[Resolved] Search Settings 1.2 reported by CA as Trojan Horse

Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 2/16/2009 3:04:27 PM for strings: ; 'norton' ; 'symantec' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E39D1C81-7E76-4d84-9F25-E2CC76EC050B}] "LocalService"="Symantec Core LC" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\LocalServer32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0] @="Symantec Core LC Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\0\win32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\HELPDIR] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\"="" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\Log\\"="1" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\"="1" "C:\\Program Files\\Norton Internet Security Professional\\"="" "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\"="" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\Portal\\"="1" "C:\\Program Files\\Norton AntiVirus\\Quarantine\\Incoming\\"="1" "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\Norton AntiVirus\\"="" "C:\\Program Files\\Common Files\\Symantec Shared\\IDSDefs\\"="1" "C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests\\"="1" "C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Common Client\\"="1" "C:\\Program Files\\Norton Internet Security\\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E26975905FAE44A83FCFAEC0303A0E] "00000000000000000000000000000000"="C:\\Program Files\\Norton Internet Security Professional\\nisum.dat" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4799D30A4DDA954429D8D4ED011517F9] "00000000000000000000000000000000"="C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\ScrAuth.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBAE3AAB8D0042547990AF991553C16B] "00000000000000000000000000000000"="C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\ScrBlock.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec] [HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\CCPD-LC] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"="Symantec Network Driver Update Notification" "C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"="Symantec ALUNotify Module" "C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"="LiveUpdate Wizard" "C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"="LiveUpdate Wizard" [HKEY_USERS\.DEFAULT\Software\Symantec] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton AntiVirus] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities\Norton UnErase] [HKEY_USERS\.DEFAULT\Software\Symantec\Norton Utilities\Norton UnErase\StateIcons] [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Office\Outlook\Addins\MsouPlug.OutlookPlug] "FriendlyName"="Norton AntiSpam Outlook Plugin" "Description"="Norton AntiSpam Outlook Plugin" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\RAS Autodial\Addresses\liveupdate.symantecliveupdate.com] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] "b"="C:\\Documents and Settings\\Susan Trapnell\\Desktop\\Norton_Removal_Tool.exe" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "f"="C:\\Documents and Settings\\Susan Trapnell\\Desktop\\Norton_Removal_Tool.exe" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus] [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Documents and Settings\\Susan Trapnell\\Desktop\\Norton_Removal_Tool.exe"="Norton Removal Tool" "C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zSE2.tmp\\SymNRT.exe"="Symantec Removal Utility" "C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS1.tmp\\SymNRT.exe"="Symantec Removal Utility" [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"="Symantec Network Driver Update Notification" "C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"="Symantec ALUNotify Module" "C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"="LiveUpdate Wizard" "C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"="LiveUpdate Wizard" [HKEY_USERS\S-1-5-18\Software\Symantec] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton AntiVirus] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities\Norton UnErase] [HKEY_USERS\S-1-5-18\Software\Symantec\Norton Utilities\Norton UnErase\StateIcons] ; End Of The Log…

Did you re-boot your computer before running RegSearch?

If not, please re-boot and then run it, then post me the log.

Registry settings are not removed until a re-boot, so the removal tool may have done more than appears.

If you did do a re-boot before running Reg Search, then follow the instructions below.

Before we remove Norton's remnants, I just need to ask you if you have any other Symantec products on your computer.

Symantec use a number of "core" modules, which are common to other products than just their AV and protection software. I don't want to remove something that might cause problems.

It's not unusual for Symantec to be a PITA to clean out, the programme is IMO a bug riddled pile of ****, which I'm more than happy to remove from your machine.

So

If you don't have any other Symantec products, please do the following.

First

Make a backup of your Registry with ERUNT.

• Double click ERUNT to launch the programme.
• You'll get a little pop-up box telling you about ERUNT, click OK
• The next box will ask you where you want to store your backup, accept the default location and click OK
• You'll be told the folder doesn't exist and asked to create it, click Yes
• ERUNT will create a backup, when finished it will notify you, click OK to exit.

