can't quarantine some viruses. help needed urgently please!!

Discussion in 'malware problems & news' started by adcyork, May 14, 2004.

Thread Status:
Not open for further replies.
  1. adcyork

    adcyork Registered Member

    Joined:
    May 14, 2004
    Posts:
    10
    The problem is as follows. I have recently downloaded a free AVG virus scanner and after scanning my whole system it found 22 viruses. All these viruses are in a folder called "TEMP" found at C:\_RESTORE\TEMP . The names of these viruses are: Trojan horse PSW.Briss.A , Trojan horse PSW.Briss.D , Trojan horse Downloader.Dyfica.T , Trojan horse Downloader.Dyfica.W , Trojan horse PSW.Briss.E , Trojan horse Downloader.Dyfica.AA , Trojan horse Downloader.Small.5.Y , Trojan horse Downloader.Apropo.C , Trojan horse Sec Thought.G , Trojan horse Dropper.Small.4.AK most of these there seems to be more than one copy of in the "temp" folder. when i tryed to quarantine the infected files it came up with this warning mesage: "Access to this file is not allowed. the source file may be in use". i know this means that i can't: change,move or delete the files because it is in use by the computer. but how do i get access to the files so i can quarantine and delete them.
    any help would be much appreciated
    thanks
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi there!
    you might be able to get to the folder when you close AVG completely via it's console.
    I never delete anything before i sent a copy to the lab, submit@diamondcs.com.au
    Maybe you're able to zip that whole folder to get it to that address.
    Maybe you can do in safe mode.

    Next step: i guess with all that before you delete anything best to post your hijackthis log in the HJT forum overhere too; from specific files the experts might see what more to look for on your system and what to clean out.
    https://www.wilderssecurity.com/showthread.php?t=15913
    See here the instructions, especially step 2 for the HJT log part.
     
    Last edited by a moderator: May 14, 2004
  3. adcyork

    adcyork Registered Member

    Joined:
    May 14, 2004
    Posts:
    10
    I can access the "TEMP" folder but can't delete or move any of the files in it because i just get the warning message. i can view the infected files in notepad but can't do anything else with them. is there anything else you can suggest?
     
  4. snapdragin

    snapdragin Registered Member

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Last edited: May 14, 2004
  5. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Most are adware, protect yourself from getting it by following the guidelines in the Adware/Hijackers forum here at Wilders !
     
  6. UFO-Psycho2

    UFO-Psycho2 Registered Member

    Joined:
    May 15, 2004
    Posts:
    2
    i had a problem like the one you are experiencing, i couldnt delete the trojans because they were running in the background (processes), and they were running my puter at max process, 100% process, i couldnt do anything, couldnt use any programs, or they ran extremely slowwww. So without knowing for sure what would happen i clicked on one of those programs that kept maxing out my system and shut down that program by using the end process tree and that stopped all of the trojan programs, i was able to delete those programs after that, while they are running, windows will not allow you to delete a running file that is why. Then after that, i turned off the restore features on both of my drives C: and F: (my two hdd`s) and ran my AVG a/v and cleaned them out, then reenabled restore, and i have been clean since.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.