Re: Program that disables my anti-virus

From: Malke (notreally_at_invalid.com)
Date: 08/28/05 

Date: Sun, 28 Aug 2005 05:13:50 -0700

Patrick Dickey wrote:

> C L via WinServerKB.com wrote:
>> Hey guys, my wife clicked a link on MSN messenger that said "hey
>> check this out ....blah blah blah.
>> She said her friend was pretty intent on her looking at it. I
>> checked the message history and found that she was getting this
>> message every 2 minutes
>> or so. I figured that it was a virus or something so I went to do a
>> scan
>> with Norton AV 2005. It turns out it was disabled. I never disable
>> it and
>> my wife wouldn't know how to do it either. So I try to enable it but
>> it
>> won't. So I tried to uninstall NAV and reinstall it but I keep
>> getting an
>> error. Saying "internal error 2753.SAVScan.exe.3333244E...........
>> Also I can't visit the symantec web site or other various anti virus
>> websites.
>>
>> So I downloaded McAfee ran that and it found a trojan.
>> I still an't visit anti virus web sites though. Any ideas?
>
> You need to edit your HOSTS file and remove the references to the
> antivirus sites. Your HOSTS file is either in C:\Windows (Windows 9x)
> or C:\Windows\System32\drivers\etc and you'll use Notepad to edit it.
> Remove ONLY the references to the antivirus sites. The one that
> absolutely HAS to stay is 127.0.0.1 localhost. If there are others in
> there, and they redirect to 127.0.0.1 ask in here before removing them
> (unless they are for an antivirus site).
>
> Also, try going to
> http://housecall.antivirus.com/housecall/start_corp.asp and running
> that
> scan. Make sure you have the Auto Clean option checked before you
> start.
>
> You may also want to check out the public.microsoft.msn.messenger
> newsgroup and public.microsoft.msn.discussion newsgroup. If you're on
> webnews, look for public.microsoft.msn and click the + by it.
>
> Hope this helps you.
> Patrick.
>

Patrick has given you good advice, but I'd change just this one teensy
thing: start cleaning up by scanning with TrendMicro's Sysclean in Safe
Mode. I don't recommend going to online virus scanners (if you can get
to one) because the malware will be active on line. Standard procedure
when cleaning viruses and malware is to disconnect the infected
computer from all networks and do the removal work in Safe Mode. This
means getting the tools and updates you need from a different,
known-clean computer with an Internet connection and a cd burner (or
have a usb thumbdrive with enough capacity to transfer the files).

Once you have done your initial scanning with Sysclean, your installed
full-featured av may work. If so, update it and do a thorough scan in
Safe Mode. OTOH, when NAV breaks it is almost impossible to fix. You
may need to uninstall/reinstall NAV, and you should refer to Symantec's
removal instructions first:

http://www.symantec.com/techsupp/index.html - Symantec tech support

There are instructions for running Sysclean and for general malware
removal here:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke 

-- 
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"