Firewall ON... Well, "No!"

[Kenneth]

Did you *ever* have any Norton Anti-Virus installed, and then uninstalled
it?
Tom

Hi Tom,

I simply do not know... The system is my wife's notebook. It
is a Dell and may have had NAV installed when she got the
system. In any case, it definitely does not have any Norton
or Symantec product on it now.

Thanks for any further thoughts,

 

[R. McCarty]

You have "Remnants" left from a trial version. You need to do a few
items to fully purge it from the PC.
1.) Check Add/Remove programs for Symantec WMI, Live Update
and Live Reg - If found uninstall
2.) Full system search for string Symantec - likely will return 2 or
more folders, remove all
3.) Device Manager - Non Plug & Play category check for drivers
that begin with the characters Sym----
4.) From the Services Map in the Registry you'll need to find and
remove the SymEvent service and a few others.
5.) Using a tool called RegSeeker, Find and remove all entries in the
Registry using search string
a.) Syman
b.) Norto
This is a 7.0 on the 10 point "Shoot-Yourself-in-the-Foot" PC risk scale.
Best done only if you can image the System partition before starting. I've
done this process 100+ times but it is somewhat risky and tedious.

 

[Kenneth]

Howdy,

Please see my comments inline...

You have "Remnants" left from a trial version. You need to do a few
items to fully purge it from the PC.
1.) Check Add/Remove programs for Symantec WMI, Live Update
and Live Reg - If found uninstall

None appear...

2.) Full system search for string Symantec - likely will return 2 or
more folders, remove all

Deleted Symantec Shared folder

3.) Device Manager - Non Plug & Play category check for drivers
that begin with the characters Sym----

I cannot find anything in Device Manager that looks like
"Non Plug & Play." I dropped everything down, with no luck.

4.) From the Services Map in the Registry you'll need to find and
remove the SymEvent service and a few others.

I do not know how to locate the "Services Map" and so tried
to search for the strings "sym" and "symantec." I removed
all Symantec hits that allowed me to do so, but at least 6
give me "Unable to delete all specified values."

5.) Using a tool called RegSeeker, Find and remove all entries in the
Registry using search string
a.) Syman
b.) Norto

I launched RegSeeker, and did the two "find & remove"
cycles. I then rebooted, opened Security Center, and had the
same problem as before.

Next, I ran regedit and searched for "Syman" yet again to
see if RegSeeker failed to remove those that I could not
remove manually.

There, I had a bit of a surprise: I found two very
suspicious entries under a key for "Security Center." One
was for Norton, and the other Symantec. I did not remember
seeing either before during my manual searches, but I
assumed that they were among those that I could not remove.
I tried to delete them, and, to my surprise, both deleted
successfully.

I continued the searches, and still found several Symantec
entries that I cannot delete (and that RegSeeker could not
delete.)

I then rebooted, and looked in Security Center:

The result is the same - (Well, almost...<g>) When I launch
it, I see either of two messages - Sometimes, it tells me
that I have more than one firewall running and warns me that
this could cause problems. On other occasions, it tells me
that "Norton Internet Worm Protection" is running.

I will also add that for the first time, I dropped down the
"Virus Protection" tab in Security Center. It tells me that
I have "more than one antivirus program" on the system and
at least one reports that it is up-to-date.

I have only one AV app on the box, and that is Kaspersky...

This is a 7.0 on the 10 point "Shoot-Yourself-in-the-Foot" PC risk scale.
Best done only if you can image the System partition before starting. I've
done this process 100+ times but it is somewhat risky and tedious.

I appreciate your concern... I generate images, and pipe
them to a remote machine before I tie my shoes.

Having heard all this, might you have other thoughts?

Either way, please accept my very sincere thanks for your
fine suggestions,

 

[R. McCarty]

I made a few omissions on the steps in the previous reply.

For locating the drivers in the Non-Plug and Play category, you
must add a couple of System Environment variables and toggle
a setting in the Device Manager display. You need to add the
following two System level Environment variables
DevMgr_Show_NonPresent_Devices
DeviMgr_Show_Details
and set each one's value = 1
When using Device Manager, Click View and tic/check the
option that says "Show Hidden Devices". Once these steps are
done you'll likely see a number of "Phantom" entries appear.
Phantom entries appear in diminished tone or grayed out. They
are safe to remove from all categories - Except System & Sounds.
Environment Variables are accessible from My Computer, Properties,
System, Advanced (TAB) -button in 3rd sub category.

The Service map is an alphabetical listing in the registry.It is found
at::
HKLM_System\CurrentControlSet\Services
Scrolling down the list you'll most likely find Sym..... entries, such
as SymEvent. You can either set it's "Start" value = 4 (Disabled)
or remove the entire entry.

- On the Risk Scale warning, it's hard to know the skill level of the
poster and the steps to remove Symantec are fairly complicated.

 

[Kenneth]

Hello again,

Please see my comments inline...

I made a few omissions on the steps in the previous reply.

