Help! Save me from Microsoft OneCare

[ahhaa]

This is a case of curiosity canning the cat...
I wondered why there were no reports or reviews on Microsoft OneCare Live, which in concept seemed like a viable product. My experience has gone from bad to worse.

At first, I was surprised because the CD in the fancy box seems to be nothing but a loader- it ran for a couple seconds and then the rest of the IS suite downloaded itself, over my rural tincans&string ISP for several hours- during which time of course I had no firewall or antivirus at all.

One reason I went with it was the extensive support promised by MS (the other was it was free 'after rebate').

I used it within a couple days, to report that the 'Your Computer might be at risk' would turn on and then off during startup. Also, I was concerned about the amount of time that the daily updates were taking- tho the box stated 56K dialup or broadband, it is clearly a broadband dependant product.

Then disaster struck with the click of a link- here's the story repeated back by MS support person Alvis Fang:

From your description, I understand that your browser suddenly shrank & started jumping around the screen. The window read something like "You have been Jacked." You could only close it using Task Manager. The Windows 'can't' sound started going continuously. OneCare showed as having been turned off- both AV & Firewall and running a OneCare scan showed nothing. Spybot showed Registry changes shutting off Windows Firewall. The se c ond time you ran the OneCare scan it said "Scan was cancelled before it was completed. Service Executable has encountered a problem and needs to close."

Please be assured that I fully understand the inconvenience caused by this issue. I will continue to work with you to find a resolution.

I understand that that you may have a virus on your computer, I suggest we try the following steps to scan virus in Safe Mode to check this issue:

Step 1: Boot in Safe Mode

====================

1. Restart your compute r and start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when you see the boot menu.

2. When the Windows Advanced Options menu appears, select Safe Mo de, and then press Enter.

3. Log onto Windows by using the Administrator account or any user account with the Administrator privileges.

NOTE: In Safe Mode, your system display and Desktop will look and perform differently than in Normal Mode. This is o nly temporary. To return the system back to Normal Mode, we can simply restart the computer.

Step 2: Scan for viruses

==================

1. Click the Start button, then in the "Start Search" box type CMD but DO NOT press Enter yet.

2. In the list above, under "Programs" right-click on CMD that appears above and choose "Run as Administrator" and click "Continue".

3. In the black command line window, type in the following command and press Enter:

CD /D %ProgramFiles%\Microsoft Windows OneCare Live

4. Type the following command and press ENTER:

SafeModeAVScanner – s – h

5. The program will begin to perform a full system virus scan, when it is finished, please restart your computer.

What is the result?

In addition, please help me collect some information by following the steps below. I will perform further research after receiving the information and provide additional suggestions.

1. Please locate the following folder if Windows is installed on the C drive:

C:\Program Files\Microsoft Windows OneCa re Live\

2. Double click the file named OneCareSupport or OneCareSupport.exe. It will collect the information.

3. When it finishes collecting the information, note the path shown and name of the information file. (Generally, it is C:\ OneCareSupportData.zip)

4. Please send this file to ****@mssupport.microsoft.com and I will perform further research on our issue.

The bolded part has me stumped. I get thru the Safe mode Startup OK, but then I can't find the right START SEARCH box mentioned- I get the typical Dog search panel and CMD goes nowhere & does nothing...

I've had this computer down now over a week, and yoyo email back & forth over Christmas- they keep telling me they replied promptly and if there's anything further... mail for the boss to read I guess.

I know there's something stupid I'm missing... ohyeah, it's XPsp2 on a dual boot machine using LILO to launch Mandrake 9.2; but I seem to get past the Safe mode start OK, at least it says so. I'm being asked to start a scan in a special way. It won't run just by normal click start.

I'd like to salvage the XP install because there are a bunch of drivers & such that reside nowhere else. Any open input window gets tildes (~~~~~~~~~~~~~~) autofilling the entry.

