• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

e1dc.73dd8

Constantly, Norton is telling me this file is trying to send info out from my computer. I have deleted it and it comes back. I have searched the net and found nothing. Period...

Anyone have any idea what this could be?

Asus/Win10. It's in App/Data/Local/f7ac/e1dc.73dd8

c:\users\bryan mcglothin\appdata\local\f7ac\e1dc.73dd8
____________________________
____________________________

                                        Developers
                                        Not Available
                                    

                                        Version
                                        Not Available
                                    

                                        Identified
                                        3/13/2017 at 2:30:50 PM
                                    

                                        Last Used
                                        3/20/2017 at 12:03:06 PM
                                    

                                        Startup Item
                                        Yes
                                    
____________________________
____________________________
UNKNOWN
Number of users in the Norton Community that have used this file: Unknown
____________________________
UNKNOWN
This file release is currently not known.
____________________________
UNPROVEN
There is not enough information about this file to recommend it.


____________________________
____________________________

                            Threat Details
                            File Location
                        
File: c:\users\**********\appdata\local\f7ac\e1dc.73dd8 Registry Key: HKEY_USERS\S-1-5-21-4107298426-3321156971-469087235-1001\Software\Microsoft\Windows\CurrentVersion\Run\"\x00rjgyv" Registry Key: HKEY_USERS\S-1-5-21-4107298426-3321156971-469087235-1001\Software\Microsoft\Windows\CurrentVersion\Run\"\x00rjgyv"
____________________________

File Thumbprint - SHA:
28E9E5F25AF7F1E36298CBDDFFF533B71E9C77A62DC1CC7D8F78689A4C5A2DCA
____________________________

Thank you in advance,

Bryan

Replies

Kudos0

Re: e1dc.73dd8

You have marked NPE as a label. Have you run NPE on your system, and did it find anything?

Try running a full system scan with your Norton Security product in Safe Mode.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: e1dc.73dd8

I did run NPE every time and it finds nothing. I have clicked the link to upload to the Norton Cloud and I get nothing back. I have not tried running a scan in Safe mode.

Thanks!

Kudos0

Re: e1dc.73dd8

Let us know if a Safe Mode scan find/fixes anything.

How is Norton telling you it is trying to send information out?

The last used date in your first post shows March 20, 2017. Is it still being sent out?

Maybe you should contact Norton Support and ask for the Virus Protection Promise. They can remote into your system and check for something deeper than NPE can find.   www.norton.com/contactcs

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: e1dc.73dd8

Scan in safe mode only found tracking files. This morning Norton popped up again say this file is trying to send info from my computer.

THIS IS WEIRD!!! So I went to the file location and deleted the file. It keeps popping back up in the folder about 4 seconds later. I'm not a computer guy, but I've never seen this happen!

From Norton Power Eraser:

"c:\users\*************\appdata\local\f7ac\e1dc.73dd8
____________________________
____________________________

                                        Developers
                                        Not Available
                                    

                                        Version
                                        Not Available
                                    

                                        Identified
                                        3/13/2017 at 2:30:50 PM
                                    

                                        Last Used
                                        3/20/2017 at 12:03:06 PM
                                    

                                        Startup Item
                                        Yes
                                    
____________________________
____________________________
UNKNOWN
Number of users in the Norton Community that have used this file: Unknown
____________________________
UNKNOWN
This file release is currently not known.
____________________________
UNPROVEN
There is not enough information about this file to recommend it.


____________________________
____________________________

                            Threat Details
                            File Location
                        
File: c:\users\************\appdata\local\f7ac\e1dc.73dd8 Registry Key: HKEY_USERS\S-1-5-21-4107298426-3321156971-469087235-1001\Software\Microsoft\Windows\CurrentVersion\Run\"\x00rjgyv" Registry Key: HKEY_USERS\S-1-5-21-4107298426-3321156971-469087235-1001\Software\Microsoft\Windows\CurrentVersion\Run\"\x00rjgyv"
____________________________

File Thumbprint - SHA:
28E9E5F25AF7F1E36298CBDDFFF533B71E9C77A62DC1CC7D8F78689A4C5A2DCA"

Kudos0

Re: e1dc.73dd8

It popped up again today. I actually posted about it, but I don't see it here. I tried manually deleting the file, but it kept popping back up every 4 or 5 seconds. I've never seen that before. I clicked on the cloud search on NPE but it did nothing, so I had Norton delete it. I believe it's gone for the moment.

I did run scan in safe mode and Norton only found tracking files.

Kudos0

Re: e1dc.73dd8

So Support helped you remove it?  Good news.

Keep an eye on things for a while and let us know if it stays away.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: e1dc.73dd8

NPE app removed it. The warning showed up again this morning after running the safe mode scan last night. We shall see.

Thanks for the support peterweb!

This thread is closed from further comment. Please visit the forum to start a new thread.