virus infection???

Hey all,

I am having some weird, virus like, issues with a clients server. First off, this is a Win2k server and I have full admin rights to the box. When I try to install either Symantec Corporate Edition A/V 8.0 or Veritas Backup Exec 8.5 agents, the installation process dies shortly after it begins. I do not think that the installation process is even reaching the point of actually installing the software. I tried sharing out all the drives, then from another machine, scanned the shared drives, but I found nothing. I believe this to be "virus like" activity, but am not sure as how to handle it from here?

Any suggestions would be greatly appreciated! TIA

btw-I inherited this box from a previous admin and noticed that there was no A/V or Backup software installed (hmm...i wonder why that admin is no longer here?).

How about doing an online virus scan and seeing if anything comes up... http://housecall.trendmicro.com/

From there we can work out more steps...

I tried the online virus scanning and it also found nothing? Any other suggestions?

Okay.. no virii, tell me more about what happens.. the installation starts, and then what.. how far in does it get?

And I'm taking a wild stab in the dark: http://service1.symantec.com/support...648?Open&src=w

Try that...

[edit]
Do you get an error message or something along that line?

Well....I see the auto-run open the A/V installer and I tell it to install the client locally. It then appears to be scanning the system for compatibility, then it simply quits. There is no error message at all not even in the event logs, making this quite frustrating.

I am taking a look at the link you posted now.

Is it just Norton and Veritas? or have you managed to install anything on this box?

cheers

So far it has only been the A/V and Backup software that have given me issues. I have been able to install updates from M$ and acrobat reader.

Hi,

Hope this doesn't get duplicated..........just had a little glitch.

Can you try to install something NEW, rather than an update.................it may give us a clue as to the problem?

Cheers

I have had LOADS of trouble with Symantec Corporate Edition 8.0 and deploying it out to clients using the deploy tool on the cd. It will show that it deployed to my 2000 client but has done nothing to the client. I usually end up going to the box and actually putting the cd in the drive and installing it from there. They have lots of problems with their product. (even though they will not admit it) The best reasource that I have found is to call their tech support (if you have a maintainence contract with them) and talk with them. After an hour or so on the phone with them I fixed 95% of my problems. Just make sure they stay on the phone with you when you are doing something because they like to just point you to a knowledge base article or two and then get you off the phone with them.

since I first encountered this issue, I was able to successfully install acrobat reader, but not the A/V or Backup software?

Is the machine updated with all the latest patches and etc.. ?

all of the latest patches have been applied, with exception of Win2k SP4.

Well I'm out of ideas... if your computers meet these requirements, then I recommend you get the phone and dial you-know-where... :)

Requirements:

Quote:

---

Windows

* Windows 98/98 SE/Me; Windows NT 4.0 Workstation/Server/Terminal Server Edition with Service Pack 6a; Windows 2000 Professional/Server/ Advanced Server; Windows XP Home/Professional
* 32 MB RAM minimum (64 MB or higher recommended)
* 45 MB disk space (80 MB during installation)
* Intel Pentium processor (Pentium II or higher recommended)

Terminal Server clients connecting to a computer with Symantec AntiVirus Corporate Edition antivirus protection have the following additional requirements:

* Microsoft Terminal Server RDP (Remote Desktop Protocol) client
* Citrix Metaframe (ICA) client 1.8 or later

---

From: http://www.uic.edu/depts/accc/softwa...ex.html#System

jag291

Is there anything in the Event Viewer logs that relates to the failed install of these apps? You could post what the logs say.

It seems you've already ruled out 'viral' activity, but I'd try one more thing before I ruled that out completely. Go download Stinger from Network Associates, here's the link: http://vil.nai.com/vil/averttools.asp#stinger

The reason I give you this is I've had to work with a few boxes that were infected with a virus (BugBear or Klez, can't remember for sure) that would not let any AV package run - it would appear to start up, then just stop with no error, no explanation, not anything. I used the Stinger tool to take care of the problem. It might be a longshot, but it's certainly something I'd try just for kicks..

That's a good thought Maverick!...................surprises me that an online scan could run, or would fail to detect those old viruses?

I have nothing more than a hunch here, but might there be a problem with updating the Registry. I would guess that both the AV and Backup software would make several entries, and want a restart...............Acrobat Reader is not quite so demanding?

I would be inclined to try loading a trial of some other AV product, to try to narrow it down a bit.................If "stinger" does not find anything, and the other AV doesn't load, then I would say "Registry"

If the other AV loads, then I would say "Symantec"

Cheers

Ok How about Yaha or one of its varients or relitives?

This family of virii will block your ability to install most brands of AV Software.. besides disabling the existing AV prog..

Give stinger a go.. it has saved my butt on a few occasions..
As for On-line Scanns.... mmmm have had little luck here.. some time you need everything in your favor to do any good.



Just some thoughts..


Cheers

I maybe out of my depth here but a mate of mine has had probs with anti virus stuff on a 2000 advanvced server machine. I think your prob is the configuration of your box and not the software its self.

Another thought.. What software have you got installed.. or the setting of your Paging/Swap File?
Some background software will give problems with the installation of some software..
As also having the pageing/swap file set to custom and set way too small.. this will cause "errors" and the install to bomb out..
Heck even a corrupted registry from a previous install that went wrong or a uninstall that was not carried out correctly..

Cheers

I tried the stinger app (btw-nice little app, thanks maverick), but still found nothing. I downloaded pc-cillin 2003 and tried to install that and I believe that I have found the root of my problems??? I *think* that the Windows Installer is causing my problems as I was unable to install the pc-cillin app which actually gave me a Windows Installer error message, unlike the Symantec AV. I guess my *assumption* that any apps installed to Windows uses the Windows Installer is incorrect, as I have been able to install acrobat reader, numerous M$ patches and ad-aware successfully.

So, I'm going to try to re-install Windows Installer and see where that leaves me.

I appreaciate all the help and suggestions!