On 2006-04-19 Nic James wrote:
I have a non IT-savvy acquaintance who has asked me to try and sort
this issue. He is running a fairly new version of the Symantec AV
product for XP Home and the Live Update feature gives him the following
error message when it runs:
Error: "LU1875 This update failed during its preprocessing welcome text
phase"
The Symantec web site does mention this error and points to possible
infection by the Trojan.Abwiz.F Trojan horse, they also supply a
removal tool.
Removal tools are worthless crap. According to the Symantec bulletin
Trojan.Abwiz.F has backdoor capabilities, so nobody could possibly know
what else has been changed on the box in the meantime. The only reliable
way to get the box back to a clean state is:
- backup data
- format disk
- reinstall
- check backed-up data
- restore clean data
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx
I have followed their instructions for running the tool, including
running it in Safe mode, and the tool said that the Trojan was not
present.
So it may be a false positive, it may be a variant that was wrongly
detected as Trojan.Abwiz.F, it may be that the trojan horse tampered
with the removal tool, or anything else you can think of.
The Symantec description of this Trojan mentions rootkit abilities -
so what I would like to ask the list is :
1. Would it be possible, if the rootkit (presumably a system level
one?) has deployed, for it to fool the removal tool ?
Most definitely.
Regards
Ansgar Wiechers
--
"Der Computer ist da, um zu rechnen, nicht um Ausreden wie 'Kann nicht
durch Null teilen' auf den Bildschirm zu schreiben."
--Marco Haschka in de.org.ccc
-------------------------------------------------------------------------
This List Sponsored by: Webroot
Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise
http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------
