NOD32 not deleting CrowT Trojan it let through

[DougWeller]

I have the CrowT Trojan -- NOD32 keeps giving me alerts about services.dll, I click on delete, it says it will be deleted when I reboot. And then the Alert window comes up again and again and again.

Rebooting doesn't have any effect. System restore doesn't work (XP Pro SP1).

An email to ESET has had no response.

I'm pretty upset that it got through NOD32 anyway, and really upset that I can't get rid of it.

Counterspy also detects it although it gives it another name -- it also detects a Trojan on services.exe -- it also fails to clean them.

Can anyone help?

Thanks

[pykko]

DougWEller
Boot in safe mode and run a scan there with all settings. ;)
NOD32 should clean the trojan.

EDIT: can you give the exact path to the malware? Where is this services.dll located ?

[Blackspear]

Could you please check your settings against those found HERE (http://www.wilderssecurity.com/showthread.php?t=37509) after this please run a scan in "SAFE MODE" by clicking on Start> All Programs> Eset> NOD32> Scan and clean

Let us know how you go...

Cheers ;D

[pykko]

you could at least quote my words Balckspear. ;D

[DougWeller]

Thanks. I'm at work right now and will do that when I get home.

Doug

[pykko]

we're waiting for the result. ;)

[DougWeller]

I should have added that my settings should be the same, I think I followed your advice a while ago.

[Marcos]

Please PM the email address you sent your query to along with your email address. I'm not aware of having received a query re. such a sample.

[DougWeller]

{QUOTE-> Could you please check your settings against those found HERE (http://www.wilderssecurity.com/showthread.php?t=37509) after this please run a scan in "SAFE MODE" by clicking on Start> All Programs> Eset> NOD32> Scan and clean

Let us know how you go...

Cheers ;D <-QUOTE}

Well, I couldn't run the Nod32 Control Centre, it failed, but I could do a scan, and that worked! It turns out I didn't have your settings after all. Maybe that's how it got through.

So, thanks very much.

Doug

[Blackspear]

{QUOTE-> Well, I couldn't run the Nod32 Control Centre, it failed, but I could do a scan, and that worked! It turns out I didn't have your settings after all. Maybe that's how it got through.

So, thanks very much.

Doug <-QUOTE}My pleasure Doug, did the scan clean everything out?

Cheers ;D

[DougWeller]

Yes, all is well and I ran CounterSpy overnight which found nothing at all!
Now to set up my wife's NOD32 the same way.

Thanks again.

Doug