Help -- Norton periodically tells me that my PC is infected with download.trojan virus & can't remove it. I have cleaned with both AdAware and Spybot. I have also run Norton AV in safe mode and it does not detect it. I have also deleted temporary internet files. Any other suggestions? I am still bombarded with pop-ups, even when using Google pop-up blocker.

Have you flushed out the restore folder?
The virus will get backed up in this folder (if Win 2000 has a restore folder), though I don't know if it can get out....

See if there is anything here you have not thought of......
http://www.computing.net/security/wwwboard/forum/9036.html
Response Number 4
Norton should find it (if it's updated).
A neighbours PC had this a few weeks ago.
While in safe mode, look for a file winfavourites.exe
I think this is the actual virus.

You may find that this thread answers your question...*S*

http://www.computing.net/security/wwwboard/forum/9167.html

as for the popups they may be unrelated, try getting a firewall http://www.grisoft.com/us/us_dwnl_free.php this ones for free and works well

Thanks for the feedback. As far as I can tell, Win2K doesn't have a restore folder, so that's not the problem. And, Norton is updated, but doesn't find the virus in safe mode. I've now installed a firewall, and maybe this will help a bit. Nevertheless, I know that the virus is still lurking out there. Given that Norton DOES periodically detect download.trojan virus 'on the fly' (though not when doing a full system scan from safe mode) I'm confident that the barrage of pop-ups are related to the virus. Amazingly, they seem to largely bypass the firewall and several simultaneously-active pop-up blockers (one from earthlink and one from google). Any other suggestions?

Hello,
You can try this excellent program called
Trojan Remover 6.19
this program is a 30 days trial freeware, but fully updated with recents trojan's signatures....
Read well the "readme" files of the program to be able to use correctly the two embaded scans of the program: one to check your memory RAM, second one to hunt, detect and eradicate the worm hidden somewhere in your hard drive....

Well, it looks like ZoneAlarm will take care of things. Even if the virus is still lurking somewhere, as long as I keep the firewall on, NO MORE POP-UPS!
Thanks for all your suggestions.

Hi, I'm actually also suffering from the same problem as raphaekg. Try the various methods(Norton steps listed on Symantec, various tools such as trojan guarder, trojan remover, AdAware and SpyBot) ages ago but to no avail.
Would it help you guys if I list down the HiJackThis log files ...hope you ppl will be able to help. Thanks!!

hi-- my computer stays online, and i don't get infected with the download.trojan virus until i load internet explorer. i get the same file names-- py.exe and zzb.exe. zzb.exe shows up under my running processes as soon as i load the browser and evidently it immediately downloads py.exe. i have updated my norton virus definitions, disabled system restore, ran in safe mode, deleted the files (along with temp. internet files, cookies, history, etc.), but i still can't load internet explorer without contracting the virus. any help with this matter would be greatly appreciated as i am thoroughly frustrated with the situation. thanks!!!

freakkler & lilypondkid, you should really start a new thread for your problems but since your posts is already here.....

freakkler, only post your HT log if someone asks for it. I can't read half of what's in them. Also don't post it unless you still have problems after running the Anti-Spyware/Redirector programs:-
Spybot, Ad-Aware & CWSredder.
These are free and will remove 99% of the crap.

lilypondkid,
Try this free online Trojan scan.......
http://www.trojanscan.com/trojanscan

If you still have problems, start a new thread. One of the reasons for not posting your problem here is, you have not stated what OS you have, and this could help a great deal, (you might have Blaster).

Hi Michael,

I have tried all those softwares you listed above. All the searches turn up blank, listing my system as clean. However, time and again, my PC continues to get infected with this download.trojan virus and my Norton Virus popping up a alert message that says "file has been deleted".

Is there anything else I can do? Thanks a great deal.

Try the following:
- deinstall Download Accelerator
- install Spybot Search&Destroy
- plug out the Internet
- run Spybot, then Norton
Michael