Free Weekly Tech Newsletter

jbbrown211 · 07-31-2006, 06:58 PM

I am getting multiple different Trojan Horse notifications from Norton, but it is saying that it can't access the file, delete the file, etc. What other Trojan Removal program should I use? I also looked in the directory where they are saying it is, and I can't see anything, even with unhiding the files. PLEASE HELP!

**rjfvillarosa** · 07-31-2006, 07:00 PM

Download and install Ewido and run the scans straight away after updating: www.ewido.net and try running an online scan at http://housecall.trendmicro.com

jbbrown211 · 07-31-2006, 07:27 PM

Thanks. Will this cause any problems with my Norton Internet Security that is already installed? Or can I run it separately?

**rjfvillarosa** · 07-31-2006, 07:43 PM

It should run fine, when did you get that Norton security suite? what version is it?

jbbrown211 · 07-31-2006, 07:50 PM

I got it earlier this year, it's 2006.

**rjfvillarosa** · 07-31-2006, 07:59 PM

I would like to recommend that you get rid of it entirely especially if your are running XP with service pack 2. Norton doesn't have a particularly good name these days, it's not a bad antivirus or firewall but it can be a little over zealous and a major system resources hog. There are a few far better applications out there and some of them are free, as regards the firewall the builtin firewall of service pack 2 is perfectly adequate.

jbbrown211 · 07-31-2006, 09:09 PM

There were some files that Trendmicro housecall couldn't delete, I still need to run ewido....

**rjfvillarosa** · 07-31-2006, 09:30 PM

What operating system are you running and did you buy that copy of Norton?

***glc*** · 08-01-2006, 03:56 AM

You may have to run your scans in safe mode.

kev7555 · 08-01-2006, 03:25 PM

You may have files located in system restore.

System restore files are protected from removal by anti-virus programs. You may have to disable system restore to remove these.

-Kev

jbbrown211 · 08-02-2006, 05:35 PM

I'm trying to boot and scan in safe mode now. I ran multiple scans in normal windows startup and I don't get the trojan message anymore, but my computer is still running SLOW...takes minutes to load even the icons in my startup tray.....

**rjfvillarosa** · 08-02-2006, 06:02 PM

What scans are you running in safe mode?

jbbrown211 · 08-02-2006, 06:02 PM

OK, something is wierd. I just started in straight "Safe Mode", logged in, and the screen is black with Safe Mode written in the 4 corners, and some Microsoft Windows XP build info going across the top. I thought I saw a window pop up very quickly when I logged on and then it disappeared. Now nothing is happening, just the black screen. This doesn't seem right...HELP!!

jbbrown211 · 08-02-2006, 06:04 PM

Quote:

Originally Posted by rjfvillarosa

What scans are you running in safe mode?

I'm not sure what to do in safe mode, I've never had to go through this before. I just posted an update above, I'm not having much luck doing anything.....

**rjfvillarosa** · 08-02-2006, 06:05 PM

Reboot into Windows normal, clear out your temporary internet files and switch off system restore. Now boot back to safe mode and try and run Ewido.
What antivirus scanner are you running in safe mode?

jbbrown211 · 08-02-2006, 06:14 PM

I'll give it a shot...stand by. I didn't get to run any antivirus in safe mode before, I was going to run Ewido...should i do a smart scan or a full system scan?

**rjfvillarosa** · 08-02-2006, 06:15 PM

Do you know how to clear the temporary internet files and do you know how to disable system restore?

jbbrown211 · 08-02-2006, 06:34 PM

Yes, did that from IE, system restore disable from control panel. Started up and clicked yes to proceed in safe mode...my windows desktop started to load, then the screen went black with the safe mode in the corners, etc. Before logon the screen runs a trail of text, then proceeds to logon. It's like if I don't click on something very quickly the screen goes black with nothing on the window. Should I be starting up in safe mode with commands, etc? Last time I started up in normal mode to clear temp files, it seemed to be a little faster, but I did disable the internet connection temporarily....

**rjfvillarosa** · 08-02-2006, 06:37 PM

It seems a little odd that you cannot get into safe mode, try and get in without networking.
Are you trying to start safe mode with command prompt?

jbbrown211 · 08-02-2006, 06:46 PM

No, just straight safe mode....should i be using the command prompt safe mode?

