can't delete trojan horse virus

[Guest]

-i seem to have been infected by a trojan horse virus, as listed by my a.v.g. anti-virus soft-ware, and it is only one file; the soft-ware was unable to delete/remove it, unofrtunately. but my computer will not allow me to manually delete the file either; the file is an "...Application Data\RNCR.EXE file. what can i do? the virus is less than one day old.

 

[Ross Durie]

The name of the trojan would help unless you just want to be told to kill
the appropriate process and remove its associated registry entry.

--
Ross

-i seem to have been infected by a trojan horse virus, as listed by my

a.v.g. anti-virus soft-ware, and it is only one file; the soft-ware was
unable to delete/remove it, unofrtunately. but my computer will not allow me
to manually delete the file either; the file is an "...Application
Data\RNCR.EXE file. what can i do? the virus is less than one day old.

 

[Kelly]

Hi Thomas,

These tools will allow you to remove it, I would suggest starting with
HijackThis; however, it takes a combo to really clean your system. Good
luck with the process!

Cleaning Up XP: http://www.kellys-korner-xp.com/xp_c.htm#cleanup

 

[Kelly]

He mentioned it.

 

[Nathan McNulty]

Also, another excellent program is PSTools from www.sysinternals.com

There is a program in that called PSKill that allows you to kill a
process even if Task Manager will not let you. This is useful for
killing virus processes and then removing the file. You can also remove
the file if it is locked by using task manager to kill explorer.exe and
start cmd. Navigate to the virus and delete it and then start explorer
again.

Nathan McNulty

 

[Guest]

-the name of the trojan horse appears in my virus scan as: Trojan horse DOwnloader.Purity., and then there is a character that i cannot recognize. i will try the suggestions so far. also, i forgot to add the the problem with deleting it manually was that i had an, "access denied", message that sadi something about the file being used by another program?

 

[Guest]

-kelly: thank-you fro the response. i used hijack this, but it suggested that i show the list log from running the program to someone who would know what to delete. how can i do that?

 

[Guest]

-nathan: pskill didn't work. i downloaded and extracted the files, but i could not run the application, it just wouldn't come-up.

 

[Hilary Karp]

Post the log to a forum that specializes in this. Here are some:

Forums to Intrepret HijackThis Logs:

http://www.spywareinfo.com/forums/
http://forum.aumha.org/viewforum.php?f=30

 

[Guest]

-to all: this is thomas, thank-you for all your posts. i have resolved my issue with the trojan horse downloader purityscan by advice from a verizon technician. he suggested that i do a windows restore, (not a system restore!), and this promptly solved the problem.

 

[Hilary Karp]

Glad to hear you got it fixed and thanks for posting back.

 

[Hilary Karp]

Thomas..uhh...be aware that Purityscan contains adware. It's "maleware"
in itself! See these links to remove it:

http://sarc.com/avcenter/venc/data/adware.purityscan.html

http://www.kephyr.com/spywarescanner/library/purityscan/index.phtml

http://vil.nai.com/vil/content/v_100828.htm

 

[Kelly]

Thanks for the feedback, Thomas. Hope all goes well for you from here.