04-11-2011 12:40 PM - edited 04-11-2011 01:16 PM
I ran a NPE-Beta scan and it found no problems but itself. I'm suspicious of a problem because I clicked on a google image that redirected me to something that used 99% of one of my CPUs. Norton IS 11 gave a pop-up at the time that Firefox was using 99% of my CPU but did not find the virus/trojan or whatever it was that was doing it. So I downloaded NPE-Beta and ran a scan and found it strange that it found itself. NPE-Beta.exe (bad) was the find. I didn't use it to delete it as I figured that was impossible. I re ran the scan and it didn't show up the second time. Is this wierd or what?
I ran all the free spyware programs I could find and nothing found anything. I keep getting medium alerts in Norton that my conhost or system32\mrt is trying to target various Norton Internet Security Engine\18.1.0.37 etc.
I restored to a point before I clicked the google image virus... then I did a full factory restore then I did a restore to disk image after that using DVD's I made when I first got the computer. After all these restores/factory resets.. I ran the Norton Power Eraser Beta and it found itself. I'm still getting the medium alerts that various windows processes are trying to access Norton IS Engine. Pretty sure I haven't solved the problem yet - either that or there was no problem. However after clicking on that google image I got a huge influx of medium alerts from Norton about processes trying to access various places. Also I would notice strange flashes on my screen when I went to save things. The save window would appear for a split second in the upper left corner of the screen and then move down to where it usually is. Not a big deal but this didn't happen before the google image virus. Then after all the restore I found it odd that Norton Power Eraser beta would find itself as the only problem on my computer and recommend deleting itself... Wierd right?
04-11-2011 01:15 PM - edited 04-11-2011 01:19 PM
Just did another scan in safe mode. This time NPE is finding C:\windows\system32\drivers\SMR162.sys to be a problem. Should I delete this? Why does NPE keep finding Norton Applications that are supposedly bad?

C:\Windows\system32\drivers\SMR162.SYS
____________________________
____________________________
Signature:
Not Available
Installed:
Not Available
Startup Item: No
____________________________
____________________________
UNKNOWN
Number of users in the Norton Community that have used this file: Unknown
____________________________
UNKNOWN
This file release is currently not known.
____________________________
UNKNOWN
There are no indications about this file.
____________________________
____________________________
Threat Details
File: C:\Windows\system32\drivers\SMR162.SYS
Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic
____________________________
04-12-2011 01:16 AM
Hi tarawe25,
I've sent you a private message, asking you for logs. If you can get us the logs, it may help us find out what's going wrong.
Thanks.
04-12-2011 04:05 AM - edited 04-12-2011 04:07 AM
As far as I know smr*.sys is "Symantec Maximum Repair" driver which is needed in order to remove files and registry keys until boot phase.
