Bit strange this one:

Had a phone call from Sal this morning saying that the Norton AV on her PC (Win 98) was reporting two trojan horse viruses. The initial thought was that they had come from an email received via Hotmail.

It appeared to be reporting a number of Internet Explorer Temp files (visual basic script files I think) as suspect and said that one virus had been quarrantined, the other could not be removed or accessed. I got Sal to delete all her temp internet files and run a full hard disk scan with Norton. This revealed no viruses.

Sal went online again and as soon as she accessed a page, she got the same Norton AV messages saying that there was a trojan horse virus on her machine.

Putting my IT hat on for a moment - I asked Sal 'what's changed' and she did say that she had downloaded an updated virus log file from Norton last night. She had also updated her version on MS Messenger. So the question is, has anyone else experienced similar problems recnetly, or do we really have a virus on this machine?

PC is running Win98 with the latest MS security patches and IE6.

Thanks for any help

Cheers
Chris

[Edited by Chris L - 10/31/2001 1:31:30 PM]

 

[qoute]as soon as she accessed a page[/quote]

was it any specific page?

 

Norton Antivirus users attempting to access MSN websites in Europe may be experiencing an alert for a 'Trojan Horse'. This alert is a False Alarm (False Positive), and should be ignored in this instance only. To resolve the issue, Norton Antivirus users are advised to update via LiveUpdate after 2pm CET.

Symantec apologises for any inconvenience caused, and stresses that Virus Alert messages should only be ignored under specific circumstances such as these and when advised to do so by Symantec.

 

I went to download a NIC driver from Realtek yesterday. Went to save it & after it had downloaded NAI reported Nimda in the file It couldn't disinfect & couldn't delete as "File Access Denied" so I fully expected problems once I'd pressed cancel.

However, did a full scan & search & it wasn't anywhere to be seen.

Not being an expert (Jack Clark OTU) but I would expect that the AV software has done it's job correctly on a temporary file that is being held in RAM before its written to disk. Hence that is why the file no longer exists. When the virus is located, the file is unable to be written to disk & the file is rejected?

Well that's what I think anyway

 

Get into good ol DOS and delete it from there

 

Doh - Jack can cut & paste faster than I can type

But on the basics, was I right? Was that why the file was unlocatable after I pressed cancel?

(PS Anyone got a NIC driver for a Realtek 3109B ? )

 

Thanks Guys (nice one Jack) - what stars you are!! Scoobynet does it again. Any of you lot fancy replacing our IT helpdesk at work?

Cheers
Chris

 

If you have the location of the file I'll check it out. Not likely that we'll detect it before it's been written to disk with out destop product. Only our WebShield products scan the HTML stream.

 

I'll look it up when I get back to work tomorrow - can't locate it here & it's a pain on 28k! Sent their webmaster an email yesterday.

We actually run the TVD suite - so possibly why. It was located in a temp IE file as the same name as the .exe I was downloading.

Haven't had problems downloading anything previously & my IE at work hasn't changed recently (5.5).

 

Thanks JackClark

I've got my update from Norton so hopefully that's the end of that little trauma The worst thing has been I was too scared to go on-line again (pc numptie ) so haven't even looked at scoobynet yet today

Sal

 

No problem, glad to see everyone alright.

I just can't believe that people have the ***** to create these things in these times. There's another one bubbling up right now, I'll post if I need to.