Norton Internet Security / Norton AntiVirus

[mcullet]

Hi peeps,

WIN 7 pro - latest updates / patches, NIS 2010 - latest updates.

I adore NIS 2010 - it contniues to keep me safe despite myself (long story - very exciting too :)

And ever since I (clean) installed WIN 7, it's proven to be a reliable, stable OS - yeah, I was kinda shocked.  Until now, I've not disabled NIS before installing a program and never ever had a problem.

I've had no need to do a system restore under WIN 7 until I made a mistake of installing the Samsung mobile phone software for the SGH-F480I.  Most mobiles have some sort of PC suite that lets you move photos, messages and contacts between the phone and PC.

During the install process, WIN 7 kept warning me about drivers being incompatible - so I chose NOT to install them.  Try as I might I could not abort the install process.  I then went and unistalled the software via the WIN 7 control panel.  Despite me supposedly saying 'no' to all of the drivers during the install process, I could see 8 (samsung 'programs') in the WIN 7 program list.: Samsung Mobile Composite Device Software, Samsung Mobile Moem Device Software and so on.

I tried to unistall these the usual way but got a message saying "A version of driver was found that was not installed with a compatible installer.  This is possibly because you installed an earlier version of this package.  Would you like to uninstall the drivers?"

Yes - yes I do.  I followed the prompts ... and was instructed to reboot.  The 'program' still appears in the program list.

I checked device drivers - (via device manager) - and could not see much difference and nothing that was stamped "SAMSUNG'.

So I figured (wrongly perhaps) that a system restore to an earlier point would 'probably sort this out - it's worked for similar driver related matters (until now).

System restore ran - rebooted - and then I got a message saying:

"System Restore did not complete successfully.  Your computer's system files and settings were not changed.  Details System restore could not access a file.  This is probably because an antivirus is running on the computer.  Temporarily disable your AV program and retry system restore.  An unspecified error occurred during system resore (0x80070005).  You can try system restore again and choose a different restore point ..."  And it goes on about advanced recovery methods.

I disabled NIS - repeated the process - and got the same result.

A google search on the error cas unhelpful - and unkind about Norton (sigh).  Most answers were remove all Symantec products blah blah .... none I saw resulted in a real working solution though.

Some suggested doing a repair install of WIN 7 - but none referred to non-programs appearing in the program list - and that method works for some to resolve the error code problem.

I found a few posts on this error in the forum - none matched my situation.

(A) I really don't understand how these Symantec driver programs appear in a WIN 7 program list - their drivers. 

(B) I'm not keen to unistall NIS (yet) because I really doubt it's the cause of the problem.

Has anyone else had anything similar happen with Samsung Mobile Phone software and WIN 7 (or anything similar) where the WIN 7 uninstall fails and recovery fails?

Finally ... I've run out of places to look and things to try.  A fresh set of eyes would really be much appreciated - it's got me beat :(

Thanks in advance,

Mike

[3play]

Hey.

Long story short :

Norton's tamper protection (built-in the product to help prevent unauthorised chages in the product) prevents Windows form doing System Restore as it might modify it.

Solution is to temporary disable this protection and perform the restore.

Open the Norton's user interface , click "Settings" and then "Miscellaneous". Follow the screenshot below

Appli the changes for 15 minutes only and do a restore .

Hope that helps !

[DaveH]

I need to turn off norton product tamper protection to get system restore to work.

It's under miscellaneous settings.

[mdturner]

Hi Mike

Try disabling Tamper Protection in NIS and then running your System Restore and it should work correctly.

[mcullet]

Hi folks

Bugger me - turn off the tamper setting - of course!!!  I'm either way too tired (yes) or someone snuck in and lobotomised me while I was watching a boring vid. 

Must run off and check for lobotomy marks .... around here that's a distinct possibility.

Thanks to all who replied - I am very grateful for the help.  As soon as I'm less sleepy, I will get right to it and let you know how it pans out. 

Mike

[mcullet]

Hi all,

Took a nap - followed steps as outlined above.  And no joy.  Grrr. This *should* have worked.

