General discussion

  • Creator
    Topic
  • #2175462

    Antivirus Removing Itself from Win2000

    Locked

    by bmurphy ·

    I was wondering if anyone is using Symantec Corporate Antivirus version 8.1 We are using it at work and it shows which computers it is protecting and when they were scanned. I just recently scanned by IP group and found that a punch of my machines were not detected. Then after further investigating. I found the machines no longer had Norton Antivirus installed on them. This happened on a punch of Win2000 Pro machines. It looks like of of the classrooms are still protected and the other half is not. It is not left in the add/remove program. The students and teachers do not have permission to remove anything. I have searched on the internet but am not finding any thing. Has anybody else witnessed this?

All Comments

  • Author
    Replies
    • #3350521

      Reply To: Antivirus Removing Itself from Win2000

      by cg it ·

      In reply to Antivirus Removing Itself from Win2000

      In the symantec systems console, under your server group, you set administrative settings for antivirus. you specify that a user must provide a password to remove antivirus from the computer. Only users who know the password and are members of the administrators group can remove antivirus from the computer. If these are not set a user can log on locally with an administrators account and remove Norton Antivirus.

      • #3350519

        Reply To: Antivirus Removing Itself from Win2000

        by cg it ·

        In reply to Reply To: Antivirus Removing Itself from Win2000

        note this policy setting applies whether the user logs on locally or onto the domain.

      • #3350518

        Reply To: Antivirus Removing Itself from Win2000

        by cg it ·

        In reply to Reply To: Antivirus Removing Itself from Win2000

        also note that if the policy is set correctly, a credential popup box will activate requesting a password anytime someone tries to uninstall Norton AV.

    • #3350502

      Reply To: Antivirus Removing Itself from Win2000

      by jdmercha ·

      In reply to Antivirus Removing Itself from Win2000

      I’ve seen McAfee remove itself because of a virus that hit the machine before the McAfee update that would have detected it. I had to boot to a CD and run a scan to detect and clean the virus.

    • #3352185

      Reply To: Antivirus Removing Itself from Win2000

      by bmurphy ·

      In reply to Antivirus Removing Itself from Win2000

      I checked the settings and they are correct the teachers and students do not have access to remove software. I also went to a few labs and tested it on the machines and was not able to remove any software. The antivirus is the only software that has been cleanly removed from the units. It has happed in more then one building.

    • #3352159

      Reply To: Antivirus Removing Itself from Win2000

      by caestelle ·

      In reply to Antivirus Removing Itself from Win2000

      I to have seens viruses uninstall AntiVirus software…Do you see any other symptoms(cpu pegged? suspicious software installed..) Regardless, I would download a utility like Stinger(offered by McAfee)and run that and see what it finds. If that comes back clean you might try booting to a cd and running a scan in dos like jdmercha suggested.

      As a side note, have you researched Symantec’s KB or called support??

      Good luck!!

    • #3330797

      Reply To: Antivirus Removing Itself from Win2000

      by bmurphy ·

      In reply to Antivirus Removing Itself from Win2000

      This question was closed by the author

Viewing 4 reply threads