topic Re: Malware Removal Forum in Tech Outpost

Malware Removal Forum

lmacri — Sun, 27 Nov 2011 18:14:13 GMT

Is Symantec considering setting up a separate Malware Removal forum for Norton users who could work one-on-one with an expert to help them remove malware infecting their system?

I've read all the pros and cons in bjm_'s thread here in the thread titled Malware Removal Forum and Quad's thread here titled Suggestion - apologies in advance for starting a new topic, but these threads are locked and I couldn't post a reply. There seems to be an increasing number of users in the NIS/NAV/N360 forums who have been infected by malware that wasn't detected by their Norton security software, and I think they deserve better than to be told to try a scan with the free Malwarebytes' Anti-Malware (MBAM) or post in the BleepingComputer or WhatTheTech forums for help. Even the MBAM forum has a board here where users can post a HijackThis log for experts to review.

I'm not comfortable recommending the Norton Power Eraser (NPE) to novices after reading posts about "safe" software inadvertently corrupted by this tool, and I don't think that most users even know that the instructions here titled How to Troubleshoot a Suspected Malware Infection are posted in the Announcements board.

Symantec might even be able to respond more quickly to emerging threats if users were posting in a central location like a Malware Removal forum.

-------------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 8.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Re: Malware Removal Forum

Andmike — Sun, 27 Nov 2011 20:46:48 GMT

I thought we had that, and it was called Quads. ;-)

Re: Malware Removal Forum

delphinium — Mon, 28 Nov 2011 00:51:31 GMT

No, actually, we did have that. Quads removed approximately 315 rootkits from user's machines in 2009 and it kept four of us busy sorting out who had what, requesting scans and scheduling who was next to be helped. It was great. Quads, however was about worn out and he really is the only specialist on the forum. There were times when he went 36 hours straight.He stopped doing complex removals using advanced tools because there was no protection for the users. Now he offers suggestions for readily available, relatively safe tools, or we send them to the forums.

The malware removal forums have enough members that they have their own training schools. The helpers are taught what to do and what not to do. The new helpers have overseers to prevent damage to user's machines. There is a long supervised practice period before they are allowed to try removals on their own.

We have no one here to do that training.

This is an open forum, which means that everyone is allowed to post on any thread whether they have any idea of what is going on or not. The four of us assisting Quads had to chase around on threads trying to prevent damage to peoples' machine by obeying instructions that ranged from useless to dangerous.

We asked several times for a separate forum, but were denied, partly due to liability questions, partly to do with the fact that Symantec charges for malware removal, and partly because an entire forum should not rely on one individual.

The Norton products have improved to such a degree that what we are seeing for infections now is hardly noticeable. There were times that every thread on the forum page was a rootkit complaint. Now it would not provide enough threads for a separate forum, even if it could be protected.

This one is rather typical of the time. At that time Symantec believed that rootkits could be removed in safe mode. Didn't work. This is the skill level required to do safe remediations.

http://community.norton.com/t5/Norton-360/Unable-to-remove-Packed-Generic-238/td-p/118857/highlight/true/page/6

Re: Malware Removal Forum

yank — Mon, 28 Nov 2011 02:39:55 GMT

As someone else would say, just my .02 cents worth:

Having spent close to 6 months attending Malware Removal University, getting through the basics, their Registry Course, and just starting to really get into the specialized tools, I had to quit for a combination of personal reasons.

If you have not attended the schools, you just have no idea of what is involved in learning how to read logs, research items in logs,analyzing the results of your search(s) and then mapping out a logical approach to figure out which specialized tools to run and in which order. Especially when the scenario of malware/virus is changing on a daily basis.

Oh and if you get far enough to work on "live logs" you have to bounce everything off your instructor before you post anything, until such time as you graduate!

IMHO, if you haven't experienced the training, studying and constant knowledge updating required- you have no idea what is necessary to become a malware fighter.

I am amazed by the volunteers who are working the various malware sites. Most are Microsoft Security MVP's and I doubt we have any of them here - besides possibly Quads.

Oh and BTW, Hijack This Logs are old school, no longer recommmened on most malware sites, DDS is the current tool of choice as a starting point, so we defiantly do not need a boad to work HJT logs.

I totally agree with delphinium's post.

