Norton Internet Security / Norton AntiVirus

[Calls]

I posted somthing similar earlier, but that thread went on a tangent, so reposting here with follow up questions

Vista Home Premium  32 bit Service Pack 2

IE7 browser      NAV2008   DSL connection

about a week ago was browsing yahoo site ( I was not attempting a download of anything from the yahoo site)and received a Norton pop up indicating a security action.

Nortonreported that

Auto-Protect has detected Trojan.Pidief.G

Status: Blocked

Recommended Action: Resolved-No action

So I'm thinking that the nasty was blocked before it was able to enter my system. However, the Norton notification also indicated

File Name/Affected Are as

C:\Users\MyPC\AppData\Local\Microsoft\Windows\TemporaryInternetFiles\Low\Content.ie5\13uls7th\ohdef02cv5000f07006rd9f71410t96c70708kedbe8917[1].pdf

But I show nothing in my quarantine history. if a file/affected area is indicated, shouldn't there be something in quarantine?

When I try to find that "file" I can only go as far as content.ie5 and then when I open that up, I see nothing there indicating such

I know some have had similar issues where they were attacked by a Trojan.Pidief.G , but they have files quarantined. I'm concerned that there were no quarantined files in the attack on me.

maybe I'm not understanding auto-protect? My sense is that it blocked it from getting into my system, but then why does it show an affected area/file?

Now under security history under Norton Community watch it does show a "statistical submission" of the file noted above. But again, why is there a file if it (Trojan)was blocked at point of contact?

So:

1. Was this already in my system and trying to activate?

2. Was it blocked by auto-protect because it was trying to get ON my system?

3. Why is there an affected area noted, but nothing in my quarantine folder?

4. What actions to I need to take? Or is this  resolved already? ( I have deleted temp internet files)

[reese_anschultz · Accepted solution]

---

Calls wrote:

[...]

1. Was this already in my system and trying to activate?

2. Was it blocked by auto-protect because it was trying to get ON my system?

3. Why is there an affected area noted, but nothing in my quarantine folder?

4. What actions to I need to take? Or is this  resolved already? ( I have deleted temp internet files)

---

1. No, you probably clicked on a link to the PDF file and IE was trying to show you the page.

2. Yes, it was blocked as it was being written to the disk. IE downloads all pages onto disk before displaying them to you.

3. Some malware detections simply delete the file. This may be one of the signatures that does that.

4. The recommended action says, "no action" -- you don't need to do anything.

[Floating_Red]

As Reese points out, the Threat was Blocked, and this means that the Trojan was never actually on your system, which is why it is not listed in Quarantine because it was Blocked from Creating the Files on your system.

[Calls]

I think I understand, except why did it note

File Name/Affected Are as

C:\Users\MyPC\AppData\Local\Microsoft\Windows\TemporaryInternetFiles\Low\Content.ie5\13uls7th\ohdef02cv5000f07006rd9f71410t96c70708kedbe8917[1].pdf

 because that is where it tried t come in?

[delphinium Norton Fighter]

2. Yes, it was blocked as it was being written to the disk. IE downloads all pages onto disk before displaying them to you.

---

Reese already answered this question.