Norton is corrupted?

Question

Hi my son who lives about three hours away from me said that his 4400 got w32.spybot.worm. Norton told him that the computer was infected, that it couldn't remove it and then he said that he got a message that the Antivirus program was corrupted. He has tried to reboot in Safe mode and run a scan and the scan just stays at zero files scanned. I went to the Symantec site and read the info about the worm. He said that he does not have any of the files in his System Folder that Symantec's info said he would get from the worm. He said that no programs  show up as running to the right of his Start button. He can't check Hotmail. He can't even download a free scan to see what is left on his computer. He tried to uninstall Norton, but the worm won't let him. I told him to disable System Restore reboot and enable it to see if that would help. Also in his Windows folder there is an the entry 'P_981116'  He is confused as to what that is.  Any suggestions would help at this point. I am a new XP user and he is experienced. I am at a loss as to how to help. I dread the day I get something on my 4700.

Ikenhooer · Answer

Hi, read the instructions here: http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

lindapolovchik · Answer

Hi, I have read that. It didn't seem to say anything about his corrupted Norton files. I went to the Symantec knowledge base and found some information about uninstalling Norton because some of his files are corrupted. The article that I read said that he needs to perform a Clean Boot of Windows XP. He has been trying to unstall Norton, but it won't cooperate with him. Perform a Clean Boot, uninstall, change back to normal startup, reinstall Norton, update virus defs, then scan for viruses. He has been running Adaware SE, Spybot S & D, and something from Trend Micro other than House Call. The worm won't let him download House Call. It sounds like he has more than a few ugly things running on his computer. The article also said that if he can't run a scan, to do it in Safe Mode. Does any of this sound like we are on the "right track?" Thanks Linda

Ikenhooer · Answer

Hi Linda,

Sounds like a good start. But my advice would be to follow the directions in the link above to remove the existing viruses/worms and then try to remove Norton AV. Sounds like he has more than just that worm. If his computer took a hit from from some of those nasty viruses out there then it might be better to boot from the windows CD and do a complete reformat of the disk and re-install windows. A pain in the rear I know, but sometimes it's the best way.

Good luck,

Mike

lindapolovchik · Answer

Thanks very much. I searched past posts and found that link. That sounds like the perfect solution as long as he can download the tools. I don't know how many old versons of Norton he had on his 4400. I will post back the results. Linda

bob350 · Answer

HowdyTry this to delete Norton's buggy bloatware.http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039?Open&src=&docid=2004093015165236&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=It's what I had to to when Nortons 2005 reallly messed up my 8400Afer being a big fan of Nortons for a long time, 2005 really turned me away frome them.I now use Zonealarm Pro & Security Suite . Much smaller program, & no conflicts with my word processing programs. Also my system boots up & shuts down much faster.Bob

lindapolovchik · Answer

Hi, He did use those tools and remove Norton 2005 and he used the tool to remove Norton 2002. He tried to install Norton 2005. It failed twice. I went to Symantec for support and it suggested he dowland the Verisign certifcate again. He can't even download that. I had him go to Trend Micro and download Housecall. He can't do that scan. He can, however, run other scans from Trend Micro for Spyware, but not House Call.  He can't download the free scan from Panda Software. I suggested as a last resort to do a System Restore and go back two weeks. I also suggested he start backing up papers and photos in case he has to do a Reformat. I had him go into the Task Manager and try and figure out what was running. I was hoping that he could find the worm and End Process long enough to download a scan that could find it and delete. Not sure what else to suggest to him. He can't get to the Dell forum, he can't even get to the Symantec site for support. He got rid of alot of stuff, but I don't think he got rid of the w32.spybot.worm.  Lousy little thing.

lindapolovchik · Answer

Hi again. My son, can't install Norton 2005. Not even after a clean boot. Also, the computer won't stay in the Normal Startup, only Selective Startup. That has been going on all week. He was able to download the trial version of Zone Alarm. He ran it found some stuff and deleted them. He downloaded a2squared and is running it now. His list is very long of things that won't work anymore.

1. Can't click and drag with mouse.

2. Can't open with left button, only File, Open.

3. Programs don't show up on toolbar when running or minimized.

4. Can't get to the login page on Hotmail

5. Can open and read mail on Yahoo, but not reply.

6. Can login to Dell forum, but can't reply.

7. Some hyperlinks work other don't.

8. Can't download Verisign Secure.

9. Can't run Windows Search Tool.

10. Can't run javascripts.

11. Can copy but not paste

l2. Links in emails don't work.

13. Can't delete messages in yahoo.

14. Can't move icons on the desktop.

I am sure there is more.

alot of good advice is needed, grad school starts Aug 29. Thanks Linda

bob350 · Answer

HowdySorry but your sons troubles are over my head too.When I was having all my problems with Nortons 2005, it started as a conflict with either Word or Word Perfect. Both of which I have on my 8400. Then it went to lockup, unable to run scans, no down loads of updates, Norton error messages just popping up every where.  I wasnt able to use add/remove to get rid of any of the parts of 2005. Unable to use the old 2001 version that I updated from.:smileymad: Trial versions would not work either.I finally spent a week end using search for all files, typing in -Nortons -Nortons antivirus - Symantec- etc- etc & deleting every file I found. I also searched with a couple of registery editors, using the same search words, & deleted every thing I found, & I found stuff every where.I also tried all the help on Symantecs site, no bloody good there either. And they dont make it easy to find. I ran that removel tool several time before it seemed like I got it all off my system.I now run Zonealarm Security Suite, & man I like it a lot better, smaller program, & NO problems.Sorry I cant be any more help, just wanted to let you know, that you are not  the only one's having major probs with 2005.   As you have found out,  many threads about the problems  with Norton's 2005 buggy bloat ware.Good luckBob

lindapolovchik · Answer

Hi, Since my son can't now even do a System Restore, I told him as a long shot to load his Norton 2002, see if he can update virus defs and scan. Maybe he can remove.the worm.  He has already stated to back up files on zip disk to reformat tomorrow. Thanks for all your help. Linda   PS. Can anbody out there tell me does the Dimension 4400 have the same feature of the 4700 which is the Dell PC Restore? That would reduce reformatting down to pushing a button. Message Edited by lindapolovchik on 08-06-2005 08:21 AM

ky331 · Answer

Linda,

Since there's obviously a whole bunch of things going wrong there, I'd suggest your son try getting help from the HiJackThis forum:

Preliminary note: When attempting the following directions, if you can't access the internet or perform the indicated download of HiJackThis (HJT) on your "infected" machine, you should download it onto another "good" machine (one at work?), then transfer it via floppy (it's a tiny file) to the infected machine, run the UNZipped/.EXE file on the infected machine, and finally transfer the generated log via floppy over to the good machine, to post your log online.

Download the latest version of HJT(hijackthis) (version 1.99.1) from

http://majorgeeks.com/download3155.html

you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )

After Unzipping, double click on HiJackThis.EXE

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.

Supplemental note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.

Specifically, the following are 3 very common BAD deviations which will cause delays:

a) BAD: using an older/outdated version of HiJackThis...

The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.

b) BAD: using a TEMP directory or your DESKTOP for HJT....

Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.

c) BAD: posting your log in the wrong forum...

if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum.

Virus & Spyware

Was this post helpful?