A virus that cancels AV install?

[scotttu]

I've got a PC here that seems to have a mind of it's own.

Now keep in mind I've been doing this job since 1993, BBS's, mainframes, the works.

But this one, first real issue with the newer virii.


Norton Corp edition 8.1, doing an install and it gets about 3/4 through it and says "Rolling back", then says something interrupted the install.

I finally pulled the drive out and put it as a slave to my drive, with 8.1 corp edition installed and found 3 viruses but then it locks up every time it finds an additional one, Wininet.dll for example.....


Can someone identify which viruses can disable norton? I've run a few of the common AV tools from Symantec but no joy.


Tx

 

[SNGX1275]

See if you can clean it with an online scanner, such as TrendMicro's Housecall.
http://housecall.antivirus.com/housecall/start_frame.asp

 

[Mictlantecuhtli]

Originally posted by scotttu
Can someone identify which viruses can disable norton?

At least Klez does this.

F-Secure Virus Descriptions : Klez
4. The worm kills tasks of anti-virus and security software as well as tasks of several other worms - Nimda, Sircam, Funlove and CodeRed. The worm opens processes and looks for the specific text strings there. If a specific text string is found in a process, the worm terminates this process. The strings the worm looks for are:

Sircam
Nimda
CodeRed
WQKMM3878
GRIEF3878
Fun Loving Criminal
Norton
Mcafee
Antivir
Avconsol
F-STOPW
F-Secure
Sophos
virus
AVP Monitor
AVP Updates
InoculateIT
PC-cillin
Symantec
Trend Micro
F-PROT
NOD32

 

[SNGX1275]

Heh based on that, running housecall isnt' going to do you any good afterall.

 

[agissi]

format c:

 

[Korperal]

start/run/regedit/hklm/software/microsoft/current version/run