Serious problem: Norton analyst remote linked,now desktop blank

I'm typing this while waiting for a call from an analyst about my net book.

 

Earlier this evening I was prompted to upgrade my Norton 360 to version 4.0. It was doing this daily so I upgraded. Then I was told my subscription had expired and I needed to pay to reactivate it. I knew I had around 6 months still to go, so I contacted support. During a live chat, the analyst offered to remote link to my netbook to solve the problem, and as I watched, he did indeed reactivate my subscription.

 

Great I thought - while I was in touch, I thought I'd ask him about a Google Redirect virus which Norton 360 didn't seem to be picking up (when I search Google and select a link - and yes, I'm very careful about what I click! -  I get taken to something completely different). Straight away the analyst ran something calle dNorton Power Eraser which scanned the system but didn't seem to pick anything up. Then he restarted the machine.

 

And now - I have a completely blank desktop. I can see the desktop background but no icons, no task bar at the bottom, nothing. I can see he is still remote linked but no way to communicate with him to find out what is going on. After 20 mins of hanging around, the analyst called me and told me to reboot in safe mode, then restart - clearly he doesn't know what's happened and says there is something wrong with my computer.

 

It seemed to be working before he linked to it!!!! I'm now waiting for a call back as I type, my desktop is still blank (luckily I have a second laptop) and it is now 23:10 at night and I have work the next day.

 

I would appreciate it if someone 'high up' in the Norton center could help here, I'm very worried that a Norton analyst may have just wrecked my netbook.

I'm not particualrly technical but here goes:

 

XP, service pack 3 perhaps??

Norton 360, jsut upgraded to version 4.0. Originally installed from disk, so not a netbook version

Contacted support through Symantec, the site did not resolve my query so I joined the live chat and was passed to "Eugene", and to resolve my query he remote linked. I accessed the Symantec site through Norton and it as all above board, I'm very careful with this sort of thing. But i wish I hadn't let the analyst boter with it now. "Eugene" said he would investigate and call me back half hour ago. It's nearly 11.30pm in UK now and I have work tomorrow, I'd like to go to bed but now I'm worrying about what has happened to my netbook...

I'm typing this while waiting for a call from an analyst about my net book.

 

Earlier this evening I was prompted to upgrade my Norton 360 to version 4.0. It was doing this daily so I upgraded. Then I was told my subscription had expired and I needed to pay to reactivate it. I knew I had around 6 months still to go, so I contacted support. During a live chat, the analyst offered to remote link to my netbook to solve the problem, and as I watched, he did indeed reactivate my subscription.

 

Great I thought - while I was in touch, I thought I'd ask him about a Google Redirect virus which Norton 360 didn't seem to be picking up (when I search Google and select a link - and yes, I'm very careful about what I click! -  I get taken to something completely different). Straight away the analyst ran something calle dNorton Power Eraser which scanned the system but didn't seem to pick anything up. Then he restarted the machine.

 

And now - I have a completely blank desktop. I can see the desktop background but no icons, no task bar at the bottom, nothing. I can see he is still remote linked but no way to communicate with him to find out what is going on. After 20 mins of hanging around, the analyst called me and told me to reboot in safe mode, then restart - clearly he doesn't know what's happened and says there is something wrong with my computer.

 

It seemed to be working before he linked to it!!!! I'm now waiting for a call back as I type, my desktop is still blank (luckily I have a second laptop) and it is now 23:10 at night and I have work the next day.

 

I would appreciate it if someone 'high up' in the Norton center could help here, I'm very worried that a Norton analyst may have just wrecked my netbook.

I can still do CTRL-ALT-DELETE to see Task Manager. I can open programs and run tasks from there, and I can see that my folders, documents and programs are still there - I've simply got no desktop and task bars/menus available to me to access things properly.

 

I'm wondering if the upgraded Norton 360 V4 is the problem, or this Norton Power Eraser which was used by the analyst. But can I uninstall them from task manager?

Hi Sarahbrarian,

 

Whew!  Good to know that you can still boot into the system.  This is probably the result of something that NPE removed.  If you open NPE you should see an option to restore.  Use the option to Review and Undo.

That's it, I have to go to bed now as I have work. Would appreciate any responses or help on offer. Someone at Symantec/Norton needs to tell "Eugene" to cut the remote connection as I have no way of doing it, there is no option for me to stop it from my end so I have no idea if he is still linked, or even still investigating the issue. The netbook is switched off now.

 

I'm seriously worried about the service I've had so far tonight. For someone to say they'll call back, then simply not bother to follow it up within an hour, is not on. I could barely hear the guy over the phone as it is, we had such a bad line - overseas is it? Got to admit, people warned me about Norton products but I've been a long-time user and my family all use it. Not so sure now after the night I've had. Shame really. :(

 

Anyway, hope the forum people on here can help me out! Night all.

