Toolkit

Story: Norton AV flaw opens door to hackers

Posted by: Bill Woelk (Sunday 24 October 2004, 4:32 AM)

I run a small computer consulting firm. I used to recommend Norton A/V to my clients, however the last six months I have lost all confidence in Norton A/V consumer products. I have personally seen this problem on at least 10 different PC's I have serviced. In each case the client's Norton Auto Protect back ground protection has been disabled by a virus. Most of my client's would not even know how to turn off this feature themselves.

You can't re-enable it until you remove the virus infection with another product. I have had real good luck using the Free AVG 6.0 A/V from www.grisoft.com to remove the existing infections. Grisoft's AVG seems to be unaffected by this exploit. I figured the reason was that AVG is too low on most hackers to-do lists to warrant the time and effort to program a means to disable its background protection.

In many cases the automatic update feature still worked and the client's A/V signatures were right up to date. yet Norton A/V was totally neutralized.

To be fair to Symantec, I have also seen the same issue with McAfee's A/V. The latest version of the Klez virus seems to be especially adept at doing this. Norton A/V 2003 and 2004 seemed to be the worst affected by this exploit. I have stopped recommending Norton A/V products to my client's due to this weakness in the consumer version.