Another Rootkit comes out of the woodwork - this time from Symantec

http://securityresponse.symantec.com/avcenter/security/Content/2006.01.10.html

Regards - Charles

 

Thanks Arie, didn't see the PCWorld article - didn't know about KAV.

Makes you wonder who else is doing this and for how long.

Regards - Charles

 

Norton AV 2005?

Well there is a patch for Norton Works but what about those of us that only run Norton AV 2005? There's been no mention of it and the protected trash is included there also. I could disable that, but if I'm correct, disabling won't fix the problem. The "hide program" will still be there and functional. Am I correct on that and if so what now? Thanks in advance.

 

Hello Brenda,

NAV2005 is one of my AV's - I don't see any mention of "Protected Recycle Bin ". I've E-mail scanning, Interent Worm Protection, and LU disabled. Is it tied to one of these?

From my understanding, the problem is limited to SystemWorks versions for 2005 and 2006.

Regards - Charles

 

Arie posted an update on this issue: http://www.internetnews.com/security/article.php/3577276

Regards - Charles

 

Hi Charles,

Open Norton AV and click on "options" then under "other" click on "Advanced tools" That's where you'll find the protected recycle bin listing.

 

Hi Brenda,

Don't see it.

Regards - Charles

 

How odd! I did a print screen of mine but how the heck do I attach it to this? The only thing I can figure is that I bought the 3 lic pack because I have 3 computers. It doesn't say anything about it on the box but the user guide has it listed under advanced utilities and unerase wizard...on page 22...and yes, I'm sure I have Norton AV 2005 and not system works.

 

Hi Brenda,

Ok, checked a NAV2005 installation on another system, and yes, found it under Advanced Tools. I don't have that.

Don't know if that's an option on the original install procedure or not - don't remember, been almost a year.

Regards - Charles

 

Hi again! Attachment not needed now! And I can stop thinking I've gone nuts too! But it still brings us back to "what do those of us with just AV 2005 to do about the problem" doesn't it? I think it may be time to email Symantec support. Thanks for restoring my idea that I'm a fairly sane person.

 

After an hour of waht was like pulling teeth spent with Symantec chat here's what I was finally told.

Manjunath N: I apologize for the confusion, you can run the patch released for Norton SystemWorks (NSW) for Norton AntiVirus (NAV) also.

But only after being told repeatedly taht NAV 2005 doesn't have the protected recycle bin! It would seem I need to go to work for Norton!

 

Hi Brenda,

Glad you've got a resolution of this.

Still trying to figure why I don't have the protected recycle bin option - not that I want it

But only after being told repeatedly taht NAV 2005 doesn't have the protected recycle bin!
That respnse may be an indication of different versions of NAV2005. I do have a dim recollection that versions sold in various parts of the world do differ, but never found out how.

My version came from a re seller, not a boxed version or a direct download from Symantec.

Regards - Charles

 

I did finally find an article from Symantec that says "some" versions of NAV do have the protected recycle bin {PRB} and that those will automatically download the patch if you have auto update running. If run manually it will be in a symevent update. Funny thing is it's called a symevent update not a protected recycle bin patch. But I was able to check the version in symevent and verify that it had, indeed, already been done.

My version is a boxed NAV 2005 Home protection Pack. It's a 3 lic pack. Maybe that's the difference. My best advise would be, if you have the option to not install PRB, don't. If not check to make sure it's updated. Do a search for symevent.sys {it should be somewhere in c:windows}. Right click on it and choose properties then check the version. If updated it will be version 11.6.6.1. I had 2 show up in the search but only one was in the windows folder.

I hope this helps someone else! Good luck to all!

 

What about Systemworks 2004 ?

I use Systemworks 2004 professional
It also has a hidden recycle bin but there is no mention of a patch for the 2004 version does anybody have any info please.

 

Hi AlBoy,
The article that finally clear it up for me is at

http://service1.symantec.com/SUPPOR...ton SystemWorks&ver=2005&csm=no&seg=hho&tpre=

According to the article a live update, manual or auto, will get the patch and that's all you need to do except for a possible reboot. Hope this helps!