Endpoint Protection

This blasted thing keeps coming back, in spite of following the removal instructions to the letter.  Problem is, I can't find it in the registry or in the file system because when it's detected it doesn't tell me where to find them - filename and location are "Unavailable".  So how did it detect the thing?  Better yet, how do I zap it fer once & fer all???  Any help greatly appreciated!

 

XP sp3, Symantec Anti Virus v10.1.4.4000 (2006)

 Its either coming from internet or from a flash drive.
Do you have risk tracer enabled in File System Auto-Protect if no then enable it..if it is coming from remote computer it will show or it can be a rootkit.

"Internet or flash drive" - Do you mean it can't be on a hard disk?  Or are you saying AV would have told me where if it were?

I didn't know about Risk Tracer, will check it out soon's I get home tonight. 

Thanks.

 Thats right i won't be on the hard disk or is getting detected before it is getting copied to hard disk.

No flash installed at bootup, so it has to be internet.  But why am I being continuously targeted?  Home page is Google, not likely to be the source.  Could it be my ISP (Metrocast)?

Thanks again.

 In your Internet Explorer remove all unwanted add/ons.
Clear all browding data/files
clear out %temp% and c:\windows\temp

Okay, thanks!

I know in my case this was a rootkit installed on the client. SAV was blocking the virus with an access denied message but it would keep popping up every 5-10 minutes. In the risk report the file location was listed as "Unavailable".  I booted to a Linux boot disk and found the file in question and its home directory that were not shown in Windows.  Killed the folder and files, booted to Windows, cleaned up the registry scars and all was well...

R

 Rootkit is also a posibility however often in rootkit the location shows as \abc\xyz but sometimes it shows up as Unavailable in that case try running sysinternal/microsoft rootkitrevealer

Got my work cut out for me tonight!  Thanks folks, I never would have known this stuff.  It's a shame Symantec doesn't tell you.

(added)
I dl'd the latest corporate version available, which has to done from work to take home.

I think the below articles will be helpful to you
Rootkit -- An Intruder Living in your Kernel 
Worms and threats that spread across networks by network shares have become more common in recent years.--Like Downadup/Conficker