Nic, A root kit definately could hide the virus from the removal, in factthats
one of their primary designs. The unfortunate thing is that youcan't really
guarentee the removal of a rootkit. With that said, Ihighly recommend the
Ultimate Boot CD for Windows or BartPE. They arewindows preinstall
environments that you build and burn to a cd. Theycontain multiple virus
scanners. Due to the fact that these disks arenot writable and not part of the
infected system(don't build them onthe infected system) they aren't affected by
the root kit.--Turk
On 4/19/06, Nic James <nic.james@btconnect.com> wrote:> List,>> Hoping this
subject is Ok to post here:>> I have a non IT-savvy acquaintance who has asked
me to try and sort> this issue. He is running a fairly new version of the
Symantec AV> product for XP Home and the Live Update feature gives him the
following> error message when it runs:>> Error: "LU1875 This update failed
during its preprocessing welcome text> phase">> The Symantec web site does
mention this error and points to possible> infection by the Trojan.Abwiz.F
Trojan horse, they also supply a> removal tool. I have followed their
instructions for running the tool,> including running it in Safe mode, and the
tool said that the Trojan> was not present.> The Symantec description of this
Trojan mentions rootkit abilities - so> what I would like to ask the list is
:>> 1. Would it be possible, if the rootkit (presumably a system level> one?)
has deployed, for it to fool the removal tool ?> 2. Has anyone come across
other reasons for why Live Update would give> this error message for the update
LU1875 ?>> There are other posts on places like ZDNet and some of the
'consumer'> sites that mention this error, but so far I have been unable to
find a> satisfactory answer (I could of course be looking in the wrong place).>
I have not approached Symantec directly as yet, I guess because> (naively?) I
figured if there were other problems with this update it> would be on their
site and so far i haven't seen any.>> Many thanks for your time List.>> Nic.>>>
-------------------------------------------------------------------------> This
List Sponsored by: Webroot>> Don't leave your confidential company and customer
records un-protected.> Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for
FREE with no> obligation. See why so many companies trust Spy Sweeper
Enterprise to> eradicate spyware from their networks.> FREE 30-Day Trial of Spy
Sweeper Enterprise>> http://www.webroot.com/forms/enterprise_lead.php>
-------------------------------------------------------------------------->>
