Yes I think SONAR did manage to remove it at that time but the virus keep coming back again and again.
If I am not wrong, SONAR will only detect the virus if it detected the virus having System Activity, it won't delete the other files that support the virus itself. What I mean by the other files are the files that can generate the virus again and again and yet they won't expose themselve at System Activity and get detected by SONAR.
That's right, Sonar uses a specific algorithm to detect suspicious activity in running processes, it cannot detect dormant threats waiting to launch themselves onto your system. That's where auto-protect comes in, but only when the infected files (and then only if recognized directly, or indirectly by previously learned characteristics, in the Norton definitions base) are attempted to be accessed or launched.