********************************************************************** Norton AntiVirus for Windows 95/98 README.TXT Copyright (c) 1995-1999 Symantec Corporation August 1999 ********************************************************************** HOW TO USE THIS DOCUMENT ********************************************************************** To view README.TXT on screen in Notepad or WordPad, maximize the Notepad or WordPad window. To print README.TXT in Notepad or WordPad, choose Print from the File menu. If you use another word processor, select the entire document and format the text in 10-point Courier before printing to ensure proper spacing. To print README.TXT from the DOS prompt, type COPY README.TXT PRN: ********************************************************************** NORTON ANTIVIRUS NOTES ********************************************************************** This README.TXT file covers compatibility information, late-breaking news, and usage tips for Norton AntiVirus for Windows 95/98. The following topics are discussed: * Upgrading from Microsoft Windows 95 to Windows 98 * Inoculation Alerts when upgrading to Microsoft Windows 98 * LiveUpdate subscriptions * Print versions of Norton AntiVirus Guide * Uninstall Beta versions of Norton AntiVirus * Uninstalling LiveUpdate or LiveAdvisor * Removing Norton AntiVirus from the Windows Start menu * Quarantining non-deletable files * NAVDX and Long Filenames (LFNs) * Inoculation Change Alerts * Automatic Protection and Downloading Software * Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386) * Scheduling scans for Windows 95 * Win 95/98 System Shutdown and Auto-Protect * Creating a test text file that looks like a virus * Using Netscape with Norton AntiVirus * Chips and Technologies display driver problem * NAVDX and ZIP drives * "IOS Failed to Initialize" error message after installation * NEC platform only: CONFIG.SYS and NAVDX.EXE * Updating Windows 95/98 video drivers for Auto-Protect * Mijenix ZipMagic and Norton AntiVirus installation * Email scanning attachments that cannot be quarantined * Using Norton AntiVirus with Microsoft Outlook Express * Using Norton AntiVirus with the Microsoft Network (MSN) * Using Norton AntiVirus with Netscape 4.6 * Using email scanning with Netscape Messenger * Using email scanning with Netscape Communicator * Using Norton AntiVirus with Eudora Light and Eudora Pro * Turning email timeout protection off and on * Disabling email scanning while a download is in progress * Manually enabling and disabling the plug-in for Office 2000 ********************************************************************** Upgrading from Microsoft Windows 95 to Windows 98 ------------------------------------------------- Windows 98 stops and restarts your computer during a Windows 98 upgrade. Windows 98 may not restart properly if anti-virus programs are running. For example, if Norton AntiVirus Auto-Protect is running, Windows 98 Setup will not restart your computer automatically during the upgrade. If your computer stops and doesn't restart when it is supposed to during the upgrade, turn the power off and then on again to restart your computer manually. Windows 98 Setup will then properly continue. Inoculation Alerts when upgrading to Microsoft Windows 98 --------------------------------------------------------- If you receive an Inoculation Alert during a virus scan after upgrading from Microsoft Windows 95 to Windows 98, choose Inoculate to respond to the alert. Do not choose Repair. In this case, the inoculation change is expected because of the Windows upgrade. If you choose Repair, you will corrupt the data on your disk. LiveUpdate subscriptions ------------------------ With the purchase and installation of Norton AntiVirus 2000, you automatically qualify for one year free use of LiveUpdate to receive virus definition updates. Your installed Norton AntiVirus program will notify you when your subscription is about to expire and provide information on how to extend your subscription to ensure continuing, up-to-date protection. Print versions of Norton AntiVirus Guides ----------------------------------------- Print versions of the Norton AntiVirus User Guide can be ordered through Symantec Customer Service. Uninstall Beta versions of Norton AntiVirus ------------------------------------------- If you tested a Beta version of Norton AntiVirus, uninstall the Beta before installing the release version. This removes unneeded files that would otherwise remain on your disk and prevents problems that could arise due to changed file formats. Uninstalling LiveUpdate or LiveAdvisor --------------------------------------- Because LiveUpdate and LiveAdvisor are shared among Symantec products, it is not uninstalled automatically if you select Uninstall Norton AntiVirus. Do not uninstall these components if there is any other Symantec software installed on your system. To uninstall LiveUpdate or LiveAdvisor, choose Add/Remove Programs from the Windows Control Panel and select LiveUpdate or LiveAdvisor. Removing Norton AntiVirus from the Windows Start menu ----------------------------------------------------- If Uninstall does not remove the Norton AntiVirus