Can a virus knock out your NAV password?

[David Bodycombe]

Ok, here's an interesting one.

I was in my lounge when I heard my laptop reboot. I thought this was odd so
I went and had a look. I saw that a program called svchost.exe (or similar)
was running a DOS script and it looked weird and ugly, so assumed it was a
virus that had mysteriously managed to self-run somehow.

"OK," I thought, "I better upgrade to Norton 2004" which, luckily, had
recently arrived here.

So I installed this but at the end of install it said that I wasn't in
Supervisor mode. I tried to run NAV 2003 and curiously all the options had
been disabled. When I try to re-enable them, it asks for a Supervisor
account.

Problem is - I don't think I've ever activated user accounts nor a
Supervisor account, and the only password I use for these things didn't
work.

Is it possible that whoever hacked in to my machine has activated the user
accounts and set up a Supervisor password, thus locking me out of my own
antivirus software?

Also, interestingly every time I try to access any site with "symantec" in
the URL, my browser says "Page not found" even though I can see it is
retrieving the Title OK before failure. Is this a "feature" of the virus?

So what I need to know is:
1) Do I have a virus or not?
2) How can I reestablish myself as the Supervisor?

Thanks in advance,

David

 

[David Bodycombe]

I was in my lounge when I heard my laptop reboot. I thought this was odd so
I went and had a look. I saw that a program called svchost.exe (or similar)
was running a DOS script and it looked weird and ugly, so assumed it was a
virus that had mysteriously managed to self-run somehow.

Found which one it is - AGOBOT or GAOBOT. Symantec say it's one of their
newest. Looks ugly - never seen this kind of backdoor access before.

Have been able to get access to the Symantec sites now but am still locked
out by this Supervisor password issue.

Any ideas?

Thanks.

David

 

[Tom R]

out by this Supervisor password issue.

Any ideas?

Thanks.

David,
See if you can get to one of these sites and run an online scan.

Run a "free" online virus scan,
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Another free online virus scanner I use is
"BitDefender"
http://www.bitdefender.com/scan/license.php

Good Luck,
Tom

 

[Gabriele Neukam]

On that special day, David Bodycombe, ([email protected])
said...

Found which one it is - AGOBOT or GAOBOT. Symantec say it's one of their
newest. Looks ugly - never seen this kind of backdoor access before.

Which means it is time to save your documents on CD, and make a complete
format and reinstall of Windows. As Microsoft itself does say, as soon
as someone has convinced you to allow them to control your machine, it
doesn't belong to you any more.


Gabriele Neukam

(e-mail address removed)