Windows Forum

Ask something
Discussion Locked

Antivirus Removing Itself from Win2000

0 helpful
8 replies

by bmurphy

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I was wondering if anyone is using Symantec Corporate Antivirus version 8.1 We are using it at work and it shows which computers it is protecting and when they were scanned. I just recently scanned by IP group and found that a punch of my machines were not detected. Then after further investigating. I found the machines no longer had Norton Antivirus installed on them. This happened on a punch of Win2000 Pro machines. It looks like of of the classrooms are still protected and the other half is not. It is not left in the add/remove program. The students and teachers do not have permission to remove anything. I have searched on the internet but am not finding any thing. Has anybody else witnessed this?

8 replies

by cg it

In the symantec systems console, under your server group, you set administrative settings for antivirus. you specify that a user must provide a password to remove antivirus from the computer. Only users who know the password and are members of the administrators group can remove antivirus from the computer. If these are not set a user can log on locally with an administrators account and remove Norton Antivirus.

by cg it

note this policy setting applies whether the user logs on locally or onto the domain.

by cg it

also note that if the policy is set correctly, a credential popup box will activate requesting a password anytime someone tries to uninstall Norton AV.

by jdmercha

I've seen McAfee remove itself because of a virus that hit the machine before the McAfee update that would have detected it. I had to boot to a CD and run a scan to detect and clean the virus.

by bmurphy

I checked the settings and they are correct the teachers and students do not have access to remove software. I also went to a few labs and tested it on the machines and was not able to remove any software. The antivirus is the only software that has been cleanly removed from the units. It has happed in more then one building.

by caestelle

I to have seens viruses uninstall AntiVirus software...Do you see any other symptoms(cpu pegged? suspicious software installed..) Regardless, I would download a utility like Stinger(offered by McAfee)and run that and see what it finds. If that comes back clean you might try booting to a cd and running a scan in dos like jdmercha suggested.

As a side note, have you researched Symantec's KB or called support??

Good luck!!

This discussion is closed to new replies.