Norton Popup Window tells me I have a SPYBOT WORM

[seymour]

but when I run a scan it does not show up. I went to the website (symantic)
and followed the directions for removing this particular spybot worm and I
still cannot find it...the directions say I should search for tftp*.exe*
with zero bytes...I found 3 tftp files but none have zero bytes...
what is going on?

 

[Duane Arnold]

but when I run a scan it does not show up. I went to the website
(symantic) and followed the directions for removing this particular
spybot worm and I still cannot find it...the directions say I should
search for tftp*.exe* with zero bytes...I found 3 tftp files but none
have zero bytes... what is going on?

Well,

On my NT based XP machine, there is only one tftp.exe in Windows\system32
on XP and Winnt\system32 on Win 2k or Win NT 4.0. There is a second copy
of tftp.exe in the DLLcache directory off of System32, which is a hidden
directory that holds all O/S files in case a O/S file is deleted, which
should not be in the search count unless the directory is not hidden. In
the case of a deleted system file, the O/S will replace it with the one
in the DLLcache directory.

So, if it's not in the root of the System32 or System32\dllcache, then
you should consider them suspect.

The tftp.exe(s) in System32 and Dllcache directories should match in file
size and date of creation as a check as to them being valid.

Duane

 

[Anonymous]

but when I run a scan it does not show up. I went to the website (symantic)
and followed the directions for removing this particular spybot worm and I
still cannot find it...the directions say I should search for tftp*.exe*
with zero bytes...I found 3 tftp files but none have zero bytes...
what is going on?

The TFTP files are generated in the startup folder by some "spybot"
variants. They would be of the format TFTP###, where #can be any number.
Tftp.exe files located elsewhere are probably Windows system files.

The Symantec instructions that I saw do not say "tftp.exe" but tftp###,
where # is any number.

Make sure that you followed ALL of the removal instructions exactly.