NCasePackage.exe

My anti virus software (Avast) continually finds a virus which seems to
regenerate itself on my computer, the virus being "Salm" which seems to
emanate from the "temp" directory in the root directory, from a file named
NCasePackage. Although this file appears to have no read only attributes, I
cannot seem to delete it even after stopping the process. I have attempted
to delete the file through the cmd window but to no avail.
Any help appreciated.

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Dowload the Trend Pattern File by obtaining the ZIP file.
For example; lpt244.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

2) Update Adaware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDo...eSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point

* * * Please report back your results * * *

Dave





"bozdog" <ianthony4@optusnet.com.au> wrote in message
news:4193c535$0$24381$afc38c87@news.optusnet.com.au...
| My anti virus software (Avast) continually finds a virus which seems to
| regenerate itself on my computer, the virus being "Salm" which seems to
| emanate from the "temp" directory in the root directory, from a file named
| NCasePackage. Although this file appears to have no read only attributes, I
| cannot seem to delete it even after stopping the process. I have attempted
| to delete the file through the cmd window but to no avail.
| Any help appreciated.
|
|

Hi David
I followed your instructions and was horrified to find in
the region of 500 threats on the first scan by Adaware SE. the second scan
resulting in 24 finds and the third 12. A fourth and final scan revealed a
clean system. Furthermore I was able to delete the NCasePackage.exe file.

Thanks for your help


"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:ViQkd.476$mc.143@trnddc07...
> 1) Download the following three items...
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
>
> Latest Trend signature files.
> http://www.trendmicro.com/download/pattern.asp
>
> Adaware SE (free personal version v1.05)
> http://www.lavasoftusa.com/
>
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download SYSCLEAN.COM and place it in that directory.
> Dowload the Trend Pattern File by obtaining the ZIP file.
> For example; lpt244.zip
>
> Extract the contents of the ZIP file and place the contents in the same
> directory as
> SYSCLEAN.COM.
>
> 2) Update Adaware with the latest definitions.
> 3) If you are using WinME or WinXP, disable System Restore
> http://vil.nai.com/vil/SystemHelpDo...eSysRestore.htm
> 4) Reboot your PC into Safe Mode
> 5) Using both the Trend Sysclean utility and Adaware, perform a Full
> Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform
> using both the
> Trend Sysclean utility and Adaware
> 7) If you are using WinME or WinXP,Re-enable System Restore and
> re-apply any
> System Restore preferences, (e.g. HD space to use suggested 400 ~
> 600MB),
> 8) Reboot your PC.
> 9) If you are using WinME or WinXP, create a new Restore point
>
> * * * Please report back your results * * *
>
> Dave
>
>
>
>
>
> "bozdog" <ianthony4@optusnet.com.au> wrote in message
> news:4193c535$0$24381$afc38c87@news.optusnet.com.au...
> | My anti virus software (Avast) continually finds a virus which seems to
> | regenerate itself on my computer, the virus being "Salm" which seems to
> | emanate from the "temp" directory in the root directory, from a file
> named
> | NCasePackage. Although this file appears to have no read only
> attributes, I
> | cannot seem to delete it even after stopping the process. I have
> attempted
> | to delete the file through the cmd window but to no avail.
> | Any help appreciated.
> |
> |
>
>

I assume that sysclean then found no viruses. I anm glad to hear you have resolution.

Dave



"bozdog" <ianthony4@optusnet.com.au> wrote in message
news:419511ca$0$24379$afc38c87@news.optusnet.com.au...
| Hi David
| I followed your instructions and was horrified to find in
| the region of 500 threats on the first scan by Adaware SE. the second scan
| resulting in 24 finds and the third 12. A fourth and final scan revealed a
| clean system. Furthermore I was able to delete the NCasePackage.exe file.
|
| Thanks for your help