program group from the Windows Start menu, you must remove it manually. To remove the program group, right-click the taskbar, select Properties, click the Start Menu Programs tab, click Remove, select Norton AntiVirus, and then click Remove. Quarantining non-deletable files -------------------------------- Norton AntiVirus cannot quarantine non-deletable files (for example, files infected by the DirII virus). To manually add these types of files to the Quarantine, open the Quarantine and choose Add Item. NAVDX and Long Filenames (LFNs) ------------------------------- NAVDX, the command-line scanner used for startup scans and emergency recovery, does not properly display long filenames in a DOS box. Inoculation Change Alerts ------------------------- When responding to an inoculation change alert, you must determine if the change is legitimate (choose Inoculate to let Norton AntiVirus generate new inoculation data) or the change indicates the activity of a virus (choose Repair to let Norton AntiVirus restore the item). The following examples demonstrate legitimate changes. In these cases you should choose Inoculate to let Norton AntiVirus generate new inoculation data. * Installing or Upgrading Windows If you are running Norton AntiVirus and reinstalling or upgrading Windows, you may receive more than one inoculation change alert. Choose Inoculate, not Repair, to respond to the alert. Windows modifies boot records during the install operation and restarts your system more than once. Each time your system is restarted, these changes are properly detected by Norton AntiVirus. If you choose Repair, you are undoing some of the changes that Windows is making and, therefore, corrupting your boot records. You may not be able to start your system from its hard disk. If this occurs, start up from a floppy disk and reinstall Windows. * Partitioning Software If you use partitioning software (such as Partition Magic) or drive overlay software (such as Disk Manager and EZ drive), you may receive inoculation alerts for legitimate changes. When you set or modify partitions after Norton AntiVirus is installed, choose Inoculate, not Repair, to respond to these alerts. For example, Partition Magic may generate several legitimate inoculation alerts when setting or modifying partitions. If you choose Repair, your drive may be rendered inaccessible with little chance of recovery. Automatic Protection and Downloading Software --------------------------------------------- If you configure Norton AntiVirus to monitor for virus-like activities, you may get unknown virus alerts when downloading program files from some online services. These alerts do not necessarily mean a file is infected with an unknown virus. The alert may be generated due to the way the file is transferred. For example, the CompuServe WinCIM program creates a file the size of the expected download when you begin a file transfer. During the transfer, the contents of this file are replaced with the data being downloaded. If you are downloading an executable program, Auto-Protect will properly notice that the file is being modified and alert you. Simply select Continue when the alert is generated to complete the download. If you frequently download programs, you can add exclusions for this behavior so that the alerts are not generated at all. For example, you could add exclusions for WinCIM for "Write to program files." Auto-Protect (NAVAPW32.EXE, NAVAP.VxD, and SYMEVNT.386) ------------------------------------------------------- Auto-Protect and Inoculation ignore disk label (volume label) changes to prevent false virus alerts. Viruses cannot use the disk label to infect your system. For the same reason, changes to the OEM ID in a boot record are not reported. By design, Auto-Protect does not report writes to a boot sector or master boot record if the new sector is identical to the one previously on the drive. For example, you may use a disk editor to write back the same data to a boot sector or master boot record. Scheduling scans in Windows 95 ------------------------------ Norton AntiVirus for Windows 98 and Windows 95 use different schedulers. The Windows 98 version uses the new built-in Windows scheduler, while the Windows 95 version uses the Norton Program Scheduler. In Windows 95, if your computer is turned off when a scheduled task is suppose to run, Norton Program Scheduler will notify you the next time your computer is started. Win 95/98 System Shutdown and Auto-Protect ------------------------------------------ Auto-Protect is often configured to scan removable media devices for boot sector viruses during system shutdown. While scanning the boot sector, Auto-Protect can display a text mode message that notes it is currently scanning a boot record. Some video boards and video drivers have problems switching to text mode after the shutdown screen is displayed and cause a system lockup. Because of this, we have disabled this behavior by default. You can control whether or not the text message is displayed by merging the following Registry Entry files with your Registry: APMSGOFF.REG Prevents the AP text message from displaying APMSGON.REG Permits the AP text message to be displayed To merge a Registry Entry file with your Registry, simply double click the file from the Explorer or a My Computer window. Both files are located where Norton AntiVirus is installed. By default, this is the C:\Program Files\Norton AntiVirus folder. Note that if a virus is found, Auto-Protect will attempt to display a message irrespective of this setting. Creating a test text file that looks like a virus ------------------------------------------------- To create a harmless text file that will be detected as a virus, which you can use to verify detection of viruses, logging, and alert functioning, copy the following line in to a separate file, saving it as TRIGGER.COM. This file is not a virus, but will be detected as the "EICAR Test String.70" virus. Disable Auto-Protect temporarily before you save the file. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* Using Netscape with Norton AntiVirus ------------------------------------ If Norton AntiVirus is installed as a Netscape helper application, a downloaded file will be lost if Netscape is closed before the download is complete. Chips and Technologies display driver problem --------------------------------------------- A problem with the Chips and Technologies display driver, which is common in Toshiba laptops, may cause a system hang after an Auto-Protect alert is generated. Changing to a standard SVGA driver avoids the problem. NAVDX and ZIP drives -------------------- Some ZIP drives require that a disk be present when they are started. You may see an "Invalid Drive type on drive " with NAVDX, the Norton AntiVirus component that performs startup scans and scans in emergency situations, if no disk is in the ZIP drive. Insert a disk in the drive and choose "Retry." "IOS Failed to Initialize" error message after installation ----------------------------------------------------------- When you restart Windows 95 after installing a program or making a configuration change to your computer, you may receive one of the following error messages: * Windows initializing device IOS: Windows protection error. IOS failed to Initialize, Please restart * While initializing IOS: Windows protection error. You need to restart your computer. This is a Windows 95 problem that occurs on a very small number of system configurations. After the error message is displayed, you may not be able to start Windows 95 normally. However, you should be able to start Windows 95 in Safe mode. To correct the problem: 1 Boot Windows 95 in Safe mode or to a command prompt. 2 Do one of the following: * Edit your CONFIG.SYS and AUTOEXEC.BAT files and remove or disable any references to SMARTDRV.EXE * Rename SMARTDRV.EXE to another name (for example, SMARTDRV.EX?). For more information, visit the Microsoft Knowledge Base and review article Q157924. NEC platform only: CONFIG.SYS and NAVDX.EXE ------------------------------------------- During installation, Norton AntiVirus checks your system's CONFIG.SYS file for a line that loads the EMM386 memory manager. If such a line is in the file, it is remarked out so that EMM386 does not load. This is done to avoid reported problems with NAVDX on machines with 32 MB or more of RAM. If your system has less than 32 MB, you can edit CONFIG.SYS to remove the remark that Norton AntiVirus adds so that EMM386 loads as before. If you do this, you must remove any switches and parameters to EMM386, and replace them with the /DPMI switch. For example, you should change device=a:\windows\emm386.exe noems ram to device=a:\windows\emm386.exe /DPMI NAVDX will not run if you load EMM386 without the /DPMI switch. Updating Windows 95/98 video drivers for Auto-Protect ----------------------------------------------------- Some versions of Windows 95/98 video drivers cause display corruption or an apparent system lock up when an Auto_protect alert is generated. To correct the problem, upgrade to the latest version of the video driver. Mijenix ZipMagic and Norton AntiVirus installation -------------------------------------------------- Norton AntiVirus should be installed before ZipMagic is installed. If ZipMagic is installed first, you must change a ZipMagic option setting for proper operation. To configure an already installed ZipMagic: * Access ZipMagic options and set up Norton AntiVirus as a program that recognizes ZipMagic archives as files, not as folders. For more information, consult your ZipMagic documentation. Email scanning attachments that cannot be quarantined ----------------------------------------------------- If you receive an email that contains an infected file that can not be Quarantined (a CAB file, for example) and you are using the Quarantine action or the Try to Repair And Then Quarantine action, the entire attachment will be deleted and not placed in Quarantine. This protects you from receiving infected files. Using Norton AntiVirus with Microsoft Outlook Express ----------------------------------------------------- If you install Outlook Express over Outlook 97 and import your Outlook 97 settings you may experience problems downloading email. If this occurs, check your Outlook Express account name (user name) setting. If you are using email