For locating the drivers in the Non-Plug and Play category, you
must add a couple of System Environment variables and toggle
a setting in the Device Manager display. You need to add the
following two System level Environment variables
DevMgr_Show_NonPresent_Devices
DeviMgr_Show_Details
and set each one's value = 1
When using Device Manager, Click View and tic/check the
option that says "Show Hidden Devices". Once these steps are
done you'll likely see a number of "Phantom" entries appear.
Phantom entries appear in diminished tone or grayed out. They
are safe to remove from all categories - Except System & Sounds.
Environment Variables are accessible from My Computer, Properties,
System, Advanced (TAB) -button in 3rd sub category.

These steps revealed a ton of Sym*, and NAV* entries. I
removed 'em all.

The Service map is an alphabetical listing in the registry.It is found
at::
HKLM_System\CurrentControlSet\Services
Scrolling down the list you'll most likely find Sym..... entries, such
as SymEvent. You can either set it's "Start" value = 4 (Disabled)
or remove the entire entry.

I found, and removed a "Norton Antivirus Service" entry.

After all this, I rebooted.

When I looked in Security Center, the problem remains...! It
still displays that "Norton Internet Worm Protection" is ON.

- On the Risk Scale warning, it's hard to know the skill level of the
poster and the steps to remove Symantec are fairly complicated.

I have no concern about risk issues because I have a very
recent image. But beyond that, your instructions have been
perfectly clear.

I am most appreciative of your suggestions, and (obviously)
wonder if there might be a next step you would suggest.

Also, I live in the woods, and have access to tools. Are we
at the point of "Driving a stake into its heart?"

Thanks for any further thoughts,

 

[R. McCarty]

Sounds like you've made good progress, but Symantec is about as
resistant to software death/removal as AOL. That "Worm Protection"
is a relatively new feature. I left/abandoned all Symantec/Norton
software a couple of years ago, so I may be unfamiliar with steps to
get rid of that feature. At this stage you might want to use one of the
"Removal" tools that Symantec provides. Their names vary according
to the product installed (SymNRT, RNIS). Unfortunately, the way
that Norton gets installed it uses a large number of CSLIDs and this
is probably where the remnant is embedded. I would go to Symantec's
support site and do a search for "Removal Tools". Otherwise, I'd have
to do a Remote Assistance onto your machine to check for items that
might have been missed. I wouldn't do a re-install at this point, unless
you've reached your limit with removal work. It seems like you are
close to resolution - but the remaining issue(s) sounds like Symantec's
replacement of Security Center with it's own monitoring tool. (WMI).

 

[Kenneth]

On Tue, 18 Jul 2006 06:40:09 -0400, "R. McCarty"

Ooops... One more thing...

DevMgr_Show_NonPresent_Devices
DeviMgr_Show_Details

^

but I assumed that to be:

DevMgr_Show_NonPresent_Devices
DevMgr_Show_Details

and entered the lines in that way.

Did I have it right?

Sincere thanks once again,

 

[Kenneth]

Sounds like you've made good progress, but Symantec is about as
resistant to software death/removal as AOL. That "Worm Protection"
is a relatively new feature. I left/abandoned all Symantec/Norton
software a couple of years ago, so I may be unfamiliar with steps to
get rid of that feature. At this stage you might want to use one of the
"Removal" tools that Symantec provides. Their names vary according
to the product installed (SymNRT, RNIS). Unfortunately, the way
that Norton gets installed it uses a large number of CSLIDs and this
is probably where the remnant is embedded. I would go to Symantec's
support site and do a search for "Removal Tools". Otherwise, I'd have
to do a Remote Assistance onto your machine to check for items that
might have been missed. I wouldn't do a re-install at this point, unless
you've reached your limit with removal work. It seems like you are
close to resolution - but the remaining issue(s) sounds like Symantec's
replacement of Security Center with it's own monitoring tool. (WMI).

Hi again,

I had run a suggested Symantec "Removal Tool" but until
reading your comments above did not know that there was more
than one... I will check further, and thank you yet again
for your most generous help on this.

All the best,

 

[Kenneth]

Sounds like you've made good progress, but Symantec is about as
resistant to software death/removal as AOL. That "Worm Protection"
is a relatively new feature. I left/abandoned all Symantec/Norton
software a couple of years ago, so I may be unfamiliar with steps to
get rid of that feature. At this stage you might want to use one of the
"Removal" tools that Symantec provides. Their names vary according
to the product installed (SymNRT, RNIS). Unfortunately, the way
that Norton gets installed it uses a large number of CSLIDs and this
is probably where the remnant is embedded. I would go to Symantec's
support site and do a search for "Removal Tools". Otherwise, I'd have
to do a Remote Assistance onto your machine to check for items that
might have been missed. I wouldn't do a re-install at this point, unless
you've reached your limit with removal work. It seems like you are
close to resolution - but the remaining issue(s) sounds like Symantec's
replacement of Security Center with it's own monitoring tool. (WMI).

