Expert: Lorry - 2/8/2008

Question
QUESTION: hi. I have what I think is a trojan and it is located in a hidden folder C:\a.bat which I cannot get rid of. This folder is not recognised and it is impossible to open or delete. Norton antivirus just says that it has recognised a trojan in this location which it cannot repair. Could you help me out?

ANSWER: Hi Shane,

You gave me the location, not the name, which is what is needed for me to help. Did Norton find W32.Spybot.AQGF or W32.Spybot.RBY?

If Norton found W32.Spybot.AQGF, the following site explains how to remove:

http://www.symantec.com/security_response/writeup.jsp?docid=2007-040311-2851-99&

If it found W32.Spybot.RBY, check out the following site for removal instructions:

http://www.symantec.com/security_response/writeup.jsp?docid=2005-062723-4833-99&

Hope this helps!
Lorry

---------- FOLLOW-UP ----------

QUESTION: Norton gives the name of the virus as "Trojan Horse" which i know is weird as usually they are called "W32.Beagle@mm!zip" or something like that. anyway norton has attempted to repair this thing but it has failed

Answer
Hi Shane,

Check out the following for removal instructions:

http://www.symantec.com/security_response/writeup.jsp?docid=2004-021914-2822-99&

If it found HTTP Trojan Horse Lodeight.C Activity, go to:

http://www.symantec.com/avcenter/attack_sigs/s22178.html

If it found DonaldD.Trojan, go to:

http://www.symantec.com/security_response/writeup.jsp?docid=2000-122015-0424-99&

Hope this helps!
Lorry