2000 Virus Problem

[mrfarid]

I have a Windows 2000 Client that Norton Anti picks up as having the download.trojan virus. NAV Quarentines it and then the virus message box comes agian. it states that the virus is located in temp as 28[1].bin. I followd NAV instructions for removing but I soon as I plug the computer to the network (Internet) there it goes again. Sometimes it also says the virus is located in WINNT/SYSTEM32/Cache as shopinst.exe but when I look for it, it is not there.

So far I booted in Safemode removed all temps, ran a NAV scan (Comes up clean). Ran spybot S&D. the computer looks clean until i plug it back into the network.

Thanks

 

[technome]

Have you run Adawre and Spybot from safemode?
Search for shopinst.exe in safemode.
Seach for *.tmp, delete all.
Emty the internet history, folders
Empty all \temp folders

 

[AV1611]

Your Norton AV bites for one. Get online and run an online scan at

http://www.antivirus.com

Then if you can't delete the virus you will have to slave the hard drive to another computer with current AV. Norton by default passes Trojans because it is set to clean viruses and you can't clean a Trojan.

As far as spybot goes, it ain't worth anything either. Get Microsofts beta spyware checker, formerly Giant Antispyware, and Spysweaper from

http://www.webroot.com.

They will clean up the spyware problems.

AV

 

[Philly44]

I would definetly agree with technome to run Ad-Aware and Spybot. Despite what AV1611 thinks SpyBot and Norton are both excellent products(no I don't work for either company or any affiliate), though we use McAfee for anti-virus where I am, we do use SpyBot and AdAware quite extensively and have never had problems with either. As for the microsoft anti spyware, I'm sure its a nice product and I have little doubt that it will be a great tool but I never use anything with BETA in the name on production machine, thats just my personal preference though.

As for a strategy to get rid of that PC entirely, you may need to boot into Windows PE (Its the DOS based OS made available for XP) and tehn run your anti-virus from. If you would rather go into safe mode, try booting into it but before you run Norton, rename the executable to something like s.com. there are a lot ov viruses out there that are programmed to either kill, fake out, or spawn new copies when they see the antivirus executable running.

 

[bofhrevenge2]

Philly44's suggestions are good, i would just like to recommend the product below as it is free, unlike Windows PE.

http://www.nu2.nu/pebuilder/

Also this is good for finding hidden running processes and files, though mabe a bit over the top in this situation.

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

 

[technome]

Philly44...
Av1611 comment about Microsofts Spyware checker is a good one; supposedly it finds more malware than other checkers. Nothing wrong with running them all.