-
February 16th, 2007, 03:50 AM
#1
Junior Member
trojan double post sorry
it comes up cp1041.nls
mutant Trojan.DL.OBFU.......
all AV and antispy tried so far won't touch it.
can anyone recomend somthing?
ashampoo cant even find it
pc tools AV says its in memory,
zone alarm ,norton, mckafee , no good.
they find it ,just can't clean it?
almost ready to reformat.
Last edited by danseur35; February 16th, 2007 at 03:56 AM.
Reason: double post
-
February 16th, 2007, 04:28 AM
#2
Well,
Of course they can't "clean" it (if that is what you really mean), it is pure malware................let them delete it.
This should work as it is supposed to have a fully functional trial period:
http://www.superadblocker.com/C/CP1041.NLS-10076.html
EDIT: for future reference with this sort of thing create bookmarks to:
http://virusscan.jotti.org/ and:
http://www.virustotal.com/en/indexx.html
If you capture a sample of the suspicious file and submit it to these sites, they will run it through a variety of AV products and you will see which ones would be likely to work............it would be a waste of time to run any of those that do not report it as malware.
Last edited by nihil; February 16th, 2007 at 04:41 AM.
-
February 16th, 2007, 05:26 AM
#3
Junior Member
thankyou nihil,
will try those.
yes it was a poor use of words,
I mean't they couldent delete it.
even after reboot.
d35
-
February 16th, 2007, 07:19 AM
#4
OK d35, I understand you now
Please get this utility if you have problems with deleting anything:
http://www.diamondcs.com.au/index.php?page=apt
It is free
-
February 19th, 2007, 01:30 AM
#5
Junior Member
I had the same problem. Check windows\system32\drivers\ndis.sys, mine was
patched to about 260 kb, should be 179 kb. If it is patched, reboot to safe mode, copy correct ndis.sys from dllcache to drivers, delete cp1041.nls,
reboot and hopefully the problem is gone.
This fixed the problem on my computer, but use at your own risk.
/DaGnome
-
February 22nd, 2007, 01:48 AM
#6
Junior Member
no dice
I tried the lot,
the owner did'nt want to try anymore.
this was a school loaner box.
had to reformat, loaded him with as/av ware.
keeping my fingers crossed. I was going to add site blocker,
unfourtunatly, he wiped his broser history so I never did find out where he
got it. I think I got a copy to send virustotal, but I am going to wait until I get a sacraficial box. It was to hard to kill to risk lossing on a good one.
as allways THANKYOU! to all who tried.
end it.
d35
Similar Threads
-
By GbinaryR in forum AntiVirus Discussions
Replies: 11
Last Post: October 30th, 2008, 09:33 AM
-
By ThePreacher in forum Miscellaneous Security Discussions
Replies: 17
Last Post: December 14th, 2006, 09:37 PM
-
By MrLinus in forum AntiVirus Discussions
Replies: 1
Last Post: October 12th, 2004, 05:26 AM
-
By LordChaos in forum Firewall & Honeypot Discussions
Replies: 19
Last Post: October 4th, 2002, 11:58 AM
-
By [WebCarnage] in forum Security Archives
Replies: 0
Last Post: January 10th, 2002, 09:10 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|