Norton Internet Security / Norton AntiVirus

[pmb1973]

I have been working on a friend's computer trying to get things straight for her.  I have done everything and was ready to give it back to her, but her Norton subscription had run out.  I upgraded it to NIS2009 this evening, and now Windows Vista hangs up.  It will boot, but before it finishes loading all the programs, it locks up and will not do anything.  I can't even move the mouse.  I have to hold the power button just to turn the machine off. 

I have seen in a few messages you guys referring people to use the NRT, but I have also seen that it will remove EVERYTHING having to do with Norton.  If I did that, then how could I get it back on her machine?  NIS 2008 came on the machine, but she doesn't have a CD for it...

HELP!!

[Phil_D Norton Fighter]

Hi pmb1973,

May I ask a few questions to clarify your issue?

1) Has the subscription been renewed or is it still expired?

2) You mentioned NIS 2008 came on the machine, so I assume it was an OEM version? If so, by what method did you update to NIS 2009?

[pmb1973]

1) Has the subscription been renewed or is it still expired?

Well, here's what happened... after I installed it, it restarted the machine and began the scan... locked up... wouldn't do anything... had to manually shut the computer down... tried to restart... that's when the BIG problems started that I have already talked about.... and now, looking at the mynortonaccount.com screen, it says "Norton Internet Security - Expired" and a second entry saying "Nortin Internet Security - Not Activated"

2) You mentioned NIS 2008 came on the machine, so I assume it was an OEM version?

I assume so... she's a bit computer illiterate, so she can't tell me anything really... and the paperwork and instructions that she had were VERY vew... and nothing in there about NIS 2008. She did tell me that it was on the computer when she got it.

If so, by what method did you update to NIS 2009?

Upgraded online and downloaded the upgrade.

[Phil_D Norton Fighter]

Okay, there may be few issues at play here.

OEM versions are generally free "trial versions" for varying time periods. They generally are not eligible for updating to the newer versions until a subscription is purchased at which time an activation key will be provided. I'm unclear as to the information that is in the Norton Account.

The next possible issue may be this. The 2009 versions of Norton Products will stop functioning when the subscription expires. This is the first time I have encountered installing NIS 2009 overtop of an expired product.

If you cannot see a valid (unexpired) activation key in the Norton Account under Product Info > View, then I would recommend contacting Customer Support via live chat at this link to see if they can help you sort this out.

I know it can be difficult when you don't have all the documentation at hand.

Let us know how you do.

[SendOfJive Norton Fighter]

It is a little unclear as to what's going on here.  It is important to know if you actually purchased NIS 2009 online, or merely tried to upgrade using the activation key that had expired.  At some point in the installation process were you prompted to activate the program?  I am a little concerned that, because NIS 2008 had expired there might be malware on the system that is keeping the new software from installing or running, causing the freeze.   If you purchased a new subscription you can download the Norton Recovery Tool, burn it to CD as instructed, and run it.  Details can be found here. 

The symptoms you describe also precisely fit what happens if you install Norton with Zone Alarm already on the computer.  If that is the case, removing ZA will fix things.  Other anti-malware programs could also be conflicting with NIS, so try removing anything that runs its protection in real time.

But do post back if you can with more specifics as that would be helpful in narrowing down the possibilities.

[pmb1973]

I am actually working live with the Norton Virus and Spyware Support team.  A technician tried to install, but it stopped installing.  It seems that there is a new virus (or maybe an old one) going around. 

The person on whose computer I am working has obviously contracted a virus (I think it's a trojan horse) after her NIS 2008 subscription ran out.

I paid $49.99 to get the upgrade from NIS 2008 to NIS 2009.  Then, when trying to install, the computer locked up on me because of the virus.

Thanks for the help guys!!

<<Edit: Removed potentially hazardous link per the Participation Guidelines and Terms of Service.>>

Message Edited by TomV on 06-16-2009 11:12 PM

[pmb1973]

Well, here is the update...

The technician tried to install Norton, it didn't work.  I told her what I had discovered online about the "edotfinds.com" stuff, so she transferred me to their Virus Support team... they told me that they could remotely access my computer and fix the problem manually, but I would have to pay $99.99.  I'm not paying that.  Can't afford it.

If anybody knows or finds out how to eliminate this problem, please let me know.

[delphinium Norton Fighter]

Hi pmb1973:

You could download and run Malwarebytes http://www.malwarebytes.org  to see if anything shows on the log.  You will be able to post it here.  It will show if there is an infection.

You could also provide a Hijackthis log, which may also point out an infection, but could also tell us if there is something not quite right.

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

We will see where to go from there.

[pmb1973]

Ok guys... you asked for it... here's the Hijackthis log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:25 AM, on 6/17/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\IEUser.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\sueellencrawford\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.maggiblair.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL
O1 - Hosts: ::1 localhost
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRxdm429YYUS
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8647 bytes

Hope that helps.

I actually tried the Malwarebytes, but it does the same thing... locks the computer up.  It's this stupid edotfinds virus....

[pmb1973]

**UPDATE**

I used RootRepeal to scan through everything... it shows a lot of stuff hidden... one of which is a file called "UACd.sys" - a trojan virus. 

I used the information found at http://www.myantispyware.com/2009/01/24/how-to-remove-windowsclickcom-redirect-uacdsys-trojan/ to try to solve the problem.  Here is that information, in part, and my problem with it:

Step 1: Disable UACd.sys trojan driver.

• Right click the My computer icon. If you are using the non classic Start menu, then right click My computer icon on your Start button menu.
• Click Properties.
• Click Hardware Tab.
• Click Device Manager.
• In the top menu, click View and click Show Hidden Drivers.
• Scroll down to non Plug and Play drivers.
• Click + at left.
• In the list of drivers right click UACd.sys.
• Click Disable.
• Click YES for confirm.
• Close all windows and reboot your computer.

My problem is that UACd.sys doesn't show in my non Plug and Play drivers, even after I've clicked "Show Hidden Drivers." 

.......still looking to solve the problem.......