HELP!!!

i got NOD32 antivirus system warning: AMON - File system monitor showing that i have a threat Win32/TrojanDropper.VB.NAI and norton anti virus shows its W32.Alcra.F and is unable to repair it.... I have tried everything i have read on the web about it and can't get rid of it.... it keeps sreading slowing down my pc HELP

 

i have version 2.5 and it does not let me clean, quarentine, delet or anything....

 

Could you please tell us where is file located? Have you tried running in-depth scan of your computer with NOD32 on-demand scanner?
Btw, are you running NORTON and AMON both in realtime ?

 

Try running the scan in safe mode. Boot into safe mode without networking. Then run an on demand scan.

 

Yes , it won't because this is loaded in the memory . You have to boot in Safe Mode immediately and perform full scan .
How to boot your computer in SAFE MODE
Do this by repeatedly typing F8 while Windows is starting before
Windows logo appears.
Then you'll open the Windows Advanced menu where you can choose to boot
the hard drive in SAFE MODE



I suggest you use the so called "My profile" and configure it to scan

as show in the screenshots + see this link:

https://www.wilderssecurity.com/showthread.php?t=37509&page=3


In addition to NOD32 , please download , install , update and use Ad-Aware SE Personal by Lavasoft
http://www.lavasoftusa.com

 

Number 2

 

HiTech_boy your definitions are a little bit out-dated. (1.1089 and 1.1096)

 

I think he took them from Blackspear's guide

 

uuu...he's a little stealer.

 

Yup, I recognize those red arrows and blue numbers anywhere

 

Any chance you could post a screenshot of the AMON alert window you get here?

 

how do i post a screen shot??

 

well, when AMON appears you hit Prt Sc button on your keyboard than open Paint (Start-> All programs-> Accesories-> Paint) , go to Edit-> Paste, save the image as .gif and then go here to the forum.
Hit post reply and then Manage Attachements and Upload the image from your computer. Hope this helps you.

 

HEres the pic....on the Nod32 antivirus system warning the end tmp17.tmp file name keeps changing every time it reopens when i close it same goes for the norton antivirus object name. on the omen the infected numbe keeps growing rapidly along with the scanned #.

 

Now we can see what the problem is
Norton and NOD32 are fighting each other.
I already know which one will win.
Do anything Marcos suggests and Disable, uninstall, clean out and clean up after Norton till it's gone and you should be just fine
After that I would check out Blackspears Extra Settings guide if you haven't already - it is a sticky thread near the top

Cheers

 

THANKS TO ALL..... i have deleted norton just as told, ran nod32 in safe mode as told and so far have not recieved any pop ups from NOD32 or amon. GREAT SITE GREAT HELP GREAT PEOPLE!!!! Thanks a million.

 

No worries - mine was the easy part.
Thanks for posting back to let us know all is OK now

Cheers

 

Me , too , great you are fine ( thanks to my little stealing abilities from Blackspear pics)

 

I am quite sure I have this same trojan. Last week I downloaded a study guide from BearShare, now I made the unbeleivably stupid assumption that malware is only bundled on pirated software on P2P. I also knew that exe's were commonly known to have viruses, and yet I installed it anyway.

Now I have popups all over the place and they are constantly downloading, absolutely killing my dialup. So the problem is NOD32 was running with fully updated definitions, yet it didn't detect anything. The funny thing is when I re-downloaded the archive and scanned the exe, it detects this particular virus you all are discussing.

I have booted in to safe mode and ran a scan, and I get the same problem as I do in normal mode: it won't delete the infected files(by this I mean the already installed malware and not the archive containing the virus). The only thing Safe Mode would do differently is let me manually delete the infected files, but of course the virus had already cloned itself or whatever it does, and reinstalled.

So has NOD32 failed or is there a solution to this?

-Also I would like to add, Dariusz82, check your temporary internet files(C:\Documents and Settings\*ACCOUNT NAME*\Local Settings\Temporary Internet Files) I am curious if NOD32 actually deleted this from your computer, since you never directed it to or anything, it just went away as you said. If I am correct then you will have numerous cookies you know you've never set, such as mine (Cookie:chris@www.ticketsnow1.com/) where I have about 200 Cookie:chris@* (of which Ad-Watch will block..not that it does much) followed by thousands of pictures and whatnot. Oh make sure you clear this folder prior to checking it for these things, trust me they will come back without you even browsing..if in fact you do still have it.

 

Hi Daze, welcome to Wilders.

Could you please check your settings against this found HERE After this please run a scan; NOD32 Control Centre> NOD32> Run NOD32> Scan and clean

Let us know how you go...

Cheers

 

I read over your guide, my NOD32 settings are configured the same way. The only thing I have different from you is that I did not enable IMON and DMON as I don't use either. I don't think this has and relevance to my problem, but if it does please let me know. Thank you.

 

So are your scan settings the same as Post number 47 to 60? and have you run a scan with these settings?

Cheers

 

Haha I didn't realize there was more than one page. I didn't have those settings configured as you did, I changed them and then did a scan and nothing was detected. It's hopeless ><

 

No, I have sent you a Private Message.

Cheers

 

VB.NAI is a quite old worm and had been detected proactively by ThreatSense from the very beginning. However, later it used to be distributed via uu-encoded email which was not scanned by NOD32, but the file was actually detected and blocked at an attempt to access the attachment.