Norton Antivirus at boot up? - Tilted Forum Project Discussion Community

arch13 · 09-29-2004, 01:34 PM

I have NortonAV 9.05 installed on my machine.
Unfortunatly, after 6 months not connected to the internet where I hadn't renewed my subscription, I got nailed by the w32.randex worm.
It opened a trojan payload via an irc channel and brought in about 1-200 adware files that adaware/spybot cuaght. I've found several instances of w32.randex on the machine, consistent with the viri's actions of making copies of itself named after real system service files.

However, Now that norton has the latest definitions it does not run a complete scan. I get error 15 (program failure) when I run a full scan. No problem checking indivigual folders or files, but i can't handle scanning the whole drive (about 17.9 gb of 80gb) on the full system scan setting. It tends to trip on files in the c:\documents and setting folder or the c:\program files folder. And it simply restarts the machine while trying to scan the c:\program files\norton antivirus folder. that makes me very nervous that NAV32.exe has been replaced with an infected version since at one point in recovering the system the Norton found virus box popped up stating that norton had found a virus in NAV32.exe.

The adware is gone but norton still can't deal and I am still getting a random popup if i use IE (always the same one), but since I use firefox, I haven't had a chance to really see what is invoking that popup.

Sooooo, Is there a way to invoke norton at boot to run a scan from dos or at bootup before services are invoked?
Starting in safe mode produces the same results, thus the question.

side question, I've got a few files in my content.ie5 cache folders that have large file names that cannot be deleted becuase their long names cuase a buffer overflow when deleting is attempted. Anyone have an idea how to kill them? I'm thinking from a c:\ prompt but ideas are appreciated...

glytch · 09-29-2004, 01:44 PM

Do you still have your Norton CD? If I remember correctly, you can boot from most Norton Anti-Virus cds and run the scan independant of the OS.

arch13 · 09-29-2004, 02:21 PM

Nope, no CD. This is an acedemic liscense given to all students as a zip file. Each install, generates an independent liscence key, thus you can't erase at the end of 1 year and re-install for more updates without paying for a subscription. Further, unistalling and re-installing to rid myself of this problem would mean paying again for a subscription since my virus suscription is tied to said independent liscence key that was randomly generated.

I searched Norton for an invoke on startup option and found none....
Please everyone, any suggestion is welcome...

soopafreek · 09-30-2004, 12:01 PM

have you tried using an online scan? http://antivirus.trendmicro.com ?

otherwise, you could used the "ultimate boot cd" - it has antivirus on it...
http://ubcd.sourceforge.net/

as for your ie.cache problem-- have you tried to rename the file(s) before deleting them? or shift-delete?

oh, and your popup problem -- are you running XP? is the messenger service disabled?

arch13 · 09-30-2004, 11:11 PM

Quote:

Originally Posted by soopafreek

have you tried using an online scan? http://antivirus.trendmicro.com ?

otherwise, you could used the "ultimate boot cd" - it has antivirus on it...
http://ubcd.sourceforge.net/

as for your ie.cache problem-- have you tried to rename the file(s) before deleting them? or shift-delete?

oh, and your popup problem -- are you running XP? is the messenger service disabled?

Online virus scan, damn... why didn't that cross my mind. Thanks

Ie.cache, yup tried both. Apperently, I've learned that MS is aware that this happens with some malformed cache files, but their KB has not info on it.

The popup isn't a messanger window, but a popunder IE window.

09-29-2004, 01:34 PM	#1 (permalink)
arch13 Loves my girl in thongs Location: North of Mexico, South of Canada	Norton Antivirus at boot up? I have NortonAV 9.05 installed on my machine. Unfortunatly, after 6 months not connected to the internet where I hadn't renewed my subscription, I got nailed by the w32.randex worm. It opened a trojan payload via an irc channel and brought in about 1-200 adware files that adaware/spybot cuaght. I've found several instances of w32.randex on the machine, consistent with the viri's actions of making copies of itself named after real system service files. However, Now that norton has the latest definitions it does not run a complete scan. I get error 15 (program failure) when I run a full scan. No problem checking indivigual folders or files, but i can't handle scanning the whole drive (about 17.9 gb of 80gb) on the full system scan setting. It tends to trip on files in the c:\documents and setting folder or the c:\program files folder. And it simply restarts the machine while trying to scan the c:\program files\norton antivirus folder. that makes me very nervous that NAV32.exe has been replaced with an infected version since at one point in recovering the system the Norton found virus box popped up stating that norton had found a virus in NAV32.exe. The adware is gone but norton still can't deal and I am still getting a random popup if i use IE (always the same one), but since I use firefox, I haven't had a chance to really see what is invoking that popup. Sooooo, Is there a way to invoke norton at boot to run a scan from dos or at bootup before services are invoked? Starting in safe mode produces the same results, thus the question. side question, I've got a few files in my content.ie5 cache folders that have large file names that cannot be deleted becuase their long names cuase a buffer overflow when deleting is attempted. Anyone have an idea how to kill them? I'm thinking from a c:\ prompt but ideas are appreciated... __________________ Seen on an employer evaluation: "The wheel is turning but the hamsters dead" ____________________________ Is arch13 really a porn diety ? find out after the film at 11. -Nanofever

09-29-2004, 01:44 PM	#2 (permalink)
glytch I am not permanent. Location: Tennessee	Do you still have your Norton CD? If I remember correctly, you can boot from most Norton Anti-Virus cds and run the scan independant of the OS. __________________ If you're flammable and have legs, you are never blocking a fire exit. - Mitch Hedberg

09-29-2004, 02:21 PM	#3 (permalink)
arch13 Loves my girl in thongs Location: North of Mexico, South of Canada	Nope, no CD. This is an acedemic liscense given to all students as a zip file. Each install, generates an independent liscence key, thus you can't erase at the end of 1 year and re-install for more updates without paying for a subscription. Further, unistalling and re-installing to rid myself of this problem would mean paying again for a subscription since my virus suscription is tied to said independent liscence key that was randomly generated. I searched Norton for an invoke on startup option and found none.... Please everyone, any suggestion is welcome... __________________ Seen on an employer evaluation: "The wheel is turning but the hamsters dead" ____________________________ Is arch13 really a porn diety ? find out after the film at 11. -Nanofever

09-30-2004, 12:01 PM	#4 (permalink)
soopafreek Psycho Location: ask your mom	have you tried using an online scan? http://antivirus.trendmicro.com ? otherwise, you could used the "ultimate boot cd" - it has antivirus on it... http://ubcd.sourceforge.net/ as for your ie.cache problem-- have you tried to rename the file(s) before deleting them? or shift-delete? oh, and your popup problem -- are you running XP? is the messenger service disabled? __________________ aaarrrrrgggghhhh!!!!