After running a full computer virus scan, a threat was found, and Norton said the computer needed to be restarted in order to remove the threat. After having restarted many times, I continue to get the message that my computer needs to be restarted. I am using Norton Antivirus 2009 on Windows Vista.
What virus did it find?
Could you please be more specific on what NAV found on your machine? Maybe you could post a screenshot?
It found the virus Trojan.Blusod
Here is a screen shot of the mesage that keeps popping up:
Hi tomleal,
Please try to run a Norton Full System scan in SAFE MODE.
There are additional Symantec removal instructions for Trojan.Blusod here.
The removal instructions include steps for removing infected keys from the registry. If you are not comfortable with or have never edited the registry, you can try this:
Download, install and update the FREE version of Malwarebytes.
If necessary, you can download this program and save it to another computer and transfer it via a flash drive to the "problem computer".
Once those steps are completed, unplug from the internet, restart your computer in SAFE MODE and run a complete Malwarebytes scan. If items are found, follow the Malwarebytes suggested procedure.
You should run the Malwarebytes scan a few times to be sure it comes up clean.
The above procedure can also be performed using the FREE version of SuperAntiSpyware. Both programs are "on-demand" scanners and will not interfere with your Norton Product.
Delete your System Restore Points by turning off System Restore. Many infections will become embedded in your previous restore points - therein lies the possibility that they may return. Also you may find that the malware has already erased your restore points.
Restart your computer in Normal Mode and check how things are working.
Once you are completely sure your computer is clean, you can turn ON System Restore.
Please let us know how you do with this.
Trojan.Blusod
http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=9075
Malwarebytes Updated abd thend run in Safe Mode, then Normal Mode should remove the Malware
Quads
Norton Internet Security 2009
Did this last post resolve this issue for anyone? I am seeing the exact behavior on 2 machines. I purchased a 3-license and have installed on 2 boxes, 1st is Vista64 the other XP Pro (all MS updates applied). Reluctant to install on a third machine.
The Vista machine had a couple of threats marked fully resolved as of 4/1/2009. Nothing new except tracking cookies found. My thinking given the thread is that the earlier threats are not actually resolved. But wouldn't they keep reappearing in the logs as new entries?
What is interesting is that the XP machine has never had any threats except tracking cookies. I have run all the suggested antispyware apps suggested in this thread, in safemode, but have only found cookies but still get the Restart prompt.
Any further thoughts?
Export of the Resolve Security Risks drop down.
Category: Resolved Security Risks
Date & Time,Severity,Activity,Status,Recommended Action,Component,Definitions Version,ERASER Version,Risk Name,Risk Category,Risk Type,Risk State
4/6/2009 12:07 PM,Low,Tracking Cookie detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.04.05.020,109.1.0.61,Tracking Cookie,Cookie,File Based,Fully removed
4/6/2009 7:49 AM,Low,Tracking Cookie detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.04.05.020,109.1.0.61,Tracking Cookie,Cookie,File Based,Fully removed
4/3/2009 9:33 PM,Low,Tracking Cookie detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.04.03.004,109.1.0.61,Tracking Cookie,Cookie,File Based,Fully removed
4/1/2009 1:06 AM,High,Infostealer.Gampass detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.03.31.035,109.1.0.61,Infostealer.Gampass,Virus,File Based,Fully removed
4/1/2009 12:59 AM,High,Backdoor.Trojan detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.03.31.035,109.1.0.61,Backdoor.Trojan,Virus,File Based,Fully removed
4/1/2009 12:58 AM,High,Hacktool detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.03.31.035,109.1.0.61,Hacktool,Virus,File Based,Fully removed
4/1/2009 12:05 AM,Low,Tracking Cookie detected by Virus scanner,Removed,Resolved - No Action,Virus scanner,2009.03.31.035,109.1.0.61,Tracking Cookie,Cookie,File Based,Fully removed
Went through an uninstall process with Symantec support. After which all as been good. I have not received another prompt to restart such as the screen shot indicated within this thread.
Used http://www.symantec.com/nrt/ Norton_Removal_Tool.exe
Then installed with http://www.symantec.com/redirects/norton/norton_com/nis09/ this package. I did not have to re-enter keys.
Reboots between each.
I have one more machine to install NIS2009. It will be interesting if this machine experiences the same.
My thinking is that the pre-existing threat that was on my machine prior to installing NIS caused some issue with a "proper or complete" install. Either that or the is a bug.
hope this helps if you haven't already resolved