POLL: Punt, or run with it..?

[oldhermit]

Win98SE
P3-Tualatin 1.2gig
256 Megs Crucial memory
ATI Radeon 64 Megs


My system runs fine.
However, NIS has alerted me that the boot sector has changed, and I can't figure out why.

Here's what I have done.
I have given it two full virus scans today. Once before LiveUpdate, and once after. No viruses found.
NIS scans the MBR at every bootup. Nothing found.
Previous full scan was two days ago, and no alert appeared during that scan.
I run SpywareBlaster and Spybot S&D. No malware found. The performance of the computer gives no indication that there is any.
SFC found that only the MSISYS.VXD had changed since my last check about a month ago. That's normal because I do connect another hard drive to do my backups, and sometimes disconnect the CD-Rom. However I have never encountered doing so to cause a change to the boot sector, and if they did, it would have shown up in the several scans I have performed since last switching drives.
No programs installed or unstalled in the previous month.
No other significant changes during that time. Changing browser view settings is not considered significant.

Been researching causes for this all day. Nothing points to anything I have done.
Is there a possibility that it could very well be a legitimate change?
Symantec listed 42572 documents in regard to boot sector. Silly Symantec.
I have the choice of reverting back to the original MBR or keeping this one.
What would you do?

Symantec doesn't recommend one over the other. All they say is if the boot sector has changed, and I haven't switched hard drives, reinstalled Windows or any other software that changes the boot sector, then there is a possibly that it can be caused by a virus. Do a LiveUpdate and then a full scan of the system.

Necessarily, all of this would have had to occur within the last two days. It didn't.

[DELTREE]

oldhermit, You did something? Try running a GOOD anti-spyware program like ADAWARE. Symantec gave you a very GOOD answer.
If your puter is running well, leave it well.
"IF IT"S NOT BROKE DON"T FIX IT."
As a computer, I find your faith in technology amusing.
Take Care your Friend DELTREE

[oldhermit]

It used to be that I could email Symantec with a question and have an answer the following day. Can't do that anymore. As being reported, apparently even the paid for support sucks. If I could have contacted them, I would have asked only one question: "Does LiveUpdate write to the boot sector?"

Well. I found my answer elsewhere on the web at the following site. Since i did a live update yesterday, this following excerpt helps put to rest the suspicion that LiveUpdate changed my boot sector. The only other explainable reason for which I have cognizance of then, is by virus.


Excerpt taken from Norton AntiVirus 2003 GRIPES
http://www.computergripes.com/Norton...html#Opinions_

April 8, 2003 ExtremeTech. Symantec has begun adding digital-rights-management software to downloadable versions of Norton Antivirus 2003 in an attempt to foil software pirates. A pilot retail program will be starting soon. Symantec executives declined to reveal the DRM software being used, although a spokesman said that the software did not write information to the boot sector, as Macrovision's SafeCast products do. Symantec software has frequently been pirated, forcing their hand.

Symantec Adds DRM To Norton Antivirus
http://www.extremetech.com/article2/...1009110,00.asp


What I'm finding out is that many of the boot sector viruses are stealth. One in particular described by Kapersky, only activates every 16th access of the boot sector. In its dormant stage, antivirus software will not detect it.

So this is my concern and the reason for this poll. If I had followed the suggestions of the Symantec documentation, then there would be little doubt that a virus has changed the boot sector.

Boot sector changes are not a normal occurrence for me. The last boot sector change happened over three years ago when I was still running a multi-boot system. At that time the alerts were regular. But I also knew exactly why I was getting them. In contrast, this time I don't.

[A31Chris]

Run a Housecall scan on your system. See what that says.

[jmtjet]

Could be a false positive by Norton. One problem I have always had with Norton is when your license expires the software just stops working. No notice-no nothing just stops working.

[oldhermit]

Thanks for the replies and for staying with me on this.

A check for new created files didn't turn up anything unusual, so I'm not convinced there is a virus on the computer yet.
I must admit though that I really have no problem with the Norton software, which has always worked for me. I'm subscribed until next year. My gripe is how they want to control everything and then isolate themselves from their subscribers. They recently purchased PowerQuest and did the same thing.

I'm in the process of comparing the new and old MBRs now, so possibly I can determine just exactly what was changed, and hopefully that will lead me to what actually caused the change.

I'm still open for suggestions as to what else will change the boot sector on an otherwise perfectly running machine. I don't believe LiveUpdate did this because my last three updates never required a reboot, as some do. But it is a fact that an install of certain security software can do so.

I'm havin' fun...

[oldhermit]

A friend just called to inform me that after a LiveUpdate a scan for viruses threw an alert that the boot sector had been changed.