BACKDOOR.HACARMY Virus

[Rich Bail]

Norton SW detected the above virus but could not delete it. I did delete the
registry entry, but cannot delete or rename the infected file. It says it
cannot be deleted or renamed. I cannot move it either. The file is
C:\Windows\System32\win32server.scr

Any ideas are welcome.

 

[Patrick]

Rich,

If you are trying to delete the file, and it's saying you can't, it's
probably because it's currently in use. Open your task manager
(ctrl-shift-esc), go to the processes tab, and see if you can identify the
running program. Once you do, highlight it and choose End Process. Then you
should be able to manually delete the file.

Hope this helps,

Patrick Pitre

 

[Mike Pannell]

Don't forget to disable system restore if it is on...here are Norton's
instructions for removal.

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hacarmy.html


Mike Pannell