Norton locked 2 Win2000 files, why cant I reload them?

[Bradley1234]

I just discovered Norton AV had quarantined 2 files from system32:

PDSched.exe and winole.exe

Ive been down this road before, they are infected even with very high
security settings, but even though I have the original CD for Win2000 that I
purchased, and have the SP4 CD that I bought, these files cannot be found on
any CD and I cant get them from Windows Update or on the net. There are
great descriptions of what they are, but is there a way to find and replace
the right versions from the CDs??

Thanks

 

[aD]

I just discovered Norton AV had quarantined 2 files from system32:

PDSched.exe and winole.exe

Ive been down this road before, they are infected even with very high
security settings, but even though I have the original CD for Win2000 that I
purchased, and have the SP4 CD that I bought, these files cannot be found on
any CD and I cant get them from Windows Update or on the net. There are
great descriptions of what they are, but is there a way to find and replace
the right versions from the CDs??

I'm running Windows 2000 SP4 and can't find either of those files.

Maybe they are part of another program or are files that are wholly viral
(as opposed to a file that's been infected).

For WinOLE:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.hatter.html
(Writeup isn't sure if it's winole.exe or winole32.exe)

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.rpcbot.html

As for PDSched.exe, I've found references to Raxco's PerfectDisk using this
file as well as:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SDBOT.CN&VSect=T

aD

 

[Bruce Chambers]

Those are _not_ normal Win2K files, therefore they cannot be
"reloaded" from a Win2K CD. Delete them.

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH