Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.



13 February 2007
Risk Impact:
File Names:
Systems Affected:


When Joke.Norantiv is executed, it displays two messages:
  1. The first message is a fake warning that appears to be from the "Norton AntiVirus Warning System."
  2. The second message that follows is "APRIL FOOLS."


A file is detected as Joke.Norantiv.


This joke program consists of one file that must be manually executed.

Antivirus Protection Dates

  • Initial Rapid Release version 02 October 2014 revision 022
  • Latest Rapid Release version 01 February 2015 revision 020
  • Initial Daily Certified version 02 April 2004
  • Latest Daily Certified version 17 January 2008 revision 033
  • Initial Weekly Certified release date 07 April 2004
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

When this joke program is run, it displays this message:

If you click OK, it displays this message:

  1. Update the definitions.
  2. Run a full system scan and delete all the files detected as Joke.Norantiv.
For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To scan for and delete the files
  1. Start your Symantec antivirus program, and then run a full system scan.
  2. If any files are detected as Joke.Norantiv, click Delete.

    Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.