help - nod32 found win32/trojandownloader.1stbar.er

Hello all,

Hoping you can help.

I performed an indepth analysis scan and it turned up a threat named win32/trojandownloader.1stbar.er. It stated that it could be deleted, however, the delete button was inactive. The leave button was the only active option available.

I have performed scans with updated Spybot 1.3, adaware SE 1.5, tds, cwshredder and ewido all finding no threats.

Each time I have run nod32's indepth analysis, it finds the same threat in altering hard drive locations, but each time, is unable to delete the file.

I restored XP back to an earlier date and this found no threats initially on repeat indepth scans but has since shown up again.

Any ideas much appreciated.

Cheers

 

Can you please provide the full path of what was found from your log files in the Nod32 Control Centre.

Cheers

 

E:\System Volume Information\_restore{F9048497-1820-4765-91C9-C926222A4705}\RP6\A0000310.exe »NSIS »gunist.exe »NSIS »proxya.exe - Win32/TrojanDownloader.IstBar.ER trojan

C:\System Volume Information\_restore{F9048497-1820-4765-91C9-C926222A4705}\RP6\A0000317.exe »NSIS »proxya.exe - Win32/TrojanDownloader.IstBar.ER trojan

Is this the log details you requested?

Thanks

 

Hello shaussie,

Try this:
- disable the system restore
- restart your computer in safe mode
- perform a scan with Nod32, all options turned on like below (click on the 'Scan & Clean' button)
- restart your computer in normal mode
- enable the system restore

 

"Delete" button is inactive because file which contains that trojandownloader is in archive. NOD32 cannot manipulate with archives. Try to delete file manually..

 

You can't from System Restore, simply turning it off and rebooting should resolve this issue.

Cheers

 

Ups, I did not notice where are files located.

 

Cheers everybody for your help - that seems to have solved my problem.

Thanks again all,

 

Thanks for the feedback