Computing.Net > Forums > Windows Me > unable to remove Trojan Horses

unable to remove Trojan Horses

Reply to Message Icon

Original Message
Name: radiosigs
Date: August 19, 2004 at 04:48:42 Pacific
Subject: unable to remove Trojan Horses
OS: Me
CPU/Ram: 256
Comment:

I'm using Grisoft's AVG6 anti-virus program.
It located 2 Trojans found in:
1. C:\_RESTORE\COPY\A0030297.CPY
2. C:\_RESTORE\COPY\A0030296.CPY
corresponding respectively to:
Downloader.Agent.2.BH and
Downloader.Small.6.BH
AVG will not allow me to quarantine them in their virus vault. I've run ADAWARE6.0 four times to no avail. I've used the safe mode startup and tried unsuccessfully to delete the infected files. Does anyone have a suggestion, short of a system software restore, to get rid of the buggers?
Thank you


Report Offensive Message For Removal


Response Number 1
Name: SusanG
Date: August 19, 2004 at 05:01:49 Pacific
Reply: (edit)

try disabling system restore and then run virus scan again. This should delete the viruses


Report Offensive Follow Up For Removal

Response Number 2
Name: Ed in Texas.
Date: August 19, 2004 at 05:03:40 Pacific
Reply: (edit)

Charlie, since AVG found your trojans in restore, Windows won't allow you to alter that file. Windows protects system files so AVG can't clean anything. If you wanna get rid of them, disable restore THEN scan (be aware that you will destroy ALL your restore points!). Recommend you make a new restore point as soon as you clean them out.
HTH.
Ed in Texas.


Report Offensive Follow Up For Removal

Response Number 3
Name: Viking
Date: August 19, 2004 at 05:05:49 Pacific
Reply: (edit)

Not necessarily, try disabling system restore AND, doing another scan. Preferably one online.


See the iDiOt walk
See the idiot TaLk

WaLk IdIoT WaLk


Report Offensive Follow Up For Removal

Response Number 4
Name: radiosigs
Date: August 19, 2004 at 15:55:13 Pacific
Reply: (edit)

Thank you very much, Susan, Ed and Viking. What I did later this morning was to uninstall AVG6 with the Trojans in the virus vault, so I thought. That's because AVG told me they could not be vaulted and were still running rampant. So anyway, out went AVG and in went Norton 2003 with all the updates. I did have the Norton disk. So after Norton was installed and all updates too, I ran a scan and it found nothing. Is that odd or what? AVG told me that the two buggers were on the loose but Norton disputed it. So right now Norton is in BUT as with so many using that AV system, the PC slowed down. Can we ever win?


Report Offensive Follow Up For Removal

Response Number 5
Name: johnnytech
Date: August 20, 2004 at 16:48:12 Pacific
Reply: (edit)

My suggestion is that you scan with an AntiVirus Emergency Startup Disk. Without Windows running, the .cpy files will now delete. I had a similar problem and couldn't resolve it by turning off System Restore; the files in question (A00277385.CPY and A-----941.CPY) were still being protected by Windows. By running from floppy, I went around Windows.
Also, don't rely solely on Norton not detecting anything. I got hit with the Blaster a few months ago and I'd been always up-to-date with my virus signature files, was always careful; furthermore, all scans said I was clean. Those scans were my software as well as an online scan. Finally I downloaded a stand-alone from McAfee, called Stinger, and that did the trick.

Bottom Line: try everything: online scan, software scan, Stand-alone and finally, Emergency Startup Disk.

Perhaps this will help. Good Luck!


Report Offensive Follow Up For Removal


Response Number 6
Name: jerrymac
Date: August 27, 2004 at 08:42:40 Pacific
Reply: (edit)

Hello, I have a problem very similar to this problem, but worse in numbers, AVG has found 29 files that are infected (all cpy files in the restore folder). I tried some of the things explained here to no avail. I went and disabled my restore, but it was checked that it was already disabled. I went through the steps explained to me to diasble them, etc. When I enable restore and do what it ask (click to restart my computer), it comes back disbled again. I enable, restart, and it automatically disables. This is very confusing to me. Can someone help me, please.


Jerry Mac
jerry@countrymusicplanet.com
http://countrymusicplanet.com
http://countrymusicplanet.net


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: unable to remove Trojan Horses

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




Have you ever used OpenOffice?

Yes, as my main suite.
Yes, occationally.
Yes, but only once.
No, never.


View Results

Poll Finishes Today.
Discuss in The Lounge