Norton Internet Security / Norton AntiVirus

[Musashix]

I'm using Symantec Endpoint Protection, but this was given to me by the university I go to, so I couldn't make a business account.

I've read some other things on what other people have done, but it seems like the steps that need to be taken depends for each person. Any help would be greatly appreciated.

http://img33.imageshack.us/img33/5372/tidserv.jpg

[Quads]

Symantec AV should not be asking for a Restart, to remove these files as it looks like it's TDL4 that has infected a Windows OS driver.

Quads

[Musashix]

So, what can I do to get rid of this permanently?

[delphinium Norton Fighter]

You will need to join the line at www.bleepingcomputer.com  This is a free malware removal forum that has experience dealing with TDL3/TDL4 rootkits.  Put the name of the infection found in the header of your first post.  Do not allow any more restarts.

[Musashix]

Thank you very much! I'll make sure to come back here and let you know if it works out.

[cgoldman]

---

Musashix wrote:

I'm using Symantec Endpoint Protection, but this was given to me by the university I go to, so I couldn't make a business account.

I've read some other things on what other people have done, but it seems like the steps that need to be taken depends for each person. Any help would be greatly appreciated.

http://img33.imageshack.us/img33/5372/tidserv.jpg

---

This message is posted having regard to the following statement which you are kindly requested to read first.
http://community.norton.com/t5/Forum-Feedback/Statement-of-contribution-by-cgoldman/m-p/215993#M5047

An important system file has been infected and cannot be repaired by your AV product. It requires manual intervention.

The infected file has been identified as netbt.sys. This file will have to be replaced and the usual method is by using the original operating system cd/dvd. You can refer to the following instructions

http://www.symantec.com/security_response/writeup.jsp?docid=2008-111113-1112-99&tabid=3

If this is unfamiliar territory then perhaps your Uni IT department can assist.