A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Windows 7 installed on 26 Aug'15 and fully updated).
Trojan location: specifically at C:\Program Files (x86)\OLBPre . With one shortcut at my desktop named "MyPC Backup" (an utility that, although I erased from the Start Menu/startup folder, has been opening inviting me to register and do a backup of my files; evidently I never accepted, since I did not installed such a program. Unfortunately I do not remember the first time this window popped up).
Here is the icon of the shortcut destined to the trojan OLBPre.exe (sanitized by Norton; the shortcut remained as a curiosity of my own... now deleted)
Date of Detection: 1 Sep'15 at 6:27 pm.
More Dates Data: I installed Norton on 29 Aug'15 at 12:40 pm. The mentioned folder with the trojan has files created on 29 Aug'15 at 12:55 pm. The other programs I had installed before the trojan's date where: Ares on 29 Aug at 11:12 pm, a licensed Nero Burning ROM on 28 Aug (previous day) at 2:58 pm, Oracle VirtualBox on 28 Aug at 12:43 pm. Programs installed just after that time: licensed PowerISO on 29 Aug at 4:57 pm, Daemon Tools Lite on 29 Aug at 5:31 pm, WinRAR on 30 Aug 1:22 am, and qBittorrent on 30 Aug at 12:11 pm.
Summary of Norton History: on 30 Aug'15 from 2:47 to 2:51 am, Norton blocked 72 times the program C:\Windows\System32\svchost.exe when it tried to access DataDefinitions at Norton's install folder. It seems a very clear activity of a trojan, doesn't it?
NOTE: svchost.exe, according Windows page is a special Win process supposedly hosting Windows services, such as Windows Defender.
Main question: Do antiviruses have any chance to agree with Microsoft Corporation a system to detect abnormal activity?
For example, let's say that is not normal that some processes are navigating through user's folders, listing all the directories, opening text files seeking for information, etc... Or let's say that some programs would need to download an update, but not to upload files greater than some few hundreds of KB, or copy/upload user's files placed at My Documents.
Other Question 1: How is it possible that this program with the trojan, MyPC Backup, was installed in my computer just after Norton Installation and that it has been, precisely Norton what finally detected it as a trojan? Am I missing something? Is there anyone that knows if "MyPC Backup" is offered through an installation wizard of another program?
Other Question 2: If there was abnormal activity of a process trying to access Norton's definitions (svchost.exe), and Norton detected it, why Norton did not warn me or feed this information back to Norton's Central for further analysis?
Other Question 3: If this program, MyPC Backup, has been starting on my user's logon, and therefore being executed, why Norton did not detect this executable as a trojan before? It might be a Norton's background scanning what has detected it. It means that Norton does not scan folder files by priority, doesn't? for example, scanning the source folder of an executable already running and closer folders to it. I do not understand why Norton did not do this check... Should it?
Other Question 4: Let's suppose I have installed it by some error, and that I did it specifically at the date shown at 'MyPC Backup installation folder' (let's suppose the date is right, not faked by the trojan). If Norton has the FileInsight function, and it does not allow you to execute any file without showing you the "Norton Community" insight of that file, why I was not warned by Norton of any danger on 29 and 30 of August?
If anyone found out any solution to be really free of malware, please, share...
NOTE: To discard options, I also have installed a licensed antilogger (since the beginning).