I just tried to update Norton Ghost 14 and after the update it's gone! C:\Program Files\Norton Ghost contains one
direcotry, Agent, and one file, Fixinstall.bat. Agent contains one file, VProSvc.exe.
This is what I recall happening:
I tried checking for updates and it found one, downloaded it, uncompressed it and (I suppose) partially installed
it. It then told me to restart the computer which I did. After logging in following the restart, there were several
windows that popped up momentarily saying "Preparing to install". I waited for 5-10 minute and nothing seemed to
happen so I tried to bring up Ghostbut got a "Missing Shortcut" pop-up. Then I checked C:\Program Files\Norton
Ghost and saw that there was virtually nothing there.
Then I brought up Task Manager and noticed that there were two instances of msiexec.exe running each using a
considerable amount of CPU at various times. Also occassionally a blank command window would very briefly pop up.
Then I noticed that other directories (including Console) were apearing in C:\Program Files\Norton Ghost and then
disappearing shortly there after. I watched this happen repeatedly for a couple of hours, then went to bed leaving
the computer running.
When I got up the next morning, there was no msiexec.exe running but there was nothing but Agent and Fixinstall.bat
in C:\Program Files\Norton Ghost.
So I restarted the computer again and noticed that two instances of msiexec.exe got started but I had to go to work
so I couldn't stay around to see what happened.
When I got home, things were in the state they were in when I got up. So I tried reinstalling using
NGH140_AllWin_EnglishTryBuy30.exe, telling it to repair an installation. It did some stuff and told me to restart my computer and now I seem to be back to the point of two instances of msiexec running with stuff appearing and disappearing and blank command windows popping up occassionally.
The most dramatic thing I did recently to my computer was install Norton Security Suite provided by Comcast. It has its own backup capability but I have not configured it to do any backups.
Any help resolving this mess would be appreciated.
Thanks
Jim
I'd rather not do that. I back up weekly and this thing happened yesterday about 5 days after last backup.
What I've discovered is that C:\Windows\TEMP is littered with log files (MSI*.LOG) with the same error message:
"Error 1911.Could not register type library for file C:\Program Files\Norton Ghost\Shared\EasySetupInt.dll. Contact your support personnel.
=== Logging stopped: 3/17/2010 23:17:12 ==="
Only the date/time is different. There's one every 5-6 minutes. So it looks like the installer is running into the registration error and just continually retries.
Is there a "support personnel" out there who can fix this error? I've googled the error but what I find makes no sense to me.
Thanks
Jim
Hi Jim,
Welcome to the forum. This is very unusual but we'll try to get this cleaned up for you.
First, given the rather dramatic symptoms I am definitely going to recommend that you run the Norton Removal tool to help clean things up. The Norton Removal tool removes ALL Norton/Symantec products so before you do run this tool (as per instructions to be provided in a subsequent post) please make sure you have your product key for all Symantec products in hand first. I am not sure if this would also remove Norton Internet Security suite but I suspect it will and in either case if it does not remove it automatically I would recommend uninstalling this yourself. With something this dramatic the intent is to get everything related to Norton products completely cleaned up and then begin reinstalling.
However before I ask you to go off and do this, please provide the following:
1) What is your OS and SP level to include 32 or 64 bit.
2) Other than Internet security suite, do you have any other anti-virus, anti-malware, etc programs installed on your computer? If so, please let me know exactly which ones.
I am also quite concerned about you indicating that windows were popping up on screen intermittently and a few other symptoms. I can believe that something could have gone wrong with a Ghost Live Update but I can almost 100% assure you that this would not account for some of the symptoms you described.
This leaves me concerned about a possible malware infection, so please also provide the following:
1) Other than the Ghost live update and the installation of the security suite, did anything else at all happen surrounding the time these problems started?
2) Did you recently download anything else from the internet (other than the security suite)? If so what?
3) Did you experience any unexpected popups when visiting a website? If so, do you remember what it said? Did you click Yes or No, etc?
4) Do you have any other examples of anything which is happening which appear out of the ordinary? If unsure, please mention them.
Our process is going to involve the following:
1) We need to run some tools to check your computer for possible malware infections.
2) Only when we have determined and/or cleaned any infections will we then proceed to uninstalling and reinstalling your Norton software along with running the Norton removal tool.
