[TechOutsider]

I upgraded to FF3. Next day, I opened it. Fine. Closed it. Opened the Task Manager, FF was still running after several minutes. I terminated the process and reopened FF. Now, my bookmarks are missing. I tried to restore the .json file, but it was corrupted. I also have several other problems, like the http address does not show up in the bar. And I can't add bookmarks.

I visited MozillaZine. I tried their methods, no luck. I found an article about Firefox.exe always open. The article made me suspect that I had Poisonivy.20.A, Win32/Delf.AKA BackDoor CEP.svr or Backdoor.Darkmoon.

It is said that no AV except SpySweeper, Kapersky, Avria, and NOD32 can detect and disinfect those threats. I am running Norton 360 ver. 2.3.0

Help?

[redoak]

Kaspersky has a free, on-line scanner:
http://www.kaspersky.com/virusscanner

{redoak}

[Rivera42]

So does ESET/NOD32:

http://www.eset.com/onlinescan/

This scan service includes removal.

The Kaspersky online service disclaims that it does not remove detected threats.

Please visit this page.

[TechOutsider]

Thanks! I have tried Kapersky and no malware detected. I guess I will revert back to FF2 then.

[Michael York]

Originally Posted by TechOutsider

I upgraded to FF3. Next day, I opened it. Fine. Closed it. Opened the Task Manager, FF was still running after several minutes. I terminated the process and reopened FF. Now, my bookmarks are missing. I tried to restore the .json file, but it was corrupted. I also have several other problems, like the http address does not show up in the bar. And I can't add bookmarks.

I visited MozillaZine. I tried their methods, no luck. I found an article about Firefox.exe always open. The article made me suspect that I had Poisonivy.20.A, Win32/Delf.AKA BackDoor CEP.svr or Backdoor.Darkmoon.

It is said that no AV except SpySweeper, Kapersky, Avria, and NOD32 can detect and disinfect those threats. I am running Norton 360 ver. 2.3.0

Help?

Hi TechOutsider,

This is Mike from the Norton Authorized Support Team responding to your posting.

The first thing I would suggest would be for you to use the "Clear Private Data" function in Firefox and to also delete all temporary Windows files from the C:\windows\temp directory.

Next, manually run LiveUpdate from within Norton 360 to make sure that you have the latest program and definition files applied. To do this, open Norton 360 2.0, click once on the "PC Security" bubble and then choose "Check for Updates."

After LiveUpdate has completed, click on the "PC Security" bubble again and choose "Run Scans." In the window that appears choose "Comprehensive Scan" and then click the "OK" button.

If Norton 360 advises you that it can not remove a particular threat, make note of the name of the threat and then locate it in the Norton Threat Explorer for removal instructions.

Symantec Threat Explorer

Thank you,
Mike

[TechOutsider]

Norton 360 suddenly told me that Intrusion Prevention was turned off. I press "Fix" but to no avail.

[Michael York]

Hi TechOutsider,

If the Intrusion prevention feature of Norton 360 is disabled, and the "Fix" button did not re enable the feature, then there is a problem with your installation of Norton 360.

To fix this problem, please follow the instructions in the following document.

Instructions to fix Intrusion prevention feature in Norton 360

Please follow the steps carefully and let me know if it resolves the issue.


Thanks,
Mike

[TechOutsider]

I did that 3 times. Each time after a fresh install Norton prompted me to restart to apply the latest updates. Then, when I log onto a Guest account, IP is disabled.

[Byteman]

Were you logged into an Administrator level account, where you applied the Norton 360 Updates, etc as Michael posted, and then switched user accounts to Guest, and found the IP disabled there?

Are you using anything that might block changes, such as SpyBot's Tea Timer feature?

[TechOutsider]

Nope. IP is enabled in Admin, there is an red X under My Network but Norton says that I'm protected in Admin.

On Guest...IP disabled, cannot fix...

[tomdkat]

I found these links regarding the "Firefox.exe is always open" issue:

http://kb.mozillazine.org/Talk:Firefox.exe_always_open
http://www.bleepingcomputer.com/foru...p/t130741.html
http://forums.mozillazine.org/viewtopic.php?t=467349
http://kb.mozillazine.org/Firefox.exe_always_open

It seems as though "Poison Ivy" has been around for a while and there ARE some products out that can deal with it. My suggestion to you is to start a thread in the malware removal forum and let them assist you in getting your system clean.

Peace...

[jsparky77]

Originally Posted by TechOutsider

It is said that no AV except SpySweeper, Kapersky, Avria, and NOD32 can detect and disinfect those threats. I am running Norton 360 ver. 2.3.0

If Mozilla said that no AV but those ones can pick it up, why are we trying to get norton 360 to pick it up?? makes no sense.

When they say Avira can pick it up does anyone know whether they are talking about the paid or free version of Avira??

[tomdkat]

Originally Posted by jsparky77

If Mozilla said that no AV but those ones can pick it up, why are we trying to get norton 360 to pick it up?? makes no sense.

Go back and re-read some of those threads. At first, I was a little surprised that "no software" could detect these threats and deal with them but then I realized those comments were made back in 2006.

When they say Avira can pick it up does anyone know whether they are talking about the paid or free version of Avira??

At this point, I would imagine either version would as well as several other apps. I believe Spy Sweeper was another one listed that could detect the trojan, at least.

Peace...

[Michael York]

Originally Posted by TechOutsider

Nope. IP is enabled in Admin, there is an red X under My Network but Norton says that I'm protected in Admin.

On Guest...IP disabled, cannot fix...

Hi TechOutsider,

Mike from the Norton Authorized Support Team responding again.

Can you please try creating another Limited User account, and then , while logged in as Admin, use the fast user switch and log into the newly created account and see if intrusion prevention is enabled. If it is enabled in the newly created limited user account than that points to some corruption in the other limited account. Please try this and let me know the outcome.

Thank you,
Mike

[TechOutsider]

tried that. IP was still off. i made a system restore point where IP was on. will that help?