Infected file

[kostya]

I got rundll32.exe infected with Trojan horse.
It had been detected by Norton AniVirus.
I placed it in quarantine and it could not be repaired.
I wish to delete this file from my pc for good.
Please inform me how would it affect my windows and if it
would how could I prevent it?

Thank you

Kostya

 

[DL]

Norton usually gives the name of the virus, and presents you with a link for
further info, which takes you to the symantec (Norton) web page with info on
the virus.
If youve got pased this stage go to www.symantec.com / Security Response /
Virus List and locate the particular virus for further info
David

 

[CaptainCrazy]

Hi Kostya,

I advise extracting a fresh rundll32.exe from your Windows disk and placing
that on your system before rebooting or you may run into troubles.

Regards,
Capt.Crazy

 

[Doug Knox MS-MVP]

Capt. Crazy,

Its unlikely that the functional version of rundll32.exe, that Windows depends on and uses, has been overwritten. This is a protected file, and if it was overwritten, Windows would replace it with the backup copy using System File Protection.

Most likely the Rundll32.exe file that is the virus is in the Windows folder, rather than Windows\System32.

 

[Doug Knox MS-MVP]

Reboot your computer into Safe Mode and scan your system again. However, this will not remove the Registry entry that tries to load the virus itself.

Look up the virus name at:

http://www.symantec.com/avcenter/vinfodb.html and follow the removal instructions there.