3) After we get a clean bill of health, we will methodically reinstall your software.
It is very important that you respond to all questions asked.
Thanks very much
Allen
I will provide further guidelines on doing the above actions once I receive the addtional information from you.
I just tried to update Norton Ghost 14 and after the update it's gone! C:\Program Files\Norton Ghost contains one
direcotry, Agent, and one file, Fixinstall.bat. Agent contains one file, VProSvc.exe.
This is what I recall happening:
I tried checking for updates and it found one, downloaded it, uncompressed it and (I suppose) partially installed
it. It then told me to restart the computer which I did. After logging in following the restart, there were several
windows that popped up momentarily saying "Preparing to install". I waited for 5-10 minute and nothing seemed to
happen so I tried to bring up Ghostbut got a "Missing Shortcut" pop-up. Then I checked C:\Program Files\Norton
Ghost and saw that there was virtually nothing there.
Then I brought up Task Manager and noticed that there were two instances of msiexec.exe running each using a
considerable amount of CPU at various times. Also occassionally a blank command window would very briefly pop up.
Then I noticed that other directories (including Console) were apearing in C:\Program Files\Norton Ghost and then
disappearing shortly there after. I watched this happen repeatedly for a couple of hours, then went to bed leaving
the computer running.
When I got up the next morning, there was no msiexec.exe running but there was nothing but Agent and Fixinstall.bat
in C:\Program Files\Norton Ghost.
So I restarted the computer again and noticed that two instances of msiexec.exe got started but I had to go to work
so I couldn't stay around to see what happened.
When I got home, things were in the state they were in when I got up. So I tried reinstalling using
NGH140_AllWin_EnglishTryBuy30.exe, telling it to repair an installation. It did some stuff and told me to restart my computer and now I seem to be back to the point of two instances of msiexec running with stuff appearing and disappearing and blank command windows popping up occassionally.
The most dramatic thing I did recently to my computer was install Norton Security Suite provided by Comcast. It has its own backup capability but I have not configured it to do any backups.
Any help resolving this mess would be appreciated.
Thanks
Jim
Is the product key the "Product SKU" (8 digit number) that came in an e-mail from Symantec when I paid for Ghost or the "Product Serial Number" (16 digit number plus some "-"s) ? If not where do I find the key for Ghost? Not worried about the key for Security Suite because I get that free from Comcast and can always download it again.
1) What is your OS and SP level to include 32 or 64 bit.
Windows XP home SP3 32 bit
2) Other than Internet security suite, do you have any other anti-virus, anti-malware, etc programs installed on your computer? If so, please let me know exactly which ones.
Old version of Spy Bot. Haven't run it in a long time.
1) Other than the Ghost live update and the installation of the security suite, did anything else at all happen surrounding the time these problems started?
There was an issue with installation of Norton Security Suite. I had installed it on another computer that had McAfee (the Comcast supplied version) on it and, as I recall, when I installed it, it automatically removed McAfee. When I did this on the problematic computer, it did not uninstall McAfee (an "enterprise" version supplied by my employer) so I uninstalled McAfee after installing Norton Security Suite. The issue is that, at least briefly, both Norton Security Suite and McAfee were installed.
There was another issue: I've been having trouble booting the computer. It would often hang during the boot up. It might take several boots to get it to come up. I believe that I have resolved that problem by disconnecting a Creative Labs web cam that I bought a couple of months ago. I've been considering uninstalling the software/driver that came with it but haven't yet.
2) Did you recently download anything else from the internet (other than the security suite)? If so what?
No. Although Firefox just updated itself today and RealPlayer has been trying to update itself but I keep telling it to remind met later (after I clean things up).
3) Did you experience any unexpected popups when visiting a website? If so, do you remember what it said? Did you click Yes or No, etc?
No.
4) Do you have any other examples of anything which is happening which appear out of the ordinary? If unsure, please mention them.
Just noticed this: If I right mouse click on anything, the installer starts and it wants to install Norton Ghost.
Thanks
Jim
Hi Jim,
Thanks for the addtional information. OK, we definitely have some clean up stuff to do.
One last question for the moment. Spy Bot should be OK provided you do not enable the Tea Timer option. Are you using Tea Timer?
