NAV for Palm OS definitions update problem

[Mark Pallo]

Anybody using the Beta Norton Anti-Virus for Palm OS on their Visor? I
am having trouble getting my definitions updated. I understand there
are presently (3) of them. I am only protected against the
Palm.Liberty.A

My friend has the (3) definitions including the Phage. The conduit is
properly installed in my HotSync and settings are set to check for new
definitions on every sync. You can see it come up on the screen and on
the visor when it syncs but still no update.

It initially would not install the conduit in the HotSync manager untill
I recently upgraded to the latest verison of Palm Desktop 3.1. I was
previously using 3.0.

Any ideas?

-Mark

[Peter da Silva]

In article <3A378201...@rhinopit.com>,

Mark Pallo <mpa...@rhinopit.com> wrote:
> Anybody using the Beta Norton Anti-Virus for Palm OS on their Visor?

Why would you want to do that? There are no viruses in the wild to infect
you.

--
`-_-' In hoc signo hack, Peter da Silva.
'U` "Milloin halasit viimeksi suttasi?"

Disclaimer: WWFD?

[Mark Pallo]

Mainly because my Visor and desktop became infested with the Palm/Phage.963
virus about 2 weeks ago and caused me 3 days of major problems.
-Mark

[Peter da Silva]

In article <3A37C185...@rhinopit.com>,

Mark Pallo <mpa...@rhinopit.com> wrote:
> Mainly because my Visor and desktop became infested with the Palm/Phage.963
> virus about 2 weeks ago and caused me 3 days of major problems.

That would be the first case I have ever seen even *mentioned* of someone
actually getting hit by this trojan.

How exactly did it happen? Where did it come from?

[Mark Pallo]

Not exactly sure where it came from. It was attacking my GraffitiDemo.PRC file
and renamed it to something different. My company's anti-virus software
(InnocuLan) detected it while syncing, but failed to cure. Everytime I synced,
it would tell me I had a virus.

Luckily I use a program called BackupBuddy. I wound up doing a hard reset on my
Visor bringing everything back from BB. No luck, same problem. I finally had to
make a copy of the backup folder where the files were housed, delete the folder,
let it create a new backup folder and place the files back in and resync. It
never really destroyed anything on the Visor itself. It was not fun, and more
and more people tell me it was very rare that I got it.

From Norton website:

Palm/Phage.963 is the first virus discovered on the Palm OS based handheld
platform. It was discovered on Sept 22, 2000. Symantec AntiVirus Research Center
does not have any confirmed reports of users being affected by this virus and is
considered a very low threat.

This Palm OS virus overwrites all installed applications on a Palm OS handheld
device.

Norton AntiVirus can detect this program on a desktop computer before the
malicious application is hot synced to the Palm OS based handheld. If Norton
AntiVirus is not set to scan all files, add the .prc extension to the list of
program files to scan.

Also known as: PalmOS/Phage.963, PalmOS/Phage.963.dr

Category: Virus

Infection length: 963

Removal:

Delete the .prc file that Norton Antivirus detects as Palm.Phage.Dropper from
Palm Desktop backup folder.
If Palm.Phage.Dropper is detected on your desktop, you should hard reset your
Palm OS device and perform a hot sync.

Number of infections: 0-49
Number of sites: 0-2
Geographical distribution: Low
Threat containment: Easy
Removal: Moderate

--------------------------------

[Peter da Silva]

In article <3A37E248...@rhinopit.com>,

Mark Pallo <mpa...@rhinopit.com> wrote:
> Not exactly sure where it came from. It was attacking my GraffitiDemo.PRC
> file and renamed it to something different. My company's anti-virus software
> (InnocuLan) detected it while syncing, but failed to cure. Everytime I
> synced, it would tell me I had a virus.

That doesn't sound like the Phage virus: the Phage virus doesn't infect PCs
and destroys all the programs on your handheld. It sounds like something in
the PRC file looked like the Phage virus and the antivirus software registered
a false positive. The fact that it was *only* GraffitiDemo, a standard Palm
application, that was listed as infected is a strong indication that it was
a false alarm... you would expect to be infected by some *new* file when you
install it, not something that had been there all along.

Unless you have some other evidence that this file really was infected by a
virus, I would classify this as a case of "friendly fire"... your antivirus
software was the cause of the problem.

[Mark Pallo]

I bet you are right. I definitely lost no data. As a matter of fact it happened
the same day our AV definitions were updated.

Thanks for the insight.

-Mark