In passing, I noticed that there was a WIN 7 critical update a couple of days ago.  Maybe it's nothing more than coincidence but over the years I've learned that MS updates sometimes lead to weird behaviour in previously well behaved programs / systems.

In case anyone else looks for a Samsung related problem, I'm including a copy of the entries that appear in my program / uninstall list .... none are able to be removed.

I'm slightly obsessive so I will continue to find a workable solution and post my findings here.  I know a lot more about XP PRO than WIN 7 and am hesitant to muck around too much with it - may make things a whole lot worse.

On the off-chance my system might have a bug, I'll run a thorough AV check overnight - it's worth the look.

And I'll expand my research to include MSDN and a few other sites ... Google results are not especially helpful when most suggest deleting Symantec (permanently).

And I have already email Samsung with a nice whinge about their software.  I *hope* I am wrong, but maybe their product is the cause - I thought companies learned their lesson about rootkits and the like.

More to follow - and a working solution, I hope :)

[EDIT - chased down one of the Samsung drivers (for those far more talented than I could dream of becomming)]

Filename: nmwcdsacjx64.sys Folder path: C:\Program Files (x86)\Samsung\PC DLC Driver\x64

Registry Info:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B75A2F7AD5FB6F438D2AAD68787F065

Value Name: 8CAF48E7815C9F048970475503D1D652
TYPE: REG_SZ
Value Data: C:\Program Files (x86)\Samsung\PC DLC Driver\x64\nmwcdsacjx64.sys

NOTE: Did a Google search on this file and stumbled upon some really dodgy site claiming to have the solution, loads of awards etc.  The awards were fake and almost all contained EXE files to do a helpful scurity scan on your PC.  Won't post URLs here but have written reports on a few for Symantec to chase down.  Newb killers.

Mike

[AllenM Norton Fighter]

Hi Mike,

The drivers may have been left in a bad state from not allowing them to install when you installed the software.

Have you tried booting from your Windows DVD and then tapping F8 until you get the menu and then selecting Last Known Good Configuration? I would recommend giving this a try. As a precaution disable Tamper Protection before restarting the computer.

This might work better depending on if the OS ascertained (incorrectly in this case) that your current configuration is actually good.

I also found the following on Samsung website when searching around some:

http://ars.samsung.com/customer/usa/jsp/faqs/faqs_view_us.jsp?SITE_ID=22&PG_ID=2&PROD_SUB_ID=557&PRO...

Please let us know how it goes.

Best wishes.

Allen

[mcullet]

Hi Allen

Your link to ars.samsung.com was really interesting. The site is in Korea - I was looking in the OZ site here: http://www.samsung.com/au/support/detail/supportPrdDetail.do?menu=SP12&prd_ia_cd=01013000&prd_mdl_cd... and it says nothing about the problems discussed on the Korean site.  Double grrr. 

You sir are a research god of olympian proportion :)

I removed the software (Studio) first - via WIN 7 program uninstall - although I did see an uninstall Studio entry in the Samsung program group.  Out of habit I use the WIN 7 uninstall process because (until now) it's generally been cleaner, as in removed things better, than the bog standard ones supplied in a program group.

Based on what the Korean site says, I needed to remove the horde of samsung drivers BEFORE uninstalling the program.  Odd - and not mentioned anywhere that i could see in the docs (yep - I looked).  And might explain why I can't now uninstall the drivers - I killed off the primary (??) means by which they can be removed when I deleted the program.

This really is poor program design - especially since most people aren't highly IT literate.

It's after midnight here and I want a clear head before trying this again.  I reckon you are definately on the right track - so THANK YOU HEAPS.  Would never have thought of this in a million years - haven't seen this sort of sloppy stuff for a long time and ... just plain forgot.  Doh ... I am getting old :)  Wonder what response the local Samsung folk will come up with .... feel like a small wager?  $2 AUS they have no clue.

Mike

[AllenM Norton Fighter]

Hi Mike,

Thanks very much for the kind words and the update.

We'll be looking forward to updates after you've had some rest.

Best wishes.

Allen

[KevinR]

Can this problem arise from the update? It is odd timing that my computer did the same update at almost the same time, then took a huge dump on me.