ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Unable to locate detected Trojan
Randelissimo


Joined: 06 Sep 2006
Posts: 2
Reply with quote
It's been identified by ClamWin but not moved to quaranteen. When I browse to the stated location, I cannot see it, even with hidden files displayed on.

Scan started: Mon Sep 04 17:01:55 2006



File excluded 'C:\Documents and Settings\Administrator\Application Data\DOBE~1\svchost.exe'



C:\Documents and Settings\Administrator\Application Data\DOBE~1\svchost.exe: Trojan.PurityScan.BJ FOUND

-- summary --

Known viruses: 67591

Engine version: 0.88.4

Scanned directories: 456

Scanned files: 1195

Infected files: 1



Not moved: 1

Data scanned: 988.97 MB

Time: 339.016 sec (5 m 39 s)

- Any ideas please?

Thanks in advance.

Rand.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
go to start-run, then type cmd.exe and open the command prompt.

In the command prompt type:
cd C:\Documents and Settings\Administrator\Application Data\DOBE~1\

then DIR

it should list all files
View user's profileSend private message
Randelissimo


Joined: 06 Sep 2006
Posts: 2
Reply with quote
alch wrote:
go to start-run, then type cmd.exe and open the command prompt.

In the command prompt type:
cd C:\Documents and Settings\Administrator\Application Data\DOBE~1\

then DIR

it should list all files


Thank you, how then, would I go about deleting?
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 898
Location: Italy
Reply with quote
the virus is in execution, windows prevents to remove the file, open task manager,
all processes named svchost.exe, winlogon.exe csrss.exe smss.exe lsass.exe and services.exe
that belongs to user and not system are always virus, you may need to use
process explorer from http://www.sysinternals.com/ http://www.sysinternals.com/ to kill them
since win task manager is dumb and it will refuse to kill process by looking at their name
I also suggest to try autoruns utility (same site), check "hide microsoft entries" in the options,
then do a scan, you will have a lot of stuff, most are ok, but some will looks as suspicious.
it also has a context menu to search google for each entry, so you can find more info about each entry.
Don't remove entries until you are sure that is a virus or something like
View user's profileSend private message
Unable to locate detected Trojan
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic