Norton Issue after Aborted Windows Update and System Restore

Norton Security | Norton Internet Security
1

I'm running Windows Vista Home Premium, Version 6.0. Build 6001, Service Pack 1; Firefox 3.5.7; and NIS 17.5.0.127.

 

So earlier today, I attempted to run Windows Update in order to download and install three updates: Security Update for WIndows Vista (KB971468), System Update Readiness Tool for Windows Vista (KB947821) [January 2010], and Windows Malicious Software Removal Tool-February 2010 (KB890830).

 

While attempting to download and install in the Windows Update Screen, the program froze. Hitting stop installation did nothing, Ctrl + Alt + Del wouldn't bring up the task manager, and I was unable to close Windows Update. I was able to do a restart from the Start Menu, though, so I did that. (In restrospect, this was probably a bad idea.)

 

When the computer rebooted it got stuck on the "Installing Updates 1 of 3; Please do not turn off your computer," screen. After a few hours of it doing nothing, I powered off the computer, rebooted into safe mode, and ran system restore. The restore point I used was just prior to Windows Update.

 

When the computer rebooted, Norton came up with a one-click window and an error message that I didn't write down. The icon in my taskbar and the regular Norton window said that my computer was insecure. I followed all the reccommended fixes, and it went back to secure.

 

The error message in my history states:

 

Error ID: 53

Module ID: 3047

Error Code: 0x00000001

Norton Internet Security cannot load because your virus protection updates are not valid. Please use Live Update to download and install new virus protection updates.

 

I then ran a MalwareBytes quick scan (full system scan takes forever), which came up clean.

 

However, every time Firefox is open, Intrusion Prevention is blocking repeated Portscan attempts, and then immediately sending IPS Detection Statistical Submissions after each one. They're occurring several times a minute. The exact message in my history is (repeated over and over again, with only the local port different):

Risk Name: Portscan

Attacking Computer: 192.168.1.1,53

Network traffic from: 192.168.1.1 matches the signature of a known attack. The attack was resulted from System.

 

I do plan on running a full system scan with MalwareBytes, but that will take a few hours.

2

Hi LisaAF,


I think, your computer reverted back to a point called "Last Known Good Configuration", where Norton program won't be having the latest virus definitions. You may need to update those definitions first. Try the solution from the following Symantec Article:

http://www.symantec.com/norton/support/kb/web_view.jsp?wv_type=public_web&docurl=20090922001042EN


Yogesh

3

Yeah, that was the error that I got in the one-click window when I rebooted, and I did run Intelligent Updater.

 

It was after that that I began to get the repeated Portscan blocks under Intrusion Prevention.

 

I don't know if I was actually being attacked every time I opened Firefox or if something got messed up and Norton is thinking that normal traffic matches attack signatures.

 

They appear to have stopped right now, but I got them while using Firefox two distinct times. The first time was around 4pm EST, and Norton blocked about thirty attempts in fifteen minutes the first time. The second time was around 5:30pm EST, and Norton blocked four attempts in one minute.

 

Prior to this burst, I only had one or two blocked attempts in my history--over a span of four months.

4

Lisa and Yogesh,

 

I'm still using NIS-2009, so my comments may not apply at all to NIS-2010 ...

 

In NIS-2009,  it was necessary to turn off Norton Product Tamper Protection before using System Restore. In NIS-09, the path is:  Computer - Settings - Miscellaneous Settings -  Product Security,

then turn it back on after a successful restore.

 

If this applies to NIS-2010, keep it in mind the next time you have to do a System Restore.