Embedded ads, NSIS, security padlock disappearing, errors on webpages

[pskelley]

You can see where the pathway says it should be. If you have all files and folders enabled, then try asking search companion to search for 2A114C40.tmp Might take a while, lots of files to search through. I am interested in why it is not where it should be, so let me know what you find.

Thanks...Phil

[molton]

Hi

I can see the files now in the quarantine folder directory. (They dont actually appear in the quarantine section in norton program). When i press delete on these it gives me a warning that i can't delete because it gives me a warning to say access denied and file may be in use.
I think perhaps I need to totally turn off norton's in order to delete these files?? Have tried disabling the program however still can't delete. I will see what Symantec responds to me with.

cheers

[pskelley]

You can boot to safe mode when the junk will not be running and delete it there:
http://spyware-free.us/tutorials/safemode/

Or use the delete on reboot tool in HJT:
How to use the Delete on Reboot tool
http://www.bleepingcomputer.com/tuto...42.html#delreb

Let me know how it goes. Can you tell me if it's one file or more. I am especially interested since Kaspersky shows only the one.

If you wait on Symantec, don't hold your breath

Thanks

[molton]

I will try the safemode and the hjt technique if it doesn't work now and let you know.

In the meantime, yes there is a couple of files in this quarantine directory. There is the 2A114C40.tmp one and there is a 3EAE407B.tmp and there is also a subfolder within the quarantine folder with a file in it called 00000001.RMA. As you say, Kapersky is only picking up the one.

cheers

[molton]

Hi

I was able to delete all the files under the quarantine folder in safe mode.

Let me know if you want me to run anything further to look into why kapersky only picked up one of them

thanks

[pskelley]

No reason to run Kaspersky again, I would be asking Symantec about the though. My thoughts are if it in a .tbp folder it can be deleted if it is malware or not and if it is in a quarantine folder that means to me Symantec identified it as malware and could not delete it so it quarantined the files. Understand, I do not use their program and that is how it usually works. I sometimes feel sorry for folks who pay them.

I'll give you a few days and then close this topic.

Safe surfing...Phil