Norton Power Eraser

Overview

Norton Power Eraser is a powerful free removal tool that may help you clean up certain types of difficult to remove security risks. If a program has hijacked your computer and you are having difficulty detecting or removing it, Norton Power Eraser may be able to clean your computer.

Norton Power Eraser includes detection and removal capabilities for security risks that impersonate legitimate applications (for example, fake antivirus software), often known as "scareware", "rogueware" or "scamware". The tool uses aggressive techniques to detect malware, so there is a risk that it could flag certain legitimate programs for removal. You should carefully review the scan results page before removing any files.

Accessing Norton Power Eraser

Navigate to http://security.symantec.com/nbrt/npe.aspx to download the latest version of Norton Power Eraser from Symantec servers.

Scanning and Cleaning with Norton Power Eraser

You do not need to install Norton Power Eraser. When the download is complete, just double click the icon on your desktop and the tool will start. You will need to accept the End User License Agreement before running a scan.

Scanning and Cleaning with Norton Power Eraser

To run a scan, click the "Scan" button to perform a complete system scan.

Scanning and Cleaning with Norton Power Eraser

When you run a System Scan, you have the option of including a scan for rootkits. If you need to remove a deeply embedded threat, include the rootkit scan as it provides the greatest chance of detecting and removing such threats. The Include Rootkit Scan option restarts your computer and proceeds with the scan after you log back in. If you are not concerned about detecting rootkits or prefer to skip the restart process, click Continue to proceed with a basic scan.

Scanning and Cleaning with Norton Power Eraser

Scanning your system may take several minutes. The scan progress screen displays the items being scanned. Once scanning is complete, to get more information about an item on the list, click the risk's name.

In the initial scanning pass, NPE will use various heuristics to detect potential threats on your system. This is known as a Local Scan. You will be presented with the scan results and given the option to either fix (remove) detected files or to run an additional Remote Scan. Symantec recommends fixing any risks that come back with Local Scan results of “Bad”.

A Remote Scan will upload files to Symantec servers for further analysis and is recommended for any “Suspicious” files before deciding whether to fix them. To initiate a Remote Scan, click the “Scan” button next to any file in the scan results screen. Norton Power Eraser will automatically check the “Fix” box next to files it believes should be removed from your system.

Symantec recommends performing a Remote Scan on any “Suspicious” files before deciding whether to fix them.

Scanning and Cleaning with Norton Power Eraser

After you run a Remote Scan on risks, the Remote Scan column indicates if any of these files are known as bad by the Symantec servers. You may select those risks you want to remove and click Fix. If a file appears under the Suspicious heading tagged as “Not a known threat,” be very cautious about removing it. It might be a legitimate file.

Scanning and Cleaning with Norton Power Eraser

When you click a risk name on the list, you can see the reputation details of this file. Those details include:

• Whether the file is signed from a trusted vendor.
• When the file was created on your system.
• When it was last used.
• If it starts automatically when you start your computer.
• How many users use the file within the Norton Community. In general, a file that is used by many users is less likely to be suspicious than a file used by only few users.
• When the file was seen in the Norton community for the first time. In general, recent files are more likely to be suspicious compared to older files.
• The trustworthiness of the file.

Click Back when you are done reviewing the information.

Scanning and Cleaning with Norton Power Eraser

Once you have reviewed the results and clicked Fix, Norton Power Eraser begins the removal process. By default, a system restore point will be created so you can revert any actions taken by Norton Power Eraser. Make sure you have System Restore enabled on your computer.

You must restart your computer to complete the process and remove the risks. You will see a screen after restart confirming that the security risks have been removed.

Settings

If you click Settings on the main Norton Power Eraser screen, a Settings screen will appear, giving you the option to setup a network proxy, adjust log settings or scan other (inactive) operating systems found on this computer.

If you wish to scan an inactive operating system, check this box and click the Ok button to scan for other installed Microsoft Windows operating systems. If you wish to scan the current (active) operating system, make sure this checkbox remains unchecked.

Note that if you choose to delete log history, you will not be able to undo any previous Norton Power Eraser fix sessions. Click Ok or Cancel to return to the main screen.

Settings

If your environment requires that you use a network proxy for Internet access, you may configure standard proxy settings on this screen.

View Scan Logs

During every System Scan, Norton Power Eraser creates a log of important system information such as:

• Operating system present on the computer
• Installed drivers
• Processes and the services running on the computer
• Startup items
• Browser plug-ins
• Files detected as risks and the actions taken

To see the log, click the View Log link at the bottom of the screen. The log is in XML format, so for best results, you should use an XML viewer.

Restoring a Previous Session

To restore previously removed files, click the “REVIEW” button found on the main Window.

Restoring a Previous Session

To help determine which session you want to undo, click "View" next to a session’s description to see the log for that session. Once you have selected the session that you want to undo, click Next to see the details.

Restoring a Previous Session

All the items that were removed in the selected session are listed, along with the type of item each one is.

To undo this session and restore the deleted items, click Undo.

All the items in the session will be restored. If you want to remove some of the newly restored files, run a scan and select only those files for removal.

Running Norton Power Eraser from the Norton Bootable Recovery Tool

If you are an existing Norton customer, you may also access Norton Power Eraser by creating bootable media containing the Norton Bootable Recovery Tool. The benefit of running NPE in this fashion is that the Norton Bootable Recovery Tool environment enables NPE run outside of Microsoft Windows, which may be your only option if your computer won’t boot into Windows and otherwise may improve malware removal results.

For detailed instructions on downloading and creating Norton Bootable Recovery Tool media, refer to this page: http://security.symantec.com/nbrt/nbrt.aspx. Once you’ve created bootable media and started your computer in the NBRT environment, you will be presented with a screen that offers two scanning options. The recommended first step is to run a Norton Power Eraser Recovery Scan. You must have a wired Internet connection to use this option from within NBRT. When you click this option, NBRT will proceed to download the latest version of NPE from Symantec servers.

Running Norton Power Eraser from the Norton Bootable Recovery Tool

Once the latest version of Norton Power Eraser has been downloaded, it will automatically run. After accepting the EULA, you’ll be presented with the main Norton Power Eraser scan screen. One difference when running from this bootable environment is that when clicking the ‘Scan’ button, you’ll be presented with a sub-menu of local operating systems to scan. Once you choose the operating system you wish to scan, the scan will proceed immediately without the restart (rootkit scan) option being presented. All further steps and functionality match NPE on an active operating system.