Thanks for reply SendOfJive, was about to switch off but I'll try it! I was too busy ranting to spot your post ;)

Hi again sendOfJive - I can't find Norton Power Erarser anywhere. It must be on there because I saw "Eugene" install it and run it, but I'e accessed Programs through task manager and I can only see a folder for Norton360, and a folder for NortonInstaller. Nothing that looks like Power Eraser ineither of these?

It was probably installed to your desktop.  Can you click the Windows button on your keyboard to bring up the Start Menu?

now N360 won't load from task manager:

 

One Click Support runs instead and it says:

"8504,104 appears on Norton 360 Version 4.0"

I am being advised to switch off 'User account control' through control panel, which I couldn't do even if I knew what that meant since I have no means of accessing the control panel.

No, not a lot seemed to be happening. I'll switch off and try again tomorrow - I have to finish for tonight because I'm wiped (at least it looks as though my netbook isn't, ahem).

 

It would be so great if you could check back on this forum tomorrow sometime? I'll take another look and try the Windows button again, and see where we go from there.

 

Thank you for helping me so far, much appreciated.

 

Sarah

In WIndows Task Manager, click New Task.  In the Create New Task dialog box click Browse.  In the Browse dialog box, click Desktop in the left panel.  Do your desktop applications appear in the right-hand pane?  If so, if NPE is there double-click it and follow the instructions given in the post below.

As long as you can start the computer, there is no sense in trying to solve this now, so get some rest.  I am hoping the icons and desktop applications are there in your desktop folder, but just not visible.  Hopefully you will be able to find NPE and undo the previous operation.  Here is the step-by-step to do that:

  1. Click "Review"
  2. Select the Repair Session and click "Next."
  3. Click "Undo."

 

You know, inspite of the number of times we tell Symantec not to use the NPE for anything that looks like a rootkit, sure enough, that's what they try first.  Redirects are most often a bootkit or a TDL3/TDL4.  I would recommend a visit to one of these free malware removal forums for assistance.  They have tools and applications that are unavailable to us.  If you had a rootkit, it still remains, as the NPE will not remove them. Bleeping is very busy and one of the others may be faster.

 

www.bleepingcomputer.com

http://www.geekstogo.com/forum/

http://www.cybertechhelp.com/forums/

http://forums.whatthetech.com/

edited for clarity

Hi Sarahbrarian,

 

I have had a chance to research this a bit.  If the earlier suggestions do not work open Task Manager and click New Task.  In the Create New Task dialog box type explorer.exe.  If Windows Explorer opens and you can see your files and folders check to see if restarting WIndows Explorer has returned the desktop back to normal.  If not, click Search in the toolbar at the top of the window and search for NPE in all files and folders.  If you can find it, run the Undo operation.  If Windows Explorer does not open we will have to try another tactic. 

Hi SOJ:

 

If the user has redirects, whatever you do may also be hampered by the infection.  It would be nice to gain the ability to save important documents, if at all possible.

NPE does not appear in the Control Panel of add/remove programs. When NPE is first run it simply puts the NPE.exe application on the desktop. Note that this is not a shortcut but the actual application which should be about 5 1/2 MB in size. It may when run link to other files on the computer, not sure.

 

However if you are able to bring up a CMD prompt then cd to \windows and look for explorer.exe. Is it there? Then cd to \Documents and Settings\[username]\Desktop. I believe this is the correct path. Do a dir command and see if you see NPE.exe, if so run it and go through the steps SendOfJive outlined.

 

You can also do an sfc /scannow command from the CMD prompt. I don't know if your netbook will have all the files need to do a system file check or not but its worth a try. If you do by chance have the original Windows DVD make sure that is inserted as well.

 

Best wishes.

Allen

Hi Sarahbrarian,

 

Does your second laptop by any chance have the same OS and SP (service pack) on it? If it does, then go to your laptop to the C:\Windows directory and copy explorer.exe to a USB stick or USB hard drive or something.

 

If you find that explorer.exe is missing from your netbook then bring up a CMD prompt as I mentioned in my last post and copy explorer.exe to the C:\Windows directory and reboot your netbook.

 

Please let us know what you find.

 

We're all here rooting for you!

 

Best wishes.

Allen

Hi Sarahbrarian,

 

Not to overwhelm you, but to add a bit to AllenM's suggestion, you should be able to open a command prompt from Task Manager, again by selecting New Task and entering cmd in the box.

Good morning all! Awake and back at work. Just reading through your posts. I'll try the simply suggestions first but then I'm going to come a bit stuck as I am really not that technical - 'cmd' prompts OS and service packs, it all means something but i'm not expert. Just hope I don't make things worse!

 

I don't know if this means much, but I've noticed that 'My Computer' does not have its usual icon, rather a placeholder. The Desktop links can all be seen but none of them work when you try to open something. NPE is not one of those desktop links either. My documents, photo folders, Firefox etc all run from Programs in task manager, so the problem really is with the Desktop somehow. I've been spending sometime sticking photos in my Flickr Pro account in case worst comes to worst!

 

Thanks all, I'll be back...