I have recently installed NIS 2009 and every time I run a Full or Quick scan the scan stops when it is at the SecurityRisk.ProxyDNS check. The program appears to have crashed as the Stop Scan button will not abort the scan, and Windows Task Manager will also not close the program. The only way I can abort is to do a hard reset of the PC.
Previously I had Norton 360 installed and that worked OK.
I used the Norton Remove Tool to uninstall NIS 2009, and then reinstalled NIS 2009. Same problem.
When I run the PC in Windows Safe mode the scan completes OK, although it pauses for several minutes on the SecurityRisk.ProxyDNS check, but the Full system scan took nearly two hours (it only found some tracking cookies - nothing nasty). I have NIS 2009 set not to scan within compressed files. It is patched up to date.
I do not really want to go back to Norton 360 as there are features that I do not need or want.
Any ideas what is causing NIS 2009 to crash consistently at this same point in the scan.
Could you also download and run Hijackthis for us. You will be able to post the log by using the "add attachments" link just below the post button. One of our analysts will look at it for you to see what is on your system that might be sticking.
Full system scan in safe mode completes OK, although it did pause at the same point for probably a minute, before moving on. Only tracking cookies found during the scan, nothing serious.
Full system scan in safe mode completes OK, although it did pause at the same point for probably a minute, before moving on. Only tracking cookies found during the scan, nothing serious.
Regards
Towos2000
That's fine.
This can tell us that it is either both or one or the other of:
- Your Driver has been damaged. You can Run a Disc Check to see if Windows Detects any problems and can automatically Fix them.
- There is a Threat on your computer that is not letting the Scan pass that point. You could Download and Install and Update Malwarebytes' Anti-Malware and do a Full System Scan in Normal and in Safe Mode of All Available Drivers.
It looks like you have some anomalies in your HJT, I will have to find an analyst to look at it, so there my be a delay until one of them comes online.
...so there my be a delay until one of them comes online.
Hi, twows2000,
Why not use this time to do a Full Scan with Malwarebytes' Anti-Malware in Normal and in Safe Mode? If you do do this, please do let us know the Results. Please do not Buy Malwarebytes' Anti-Malware as this will add Real-Time Protection, which is what your Norton Product has. Make sure you always do Anti-Virus Scans dis-connected from the Internet, and that you Update the Product before dis-connecting.
Malwarebytes' Anti-Malware check in Safe Mode took 47 minutes and found no problems.
Malwarebytes' Anti-Malware check in Normal mode, I left running overnight, and this morning, Malwarebytes' Anti-Malware had crashed, with the normal Windows error message.
See if you can delete it in safe mode. Let us know if that works.
Also try this one in case.Please run a SysProt log for us so we can check your system for rootkit activity. You will need to disable Norton auto-protect while you run the scan.
Choose report or log, check all the boxes and scan.
You will be able to post the log here using the "add attachments" link just below the orange post button.
With your logs coming back clean, lets move to a Windows side for a moment. Are you running XP or Vista? What SP level and is the system 32 bit or 64 bit?
You can try to flush your DNS and resetting the winsock.
1. Click Start > Run, type ipconfig /flushdns and click OK.
2. Click Start > Run, type cmd and click OK.
(Note : If you are running Vista you will need an elevated Command prompt here; Click START and in the start search box type cmd. Right click on the cmd.exe entry on the top of the list and select Runs as Administartor. Click continue in the User Account Control pop up.)
3. in the command prompt, type the following and press Enter after each line:
I think you are all telling me, that as far as you can see, my PC is clean.
So I tried a bit of lateral thinking.......
I added the SecurityRisk.ProxyDNS test to the NIS2009 signature exclusion list, in an effort to see what would happen if I did not run that specific test.
Answer......
NIS2009 still runs the SecurityRisk.ProxyDNS test and crashes.
Is there something else I have to do to get NIS2009 to recognise something I have added to the signature exclusion list ?