[needafix]

Is this image a legitimate Norton warning?

http://forums.techguy.org/album.php?albumid=66

(upload as attachment isn't working)

I'm a bit suspicious because at the time I had all of Nortons start up files and *.vxd's disabled.

If this is legit, Norton is running invisibly and cannot be shut off. I don't like that since it could lead to problems diagnosing things.

[Byteman]

Hi,

Norton will usually put up an alert about a .vbs script, such as SilentRunners.vbs uses..... when we were using SilentRunners.vbs often, our canned replies always included a warning note to ALLOW the script, not block it, since that would block what we were trying to run.

Here's a link to another post about the same type of alert, worded exactly the same:

http://forums.spybot.info/showthread.php?t=765&page=2


**What version of Windows are you using?

.

[TechOutsider]

what version of norton?

[needafix]

It is the upgraded version of Norton 2005 that expires in 2009.

I renamed all Norton and Symantec folders and renamed navui.nsi, nmain.exe, Navw32.exe.

Now I can run Silentrunners without a looong delay.

That is what I don't like, everything I do is delayed or in other terms appears to be "hanging up."

I am trying to diagnose the "hang ups" and it turns out that it was the secret and invisible Norton doing it.

If I want it off that means off, not running behind my back while it or any of its .dll's are running invisibly, never appearing in any process viewer while I am trying to diagnose computer issues.

As far as that goes it behaves exactly like spyware reinstalling itself because there is no difference in that and turning off a program but yet it is not off and running invisibly all the time.

With behavior like that, I think Norton is just giving the malware industry a method of running invisibly and all they have to do is pick apart Norton to find out how its done and duplicate it.

[needafix]

I still would like to know why Norton is running invisibly and running against the users wishes (at least my wishes anyway) an especially after disabling every .vxd, .exe and .dll that Norton uses.

What is the difference between that and some form of clandestine malware?

If Norton is not purposely programmed to behave in this fashion then that malicious script warning is a fake.

Which one is it?

[Byteman]

Hi,
The alert snapshot you sent looks legit, and worded exactly the same as it should be, so it looks like there is a Norton program installed...perhaps it came with the computer.

Probably what you did did not fully turn it off, the Services control the program and what is enabled....if it's on an XP type computer...

I am not sure you will have much success removing it all unless you name the files back to what they were....I can't say, but we can try.


go to Click here to download HJTsetup.exe

• On that page, click the icon
• at lower right , and follow the prompts to get the installer version
• Save HJTsetup.exe to your desktop.
• Double click on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
• Click on the Do a system scan and save a log file button. It will scan and then save the log and then the log will open in Notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Paste the log in your next reply.
• Don't use the Analyse This button, its findings are dangerous if misinterpreted.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Don't forget this second part:

_ _ _ _
Please also do this:

• Open Hijack This and click on the "Open the Misc Tools section" button.
• Click on the "Open Uninstall Manager" button.
• Click the "Save List" button. After you click the "Save List" button, you will be asked where to save the file. Pick a place to save it then the list should open in notepad.
• Copy and paste that list here in your reply