downloader.trojan and can't get rid of it

[mquinn0908]

I have a Windows 2000 pro box that has been infected by the downloader.trojan virus and I can't get rid of it. I have norton corporate edition 9.0 and when the real time scan catches the files it is deleting them but it keeps comming up with more files that are infected. All of the files seem to be found in the users temp folder in the local setting directory under documents and settings. I have deleted everything out of that folder and booted into safe mode and scanned and still have the problem. I have ran Ad-Aware and Spybot and removed any problems found and after rebooting I am still getting notifications that files are comming up infected. Help please!! What else can I do to get rid of this??

 

[aquias]

This is Symantec's recommendation for removing this virus...

http://securityresponse.symantec.com/avcenter/venc/data/downloader.trojan.html

 

[mquinn0908]

Thank you for the response but I have already tried Symantec's recommendation and I still have this problem.

 

[mquinn0908]

I have already tried Symantec's recommendation and unfortunately that didn't take care of the problem. I am still receiving alerts that the downloader.trojan virus was found in a file and it does delete the file.

 

[aquias]

A question, is this system on a network or is this a stand alone system?

 

[mquinn0908]

This system is on a network.

 

[aquias]

Disconnect the system from the network, remove the virus from the system and let it sit for a day or so. If the system remains uninfected, then you're receiving the virus from somewhere else, probably from the network.

 

[mquinn0908]

That is the thing, when I run a scan it doesn't find anything, it is only when the sytem is running and then the real time scan will detect the files as they come up.

 

[diogenes10]

faq608-4650:

Try an online av scan.
Try an antitrojan scan.

If still no sucess review or post a hijackthis log.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[aquias]

Diogenes hit the right thing to look into as well. I still have a feeling that the infection to this system is coming from somewhere else on the network, but follow what he suggested prior to tearing into my suggestion.