[1324]

23red,
I uninstalled Combofix, disabled Norton, downloaded ComboFix and ran it in Safe mode with Networking and got the same warnings as before:
ComboFix gives me a warning that the scanners (Norton) are still active but ComboFix shall continue to run. Kindly note this at your own risk. I click ok and nothing happens, no log.

Edited by 1324, 10 December 2013 - 06:59 PM.

[Advertisements]

Hi Rich

Let's try uninstalling and reinstalling Norton. We'll run Combofix in between.

Ok. Do you have your Norton Product license Key available?

There are instructions for obtaining your CD Key and for downloading and running the Norton Removal Tool here so you can get more information, if needed.

Step 1

What I'd like you to do first is download a fresh copy of Norton Internet Security to your Desktop.


• If you do not have the disk, you can download Norton Internet Security from here


• Download Norton (fresh) to your Desktop. Leave it there for installation after running Combofix.


Step 2.

Download the Norton removal tool from here to your Desktop.


• Make sure you have the license key!


Step 3.

Uninstall Norton:

• Click on the Start orb ~> Control Panel ~> Programs and Features
In the list of programs installed, locate the following program:

Norton Internet Security


• Click on Norton to highlight it and click Change/Remove.


• After the programs have been uninstalled, close the Installed Programs window and the Control Panel.


• Reboot the computer.


Step 4.

Norton Removal Tool

Right click on the Norton Removal Tool on your Desktop to Run as Administrator

• Follow the on-screen instructions to remove Norton.

• Reboot your computer


Step 5.

Now let's run Combofix. Do it in regular mode instead of Safe Mode. It should be ok, now. Just right click and delete the copy you have, no need to uninstall it.

**Note: It is important that Combofix is saved to your desktop**

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2

• Close any open browsers.

• Double click combofix.exe and follow the prompts.

• Accept the disclaimer and allow to update if it asks



• ComboFix will then extract it's files before beginning the scan.



• When the scanning begins you will see a window like the image below. Although the program states that the scan typically doesn't take more than 10 minutes there are 50 stages or so that it goes through. On a severely infected machine it can take much longer so please be patient.



• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Important Notes:

1. Do not mouseclick combofix's window while its running. That may cause it to stall

2. Do not "re-run" ComboFix. If you have a problem, reply back for further instructions.

3. If you recieve an error "Illegal operation attempted on a registry key that has been marked for deletion" after running Combofix, please restart the computer. That will cure it.

4. Save the log it produces.

Step 6

Reinstall Norton Internet Security, then update it.

Re-enable your firewall, and WinPatrol.

When you return, please post the Combofix log and let me know how your computer is doing, and how your space is looking.

[23red]

Hi Rich

Let's try uninstalling and reinstalling Norton. We'll run Combofix in between.

Ok. Do you have your Norton Product license Key available?

There are instructions for obtaining your CD Key and for downloading and running the Norton Removal Tool here so you can get more information, if needed.

Step 1

What I'd like you to do first is download a fresh copy of Norton Internet Security to your Desktop.


• If you do not have the disk, you can download Norton Internet Security from here


• Download Norton (fresh) to your Desktop. Leave it there for installation after running Combofix.


Step 2.

Download the Norton removal tool from here to your Desktop.


• Make sure you have the license key!


Step 3.

Uninstall Norton:

• Click on the Start orb ~> Control Panel ~> Programs and Features
In the list of programs installed, locate the following program:

Norton Internet Security


• Click on Norton to highlight it and click Change/Remove.


• After the programs have been uninstalled, close the Installed Programs window and the Control Panel.


• Reboot the computer.


Step 4.

Norton Removal Tool

Right click on the Norton Removal Tool on your Desktop to Run as Administrator

• Follow the on-screen instructions to remove Norton.

• Reboot your computer


Step 5.

Now let's run Combofix. Do it in regular mode instead of Safe Mode. It should be ok, now. Just right click and delete the copy you have, no need to uninstall it.

**Note: It is important that Combofix is saved to your desktop**

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2

• Close any open browsers.

• Double click combofix.exe and follow the prompts.

• Accept the disclaimer and allow to update if it asks



• ComboFix will then extract it's files before beginning the scan.



• When the scanning begins you will see a window like the image below. Although the program states that the scan typically doesn't take more than 10 minutes there are 50 stages or so that it goes through. On a severely infected machine it can take much longer so please be patient.



• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Important Notes:

1. Do not mouseclick combofix's window while its running. That may cause it to stall

2. Do not "re-run" ComboFix. If you have a problem, reply back for further instructions.

3. If you recieve an error "Illegal operation attempted on a registry key that has been marked for deletion" after running Combofix, please restart the computer. That will cure it.