Once you've created a backup

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Files
C:\Program Files\Symantec
C:\Documents and Settings\Susan Trapnell\Desktop\Norton_Removal_Tool.exe
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Norton Internet Security Professional

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E39D1C81-7E76-4d84-9F25-E2CC76EC050B}]
"LocalService"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\LocalServer32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\0\win32]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\HELPDIR]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\"=-
"C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\Log\\"=-
"C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton Internet Security Professional\\"=-
"C:\\Program Files\\Norton Internet Security Professional\\"=-
"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\"=-
"C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Norton AntiVirus\\"=-
"C:\\Program Files\\Norton AntiVirus\\Quarantine\\"=-
"C:\\Program Files\\Norton AntiVirus\\Quarantine\\Portal\\"=-
"C:\\Program Files\\Norton AntiVirus\\Quarantine\\Incoming\\"=-
"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Norton Internet Security Professional\\Norton AntiVirus\\"=-
"C:\\Program Files\\Common Files\\Symantec Shared\\IDSDefs\\"=-
"C:\\Program Files\\Common Files\\Symantec Shared\\SPManifests\\"=-
"C:\\Documents and Settings\\All Users\\Application Data\\Symantec\\Common Client\\"=-
"C:\\Program Files\\Norton Internet Security\\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E26975905FAE44A83FCFAEC0303A0E]
"00000000000000000000000000000000"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4799D30A4DDA954429D8D4ED011517F9]
"00000000000000000000000000000000"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBAE3AAB8D0042547990AF991553C16B]
"00000000000000000000000000000000"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Symantec]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"=-
"C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"=-
"C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"=-
"C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"=-
[-HKEY_USERS\.DEFAULT\Software\Symantec]
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Office\Outlook\Addins\MsouPlug.OutlookPlug]
"FriendlyName"=-
"Description"=-
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\RAS Autodial\Addresses\liveupdate.symantecliveupdate.com]
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"b"=-
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"f"=-
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton AntiVirus]
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security]
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional]
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional\Norton AntiVirus]
[-HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus]
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Documents and Settings\\Susan Trapnell\\Desktop\\Norton_Removal_Tool.exe"=-
"C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zSE2.tmp\\SymNRT.exe"=-
"C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS1.tmp\\SymNRT.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\PROGRA~1\\SYMNET~1\\SNDWarn.exe"=-
"C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE"=-
"C:\\PROGRA~1\\Symantec\\LIVEUP~1\\LUALL.EXE"=-
"C:\\Program Files\\Symantec\\LiveUpdate\\LUALL.EXE"=-
[-HKEY_USERS\S-1-5-18\Software\Symantec]

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

I have not removed every single Norton remnant, but the ones left should not cause any problems.

If you do use other Norton/Symantec products, DO NOT use OTMoveIt, just let me know.

Yes, I rebooted each time I ran the Removal Tool, and no, I don't use any other Symantec Products. You didn't ask for anything other than the MoveIT log; here it is. Thank you! ========== FILES ========== File/Folder C:\Program Files\Symantec not found. C:\Documents and Settings\Susan Trapnell\Desktop\Norton_Removal_Tool.exe moved successfully. File/Folder C:\Program Files\Common Files\Symantec Shared not found. File/Folder C:\Program Files\Norton Internet Security Professional not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{E39D1C81-7E76-4d84-9F25-E2CC76EC050B}\\LocalService deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\LocalServer32\\@ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\\@ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\0\win32\\@ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\HELPDIR\\@ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\Compatibility\NortonSystemInfo\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Symantec Shared\Script Blocking\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Application Data\Symantec\Norton Internet Security Professional\Log\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Application Data\Symantec\Norton Internet Security Professional\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Norton Internet Security Professional\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security Professional\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Norton AntiVirus\Quarantine\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Norton AntiVirus\Quarantine\Portal\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Norton AntiVirus\Quarantine\Incoming\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security Professional\Norton AntiVirus\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Symantec Shared\IDSDefs\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Symantec Shared\SPManifests\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Norton Internet Security\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E26975905FAE44A83FCFAEC0303A0E\\00000000000000000000000000000000 deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4799D30A4DDA954429D8D4ED011517F9\\00000000000000000000000000000000 deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBAE3AAB8D0042547990AF991553C16B\\00000000000000000000000000000000 deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\\ deleted successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\PROGRA~1\SYMNET~1\SNDWarn.exe deleted successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE deleted successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\PROGRA~1\Symantec\LIVEUP~1\LUALL.EXE deleted successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Symantec\LiveUpdate\LUALL.EXE deleted successfully. Registry key HKEY_USERS\.DEFAULT\Software\Symantec\\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Office\Outlook\Addins\MsouPlug.OutlookPlug\\FriendlyName deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Office\Outlook\Addins\MsouPlug.OutlookPlug\\Description deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\RAS Autodial\Addresses\liveupdate.symantecliveupdate.com\\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*\\b deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe\\f deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton AntiVirus\\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security\\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional\\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Norton Internet Security Professional\Norton AntiVirus\\ not found. Registry key HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Norton AntiVirus\\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Documents and Settings\Susan Trapnell\Desktop\Norton_Removal_Tool.exe deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\DOCUME~1\SUSANT~1\LOCALS~1\Temp\7zSE2.tmp\SymNRT.exe deleted successfully. Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\DOCUME~1\SUSANT~1\LOCALS~1\Temp\7zS1.tmp\SymNRT.exe deleted successfully. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\PROGRA~1\SYMNET~1\SNDWarn.exe not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\PROGRA~1\Symantec\LIVEUP~1\LUALL.EXE not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\Program Files\Symantec\LiveUpdate\LUALL.EXE not found. Registry key HKEY_USERS\S-1-5-18\Software\Symantec\\ not found. OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02172009_124255

