• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Kudos0

can't find or remove virus - using Norton Security Suite

Hi,

I hope someone out there can help.  I believe my laptop has a virus.  For several weeks I've been having trouble with it getting hung up and becoming completely unresponsive so that I have to hit the power button to shut it down.  Have also been having problems getting it to start up. I have tried lots of things to try to solve this, but it keeps recurring.  Then, in the last few days, bogus e-mails have suddenly started being sent through our comcast email account.  I use outlook for email and have 2 email accounts set up through outlook - one is my comcast.net address, the other is NOT a Comcast.net address (it's an address I set through my web host).  All the bogus emails have been sent through the comcast.net address and not the other email address, and the addresses that they have been sent to are from the address book on the comcast server, not my address book in outlook.   I have run multiple scans on my laptop using Norton Security Suite and it has not found any viruses.  Also downloaded and ran Malwarebytes, it also found nothing.  I tried to run Norton Power Eraser but could not get it to run - tried several times, even tried the BETA, but could never get either to run.  I kept getting an error saying that it was missing definitions needed to run the program.  I'm not sure what else to do or try at this point.  Can anyone help?  For the record I am running Windows XP on the laptop and unfortunately do NOT have XP install disks. 

I Should also mention that we also have a desktop computer that could potentially be the virus victim, but we are ssuming that the virus is on the laptop since it has been acting up lately and the desktop has not.

A couple more things to add: When I look at the NIS security history, I see quite a few entries labelled "medium" risk.  For example from 9:54 to 10:01 tonight, there are 6 entries labelled "Unauthorized process blocked (access process data)", and I saw many similar types of entries earlier in the day.  I also saw this entry at 3 am in the security history and have no idea what it means, but it sounded fishy:

"Protecting your connection to a newly detected network on adapter \"Intel(R) WiFi Link 5100 AGN - Packet Scheduler Miniport\" ,Detected,No Action Required,Firewall - Network and Connections

Thanks to anyone who can help!!

Replies

Kudos1

Re: can't find or remove virus - using Norton Security Suite

I'm going to try to repond within your post as there are a few ciomments that need to be made. 

2hikinghokies wrote:

Hi,

I hope someone out there can help.  I believe my laptop has a virus.  For several weeks I've been having trouble with it getting hung up and becoming completely unresponsive so that I have to hit the power button to shut it down.  Have also been having problems getting it to start up. I have tried lots of things to try to solve this, but it keeps recurring.

The above sounds like it may be a conflict with another security program running in the background.  Do you have any other security programs installed?  How long have yuo had NSS instaled on this laptop and was there any Antivirus on the laptop prior to Norton?  If so which one.

Then, in the last few days, bogus e-mails have suddenly started being sent through our comcast email account.  I use outlook for email and have 2 email accounts set up through outlook - one is my comcast.net address, the other is NOT a Comcast.net address (it's an address I set through my web host).  All the bogus emails have been sent through the comcast.net address and not the other email address, and the addresses that they have been sent to are from the address book on the comcast server, not my address book in outlook.

There are many ways that someone could have gotten your password from your comcast account.  Please change the password for the Comcast account.  Keep an eye on it.  The emails should quit being sent when you change the password.

   I have run multiple scans on my laptop using Norton Security Suite and it has not found any viruses.  Also downloaded and ran Malwarebytes, it also found nothing.  I tried to run Norton Power Eraser but could not get it to run - tried several times, even tried the BETA, but could never get either to run.  I kept getting an error saying that it was missing definitions needed to run the program.  I'm not sure what else to do or try at this point.  Can anyone help?  For the record I am running Windows XP on the laptop and unfortunately do NOT have XP install disks.

The fact that you ran MBAM and it found nothing is good.

Here is a link for the instructions to run the Norton Power Eraserhttps://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?lg=english&ct=united+states&docid=20100914184709EN&product=home&version=1&pvid=f-home&layout=Retail&partner=&ispid=&sitename=&actstat=activated&substatus=current&ncoap=1

Please do not try to run the Beta as it is not a fully supported program and shuold not be used on anything but a test system.

