Hi ChristianDK,
I am sorry to learn that the suggestions provided by delphinium and I were not effective.
My advice is to continue to renew your subscription of Norton. Why do I say this? I work in the security industry and trust me, Norton is far better than the competition (in terms of malware removal and prevention). I use it on all of my PCs.
The reasons that Norton is not detecting the threat are one of the following:
1. The program does not perform malicious actions.
2. The particular variant of this program on your computer is not yet known to Symantec (Norton).
For any security company, not just Norton it is difficult to say what programs should be removed and what should not be. The definition of Unwanted programs vary from person and is a gray area when it comes to classification.
In order to remove this threat (a name that I am calling this program, it may not even be malicious but it is STILL UNWANTED), I would suggest, downloading and running Sysinternals Process Explorer:
http://technet.microsoft.com/en-us/sysinternals/bb896653
You can use Windows Task Manager for this but, Process Explorer shows the corresponding path to the file with less clicks and is more visual and easier to understand.
You will need to first unzip (de-compress it), run the following file that will be present after decompressing the zip file as follows:
Right click and choose "Run as Administrator" for the following .exe file (click "Yes" if prompted by Windows):
procexp.exe
Agree to the license agreement (it is a totally free and non-expiring program) and then examine the list of running processes.
Process Explorer should open and look similar to the following screenshot:
For any program that you do not recognise, examine the path of that program (this will give the location of the program, most likely C:\Users\-YourName-\AppData\Local\Temp).
To do this, right click a blank area of the Process Toolbar and choose "Select Columns" and check the box marked "Image Path" and click OK" (see the following screenshot):
Move your mouse over the right hand side of the "Path" column, when the mouse cursor changes to a black line with arrows pointing out from both sides of it; drag the cursor to right to expand the column to make it easier to read (please see the screenshot below for the result intended).
Now carefully look in the Process column to the far left of the window, you are looking for any program you do not recognize.
For any program you do not recognise, move along the line that it is on and examine the company name, is it a company recognize? If not, this is most likely the program that is appearing in your Windows taskbar at the bottom of the screen. Examine the path to the file and make a note of it.
For any other programs that you do not recognise, write down the path to the program and make a note of the company name if you wish.
You can use the following screenshot taken using Process Explorer 15.01 under Windows 7 Professional 64 bit SP1 (a separate copy of Windows that I have bought specifically for malware testing) as a good guide (since it is showing the minimum programs running at start up).
This is a fresh install of Windows 7 running in a virtual machine (VMware Workstation) (you can ignore any running programs that have the Company Name, VMware, Inc. from the above screenshot, since they will not be present on a native (i.e. normal) installation of Windows).
Next download and run Sysinternals Autoruns:
http://technet.microsoft.com/en-us/sysinternals/bb963902
Once again, unzip the file you download, right click and choose "Run as Administrator" for the following .exe file (click "Yes" if prompted by Windows):
autoruns.exe
Agree to the license agreement (it is a totally free and non-expiring program) and then click on the "Logon" tab near the top of the windows. This tab will show a list of programs that run at Windows start up:
From the following screenshot you can see the list of programs that run when my native Windows 7 Ultimate 64 bit SP1 starts up:
If any program in this list matches the program(s) that you did not recognize in Process Explorer, uncheck the box (located on the far left side of the window) beside the program’s entry in the list.
Uncheck any program that you do not recognize (make a note of the path location of any program you uncheck e.g. c:\windows).
ONLY UNCHECK WHAT YOU STRONGLY SUSPECT IS THE PROGRAM THAT YOU WISH TO STOP FROM RUNNING.
Close Autoruns and restart your computer for the changes to take effect.
If the program with the binoculars icon no longer appears, you have located the file(s) responsible and have removed them from starting when Windows starts.
If the program is still there, follow these steps:
1. Open Autoruns again, right click and choose "Run as Administrator" for the following .exe file (click "Yes" if prompted by Windows):
autoruns.exe
that you downloaded and used earlier.
2. Click the "Everything" tab near the top of the window. Examine the list for any entry that you do not recognize and uncheck the box for that entry.
3. You can see from the screenshots below that there are a lot of different company names present even on a fresh install of Windows 7.
4. ONLY UNCHECK WHAT YOU STRONGLY SUSPECT IS THE PROGRAM THAT YOU WISH TO STOP FROM RUNNING.
5. Anything with the word "driver" and a small cog icon is very unlikely to be the program you wish to stop from running, as shown in the following small list of drivers:
6. If you uncheck any program, close Autoruns and restart your computer for the changes to take effect.
7. Repeat by unchecking programs until the binoculars icon is gone.
8. For any program that you recognise but unchecked and no change was observed, re-check the box for the program’s entry in Autoruns and it will then run as normal upon the next computer restart.
Once the icon has been removed, you can now simply delete the files in question or use Norton to quarantine and submit them for analysis.
After restarting your computer, the icon should no longer be present. Open Computer and navigate to the location of the file, right click the file and choose Delete.
If you encounter any problem deleting the file, try deleting the file in Windows Safe Mode. If you still encounter difficulties, please reply to this post and I will supply further instructions with screenshots.
If you wish to use Norton to quarantine the file(s) and submit them for analysis, follow these steps:
Open your Norton product.
Click the Quarantine option.
To add an item to the Quarantine
1. Click Add to Quarantine.
2. In the Manual Quarantine dialog box, in the Description text box, type a short name for the item that you want to add.
This text appears in the Quarantine, so you should use a recognizable description.
3. Click Browse.
4. In the Select File to Quarantine dialog box, browse to the item that you want to add, select it, and then click Open.
5. Click Add.
6. Click Close.
After adding the item to Quarantine, click the yellow "More Details" button.
Click the "Options" button at the bottom of the window.
Click "Submit To Symantec".
Your computer should now be free of this troublesome program.
If you have any further questions, please reply and I will be happy to assist further (you can also send me a private message to perhaps set up a Skype call between us?)
Thank you.
JimboC
.