Re: Malware Removal Forum

delphinium — Mon, 28 Nov 2011 03:29:08 GMT

It's very good to get an idea of what helpers have to go through before they are allowed to assist. I knew it was a tough technical slog, but your post is an eye-opener for me as well. I must have looked at a thousand logs over the years, and unless something is pretty blatant, I can't read the things.

Re: Malware Removal Forum

Quads — Mon, 28 Nov 2011 04:22:26 GMT

There are advantages of using Hijackthis over DDS, and even Bleeping Computer still uses Hijackthis in it's processes for that reason.

Quads

Re: Malware Removal Forum

yank — Mon, 28 Nov 2011 13:10:59 GMT

Quads wrote:
There are advantages of using Hijackthis over DDS, and even Bleeping Computer still uses Hijackthis in it's processes for that reason.

Quads

No arguement from me, but one has to be aware of/overlook the possible erroneous entries on 64 bit systems.

BTW, I do not see HJT mentioned in their initial instructions anymore.

Re: Malware Removal Forum

dickevans — Mon, 28 Nov 2011 14:59:40 GMT

I like the 'other guys' being the experts on malware and being able to recommend them to users with problems that cannot be solved with the resources we have here. I also think that trying to be everything to everybody will only dilute the quality of support currently present. I know we can get better but I don't know that we can get better and bigger all at once. My choice would be to get better at supporting Norton products and recommend the 'other guys' for malware removal.

But that's just me

Re: Malware Removal Forum

lmacri — Mon, 28 Nov 2011 18:31:00 GMT

delphinium wrote:

We asked several times for a separate forum, but were denied, partly due to liability questions, partly to do with the fact that Symantec charges for malware removal, and partly because an entire forum should not rely on one individual.

Hi everyone, and thanks for all the great feedback.

Here's my main concern. If a user is already paying $99 US online for a one-year subscription for N360 Premier and their system becomes infected with malware, why should they be charged an additional fee for having that malware removed from their system or be re-directed to another forum for help?

I don't see why Symantec couldn't assign a few of their own malware removal experts to help out Quads and a few other pre-approved volunteers in a separate Malware Removal forum. I've posted in the WhatTheTech Virus, Spyware & Malware Removal forum (who still request a HijackThis log) and the malware expert assigned to work with me one-on one was the only other person allowed to post in my thread. Symantec could also restrict use of the forum by requiring users to validate their subscription with their product activation key (along with that ubiquitous "I Accept" button to accept the Terms & Conditions to address the liability issue) before they started a new thread.

Either that, or Symantec needs to open a PayPal account and start rewarding the volunteer malware experts who do their tech support for them.:smileyvery-happy:

------------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 8.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Re: Malware Removal Forum

dickevans — Mon, 28 Nov 2011 18:37:59 GMT

lmacri wrote:
delphinium wrote:

We asked several times for a separate forum, but were denied, partly due to liability questions, partly to do with the fact that Symantec charges for malware removal, and partly because an entire forum should not rely on one individual.

Hi everyone, and thanks for all the great feedback.

Here's my main concern. If a user is already paying $99 US online for a one-year subscription for N360 Premier and their system becomes infected with malware, why should they be charged an additional fee for having that malware removed from their system or be re-directed to another forum for help?

I don't see why Symantec couldn't assign a few of their own malware removal experts to help out Quads and a few other pre-approved volunteers in a separate Malware Removal forum. I've posted in the WhatTheTech Virus, Spyware & Malware Removal forum (who still request a HijackThis log) and the malware expert assigned to work with me one-on one was the only other person allowed to post in my thread. Symantec could also restrict use of the forum by requiring users to validate their subscription with their product activation key (along with that ubiquitous "I Accept" button to accept the Terms & Conditions) before they started a new thread.

Either that, or Symantec needs to open a PayPal account and start rewarding the volunteer malware experts who do their tech support for them.:smileyvery-happy:
------------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 8.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Hi,

I go to the doctor when I don't feel good. He determines that I have cancer. He refers me to a specialist.

I go to the dentist with a tooth ache. He determines that I need a root canal and refers me to a specialist

I go to the Norton Community with a problem. They determine that I have a malware problem and refer me to a specialist.

