IRC Trojan

[Baloo]

Hi

I run Windows XP home.

Norton has detected an IRC TROJAN virus in windows/sytem32/win32server.exe,
and is unable to repair this file as access is denied.

I've tried to download a replacement for win32server.exe, but can't find
one. Also I cannot delete or move this file.

How can I remove this virus ?

regards

Baloo

 

[David H. Lipman]

1) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Please reboot your PC into Safe Mode
3) Perform a Full Scan of your platform and clean/delete any infectors found
4) Restart your PC and if you are using WinME or WinXP, re-enable System Restore
and then create a new Restore point
5) Perform a "final" Full Scan of your platform then report back your results


Dave



| Hi
|
| I run Windows XP home.
|
| Norton has detected an IRC TROJAN virus in windows/sytem32/win32server.exe,
| and is unable to repair this file as access is denied.
|
| I've tried to download a replacement for win32server.exe, but can't find
| one. Also I cannot delete or move this file.
|
| How can I remove this virus ?
|
| regards
|
| Baloo
|
|

 

[GSV Three Minds in a Can]

1) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Please reboot your PC into Safe Mode
3) Perform a Full Scan of your platform and clean/delete any
infectors found
4) Restart your PC and if you are using WinME or WinXP, re-enable
System Restore
and then create a new Restore point
5) Perform a "final" Full Scan of your platform then report back
your results

Just to add, for the benefit of the OP, that you =don't want= to replace
winserver32.exe, since that =is= the trojan. There is no such file in
WinXP, which is why you can't find a replacement.

fwiw, www.google.com is invaluable for finding answers that have already
been posted.

 

[Baloo]

1) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Please reboot your PC into Safe Mode
3) Perform a Full Scan of your platform and clean/delete any infectors found
4) Restart your PC and if you are using WinME or WinXP, re-enable System Restore
and then create a new Restore point
5) Perform a "final" Full Scan of your platform then report back your results


Dave



| Hi
|
| I run Windows XP home.
|
| Norton has detected an IRC TROJAN virus in windows/sytem32/win32server.exe,
| and is unable to repair this file as access is denied.
|
| I've tried to download a replacement for win32server.exe, but can't find
| one. Also I cannot delete or move this file.
|
| How can I remove this virus ?
|
| regards
|
| Baloo
|
|

Hi

Thanks for your help.

Followed the steps above, Norton still finds the virus and is unable to
remove it !

regards

Baloo

 

[Baloo]

infectors your

Hi

Thanks for your help.

Followed the steps above, Norton still finds the virus and is unable to
remove it !

regards

Baloo

Just ran the scan again, and the item was quarantined and deleted this time.

Thanks, both, for your help.

regards

Baloo