Norton Internet Security / Norton AntiVirus

[patio]

My daughter's computer became infected with the Internet Security 2010 virus.   She kept getting lots of pop-ups and then the fake virus scan thing would pop up.   She hasn't had anything other than AdAware on her computer and the windows defender running.   That usually has taken care of her just fine because she only goes to a few websites, unfortunately she had a homework assignment that took her to some weird sites and I am guessing that is where she got the virus.

So I went to the store and bought her Norton Anti Virus because we have it on a couple of computers.   On the quick scan it did not catch the above mentioned virus, just tracking cookies.   I then ran the deep scan and left it to run.   I came back downstairs and her computer had rebooted and it gets stuck on her desktop.   There are no icons, there is no task bar, nor does the mouse show up.   I tried to start it in safe mode, with the same thing happening, I also tried running it from the last known good cofiguration.    Her computer would start when she had the virus, it was just annoying because of the pop ups.   This problem did not happen until after I installed Norton and started running it.   Now I am getting a lot of negative feedback about Norton from other sites and how I should have never installed the software.  Great, too late.  Can you guys help me get her computer running again?

Thanks in advance.   (as far as computer details go, I can't give you that, other than I know it was running on XP)

[edit: Clarified subject.]

[Quads]

You talk about the Rogue, then state, "So I went to the store and bought her Norton Anti Virus because we have it on a couple of computers"

So is that before or after the Infection you got Norton installed??

Quads

[patio]

We run 8 computers and 3 laptops, a few of those have Norton.  This one did not.  It became infected and I went out and bought Norton in hopes that it would help, it did not, my problem only became worse.   What happened during the deep scan, or whatever it is called on Norton, is unknown to me.   I was upstairs, this computer is in the basement. 

[Quads]

Installing Norton on top of Active Malware that is designed to stop Security programs working properly, would cause problems

You can see the desktop and things on the desktop, to be able to do this,  I have tested a close relative of this rogue, So

1. Download Hijackthis with the clean system, if not able to on the infected PC) from here http://free.antivirus.com/hijackthis/ Download the version 2.0.2 executable on the right hand side ( Not the Installer)

Before Transfering, or just needing to rename "Hijackthis.exe" to "Hijackthis.com"  then transfer to your desktop of the infected machine, run and save a log.

Other names you could rename Hijackthis to are or should be,

iexplore.exe

explorer.exe

winlogon.exe

firefox.exe

Then post the Log back here

Quads

[patio]

I appreciate your patience with me.   :)    Saying that, I am going to be annoying here because I am not real savy when it comes to things like that.   How can I install something when I cannot do anything on my/her desktop?   I don't even get the "start" button on the task bar?   

Thanks again, I'll probably check back in the morning.  

[Quads]

Hmmm sounds like more of a problem than the Rogue on it's own, whether it's installing Norton on top of the Rogue cause more problems,

But if you have No, desktop icons, Taskbar, "start button" or clock etc,  something has stopped sounds like "Explorer.exe" isn't loading 

What happens, if you start the PC into "Safe Mode" But  use the Admin account to load instead of your everyday account??

This is a screenshot of a new variant of this family I played with, screenshot from my actual infection, has fun enough getting a screenshot created

Quads

[jAW]

Hi patio,

I have removed a few of these and the IS2010 rouge often comes alongside a much more severe infection that infects/replaces system files, similar to the TDL3 rootkit. I do not say that you have this in your system, just giving a heads up that a more thorough look might be needed to deem the system clean.

It could however be the reason why this happened after the Norton scan if Norton removed infected system files. Usually this causes much worse symptoms though, hopefully it is like Quads say that the Explorer is not loading. However, the fact that the mouse cursor is not showing is a bad sign since that has nothing to do with the explorer loading or not.

---

patio wrote:

How can I install something when I cannot do anything on my/her desktop?   I don't even get the "start" button on the task bar?

---

When you have it loaded up to the desktop where it gets "stuck", try pressing CTRL+ALT+DEL and see if you get the Task Manager running (it could be blocked by the infection or faults in the system). If you get it running go under File > New Task. Type in explorer and press Ok.

If you get the startmenu and dektop back, follow Quads instructions. If you got the Task Manager running but the Explorer still won't start you can go to File > New Task and then click the Browse button. This should give you a little window where you can browse the files and folders of the system and hopefully, although with a bit more struggle, perform the things Quads want you to do.

Regards

jAW

[Quads]

Task manager should be disabled by the rogue, as I found.

Oh well I will left you with JAW,  and his instructions.

Quads

[patio]

Thanks for the replies.  I will mess with what you said this afternoon.   To answer your question about starting it in safe mode, all I get when I do that is a black desktop with no icons, task bar, etc.   It shows the Service Pack 2 was installed on the PC if that helps which was quite a while ago.   I disabled automatic installation of Windows updates for lots of reasons, lol.