Let's proceed as follows, the order these are done in can be important.
1) Double check that Mcaffee is not shown in Add/Remove programs. I would also recommend to be on the safe side to see if Mcaffee has a removal tool. I searched a bit but not sure what Enterprise version you have. I did find the following link which may or may not be of use. Please see here. If you cannot locate a removal tool for it, then let's forget this for now and just make sure it is not in add/remove programs.
2) Download the free version of Malware Bytes. Please click on the spoiler tag below to open the procedure.
Please download, install, update and run the free version of MalwareBytes following the procedure outlined below. Any other recommendations will follow after you have a chance to provide any other details requested.
Please go to www.malwarebytes.org
1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) free version and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as “default” only
4. Before the installation completes, check on the following prompts:
- Update Malwarebytes’ Anti-Malware
- Launch Malwarebytes’ Anti-Malware
5. Click “Finish.” The program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly choosing a "full scan".
7. When scanning is finished click on “Show Results”
8. Make sure that all detected threats are marked with a check mark, click on "Remove Selected".
9. Restart your computer.
Please post the logs back to this thread using "add attchments" at the bottom.
Note: Sometimes the main site is blocked from attempts to download MalwareBytes. If this occurs please try to download from:
http://www.filehippo.com/download_malwarebytes_anti_malware/
Please do not download the Spyware Doctor which you will see on this page!
3) Run a FULL system scan with security suite and please let me know the results.
4) Double check that Ghost is NOT listed in Add/Remove programs any more. If it is attempt to uninstall it. It is a good chance this step will fail. Browse through your add/remove programs and just double check that outside of Security Suite you have no other Norton or Symantec products listed including Live Update. Uninstall any Norton/Symantec software but do NOT uninstall Security suite just yet.
5) Browse to the following locations in Windows Explorer and delete the directories indicated if they exist.
C:\Program Files\Norton Ghost
C:\Documents and Settings\All Users\Application Data\Symantec\FileBackup
C:\Documents and Settings\All Users\Application Data\Symantec\Norton Ghost
C:\Documents and Settings\All Users\Application Data\Symantec\Live Update
C:\Documents and Settings\All Users\Application Data\Symantec\VProConsole
6) Download the Norton Removal Tool from here and save on your desktop. However please do NOT run this just yet.
7) The Norton Security suite is based on Norton 360 software so you probably have Identity Safe included with it. Are you familiar with Identity Safe feature and do you use this? If you do use this please back up your Identity safe data. Details are included at this link.
I have more which we need to do but will hold off posting this until I see the scan results from Malware Bytes and security suite.
Please let me know if you have any questions. I know there is a lot here.
Thanks much
Allen
I won't be able to get to this until later today but I can answer a couple of questions now:
1) Double check that McAfee is not shown in Add/Remove programs. I would also recommend to be on the safe side to see if Mcaffee has a removal tool. I searched a bit but not sure what Enterprise version you have. I did find the following link which may or may not be of use. Please see here. If you cannot locate a removal tool for it, then let's forget this for now and just make sure it is not in add/remove programs.
McAfee is not in Add/Remove programs. I used Add/Remove programs to uninstall it and there were no problems reported when I did it.
4) Double check that Ghost is NOT listed in Add/Remove programs any more. If it is attempt to uninstall it. It is a good chance this step will fail. Browse through your add/remove programs and just double check that outside of Security Suite you have no other Norton or Symantec products listed including Live Update. Uninstall any Norton/Symantec software but do NOT uninstall Security suite just yet.
Norton Ghost is listed in Add/Remove programs.
7) The Norton Security suite is based on Norton 360 software so you probably have Identity Safe included with it. Are you familiar with Identity Safe feature and do you use this? If you do use this please back up your Identity safe data. Details are included at this link.
I have just recently installed the Security Suite. I have not yet investigated what it is and am not using it.
Thanks
Jim
Hi Jim,
I will look forward to the results when you have a chance to go through this.
Regarding Spy Bot, are you using the Tea Timer option? I would recommend not using this as it could cause conflicts with the security suite.
Thanks much
Allen
Allen, first let me thank you for the help you are providing me. It is much appreciated.
