Join or sign in Register for your free TechRepublic membership or if you are already a member, sign in using your preferred method below. Use Your Email Use FacebookUse Linkedin

Antivirus Removing Itself from Win2000

Locked

I was wondering if anyone is using Symantec Corporate Antivirus version 8.1 We are using it at work and it shows which computers it is protecting and when they were scanned. I just recently scanned by IP group and found that a punch of my machines were not detected. Then after further investigating. I found the machines no longer had Norton Antivirus installed on them. This happened on a punch of Win2000 Pro machines. It looks like of of the classrooms are still protected and the other half is not. It is not left in the add/remove program. The students and teachers do not have permission to remove anything. I have searched on the internet but am not finding any thing. Has anybody else witnessed this?

Topic

Reply To: Antivirus Removing Itself from Win2000

In reply to Antivirus Removing Itself from Win2000

In the symantec systems console, under your server group, you set administrative settings for antivirus. you specify that a user must provide a password to remove antivirus from the computer. Only users who know the password and are members of the administrators group can remove antivirus from the computer. If these are not set a user can log on locally with an administrators account and remove Norton Antivirus.

Reply To: Antivirus Removing Itself from Win2000

In reply to Reply To: Antivirus Removing Itself from Win2000

note this policy setting applies whether the user logs on locally or onto the domain.

Reply To: Antivirus Removing Itself from Win2000

In reply to Reply To: Antivirus Removing Itself from Win2000

also note that if the policy is set correctly, a credential popup box will activate requesting a password anytime someone tries to uninstall Norton AV.

Reply To: Antivirus Removing Itself from Win2000

In reply to Antivirus Removing Itself from Win2000

I’ve seen McAfee remove itself because of a virus that hit the machine before the McAfee update that would have detected it. I had to boot to a CD and run a scan to detect and clean the virus.

Reply To: Antivirus Removing Itself from Win2000

In reply to Antivirus Removing Itself from Win2000

I checked the settings and they are correct the teachers and students do not have access to remove software. I also went to a few labs and tested it on the machines and was not able to remove any software. The antivirus is the only software that has been cleanly removed from the units. It has happed in more then one building.

Reply To: Antivirus Removing Itself from Win2000

In reply to Antivirus Removing Itself from Win2000

I to have seens viruses uninstall AntiVirus software…Do you see any other symptoms(cpu pegged? suspicious software installed..) Regardless, I would download a utility like Stinger(offered by McAfee)and run that and see what it finds. If that comes back clean you might try booting to a cd and running a scan in dos like jdmercha suggested.

As a side note, have you researched Symantec’s KB or called support??

Good luck!!

Reply To: Antivirus Removing Itself from Win2000

In reply to Reply To: Antivirus Removing Itself from Win2000

Poster rated this answer.

Reply To: Antivirus Removing Itself from Win2000

In reply to Antivirus Removing Itself from Win2000

This question was closed by the author

[Author]

Replies