topic Re: I have a virus that norton logs, but doesn't detect...HELP!!! in Norton 360

I have a virus that norton logs, but doesn't detect...HELP!!!

Watchlord — Mon, 07 Jun 2010 08:07:16 GMT

I was surfing facebook last night and all the sudden a fake antivirus thing pops up. This happens all the time so I thought it was no biggie and that Norton would handle it. Norton did nothing. Then I got a message from Windows UAC asking me to cancel or allow access to something, I canceled and then a message came up that said 'Nmyvk.exe has stopped working, Windows is attempting to find a solution". So the fake antivirus crashed after windows blocked access. (I clicked cancel before reading out of shock *facepalm*). So I continued surfing, but whenever I tried to load a webpage the page flashed grey and then the "Internet Explorer cannot display this webpage" page comes up. Windows still says I have internet access but I cannot access any web pages. (Live update can no longer connect either.)

I go looking through the security history to find that a program called 'ixvevvotssd.exe' and 'kquw' has made changes to my system and network. THANKS NORTON for not telling me. I go to look at what changes its made and...THANKS NORTON for not showing the end of the file path that has been modified. Norton will not show the entire path of the file that's been modified. Also I find that 'ixvevvotssd.exe' has created a Norton Firewall rule that allows Nmyvk(remember this guy?)TCP 54387 out and TCP 5555 in for that program...THANKS NORTON.

What I did:

-Moved ixvevvotssd.exe (was in C:/users/<my account>/appdata/nkedbjojj/ixvevvotssd.exe) and kquw.exe (I forgot where this was) to my desktop and scanned them. Norton did not detect any viruses...THANKS NORTON.

-Blocked firewall acesses for Nmyvk.

-Full system scan with no results...THANKS NORTON.

(I can't find anymore changes)

What I have:

-The two .exe files that caused the whole mess on me desktop.

- Windows Event Viewer log files that show the info on when Nmyvk crashed after I cancel its UAC notification.

Persisting Problem

-I rubben nortons nose in a virus and it still doesn't detect the virus.

-Live Update doesn't connect.

-Internet Explorer 8 flashes grey and then gives a "Internet Explorer cannot display this webpage" page despite windows saying there is internet access.

I would give you screenshots, files, etc. but the virus is keeping my desktop computer from accessing the web.

Windows 7 Prefessional x64

Norton 360 Premier Edition

Internet Explorer 8

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Watchlord — Mon, 07 Jun 2010 08:36:26 GMT

UPDATE: I got internet access back up on the infected computer. I found that the virus set Internet Explorer to use its own host computer as a proxy on port 5555.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Turbo — Mon, 07 Jun 2010 09:53:58 GMT

I go looking through the security history to find that a program called 'ixvevvotssd.exe'

If you see a random string of gibberish ending in tssd.exe it is very likely related to the rogue Antispyware Soft, further evidence is that your IE proxy settings were changed. You can view additional information and get removal instructions here: BleepingComputer

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Marjan — Mon, 07 Jun 2010 10:07:39 GMT

I had the very same problem and shut down the proxy server. Problem solved, thanks!!

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

floplot — Mon, 07 Jun 2010 15:08:59 GMT

Hello Watchlord

Welcome to the Norton Users Discussion Forum

Very often that rogue security program comes along with a rootkit. I would strongly recommend a visit to www.bleepingcomputer.com and sign up with them and put possible rootkit in the topic. It is a free site with a very good reputation with removing malware such as this. Very often Norton can not remove the rootkits because critical windows drivers become infected and if removed, your computer will become involved in a bootup cycle or worse. These types of removals require replacement with a good version of the driver and it could be different drivers every time. Bleeping Computer has the right type of environment to help you get this done in a safe manner.

Please come back and let us know how you made out after you have consulted with them. Thanks.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Watchlord — Mon, 07 Jun 2010 16:41:09 GMT

@ Turbo: Thanks! That is the exact thing that hit me, even the screenshot was accurate. I deleted the registry keys it listed (only a few existed). Also today when I logged on Norton finally recognized the two .exe files as SpywareGuard2008 and took about 30 min to proccess the 1st one. It showed that norton repaired and deleted a load of files and registry keys.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

floplot — Mon, 07 Jun 2010 21:06:08 GMT

Hello Watchlord

Although you have fixed 2 programs like Spyware Guard 2008 and that other one, I would still pay a visit to www.bleepingcomputer.com to check out to see if you have a rootkit in your system. The secondary infections may have been cleaned up, but the fact that you got 2 of this type and it ending with tdss, it is very likely that you do have a rootkit which needs to be checked out by Bleeping Computer. They will give you programs to run to check to see if you do have a rootkit. If you don't have one according to their tests, then nothing lost. If you do have a rootkit, they can help you clean it up. It's a free site and they are good at what they do. There may still be an infected driver which is causing these programs to download to your computer.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Watchlord — Mon, 07 Jun 2010 22:20:07 GMT

Thank you I will be sure to check that out.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

TylerDurden — Tue, 08 Jun 2010 00:51:08 GMT

Have you tried Norton Power Eraser? It's FREE and worth a shot. Available at http://security.symantec.com/nbrt/npe.asp

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Watchlord — Tue, 08 Jun 2010 04:06:17 GMT

Why would this work better that N360 which costs money?

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

delphinium — Tue, 08 Jun 2010 07:10:35 GMT

Norton was able to delete the infected rootkit files. Unfortunately, if the files, which are often crucial Windows system files, are deleted instead of exchanged for uninfected files, the machine often becomes unbootable. To prevent this, Norton products, probably Power Eraser as well, were changed to stop any deletions, and to require manual removal of the infection.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Turbo — Tue, 08 Jun 2010 08:31:37 GMT

Hi delphinium,

Not certain why you are assuming that the OP has a rootkit, in message 7 of this thread floplot incorrectly identified a file name on the users system as ending with TDSS when the OP clearly stated several times that the file name ended with TSSD. The difference is crucial, one is a rootkit, the other is just a rogue. If you click on the link in my first post in this thread you will see that bleeping computer classifies the file name ending in TSSD.exe as a rogue, not a rootkit. While it is possible that the OP could have a rootkit, I don't see how you can say that with certainty at this point.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

floplot — Tue, 08 Jun 2010 16:52:39 GMT

Hello Turbo

I was referring that many times the rogue Antispyware Soft comes along with a rootkit. I wasn't referring to the file, well didn't mean to if I did. I was trying to make the point that since he had 2 infections like that, a visit to bleeping computers would determine if indeed he had a rootkit or not.

First he had Antispyware soft and then he got Spyware Guard. I like to be on the safe side and would take the time to go to Bleeping Computers just to check to see if there was a rootkit involved. No harm done if there is no rootkit involved, but can be a life saver if there is one.

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

Quads — Tue, 08 Jun 2010 21:35:42 GMT

floplot wrote:

First he had Antispyware soft and then he got Spyware Guard.

No Norton detected the 2 "Antispyware Soft" files as "Spyware Guard 2008" (part of that family).

As for the time it took for Norton to process the files (30mns) that seems really long, although this would be because Norton would be checking for OLDER variants listed in the definitions for Spyware Guard 2008, all the files and registry entries etc.

Although Norton would not have found all of them, except if the Phantom objects problem occurred, and listed objects that didn't actually exist.

Quads

Re: I have a virus that norton logs, but doesn't detect...HELP!!!

delphinium — Tue, 08 Jun 2010 22:18:00 GMT

Turbo:

It was a generic answer to a generic question, not a diagnosis.