How do I delete or quarantine a "download.troajn" file?

[Guest]

So I've done all my scans (Norton; Spybot; Ad-Aware; etc.) in Windows XP safe
mode; cleaned up everything and all that, but now when I restart, Norton
displays a window notifying me that there is something called
"downloader.trojan" on my computer, and Norton cannot delete or remove it
....(?)

I am a subscriber to Semantec but I cannot find any forum or tech support
message board to answer how I can now get rid of this infection.

(I know about their forums, and have read them but no where is it explained
to me what it is I must do)

It's all fine and good that I now know "d.t" is there, but I need to get rid
of it.

Is there any procedre I can can go ahead and do myself? Is this some file
somewhere I can just go delete?

Thanks for any help ...

 

[Shenan Stanley]

So I've done all my scans (Norton; Spybot; Ad-Aware; etc.) in Windows
XP safe mode; cleaned up everything and all that, but now when I
restart, Norton displays a window notifying me that there is
something called "downloader.trojan" on my computer, and Norton
cannot delete or remove it ...(?)

I am a subscriber to Semantec but I cannot find any forum or tech
support message board to answer how I can now get rid of this
infection.

(I know about their forums, and have read them but no where is it
explained to me what it is I must do)

It's all fine and good that I now know "d.t" is there, but I need to
get rid of it.

Is there any procedre I can can go ahead and do myself? Is this some
file somewhere I can just go delete?

(This, of course, will erase any previous restore point you have.)

- Turn off System Restore.
http://support.microsoft.com/?kbid=310405
- Reboot.
- Turn on System Restore.
http://support.microsoft.com/?kbid=310405
- Make a Manual Restoration Point.
http://snipurl.com/68nx

 

[WTC]

did you do a search for it on their webpage, look what I found in one try.

http://securityresponse.symantec.com/avcenter/venc/data/downloader.trojan.html

 

[Eugene Fridman]

Shenan,

If the offending file is in System32 directory could user rights interfere
with removal? Does it necessary to login as Administrator?

TIA, Eugene

================================================================

 

[Shenan Stanley]

Shenan,

If the offending file is in System32 directory could user rights
interfere with removal? Does it necessary to login as Administrator?

Yes - limited users may not have the rights needed to delete certain files
in the System32 directory. SOme trojans/Adware/Apyware is even made to
remove admin rights from the things it does so that it is harder to remove.

 

[Guest]

Thank you for that lead to their (Semantec's) own recommendations ;;; guess I
missed finding that ... will attempt the procedre they outline ...

,,, which corresponds to the earlier helpful suggestions in the messages for
me.

It's on my home computer (Im the administrator);

It sounds like they also advise changing passwords ... I've only do that
once every 1-2 years ...

Thanks everyone ...

Michael

 

[Kelly]

Download.Trojan
http://www.google.com/search?hl=en&q=download.trojan

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Alex Nichol]

So I've done all my scans (Norton; Spybot; Ad-Aware; etc.) in Windows XP safe
mode; cleaned up everything and all that, but now when I restart, Norton
displays a window notifying me that there is something called
"downloader.trojan" on my computer, and Norton cannot delete or remove it
...(?)

Probably because it has got into a restore point, which Norton can see
but cannot change. It can do no harm there, unless you restore to the
point concerned. So wait for a new clean one to have been made (or go
to Start - All Programs - Accessories - System Tools - System Restore
and create one manually) then Start - All Programs - Accessories -
System Tools - Disk Cleanup and on the More Options use the button to
delete all but the more recent point - the virus will go along with the
point it is in

 

[Guest]

Progress report:

I have:

disabled System Restore
updated my virus definitions
restarted in Safe Mode
run a full (comprehensive) scan with my norton
cleared the TIF files

(My scan, by the way, said it "detected no viruses" ....?)

I then restarted back in Normal Mode and enabled System Restore.

I don't see that box anymore that said I had a download .trojan thing.

Does this mean I got rid of it, even if my norton scan said it "didn't find
anything"? I'm confused.

I still have those annoying "Only the Best" pop up things ...

But did I actually truly get rid of the trojan thing yet?

Thanks for all the help, appreciate it!

Michael

 

[Malke]

Progress report:

I have:

disabled System Restore
updated my virus definitions
restarted in Safe Mode
run a full (comprehensive) scan with my norton
cleared the TIF files

(My scan, by the way, said it "detected no viruses" ....?)

I then restarted back in Normal Mode and enabled System Restore.

I don't see that box anymore that said I had a download .trojan thing.

Does this mean I got rid of it, even if my norton scan said it "didn't
find anything"? I'm confused.

I still have those annoying "Only the Best" pop up things ...

But did I actually truly get rid of the trojan thing yet?

Thanks for all the help, appreciate it!

Michael, it sounds like you got rid of the trojan but that your computer
still has non-viral malware on it. If it were clean, you would not be
getting the "Only the Best" popups. So continue your cleaning by doing
the following steps. You can ignore Step 1 (av scan) since you've
already done that. Start by using Ad-aware and Spybot and only progress
to the other steps like Hijackthis if you need to. Do all scans in Safe
Mode.

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

HijackThis is an excellent tool to discover and disable hijackers, but
it requires expert skill. See below for HijackThis links. A combination
of HijackThis and About:Buster works well in removing the About:Blank
homepage hijacker. Again, this is an expert tool and novices should get
help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

General:
http://forum.aumha.org/ - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke

 

[Eugene]

Alex,

PMJI

Probably because it has got into a restore point, which Norton can
see but cannot change.

I have the situation when Norton reports Downloader.Trojan on a DLL
file in System32 directory but can not remove it. The file is indeed
in the directory but Windows do not allow to delete it even in Safe
mode with System Restore disabled.

Symantec suggests that there might be "auto-run" registry settings that
point to the offending file. Should such registry entries be ignored
by Safe mode? If not then it can explain the behavior since these
files will be indeed open.

Please advise. TIA, Eugene