Firewall And AntiVirus turns Off automatically on Restart

Hi, I'm using Windows XP SP2, Norton AntiVirus2004, whenever I restart
my computer Firewall & AntiVirus turns off automatically, Windows
Security window pops up, and then I have to Enable both of them
everytime. Does microsoft know any virus/worm that does this? Or
Symantec knows any virus/worm that is capable of this??? It's annoying
to keep enabling them upon restart.

Thanks,
Henry

PA
Fri Oct 08 05:31:05 CDT 2004

A third-party firewall or the Windows Firewall?

Has NAV visited and downloaded/installed from LiveUpdate since you installed
SP2?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

WinXP SP2: What's New for Internet Explorer and Outlook Express
http://www.microsoft.com/windowsxp/sp2/ieoeoverview.mspx

What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

"There is no 'silver bullet' solution."
http://go.microsoft.com/fwlink/?LinkId=33131

Henry C. Wu wrote:
> Hi, I'm using Windows XP SP2, Norton AntiVirus2004, whenever I restart
> my computer Firewall & AntiVirus turns off automatically, Windows
> Security window pops up, and then I have to Enable both of them
> everytime. Does microsoft know any virus/worm that does this? Or
> Symantec knows any virus/worm that is capable of this??? It's annoying
> to keep enabling them upon restart.
>
> Thanks,
> Henry

henrycortezwu
Sun Oct 10 05:39:34 CDT 2004

I'm only using Windows Firewall, I have no 3rd Party Firewall software.
NAV2004 has all the latest LiveUpdate, I keep updating it until it says
something like your are currently up-to-date.

Whenever I reboot, when Windows XP SP2 starts to load background
programs at the systray, a security baloon would appear saying that my
computer might be at risk because the NAV is turned off, click the
balloon to solve the problem. Without touching, clicking anything, the
baloon disappears, I believe NAV2004 autocorrects this problem?? Then
when everything is loaded, a balloon will pop up saying that my
computer might be at risk because the Windows Firewall is off. This
time it stays this way until I click the balloon, click the
"Recommendation" button, and switch Windows Firewall back on.

Is there a log somewhere that I can post here for someone to view what
programs/process has started, triggered, ran? Or some registry that I
should check and verify to make sure everything is correct??

I know this problem is not normal because I have the same setup in my
2nd computer and no Security Balloons pops-up.
Awaiting for any help,
Henry

Karl
Sun Oct 10 06:52:22 CDT 2004


"Henry C. Wu" <henrycortezwu@gmail.com> wrote in message
news:44f096ca.0410071805.20d7bab6@posting.google.com...
> Hi, I'm using Windows XP SP2, Norton AntiVirus2004, whenever I restart
> my computer Firewall & AntiVirus turns off automatically, Windows
> Security window pops up, and then I have to Enable both of them
> everytime. Does microsoft know any virus/worm that does this? Or
> Symantec knows any virus/worm that is capable of this???

Yes, a lot of them do disable the firewall and anti-virus by a variety of
methods.

If you think you may have a virus, do a second-opinion antivirus scan by
going to http://housecall.antivirus.com Better yet, go to
www.bitdefender.com and download the free Linux boot CD scanner they have.
[this is better because some viruses can use windows root kit functionality
to hide their presence from locally run tools like antivirus.] Or, if you
have other windows computers connected via a network, you could map a drive
to the suspect computer's hard drive and run an anti-virus scan remotely
across the network.

PA
Sun Oct 10 21:58:52 CDT 2004

Uninstall, Reinstall and re-LiveUpdate NAV 2004.

Dealing with Trojans & Hijackware

A. Trojans

1. Check in at Windows Update and install all critical updates & reboot.

2. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

3. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder v1.59.1 (no updates available currently; fix all found)

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

WinXP SP2: What's New for Internet Explorer and Outlook Express
http://www.microsoft.com/windowsxp/sp2/ieoeoverview.mspx

