Expert: Lorry - 9/10/2007

Question
Ok whats happened was i received this little problem a while ago and my security program has been failing to deal with it. It still periodically says it finds a problem in 2 different places and blocks both of them. One of the detections in in the temporary internet files/content.ie5 folder and it used to say "file access is denied" but now it just says "blocked"(i upgraded my security software. The other is in the window/system32 folder and that one used to says "file was automatically deleted" now it says "blocked."  From what i can tell "blocked" means the file has been blocked cause it says "status: blocked" I've tried going to the symantec website and doing a virus scan there, they didn't find anything, i've done a full system scan and that found 2 files but only partially removed the second one, i tried getting the vundo removal tool from symatec and i followed those instructions and that didn't work either. I also tried to manually find the files but even in the cmd window i can't even find the files, i can find the folders that its said to be in but not the file itself. In case this info is needed i have windows XP service pack 2, Norton internet security 2006(upgraded to have the 2007 features), Norton system works 2006(also upgraded to have the 2007 features), and thats all i can think of that you might need to know. Any help would be greatly appreaciated.

Answer
Hi David,

Did you disable System Restore before using the removal tool from Symnatec? It is very important for you to follow the steps from the following site:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112210-3747-99

Or you could manually remove it following the directions given at:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&...

Whichever way you choose, disable System Restore first and follow the steps, one by one.

Hope this helps!
Lorry