Whew! I finally got through all your suggestions late yesterday EXCEPT uninstalling Live Update. The journey was not without incident. What follows is in two parts. Part one is a collection of responses to your latest suggestions and questions. Part two is a recap of everything that has transpired to date. There is new information n part two that was previously omitted.
PART ONE
One last question for the moment. Spy Bot should be OK provided you do not enable the Tea Timer option. Are you using Tea Timer?
>> No.
1) Double check that Mcaffee is not shown in Add/Remove programs. I would also recommend to be on the safe side to see if Mcaffee has a removal tool. I searched a bit but not sure what Enterprise version you have. I did find the following link which may or may not be of use. Please see here. If you cannot locate a removal tool for it, then let's forget this for now and just make sure it is not in add/remove programs.
>>McAfee does not show in add/remove programs. Did not find any removal tool. I don't remember what version of McAfee it was
2) Please download, install, update and run the free version of MalwareBytes following the procedure outlined below.
>> Done. Results attached as "mbam-log-2010-03-20 (17-44-59).txt".
3) Run a FULL system scan with security suite and please let me know the results.
>>Here's where things got a little weird, causing me to panic a bit... There are three scan options: 1) Quick Scan, 2) Comprehensie Scan 3) Let Me Choose. No Full scan. So I chose Comprehensive Scan but that insisted on setting up backups which I didn't want because I have Ghost. So I selected Let Me Choose and took the default options EXCEPT I deselected Back Up. This involved 5 steps: 1) Live Update, 2) Virus and Spyware Scan, 3) Internet Explorer Temporary Files, 4) Windows Temporary Files and 5) Disk Optimization.
>>It went through the first 4 steps and then hung on Disk Optimization, "analyzing" F: for more than 20 minutes. F: contains a total of 2 directories and 3 files. Then I noticed that the icon in "My Computer" for G: was wrong. G: is where my Ghost backup files are. I checked the properties of G: and the file type was RAW with 0 bytes used and 0 bytes total. When I opened G: it showed an empty partition. This is when I paniced, thinking I'd lost all my backups. I had checked them on earlier in day and they were fine so it appeared that something I had done (running MalwareBytes or the Norton Security Suite scan) had caused this. So, I asked Security Suite to skip the Disk Optimization and it went into a "skipping" state but never quit so I shutdown the computer and booted the recovery disk. This, fortunately, still showed the recovery files. Feeling a little less paniced but still not quite safe, I dusted off an old Drive Image 7 and tried to install that in order to make a backup of C:. But after installing Drive Image I couldn't boot my computer (It kept sponaneously rebooting shortly after bringing up the signon screen). So I booted into safe mode and did a system restore to a 3/19/2010 restore point. This removed Anti-Malware in addition to Drive Image, but I'd already run the scan and I have the download file.
>>After the system restore, Security Suite needed to be reconfigured but it still had in its history the results of the scan. It found several Trojans all in ...\java\deployment\cache\6.0... It also found a "Macro Component" in two .dot files that are 13 years old. I've been carrying these files from computer to computer.
4) Double check that Ghost is NOT listed in Add/Remove programs any more. If it is attempt to uninstall it. It is a good chance this step will fail. Browse through your add/remove programs and just double check that outside of Security Suite you have no other Norton or Symantec products listed including Live Update. Uninstall any Norton/Symantec software but do NOT uninstall Security suite just yet.
>>Removed Norton Ghost. This did NOT fail. Also, after removing Norton Ghost, G: is back to normal and right clicking on things does not cause a pop-up about the installer starting.
>>Did NOT remove Live Update. Do we need to do that? Since the removal of Ghost things seem to have settled down. Would it be safe to just try to reinstall Ghost? Are Ghost and Security Suite compatible?
5) Browse to the following locations in Windows Explorer and delete the directories indicated if they exist.
C:\Program Files\Norton Ghost
>>Did not exist.
C:\Documents and Settings\All Users\Application Data\Symantec\FileBackup
>>Did not exist.
C:\Documents and Settings\All Users\Application Data\Symantec\Norton Ghost
>>Did not exist
C:\Documents and Settings\All Users\Application Data\Symantec\Live Update
>>Still there and I did not delete since I did not remove Live Update.
