Please check this Hijack This log

I'm back one again on my in-laws' computer. Their homepage has been hijacked again. Also, something is causing their firewall, Zone Alarm, to not load at startup. I re-enable it but when I check the next time I come to their house, it's not starting up. Their virus protection, Norton Antivirus, also won't start. The definitions file won't load. I have uninstalled and reinstalled Norton three times in the last few months, but once again, when I come back over here, it's goofed up again.
I ran Ad-aware and fixed about 100 problems. I ran Spybot and fixed another 40. I am running out of ideas.
For what it's worth, below is their latest Hijack This log. I will try to get back to their house quicker this time to make any suggested changes or fixes.

Thanks.

 

Umm, forgot to post the log.

 

OK, do I feel stupid or what? I'll blame it on my wife. She was rushing me to leave so the kids could get home and start their homework. The earliest I can get back over there is Friday, so I'll try to do it then. Sorry.

 

No problem. The Firewall and AV shutting down sound alot like a new infection. When you get back to the machine, look for any of the entries shown in the example log in this link, and if present, follow the suggestions there before posting a new log.

 

OK, it took a couple of trips over here to my in-laws, but here is where I am at with their computer. I uninstalled their Norton Antivirus 2003 once again. I followed the link that Noahdfear provided. I installed the KAV antivirus program. That's what took the extra trip, as I couldn't download the updates for it from this computer. I had to do it from home, burn it on a disk, and bring it back over here to load. I wasn't sure if it worked at first, as it kept saying that the definitions were like 60 days old. It wasn't until later that I realized that the date on my in-law's computer was set for May 2005! I realized that when I saw the May date on the log for the virus scan I ran. I have since corrected that.
Anyway, I rebooted into Safe Mode before running the virus scan as directed. I ran into a problem on the step that says to open Task Manager, go to Processes tab and shut down explorer.exe. This is a 98SE machine, and Control/Alt/Delete just opens End Task. I wasn't sure I could successfully restart explorer.exe, so I didn't want to risk it.
I ran the virus scan and it came up with 50-some virus and deleted them. I then ran a Hijack This scan and am posting that log below. Let's see if I can actually remember to do that this time! I don't have my wife here this time to blame that on.
Thanks in advance for any assistance and I await further instructions.

_

Logfile of HijackThis v1.99.1
Scan saved at 8:50:38 PM, on 3/23/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CSAFE\AUTOCHK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\ACCESSORIES\WORDPAD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://teen-biz.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.find-now.info/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL (file missing)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM219.DLL (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL (file missing)
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL (file missing)
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [kejnqivcxw] C:\WINDOWS\SYSTEM\dknojm.exe
O4 - HKLM\..\Run: [ct3216v] C:\WINDOWS\SYSTEM\ct3216v.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe "
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/wdriver/ddc/shockwave/wtinst.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
O19 - User stylesheet: (file missing)
O21 - SSODL: DDE Control Module - {3F143C3A-1457-6CCA-03A7-7AA23B61E40F} - (no file)

 

Wow! That's great!

Scan again with HijackThis and place a check next to the following entries. Close ALL other windows and click fix.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://teen-biz.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.find-now.info/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL (file missing)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM219.DLL (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll (file missing)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL (file missing)
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL (file missing)
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [kejnqivcxw] C:\WINDOWS\SYSTEM\dknojm.exe
O4 - HKLM\..\Run: [ct3216v] C:\WINDOWS\SYSTEM\ct3216v.exe
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/...wave/wtinst.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/...IL/PhPSetup.cab
O19 - User stylesheet: (file missing)
O21 - SSODL: DDE Control Module - {3F143C3A-1457-6CCA-03A7-7AA23B61E40F} - (no file)

Reboot and look for the files/folders in red. Delete if found. Empty the recycle bin and all temp folders. Post a new log.

If you're not going to get the full version of KAV, uninstall and re-install something ASAP. I recommend eTrust (free for a year) along with Zone Alarm firewall (always free), or the eTrust EZ Armor, which is the AV and Firewall package (uses ZA).

Re-immunize the system with Spybot, SpywareBlaster and IESpyad.

