Virus help

[David]

Trying to fix a friends PC which seems to have a trojan horse in C:\WINDOWS\hosts and C:\WINDOWS\system32\drivers\etc\hosts but neither file exists on the computer, and Norton says it can't remove it.

I did however remove two files from the startup thing:

nthm.exe
wintime.exe
carpserv.exe

nthm.exe put itself back in the startup list when I rebooted, however - could this be the trojan?

A format and reinstall is possible but time consuming and would mean backing everything up, and is a last resort.

[dicecca112]

did you try loading the nortons disk at bootup, and scanning for viruses that way

[David]

did you try loading the nortons disk at bootup, and scanning for viruses that way


I ran a system scan which said that explorer.exe was infected. Just gonna do a reinstall because there are other problems with the computer (spy/ad-ware related) that Adaware and Spybot couldnt pick up.

[jrbob]

If you are working with XP make sure system restore is turned off and reboot before you remove anything. I would also turn off the power on the back of the rigg or unplug it for 5min to make sure that the memory gets cleared.

[snafumaster]

Try running norton in safe mode too. Not exactly sure why, But I have had some that will only come out using that method. Spybot works well in safe mode too.

[nahmus]

remove the drive and install it in another PC and scan it from there. Since nothing was booted from that drive the scan should be able to remove whatever it needed to

[CheeseMan]

running norton in safe mode always helps a lot

[Bald Shadow]

Don’t forget to turn off system restore before you run your antivirus program otherwise the virus will just return.

[snafumaster]

Don’t forget to turn off system restore before you run your antivirus program otherwise the virus will just return.
As a general rule I turn off system restore as part of the install procedure. I would rather rely on other manual methods of backup.

[Bald Shadow]

As a general rule I turn off system restore as part of the install procedure. I would rather rely on other manual methods of backup.

I do the same thing. :D

[diehrd]

I would drag his drive to my system and run the virus,Trojan,spy and ad scanners on it..I have fixed many drives infeted like his that way...And if he has XP on it u can run chk disk and repair many XP file corruptions.........