norton internet security

crispi · #1 05-03-2004, 01:00 PM

windows xp home
norton internet security
adsl broadband

I have a continual flashing white exclamation mark in a red circle over my norton I.S icon in the tray. Can't find any info. about it. Help appreciated.
By the way mods. sorry if wrong place for thread. I new boy
cheers

scouse · #2 05-03-2004, 01:26 PM

It sounds like it is telling you it is not enabled? right click on it and see if there is a word "ENABLE" or "START" or "RUN" and click on it.. then if the programme loads just close it down top right corner..

ESALADUANE · #3 05-03-2004, 01:30 PM

That's an alert that NIS has detected an attempt to breach your security. I got alot of them yesterday from Sasser (but, none today). Just right-click the icon and turn off the notification. Or, if the alerts are getting too annoying you can turn off the alert system all together.

To turn Intrusion Detection alerts on and off

1. In the main window, double-click Intrusion Detection.
2. In the Intrusion Detection window, check or uncheck Notify me when Intrusion Detection blocks connections.
3. Click OK.

scouse · #4 05-03-2004, 01:43 PM

It is good to know, i have never used Norton I.S, sounds quite good ESALADUANE. I may give it a try.

ESALADUANE · #5 05-03-2004, 01:53 PM

Turning off the alerts doesn't turn off your Intrusion Detection system. You're still protected. You just won't see the flashing alert sign anymore.

crispi · #6 05-03-2004, 02:35 PM

Quote:

That's an alert that NIS has detected an attempt to breach your security. I got alot of them yesterday from Sasser (but, none today).

Ooops! I turned off NIS briefly because my connection was constantly busy and the speed was really really slow and caught the following, sasser (fixed), welch (tool didn't find it, false alarm maybe?) and this W32.Gaobot!inf (ran the gaobot tools to no avail), which means i have a connection a little worse than a 16k modem!
Oh and i think i blocked broadband provider nodes!

I deserve laughter, but when thats over, any help much appreciated??!!

ESALADUANE · #7 05-03-2004, 02:52 PM

I would suggest using LiveUpdate and then running a full system scan to make sure that you're clean. Are these the Removal Tools that you Used?

W32.Sasser Removal Tool
http://securityresponse.symantec.com...oval.tool.html

W32.Welchia.Worm Removal Tool
http://securityresponse.symantec.com...oval.tool.html

W32.Gaobot Removal Tool
http://securityresponse.symantec.com...oval.tool.html

crispi · #8 05-03-2004, 02:55 PM

Yes they are the exact ones i used. I thinking is there some windows Crit. update i need?

ESALADUANE · #9 05-03-2004, 03:02 PM

If you've been keeping up with your Windows Updates you should have everything you need (as long as your firewall is up). The Update (patch) that's directly relevant to Sasser is MS04-011 (KB835732) which was part of the April Updates (Updates usually come out the 2nd Tuesday of every month).

http://www.microsoft.com/technet/sec.../MS04-011.mspx

crispi · #10 05-03-2004, 04:13 PM

Thanks for your help ESALADUANE. It seems to be alot better now although it still says i have the sasser in one file, but the symantec site isn't responding. I try later

ESALADUANE · #11 05-03-2004, 04:19 PM

It may be in one of your System Restore points. Did you disable/re-enable System Restore?

"If the computer is infected with a virus, then it is possible that the virus could be backed up by System Restore. By default, Windows prevents System Restore from being modified by outside programs. As a result, there is the possibility that you could restore a virus-infected file, or that the on-line scanners would detect the virus in that location."

Disabling or enabling Windows XP System Restore
http://service1.symantec.com/SUPPORT...01111912274039

crispi · #12 05-03-2004, 04:38 PM

Ok you are a smart cookie! Somehow it turned itself back on!!

crispi · #13 05-04-2004, 10:53 AM

Thanks alot for your help ESALADUANE, all clean now. If its ok with you i would like to see if i understand what has happened.
Windows security/critical updates update windows so that the conditions for say the sasser virus to be "invited" to your computer are removed.
If there is a virus without a fixtool, norton liveupdate will update the norton program on your computer and get rid off the virus..
If a file has a virus but is in the system restore, fixtools cannot see it as they not allowed access to those files, and norton virus scans can see it but can't fix it. The only way to get rid off it is to disable system restore so that those files are permenantly deleted.
Thanks again, (hopefully a slightly wiser geek!!!)
Chris

ESALADUANE · #14 05-04-2004, 11:08 AM

Symantec only has Removal Tools (fixtools) for a selected number of commonly encountered viruses (see the link below for a list). However, they add virus definitions (almost as fast as they're encountered) to your computer as long as you use LiveUpdate regularly (daily, weekly). Yes, Microsoft releases "patches" whenever a vulnerability is discovered. And, yes, your right about System Restore.
http://securityresponse.symantec.com...ools.list.html

McAfee has a similar Removal Tool (called Avert Stinger v2.2.5) that removes several common viruses.
http://vil.nai.com/vil/averttools.asp