Gary, I'm second guessing, I know. But, here's a Registry Search AFTER running MoveIt3: —————————— Windows Registry Editor Version 5.00 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.6.0 ; Results at 2/17/2009 12:52:26 PM for strings: ; 'norton' ; 'symantec' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\LocalServer32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0] @="Symantec Core LC Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\0\win32] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\1.0\HELPDIR] @="C:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup] ; Contents of value: ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll ; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll ; "Symantec Core Components"=hex(7):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,\ 00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,\ 6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,53,00,79,00,6d,\ 00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,00,61,00,72,00,65,00,64,00,\ 5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,5c,00,73,00,79,00,6d,00,6c,\ 00,63,00,73,00,79,00,73,00,2e,00,64,00,6c,00,6c,00,00,00,43,00,3a,00,5c,00,\ 50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\ 00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,00,65,00,\ 73,00,5c,00,53,00,79,00,6d,00,61,00,6e,00,74,00,65,00,63,00,20,00,53,00,68,\ 00,61,00,72,00,65,00,64,00,5c,00,43,00,43,00,50,00,44,00,2d,00,4c,00,43,00,\ 5c,00,73,00,79,00,6d,00,6c,00,63,00,72,00,73,00,74,00,2e,00,64,00,6c,00,6c,\ 00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard] ; Contents of value: ; C:\PROGRA~1\NORTON~1\AdvTools\UE32.EXE "EventMessageFile"=hex(2):43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,\ 00,7e,00,31,00,5c,00,4e,00,4f,00,52,00,54,00,4f,00,4e,00,7e,00,31,00,5c,00,\ 41,00,64,00,76,00,54,00,6f,00,6f,00,6c,00,73,00,5c,00,55,00,45,00,33,00,32,\ 00,2e,00,45,00,58,00,45,00,00,00 [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" [HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS26.tmp\\SymNRT.exe"="Symantec Removal Utility" "C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS28.tmp\\SymNRT.exe"="Symantec Removal Utility" "C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS10.tmp\\SymNRT.exe"="Symantec Removal Utility" [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://securityresponse.symantec.com/avcenter/fix_homepage/" ; End Of The Log…

Gary, I was looking through Windows Installer and came across a file that has the following information when running the mouse over it: 38c93a62.msi Type: Windows Installer Package Author: Vendio Services, Inc. Title: Search Settings Subject: Search Settings Date modified: 1/5/2009 3:40 pm Size: 1.20 MB Vendio seems to be a legimate company in nearby Silicon Valley. But, this is quite possibly the installer for the "bug" we have been chasing.

OK, hadn't realised I'd left so much behind, I needed to do some research before removing "everything".

Please note, there will still be keys with reference to Symantec left on your computer when we've finished, but these are default Windows keys and should be left in place.

