system 32 flagged with virus

[angler2229]

I tried to install Norton's Anitvirus 2005 on a laptop. The installation seemed to be going OK when Norton's detected a virus in the System 32. It wanted to erase the file. I foolishly skipped the step and continued with the installation, my reasoning being that the computer needed System 32 to run.I was also working on a major project on my own computer and did not write down the specific virus name, but it was not one that looked familiar.

Bottom line - Norton's then went into some screen that scanned back and forth like a cylon. It ran that way for more than an hour. I figured that something was wrong and did a Ctrl + Alt + Delete and ended the loop. I then restarted.

I tried loading Norton's again and could not get beyond the welcome screen.

I visted the Norton's site on my computer and did not find any info on the situation that I witnessed.

Some other things that I did was to delete all the files in the Temp folder per the Norton's manual. No luck.

Any ideas? I won't be able to work on the laptop for another week as the co-worker is out of town, but I would like to be prepared when he gets back to solve the problem.
When he does return, I plan on running Norton's online scan before installing the software.

What would have happened to the computer if I had followed Norton's instructions and deleted System 32?

Thanks for your help.

Daniel

 

[linney]

You wont get far if you delete the System32 folder, I'm sure Norton only wanted to remove, delete or quarantine one or two files located within that folder and not the whole folder.

When the laptop returns try uninstalling Norton and re-installing it.

http://service4.symantec.com/SUPPORT/nsw.nsf/docid/2001101612274407

Removing adware & spyware
faq608-4650

Windows Installer 3.1 is available

http://support.microsoft.com/default.aspx?scid=kb;en-us;893803&FR=1&PA=1&SD=HSCH

For problematic installs it is possible to run some installs or uninstalls from Safe Mode if you start the Windows Installer Service while in Safe Mode.

 

[angler2229]

That is another strange thing. The computer came new with the standard Norton Antivirus 2003, but my co-worker had never activated it. The manual said I didn't have to uninstall the 2003 version that it would be done by the installer. However, when I failed to load the new version, I tried using the Remove Programs and that failed too. The 2005 version did not show up in the list of programs either. That is how I figured the install didn't take in the first place.

He has only had the computer for a year and had used the 'Net maybe a dozen times. He must have gone to the wrong sites or answered the wrong email to have gotten his virus.

I also ran Adaware 6.0 and SpyBot Search and Destroy before installing Norton's Antivirus.

Daniel

 

[micker377]

Can you get on-line with the computer? If so, go to Trend Micro/Housecall and do an online virus scan (takes a while to download the scan program), allow 1/2 to 3/4 hour to download and run.

 

[angler2229]

Yes, it will connect. I'll try that.

Does Trend Micro/Housecall repair the infected files?

Daniel

 

[11kumi11]

A lot of the viruses install executable files to Windows and windows\system32. It could have been a virus or a spyware on the system32 folder that Norton wanted to delete.

Download Microsoft's AntiSpyware and run it a few times. Perform disk cleanup and disk defrag on your hard drive too.

 

[gpalmer711]

[qoute]Does Trend Micro/Housecall repair the infected files?
[/quote]

Yes it will in most cases, when the scan has completed it will show you a list of any infected files and will allow you to either ignore, delete or quarantine.

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[angler2229]

I doubt if this computer has ever run SP2. Would it be wise to wait until Antivirus 2005 is installed or before?

Daniel

 

[gpalmer711]

Personally I would say to wait until you are sure the PC is clear of Viruses and Malware before installing SP2, there have been some issues with SP2 not installing correctly when the machine is infected.

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk