NAV Liveupdate Question

[Kierkecaat]

Liveupdate on my lady's Win98, NAV 2002 PC is accessing:

panther.umaryland.edu

for the update files. She is on several mail lists at Maryland, which
have been riddled with various virii for many months.

Is is known that Norton distributes its definitions and updates to
participating sites, or is there reason to be concerned about this
behavior?

Thanks,
KC

 

[Buffalo]

Be concerned.
Have her go to the Symantec website and use the Intelligent Updater to dl
and install the latest virus definitions.
Then have her run it.
She should also download,install, update the following free anti-spyware
programs.
AdAware
http://www.lavasoftusa.com/

Spybot Search & Destroy
http://security.kolla.de/

Spyware Blaster
http://www.wilderssecurity.net/spywareblaster.html

 

[Tom R]

I would run at least one of these free online virus scan's also.
RAV
http://www.ravantivirus.com/scan/

Panda:
http://www.pandasoftware.com/activescan/

BitDefender
http://www.bitdefender.com/scan/license.php

Tom

 

[Kierkecaat]

Thanks for the feedback. I'm right there with you on the strategies;
I booted her machine in safe mode and installed the latest Intelligent
Update after running the latest Stinger (both found NOTHING).

I did find that her RNAAPP.exe was frequently trying to make friends
connecting out on UPD port 137 to various addresses. Used Kerio to
put an end to that, but I don't know if that indicates a problem.

Liveupdate DOES appear to be a complex beastie, however: on both her
machine and mine, liveupdate.symantecliveupdate.com resolves to:

a568.x.akamai.net

But on her machine with a different ISP than mine, a568.x.akamai.net
resolves to a different IP than it does on mine:

193.108.95.47 vs. 63.211.66.38

It does seem possible that Norton has a system in place to disperse
the load on Liveupdate, doesn't it?

I would be interested to hear from someone who has looked directly
into this question.

Thanks, KC

 

[Chuck]

Thanks for the feedback. I'm right there with you on the strategies;
I booted her machine in safe mode and installed the latest Intelligent
Update after running the latest Stinger (both found NOTHING).

I did find that her RNAAPP.exe was frequently trying to make friends
connecting out on UPD port 137 to various addresses. Used Kerio to
put an end to that, but I don't know if that indicates a problem.

Liveupdate DOES appear to be a complex beastie, however: on both her
machine and mine, liveupdate.symantecliveupdate.com resolves to:

a568.x.akamai.net

But on her machine with a different ISP than mine, a568.x.akamai.net
resolves to a different IP than it does on mine:

193.108.95.47 vs. 63.211.66.38

It does seem possible that Norton has a system in place to disperse
the load on Liveupdate, doesn't it?

I would be interested to hear from someone who has looked directly
into this question.

Thanks, KC

KC,

Akamai is edge technology, and Symantec uses Akamai for its content
distribution, such as signature updates. Many ISPs have an Akamai server local
to their address space, so you should expect any xxx.akamai.net to resolve
differently for any different ISP.

In addition to running several virus scans, and AdAware / Spybot S&D (which
complement each other), I would advise HijackThis, which looks differently for
spyware. Complete instructions:
http://forums.spywareinfo.com/index.php?showtopic=227

For information about RNAAPP.exe, this might help:
http://www.modemhelp.net/newsletter/dun/combatrnaapp.shtml

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Kierkecaat]

Chuck, thanks, useful stuff.

Cheers, KC

KC,

Akamai is edge technology, and Symantec uses Akamai for its content
distribution, such as signature updates. Many ISPs have an Akamai server local
to their address space, so you should expect any xxx.akamai.net to resolve
differently for any different ISP.

In addition to running several virus scans, and AdAware / Spybot S&D (which
complement each other), I would advise HijackThis, which looks differently for
spyware. Complete instructions:
http://forums.spywareinfo.com/index.php?showtopic=227

For information about RNAAPP.exe, this might help:
http://www.modemhelp.net/newsletter/dun/combatrnaapp.shtml

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.