1. Starting yesterday, every time I click on a link from a Google search, instead of going to the site, I get the following site and message: (quoted message in color)
“Malicious Web Site Blocked
You attempted to access: http://srv.tidynetwork.com/pubjs?pid=817583&sid=009&uid=&cid=0&t=188569
This is a known malicious web site. It is recommended that you do NOT visit this site. The detailed report explains the security risks on this site.
For your protection, this web site has been blocked. Visit Symantec [ http://www.symantec.com/transactsafely ] to learn more about phishing and internet security.
| Exit this site | |continue to site anyway| ”
The URL for this message:
symres:C:\Program Files\Norton Internet Security\MUI\20.2.0.19\09\01\coUICtlr.loc/PAGEBADREDIRECT.HTML, yields a path to a (genuine) Norton file in my NIS program.
The “Detailed report” link yields a purported report by Norton Safe Web, with a Norton Rating [red X] and official looking summary. (See http://safeweb.norton.com/report/show?url=http:%2F%2Fsrv.tidynetwork.com%2Fpubjs%3Fpid=817583%26sid=009%26uid=%26cid=0%26t=188569&product=NIS&version=20.2.0.19&layout=Retail&lang=0901&source=toolbar if interested.)
2. When I searched for Tidynetwork.com and the caption above, I got only one Microsoft Security article describing ) a Trojan called: “Win32/Paidemet.A” and containing Doc-&-Settings files in a folder entitled Tidynetwork.com.
OT1H, I found such a folder in my Docs & Settings, with some of the specified files.
OTOH, on checking these files (esp the application), Norton Rating rated them reliable and very safe, no reports of security problems.
3. In Norton’s forums, I found several discussions for “Malicious Web Site Blocked” but nothing directly on Tidynetwork. However, some of these discussions indicate similar behavior (as to other programs).
Namely, it appears a virus routes all (in my case, Google search links) to the fake Norton warning page and naming a program (in my case, Tidynetwork) that is actually legitimate. The fake page gives several alternate links (Exit this site, Continue to site anyway) (which I’ve avoided clicking; that’s probably the action which compounds the virus).
I suspect (but not positive) that Norton file in the above path ( coUICtlr.loc ) is not infected and that the file isn’t causing each Google link to open the warning page; rather it appears the virus activates this file, which then opens the page.
4. I have run: (a) Norton Internet Security’s scan, and (b) Norton Power Eraser (both with updates), but neither found any infections.
I renamed the Tidynetwork folder and Removed the program (Add/Remove), but no help either.
HOW do I find and fix this virus?!