**rjfvillarosa** · 08-02-2006, 06:49 PM

You could try it, all the text that will be running down your screen will be the drivers and applications starting up as Windows starts, it will give you and idea of what is starting and where it freezes if it doesn't start.

jbbrown211 · 08-02-2006, 07:15 PM

Trying now. During the text string, it also says "press esc to cancel loading sptd.sys" then goes away after a minute. Should I cancel that part?

jbbrown211 · 08-02-2006, 07:20 PM

OK, I now have a cmd.exe window launched, its waiting for a command. I have no clue how to run anything in DOS, what should i be typing in to run a scan from the command window?

jbbrown211 · 08-02-2006, 07:33 PM

I still have the black screen, I hit ctrl alt delete and took a look at my PROCESSES tab, which shows the following:

taskmgr.exe (CPU column is 00, mem usage column is 4300k)
svchost.exe (00, 7780k)
svchost.exe (00, 3616k)
svchost.exe (00, 3032k)
lsass.exe (00, 720k)
services.exe (00, 3728k)
winlogon.exe (00, 1832k)
csrss.exe (00, 2764k)
smss.exe (00, 404k)
System (00, 208k)
Syste Idle Process SYSTEM (99, 16k)

DOES THAT MEAN ANYTHING TO ANYONE?

**rjfvillarosa** · 08-02-2006, 07:35 PM

When you have the black screen do you have a task bar at the bottom and one or two icons on the side and "safe mode" in each corner of the screen?

jbbrown211 · 08-02-2006, 07:41 PM

safe mode in each corner, no task bar, no icons

**rjfvillarosa** · 08-02-2006, 07:48 PM

You are in Safe Mode but not completely because you should have a task bar and just a few icons.
Have a read of this thread ( http://forum.pcmech.com/showthread.php?t=103171 ) and run a HJT scan, after the scan you will be able to save the results as a text file, just copy and paste the results straight back here in a post, and maybe we can workout what is causing the problem.

jbbrown211 · 08-02-2006, 07:51 PM

thanks, i'll take a look

jbbrown211 · 08-03-2006, 07:10 PM

I'm having serious issues now. I CAN'T start up in Safe Mode, I continue to get the black screen with nothing else happening. Is there some kind of other system startup tool I can use. Or can I go back to a save point and restore my system from a week ago and be safe? I need some kind of help, my computer has slowed to a crawl and I'm getting pop ups everywhere telling me I have system critical virus's on my computer. It's hard to tell if they are legit or just fraud notifications that are part of the virus. I'm on my laptop now and am afraid to leave my computer on with the modem on......Any suggestions?

**rjfvillarosa** · 08-03-2006, 07:15 PM

You certainly appear to have a bad infection, is it possible to format the harddrive and reinstall Windows?
Did you read the post about HJT (high jack this)?
Do you know how to access the start up tab in MSCONFIG?

07-31-2006, 06:58 PM	#1
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	Norton Not Deleting Trojan Horse(s) I am getting multiple different Trojan Horse notifications from Norton, but it is saying that it can't access the file, delete the file, etc. What other Trojan Removal program should I use? I also looked in the directory where they are saying it is, and I can't see anything, even with unhiding the files. PLEASE HELP!

07-31-2006, 07:00 PM	#2
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	Download and install Ewido and run the scans straight away after updating: www.ewido.net and try running an online scan at http://housecall.trendmicro.com __________________ Niwa no niwa ni wa, niwa no niwatori wa niwaka ni wani o tabeta.

08-01-2006, 03:25 PM	#10
kev7555 brewer, mostly... Join Date: Jun 2004 Location: Laying on the floor, in the brewery Posts: 1,315	You may have files located in system restore. System restore files are protected from removal by anti-virus programs. You may have to disable system restore to remove these. -Kev __________________ Symantec-free zone. To stay malware free: AVG antivirus/antispyware, Malwarebytes anti malware, Commodo Pro free firewall, ccleaner, Windows updates. or.... just install Linux Too many computers in this house to list. They are all my builds, some AMD some Intel...

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

Need Some Help? Type Your Keywords Here:

Still Need Help? Type Your Keywords Here:

Free Weekly Tech Newsletter

07-31-2006, 07:27 PM	#3
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	Thanks. Will this cause any problems with my Norton Internet Security that is already installed? Or can I run it separately?

07-31-2006, 07:43 PM	#4
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	It should run fine, when did you get that Norton security suite? what version is it?

07-31-2006, 07:50 PM	#5
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	I got it earlier this year, it's 2006.

07-31-2006, 07:59 PM	#6
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	I would like to recommend that you get rid of it entirely especially if your are running XP with service pack 2. Norton doesn't have a particularly good name these days, it's not a bad antivirus or firewall but it can be a little over zealous and a major system resources hog. There are a few far better applications out there and some of them are free, as regards the firewall the builtin firewall of service pack 2 is perfectly adequate.

07-31-2006, 09:09 PM	#7
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	There were some files that Trendmicro housecall couldn't delete, I still need to run ewido....

07-31-2006, 09:30 PM	#8
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	What operating system are you running and did you buy that copy of Norton?

08-01-2006, 03:56 AM	#9
*glc* Forum Administrator Staff Premium Member Join Date: May 2000 Location: Joplin MO Posts: 41,163	You may have to run your scans in safe mode.