C:\Documents and Settings\All Users\Application Data\Symantec\VProConsole
>>Did not exist
6) Download the Norton Removal Tool from here and save on your desktop. However please do NOT run this just yet.
>>Done.
7) The Norton Security suite is based on Norton 360 software so you probably have Identity Safe included with it. Are you familiar with Identity Safe feature and do you use this? If you do use this please back up your Identity safe data. Details are included at this link.
>>Since Security Suite is new to me I haven't looked into Identy Safe feature.
PART TWO
This really started with a boot-up problem I was having. I'll describe boot-up as comprising 5 phases:
Phase 1: The BIOS stuff
Phase 2: When the Windows logo screen comes up.
Phase 3: When the screen goes blank
Phase 4: When the little red light under the mouse flashes and the mouse pointer appears on the screen
Phase 5: When the Windows signon screen comes up.
Boot-up would occassionally hang in Phase 3 (blank screen). It was a problem I'd been having for several months but it was occurring with much greater frequency lately. It might take 3 or 4 reboots to get boot-up through Phase 3.
Then I installed Norton Security Suite from Comcast slightly incorrectly in that I installed Security Suite first and removed McAfee second. There did not appear to be any adverse consequences of doing that.
Then I tried to update Norton Ghost and that's when things really went haywire as detailed above. First (and this is a piece of info that I had previously omitted) a restart would result in an error in Phase 1. It didn't recognize the hard drive as having a valid OS. Turning the computer off and back on would result in it getting through Phase 1.
Than I noticed something about the sequence of lights coming on on my USB attachment and that prompted me to disconnect the Creative Labs web cam and since then boot-up has not hung in Phase 3 and there have been lots of boot-ups dealing with the Ghost issue.
Since uninstalling Ghost there have been no boot-up or restart problems, right clicking on an icon does not start the installer and my back-up drive appears normal. The only apparent downside to the situation now is that I don't have Ghost so I don't have any backups being done.
Again, thanks a lot for your help.
Jim
Hi Jim,
Thanks for the update.
>>After the system restore, Security Suite needed to be reconfigured but it still had in its history the results of the scan. It found several Trojans all in ...\java\deployment\cache\6.0... It also found a "Macro Component" in two .dot files that are 13 years old. I've been carrying these files from computer to computer.
Did you tell Security Suite to remove the infected files? Did it do so successfully? Did you run a subsequent scan? If not, please do so.
I do not see the Malware Bytes log attached, can you try attaching again?
Can you check how the disks are listed in the Disk Management console? To do this please type compmgmt.msc in the start menu run box. Check that each disk is showing as healthy and please let me know the file system type of each drive.
Thanks much
Allen
Here's another attempt to attach the log.
I didn't tell Security Suite to do anything. I'm running the scan again. It will take a couple of hours. Is there a way to get Security Suite to provide a text report that can be attached? I tried to attached a screen print pasted inot a Power Point file but this forum doesn't allow that.
This is my disk configuration:
Disk Partition Type File system Capacity Free Status
0 C: primary NTFS 44GB 16GB Healthy(Active)
0 F: logical NTFS 73GB 73GB Healthy
0 free space in extended partition 73GB
1 E: logical NTFS 29GB 3GB Healthy
1 Unallocated 47GB
2 G: primary NTFS 465GB 245GB Healthy
DIsks 0 and 1 are internal Maxtor IDE drives. Disk 2 is a Seagate Free Agent USB drive. Disk 2 is the one I'm using for back-ups.
Jim
Hi Jim
Thanks for the update. The Malware Bytes log indicates it did not find any malware. However you indicated that the Security Suite did. Please have this clean/remove any infected files, etc that it finds. After cleaning we will need to run another scan to make sure it is all gone.
You can attach a screen shot of this as follows. With the scan results window being the active window, hit Alt+Print Screen. Then bring up MS Paint application and hit Ctrl+V. Save to your desktop as JPG file. Then hit the symbol near the top. Browse to the JPG image and select appropriate size, then insert.
Note that it takes a while before i can view the image since it must first be approved by a forum moderator. This typically can take several hours on the weekend.
Thanks much
Allen
The scan completed and found 1 risk, tracking cookie, and I told it to fix it.
