possibly infected machine?

[Coxy01]

hello,

I am looking at a problem on my friends machine for him, he has been running norton internet security for a year or so, last night it reported an attempted attack on the machine (not unusual) norton then stopped running on his logon, but, would run on a different logon (both users not admins same permissions etc) now it will not run on any logon, security has set it self to off instead of on, when you try and turn security back on you tick the box but it just wont run and security is perminently disabled, the machine is running slow and nearly unusable unless booted in safe mode, I have looked at the processes that are running and they seem to be legitimate. Spybot finds problems but then when you try to fix them it falls over, adaware has found a couple of dodgy registry entries and sorted them, I think that norton has been attacked by the virus and that is why it does not work?

a norton scan on the available logon that would run it found nothing which really surprised me, is the machine infected?
any one seen this behaviour before?

Thanks

 

[bcastner]

You should do an online AV scan, (Symantec sounds like a good idea):

http://www.mvps.org/sramesh2k/Scanners.htm

But usually this is not a true virus issue, but more one of general malware. My teenage daughter's school (everyone is required to have a laptop) was experiencing this widely last month due to an AIM *AOL Instant Messenger" hijack that was not picked up by any virus scan I tried. If you use AIM see if it acts oddly, and see:

http://www.jayloden.com/VirusClean.htm

Finally use the malware cleanup tools discussed in faq608-4650