On 8 Apr 2007 09:42:00 -0700, "Roundtable"
>Anyway, so as usual every year I bought my Norton and installed AND
>registered it online in January.
Not a fast learner, eh? (sorry, couldn't resist <g> )
>In February I changed my internet provider from Cablecom to Swisscom.
>(I'm a Brit living in Switzerland)
OK...
>Already in January this worm called Driveclean kept popping up and
>telling me that the "sex-pages" (like Shakespeare websites) I was
>loking at would leave traces on my PC, and should it scan, etc.
Antivirus software such as "Norton" (in reality, post-Norton Symantec)
are weak on commercial malware, and it sounds like you got click-happy
when some web site popped up a fake "system error dialog".
Write this in flaming letters: NO AV WILL PROTECT YOU SO WELL THAT YOU
CAN GET CLICK WHATEVER YOU LIKE WITH IMPUNITY. That's not just for
Roundtable, but for everyone who says "In Norton We Trust".
>Then a few days ago a window popped up saying User32.exe had been
>illegally transferred and was occupying another address, and my system
>wouldn't work, etc.
That, OTOH, sounds like a known issue that arises if you:
- have Reaktek audio control installed (sound driver foistware)
- apply a recent patch against the ANI exploit
If so, this is not a malware effect. Let me find you the hotfix URL:
http://www.microsoft.com/downloads/d...playlang=en&tm
(Thanks, Susan Bradley!)
>All this time, my Norton Liveupdates were blithely telling me that my
>PC was absolutely healthy.
Yup. Once malware goes resident, the av is pretty much out of the
trust loop. If you came home to find your club doorman standing
firmly at his post while a gang of misfits ran amok inside, would you
trust him when he says "all's well, squire"?
>(See how they lie to us - they lie!)
A resident av is running in the same infected OS as the malware, so
it's a fight among "equals" (best-case). It's as if there was a
burglar deep in the bowels of your darkened house, with his gun drawn
and pointing at the illuminated doorway through which you will appear
asking "hello, is anyone there?" I know where I'd place my bets.
>So I googled and then got onto the Microsoft page which suplied a
>download patch to solve the User32.exe (which happens to be a Trojan)
>problem, downloaded it....
>and now my Norton has shut down and told me my subscription had
>expired!
Norton AV will do that, and if you know a bit more about it, you can
(as I do) guess why this is.
Norton AV is feeware (i.e. you pay for it, that's why it dies every
year so that you're encouraged to pay again).
Not only that, but Symantec are a vandor who embed commercial malware
within the product; something like Windows Product Activation to fuss
about whether you're "properly licensed" or not, whether it's still on
the "same PC" or is now on a "different PC".
This means you have hidden, undocumented code from Symantec that is
operating against your interests for their commercial reasons (hence
described as "commercial malware").
This makes the av more brittle; any changes may make it "think"you're
breaking your license terms, and so (being a vandor, i.e. VANdal +
venDOR) the program logic deliberately stops working. Nice, eh?
In the context of malware, one often has to go bare-knuckles looking
for hidden code etc. but in this case, you also have to ask; is this
part of "Norton"'s stealth licening crap, or is it the malware I'm
after? If I kill this, am I cleaning my system, or hobbling my
defenses so that I can be more easily overrun? Do I feel lucky?
As you can guess, my answer is to simply use a product that sucks
less, from a vendor that isn't aiming to stab me in the back with one
hand even as he takes my money with the other.
>And today my PC was slow to start, had to re-start about 8 times, etc.
>and my Norton told me my subscription had expired completely.
>So I removed it and installed a different, free anti-virus programme
>and on Tuesday I'm going to take the Norton package back to
>the shop and I'd like to find those Symantic guys and fling the
>whole thing into their ugly faces.
Ah, the enlightenment begins ;-)
>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -
Similar Threads
Linear Mode