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup]
"Symantec Core Components"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard]
"EventMessageFile"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\BackupRestore\FilesNotToBackup]
"Symantec Core Components"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard]
"EventMessageFile"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup]
"Symantec Core Components"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard]
"EventMessageFile"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-
[HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS26.tmp\\SymNRT.exe"=-
"C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS28.tmp\\SymNRT.exe"=-
"C:\\DOCUME~1\\SUSANT~1\\LOCALS~1\\Temp\\7zS10.tmp\\SymNRT.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"Start Page"=-

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

Next

Download FileFind by Atribune.

• Double click on FileFind.exe to open the programme.
• Enter 38c93a62.msi into the File: box.
• Click on the Search button.
• After a while a list of file locations will appear in the List of Files: box.
• Click on the Export button.

This will create a Notepad file named Export.txt located in the C:\ folder, copy and paste it to your next post please.

Here is the output you requested. Thank you. SusanT
——————————————————————————
Output from MoveIt3:

========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60C70E11-2B08-4798-B366-C8450CDA7B1A}\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{54635C92-DFAF-4A99-8802-92FB068A6154}\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup\\Symantec Core Components deleted successfully.
Unable to delete registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard\\EventMessageFile .
Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\BackupRestore\FilesNotToBackup\\Symantec Core Components deleted successfully.
Unable to delete registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard\\EventMessageFile .
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup\\Symantec Core Components not found.
Unable to delete registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard\\EventMessageFile .
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page deleted successfully.
Unable to delete registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page .
Unable to delete registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page .
Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\DOCUME~1\SUSANT~1\LOCALS~1\Temp\7zS26.tmp\SymNRT.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\DOCUME~1\SUSANT~1\LOCALS~1\Temp\7zS28.tmp\SymNRT.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-643571872-3238835185-2771580065-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\DOCUME~1\SUSANT~1\LOCALS~1\Temp\7zS10.tmp\SymNRT.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page not found.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02172009_142400

====================
Output from FileFind:

C:\WINDOWS\Installer\38c93a62.msi - 1263616 Bytes

———————
End. st

OK, we've got a few keys and values that weren't deleted.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\NUEWizard\\EventMessageFile .

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\NUEWizard\\EventMessageFile .

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NUEWizard\\EventMessageFile .

These values are related to Event log entries, they're of no concern. Leaving them in place shouldn't cause any problems.

HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page .

HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page .

These are IE start page settings for other accounts on your computer, you can't delete them from the account you're currently in, if you want to remove them you'll need to log in to the appropriate accounts. Let me know if you want to do this.

To get rid of the "Search Settings" file.

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Files
C:\WINDOWS\Installer\38c93a62.msi

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

How's your computer behaving now?

1. Here is the log you requested. The operation failed. Did I do something wrong?
========== FILES ==========
File move failed. C:\WINDOWS\Installer\38c93a62.msi scheduled to be moved on reboot.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02172009_160152

Files moved on Reboot…
File move failed. C:\WINDOWS\Installer\38c93a62.msi scheduled to be moved on reboot.
——————————–

2. In addition to the MSI file, there is also a Directory named Search Settings. It is located under myuserid/Application Data/Search Settings. It contains subfoldr kb127 and under that 2 sub-folders "res" and "temp"
I didn't open any thing but the folders – afraid the big boogy man might jump out at me.

3. When the machine rebooted, (and everytime I have rebotted for the past couple of days,
there is a quickly moving message about a failed driver. I think it says something like
PCARmdrv.exe failed. I undoubtedly removed or changed something I shouldn't have.

Other than that, I believe things are looking better. Thank you. SusanT

No you didn't do anything wrong.

Let's try something a bit more powerful to see if we can persuade it to part company with your computer.

First

Download Avenger by Swandog and unzip it to your Desktop.

Note: This programme must be run from an account with Administrator priviledges.

• Open the Avenger folder and double click Avenger.exe to launch the programme.
• Copy the text in the code box below and Paste it into the Input script here: box.

Files to delete:
C:\WINDOWS\Installer\38c93a62.msi

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

• Ensure the following:
  
  • Scan for Rootkits is checked.
  • Automatically disable any rootkits found is Unchecked.
• Press the Execute key.
• Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
• Post the log back here please. (it can also be found at C:\avenger.txt)

Next

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :dir
  %userprofile%\Application Data\Search Settings /s

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

PCARmdrv.exe is related to Lynksys routers, do you use one?