 

OK, I scanned again and checked and fixed the entries listed above. I rebooted and looked for the red files/folders. When I searched for Norton AntiVirus, I found three things. Only the third was called Norton AntiVirus exactly, so that's the only one of the three I deleted. Of the other two, the first was Norton Rescue.LOG, which was found in C:\WINDOWS. The second was called norton and was found in C:\IBMTOOLS\s... Should I have deleted those as well?
The other three red files/folders weren't found at all.
I emptied all temp folders and the recycle bin. Posted below is my latest HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 8:19:04 PM, on 3/25/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CSAFE\AUTOCHK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [Zone Labs Client] "C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE "
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe "
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service


I feel like real progress is occurring and continue to say thanks.

 

Log looks great! You could safely delete the nortonrescue.log. Not sure about the other without the exact filename, but appears you could. Check the file properties. If it's from Symantec/Norton, it can go. I would recommend running a regcleaner for optimization if you feel it's needed. I would also question why the machine hasn't been updated with Windows Updates. IE6 and many other security patches are available and should be applied.

Well done Bucksone, and glad I could help.

 

I'll look into the Windows Update the next time I come over here, which should be for Easter dinner. I always work better with a full stomach.
The machine has some glitches booting up that I don't know if they are related to all of this or not? Before Windows boots, the following message appears.
Cannot find a device file that may be needed to run Windows or a Windows application.
The Windows registry or SYSTEM.INI file refers to this device file, but the device file no longer exists.
If you deleted this file on purpose, try uninstalling the associated application using its uninstaller or setup program.
If you still want to use the application associated with this device file, try reinstalling that application to replace the missing file.
C:\PROGRA~1\SYMANTEC\SYMEVNT.386
Press a key to continue.
I do so, then the above message appears again with the following.
c:\PROGRA~\NORTON~1\SAVRTPEL.VXD
I press a key, then...
c:\PROGRA~\NORTON~1\SAVRT.VXD
I press a key, then...
SYMTDI.VXD
I press a key, then finally begins to boot. During that boot, I get a window that is titled, "Error starting program." It says, "A required .DLL file, EZTEXT.DLL was not found. I click OK and Windows finishes booting.
I'm not sure what causes this?

 

I would definitely start with running RegSeeker to cleanup the registry. Norton usually leaves alot behind when uninstalled.

EZTEXT.DLL is likely an eTrust file. Did you download/install it? I didn't see it running and still see KAV, so assumed you did not.

 

No, I haven't downloaded e Trust, and I'm sure my in-laws didn't as well. That had been popping up at boot prior to me working on this whole problem.

Since they have paid for Norton 2003 and their subscription for virus definitions is paid through next September, is there any reason why I shouldn't re-install Norton Antivirus? I am hoping that whatever was causing it to be deleted has been killed off by now.

If I do re-install Norton, I suspect I should first make sure it is completely uninstalled.

 

I'd recommend again cleaning up the registry first, then see if the EZTEXT.dll error is still present. If so, do a search of the registry for it and let us know what you find.

No reason you can't re-install Norton if you want, as long as you're still getting definition updates. Support for 2003 has ended however (telephone and/or Live Support).

 

Well, it took me a few days longer to get back to this computer then I planned, but here I am. I started by deleting those two remaining Norton entries I mentioned a few posts ago.
Next was RegSeeker. I tried clicking on the link to it that Noahdfear provided, but nothing came up. I tried going directly to the hoverdesk.net site, but only got a blank page. I google searched RegSeeker, tried a few download sites provided from there and got either blank pages or the dreaded This Page can't be displayed. I was finally able to download a beta version from PCWorld's site. I ran the program and it came up with 1187 entries to delete, which I did.
When I rebooted, the "Cannot find a device file..." messge I mentioned earlier that comes up prior to Windows starting still appeared. The only difference was that it only did it for SYMTDI.VXD, not the three other things I mentioned in an earlier post. I hit the space bar and Windows started.
The Error Starting Program thing regarding the EZTEXT.DLL still happened. I tried searching the registry for it using regedit, Edit, Find, but it came up with nothing.
Next I tried to update Windows. I google searched this as well, and tried several choices. Some gave me just a blank page. Some took me to Microsoft's update sites, although each one looked a little different. On these sites, I would get the message that they were checking for the latest version of the Windows Update software. I would wait 5-10 minutes, nothing would happen, so I gave up.
I'm still holding off on re-installing Norton Antivirus until I feel sure that any previous Norton stuff is gone. I'm suspicous that the SYMTDI.VXD thing might have something to do with Symantec.

 

At this point, I would uninstall the KAV and re-install Norton. That should fix the sym*** errors. The problem is that it's still trying to load the Norton drivers from, umm, I think it would be autoexec.bat, (where are the 98 guys? ) which may be where you need to look for the EZTEXT.dll entry also. Did you search the drive for the EZTEXT file?

