AntiVirus & Firewall keep disappearing

[AndyWatt]

Hi All,

I was on a site last week with a W2K workstation acting as a server and three W98 clients. The site is "new" - the server having being cloned from an existing machine.

The W2K machine had McAfee Virus Scan installed and the built-in Firewall enabled. However when we returned two days later the AV and firewall we no longer in memory.

We ran Stinger and Virus Scan from another PC (as as soon as you started AV something would unload it). We did find a virus (sorry, can't remember which) and successfully removed it. We had to uninstall and re-install AV before it would stay loaded.

Then, of course, a couple of days later the same thing happened. The machine was replaced with the machine it was cloned from, but the same thing eventually happened.

A virus scan on the "new" machine finds nothing, nor does it find anything on the "old" machine.

Can anyone make any guesses as to what's going on?

Andy
"Logic is invincible because in order to combat logic it is necessary to use logic." -- Pierre Boutroux
"A computer program does what you tell it to do, not what you want it to do." -- Greer's Third Law

 

[smah]

This is common behavior for several virii. I suggest trying a couple of different scanners from faq760-3862. Be sure to scan locally at that machine with an administrative account that has access to everything.

 

[bcastner]

1. A lot of this particular virus form comes through opened emails. Consider your site policies as to opening email attachments. Consider a spam/email filter.

2. Some of these come through backdoor approaches. Review your firewall policies.

 

[jrbarnett]

Andy

I'm not quite sure what you mean - Win2K doesn't have a built in firewall to my knowledge, only the XP family (including Win2K3 server) do.

John

 

[allteltec]

I am have the same problem on several PC's all runing McAfee corp. ver.
I have found That McAfee is not reopening after shuting down for a schelduled update. If the update is run manuly no problem, just when schelduled to run auto.
I have schelduled and complete system scan 30 mins after schelduled update and have not had it happen for a week now. I am hopeing to have the problem fixed, switching to a different virus program in not a option. I had 6 PC's infected with viruses in the last 3 weeks because McAfee was not runing.

 

[AndyWatt]

Update:

The Firewall now only has ports 110, 25 and 8100 open (8100 is required for an application), and you are quite right jrb it isn't built-in - just a poor choice of words to mean "software" rather than "hardware". I blame late nights.

Users do not have email, as we aren't prepared to get that set up until we have this issue fixed.

Andy
"Logic is invincible because in order to combat logic it is necessary to use logic." -- Pierre Boutroux
"A computer program does what you tell it to do, not what you want it to do." -- Greer's Third Law