Norton Support Nightmare

Discussion in 'Malware Help (A Specialist Will Reply)' started by toptechx6, Jun 9, 2010.

  1. toptechx6

    toptechx6 Private E-2

    Many thanks to Majorgeeks for the Spyware Removal tutorial, it worked so well I do not need to post logs of the various scans. Most showed nothing anyway, I believe it was the Combofix program that did the trick.

    I kept getting the message ccSvcHst application error which is associated with Norton Internet Security, since I had just upgraded to the latest version I thought at first it was a glitch in the software. I tried Live Update, rebooting the machine then One Click Support, all failed. My next attempt was to use the Norton Removal Tool after which I reinstalled a fresh copy of NIS 2010, again failure so I logged in to a chat session with Norton support and let them take remote control of my desktop, a short time later they said it was fixed, but the error message soon returned.

    I then called Norton with my case number and once again allowed them to take control of the desk top, after some time they indicated the problem was resolved, but the error message returned quickly along with a new message indicating a problem with Symantec Service Framework, about this time I also noticed both Internet Explorer and Firefox searches were being redirected! This support scene was repeated several times over a three day period until Norton finally told me my computer had a “worm” and if I wanted it removed there would be a fee of $99.99.

    When I asked how that could happen with their Internet Security installed and updated I was told someone had “allowed” the malware to be installed by clicking on a bad attachment, website or link. I was very skeptical of this explanation but agreed to pay the fee because I needed my machine to function, and Norton promised repair was “guaranteed”.

    After charging my credit card Norton Support again took control of my desktop and made several attempts lasting many hours over several days all were complete failures. A manager eventually communicated that my machine had a “new” virus and the case was being escalated to their “research department” and that I would receive a call from their “Elite” support team within 24 to 48 hours. When they had not called back three days later I called again and after a serious runaround finally was connected to an “Elite” support technician who once again took remote control of my machine, this began another series of repair attempts lasting many hours over several days, all failed to fix the problem.

    Nearly 10 days after the first error the “Elite” support technician asked me if I had the CD to reinstall my OS and asked me to back up my data to an external hard drive, obviously the next “repair’ attempt was going to be reformatting my hard drive. I would likely have even allowed them to do that if they had bothered to call back as promised within two hours, but they failed to do so and have still not responded even now two DAYS later! While the Spyware Removal Process on Majorgeeks initially seemed intimidating, I figured I had nothing to lose compared to the reformatting option so I printed out the instructions and followed them step by step. While it did take some time, the few hours spent were far less than the days already wasted and when I was finished my computer works better than ever.

    I sent an e-mail very similar to this to Norton Support demanding a refund of the Virus Removal fee over one day ago; they have yet to reply so I will be calling them today, if they fail to agree to a refund my next step will be disputing the charge with AMEX.

    Thanks again for your help, much appreciated.
     
    Last edited by a moderator: Jun 9, 2010
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hello there. :) Sorry to hear of all your troubles. If you have been through our malware removal procedures then please attach all of the requested logs.
     
  3. toptechx6

    toptechx6 Private E-2

    First two logs attached. Seem to recall I can only send two at a time so I will send additional replies.
     

    Attached Files:

  4. toptechx6

    toptechx6 Private E-2

    Second batch of log files.
     
  5. toptechx6

    toptechx6 Private E-2

    Oops sorry, 2nd batch failed to upload.
     

    Attached Files:

  6. toptechx6

    toptechx6 Private E-2

    Last logfile.
     

    Attached Files:

  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am not seeing any malware in your logs. Combofix did indeed find an infected copy of the below and healed it.
    Delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).
    So tell me how things are running for you now?
     
  8. toptechx6

    toptechx6 Private E-2

    Thanks for your reply Kestrel13, I will follow your advice. So far all is well with my machine no issues at all. Norton was actually very pleasant when I called about a refund, no problem with that either.
    The conversation was in fact quite interesting, they explained that they are only permitted to remove malware with Norton developed tools or by manual delete which helps explain why they struggled. Since most third party tools come with a disclaimer, Norton cannot accept the liability of using them.
    If I have problems in the future I will not use their support, I am not a "geek", but I can follow the simple directions posted by the experts here. Thanks to all of those who help out here.:clap
     
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    That's great to hear :) And Norton have been very fair about your refund, I agree, that was nice of them.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds