Cannot quarantine or deleate virus

[Molendie]

hey y'all. Im doing some work on my friends dell and upon running norton (which is up to date) I found 7 virus's (couple of em trojans) and after the search it wouldnt quarantine or deleate them ("quarantine failed", "deleation failed"). I then tried this again in safe mode and got the same results. Any ideas of how to get rid of these (please dont say format lol)? Thanks in advance for any help you can throw my way.
-Timmy

 

[SESaskDFC]

Howdy:

What are the virii/trojans and where does Norton say they are located??

Murray

 

[Molendie]

C:\\Windows\pft5364~TMP\Plugins

ABsr.exe
ausvc.exe (X3)
bvt.exe (X2)
F39BB1AD.exe

 

[SESaskDFC]

Did you try going to the Norton website for manual removal instructions??

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.autoupder.html

Murray

 

[ordisecours]

I will try to terminate these process in operation with these names or similars ( ctrl+alt+del ) ...

May also try to desactivate it in msconfig>>startup and reboot in safe mode...and rescan...

Maybe also a good scan with spybot or adaware will help

GOOD LUCK



..._ - _ - every trouble shooting begin with power ON !! we always forgot one day. HAVE A NICE DAY.

 

[Molendie]

hey thanks guys. ya i already got rid of around 150 items with adaware and spy bot and then went into safe mode and tried norton again but with no avail. Ill check out that manual removal but i went to nortons virus library or whatever and couldnt even find those on my list in it!

 

[Molendie]

ok guys. im really frustrated now!!! I took the FixAutoupder.exe over to my friends house and it didnt find anything! Not in regular mode or safe mode! So to make sure they were still there I ran norton again and sure enough there they were!!! so let me just say it again...
1) infected with back door trojan files (i.e. absr.exe and bvt.exe)
2) norton updated, cant quarantine or deleate these viruses (tried in safe mode too)
3) adware and spy bot already run
4) FixAutoupder doesnt find anything (tried in safe mode too)
ANY HELP would be great! this is seriously driving me crazy over here!

 

[ordisecours]

did you desactivate the restauration fonction in XP ( If xp you have ?)

do a search for the file in start>>search>> (option all files and hidden folder...) and delete it manually

Hope it help...

..._ - _ - every trouble shooting begin with power ON !! we always forgot one day. HAVE A NICE DAY.

 

[Molendie]

his computer is running ME. Dont know a about the restauration function. Im gonna try that search plus look for them in the registry. But, if norton cant deleate them, will I be able to manually?? thanks.

 

[ordisecours]

...
windows ME should have restauration function, like XP...

and for delete it manually after search...I will do that in safe mode and all start section in msconfig desactivate.

You're near succes I think....don't give up.


..._ - _ - every trouble shooting begin with power ON !! we always forgot one day. HAVE A NICE DAY.

 

[SESaskDFC]

It's called "System Restore".. Disable it..

Murray

 

[Molendie]

ok cool. yes when I ran the autoupder I had system restore disabled and still nothing. Next time I go over Im gonna disable system restore once again, go into safe mode, search for these monsters, and look in the registry too. Ill let u guys know. thanks.

 

[Zaster55]

Just a general note on handling infections that Norton AV cannot get rid of: Norton AV will usually give you the name of the virus or else the name of some files that are distinctive to that virus (often a .exe file). Just Google those names and you will often find detailed instructions for how to remove the virus manually. In most cases other people have successfully dealt with the same virus and posted a solution somewhere. If the solution calls for editing the Registry, be very careful and follow all the safety steps for doing that.

This has saved me more than once.

 

[glacierxx]

Have you looked in the quaratine folder to see if they are possibly still there. If they try to delete them and then run the scan. What version of Norton are you using.

"evil prospers when good men do nothing”

 

[allteltec]

You are 9X fat32 file store, no problem deleting here. Make your self a Floppy boot Desk, copy attrib to it and boot from it. If you know the file name start at C:\
C:\ and type attrib bvt.exe /s
cd to where the file is, like
C:\ CD\Windows\pft536~1\Plugins
attrib -s -r -h bvt.exe
del bvt.exe

Good old DOS that can't hide here.