Also a word of caution, the NPE is a powerful tool and at times too powerful.  It it lists something to remove and tyou are not 100% sure it is safe to remove it come back here with info on it and we'll gte someone knowledgeable to advise you.

I Should also mention that we also have a desktop computer that could potentially be the virus victim, but we are ssuming that the virus is on the laptop since it has been acting up lately and the desktop has not.

Let's handle the laptop first - one system at a time to avoid confusioln.

A couple more things to add: When I look at the NIS security history, I see quite a few entries labelled "medium" risk.  For example from 9:54 to 10:01 tonight, there are 6 entries labelled "Unauthorized process blocked (access process data)", and I saw many similar types of entries earlier in the day.  I also saw this entry at 3 am in the security history and have no idea what it means, but it sounded fishy:

Those entries are nothing more than Norton's Tamper Protection working as it should be - preventing access to the program itself.  It is just basically saying - "get lost you have no business accessing my files"  Those entries are nothing to worry about.

"Protecting your connection to a newly detected network on adapter \"Intel(R) WiFi Link 5100 AGN - Packet Scheduler Miniport\" ,Detected,No Action Required,Firewall - Network and Connections

I am sorry but I am not very knowledgabel in regards to WiFi, network adapters - etc.  But the good sign I can recognize is that Norton took care of it as it states No Action Required.

 

Thanks to anyone who can help!!


 I woud suggest you try NPE again following the directions - and being careful if you remove anything.  Also please let us know abuot any addtional security programs you may have/or had installed.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Hi,

Thanks so much for taking the time to reply.

To answer the question about AV programs on the laptop, I have been running Norton Security Suite for about 1.5 years on it. When comcast switched from offering McAfee to offering NSS (about 1.5 years ago), that is when I installed NSS on the laptop.  The laptop is around 2 years old, and I'm not certain what AV program was on it prior to NSS.  It could have been McAfee through Comcast (which is probably the case) or an AV program that came on the laptop.  Unfortunately I don't remember for certain, but I think it was probably McAffee through Comcast.

For the record, I have seen some Symantec error messages recently, and I have uninstalled/reinstalled NSS twice in the past 2 weeks.  Both times I thought the laptop was back on track after the NSS reinstall, but problems with the computer locking up and not restarting problems returned within a few days. I just started the laptop in safe mode and started a scan with NSS, and just got another Symantec error (but it does seem to be running the scan). 

Also, I discovered yesterday that we could not access our Comcast account at all because our password was no longer working.  We were able to reset the password and the Comcast account is now working and there have NOT been any additional bogus emails to date.

I will try again to run NPE if I can....as of 2 days ago the laptop is having serious trouble starting up.  IF I can get to start at all, it won't do anything once it is done booting up.  I can see my desktop but cannot click on anything or launch anything.  Even the clock was not working.  I will report back if I have any success running NPE.

I also tried to run Norton Bootable Recory Tool on the laptop a few days ago, but I did not have a product key and could not run it.  I found a PIN on the Comcast site, but could not find a product key.  I have a desktop that is running Norton Internet Security (NIS subscription came with the computer - so I may be able to find a product key).  I did create a CD using NBRT on the desktop, which is running Windows 7.  Can I use this disc to boot the laptop, which is running Windows XP?  That wasn't clear to me from the instructions. 

Thanks again for your help!!

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Hi,

I hope someone out there can help.  I believe my laptop has a virus.  For several weeks I've been having trouble with it getting hung up and becoming completely unresponsive so that I have to hit the power button to shut it down.  Have also been having problems getting it to start up. I have tried lots of things to try to solve this, but it keeps recurring.  Then, in the last few days, bogus e-mails have suddenly started being sent through our comcast email account.  I use outlook for email and have 2 email accounts set up through outlook - one is my comcast.net address, the other is NOT a Comcast.net address (it's an address I set through my web host).  All the bogus emails have been sent through the comcast.net address and not the other email address, and the addresses that they have been sent to are from the address book on the comcast server, not my address book in outlook.   I have run multiple scans on my laptop using Norton Security Suite and it has not found any viruses.  Also downloaded and ran Malwarebytes, it also found nothing.  I tried to run Norton Power Eraser but could not get it to run - tried several times, even tried the BETA, but could never get either to run.  I kept getting an error saying that it was missing definitions needed to run the program.  I'm not sure what else to do or try at this point.  Can anyone help?  For the record I am running Windows XP on the laptop and unfortunately do NOT have XP install disks. 

