Norton Power Eraser - Aggressive Scareware Scan & Removal

Dealing with Persistent Scareware Infections

I encounter a wide variety of computer infections regularly. Occasionally, an infection is so recent that standard antivirus software fails to recognize it. Many of these problematic infections are categorized as scareware.

These malicious programs infiltrate systems through various methods, exploiting existing system weaknesses and vulnerabilities. Once inside, they falsely report infections, prompting users to purchase unnecessary and often harmful removal tools. I’ve even observed instances where users were led to believe their files were encrypted, demanding payment for decryption – a deceptive tactic.

To combat these threats, Symantec has created a specialized tool designed to identify and remove these types of infections. This tool is known as Norton Power Eraser.

Understanding Norton Power Eraser

Symantec characterizes its application in the following manner:

Norton Power Eraser is engineered to tackle difficult-to-detect crimeware, commonly referred to as "scareware" or "rogueware." Cybercriminals employ this type of software to mislead users into downloading threats onto their computers. This growing trend utilizes deceptive pop-up alerts and security messages, instilling fear and prompting immediate action.

It’s important to note that this tool should be utilized as a final option, after all other remediation attempts have been exhausted. This is because it can generate a significant number of false positives. Its aggressive nature carries the potential to disrupt legitimate applications. However, if a system is nearing the point of reformatting, it represents a valuable last-ditch effort.

Upon downloading and executing the 5.28MB installer, a screen similar to the one below will appear, offering options to scan for risks or review and undo previous repairs.

Scanning and Repair Options

Selecting the orange scan button presents two distinct scanning choices: a full system scan or a scan of a specific directory.

I opted to scan a specific directory in this instance.

When dealing with a heavily infected machine, I often remove the drive and connect it to a clean computer using an IDE to USB adapter. This allows me to scan the entire C:\ drive without booting into the compromised operating system. I would then select the drive from the file browser and initiate the scan.

In this case, I selected the D:\ drive and observed a scanning your computer message as the process began.

Upon completion, the tool displays its findings.

Any identified "˜Risks', as the tool terms them, are presented in a list format.

Users can then select the checkboxes next to each identified risk and click the fix button to initiate the removal process. The option to create a system restore point before applying changes is also available.

This feature is particularly useful when scanning machines where operating system files or the registry have been corrupted. Correcting these issues can sometimes introduce further complications, and the ability to revert to a previous state is invaluable. It’s always prudent to have a backup.

Additional Resources

You can also explore this article on removing viruses at home. Furthermore, if your system fails to boot, Symantec offers another tool for assistance. I plan to test this tool and will share my experiences when possible.