Computer has a worm that Norton's AV is not detecting.

[slg2005]

Hi-

My computer has a worm and has been sending out the same set of old messages a few times per year. I am running Nortons Antivirus software w/current virus definitions and have done a full system scan w/nothing detected.

In the past, it would send out one copy of each message; we recently got cable internet access and when the worm activated itself it to sent out the same set over and over. Not sure where to start. Please help.

Thanks.

 

[porkchopexpress]

I would start by installing a firewall like Zonealarm as this will prevent anything connecting to the net without your permission, it will also give you a clue what is trying to connect.

Norton may be damaged so i'd be tempted to take advantage of Trends free online scan.

http://housecall.trendmicro.com/housecall/start_corp.asp

Process explorer is worth trying as well, it will tell you what processes are running and what files they are using.

http://www.sysinternals.com/Utilities/ProcessExplorer.html

Also AdAware is well worth trying as it might be a Spyware prog of some sort and so Norton won't flag this as a virus.

http://www.lavasoftusa.com/software/adaware/

They are all free and worth trying.

Hope that gets you started.

 

[ScDavis]

The other thing to question is -- are you sure the machine is infected? How do you know that?

Spoofed (faked) email sender (From addresses aren't a definate indication that your machine is infected.

Nearly all viruses send emails using an address they found on the infected machine (these days). So, if you're basing the assumption that the machine is infected based on returned emails (NDRs - non-delivery receipts) -- it's more likely someone you know that's infected, rather than you.

-- Scott.

 

[Alshrim]

We had something similar where a worm was found, but not detected.. but Symantec had come out with a rapid-release installer to bring the defs up to date.. after installing it - it brought us up to date, and the worm was effectively quarentined...
Check for these rapid-releases often..

Alshrim
System Administrator
MCSE, MCP+Internet