Hi Gary,
Output from Avenger:
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger
*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\Installer\38c93a62.msi" deleted successfully.

Completed script processing.
*******************
Finished! Terminate.

I viisually confirmed the deletion.

Output from SystemLook
SystemLook v1.0 by jpshortstuff (11.02.09)
Log created at 11:21 on 18/02/2009 by Susan Trapnell (Administrator - Elevation successful)

========== dir ==========

C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings - Parameters: "/s"

—Files—
None found.

C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127 d—– <00:58 06/01/2009>

C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127\res d—– <00:58 06/01/2009>

C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127\temp d—– <00:58 06/01/2009>
ws-14283.log –a— 3575 bytes <01:06 08/02/2009> <00:10 10/02/2009>
ws-14285.log –a— 4302 bytes <02:59 10/02/2009> <18:35 10/02/2009>
ws-14286.log –a— 2868 bytes <06:28 11/02/2009> <19:51 11/02/2009>

-=End Of File=-
———————–
Regarding the PCARmdrv, yes, we have setup a home network.
I found the log for the failure when I was nosing around to make sure that I had administrator privileges.
————————-
Application popup: PCARmDrv.exe - Application Error : The application failed to initialize properly (0xc0000142). Click on OK to terminate the application.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

OK, let's get rid of the Search Settings folder.

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Files
C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

Next

Let's see what we can find out about PCARmDrv.exe

• Double click on FileFind.exe to open the programme.
• Enter PCARmDrv.exe into the File: box.
• Click on the Search button.
• After a while a list of file locations will appear in the List of Files: box.
• Click on the Export button.

This will create a Notepad file named Export.txt located in the C:\ folder, copy and paste it to your next post please.

Then

• Double click regsearch.exe to launch the programme.
• Copy/Paste the following into the Search Box PCARmDrv
• On the next line Copy/Paste Lynksys
• Click OK.

Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder.

Copy/Paste that file into your next post please.

My ISP's e-mail server is a bit flaky at the moment and I haven't been getting notifications when you've posted replies, so I've got to check here (and the other sites I work) manually. Because of that my replies may not be as prompt as I'd like them to be, and it'll probably be tomorrow before I see your next set of logs.

Sorry for the inconvenience.

Hello Gary,

Here are the logs you requested:


MoveIt3:
========== FILES ==========
C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127\temp moved successfully.
C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127\res moved successfully.
C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings\kb127 moved successfully.
C:\Documents and Settings\Susan Trapnell\Application Data\Search Settings moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02192009_100418

——————————–
Output from FileFind:
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400\PCARmDrv.exe - 45056 Bytes

——————————–
Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0

; Results at 2/19/2009 10:51:27 AM for strings:
; 'pcarmdrv'
; 'lynksys'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"="Rawether Service Control Entry Remover"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"="Rawether Service Control Entry Remover"

; End Of The Log…

Please NOTE:
We had a wireless router installed, until we realized that it just wasn't going to work in this house. So we hardwired between the rooms and now have a wired router for our home network. It looks like the file that is dangling here is one from the Wireless Router. I also have the silly little wireless icon in my system tray …or whatever that is over by the time on the right.

It looks like I somehow missed your prior post as well. I so appreciate the time you've put in to this. And, I'm absolutely amazed, considering the time between us that we've been able to move through this so smoothly. As far as I'm concerned, your ISP glitches are no problem at all. Thanks again. SusanT

OK, if you're not using the Wireless Router, then the easiest thing is to Uninstall it (if you can).

However, I'm presuming you've already tried that and what we're looking at are just orphans, so if that is the case then we'll hack it out like we did with Norton.

Before we start can you create a new backup with ERUNT (I always like to have an insurance policy).

Next

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Files
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400

:Reg
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"=-

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

Everything still running OK ?

OK, if you're not using the Wireless Router, then the easiest thing is to Uninstall it (if you can).

However, I'm presuming you've already tried that and what we're looking at are just orphans, so if that is the case then we'll hack it out like we did with Norton.

Before we start can you create a new backup with ERUNT (I always like to have an insurance policy).

Next

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below.

:Files
C:\Program Files\Linksys Wireless-G PCI Adapter with SRX400

:Reg
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Linksys Wireless-G PCI Adapter with SRX400\\PCARmDrv.exe"=-

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.

• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

Everything still running OK ?