Hello again,

You're gonna love this...

Using live chat, I eventually got the link from Symantec for
the tool that would "remove all traces."

But, I cannot run the tool because it requires that I
install an ActiveX Control, and (you guessed it) that is
blocked by my firewall though, of course, I have not
firewall running.

Might you have any further thoughts...?

Thanks again,

 

[R. McCarty]

Based on the website, you can temporarily place the domain in your
"Trusted Zone" which effectively lowers the security so the ActiveX
component should install without prompting. Once you've gotten the
add-in, then remove the site/domain from the Trusted Zone.
IE, Tools, Internet Options, Security, Trusted Sites (Selected), Sites
Button - add domain and uncheck "Require Server Verification...."
(Example: http://*.symantec.com)
Reverse these steps after you've completed the removal process.

 

[Kenneth]

Based on the website, you can temporarily place the domain in your
"Trusted Zone" which effectively lowers the security so the ActiveX
component should install without prompting. Once you've gotten the
add-in, then remove the site/domain from the Trusted Zone.
IE, Tools, Internet Options, Security, Trusted Sites (Selected), Sites
Button - add domain and uncheck "Require Server Verification...."
(Example: http://*.symantec.com)
Reverse these steps after you've completed the removal process.

Hello again,

Thus far, I have not been able to get the Trusted Zone thing
to work (though I suspect that I see the reason now. I
entered the URL of the particular page, rather than using
domain itself.) I will try that again shortly (the system is
in another building.)

But, whether that succeeds or not, I do have another
approach:

Symantec gave me a link to a page that will allow me to
download the tool to run locally. When I tried the link, the
page tells me that their KB server is down...

So, we shall see...

Thanks again,

 

[Kenneth]

Based on the website, you can temporarily place the domain in your
"Trusted Zone" which effectively lowers the security so the ActiveX
component should install without prompting. Once you've gotten the
add-in, then remove the site/domain from the Trusted Zone.
IE, Tools, Internet Options, Security, Trusted Sites (Selected), Sites
Button - add domain and uncheck "Require Server Verification...."
(Example: http://*.symantec.com)
Reverse these steps after you've completed the removal process.

Hello again,

I finally succeeded in getting the three cleanup files. I
ran them in the appropriate order, rebooted, and the problem
remains: Security Center still tells me that Norton Internet
Worm protection is ON.

Whew...

 

[Kenneth]

Based on the website, you can temporarily place the domain in your
"Trusted Zone" which effectively lowers the security so the ActiveX
component should install without prompting. Once you've gotten the
add-in, then remove the site/domain from the Trusted Zone.
IE, Tools, Internet Options, Security, Trusted Sites (Selected), Sites
Button - add domain and uncheck "Require Server Verification...."
(Example: http://*.symantec.com)
Reverse these steps after you've completed the removal process.

Hello again,

You're gonna love this...

Using live chat, I eventually got the link from Symantec for
the tool that would "remove all traces."

But, I cannot run the tool because it requires that I
install an ActiveX Control, and (you guessed it) that is
blocked by my firewall though, of course, I have not
firewall running.

Might you have any further thoughts...?

Thanks again,

Hi again,

Right now, I can find only one mention of Symantec in the
Registry. It is at:

HKLM\Software\Microsoft\Security Center\Monitoring\Symantec
AntiVirus.

When I try to delete it, it seems to be gone.

Then, when I re-boot, it is back in the Registry.

Might that be my problem? And if so, how can I permanently
delete it?

Sincere thanks, as before,

 

[Tom Willett]

Also search your registry for Norton.

 

[Kenneth]

Also search your registry for Norton.

Howdy,

I have no Norton entries...

Thanks for any further thoughts,

 

[BuckRabbit]

Reformat and do a clean install.

That's what I'd do, in fact that's exactly what I did last night!

 

[Kelly]

What a mess you have going on there.
Would really like to have that setup saved.
Good luck and keep us posted.

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm

 

[Kenneth]

What a mess you have going on there.
Would really like to have that setup saved.
Good luck and keep us posted.

Hi Kelly,

I still have the problem, but...

Please forgive me (and it may just be too early in the
morning) but I don't know what you mean by "Would really
like to have that setup saved."

Can you say a bit more...?

 

[Kelly]

Hi Kenneth,

Most times when this happens, Norton gives the message that you don't have
the necessary rights, etc to disable or enable. Just another part of their
mess. I would suggest using the Norton uninstaller and start over.
ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SymNRT.exe

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm

 

[Kenneth]

Hi Kenneth,

Most times when this happens, Norton gives the message that you don't have
the necessary rights, etc to disable or enable. Just another part of their
mess. I would suggest using the Norton uninstaller and start over.
ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SymNRT.exe

Hi Kelly,

I have used SymNRT.exe more than once in this process. In
addition, I have used two other removal tools that Symantec
provided.

Nothing worked...

Thanks for any further thoughts you might have,