Jim
Hi Jim
Thanks for the update. I know you are a bit reluctant to run the Norton Removal tool so we can give this a try without doing this. However if anything else unusual happens we will still need to take this step.
Let's go ahead and try to reinstall Norton Ghost. Once it installs successfully, please check if it is functioning correctly before running Live Update on it.
Once you have determined it is OK, go ahead and run Live Update and then recheck..
Thanks very much.
Allen
OK, just reinstalling Norton Ghost wasn't such a good idea. Here's what happened:
I ran one more scan that showed no risks.
Then I reinstalled Ghost and got it working fine and did some backups. Then I tried to do a Live Update. That failed. See attached Live_Update_Failure.txt that was copied from the Live Update window. There was also a "Fatal Error" pop-up from the installer itself. Live Update did not suggest a restart but things were a little unstable so I tried a restart and that resulted in msiexec.exe starting and putting logs in C:\WINDOWS\temp like the attached MSIc4589.LOG every 2-3 minutes for two hours. Then it mercifully quit and I was able to uninstall Ghost. That uninstall resulted in an error pop-up saying "C:\Program Files\Norton Ghost\Agent\SpnRegister.dll can not be found. Make sure the file is on target system or installed already." I pressed OK and the uninstall completed successfully,
Then I ran another full scan and it found 1 tracking cookie which it removed.
So, I think I'm back to the state where we can proceed with a more thorough clean up. Ghost is uninstalled. Live Update and Security Suite are still installed and I have the removal tool on my desktop.
I don't really have a problem running the removal tool. I was just hoping it was unnecessary. Also, since Live Update seems to be working for Security Suite, I'd like to keep it on until we remove Security Suite.
Jim
I've continued to search the web and the problem that I just had seems to be the one identified at http://community.norton.com/t5/Other-Norton-Products/Norton-Ghost-14-0-fails-Live-Update-LU1812/td-p/47048. This is a very long thread
There appear to be two different solutions:
1. http://www.symantec.com/norton/support/kb/web_view.jsp?wv_type=public_web&docurl=20090325172513EN
The problem with number 1 is that you have to experience the problem to be able to get at the live update log which means having to uninstall Ghost and is thus long a drawn out process. FWIW I have down loaded the patch zip file, 1250526122jtun_norton_ghost_14.0_sp5_patch.zip.
The problem with number 2 is that the date "...20080415...." implies that it is older than number 1 (...20090325...) and thus may not be current. Further the thread talking about the problem started 12/08/2008 which is 4 months after this solution and thus likely doesn't work.
Jim
There's an extraneous period at the end of the first link in my previous post.
Hi Jim,
Thanks for the updates. You can try either or both of those fixes. Please note that though the original author date of the second one is older than the first one, the date last modified of the second is actually more recent than the first one.
Also at the end of the second one it does indicate that if the procedure fails the next step is the Norton Removal tool.
So I would recommend trying both of these procedures and let's hope it will resolve it.
If not, we can move on to the removal tool.
Thanks
Allen
Thanks for all information , I was reading all threads coz i really faced the same problem but this time with GHOST 15.0 , i really post my problem but i did not get any replay anywayz ... i think now the last option we have is using NORTON REMOVAL but i hate doing this coz i already had Norton Security 2010 installed ... so are u sure u recommended to do this for the last option ...
Tried first option - downloading the patch and running it from start->run. Ran into http://community.norton.com/t5/Other-Norton-Products/Norton-Ghost-14-SP5-Update-Fails-quot-Error-27107-File-Patching/td-p/143841
In that thread the problem seemed to be isolated to 64-bit Vista but I'm having the problem on 32-bit XP. Their problems were resolved by getting a full 14.0.5 iso install image from "Erik Technical Product Manager Symantec Corporation" Any possibility that I could get one for 32-bit Windows XP? It appears that the link to the download was through private messages because the link does not appear in that thread.
It's hard working through these things because it is a 3-4 hour turn around. Install Norton Ghost, try some way to apply patch, it fails, then wait a couple of hours for msiexec.exe to quit trying to complete the update (any way to get it to quit without so many retries?), then reinstall Ghost.
Is there anyway to get sp3 again? That did install correctly. I never installed sp4.
Thanks
Jm