I Should also mention that we also have a desktop computer that could potentially be the virus victim, but we are ssuming that the virus is on the laptop since it has been acting up lately and the desktop has not.

A couple more things to add: When I look at the NIS security history, I see quite a few entries labelled "medium" risk.  For example from 9:54 to 10:01 tonight, there are 6 entries labelled "Unauthorized process blocked (access process data)", and I saw many similar types of entries earlier in the day.  I also saw this entry at 3 am in the security history and have no idea what it means, but it sounded fishy:

"Protecting your connection to a newly detected network on adapter \"Intel(R) WiFi Link 5100 AGN - Packet Scheduler Miniport\" ,Detected,No Action Required,Firewall - Network and Connections

Thanks to anyone who can help!!

Kudos0

Re: can't find or remove virus - using Norton Security Suite

I'll answer inside yours again .  

2hikinghokies wrote:

Hi,

Thanks so much for taking the time to reply.

To answer the question about AV programs on the laptop, I have been running Norton Security Suite for about 1.5 years on it. When comcast switched from offering McAfee to offering NSS (about 1.5 years ago), that is when I installed NSS on the laptop.  The laptop is around 2 years old, and I'm not certain what AV program was on it prior to NSS.  It could have been McAfee through Comcast (which is probably the case) or an AV program that came on the laptop.  Unfortunately I don't remember for certain, but I think it was probably McAffee through Comcast.

I also assist on the Comcast Forums as USAF_E-8_RET, and have been helping with the McAfee to Norton conversion since Comcast switched, so I know exactly what you are talking about.  If you have been cruising along this long with no problems - then McAfee or any previous programs are not causing any conflicts.

For the record, I have seen some Symantec error messages recently, and I have uninstalled/reinstalled NSS twice in the past 2 weeks.  Both times I thought the laptop was back on track after the NSS reinstall, but problems with the computer locking up and not restarting problems returned within a few days. I just started the laptop in safe mode and started a scan with NSS, and just got another Symantec error (but it does seem to be running the scan). 

Have you used the Norton Removal Tool between remove and reinstall?  Itis recommended if you are encountereing problems with NSS to remove via Control Panel (Add/Remove), run the Norton Removal Tool, reboot and then get a fresh download of NSS to install.  If there is any "digital debris" left behind, the NRT will remove most of it.  If not you may also want to follow the procedures here:    http://forums.comcast.com/t5/Security-and-Anti-Virus/How-To-Uninstall-Reinstall-Norton-Security-Suite-after-a-problem/m-p/870735 .

Also, I discovered yesterday that we could not access our Comcast account at all because our password was no longer working.  We were able to reset the password and the Comcast account is now working and there have NOT been any additional bogus emails to date.

Sounds like you are OK in this area now.

I will try again to run NPE if I can....as of 2 days ago the laptop is having serious trouble starting up.  IF I can get to start at all, it won't do anything once it is done booting up.  I can see my desktop but cannot click on anything or launch anything.  Even the clock was not working.  I will report back if I have any success running NPE.

Perhaps you ned to hold off on the NPE until after we try the NBRT.

I also tried to run Norton Bootable Recory Tool on the laptop a few days ago, but I did not have a product key and could not run it.  I found a PIN on the Comcast site, but could not find a product key.  I have a desktop that is running Norton Internet Security (NIS subscription came with the computer - so I may be able to find a product key).  I did create a CD using NBRT on the desktop, which is running Windows 7.  Can I use this disc to boot the laptop, which is running Windows XP?  That wasn't clear to me from the instructions. 

