virus uninstalled nod32!

Hi
on one of our windows 2000 servers , I noticed that some programs had crashed and CF ODBC wouldnt restart , before rebooting , I checked nod32
and found all the tabs "red" , all the tick boxes were unticked
so I ticked them and then rebooted

after reboot , Nod32 had completly disapeared , I checked add/remove programs and it was gone
in c: program files ESET there was just the .exe file left and a cache folder
I had to reinstall etc
then ran update and then scan - it found nothing ...
I then ran search and destroy spy bot program, and it did find something ..
Haxdoor-H
which I removed.
I'm not totally sure that is what removed nod32 , but first time Ive ever seen anything do that , and we have it installed on 10 servers.

anybody else seen nod32 removed by a virus or trogan ?

 

I certainly havent but this sounds very scary, do you know what virus it is or was ?

 

Hi

I only know that this Haxdoor-H was picked up by "search and destroy" , nod32 didnt find anything at all.

 

Haxdoor is a trojan, the hacker could have removed NOD once on your system. Not that it makes it any better, but I don't think NOD was removed by the trojan.

 

Especially given that the nod32kernel service cannot be killed.

 

One typical Haxdoor-H is Remote Administrator by Famatech if my memory serves correctly (version < 2.2).

 

Not right away but you can disable it considering NOD32 didn't detect it (if he's correct). Havne't thoroughly tested it but you can manually "kill" the kernel, thats for sure.

 

the nod32 kernel respawns if killed though...

 

No it doesn't if you set it so...