Virus Problem

Got a problem here. My norton is acting fucked up, a virus popped up today and I've tried everything to get rid of it. There's even a tool avail. from Symantec to get rid of that specific virus, but it doesnt work (shows a "virus" not found error). The virus itself is Trojan.Vundo and seems to be in the C:\WINDOWS\Cursors\ folder in a file called unnet.dll. I've tried everything to get rid of that dll, from safe mode, to task manager, to even that file that symantec offers, so far nothing. I can't even find the registry keys that its supposed to have created.

But that's not the bad part, the bad part is, the stupid Norton display box (that tells you of any viruses/spyware found) keeps popping up, I click ok on it and it pops right back up a nanosecond later. The first message is "Access to file was denied" then I click ok, and then another box comes up saying "Unable to repair this file" and then it just keeps repeating those two boxes, and it's always "on top" of any application I'm running. Any suggestions? Starting to piss me off.:angry:

try running a Hi Jack this scan and full adaware scans to see if they can get rid of it

im working on it rite now, it's not the actual virus that's worrying me, it's that norton is being a stupid bitch and keeps popping up w/ that mesage. its' really annoying, i'm running home scan from trend micro. then ill do adaware and hi jack this.

My friend had that same shit and cant get rid of it.

when youve sorted the problem, uninstall norton and get avast :) lol

When after the message proclaiming "access is denied" ever starts rearing it's ugly head, that is usually the first sign to go into "safemode" and attempt removing it from there. As a matter of fact, I would wager that Symantec even suggested such a thing when utilizing their "tool". That as well as disabling any "system restore" functions. You can also go into the "properties" for that specific file and uncheck the box that reads "read only". Which may aid in removing it.

Applications such as Sunbelt's "Counterspy" and Microsoft's "Antispyware beta", which unlike Norton and similiar anti-virus products, are geared specifically towards detecting/removing these malwares, are more suitable, IMO.

ok thanks izagaia, i'll do the "read only" option since I've tried safe mode (and my system restore is always off) and i still cant get rid of it (says an application is using it) i used process explorer to see what is using unnet.dll (both in normal and safe mode) and it seems explorer.exe and winlogon.exe are both using it, cant do anything about that because i dont know how to end a process that's "within" a process. Hopefully going to properties and doing the "read only" method might get rid of it. Ill post back, it's really starting to piss me off now.

edit: it's already unchecked, ill see what happens when i check the box, there is also an "advanced" button but i wont go in there, not just yet anyway.

edit edit: ok checking it seems to do nothing because after i hit apply then ok then go back into properties again it's still unchecked, ill try in safe mode. be back in 5 min. (this is really getting on my nerves, i honestly dont care for this virus since its low risk, its just the stupid security pop up box from norton that's pissing me off)

Norton blows ass, get Kaspersky or NOD32 :)

If this malware is a "start up" process, you may want to also attempt going into "msconfig" and then killing it from there. If successful, then you may (not too certain) be able to remove the actual file afterwards.

So far as "killing explorer.exe", you can do that safely from the taskmanager. Explorer merely restarts itself. Once in awhile I am able to remove "persistent" items by quickly navigating to it then after explorer starts and deleting it before the actual process starts. Perhaps you may be able to move the file to your desktop, kill explorer, then delete the file immediately before the process starts again. A long shot, however you have nothing to lose and it certainly will not harm windows.

Ok ill give it a try, however I dont think i can move it to desktop because it wont let me rename/delete in first place, ill give it a go. I kill explorer all the time, however, if i do that then i cant access windows explorer or my computer, etc. unless i restart explorer from task manager (new task). I'll try msconfig, I think you're right about it being a startup process. ill post back. as for new AV

what's the best? Avast? NOD32? Kaspersky??? Please post what you think is the best and most effective one (and if I can get updates using a crack :) )

edit: My friend said to check out Platinum Internet Security 2005 by Panda Software, apparently its the best right now. Is it?