protection, this setting should be UserName/MailServerName. If you are not using email protection, this setting should simply be your username (or whatever your mail service provider requires). This behavior will likely occur with any client you install and you import the settings from a protected client. See the online help topic on manually configuring email client for further information on these settings. If you use digital signatures by default on outgoing messages you may need to turn off email protection in Norton AntiVirus, then enable digital signatures in Outlook Express, and then enable email protection in Norton AntiVirus. Using Norton AntiVirus with the Microsoft Network (MSN) ------------------------------------------------------- Norton AntiVirus cannot scan email received from MSN because MSN's Secure Password Authentication fails. You must turn off email scanning to receive email from MSN. You are still protected by Norton AntiVirus Auto-Protect. Using Norton AntiVirus with Netscape 4.6 ---------------------------------------- Netscape 4.6 uses a feature called Smart Download. This feature is launched each time you download a zip file and it handles the download without running it through the Norton AntiVirus plugin. Virus protection will be provided by Norton AntiVirus AutoProtect when you extract files from the compressed file. Using email scanning with Netscape Messenger -------------------------------------------- If you configure Netscape Messenger to use an IMAP mail server, and then change it back to use a POP3 server, Norton AntiVirus may not recognize it. You can manually configure non-recognized clients and Norton AntiVirus will then scan email received by those clients. See the online help topic on manually configuring email clients for further information. Using email scanning with Netscape Communicator ----------------------------------------------- When you are using multiple profiles in Netscape Communicator, you need to ensure that you are using the same profile when enabling and disabling email scanning. Switching to a different profile after enabling email scanning will not let you disable email scanning unless you switch back to the profile you were using when you enabled email scanning. Using Norton AntiVirus with Eudora Light and Eudora Pro ------------------------------------------------------- Norton AntiVirus can correctly configure and scan email if you have either Eudora Light or Eudora Pro installed. Norton AntiVirus will also function correctly if you upgrade from Eudora Light to Eudora Pro. However, if you have both email clients installed, Norton AntiVirus may not recognize either or it may only recognize one of the two clients. You can manually configure non-recognized clients and Norton AntiVirus will then scan email received by those clients. See the online help topic on manually configuring email clients for further information. Turning email timeout protection off and on ------------------------------------------- Protection against timeouts when scanning email is enabled by default in Norton AntiVirus. If you have turned timeout protection off, you should restart your computer after turning it on and before downloading email. Disabling email scanning while a download is in progress -------------------------------------------------------- Norton AntiVirus does not support disabling email scanning while an email download is in progress. If you do this and if the email that you are downloading contains an infected file attachment, portions of this infected file attachment might be left in your TEMP directory (usually C:\WINDOWS\TEMP or C:\TEMP). It is recommended that you delete this file. If you should attempt to extract the infected contents of this file, Norton AntiVirus Auto-Protect will protect you from any infections. Manually enabling and disabling the plug-in for Office 2000 ----------------------------------------------------------- Sometimes Norton AntiVirus setup cannot configure the Norton AntiVirus plug-in for Microsoft Office 2000. You can enable or disable it manually using the following procedures. To enable the plug-in for Office 2000: 1) Click the Start button, and then select Run. 2) In the Open box, type the following. The quotation marks are important. You may have to change the paths to suit your installation of Windows and Norton AntiVirus. "C:\Windows\System\Regsvr32" "C:\Program Files\Norton AntiVirus\OfficeAV.dll" 3) Click OK. You will see the following message: DllRegisterServer in C:\Program Files\Norton AntiVirus \OfficeAV.dll succeeded. To disable the plug-in for Office 2000: 1) Click the Start button, and then select Run. 2) In the Open box, type the following. The quotation marks are important. You may have to change the paths to suit your installation of Windows and Norton AntiVirus. "C:\Windows\System\Regsvr32" /U "C:\Program Files\Norton AntiVirus\OfficeAV.dll" 3) Click OK. You will see the following message: DllUnregisterServer in C:\Program Files\Norton AntiVirus \OfficeAV.dll succeeded. ********************************************************************** END OF FILE **********************************************************************