Is there a logical pattern here?

As for opening a new forum to deal with the malware problem I'm hard pressed to justify the time, talent and budget necessary for an undefined benefit, if any. I'm still a strong supporter of the concept of 'we do our best to support our product and we recommend those who are best at supporting their product(s)'.

Yes, other problems are being solved by one and all but they are done as a courtesy and not a part of the 'official' support provided by the community here. If your fly is unzipped I wouldn't send you to a tailor to get it fixed. If it can't be fixed I would not attempt to try.

I am still waiting for a show stopping arguement that will convince me that Norton Community Forums needs to be the be all and end all of the places a user can come to get help with any problem. I will support and strive to be a part of the Norton Community that is the only place where Norton product users come to get the very best support for their product. That to me is a big enough job that I'm not ready to consider taking on more.

As for the pay part I won't comment here

Re: Malware Removal Forum

Atomic_Blast — Mon, 28 Nov 2011 19:38:34 GMT

Hi all:

I find this thread rather interesting!

I'm not going to comment now, but I wanted to share this with you...

Malwarebyte's has just started (for November) a new e-mail newsletter.

If you wish to subscribe, you can do it here:

http://www.malwarebytes.org/consumer_newsletter

Cheers,

Atomic_Blast :)

Re: Malware Removal Forum

elsewhere — Sun, 04 Dec 2011 05:54:01 GMT

lmacri wrote:
delphinium wrote:

We asked several times for a separate forum, but were denied, partly due to liability questions, partly to do with the fact that Symantec charges for malware removal, and partly because an entire forum should not rely on one individual.

Hi everyone, and thanks for all the great feedback.

Here's my main concern. If a user is already paying $99 US online for a one-year subscription for N360 Premier and their system becomes infected with malware, why should they be charged an additional fee for having that malware removed from their system or be re-directed to another forum for help?

[...]

Perhaps an alternative would be for Norton to include access to the 'Norton Virus Removal Assurance' service as a basic feature of the product. At the current $8.99 for access to 'unlimited virus removals' for the duration of the subscription, it's not going to have that much of an impact on the overall product purchase price.

Re: Malware Removal Forum

dickevans — Sun, 04 Dec 2011 06:53:36 GMT

elsewhere,

Does 'Norton Virus Removal Assurance' include malware?

Re: Malware Removal Forum

DistEd2 — Sun, 04 Dec 2011 17:07:14 GMT

Norton's basic purpose (regarding malware) is to keep the nasties from getting on your system; as we all know, once they've got themselves entrenched on a machine, the installed Norton (or anybody else's) product isn't going to do much good. So that (plus, for 360, the backup and utilities functions--and for Premier, the additional 23GB of online backup space) is what our $99 subscription is paying for. And with a little safe computing knowledge & practice, it's all most of us are going to need. So rather than making everybody's subscription cost cover the cost of recruiting and training an army of people like Quads, Norton keeps the basic subscription cost down, but offers folks who are especially concerned that they might play host to a nasty the option to pay for some "insurance"; one of the strengths of this approach (besides keeping the cost for the rest of us down) is that the number of people choosing to buy that "insurance" gives them a rough, forward-looking metric for forecasting how many malware removal experts they ought to employ and train.

Sure, there's some intuitive appeal to the idea that if Norton's product "fails" and a nasty slips by, then Norton ought to provide the help to clean it up as a service, a sort of warranty. But as we here also know too well, there are an awful lot of users who will override their security software--even if they have to come here to ask somebody how to do it!--so they can download or run a program, or access a website, which they "know" is safe. And, with millions of users, there are bound to be "a few" who--either by sheer bad luck or because they're out there browsing some unsavory parts of the web looking for bargains, porn, or the like--are going to cross paths with the latest and greatest code that our malware-writing adversaries have produced, before anybody else has discovered it and written it into the definitions or behaviors that Norton can look for.

If Norton is going to bulk up its staff with experienced veterans of the malware wars with the training and the wisdom not to render a lot of peoples' PCs unbootable--and then insure themselves against the occasional human mistake that somebody might sue them to pay for--well, that costs money, which has to come from somewhere. So at some point, we have to ask ourselves--on behalf of all the millions of users like us whom we're looking out for--do we really want to all have to subsidize that for the folks I described in the preceding paragraph...or would justice dictate they pay for it themselves, with a little extra "premium" or a $99 "consult fee"?

