Manually Norton 360 Removal

Nikumba · 7 Jun 2012 at 10:44

Got a problem with my bosses laptop, that it keeps rebooting in Windows, mostly blue screens of different ones, but it only happens once logged in and not while sat at the login screen.

Now the articles I have read point to Norton 360 to be at fault, now normally you would remove it via Programs in Control Panel but it is not staying up long enough for that to work.

I can not disable the Norton 360 service to prevent it from starting on boot.

Now you use to be able to remove norton by messing with the registry, deleting files etc which is what I want to do, however I can not find anything, just a Norton removal tool which I can't use as the machine wont stay up long enough.

Any help on where to look or have instructions?

Thanks

Kimbie

Swordfish · 7 Jun 2012 at 10:45

Boot into safe mode for starters and run the removal tool

Edit - what is the BSOD you are getting.?

Nikumba · 7 Jun 2012 at 10:46

Swordfish said:
Download the Norton Removal tool and run that.

Thanks for that, however I did say I can not use that tool as the machine does not stay up long enough.

Kimbie

edscdk · 7 Jun 2012 at 10:47

boot from something else and rename the norton folder?

Swordfish · 7 Jun 2012 at 10:48

Boot into safe mode and run the removal tool.

Then run TDS Killer, then combofix - this will rule out any malware/rootkits.

NealR · 7 Jun 2012 at 10:55

If all else fails, trying booting using something UBCD4Win or BartPE to build a custom live CD in order to run virus/malware removal and/or the NRT(Norton Removal Tool)

edscdk · 7 Jun 2012 at 10:58

NealR said:
If all else fails, trying booting using something UBCD4Win or BartPE to build a custom live CD in order to run virus/malware removal and/or the NRT(Norton Removal Tool)

dont think you can use the removal tool unless you boot the instance of windows that needs the software removing

Deleted member 77746 · 7 Jun 2012 at 11:03

Backup & format

NealR · 7 Jun 2012 at 11:05

edscdk said:
dont think you can use the removal tool unless you boot the instance of windows that needs the software removing

hmmmmmm that might be true. I'm not entirely sure. But using either BartPE or UBCD4Win or others alone those lines will or at least should allow you to run anti-virus/malware tools.

darael · 7 Jun 2012 at 11:21

Can we know the error code from the blue screen.

NealR · 7 Jun 2012 at 11:30

Nikumba said:
Got a problem with my bosses laptop, that it keeps rebooting in Windows, mostly blue screens of different ones, but it only happens once logged in and not while sat at the login screen.

Now the articles I have read point to Norton 360 to be at fault, now normally you would remove it via Programs in Control Panel but it is not staying up long enough for that to work.

I can not disable the Norton 360 service to prevent it from starting on boot.

Now you use to be able to remove norton by messing with the registry, deleting files etc which is what I want to do, however I can not find anything, just a Norton removal tool which I can't use as the machine wont stay up long enough.

Any help on where to look or have instructions?

Thanks

Kimbie

Having just re-read the OP, have you tried a system restore using the Recovery Console ?

http://support.microsoft.com/kb/307545

Nikumba · 7 Jun 2012 at 11:58

Im cloning the drive at the moment, so will let you know the codes later.

thanks for that link but should have said using windows 7

NealR · 7 Jun 2012 at 12:07

Nikumba said:
Im cloning the drive at the moment, so will let you know the codes later.

thanks for that link but should have said using windows 7

From the people who bring you ComboFix - http://www.bleepingcomputer.com/tutorials/windows-7-recovery-environment-command-prompt/

Have you tried running that?

Nikumba · 7 Jun 2012 at 15:07

Have managed to rip out Norton yay!

But still getting these errors, well these are the ones I have been able to catch

IRQ_NOT_EQUAL_LEss

an attempt was made to execute to non-executeable memory 0x000000FC

MEMORY_MANGEMENT 0x0000001A

The laptop has 2 DIMMS in it and ave removed one of them, will be running memtest later today.

Kimbie

Nikumba · 7 Jun 2012 at 16:05

Going to run a memtest as it seems to be stable with one stick in at the moment running prime95.

There seems to be two places to get memtest from http://www.memtest86.com/ and http://www.memtest.org/ which is right one?

Kimbie

NealR · 7 Jun 2012 at 16:07

http://hcidesign.com/memtest/download.html is one place, otherwise I would get it from memtest86.com

Nikumba · 7 Jun 2012 at 16:53

Running memtest now, with only one DIMM in and got lots of red as per the pic, is this something to worry about? Or just one of those pesky ghost errors?