[stiltman]

Command Prompt can be found here for a default install of windows with C: being the boot partition
C:\WINDOWS\system32\cmd.exe
Skip the run-as step, because you have to be an Administrator to login in the first place

You can accomplish the same thing just by adding this to the run box
"C:\Program Files\Microsoft Windows OneCare Live\SafeModeAVScanner – s – h"

You'll need to use the quotes too



EDIT:
BTW, I have found that there is not one product on the maket today that can catch and REMOVE all the viruses/spyware/maleware/trojans/root kits

I tipically have to use a few programs after a 'user gets infected with new stuff
Here's a list of some of the programs I use or have used
Windows Defender
VundoFix
Spyboy Search and Destroy
Sophos Rootkit Remover
HiJackThis
Dr Web's free version of Cureit! (beware, it will find competitors anti-virus programs as possible viruses)
Microsoft Systernals Autoruns (usually I start with this first to see what's being loaded)

[JohnnyMalaria]

The bolded part has me stumped. I get thru the Safe mode Startup OK, but then I can't find the right START SEARCH box mentioned- I get the typical Dog search panel and CMD goes nowhere & does nothing....

The reason you are stumped is because the MS person assumed you have Vista. The search function is different as too is the Run As Administrator option.

When you follow up with the MS support group, let them know that you have had a lot of difficultly following their instructions because they assumed you have Vista and not XP. Hopefully, they'll change their procedure to prevent it happening to others.

[ahhaa]

Thanks guys- I thought I just wasn't reading it right! I clearly specified XP in both the initial report and the post crash report. and lemmetellya, it is a drag trying to use webmail to compose long tech reports- I had it auto sign out twice, losing long involved content both times.
Have already received email from a supervisor, but it doesn't sound like he is getting my emails.
am going to try the Run command, wondered about that, but MS mistaking it?

[JohnnyMalaria]

Perhaps the tech support guy had a hangover given the season...

[ahhaa]

well, these guys are in China somewhere based on their last names- got emails on Xmas Eve & Christmas Day, but silence now that the BigBox computers are out from under the tree.

Nothing has worked; the C:\Program Files\Microsoft Windows OneCare Live\SafeModeAVScanner – s – h command returned a message that it refers to a location that is unavailable.
I tried adding .exe to it and then tried finding the SMAVS file using Explorer (its right where its supposed to be) , then creating a rightclick shortcut on the desktop and adding -s -h to that which got me "a device attached to the system is not functioning".

The more I try to pry this outta my computer, the more sophisticated it seems. It is aimed not at the general user, but at Microsoft OneCare itself imho.

I have a fresh CD of Norton08, but it doesn't wanna run a scan with OneCare installed. Can I uninstall OneCare without further damage? Or if I looked at task manager in normal mode, would I find a suspicious process?

This looks so easy in the movies! 8)

[JohnnyMalaria]

You need to put quotation marks around the string and remove the spaces in the parameters, i.e.,

"C:\Program Files\Microsoft Windows OneCare Live\SafeModeAVScanner" –s –h

Makes me wonder if the chinese support group is counterfeit

[ahhaa]

I emailed Symantec about scanning/installing the NIS08 CD I have, their email said a tech would be in touch within 96 hours (up from 72). Looking over their virus remover tools, seems like they quit that - only 2 this year, but started up a whileyouwait hard drive fixit business.

If I was mean, I'd post the support emails...

[fatbloke88]

can you not try an online scanner such as panda

http://www.pandasecurity.com/homeusers/solutions/activescan/

or http://pcpitstop.com/

[ahhaa]

hi fb-
I'd like to, but this is kinda sophisticated like I said... opening any input window fills it with ~~~~~~~~~~~ one at a time.
This happened as soon as I opened my dialer connect window, both the address and password got annihilated, goading me towards reentering them.
I didn't because I realized any program that could do that could also read & send my keystrokes.

[Krispy Kritter]

You should just fix it yourself with the free tools everyone else uses. Then after you have the PC up and running again, then decide to fix or remove the MS product.

Three basic tools will fix most problems:

Ad-Aware SE http://www.lavasoftusa.com/

Spybot Search & Destroy http://www.safer-networking.org/en/index.html

HiJack This http://www.spywareinfo.com/~merijn/programs.php

[aedipuss]

may be too late to fix. faster and more likely to succeed with a full re-format of the hard drive and re-installing windows. and don't connect to the net before full anti-virus and firewall are up and running. sp2 would be a big help also.

[ahhaa]

kk- thanks, Spybot is what found the registry changes that shutdown the firewall, but not the program itself.
The HiJack link lead me to the spyware forum where they recommended this:

AVG Anti-Spyware Free Edition 7.5
http://free.grisoft.com/doc/downloads-products/us/frt/0?prd=asf

the only thing is that I had a fully updated & frequently scanned system when I clicked on an innocent looking link, much like i trusted the links above, at a site I have used and trusted for quite while.

This was the job that OneCare failed at, and to me the failure is complete.