Certainly the first thing that any well-trained worm should do would be to look for the install log for any AV program that might be on the computer. Then it just needs to run the log backwards to remove the AV program, which is the chief impediment to accomplishing what the worm was sent to do.

It is for this reason that nearly all AV programs delete (or should delete) the install log on completion of the installation.

Without a log to "run backwards" normal removal procedures cannot be effective for anything but the most trivial of programs - and decent AV programs are far from trivial.

The failure to completely remove an AV program using "ordinary" removal methods, while not a proof, is at least evidence that the program was "strongly constructed and installed."

Retail Norton AV disks have generally include a step in the installation procedure that asks for permission to remove earlier versions, and some people skip that step. One reason for asking permission is that if you, the operator and owner of the computer enter the "permission" via a keystroke, variations in security setup don't have to be analysed to decide what permission to ask for and how to phrase the question and get an answer. The ONLY thing that matters is the one who hits the "YES" button is the BMFWIC who has to be obeyed by the OS.

Some download versions may have omitted the embedded "uninstall prior versions" step in the automated installation; but the instructions for installing the download invariably inform you that you should uninstall all prior versions before installing the new one, which you will do if you read the instructions before starting to install.

Some AV programs, that don't "embed" as deeply and protect as strongly as Norton can get by with installing over an earlier version, or another kind of AV program; but there is some risk that you'll break the whole system if you don't remove the one that's no longer to be needed.

And Norton is NOT the only good AV that is accused of "breaking the computer" when the actual cause is "operator error" and an incorrect or incomplete installation procedure.

In recent years (or decades) Norton has made available a "stand alone" program called "Norton Remover" that can be used if you need to clean up to install a new AV - Norton or any other. For complete effectiveness, it does remove "everything Norton" so it has the disadvantage that you might have to reinstall Utilities or Ghost after you use it. Most of the "embedded" removal programs that come on retail Norton AV and Ineternet Security program disks are a little more selective, but keeping the other disks handy is still recommended just in case.

John