[dencorso]

That may well be the case. If so, provided you have an image of the partition from before your 1st attempt, I'd suggest you redeploy the said image and try again as per your latest trial, which sure does comply in every aspect with my own experiment. The rationale for this present suggestion is that if it stored somewhere the info the certificate is expired, that place must be either the registry or (less probably) some other file inside the same partition... which an image redeployment would perforce remove. Good luck!

[submix8c]

Looks like (nearly identical) to what's available on the FTP -
ftp://ftp.symantec.c.../removal_tools/
Linked to from here -
https://www-secure.s...0080710133024EN

Quote

This document is for Norton products downloaded from your service provider.

For NOT from Service Provider -
https://www-secure.s...0080710133834EN
You must pick a product... - same products though... and gives same link.
There's a comment here as well (would prevent services/processes from running) -
http://community.nor...p/109722/page/2

Quote

I would boot into Safe Mode and run NRT once and reboot to safe mode and rerun again. After that, delete any folders that are named Symantec or Norton. Before deleting, change the options so you can view hidden files and folders (Explorer > Tools > Folder Options > View and apply to all ).

Norton_Removal_Tool_9x.exe
2007.2.0.14

Quote

Welcome to Norton Removal Tool
This tool will remove ALL copies of:
- Norton AntiSpam 2004 and 2005
- Norton AntiVirus 2003 through 2007
- Norton Ghost 2003, 9.0, and 10.0
- Norton GoBack 3.1 through 4.2
- Norton Internet Security 2003 through 2007
- Norton Password Manager
- Norton Personal Firewall 2003 through 2006
- Norton SystemWorks 2003 through 2006
- Norton Confidential Online 2007

Here's something interesting though... Unpacked with WinRAR/UniExtract, it gives a file named "all.cpr" that lists everything that it deletes/services/etc-etc. Be aware that it appears that some fields are "<stringvalue>". Sadly, you would have to manually perform all of the operations within (stop services/processes/etc).

edit - also found this with a different set of procedures and files (BAT/REG/Manual Delete) to "get rid of" Norton/Symantec (the links inside work as well) -
http://filesharingta...pletely*-safely

HTH

This post has been edited by submix8c: 22 January 2013 - 11:06 AM

[dencorso]

One idea: look for and delete the key HKLM\Software\SYMNRT and all subkeys and values under it. Then disconnect the internet, reset the bios date and try again.

[jds]

submix8c, on 22 January 2013 - 10:38 AM, said:

Looks like (nearly identical) to what's available on the FTP -
ftp://ftp.symantec.c.../removal_tools/
Linked to from here -
https://www-secure.s...0080710133024EN

Quote

This document is for Norton products downloaded from your service provider.

For NOT from Service Provider -
https://www-secure.s...0080710133834EN
You must pick a product... - same products though... and gives same link.

Yep, I have versions 2007.2.0.11 (2007/1/12) and 2007.2.0.14 (2008/2/9). They both exhibit this expiry problem.

submix8c, on 22 January 2013 - 10:38 AM, said:

There's a comment here as well (would prevent services/processes from running) -
http://community.nor...p/109722/page/2

Quote

I would boot into Safe Mode and run NRT once and reboot to safe mode and rerun again. After that, delete any folders that are named Symantec or Norton. Before deleting, change the options so you can view hidden files and folders (Explorer > Tools > Folder Options > View and apply to all ).

Humbug! If you run the tool in Safe mode, it tells you it won't run in Safe mode.

submix8c, on 22 January 2013 - 10:38 AM, said:

Norton_Removal_Tool_9x.exe
2007.2.0.14

Quote

Welcome to Norton Removal Tool
This tool will remove ALL copies of:
- Norton AntiSpam 2004 and 2005
- Norton AntiVirus 2003 through 2007
- Norton Ghost 2003, 9.0, and 10.0
- Norton GoBack 3.1 through 4.2
- Norton Internet Security 2003 through 2007
- Norton Password Manager
- Norton Personal Firewall 2003 through 2006
- Norton SystemWorks 2003 through 2006
- Norton Confidential Online 2007

Here's something interesting though... Unpacked with WinRAR/UniExtract, it gives a file named "all.cpr" that lists everything that it deletes/services/etc-etc. Be aware that it appears that some fields are "<stringvalue>". Sadly, you would have to manually perform all of the operations within (stop services/processes/etc).

edit - also found this with a different set of procedures and files (BAT/REG/Manual Delete) to "get rid of" Norton/Symantec (the links inside work as well) -
http://filesharingta...pletely*-safely

Checked those alternative procedures, downloaded the files, turned out to be for NT only, not compatible with W9X.

dencorso, on 22 January 2013 - 08:06 PM, said:

One idea: look for and delete the key HKLM\Software\SYMNRT and all subkeys and values under it. Then disconnect the internet, reset the bios date and try again.

Den, you're a genius! Thank you.
That was the missing piece of the puzzle - SAV is now vanquished!

Joe.

