download programs, you can add exclusions
for this behavior so that the alerts are not generated at all. For
example, you could add exclusions for WinCIM for "Unknown virus
detection" and "Write to program files." See "Managing exclusions" in
Chapter 5 of the User's Guide for directions.

Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386)
-------------------------------------------------------
Auto-Protect and Inoculation ignore disk label (volume label) changes
to prevent false virus alerts. Viruses cannot use the disk label to
infect your system. For the same reason, changes to the OEM ID in a
boot record are not reported.

By design, Auto-Protect does not report writes to a boot sector or
master boot record if the new sector is identical to the one
previously on the drive. For example, you may use a disk editor to
write back the same data to a boot sector or master boot record.

Modifying Rescue Disks
----------------------
Due to the number of product specific technologies used by
manufacturers to configure and initialize hard disks, Norton
AntiVirus cannot always create a bootable Norton Rescue Boot Disk
automatically.

To test your rescue disk, restart your computer from rescue disk 1,
"Norton Rescue Boot Disk," and type C: to change to your hard drive.
If you can access your hard drive, you can rely on the rescue disk in
an emergency situation. Write-protect the disk and store it in a safe
place.  If, however, you cannot pass this test, you must modify the
disk.

In all cases, restart your computer from the newly modified rescue
disk to verify proper operation.

 * Modifying a Norton Rescue Boot Disk for NT Dual Boot systems
   or Large Volume Support (FAT32) file systems

   You will not be able to start your computer from the rescue disk
   unless you transfer the operating system to the rescue disk.

   To modify the disk, start up from your hard disk, insert rescue
   disk 1, "Norton Rescue Boot Disk," in the A: drive, and, from a
   DOS prompt, issue the following command to transfer the operating
   system to the rescue disk:

      SYS A:

 * Modifying a Norton Rescue Boot Disk for Ontrack Systems

   1 Choose Shutdown from the Start menu and select "Restart the
     computer in MS-DOS mode."
   2 After your computer restarts, insert your Ontrack Disk Manager
     disk in the A: drive.
   3 Type A:\DM and press Enter to run the Disk Manager program.
   4 Choose "Maintenance Menu" from the main window Select an
     Installation menu.
   5 Choose "Create Ontrack Boot Diskette."
   6 Choose "Make this diskette an Ontrack Boot Diskette."
   7 Remove the Ontrack Disk Manager disk and insert rescue disk 1,
     "Norton Rescue Boot Disk," in the A: drive. Make sure the disk
     is not write-protected.
   8 Press Enter to accept the default switches (/P-).
   9 When the operation is completed, write-protect the rescue disk.
  10 Restart your computer using you Norton Rescue Boot Disk and
     type C: to change to your hard drive to verify proper operation.

 * Modifying a Norton Rescue Boot Disk for embedded driver systems

   Because embedded driver implementations are hard drive specific,
   you must refer to the documentation that came with your hard disk
   for instructions on how to create a bootable floppy disk that
   gives you access to the hard disk. In some cases, you will have
   to contact the manufacturer's technical support department.

LiveUpdate and Internet Firewalls
---------------------------------
LiveUpdate is the new, automatic virus definitions files update
feature (see Chapter 4 in the User's Guide, "Keeping Up With New
Viruses," for information). If your Internet connection is protected
by a firewall, you may need to modify its configuration to use
LiveUpdate. Use the following data to configure your firewall to
permit access to the Symantec LiveUpdate FTP site.

  Host:                update.symantec.com
  Outbound data port:  21
  Inbound data port:   20
  Protocol:            FTP

Consult your firewall's documentation for implementation details.

Win 95 System Shutdown and Auto-Protect
---------------------------------------
Auto-Protect is often configured to scan removable media devices for
boot sector viruses during WIN 95 shutdown. While scanning the boot
sector, Auto-Protect displays a text mode message that notes it is
currently scanning a boot record. Some video boards and video drivers
have problems switching to text mode after the WIN 95 shutdown screen
is displayed and cause a system lockup.

You can control whether or not the text message is displayed by
merging the following Registry Entry files with your Registry:

   APMSGOFF.REG      Prevents the AP text message from displaying
   APMSGON.REG       Permits the AP text message to be displayed

To merge a Registry Entry file with your Registry, simply double
click the file from the Explorer or a My Computer window. Both files
are located where Norton AntiVirus is installed. By default, this is
the C:\Program Files\Norton AntiVirus folder.

Note that if a virus is found, Auto-Protect will attempt to display a
message irrespective of this setting.

Novell Client32 for Windows 95
------------------------------
A problem has been identified with the initial release of the Novell
Client32 for Windows 95 and Auto-Protect. Under some circumstances,
Auto-Protect can miss infected files when files are going between a
NetWare 4.1 server and a Windows 95 client running the Novell Client32
software. Contact Novell for an upgraded version of Client32.

"HIMEM.SYS is missing" Message when Restarting Your Computer
------------------------------------------------------------
On certain computers, including the Compaq Deskpro XL, you may see the
following message when restarting your computer:

   HIMEM.SYS is missing.
   Make sure that the file is in your Windows directory.

This error occurs only if you restart your computer with a warm boot 
(Ctrl-Alt-Del). If you turn the power off and then on again, or press
the reset button, your computer starts properly.

To prevent the problem from occurring, add the following line to the
beginning of your AUTOEXEC.BAT file:

   SET DOS16M=2

After making the modification and saving your AUTOEXEC.BAT file, turn
the power off and then on (or press the reset button) to restart your
computer.

CTL3D32.DLL Error Message
-------------------------
The following message may appear during Norton AntiVirus installation:

   This application uses CTL3D32.DLL, which is not the correct
   version. This version of CTL3D32.DLL is designed only for 
   Windows NT. 

Simply click OK to continue the install.

The message is generated because an old version of CTL3D32.DLL is 
found on your system. Microsoft has updated CTL3D32.DLL to correct
the problem (version 2.31).

Installing Norton AntiVirus from LFN Folders
--------------------------------------------
Norton AntiVirus cannot be installed from a long-filename (LFN) folder
on a Novell NetWare server. Similarly, Norton AntiVirus cannot be 
installed from a long-filename folder on a Windows NT server if 
short-filename (SFN) aliasing is turned off.

Startup Scans and Removable-Media Drives
----------------------------------------
If a large-capacity, removable-media drive is empty during a startup 
scan, Norton AntiVirus may report that it cannot access the drive. To 
avoid the message, simply leave a disk in the drive.

Pre-installed Dell P6 Power-Management Software
-----------------------------------------------
The Dell P6 power-management software includes a thermal shutdown 
component (TEMPSENS.VXD) that is not compatible with Norton AntiVirus.
To disable this component, you must modify the following Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Delete the "ThermalShutdown" entry.

The other Dell power management features will not be affected.
**********************************************************************
                                END OF FILE
**********************************************************************