08-02-2006, 05:35 PM	#11
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	I'm trying to boot and scan in safe mode now. I ran multiple scans in normal windows startup and I don't get the trojan message anymore, but my computer is still running SLOW...takes minutes to load even the icons in my startup tray.....

08-02-2006, 06:02 PM	#12
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	What scans are you running in safe mode?

08-02-2006, 06:05 PM	#15
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	Reboot into Windows normal, clear out your temporary internet files and switch off system restore. Now boot back to safe mode and try and run Ewido. What antivirus scanner are you running in safe mode?

08-02-2006, 06:14 PM	#16
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	I'll give it a shot...stand by. I didn't get to run any antivirus in safe mode before, I was going to run Ewido...should i do a smart scan or a full system scan?

08-02-2006, 06:15 PM	#17
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	Do you know how to clear the temporary internet files and do you know how to disable system restore?

08-02-2006, 06:34 PM	#18
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	Yes, did that from IE, system restore disable from control panel. Started up and clicked yes to proceed in safe mode...my windows desktop started to load, then the screen went black with the safe mode in the corners, etc. Before logon the screen runs a trail of text, then proceeds to logon. It's like if I don't click on something very quickly the screen goes black with nothing on the window. Should I be starting up in safe mode with commands, etc? Last time I started up in normal mode to clear temp files, it seemed to be a little faster, but I did disable the internet connection temporarily....

08-02-2006, 06:37 PM	#19
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	It seems a little odd that you cannot get into safe mode, try and get in without networking. Are you trying to start safe mode with command prompt?

08-02-2006, 06:46 PM	#20
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	No, just straight safe mode....should i be using the command prompt safe mode?

08-02-2006, 06:49 PM	#21
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	You could try it, all the text that will be running down your screen will be the drivers and applications starting up as Windows starts, it will give you and idea of what is starting and where it freezes if it doesn't start.

08-02-2006, 07:15 PM	#22
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	Trying now. During the text string, it also says "press esc to cancel loading sptd.sys" then goes away after a minute. Should I cancel that part?

08-02-2006, 07:20 PM	#23
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	OK, I now have a cmd.exe window launched, its waiting for a command. I have no clue how to run anything in DOS, what should i be typing in to run a scan from the command window?

08-02-2006, 07:33 PM	#24
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	I still have the black screen, I hit ctrl alt delete and took a look at my PROCESSES tab, which shows the following: taskmgr.exe (CPU column is 00, mem usage column is 4300k) svchost.exe (00, 7780k) svchost.exe (00, 3616k) svchost.exe (00, 3032k) lsass.exe (00, 720k) services.exe (00, 3728k) winlogon.exe (00, 1832k) csrss.exe (00, 2764k) smss.exe (00, 404k) System (00, 208k) Syste Idle Process SYSTEM (99, 16k) DOES THAT MEAN ANYTHING TO ANYONE?

08-02-2006, 07:35 PM	#25
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	When you have the black screen do you have a task bar at the bottom and one or two icons on the side and "safe mode" in each corner of the screen?

Subscribe to THE INSIDER

Need Some Help? Type Your Keywords Here:

Still Need Help? Type Your Keywords Here:

Free Weekly Tech Newsletter

08-02-2006, 07:41 PM	#26
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	safe mode in each corner, no task bar, no icons

08-02-2006, 07:48 PM	#27
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	You are in Safe Mode but not completely because you should have a task bar and just a few icons. Have a read of this thread ( http://forum.pcmech.com/showthread.php?t=103171 ) and run a HJT scan, after the scan you will be able to save the results as a text file, just copy and paste the results straight back here in a post, and maybe we can workout what is causing the problem.

08-02-2006, 07:51 PM	#28
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	thanks, i'll take a look

08-03-2006, 07:10 PM	#29
jbbrown211 Member (9 bit) Join Date: Feb 2003 Location: New Jersey Posts: 404	I'm having serious issues now. I CAN'T start up in Safe Mode, I continue to get the black screen with nothing else happening. Is there some kind of other system startup tool I can use. Or can I go back to a save point and restore my system from a week ago and be safe? I need some kind of help, my computer has slowed to a crawl and I'm getting pop ups everywhere telling me I have system critical virus's on my computer. It's hard to tell if they are legit or just fraud notifications that are part of the virus. I'm on my laptop now and am afraid to leave my computer on with the modem on......Any suggestions?

08-03-2006, 07:15 PM	#30
rjfvillarosa Staff Premium Member Join Date: Sep 2004 Location: Cardiff, Wales. UK Posts: 6,555	You certainly appear to have a bad infection, is it possible to format the harddrive and reinstall Windows? Did you read the post about HJT (high jack this)? Do you know how to access the start up tab in MSCONFIG?