Norton 360 problem with XP

[westpase-he_ac]

After dallying a lot, I am now thinking 'Virus/Trojan'.

After a reboot (not every time, but twice a week), I got the message :

\Documents and Settings\All Users\Application
Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SRTSP\LightningSa­nd.CFD
is corrupted, please run chkdsk...

 As it is a Norton directory, I suspected Norton, but they have been
helpless....

 Then, I do remark :
Norton, Spybot, Adaware do not detect anything wrong.

Hijackthis do not show anything obvious.

 After the chkdsk, the file is GONE. But Norton does not care ...

 (before the chkdsk, the file is not accessible because of the
disk/pointer/directory error)

There are several postes about this file as a virus 'clue', but
nothing really conclusive.

Anyway, the answer to my submission by Seagate was 'Replace the disk'.

I did this, change the system disk and rebuild my whole XP pro
install, and

I stil have the problem here.... (100 € and 1 week of work lost)

If the Norton came with the machine, you should have the ability
to re-install it.I have been dealing with a win32 trojan that running
Malwarebytes in safe mode,and running a boot scan with the
sensitivity at high using Avast5 cleans the machine.
Turning off system restore before the scans seems to do
the most thourough job. Delete the virus chest,
then turn restore back on after the scans.
It is a nasty little bugger that comes with AntivirusPlus,
a totally obnoxious piece of malware crap embedded
in web pages.
MTCW

 

[JeanPaulo]

How many disks do you have? And how does your original disk (the one you
replaced) enter the equation?

I have two units, one 80 Go Seagate IDE, and a second 1To new Seagate
Sata. I wanted to put the XP system on the Sata, but was unable to
make it work, as my main board does not BIOS recognize Sata.
(Asus A7v8x)

The 'old bad' (Sight!) was a 160 Go Maxtor.

Seatools (Dos) does not see any problems, but (XP tool) does not
work at all (can't even read SMART data)

On your first disk, XP is apparently on E:. Do you also have another
instance of XP on C:?

NO, and no multiboot.

Please tell us what is on every single partition you have. So far, all
you have said is that XP is on the "second partition" and data is on the
"third partition." What about the first and fourth partitions? What
about your other disks?

C is just a small FAT partition usable with DOS stuff and the initial
boot

D is the first partition on the 1 To, and contains data (videos....)
and pictures (This is how the disk are recognized, 1 IDE, then 1 Sata)

E is the system disk and programms (and swap file) (80 Go)

F contains my datas (Access, Office, mails, VB, C), but no programs
except some VB homemade (also on the 80 Go)

G to J are data only disks on the 1To

And looking at the other post, it really looks like you did not perform
a proper Clean Install.

I started from a newly formatted partition, and re-installed
everything, starting from XP, then Norton, then all my usual programms
from the 'setup's files. The old XP system was on the discarded disk.

Finally, when you say that you have "all [your] data on the third"
partition, is it possible you have installed programs to that partition
as well? (Although having a separate partition for data *only* is not a
bad idea, programs should always be on the same partition as the OS.)

No. And my backups are usually only made for this partition.

And as I said, except after some freezing (my DVD player was freezing
XP in some instances, needing a 'hard' reboot), I never had any errors
on the 'data' disk, being the current one or the old 'bad' disk. (I am
fully convinced that it was not a disk problem)

Regards, Jean Paulo.

 

[JeanPaulo]

I installed Norton from the Web files. I would rather like it to be a
trojan, but Norton, Adaware, Spybot, Malwarebytes and last Avira did
not find anything in the system. Now Norton is out, and I am waiting.
I had one bad file problem since, but it may be related to a system
freeze rather than the current problem.

Jsut for the fun, Avira found a trojan in a program that Norton never
detected. I am not certain it is not a false positive, and it has been
removed. All full scans are now 'clean'

I never looked at AntivirusPlus at all.

 

[Daave]

How many disks do you have? And how does your original disk (the one
you replaced) enter the equation?

I have two units, one 80 Go Seagate IDE, and a second 1To new Seagate
Sata. I wanted to put the XP system on the Sata, but was unable to
make it work, as my main board does not BIOS recognize Sata.
(Asus A7v8x)

The 'old bad' (Sight!) was a 160 Go Maxtor.

Seatools (Dos) does not see any problems, but (XP tool) does not
work at all (can't even read SMART data)

On your first disk, XP is apparently on E:. Do you also have another
instance of XP on C:?

NO, and no multiboot.

Please tell us what is on every single partition you have. So far,
all you have said is that XP is on the "second partition" and data
is on the "third partition." What about the first and fourth
partitions? What about your other disks?

C is just a small FAT partition usable with DOS stuff and the initial
boot

D is the first partition on the 1 To, and contains data (videos....)
and pictures (This is how the disk are recognized, 1 IDE, then 1 Sata)

E is the system disk and programms (and swap file) (80 Go)

F contains my datas (Access, Office, mails, VB, C), but no programs
except some VB homemade (also on the 80 Go)

G to J are data only disks on the 1To

And looking at the other post, it really looks like you did not
perform a proper Clean Install.

I started from a newly formatted partition, and re-installed
everything, starting from XP, then Norton, then all my usual programms
from the 'setup's files. The old XP system was on the discarded disk.

Finally, when you say that you have "all [your] data on the third"
partition, is it possible you have installed programs to that
partition as well? (Although having a separate partition for data
*only* is not a bad idea, programs should always be on the same
partition as the OS.)

No. And my backups are usually only made for this partition.

And as I said, except after some freezing (my DVD player was freezing
XP in some instances, needing a 'hard' reboot), I never had any errors
on the 'data' disk, being the current one or the old 'bad' disk. (I am
fully convinced that it was not a disk problem)

Regards, Jean Paulo.

I don't think any of your hard drives are bad, either.

Disregard what I said earlier about it looking like you hadn't performed
a Clean Install. I had erroneously assumed you had performed a *second*
clean install, which of course would have meant there would not have
been any references to lightningsand.cfd.

Are you currently having any problems? That one issue with Avira might
have just been a hiccup. Did you happen to look at these pages?:

http://forum.avira.com/wbb/index.php?page=Thread&postID=791899

http://forum.avira.de/wbb/index.php?page=Thread&postID=784685

 

[JeanPaulo]

I don't think any of your hard drives are bad, either.

Disregard what I said earlier about it looking like you hadn't performed
a Clean Install. I had erroneously assumed you had performed a *second*
clean install, which of course would have meant there would not have
been any references to lightningsand.cfd.

Are you currently having any problems? That one issue with Avira might
have just been a hiccup. Did you happen to look at these pages?:

http://forum.avira.com/wbb/index.php?page=Thread&postID=791899

http://forum.avira.de/wbb/index.php?page=Thread&postID=784685

Yes.
I agree that the latest crash may be accidental (as I said, it
followed a 'hard reboot' when the system freezed), and the avira file
could be corrupted because of that.

I am now waiting. As the problem occured irregularly, I will feel it
solved if it does not occurs again the next month....

So for now, thanks for your help, I will reopened a thread if
necessary.

 

[Daave]

Yes.
I agree that the latest crash may be accidental (as I said, it
followed a 'hard reboot' when the system freezed), and the avira file
could be corrupted because of that.

I am now waiting. As the problem occured irregularly, I will feel it
solved if it does not occurs again the next month....

So for now, thanks for your help, I will reopened a thread if
necessary.

YW. Good luck!