 

Please go here:  http://security.symantec.com/nbrt/nbrt.aspx .  You will notice there are two NBRT's - the one on the left is for NSS (uses a 13 digit PIN).  The other one is for retail versions of Norton and uses the 25 digit Product Key.  If you purchase a boxed retail product, the CD will have the NBRT on it.  The retail product is not operating system specific, so as far as I now, the NBRT will work on any OS, thus you should be able to download the PIN version of NBRTon the Win 7 system,. burn a CD or use a USB (if XP will boot from USB)  and use it on the XP system.

Thanks again for your help!!


 I think that covers it al for now, please keep us posted.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Unfortunately I have not been able to find the NIS product key.  When I open NIS and click Support and then About, I see a serial number and end point ID, but not a product key.  I do not have a box for NIS - I downloaded it as a free 15 month subscription (42 days remaining) when I purchased the PC.  Do you know how I can find the product key?

I am going to try downloading the PIN version on the Windows 7 machine, create CD, and try running it on the  XP laptop.  Will report back.

Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

Unfortunately I have not been able to find the NIS product key.  When I open NIS and click Support and then About, I see a serial number and end point ID, but not a product key.  I do not have a box for NIS - I downloaded it as a free 15 month subscription (42 days remaining) when I purchased the PC.  Do you know how I can find the product key?

On the main page of NIS, you shuold have an Account Button > Clcik it, signin and there will be an arrow to the left of the NIS entry.  Clciking it will provide a dropdown showing your product key for NIS.

Would it be better to download the NSS/PIN version of NBRT on windows 7 machine and use it create a CD?  I did find a service PIN for NSS on the Comcast site that I presume would work for this version - as long as the CD created on the Windows 7 machine would run on the XP lapatop.  What do you advise?

Yes, you should download the PIN version of NBRT on your Win 7 system (you shuold not need the Win 7 Product Key to download it).  Then burn the PIN Version of NBRT to CD or USB (if XP will boot from USB).  when you start the NBRT on the XP system it will ask for your NSS PIN - which you said you have obtained.

Thanks again!!



Please keep us posted.

<edit>  Posted from your previous post - sorry! <edit>

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Hi,

I just finished running NBRT on the laptop. The scan ran to completion and found no viruses. 

Based on this result, should I assume that my laptop does not have a virus and that there is some other problem with it?

Not sure where to go from here.

Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

Hi,

I just finished running NBRT on the laptop. The scan ran to completion and found no viruses. 

Based on this result, should I assume that my laptop does not have a virus and that there is some other problem with it?

Not sure where to go from here.


Hi,

Find your product key by going to www.mynortonaccount.com sign using the email address and password you used to register the product.

There may not be a virus but there may still be a problem. Have your run a full scan using Malwarebytes free scanner found here: http://www.malwarebytes.org/products/malwarebytes_free ? It's Norton compatible so keep it on the desktop for when you want a second opinion.

Hope this helps

Dick Win7x64 SP1 current NIS V21
Kudos0

Re: can't find or remove virus - using Norton Security Suite

Yes, I have run Malwarebytes on the laptop, and it found no viruses.  Over the past few weeks, I have been getting Symantec error messages off and on.  I have uninstalled/reinstalled NSS twice in the past two weeks, but the laptop continues to lock up and not start up correctly.  Are there any other virus programs I should try to run at this point (assuming I can even start the laptop at this point, which is questionable)?  So far I have scanned the laptop with NSS, Malwarebytes, and NBRT.  I tried to run Norton Power Eraser previously but could not get it to run - kept getting error messages saying that it was lacking definitions that were needed to run the program. I also tried to run Microsoft Standalone Recovery Tool, but could not get that to run either.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

I have a question for Yank:

You recommended running Norton Removal Tool between uninstall and reinstall of NSS, which I have NOT done previously.  I did not know about Norton Removal Tool, so thank you for the suggestion.  Would this be the next step you recommend, if I can get the laptop to start up and function?  Can I uninstall and use Norton Removal Tool and then reinstall NSS in Safe Mode, or do I need to start up the laptop normally? I am not sure if I can start it normally at this point. Thank you.

Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

Yes, I have run Malwarebytes on the laptop, and it found no viruses.  Over the past few weeks, I have been getting Symantec error messages off and on.  I have uninstalled/reinstalled NSS twice in the past two weeks, but the laptop continues to lock up and not start up correctly.  Are there any other virus programs I should try to run at this point (assuming I can even start the laptop at this point, which is questionable)?  So far I have scanned the laptop with NSS, Malwarebytes, and NBRT.  I tried to run Norton Power Eraser previously but could not get it to run - kept getting error messages saying that it was lacking definitions that were needed to run the program. I also tried to run Microsoft Standalone Recovery Tool, but could not get that to run either.


If you can get to the CMD prompt run CHKDSK /F and let us know the results.

Thanks

Dick Win7x64 SP1 current NIS V21
Kudos0

Re: can't find or remove virus - using Norton Security Suite

I tried running chkdsk /f from the command prompt in safe mode, and it would not run.  So I typed just chkdsk, and that ran and gave no error messages.  Could not run chkdsk from a normal start up, could only do it in safe mode.

Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

I tried running chkdsk /f from the command prompt in safe mode, and it would not run.  So I typed just chkdsk, and that ran and gave no error messages.  Could not run chkdsk from a normal start up, could only do it in safe mode.


Hi,

You're getting beyond my level of experience/knowledge/comfort. If one of the more experienced users here doesn't post a solution quickly I'm going to recommend that you visit one of the following sites and let the experts there assist you.

[Compliments of Delphinium]
http://www.bleepingcomputer.com
http://www.geekstogo.com/forum/
http://www.cybertechhelp.com/forums/
http://forums.whatthetech.com/

Hope this helps

Dick Win7x64 SP1 current NIS V21
Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

I have a question for Yank:

You recommended running Norton Removal Tool between uninstall and reinstall of NSS, which I have NOT done previously.  I did not know about Norton Removal Tool, so thank you for the suggestion.  Would this be the next step you recommend, if I can get the laptop to start up and function?  Can I uninstall and use Norton Removal Tool and then reinstall NSS in Safe Mode, or do I need to start up the laptop normally? I am not sure if I can start it normally at this point. Thank you.


I do not believe you can install NSS in Safe Mode.

Is there a way you can provide the  Symantec error messages you have been getting off and on?

I do not think running the NPE will provide any additional answers.

Dick's suggestion may be the way to go at the moment - go to a malware removal forum.  At least after they do their magic, you will know for sure if you are infected - or if you do infact need to look elsewhere.

BTW, if you go here:  http://forums.comcast.com/t5/Security-and-Anti-Virus/Where-to-Seek-Malware-Removal-Assistance/m-p/882367 and use the DSL Reports link - more than likey an individual who works that forum and is in fact a Security Expert on the Comcast forum will help you out.  Their name if  LoPhatPhuud.

Please keep us posted.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Thank you for the suggestions.  I had some help tonight from my significant other and the laptop is up and running for the moment.  I am not sure of everything that he did, but I know that he ran some hardware tests and did get some hard drive read errors.  He restored the laptop to a prior restore point using the manufacturer's rescue and recovery functions, and it seems to be working at least for the moment. But, the laptop was restored previously, and it ended up going haywire, so time will tell. 

One of the Symantic errors I got previously and wrote down was "Symantec Service framework encountered a problem and needed to close."  Another error that I got previously (not sure if this is Symantec related or not) was "Spooler subsystem App has encountered a problem and needs to close"  If/when I get more Symantec errors again, I will report back with them.

In light of this latest information, would you recommend removing NSS and using the Norton Removal Tool prior to reinstalling, or would it be better to try to other malware forums first?

Thanks again for all of your help!

Kudos0

Re: can't find or remove virus - using Norton Security Suite


2hikinghokies wrote:

Thank you for the suggestions.  I had some help tonight from my significant other and the laptop is up and running for the moment.  I am not sure of everything that he did, but I know that he ran some hardware tests and did get some hard drive read errors.  He restored the laptop to a prior restore point using the manufacturer's rescue and recovery functions, and it seems to be working at least for the moment. But, the laptop was restored previously, and it ended up going haywire, so time will tell. 

One of the Symantic errors I got previously and wrote down was "Symantec Service framework encountered a problem and needed to close."  Another error that I got previously (not sure if this is Symantec related or not) was "Spooler subsystem App has encountered a problem and needs to close"  If/when I get more Symantec errors again, I will report back with them.

In light of this latest information, would you recommend removing NSS and using the Norton Removal Tool prior to reinstalling, or would it be better to try to other malware forums first?

Thanks again for all of your help!


Hi,

Based on the repairs above I'm not convinced that there's a software problem. It's beginning to sound like the drive may not be in the best of health. You can run Malwarebytes free scanner found here: http://www.malwarebytes.org/products/malwarebytes_free and see if it finds any problems. If not then I'd go to the hard drive manufacturer's site and see if they have a disk test utility you can download and run. If that turrns up nothing then I'd visit one of the malware removal sites and ask for help.

Dick Win7x64 SP1 current NIS V21
Kudos0

Re: can't find or remove virus - using Norton Security Suite

@ hikinghokies,

Dependent on what you mean by, "restored the laptop to a prior restore point using the manufacturer's rescue and recovery functions" means the system was rolled back to "from factory condition", then it may have a trial version of some security program installed, and NSS and it will not play nicely together.  If there was a trail reinstalled (even Norton), it bneeds to be totally removed, run it's removal tool (ask if you can not find one for whatever product is installed)  Also normally a restore in any form meeses up the definitions in NSS, if in fact it is still installed.

At this point I'll need more info as to the trial AV program (if any) was "restored".  If in fact NSS is still showing in add/remove programs and we'll go from there.

I'll wait for your responses and keep my fingers crossed in the mean time.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Hi,

Sorry for the vague information.  The laptop is a Lenovo Thinkpad.  There is a "ThinkVantange" button on the keyboard that you can push during start up to launch Lenovo's rescue and recovery utililies.  One of the things you can do in rescue and recovery is restore the system to a previous restore point.  My husband restored to computer to a restore point dated Jan 11 2012.  Apparently the most recent restore point prior to Jan 11 point is about one year prior to that, and he didn't want to go back that far (yet).  So he's used the Jan 11 restore point to restore the laptop twice now.  After the restore process was complete, ran NSS Live Update several times until it said it was updated, and ran full system scan. 

I did uninstall/reinstall NSS twice in the past couple of weeks, but did not do it following the restore process.

I have never run the Norton Removal tool.   Also do not recall exactly how I removed McAfee when Comcast converted to NSS 1.5 years ago. 

Also, re the hard drive errors, husband said he ran 2 different utilies to test hardware.  He ran a full system hardware check through the Lenovo rescue and recovery utility, and it found some hard disk errors.  Also ran a second check of the hard drive through another utility, but I'm not sure of the details.  The second utility also found hard disk errors.  However, he was able to restore the system to the Jan 11 restore point and it is functioning at the moment (time will tell how long it lasts)

I hope that clears up all the questions.

Thank you.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

@ 2hikinghokies,

As you explained it (very nice job BTW - all the details we needed), it certainly sounds like you have NSS up and running just fine.  At present I would not mess with a remove/reinstall just to run the NRT between the two.  I would suggest to leave things as they are and see what the future holds.  If it does come to wanting to remove/run the NRT and reinstall, please follow the instructions in this FAQ:

 http://forums.comcast.com/t5/Security-and-Anti-Virus/How-To-Uninstall-Reinstall-Norton-Security-Suite-after-a-problem/m-p/870735

I will leave advise on the hard drive errors to someone else, as that is not my best knowledge area.    At this point I do believe your system is malware free - however, the only way yo be 100% sure (if that's possible), I'd still suggest a precautionary visit to DSL Reports as I suggested a few posts ago.

Please do keep us posted.

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Will do!  Still so far, so good for now...

Kudos0

Re: can't find or remove virus - using Norton Security Suite

Try downloading and running Malwarebytes. Just use the free version and it will not interfere with your current A/V program. If that doesn't clean it up, try Microsoft Standalone System Sweeper. Note that this is a beta product, but still works fine.

Replies are locked for this thread.