• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

NIS 2009 Keeps asking to reboot to remove threats

This started happening today on my 2nd day with NIS 2009. Even when I reboot and run no extra apps

Any ideas? I had run a full systen scan yesterday, ran CCleaner today and Disk Cleanup to see if that helped.

Perhaps I should run a scan from the CD and then another full scan from Windows XP?

Thanks to all

Tony

Replies

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Tdale:

Please provide more details before you continue changing things in your computer.  Please click on history, go to the menu list at the top and check both unresolved and resolved threats to find out what file is involved.  Let us know.  That will tell us what assistance you need, if any.

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi! Tdale,

I would like to know if you have noticed any unexplained hard disk free space lose.  If so check for a new hidden partition; I have had malware create a hidden partition on my system before.  Keep in mind that some computer manufacturers do include a hidden partition for system recovery puposes. If your system is built by a major manufacturer you may need them to do a repair on the system to get rid of any malware on your system. (Note some manufacturers don't do repairs on systems infected with malware). If possible request recover discs to reinstall the software that came with pc; but only reinstall as a very last resort when all other resources have been exhausted. One key reason NIS 2009 is requesting a reboot is because a rootkit may be involved that has infected system files or possibly the Master Boot Record.  Also run from the command line the command chkdsk /r to check for and resolve any disk issues your system may have; even brand new pc's can have disk errors that are minor but interfere with the proper operation of the system and its software.  Also use a different computer to download the latest virus definitions from symantec's site; you will need to burn (write) the file to a cd. Install the virus definition file from the cd you created; if you use a flash drive you risk possibly infecting and ruining the flash drive.  Run the full system scan again and follow any on-screen prompts.  If the issue continues then use a program like spybot search and destroy or ad-aware to due a full system scan (these programs can be downloaded from http://www.downloads.com just enter the program name into the search box and download and install the program and run its update function; prior the scan.  These programs may allow NIS to complete its work.

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Thanks for your replay, I do have more info

I build my own PC's and this one had had a recent clean install of XP, then W7 as a dual boot.

Can a rootkit be detected if I boot from trhe CD to run a safe mode scan?

Can Spybot Search and Destroy run alongside NIS 2009? 

There are 2 blocked items which do not seem right, here they are:

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\mcui32.exe

Target PID 212

Action  Send terminate Message to Window

Reaction Unauthorised access blocked

It is a medium threat

The other is

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\ccsvchst.exe

Target PID 1580

Action  Send terminate Message to Window

Reaction Unauthorised access blocked

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi! Tdale,

First I will tell you that I am a PC Tech trained by Penn Foster and now going through formal CompTia training.  Only rootkits that were around when the definition file was created will be detected.  Yes, Spybot Search and Destroy can run alongside NIS 2009 as can Ad-Aware and Windows Defender.  I run all four side by side with resident memory scanners running too and I have yet to have any problems.  However, Windows 7 is not supported by the other three programs so run them from Windows XP,  all these programs do recognize other unsupported OS's and only remove malicious software nothing else.  Are blocked listed in the NIS 2009 History?  NIS 2009 has a product protection function and if something not recognized as being from Symantec it will be blocked access to NIS 2009 files.  Please keep me informed as to your situation; I have a friend that is a trained PC Specialist who can help.

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi! Tdale,

I have been asked to discontinue posting in this part of the forum with the exception of my own noted problems.  I will comply and hopefully avoid being banned.

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats


tdale wrote:

Thanks for your replay, I do have more info

I build my own PC's and this one had had a recent clean install of XP, then W7 as a dual boot.

Can a rootkit be detected if I boot from trhe CD to run a safe mode scan?

Can Spybot Search and Destroy run alongside NIS 2009? 

There are 2 blocked items which do not seem right, here they are:

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\mcui32.exe

Target PID 212

Action  Send terminate Message to Window

Reaction Unauthorised access blocked

It is a medium threat

The other is

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\ccsvchst.exe

Target PID 1580

Action  Send terminate Message to Window

Reaction Unauthorised access blocked


Sounds like a fp, but I am not sure. Please provide the information as delphinium asked

"All that we are is the result of what we have thought"
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats


There are 2 blocked items which do not seem right, here they are:

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\mcui32.exe

Target PID 212

Action  Send terminate Message to Window

Reaction Unauthorised access blocked

It is a medium threat

The other is

Actor   c:\windows\explorer.exe

Actor PID 464

Target  c:\program files\norton internet security\engine\16.5.0.135\ccsvchst.exe

Target PID 1580

Action  Send terminate Message to Window

Reaction Unauthorised access blocked


Looks like the same as what we explained Send of Jive and I here  and screenshot on that thread further  below http://community.norton.com/norton/board/message?board.id=nis_feedback&message.id=63824#M63824 

For the rebooting In the "history"  go to the Unresolved Threats" list, is there anything in there??

Quads 

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hello Quads

Yes that is exactly what I have. I have nothing in Unresolved, all of these instances are in the Norton Tamper section. Is there anyway to fix this, othwerwise the warnings will arise every time I use my PC.

Shall I uninstall software one at a time until I can isolate thae cause? 

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi

They don't need to be removed, I have them in my logs to.

What version of NIS do you have??  As if you installed an older version of the product from a CDROM their could be a newer version that could fix a lot of problems.

Quads 

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

I have NIS 2009, but I don't want these popups occurring every bootup and all of the time. Surley this can be fixed instead of disabling the tamper function

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

What is your version tdale?  Look under help & support - about.
Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Also, Spybot Search and Destroy can only be used if Teatimer is disabled.  The same thing goes for Adaware and Windows Defender.  They can be used on a on-demand basis, but not on a real-time basis as they will trigger the same type of conflict.  Antivirus engines do not like being poked by other programs.  It is built-in protection to prevent malware from disabling them.
Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

The program is Norton Internet Security, 2009. Is the version  16.5.0.135?  I am at work so will check tonight.  

I will turn off TeaTimer. I had AVG and S&D with TeaTimer which I uninstalled and rebooted before installing NIS 2009 

Tks

Tony

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Did you use the AVG removal tool before installing NIS??

Quads 

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

No, I uninstalled AVG from its own Start menu uninstall program, same with Spybot
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

AVG Has a removal tool so that you can remove all the remanants of AVG like Norton has it's NRT (Norton Removal Tool).

Quads 

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi Quads

I ran the AVG Removal tool, no change, removed TeaTimer, no change. Uninstalled NIS with the removal tool and reinstalled all ok so far.

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

I think you had a lot of program conflicts going on there and possibly some warnings related to what might have been in other program quarantines.

Are the warnings gone now, and is your system working better?

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Hi

I dont really agree, the OS was a recent clean install, nothimg much on it, but TeaTimer had been as has AVG. The AVG removal tool removed reg entries not removed by the ACG uninstall so perhaps that was the issue?

Kudos0

Re: NIS 2009 Keeps asking to reboot to remove threats

Is Norton running properly now?  Are you still having any issues?
Under certain circumstances profanity provides relief denied even to prayer.Mark Twain

This thread is closed from further comment. Please visit the forum to start a new thread.