I encountered a virus last night that was not detected by, nor could not be removed by, Norton.
It takes over your computer with a box labeled Antivirus Scan, it looks like a legit program. It scans your computer like it is searching for viruses, and puts an icon in the tool tray. Multiple warning boxes pop up telling you your computer is infected. It disables all executable files, nothing works, it keeps repeating the same loop. In the main box it tells you that uninstall is not available with the demo version, and you should order the program. All the while it opens IE taking you to porno sites.
In Control Panel it disables Add/Remove Programs and Windows Firewall. I ran Norton (as provided by Comcast) and it found nothing. I ran a Norton update and rescanned, it still found nothing. Eventually, even Norton stalled out. All tries at accesing the internet came back with "web page cannot be displayed."
I right-cliked on the main box and looked at properties. The location showed a URL with the prefix hxsi://C: which I found strange. The file hides in the documents and settings\user name\local\temp\ in a folder named dnoljlrrc. The file in that folder is named fwogysmusbs.exe.
I tried deleting the file, it would not delete. I tried using Unlocker Assistant, which has never failed me, and it told me the Unlocker .exe file was corrupt. I tried renaming the file, which it allowed, and then deleting, not allowed. Restarting the computer did nothing, the program took over immediately after Windows started up. Only when I disconnected my line to the modem and rebooted was I able to navigate to the file and delete it.
Afterwards, I was only able to access https sites. Ordinary sites like Yahoo.com would not come up. You have to go to tools, internet options, click on the advanced tab and hit reset to restore default settings, and then change them back to what you want.
This program/virus is insidious. It seems to have gotten through while my son was downloading games using Bittorrent 7.1. I have never had a virus before like this.
Any thoughts?