Re: Downloader.Trojan

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 01/10/05 

Date: Sun, 9 Jan 2005 19:35:26 -0500

If you can't delete it, it is being used. You have to stop it from being used, reboot and
scan/delete or you have to shutdown the process running that loads the file and scan/delete. 

-- 
Dave
"Craig Twist" <tc@craigtwist.wanadoo.co.uk> wrote in message
news:OnG2NYq9EHA.3944@TK2MSFTNGP12.phx.gbl...
| David,
|
| Thanks for your response.
|
| I have tried this sequence several times over already and unfortunately
| Windows XP will just not let me delete the virus from the file 'ocWOC.dll'.
| I have tried the sequence again to ensure I am not doing something wrong and
| windows will still not let me delete the virus or the file from my computer.
|
| Perhaps I am missing something which is staring me in the face!!!!
|
| TC
|
| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
| news:OGSKM2n9EHA.2600@TK2MSFTNGP09.phx.gbl...
| > 1)    If you are using WinME or WinXP, disable System Restore
| >             http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
| > 2)     Reboot your PC into Safe Mode and shutdown as many applications as
| possible
| > 3)     Using your NAV software, perform a Full Scan of your platform and
| clean/delete any
| >             infectors found
| > 4)     Restart your PC and perform a "final" Full Scan of your platform
| > 5)     If you are using WinME or WinXP,Re-enable System Restore and
| re-apply any
| >             System Restore preferences, (e.g. HD space to use suggested
| 200 ~ 400MB),
| >             reboot your PC.
| > 6)     If you are using WinME or WinXP, create a new Restore point
| > 7)     Please report back your results
| >
| >
| >
| > --
| > Dave
| >
| >
| >
| >
| > "Craig Twist" <tc@craigtwist.wanadoo.co.uk> wrote in message
| > news:uh8jKdd9EHA.208@TK2MSFTNGP12.phx.gbl...
| > | I am currently running Norton AV 2004 on my PC (XP Home) and auto detect
| has
| > | detected the 'downloader.trojan'  virus.
| > |
| > | The infected file is located at C:\WINDOWS\System 32\oCwOC.dll
| > |
| > | At first NAV auto detect tells me that it is "unable to repair this
| file"
| > | and then it tells me "access to file denied". I have ran a full system
| scan
| > | on NAV and fortunately this is currently the only virus that has been
| found
| > | on my computer. However, once detected, the repair wizard displays a
| status
| > | of 'delete failed'.
| > |
| > | On selecting 'fix' NAV is unsuccessful. On selecting 'quarantine' NAV is
| > | unsuccessful. On selecting ' delete' NAV is unsuccessful. The infected
| file
| > | remains on my computer.
| > |
| > | I have followed the link to the NAV information file
| > |
| http://securityresponse.symantec.com/avcenter/venc/data/pf/downloader.trojan
| > | .html but after following the instructions I still find that I cannot
| delete
| > | this file.
| > |
| > | Can anybody help? It is becoming increasingly annoying to have auto
| detect
| > | continually flash up a virus alert and I would like to fix this problem
| > | without having to pay the ludicrous sums of money symantec ask for via
| the
| > | technical help hotline (Ł1.50 per minute)!!!!
| > |
| > | Any help would be much appreciated. Thankyou in advance!!!
| > |
| > | TC
| > |
| > | (Sorry about the long post!!)
| > |
| > |
| >
| >
|
|

Relevant Pages

  • Re: Downloader.Trojan
    ... Then reboot and scan/delete. ... |> | windows will still not let me delete the virus or the file from my ...
    (microsoft.public.security.virus)
  • Re: 16-bit dos sub-system
    ... It fixes the problem until I shutdown. ... >When I reboot, I need to do it again. ... There appears to be a virus that is doing this corruption/deletion of ...
    (microsoft.public.windowsxp.general)
  • Re: HOW TO REMOVE THE RPC VIRUS
    ... > Paul, You're pretty funny. ... > Microsoft PSS doesn't charge for virus calls. ... >> 2) When you are not connected to the internet, ... >> not reboot on you. ...
    (microsoft.public.security)
  • Re: system shut down
    ... You might have the sasser virus or the blaster virus ... To stop shutdown, click Start, click Run and type: ... It doesn’t remove the worm. ... You can then connect to the Internet and download the Microsoft relevant patch. ...
    (microsoft.public.windowsupdate)
  • Re: Not so spontaneous reboots
    ... causes a reboot. ... >> After that we were able to run AVG virus scan, ... > Symantec Online Virus and Security Scan: ... > the latest security patches from Windows Update too. ...
    (microsoft.public.windowsxp.general)