Problem with system restore

[Vic]

Norton AV 2002, with current virus definitions tells me
that I have the BACKDOOR.TROJAN virus on my computer. It
states that it cannot repair this file(Windows\system32
\py.exe). When I click ok, I get the same message except
now it says Access to file was denied.
Symantec won't support AV 2002 even tough my subscription
is good until Feb 2005. They do have a procedure for
removing this virus, but, whether I try the manual route
or use one of their virus removing tools, both require
that system restore be disabled. When I attempt to
disable, I get, after the normal message, the
following: "System Restore encountered an error trying to
enable/disable one or more drives. Please restart your
machine and try again". Restarting several times solves
nothing, as the same message appears each time.
I attempted also to disable system restore through
msconfig>processes by unchecking the system restore
entry. I get the same message.

 

[Juan]

Greetings:

Go to Pandasoftware and run a scan to clean your system.

BACKDOOR.TROJAN Details and fixes
http://www.sss.ca/sensible/home.nsf/a64058508e765d31852568c90012f088/41f9556
769b1808b85256b3b0064e96f?OpenDocument

BACKDOOR variants.
http://www.pandasoftware.com/virus_info/encyclopedia/results.aspx?tipoBusque
da=vi&termino=BACKDOOR&pagina=2

Scan your system online.
http://www.pandasoftware.com/virus_info/encyclopedia/

Hope this helps

----------------Original Message----------------

 

[Guest]

I have a problem with this virus too - but even with disabling system restore, it keeps coming back. I've deleted my temporary internet files and repeated py.exe from my system32 folder repeatedly (and emptied my quarantine, recycle bin, etc). After doing this, my computer scans as clean, but as soon as I open internet explorer another virus warning will pop up from Symantic saying that another virus has been found (or 500 of them, as the case may be) with the name py[1].exe or py[2].exe in my temporary internet files. Lo and behold, a new py.exe will have appeared in my system32 folder and the who process begins anew. If anybody has successfully founjd a way to remove this thing please tell me, as my friends tell me the only thing left for me to do is to reinstall windows which is a huge pain.