[submix8c]

Running Norton_Removal_Tool_9x.exe for Dummies:
(it must be Version: 2007.2.0.14, MD5: 316B61CE6F827A8EE48944E5B076F37C, SHA-1: BC6F1C1EB7DCD4FA88A2F8C861A492F36A73C047,
CRC32: 5FB68354, Digitally Signed by Symantec Corporation, with a VeriSign Class 3 Certificate valid from 10/30/2007 to 11/24/2010)

1 - Disconnect the machine physically from the internet.
2 - Run REGEDIT and delete (if exists) "HKLM\Software\SYMNRT"
3 - Reset the machine date to some day (e.g. 19) in January, 2009.
4 - Shut Down/Turn Off the machine.
Note: This is an "insurance" step to enusre everything "sticks".
5 - Turn the machine on.
6 - Boot Win9x.
Note: If it runs Scandisk or NDD, abort the scan
or it'll find many "wrong dated" files.
7 - Once at the desktop, run Norton_Removal_Tool_9x.exe.
8 - Reset Date to Current.
9 - Repeat Steps #4 thru #6
Note: Ignore #6 Note as the Date has been Reset (#8).
Done!

Nothing will be installed.
The Norton_Removal_Tool_9x.exe is stand-alone.
It removes all Norton products except Norton CrashGuard,
which it didn't touch.

Additional Notes:
Step #3 may be instead performed after #5 in the BIOS.

====

Does the above cover it?

Odd that it doesn't self-clean (ref. "all.cpr") and has the NERVE to insert REG Keys/Values. Still, that file DOES have everything listed that it performs/cleans.

This post has been edited by dencorso: 23 January 2013 - 03:12 PM

[dencorso]

jds, on 23 January 2013 - 02:52 AM, said:

That was the missing piece of the puzzle - SAV is now vanquished!

Yay!

@submix8c: Great how-to, thanks!
I've added some info, because the date selected in step 3 must fall in between the vallid dates of the certificate.

[dencorso]

Bumping just to call attention to two interesting Symantec KB documents I've found:

Manually Uninstalling Symantec AntiVirus 9.x from Windows 98/Me
Manually Uninstalling Symantec Client Security 2.0 from Windows 98/Me

@jds: It might be interesting to give a look in all of those places, since SAV is not officially indicated as one of the packages the NRT_9x removes.
Who says you won't find up some leftovers lurking in some obscure nook or cranny?

[JorgeA]

Go figure -- Avast 4.8 updated twice today (at 6:30 AM and 10 PM) on one of my Win98 systems. (The other one is offline, but I'll turn it back on to see what happens.)

--JorgeA

[CharlotteTheHarlot]

( Sorry, I forgot to post this from about three weeks ago )

UPDATE: Success using DATs v6883 and v7040 with McAfee v6 on Win9x.

• See above Post #40 for the first time I tried this using DATs v6346 ( has detailed instructions ).
  
• See above Post #57 when I tried it again using DATs v6511.
  
• See above Post #65 when I tried it again using DATs v6845.

Strangely, just three days after I downloaded the 6883 DATs, they updated the FTP servers with 7040, ( only 6883 downloads are shown here ). Note that the time/dates shown for these files reflects the download and extraction. The three downloads that I found ...
- 2013-04-06 ... 14:40 ... 110,494,296 ... 6883xdat.exe
- 2013-04-06 ... 14:42 ... 108,612,096 ... Avvdat-6883.tar
- 2013-04-06 ... 14:43 ... 116,296,064 ... Sdat6883.exe

As has been the case, all three packages contain the same three DAT definition files.

This was 6883 ...
- 2012-11-01 ... 01:40 ....... 727,193 ... Avvclean.dat
- 2012-11-01 ... 01:40 ....... 489,337 ... Avvnames.dat
- 2012-11-01 ... 01:40 ... 107,382,892 ... Avvscan.dat

And here is 7040 ...
- 2013-04-09 ... 06:40 ....... 749,177 ... Avvclean.dat
- 2013-04-09 ... 06:40 ....... 534,921 ... Avvnames.dat
- 2013-04-09 ... 06:40 ... 103,458,908 ... Avvscan.dat

As described previously, just strip the "AVV" prefix from the default filenames and replace CLEAN.DAT, NAMES.DAT and SCAN.DAT. Note that the SCAN.DAT actually got smaller between the last two versions.

The McAfee scan engines contained in the SDAT package still hasn't been changed ...
- 2009-07-31 ... 06:40 ..... 3,182,712 ... Mcscan32.dll
- 2009-07-31 ... 06:40 ..... 4,706,936 ... Mscan64a.dll
... so I updated no other files beyond the three DATs.

As before, it took a long time for McAfee to initialize and load the DATs, approximately 3 minutes at 2.6 GHz ( likewise when I changed directories to test scan some known infected files ). But all went well and McAfee scanned files and folders successfully once again.



See in the screenshot that the main executable McAfee file is VSMAIN.EXE v6.01.2000.1 is dated: 2001-11-16. Over 11 years old.

P.S. Maybe the OP should change the title to: Windows 9x/Me Security Thread for 2011 ... 2012 ... 2013 ( or just leave off the date! )

[JorgeA]

Both of my Windows 98 systems (one SE, one FE) have Avast! "virus recovery database" dated 4/29/13.

--JorgeA