Honestly, though, I'm not cold-hearted enough to completely answer my own question with the latter--which is why I'm glad that, just as we have so many good folks here who are willing to volunteer their time to help users keep their Norton protection humming so they'll never have a malware infection, there are also so many good people out there on those other free forums, who maybe don't care to spend their time on subscription issues and folks trying to run plain, ordinary backups (etc.) but are happy to put their formal malware removal training and years of proven expertise to work digging nasties out at the root(kit). :smileyvery-happy:

So I guess my bottom line (finally, eh?) is that I think the current approach makes a lot of sense.

Re: Malware Removal Forum

dbrisendine — Wed, 07 Dec 2011 04:26:00 GMT

dickevans wrote:
elsewhere,
Does 'Norton Virus Removal Assurance' include malware?

You're joking right? :smileywink:

No but it does include the common cold!!! :smileyvery-happy:

Re: Malware Removal Forum

dickevans — Wed, 07 Dec 2011 15:24:50 GMT

dbrisendine wrote:
dickevans wrote:
elsewhere,
Does 'Norton Virus Removal Assurance' include malware?
You're joking right? :smileywink:

No but it does include the common cold!!! :smileyvery-happy:

And I was hoping that it would cure everything :smileysad:

Then I remembered that stupid can't be cured :smileywink:

Re: Malware Removal Forum

will608 — Sat, 21 Jan 2012 06:28:52 GMT

Finally I want to thanks the forum and Nortons as the one page I seen show a new product by a company called Malwarebytes Anti-malware software which really works.Unliked when I was hacked and had you guys fix it.This goes a step futher by actually removing said malware completely and fixing any problems said malware caused.Where as you guys only listed said malware as suspect and left it on my computer.Now only if you could find some company to fix your norton Framework fault and PC Checkup programs faults as both has shutdown and Norton's only responsed has been to want me to renewed although I still have over 5 months left on my current 360 program.Granted renewing does seem to fix the problem but to have this happen every year is bull.I mean I paid for a year not six months as now this is a second time in two years.

Re: Malware Removal Forum

Quads — Thu, 26 Jan 2012 00:50:56 GMT

It wasn't the amount of removals I was doing by logging and scripting for the individual PC or at times just the trying to keep up with where I was up to and the hours and hours,

I didn't mind, just took a fair bit of energy drink:smileylol:

It was the fact in this open forum, people would tell the user to install or run everything but the kitchen sink, which could make things worse, harder to remove, or start telling the user to run tools I was using, but yet they didn't know how how to properly use the tools, know what they were looking at or how to script / fix a problem if it occurs.

Other times I would be half way through removal and waiting for the user reply, I would be offline. another user would jump in saying do this do that. GEEZ, made things harder.

So I decided it's not a good idea to do advanced removal on a open forum and I can see why removal forums have protection in place.

I don't (didn't) care about kudos and the Solved I care(d) that the users PC was correctly and completely clean without losing data or damaging the system further.

Quads

Re: Malware Removal Forum

will608 — Fri, 27 Jan 2012 18:46:55 GMT

No but when you paid the extra 99 dollar fee you expect more than just removal of viruses.But then Nortons isnt that great in fixing their own problems.Such as Nortons framework shutdown error an other norton problems.Their answer is for me to renewed which does fix it but this has happened every year I've had nortons.After 5 months this problem always pops up.Paying for a year and to have this keeps reaccurring 5 months into that year is BS and sorry if that offends you as I mean no disrespect.As tech support for this matter is sorely lacking as their quick fix is to get you to renew which won't happened in about 160 days.

Re: Malware Removal Forum

Quads — Mon, 06 Feb 2012 00:36:48 GMT

See some of the variants of the well known kits now have Windows not starting up after the use of FixTDSS,NPE, Combofix, TDSSkiller, or AV software etc.

The making of Windows bootable again is enjoyable (take that, Zeroaccess,TDL4, MaxSS, Bamital.Q..........) But it does have me double or triple checking logs and then also doing the same for the fix script, for that system only. To make sure the script is correct and it will do what I ask it to do.

Quads