A Norton scan has identified OneStep (and on my son's laptop but says it is unable to remove it (detected but remained) and that it must be removed manually.
I have followed the instructions (http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-112613-5052-99) disabling System Restore and running the scan and got the same message.
I then followed the instructions and ran the scan in Safe Mode
("If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. Once you have restarted in Safe mode, run the scan again.")
Got same message that the OneStep is there but isn't removed after telling Norton to remove (or quarantine it).
The instructions say after running the scan in Safe Mode:
"After the files are deleted, restart the computer in Normal mode and proceed with the next section." which is to "To delete the value from the registry"
I'm concerned about proceeding to the next step (deleting the values from the registry) because the "files are not deleted" after running the scan in Safe Mode as instructed.
Any advice?
Thanks.