4. Save the log it produces.

Step 6

Reinstall Norton Internet Security, then update it.

Re-enable your firewall, and WinPatrol.

When you return, please post the Combofix log and let me know how your computer is doing, and how your space is looking.

[23red]

Hi Rich
Any problems? Need more time?
Please keep me posted.

Thank you!

[1324]

23red,
I do not know my Norton Product license Key and hesitate to uninstall and reinstall.
Rich

[23red]

Hi Rich
This may help: Look here or here

[1324]

23red,
ok i'll try that tomorrow, maybe.
thanks,
Rich

[23red]

So you are aware: Once you've got your key and you do run the removal tool and then when it's finished, Norton opens a window with links for reinstalling the product. Save the link on your Desktop for later.
To do that click File ~> Send then click on Shortcut to Desktop and the link will be waiting for you after
That makes it much easier!

[1324]

23red,
This seems to get more daunting with every reply. I'll try on the weekend. I'm very nervous.
I'll keep you posted.
Thanks,
Rich

[23red]

It's ok! Nervous is normal. When you're ready. It's not so bad as it sounds, really!
How is your space doing?

[23red]

Hi Rich


Let me explain why I've requested this line of action:

The main problem seen at this point is the accumulation of what appear to be data files.
Reason unknown to date and nothing has shown why nor put an end to the accumulation.
Also, something stopped CCleaner from working. It should work.
Eraser will not erase. It should also work.
Norton should turn off and Combofix should run with no problem.
Malware can also prevent programs from running or running properly ~ Including Antivirus programs. Malware can also damage Antivirus programs.

Norton is what it is..it could have very well gotten somehow corrupted to make those unknown data files. A borked Norton could also be the reason CCleaner or Eraser won't work. An update could have gone wrong. The uninstallation and reinstallation will ensure a clean running Norton.

You are supposed to be in control of your computer, not it or its programs in control of you. Which also means, CCleaner should run, so should Eraser if chosen, so should Norton stop if requested to let Combofix run.
Norton is the one constant in all this. It's one of the main items that never changed through all we've checked. And the extra files still come. Eraser and CCleaner still will not run.

Combofix with Norton uninstalled would be about the only way we know to see what the heck may be making all the trouble. Either Norton corrupted somehow or something's hiding or tweaked a setting.

Combofix is big guns used as a last resort or unless specifically needed.. Not a toy and not prescribed lightly. It has amazing merits and the fact that Norton won't let it run is troubling. It is also one tool used in zeroaccess infections. Even though we've seen no evidence of this, with Norton out of the way Combofix would pick it up if it is there.

After all we've been thru, I want to send you home happy as you were before you got reinfected!
To be sure, it is tedious. At the very least, you'll have a clean fresh Antivirus install and hopefully the accumulation of data files will have stopped, no malware, CCleaner able to run and Norton back at work.

I would not ask if I did not think it necessary

Hope this helps
And nervous is good, it keeps us careful Print the instructions out for yourself. That will help

If and when you're able to start please turn off WinPatrol before you begin.
Keep me posted

[1324]

23 red,
I found a product key and a serial #. Is one of those the product license key?
Also, ihave plenty of free space - 638 free out of 681
Thanks,
Rich

[23red]

Hi Rich
Information is here. Looks as though yes, that would be what you need. Excellent

Please proceed. We'll freshen your Norton install and let Combofix do it's thing.
Remember to disable WinPatrol before you start

[1324]

23red,
I used the Norton removal tool and removed Norton and rebooted my computer. I downloaded combo fix and ran it. It extracts all the files but the scanning never begins (blue background, white lettering). I do not get any error messages about anti-virus software. I have waited 30 minutes for it to begin. I am not sure what I am doing wrong or what to do next. I will try to check back more regularly it has been a "difficult" Christmas for our family.
Thanks, Rich

[23red]

Hi Rich
Let's try this one more time. Malwarebytes may be preventing Combofix from running completely. Let's disable it and try again. To do that:

• Right click the mbam blue symbol in your systray (bottom right hand corner of your screen).

• Uncheck start with windows.

• Right click the symbol again and click exit.

Then follow the instructions in this post, Step 5 with a fresh copy of ComboFix.
Let me know how it goes
Thank you!

[1324]

23red,
I don't believe I have any anti-virus software on my computer, nothing in the systray, nothing when I check programs and features. The only "protection" I have running is Windows Firewall. Is there some anti-virus software that I can't see?
Thanks,
Rich