Date: Wed, 02 Nov 2005 20:01:27 +0000
From: "alex cottle" <eddie5659@...mail.com>
To: bugtraq@...urityfocus.com
Subject: Norton Unerase - Need Contact


Hiya

Read these all the time, and decided to post at last :o)

Thing is, its a well known flaw with Norton Unerase, and Norton don't have a 
fix yet. However, a user in a forum has been having this exact same problem, 
and we may have resolved it. However, I've tried to contact Norton but no 
reply from 2 months ago, so may have the wrong email address.

So, I'll post what we've done, and hopefully someone from Norton is 
watching, and can prove this works or not:


Regarding this document:

http://service1.symantec.com/support/nsw.nsf/ba62122e5d142a6588256d87006b22be/8e1d3cad4e49af6a85256c370048ada8?OpenDocument&src=bar_sch_nam

A user had problems with this, and as the above document is unresolved, we 
started working on it:

http://forums.techguy.org/showthread.php?t=391275

if you can't see or look at that link, this is what we found out, so maybe 
it will help:

For the Norton error, this is what was listed under the Application log 
(WinXP, SP2, fresh install):

"Faulting application NPROTECT.EXE, version 16.0.0.22, faulting module 
ntdll.dll, version 5.1.2600.2180, fault address 0x0001a47d".

Category shows(100).Event ID shows 1000.

Copies of ntdll.dll:

ntdll.dll c:\WINDOWS\$NtServicePackUninstall$
ntdll.dll.000 c:\WINDOWS\$NtServicePackUninstall$
ntdll.dll c:\WINDOWS\$NtUninstallQ815021$
NTDLL.DLL c:\WINDOWS\I386
ntdll.dll c:\WINDOWS\system32
NTDLL.DLL c:\WINDOWS\I386\SYSTEM32
ntdll.dll c:\WINDOWS\ServicePackFiles\i386

-----------

However, this is how he seemed to have resolved the issue in question:

"My drives are partitioned "C" & "D". I ran a search on Recycler for both 
drives after unhiding all hidden files, folders etc and discovered a folder 
named NPROTECT in each drive and two folders with identical names 
S-1-5-21-1163395192-2704639424-2437969446-1004 in each drive containing the 
recycle bin files. Somehow or another these folders had duplicated and all 
the recycle bin files were also duplicated. I tried deleting one of the 
duplicate folders and files in each drive but kept getting an error message 
preventing me from doing so. I then tried deleting the other identical 
folder in each drive and had success with that. I then went back to the 
folder I couldn't delete and deleted the files with this folder. This worked 
and immediately freed up space in my "D" drive. Not sure whether this was 
going to be the final solution to the problem so I did a defrag on both 
drives, a scan and clean up and since then everything seems to be working 
fine - no more error messages, the recycle is working OK and I'm able to 
delete as when I want."



I hope this can offer some light on the subject, as we're hoping there is a 
solution to this problem, in case others have the same.

Kind Regards

eddie

Powered by blists - more mailing lists