Trojan Problem

Puppetmaster · 25 Jul 2006 at 00:33

Ok well norton just detected like 3 trojans in my windows\system32 folder, but i cant delete them due to it being access denied. anyway ican delete them? boot into safe mode?

Sputnik II · 25 Jul 2006 at 09:26

Maybe you could try something else like trojanhunter and see if that allows you to delete them?

Puppetmaster · 25 Jul 2006 at 09:54

well norton detected them first didnt bother to delete them i dont think, so i tried my self which failed with the above problem.

ran a scan with norton, couldnt delete them from there.

AfroLightening · 25 Jul 2006 at 18:09

Boot up into Windows Safe mode, should be able to delete them from there, manually if you have to.

hp7909 · 25 Jul 2006 at 18:42

AfroLightening said:
Boot up into Windows Safe mode,{snip}

...and run this

Duke · 25 Jul 2006 at 19:23

hp7909 said:
...and run this

What special about that scanner, out of interest?

Puppetmaster · 31 Jul 2006 at 23:17

ok well neither of those programs worked in safe mode, spydoctor detected it but i need to buy it to remove it (or try to).

I tried renaming it moving it etc still wont die lol. Norton keeps moaning also, wont quarentine it either.

Any ideas apart from a format?

P_A_N_I_C · 31 Jul 2006 at 23:31

ive got a suggestion but i dont suffer from trojans (that i know of), but it might be of some use if nothing is working.

grab hold of Process Explorer

i'm guessing it cannot be deleted because it has a running process or something?

run the app - it's like task manager on steroids

it shows all running processes, and tells you everything you could ever want to know about it. and hopefilly the info about where all it's files are stored etc that are keeping it alive. just start killing them off so you can delete it.

good luck

what ar the trojan names btw?

Puppetmaster · 31 Jul 2006 at 23:33

winjyp32.dll is the file norton thinks is a trojan.

P_A_N_I_C · 31 Jul 2006 at 23:36

also http://www.ewido.net/en/download/ is recommended

Puppetmaster · 31 Jul 2006 at 23:43

using that process thing, it isnt in there tho

Phog · 1 Aug 2006 at 00:27

Is there anything about them on a hijack this log?

Puppetmaster · 1 Aug 2006 at 00:42

havnt tried that yet

KizZ · 1 Aug 2006 at 00:47

http://ccollomb.free.fr/unlocker/

Mrchu_ · 1 Aug 2006 at 01:31

Are you an administrator when you do this(safe mode)? this should give you manual delete access.Try task manager for any "odd" processes before you delete,stop those that look dodgey processes running in ram.

anything nav is norton anti virus,dont stop those

Also does system restore (have to be) set to off,before you do this to stop the trojan reproducing itself, someone?

sorry to keep editing posts,but you should find out what they are before doing above suggestions as these give you full "root" access and can stuff your windows setup if you delete the wrong thing aye.