Trojans disabling anti-virus?

I've recently been getting alerts from my Norton Personal Firewall that said connection request to SubSeven Server or NetBus Trojan from (xxx.xxx.xx.xx) auto-blocked. I'm not really worried because I have 2 firewalls running and this is only my dial up router computer (Nothing important on here, its all behind it on a LAN). I have the most up to date norton and anti virus versions (live updated today before this happened, and 3 weeks before). Of course, I never play with trojans or anything and I think its a possibility someone with physical access to the computer infected me. Can these or other trojans disable Norton AntiVirus completely, even the updated versions? I've performed a full system scan which turned up nothing, and I have auto-protect enabled. I am extremely embarrased to admit I use dial up AOL, but I use the freebie ISPs when something like this happens.

Happens all the time, more common in viruses though. I have actualy never seen subseven disable an AV utility. I didn't think that functionality was built into it. But to answer your question, yes. Check you see if your AV program still works. And then reinstall it, because that may be the only way to get it to work again.

When you don t trust your av do a free online check at trend.com

http://housecall.antivirus.com/

Quote:

---

I have actualy never seen subseven disable an AV utility.

---

If the attacker has access to the machine, he/she can disable/enable anything, even AV. Yes, SubSeven has potential for that feature, even NetBus.

Dude, if your using Norton Antivirus like me, there is a problem. You need to go in the options and into the Exclusions section. Norton by default does NOT scan the \_RESTORE\ directory which is the SYSTEM RESTORE directory in windows. REMOVE THIS from the exclusion list and run the scan again. Chances are the trojan is in there. (I had this EXACT SAME PROBLEM) Now its not as easy as it sounds though! Norton can't just delete stuff from the restore directory because all the files are 'in use'. What you need to do is the following: (I use Windows ME so it may be a little different from what you may be using ;-)

1. Right Click on My Computer and go to 'Properties'
2. Click on the 'Preformance' Tab
3. Click on 'File System' then on the 'Troubleshooting' tab
4. Check the 'Disable System Restore' box, click ok and reboot!

This empties the restore directory right out. Scan again just to make sure all the traces are gone. Also, Windows ME and XP both have UVPnP active by default which run off of port 5000. THIS PORT IS A TROJAN PORT!!! (I have to clue what Microsoft was thinking when they did this, maybe they weren't) You need to get the patch of their site for that by the way. My firewall logged these as a local connection to a 'Backdoor-g-1' trojan. It could be either of these, maybe even both. I suggest you follow the instructions I gave you up top and to get the update. EVERY trojan I have ever had spread to the Restore directory. I'm still mad at Symantec for excluding this directory by default. Some people these days...

if the person had physical access to your machine then it's somebody you know just trying to play a practical joke on you. i dont no about norton's firewall but i no that zone alarm hasn't let any of many many attempts on me get through and im "pretty sure" ;) that sub7/netbus cant shut down your av proggy unless its already connected to a console.

I had the very same problem, uninstalling Norton won't work like someone said, I ended up reformatting for this and other reasons, because I didn't know about any fix, silly me!

PastyPyro

when your firewall notifies you of these connection attempts, it dosn't mean you have the trojan on you system.

What your seeing are kiddies scanning the internet, looking for infected computers. if they get a response to there connection attempt, it is logged and when thier scanners run is done they'll come back to play with it.

You'll get these all the time, it means nothing.

It's not only a connection attempt, the alert said the connection attempt was to SubSeven or NetBus trojan. I reformatted the drive late last nite (I set the computer up so I could wipe it in an emergency) and I was going to use to it to scan the rest of my network for anything else. But I accidently fried that machine I think while plugging in an ethernet cable while the machine was booting and it just went off and I can't get it to even come back on. Back to square one here, but luckily theres nothing even slightly important on there. Anybody know of any good pay-as-you go ISPs with no proprietary windows software? (I'd love to use a slackware router)

As far as I know, NetBus or Sub Seven Trojans cannot disable your anti-virus. But there are many that can. Some people might send you that kind of viruses frist; through e-mail or messengers then they might send you a Trojan.
So becareful what you are downloading.
Its good to have an updated firewall and a anti-virus.

My AV is up to date every week, and I scan everything I download. It just keeps amazing me how I get those alerts. Time to start migrating everything to Linux...

Recommend you to use Antiy Ghoustbusters Professional Edition

Download Site:http://www.antiy.net/ghostbusters/agb3.exe

You have received some great info.

I just tried Anti-Trojan. It scans your registry, all ports, and of course all the files on your hard drive.

http://www.anti-trojan.net

Oh! And you get 15 free days of full program capabilities.

The only bad thing about Norton AV is that it is so widespread and popular it is most commonly tried to corrupt with viruses and trojans. BUT if you scan everything you download and/or run that auto-protect and live-update often, you will be safe.

go here, http://www.moosoft.com/ , to get a trojan cleaner.

there are some trojans specifically designed to disable AV and/or firewalls in preperation for sub7 ,netbus etc.. in order to avoid detection.

->There are indeed malware that can bypass/disable firewalls, and thats another reason to keep your antiviral updated/upgraded often. And, as with anything, you should shop around for the best you can get in such programs. Malware that can bypass/disable firewalls include Theef, Cyberspy, Helios, f17, Armageddon, MoSucker, and on and on... in fact a wide array of them, old and new, are our there. Most have been incorporated (I would hope) into current virus/trojan definitions for your AV/AT programs, but vigiliance is key. Makes me wonder: If you are running dual firewalls, and are therefor "invisible" on the net, and you are being scanned repeatedly... it seems unlikely its a random scan you are detecting... perhaps someone knows who you are and is targetting you.
->I don't know as I am no expert, learning myself. Any ideas?

dont feel protected by norton *cough*damn newbies here *cough* ......
norton sux ....
use kasperky avp .....
norton sux because cant detect packed trojans , like all av , exept avp ......
u can disable av , but where is the utility ? most of you use personal crap antivirus and we can go thought ....
the only which should be potentialy disabled is firewall , but its more fun to find what firewall is installed , disable then emulate it ( exemple the animated icon of zonealarm )....
change antivirus now guys ....
trojans CAN disable avs / fw and whatever the programmer wants ....