Re:Symantec - Live Update Error message

[shnewman () att net]

Have you 

tried running F-Secure's rootkit detector (http://www.f-secure.com/blacklight/)?
tried manually downloading the AV definition update (http://securityresponse.symantec.com/avcenter/defs.download.html)?
tried uninstalling/reinstalling live update (http://symantec.com/techsupp/files/lu/lu.html)?

Safi Newman


> On 4/19/06, Nic James <nic.james () btconnect com> wrote:
> > List,
> >
> > Hoping this subject is Ok to post here:
> >
> > I have a non IT-savvy acquaintance who has asked me to try and sort
> > this issue. He is running a fairly new version of the Symantec AV
> > product for XP Home and the Live Update feature gives him the following
> > error message when it runs:
> >
> > Error: "LU1875 This update failed during its preprocessing welcome text
> > phase"
> >
> > The Symantec web site does mention this error and points to possible
> > infection by the Trojan.Abwiz.F Trojan horse, they also supply a
> > removal tool. I have followed their instructions for running the tool,
> > including running it in Safe mode, and the tool said that the Trojan
> > was not present.
> > The Symantec description of this Trojan mentions rootkit abilities - so
> > what I would like to ask the list is :
> >
> > 1. Would it be possible, if the rootkit (presumably a system level
> > one?) has deployed, for it to fool the removal tool ?
> > 2. Has anyone come across other reasons for why Live Update would give
> > this error message for the update LU1875 ?
> >
> > There are other posts on places like ZDNet and some of the 'consumer'
> > sites that mention this error, but so far I have been unable to find a
> > satisfactory answer (I could of course be looking in the wrong place).
> > I have not approached Symantec directly as yet, I guess because
> > (naively?) I figured if there were other problems with this update it
> > would be on their site and so far i haven't seen any.
> >
> > Many thanks for your time List.
> >
> > Nic.
> >
> >
> > -------------------------------------------------------------------------
> > This List Sponsored by: Webroot
> >
> > Don't leave your confidential company and customer records un-protected.
> > Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
> > obligation. See why so many companies trust Spy Sweeper Enterprise to
> > eradicate spyware from their networks.
> > FREE 30-Day Trial of Spy Sweeper Enterprise
> >
> > http://www.webroot.com/forms/enterprise_lead.php
> > --------------------------------------------------------------------------



-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------