Tech: Virus attacking Norton and MacAfee?

Subject: Tech: Virus attacking Norton and MacAfee?
From: GUEST,lurker
Date: 26 Jun 04 - 05:13 PM

I've apparently been infected with this virus three times. It attacks Norton Anti-virus and MacAfee, turning them off while still making them appear on. Has anyone else heard about this/have advice?

Thanks from...the lurker

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: emjay
Date: 26 Jun 04 - 05:23 PM

I haven't heard of it, but www.snopes.com is a good place to look for information about viruses and a good many other things. I didn't find anything about a virus attacking Norton and McAfee. There was a Symantec site, and I went to it but didn't find anything pertinent. You could contact Norton or McAfee if you have one or both of those. I'm sure their tech support could help you.
In the meantime by McAfee anti-virus and firewall seem to be doing the job. (Knock on wood? or is there a high-tech version when you aren't quite sure or are pretty ignorant?)

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: Jim McLean
Date: 26 Jun 04 - 05:36 PM

Ensure you're no a victim of a hoax. There is one which states that neither Norton nor McAfee can detect it.

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: Ed.
Date: 26 Jun 04 - 05:36 PM

I've apparently been infected with this virus three times

What were the symptoms?

emjay's comments seem very sound

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: Rapparee
Date: 26 Jun 04 - 05:44 PM

Symantec's Security Response site is here. Scroll down and you'll find the hoaxes area.

Other antivirus software manufacturers have similar sites.

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: nutty
Date: 26 Jun 04 - 06:02 PM

On the other hand other sites on the web may be more honest.

Information on this site CLICK tells a different story .....

The Anti Anti-virus Viruses

Anti anti-virus viruses put forth their energy and efforts into targeting anti-virus programs. These are also called retro
viruses.

Anti anti-virus viruses try to keep the user from detecting them by corrupting the anti-virus software. In attacking anti-virus software, they will try to delete or change the anti-virus programs and data files so that they do not function properly.

Retro viruses sometimes try to avoid corrupting anti-virus software while in the infection phase. They do this because, if the anti-virus software is not working properly, the user will attempt to fix it. This would make it difficult for the virus to continue spreading.

Examples of anti anti-virus viruses: Goldbug, Tequila, Varicella, and Tremor.

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: Rapparee
Date: 26 Jun 04 - 06:14 PM

Try here for info from US-CERT.

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: JohnInKansas
Date: 26 Jun 04 - 06:58 PM

If you are using WinXP, and to some extent with (some) other OS, the automatic backup/recovery "features" can cause persistent reinfection with a virus that manages to get on your machine.

Since the autorecovery system makes frequent copies of the registry, and will restore the "last best copy" if something changes unexpectedly, a virus that uses a changed registry entry may be "relaunched" if autorecovery restores to a backup registry copy that contains the virus the next time you restart the machine. This can be a perpetual cycle.

There have been numerous virus versions and variations that attempt, with varied success, to disable AV programs. There have also been numerous attempts to launch DDoS attacks on major AV providers' websites to prevent people from getting recovery tools.

The general procedure for such infections, or when one is suspected, is to:

1. Turn OFF autorecovery. This will delete all previous registry backups.

2. Go to a known reliable AV provider website, and use the "online scan for infections" available. This will use current AV signatures, and usually can do a valid scan.

3. Check the AV provider website(s) for any identifying filenames, or registry entries that may be associated with the suspected infection, and look for a complete procedure for removal.

4. PRINT and FOLLOW COMPLETELY AND EXACTLY ALL STEPS in any removal instructions you find.

In most cases, step 2 will actually accomplish disabling of the "virus" portion - IF YOU DID STEP 1 FIRST. Many infections carry "payload" files in addition to the "viral component" that gets the crap onto your machine, so the additional steps are needed to get rid of the "non-viral payload" junk.

In severe cases, after you have cleaned the crap off your machine, reinstallation of your AV program may be required. Once you have the system "clean" and AV working, you probably will want to turn autorecovery back on, since it is helpful in cases not associated with a virus of this kind.

John

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: Malcolm Douglas
Date: 26 Jun 04 - 07:12 PM

A few questions. You say you have "apparently been infected with this virus three times".

1. How do you know? Did you get a message from somewhere? What did it say? Be precise.

2. What is the "virus" called; or how was it referred to when you were told that you had been infected? Did the information come from a virus scan? If so, which one?

There is an art to asking technical support questions (even on a music forum), and you must provide all the information you have if you want a useful answer. Otherwise you are just going to waste everybody's time, including your own.

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: GUEST
Date: 26 Jun 04 - 10:22 PM

could lurker be a spammer?

did anything worthwhile come out of all of this?

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: GUEST,.gargoyle
Date: 27 Jun 04 - 01:14 AM

Cntrl-Alt-Del are your friends.

Also run a log of all programs you have running and when.

Sincerely,
Gargoyle

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: GUEST,lurker
Date: 02 Jul 04 - 02:58 PM

Thanks ever so for all your advice and links (no Guest, I'm a lurker, not a spammer).
How do I know I had it three times? The computer told me...

Many thanks again from...the lurker

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: GUEST
Date: 02 Jul 04 - 03:06 PM

?? your computer (which I would guess means your AV program)told you that you were infected with a virus that diables your AV program?

In that case - how did it inform you were infected?

Subject: RE: Tech: Virus attacking Norton and MacAfee?
From: JennyO
Date: 02 Jul 04 - 09:51 PM

Maybe it snuck in when your virus definitions weren't up to date?