Norman Virus Control and TDS-3

Discussion in 'Trojan Defence Suite' started by Longthing, Feb 27, 2004.

Thread Status:
Not open for further replies.
  1. Longthing

    Longthing Registered Member

    Joined:
    Jul 27, 2002
    Posts:
    40
    Found out, when testing Norman Virus Control, that NVC (among other entries that should not be removed) removes the startup entry of TDS-3 in the registry (HKLM/..../Run) when removing a virus. In my case a couple of samples wich i saved on my harddisk.

    I will also contact Norman about this and hope they will fix it.

    In the meantime users of NVC in combination with TDS-3 should be aware.
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hello Longthing,
    thanks for the warning! Doesn't it ask confirmation before doing so and no recovery button?
     
  3. Longthing

    Longthing Registered Member

    Joined:
    Jul 27, 2002
    Posts:
    40
    No, it only warned for the virus and asks me what to do with it.. When you choose for remove the registry entries are also removed.

    In my case Adwatch kicked in so i could prevent it.
     
  4. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Wondering which viruses would use the tds registry settings. And if Process Guard would have stopped that action too.
    Good to warn Norman about this behavior so they can change their work somwhat.
     
  5. Longthing

    Longthing Registered Member

    Joined:
    Jul 27, 2002
    Posts:
    40
    Norman also removes entries to files like syntplpr.exe and syntpenh.exe. If these files aren't lauched at startup my touchpad doens't function proberly.

    I quess Norman sees these files as randomly choosen file names and therefor suspicious.
     
  6. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    They should exclude them from their deletion list, maybe if found in other places then their default place, or maybe you have setting options to exclude them!
     
Thread Status:
Not open for further replies.