What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

"There is no 'silver bullet' solution."
http://go.microsoft.com/fwlink/?LinkId=33131


henrycortezwu@gmail.com wrote:
> I'm only using Windows Firewall, I have no 3rd Party Firewall software.
> NAV2004 has all the latest LiveUpdate, I keep updating it until it says
> something like your are currently up-to-date.
>
> Whenever I reboot, when Windows XP SP2 starts to load background
> programs at the systray, a security baloon would appear saying that my
> computer might be at risk because the NAV is turned off, click the
> balloon to solve the problem. Without touching, clicking anything, the
> baloon disappears, I believe NAV2004 autocorrects this problem?? Then
> when everything is loaded, a balloon will pop up saying that my
> computer might be at risk because the Windows Firewall is off. This
> time it stays this way until I click the balloon, click the
> "Recommendation" button, and switch Windows Firewall back on.
>
> Is there a log somewhere that I can post here for someone to view what
> programs/process has started, triggered, ran? Or some registry that I
> should check and verify to make sure everything is correct??
>
> I know this problem is not normal because I have the same setup in my
> 2nd computer and no Security Balloons pops-up.
> Awaiting for any help,
> Henry

henrycortezwu
Mon Oct 11 01:06:14 CDT 2004

Im using Windows Firewall

I have update NAV2004 via LiveUpdate until I receive the message you
are up-to-date.

Whenever I restart my computer a balloon would appear saying my
computer's at risk because NAV is turned off, but after awhile without
touching anything, it will go away and NAV would be turned on
automatically, so that appears not to be a problem.

However, after waiting for every process/background programs to load at
systray, a balloon would appear saying that my computer's at risk
because Windows Firewall is turned off. I have no 3rd part Firewall
software. So it instructed me to click the balloon, then the
recommendation button, then I turn the Windows Firewall back on.

I have to do this process every time I boot to WindowsXP-SP2.

Is there a log somewhere that I could post, so that someone could
decipher what I happening? Why is Windows Firewall being turned off
automatically whenever WindowsXP-SP2 boots?

Thanks,
Henry

Miguel
Mon Oct 11 02:43:17 CDT 2004

Hi Henry, I do have the same problem and I'm also using
NAV2004. If you find a solution, please advise me.
Thanks and regards,
MJ
>-----Original Message-----
>I'm only using Windows Firewall, I have no 3rd Party
Firewall software.
>NAV2004 has all the latest LiveUpdate, I keep updating it
until it says
>something like your are currently up-to-date.
>
>Whenever I reboot, when Windows XP SP2 starts to load
background
>programs at the systray, a security baloon would appear
saying that my
>computer might be at risk because the NAV is turned off,
click the
>balloon to solve the problem. Without touching, clicking
anything, the
>baloon disappears, I believe NAV2004 autocorrects this
problem?? Then
>when everything is loaded, a balloon will pop up saying
that my
>computer might be at risk because the Windows Firewall is
off. This
>time it stays this way until I click the balloon, click
the
>"Recommendation" button, and switch Windows Firewall back
on.
>
>Is there a log somewhere that I can post here for someone
to view what
>programs/process has started, triggered, ran? Or some
registry that I
>should check and verify to make sure everything is
correct??
>
>I know this problem is not normal because I have the same
setup in my
>2nd computer and no Security Balloons pops-up.
>Awaiting for any help,
>Henry
>
>.
>

lecter
Mon Oct 11 20:40:56 CDT 2004

I can't found the free Linux boot CD scanner in www.bitdefender.com/
It's a good idea to clean the windows virus with Linux programme!?

On Sun, 10 Oct 2004 07:52:22 -0400, "Karl Levinson [x y] mvp"
<levinson_k@despammed.com> wrote:

>
>"Henry C. Wu" <henrycortezwu@gmail.com> wrote in message
>news:44f096ca.0410071805.20d7bab6@posting.google.com...
>> Hi, I'm using Windows XP SP2, Norton AntiVirus2004, whenever I restart
>> my computer Firewall & AntiVirus turns off automatically, Windows
>> Security window pops up, and then I have to Enable both of them
>> everytime. Does microsoft know any virus/worm that does this? Or
>> Symantec knows any virus/worm that is capable of this???
>
>Yes, a lot of them do disable the firewall and anti-virus by a variety of
>methods.
>
>If you think you may have a virus, do a second-opinion antivirus scan by
>going to http://housecall.antivirus.com Better yet, go to
>www.bitdefender.com and download the free Linux boot CD scanner they have.
>[this is better because some viruses can use windows root kit functionality
>to hide their presence from locally run tools like antivirus.] Or, if you
>have other windows computers connected via a network, you could map a drive
>to the suspect computer's hard drive and run an anti-virus scan remotely
>across the network.
>