Norton Internet Security - BIG problems - please help!

PigginSkint

A few days ago I got a message from Norton saying a free upgrade was available (to the 2009 version). Cannot get the damn thing to install! Spent 7 hours last night in a live chat with 4 different analysts on the Symantec site. Had to spend money for a major virus clean-up. I thought that I was now virus free but as this upgrade will still not install, it seems to suggest there is still a problem! To make things worse, I have been trying all evening to connect to another live chat to sort it out - but I can't seem to connect.

So here I am, having spent good money for Internet Security and currently I have none (the old version had to be remove to make room for the new one) and a for virus clean-up and I think I still have one.

Any help gratefully received!

aliEnRIK

Download MALWAREBYTES
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
UPDATE and run a QUICK scan (just for now, run a FULL scan later)
Post the LOG here (Chop into parts if need be)

DatabaseError

money spent on norton products is no longer 'good money', take rik's advice

Donnie

PigginSkint wrote: »

A few days ago I got a message from Norton saying a free upgrade was available (to the 2009 version). Cannot get the damn thing to install! Spent 7 hours last night in a live chat with 4 different analysts on the Symantec site. Had to spend money for a major virus clean-up. I thought that I was now virus free but as this upgrade will still not install, it seems to suggest there is still a problem! To make things worse, I have been trying all evening to connect to another live chat to sort it out - but I can't seem to connect.

So here I am, having spent good money for Internet Security and currently I have none (the old version had to be remove to make room for the new one) and a for virus clean-up and I think I still have one.

Any help gratefully received!

You spent money on a "major virus clean up".....before asking here?? :eek: You paid for NIS??

*Dumbfounded*

PigginSkint

aliEnRIK wrote: »

Download MALWAREBYTES
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
UPDATE and run a QUICK scan (just for now, run a FULL scan later)
Post the LOG here (Chop into parts if need be)

Thanks for the help. Just running scan now.

PigginSkint

Donnie wrote: »

You spent money on a "major virus clean up".....before asking here?? :eek: You paid for NIS??

*Dumbfounded*

It seemed a good idea at the time......I was already online in a live chat.:o

I will know better next time! Feeling thoroughly ashamed of myself now!

PigginSkint

tonyhague wrote: »

money spent on norton products is no longer 'good money', take rik's advice

I thought I was doing the right thing! I consider myself reprimanded!

PigginSkint

Please see below for scan log:

Malwarebytes' Anti-Malware 1.30
Database version: 1354
Windows 5.1.2600 Service Pack 3
01/11/2008 21:08:37
mbam-log-2008-11-01 (21-08-25).txt
Scan type: Quick Scan
Objects scanned: 57349
Time elapsed: 12 minute(s), 26 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 38
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 10
Files Infected: 9
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\wasfsd.creationnotifier (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\wasfsd.creationnotifier.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\!!2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\!!4567ab12-a884-4ca6-b739-cedb12fef096} (Rogue.PersonalAntiSpy) -> No action taken.
HKEY_CLASSES_ROOT\Interface\!!741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{abcd4567-4d73-43e9-85e5-53a2dbd95422} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{abcd4567-d8e8-4df1-a3ea-d0aa72f42622} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\!!_clsid_washellexecutecheck} (Rogue.PersonalAntiSpy) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{abcd4567-76b5-4bc7-aac5-396d70925b22} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\!!147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\!!9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\!!4567ab12-ae24-4fd6-b479-e2b464f32da6} (Rogue.PersonalAntiSpy) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{abcd4567-7437-43ef-ab74-4ab1d3a37422} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\!!1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\!!56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\!!56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\!!1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wasfsd (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wasfsd (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wasfsd (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adwareprotector (Rogue.Ad-WarePro) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> No action taken.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\PopSwatr (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\PopSwatr\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> No action taken.
Files Infected:
C:\WINDOWS\system32\drivers\wasfsd.sys (Trojan.FakeAlert) -> No action taken.
C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\PopSwatr\History\allowed (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\PopSwatr\History\notallow (Adware.MyWebSearch) -> No action taken.
C:\Program Files\FunWebProducts\ScreenSaver\Images\00C5981B.urr (Adware.MyWebSearch) -> No action taken.
C:\WINDOWS\system32\stera.exe (Rogue.WinAntivirus) -> No action taken.

aliEnRIK

jesus!
That IS a lot!
Did you remove all the infected files and folders?
If not then rescan and do that

Uninstall Norton using the norton removal tool
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

Then we need to look at a firewall and anti virus package
I personally recommened AVIRA anti virus ~
http://www.download.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html

Or you can also use AVAST or AVG

As for firewalls theres COMODO, ZONEALARM and SUNBELT
Im recommending sunbelt ~
http://www.filehippo.com/download_sunbelt_personal_firewall/

MAKE SURE NORTON IS COMPLETELY GONE BEFORE INSTALLING EITHER

PigginSkint

aliEnRIK wrote: »

jesus!
That IS a lot!
Did you remove all the infected files and folders?
If not then rescan and do that

Uninstall Norton using the norton removal tool
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

Then we need to look at a firewall and anti virus package
I personally recommened AVIRA anti virus ~
http://www.download.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html

Or you can also use AVAST or AVG

As for firewalls theres COMODO, ZONEALARM and SUNBELT
Im recommending sunbelt ~
http://www.filehippo.com/download_sunbelt_personal_firewall/

MAKE SURE NORTON IS COMPLETELY GONE BEFORE INSTALLING EITHER

I haven't deleted them all yet but I have still got it open - wanted to check it was O.K. to do before I did it. So I can just do that now.

I have got an existing subscription with Norton which does not expire until January. I would rather I got my money's worth unless you really think I shouldn't!

I will see what happens when I delete these files and reboot first.

Thanks for your help.

Reluctant_spender

You have Nortons and you are infected - a free product will remove it for you.

I think Nortons has done enough.

When you have fixed then post back the resultant log.