PDA

View Full Version : internet only in safe mode


ell
03-09-2009, 06:21 PM
just wondering if anybody knows of something i'm missing to do here. I have a system that was cleaned (don't know what they found) but they messed with the registry pretty good, I got services straightened out, and the wireless card connects to my network fine, however firefox & ie7 are both blocked somehow. Works fine in safe mode. There is symantec antivirus on it, a school supplied version. I thinking the only way to fix is to remove it, but I'm wondering if theres something else I could try, I disabled xp firewall, I did winsock fix and ccleaner. scanned with hijack this and malwarebyes,clean.:confused:

arrow_runner
03-09-2009, 06:33 PM
See if there's another firewall running on it. Also run autoruns and look for any stupid BHOs or something, but it's most likely a firewall...

If you install chrome or some other browser and try to access the internet, that might give you an idea what the program is. (it should pop-up saying allow or deny)

ell
03-09-2009, 06:39 PM
See if there's another firewall running on it. Also run autoruns and look for any stupid BHOs or something, but it's most likely a firewall...

If you install chrome or some other browser and try to access the internet, that might give you an idea what the program is. (it should pop-up saying allow or deny)

can you give me help with BHO's? Or point me to a link where I can learn about how to use autoruns? I did run autoruns but had no clue how to use it.

Bullfighter
03-09-2009, 10:29 PM
It does sound like a classic Norton Firewall corruption...

EP

ell
03-09-2009, 10:33 PM
It does sound like a classic Norton Firewall corruption...

EP

yup, thats what I think too, I tried to uninstall Norton but then got a password request so I stopped. Called my customer and got the ok to reinstall xp anyways, college kid had pretty well messed things up. Is there any way to disable norton without uninstalling it completely? Had already tried disabling it in services.

TimeCode
03-09-2009, 10:45 PM
Is there any way to disable norton without uninstalling it completely? Had already tried disabling it in services.

Not reliably. Even when disabled it still has its fingers in every pie it can find. :mad:

ell
03-09-2009, 10:49 PM
Not reliably. Even when disabled it still has its fingers in every pie it can find. :mad:

well I'm glad to hear it from others, I thought maybe I was missing something.

seedubya
03-09-2009, 11:24 PM
Yes there is, use Autoruns to disable every Symantec labelled program, service, driver and dll. If you do that and the internet works in normal mode then you know what the general problem is.

TimeCode
03-09-2009, 11:40 PM
I hope it works but I've had less than stellar results from that method.

PatrickB
03-10-2009, 02:02 AM
The password is likely "symantec" or "Symantec".

If that fails, you can change the value for this key to "0" (zero).
HKLM\Software\Intel\LanDesk\VirusProtect6\CurrentV ersion\AdministratorOnly\Security\UseVPUninstallPa ssword


You may also want to use the Norton Removal Tool:
http://www.symantec.com/norton/support/kb/web_view.jsp?wv_type=public_web&ssfromlink=true&sprt_cid=1a13409b-29db-4397-a286-9dec49f8e252&seg=hho&ct=us&lg=en&docurl=20080828154508EN

-- Patrick b.

TimeCode
03-10-2009, 02:16 PM
If that fails, you can change the value for this key to "0" (zero).
HKLM\Software\Intel\LanDesk\VirusProtect6\CurrentV ersion\AdministratorOnly\Security\UseVPUninstallPa ssword


You may also want to use the Norton Removal Tool:
http://www.symantec.com/norton/support/kb/web_view.jsp?wv_type=public_web&ssfromlink=true&sprt_cid=1a13409b-29db-4397-a286-9dec49f8e252&seg=hho&ct=us&lg=en&docurl=20080828154508EN

Now that is good to know! But doesn't the Norton Removal Tool require a password if it was installed with one?

PatrickB
03-10-2009, 04:13 PM
Use the default password. If that fails, change the registry key, then uninstall. :)

-- Patrick B.

PatrickB
03-10-2009, 04:52 PM
@ell, if you still need information about BHO's (Browser Helper Objects) ...

There are a few programs to deal with those:

Autoruns from http://www.sysinternals.com/

HiJackThis! from http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

... and my favorite, Spybot Search & Destroy from http://www.safer-networking.org/en/download/index.html

Spybot's advanced feature to handle BHO's. It presents them in a list and shows you details about them. They can be deleted from here. You will find them under the Mode > Advanced Mode >> Tools > BHOs. BHO's that are known to be suspect will be marked with a Red or Yellow indicator.

You also can check your
ActiveX Objects
System Startup
Winsock LSP
and Hosts file entries

-- Patrick B.

Graystar
04-10-2009, 09:01 AM
I have been fighting this scenario all evening. I was perplexed, and I came here and read this thread.
There was no evidence of Norton on the laptop but I ran the Norton uninstaller anyway thinking maybe the customer may have unistalled in via the Control panel.
VOILA
it worked!
I really am learning to HATE The Norton products.

Thanks to all who post here.

Jim:D

TimeCode
04-10-2009, 06:59 PM
I really am learning to HATE The Norton products.

And that is the beginning of true PC wisdom. ;)