While Norton 360 v3 seems to be able to eliminate "Infostealer.Gampass," I'm having to do frequent reboots to finalize the removing of it. I never had problem with this virus prior to N360 v3 or the earlier versions just didn't detect it.
Also, I'm finding that when I open Windows Explorer, and select Tools, Folder Options, View, the box next to "Hide protected operating system files (Recommended)" keeps getting unchecked and I have to manually check it again. Is N360 doing this or is it the Infostealer.Gampass virus doing it?
My system has also gotten a lot slower since upgrading to N360 v3 and crashes a lot in some programs. I also have frequent lockups when I go into the Identity Protection area to update tasks or backup my configuration file.
I just restored my system using Norton Ghost to a known good backup from last summer then updated it because of so many problems. My computer is old (about 8 years), but had been running well prior to upgrading N360.
I'm considering formatting my drive and reinstalling everything and not using my Norton Ghost backups. This computer has become mostly unusable.
I installed Malwarebytes' Anti-Malware and first ran the full scan, then the safe mode per your instructions. The Symantec instructions said to do the reverse. What's the point of the safe mode scan if the full scan doesn't find anything which it didn't? Actually during the scan, Norton popped up with another Infostealer-Gampass message and said I had to reboot to fix it. I delayed the reboot until the scan was finished. I have several drives that have to be scanned so this took a long time.
I actually didn't finish the safe mode scan because I had more pressing things I had to do online and couldn't wait hours for it to finish. I did notice that when I ran MSCONFIG that a few odd things were in there:
Under Services Tab: Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## Manufacturer: Unknown Status: Running
By the way, I forgot to mention that I did reformat my hard drive a couple of days ago and am just getting it back in shape. It would be nice if you could download all of the updates at once so when reinstalling Norton software offline you don't get hit with viruses as I did when trying to activate and update.
I'm beginning to believe that N360 v3 has some flaws in it and may be generating these false reports.
I also forgot to mention that prior to reformatting my hard drive, I did a restore with Norton Ghost which had the N360v2 and Norton Anti-Bot in the file. When I tried to install N360 v3, the program asked to remove Anti-Bot. When I did finally reformat my drive, I installed Norton 360v3 and just recently reinstalled Norton Anti-Bot. I figured if it were to conflict with N360v3 the installer would have notified me which it didn't. Since then I don't seem to be getting as many notices of this virus so I wonder if having the Anti-Bot program installed could be keeping this sneaky virus from getting back in.
I'll do the Safe Mode scan right now since I don't need to use the computer right now. I'll give you the results.
This is interesting. In the history I found eight instances of these. I didn't submit these manually. Does it do it automatically?
Norton Community Watch Feedback Submitted 5/17/2009 10:34:19 AM
Submitted 5/17/2009 10:34:08 AM
Also found these two times: Unused port blocking has blocked communications. Inbound TCP connection: Detected (2 of these) between 10:25:53 AM and 10:25:56 AM
Unauthorized access blocked (Duplicate Object): Medium Severity Actor: c:\windows\system32\services.exe Target: C:\Program Files\Norton Ghost\Agent\VProSvc.exe No Action Required
I forgot to add that the Norton Anti-Bot log was empty. You can't do much with that program. I guess it works on it's own.
While Norton 360 v3 seems to be able to eliminate "Infostealer.Gampass," I'm having to do frequent reboots to finalize the removing of it. I never had problem with this virus prior to N360 v3 or the earlier versions just didn't detect it.
Also, I'm finding that when I open Windows Explorer, and select Tools, Folder Options, View, the box next to "Hide protected operating system files (Recommended)" keeps getting unchecked and I have to manually check it again. Is N360 doing this or is it the Infostealer.Gampass virus doing it?
My system has also gotten a lot slower since upgrading to N360 v3 and crashes a lot in some programs. I also have frequent lockups when I go into the Identity Protection area to update tasks or backup my configuration file.
I just restored my system using Norton Ghost to a known good backup from last summer then updated it because of so many problems. My computer is old (about 8 years), but had been running well prior to upgrading N360.
I'm considering formatting my drive and reinstalling everything and not using my Norton Ghost backups. This computer has become mostly unusable.
I noticed the article seems to relate mostly to games and stealing game account numbers. I don't do online games and don't have any installed on my computer. I mostly use graphics, 3D, and video editing software, but no games. I do use Norton 360's integrated password program to remember passwords and logins so maybe the virus is trying to get to that. Maybe I should not use it.
Like I mentioned, I haven't had another instance of this virus since May 14th and the scan early this morning did not detect it nor did that other program you recommended.
Norton Community Watch Submits Files to symantec which is related to Norton Insight and possible un-Detected Threats; this is Normal. And yes, it Submits them Automatically. If you look at your "Background Tasks" your Norton Product does, you will see "Norton Community Watch" in there.
Un-Used Port Blocking Blocks Connect Attempts that Programs on your computer are not using. And the Un-Authorised Access Blocked is Norton Blocking Changes to your Norton Product because Malware can Change things in your Norton Product to make it stop working, so, both these are Normal too.
I forgot to mention, I’m using Windows XP SR3 on a computer that’s about eight years old and probably ready to die. I’ll check out that program and let you know.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:35:21 AM, on 5/17/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal
Please go to: Start > Run > %Windir% and see if there are any random names in there; also be out on the look-out for:
Start > Run > %System% and see if there are any random DLL Files.
It may add a Value to one of the following Registry Sub-Keys so that it Runs every time Windows Starts: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The Trojan may Modify the following Registry Entries: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"Hidden" = "2" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\"NoDriveTypeAutoRun" = "145" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL\"CheckedValue" = "0"
Can you please Check these and let us know how you get on!
Message Edited by Floating_Red on 05-17-2009 10:44 PM
At the top of the list: $hf_mig$ (in black; other hidden folders in blue); 5/13/2009 3:37 PM
Start > Run > %System%
"Windows cannot find '%System%'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search."
I just typed System instead. I'm not sure what I'm supposed to be looking for as far as random.
I wish I could just send you my registry file to see if you can find anything. None of it makes much sense to me. A lot of what I see are Sony system files.
Wouldn't Norton be able to detect if there was something strange in my registry?
Try Start > Run > %systemroot%\system32 for the random DLL files.
As to the registry, Norton will scan some of it (common malware infected places) but I do not believe Norton scans all the registry nor corrects all of it either.
I still don't understand what I'm supposed to be looking for. There is a long list of things none of which mean anything to me. There are two folders that are blue text (dllcache and DRVSTORE). When I double click these folder names everything inside them is blue as well. I'm assuming they are hidden folders.
Norton hasn't given me anymore indications that the virus has returned so I'm assuming everything is okay for now.
Please keep an eye out for this and take any notes you can (file names, locations, what you were doing on the system just before this showed, etc.) . Thanks for being patient with us.
If you read that Blog, you will have seen that Infostealer.Gampass Deletes it's-self from the system, but keeps a File that can Lanch the Threat again, so, even although your system seems okay, you may still have the Threat on your computer, although, you may be Clean.
It might be an idea to do a Full System Scan with Norton and with Malwarebytes' Anti-Malware - all Drives - in Safe Mode, dis-connected from the Internet. Please remember to Update the Products before Scanning. If you do do this, please let us know the Results.