Re: Symantec - Live Update Error message

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2006-04-19 Nic James wrote:
> I have a non IT-savvy acquaintance who has asked me to try and sort
> this issue. He is running a fairly new version of the Symantec AV
> product for XP Home and the Live Update feature gives him the following
> error message when it runs:
>
> Error: "LU1875 This update failed during its preprocessing welcome text
> phase"
>
> The Symantec web site does mention this error and points to possible
> infection by the Trojan.Abwiz.F Trojan horse, they also supply a
> removal tool.

Removal tools are worthless crap. According to the Symantec bulletin
Trojan.Abwiz.F has backdoor capabilities, so nobody could possibly know
what else has been changed on the box in the meantime. The only reliable
way to get the box back to a clean state is:

- backup data
- format disk
- reinstall
- check backed-up data
- restore clean data

http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

> I have followed their instructions for running the tool, including
> running it in Safe mode, and the tool said that the Trojan was not
> present.

So it may be a false positive, it may be a variant that was wrongly
detected as Trojan.Abwiz.F, it may be that the trojan horse tampered
with the removal tool, or anything else you can think of.

> The Symantec description of this Trojan mentions rootkit abilities -
> so what I would like to ask the list is :
>
> 1. Would it be possible, if the rootkit (presumably a system level
> one?) has deployed, for it to fool the removal tool ?

Most definitely.

Regards
Ansgar Wiechers
-- 
"Der Computer ist da, um zu rechnen, nicht um Ausreden wie 'Kann nicht
durch Null teilen' auf den Bildschirm zu schreiben."
--Marco Haschka in de.org.ccc

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------