21A09.TXT - Description file for 21A09.DEF
AntiVirus Lab, SYMANTEC/Peter Norton Product Group
July 1, 1993
******************************************************************

Instructions for loading virus definitions, using Norton AntiVirus
version 2.1:

[The NAV definition update installation instructions are also
available on this disk in French, German, Italian, Swedish, and
Spanish.  Please reference the appropriate file.]

1)   Run Virus Clinic by typing NAV at the DOS prompt or clicking
on the NAV Icon from within Windows.

2)   Select "Cancel," or press <Esc> to bypass the "Scan Drives"
Screen.

3)   Select the "Definitions" menu.

4)   Select "Load from File..."

5)   If the name of the drive and directory to which you loaded the
definition file does not appear on the "Directory:" line, change to
the proper drive and directory.  The name of the definition file
should appear in the "Files" window.

6)   Select the definition file, click "OK," or press <Enter>.

7)   After the definitions have loaded, press <Enter> to exit from the
"Load Definition File Results" screen.

8)   Select "Exit" from the "Scan" menu.

9)  Reboot your computer to activate the new definitions.

******************************************************************

Note for users who are not updated through Corporate Channels:

After updating your definitions, if every file is identified as
being infected with "MtE", don't panic.  You probably do not have
a virus.  Please download the patch file, PTCH1A.ZIP (available
through CompuServe and the Symantec BBS), unzip the file, follow
the instructions included in the readme file, and then load these
definitions again.

If you are unable to download this patch file, or are still
experiencing problems after using it, please contact Symantec
Technical Support.

******************************************************************

PS-MPC (Walkabout)
Another virus created by the PS-MPC virus generation tool, Walkabout
is a memory-resident infector of COM and EXE files. When an infected
file is run, the virus installs itself at top of memory and reduces
available memory by 2k. From memory, the virus infects COM and EXE 
programs as they are run.

Infected files grow by approximately 550 (573) bytes.  Virus code
is appended to the end of the target file.  The virus code is encrypted
when attached to programs.

No special destructive code was found in the virus.

Walkabout can be repaired by NAV.

-----

WXYC
This virus infects the boot sector of hard and floppy disks. Once in
memory it will infect diskettes as they are accessed and will stealth
its presence in infected sectors. The virus occupies two sectors.

The virus will display the message "WXYC rules this roost!" on boot up,
but does not appear to contain destructive code.

WXYC can be repaired by NAV.

-----

Stoned.Manitoba
This virus is a minor variant of the stoned virus and, like its parent,
infects the boot sector of floppy disks and the master boot sector on
hard drives. Once in memory it will infect diskettes as they are accessed.
It occupies one sector and relocates the boot or master boot as stoned
does.

The virus does not contain the usual "Stoned" (or any other) message and
does not appear to contain destructive code.

Stoned.Manitoba can be repaired by NAV.


(Note: File size growth is given in approximate numbers.  If a number is
enclosed in parentheses, that number would be the growth of one of the more
common variants.  As it is too easy for a virus writer to alter this number
without changing the virus significantly, do not depend on the more precise
number.  It is provided for your confidence should you encounter it, which
we hope never happens.)