No idea why you came up blank on the link. Just checked it to make sure, and it works fine for me. Still draw a blank for you? Still having problems with other links?

 

Well, I uninstalled KAV and tried to reinstall Norton. When the computer boots up, before Windows starts, a red box appears that says "Unable to load the Auto-Protect Windows agent. Logging and network alerting will be unavailable." I hit enter and the computer continues to boot. I still get the EZTEXT.DLL thing. I did a search for it in Windows Explorer. I found it in C:\IBMTOOLS. It was 39kb in size. Under Type it said Application Extension. Under Modified it said 4-22-98. This is an IBM Aptiva computer, for what that's worth. Also, while the desktop loads, a window appears titled Program. It appears empty, with 0 bytes.
Once Windows is done starting, Norton doesn't start. I try to open it through Start, Programs, Norton. I get a message that says I must restart the computer before running Norton. I do so, but I have the same result every time.
So, now that I have uninstalled KAV and can't get Norton to work, I seem to be leaving my in-laws with a computer that has no virus protection. Seeing as that is how all of these problems in this thread started way back when, I am now going to unplug the cable modem and go home and take a Tylenol.

Oh, by the way, I still couldn't get anywhere with Windows Update. If I don't start producing results, they might stop feeding me those nice dinners when I come over here!

 

Try uninstalling Norton again, then run SYMClean.

Reboot and re-install.

Please send me a copy of EZTEXT.dll here. Put Bucksone in the subject line.

 

I finally made it back her to the in-laws.

I uninstalled Norton. During the process, a window appeared. It was titled, Symantec Integrator. It said "Failed to unregister file types." I clicked OK. The process continued and it said I successfully uninstalled Norton Anti Virus. I rebooted.

The EZTEXT.DLL thing still appeared. The window titled Program did not.

I had problems clicking on the provided link to Symclean. I get an empty window with the globe still spinning and the hourglass present when I try to do anything that opens a second window in Internet Explorer. I read about others having this problem in the IE part of this forum. I tried the Internet Explorer repair thing in Add/Remove Programs. This didn't help. There were some lengthy-looking things to attempt to work this problem, but I was running out of time to stay here, so I tried Noahdfear's suggestion about right-clicking and pasting into the address bar, and got to the Symclean that way. Actually, the link took me to the directions page for Symclean, which said it was for versions of Norton prior to 2003. I ran it anyway. It said there was nothing for it to work on, and to continue to install my Norton.

During the re-installation of Norton Antivirus, a window opened that was titled "Microsoft Visual C++ Runtime Library." It said, "Runtime Error! Program:...\COMMON FILES\SYMANTEC SHARED\SCRIPT BLOCKING\SBSERV.EXE. Abnormal Program Termination." I clicked OK. At the end of the installation, it said, "Norton successfully Installed. "

I rebooted. My friend EZTEXT.DLL still appeared. The empty window titled "Program" with 0 bytes reappeared. I double clicked the Norton icon that was now on the desktop and got the message about having to reboot before using Norton. I right clicked the Norton icon on the task bar and could open the configuration window and configure everything, it seems, except Live Update. When I click on that, I get "Norton Antivirus Error Norton Antivirus has encountered an internal program error." The number 3005,597 is also in that box. A few minutes later, the Welcome to Norton Antivirus appeared. I tried again to run Live Update but it says "Live Update is already running or the Live Update Configuration window is open. Wait for it to finish or close configuration window. "

So, it appears that I have Norton Antivirus re-installed, but the virus definitions are from 2002 and I can't seem to update them. I am going to pull the plug again on their cable connection and go home now.

Oh, I will email that EZTEXT.DLL thing to you, Noahdfear, but I first emailed it to my address at home, then I will email it to you.

Thanks as usual.

 

The EZTEXT.dll is a legit IBM file. No idea what all is in that IBM Tools folder, but just for kicks try this.
Go to start>run and type regsvr32 C:\IBMTOOLS\s.....\EXTEXT.dll and hit enter. (make sure to leave a space after regsvr32) You should get a succeeded message. Reboot.

 

I have spent so much time on my in-laws' computer, with limited success. I'm considering backing up what I can and re-formatting their hard drive. Would this be an option worth considering to solve these problems?

 

Definately worth considering, but can't say what kinds of problems you might run into getting the proper drivers for everything loaded. Have you got the original installation disks?