One question why when we got antimal ware doctor norton didnt delete it until we changed our ip it was a fake av
I'm not sure I completely understand your reference to changing your ip. Fake AV programs are often difficult to detect because new variants are released continually in order to evade detection methods that use signatures to identify known malware. Until a new variant is recognized, it has a window of opportunity to infect user's PCs. So, if you are asking why there may have been a delay between the time of infection and the time that Norton was able to remove it, it could be because the threat was only identified recently, and its signature only then was incorporated into the latest virus definitions update. It is also possible that the malware you have discussed in your other thread is involved, either concealing or preventing Norton from being able to remove the rogue AV. Tidserv is usually associated with many related infections of this type.